upgrade gitea and drop bitnami postgres

.drone.yml

@@ -15,7 +15,7 @@ trigger:
 
 steps:
 - name: terraform init
-  image: hashicorp/terraform:1.1.8
+  image: hashicorp/terraform:1.3.5
   commands:
     - echo "$${CI_SSH_KEY}" | base64 -d > id_rsa
     - chmod 600 id_rsa
@@ -29,7 +29,7 @@ steps:
       from_secret: terraform-aws-secret-access-key
 
 - name: terraform plan
-  image: hashicorp/terraform:1.1.8
+  image: hashicorp/terraform:1.3.5
   commands:
     - terraform plan $([[ $${DRONE_BUILD_EVENT} = cron ]] && echo "-detailed-exitcode") -out .tfplan
   environment:
@@ -46,7 +46,7 @@ steps:
     - main
     event:
     - push
-  image: hashicorp/terraform:1.1.8
+  image: hashicorp/terraform:1.3.5
   commands:
     - terraform apply .tfplan
   environment:
@@ -71,7 +71,7 @@ trigger:
 
 steps:
 - name: format and generate docs
-  image: hashicorp/terraform:1.1.8
+  image: hashicorp/terraform:1.3.5
   commands:
     - apk add bash wget 
     - wget -q https://github.com/terraform-docs/terraform-docs/releases/download/v0.16.0/terraform-docs-v0.16.0-linux-amd64.tar.gz -O - | tar -xz terraform-docs -C /usr/local/bin
@@ -81,6 +81,6 @@ steps:
 
 ---
 kind: signature
-hmac: 431052d1fbb96d0752009696c855c4611f87c5474f5574d03611164511c94688
+hmac: aa6fd4b3cac36e71753a8fda8188a91a9bb977788d857f5756596c1798d27367
 
 ...

.terraform.lock.hcl

@@ -0,0 +1,81 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "4.9.0"
+  constraints = "~> 4.9.0"
+  hashes = [
+    "h1:GtmIOZMkKmr9tMLWouHWiGXmKEL/diOTNar5XfOVLjs=",
+    "zh:084b83aef3335ad4f5e4b8323c6fe43c1ff55e17a7647c6a5cad6af519f72b42",
+    "zh:132e47ce69f14de4523b84b213cedf7173398acda14245b1ffe7747aac50f050",
+    "zh:2068baef7dfce3613f3b4f27314175e971f8db68d9cde9ec30b5659f80c68c6c",
+    "zh:63c6f489683d5f1ac55e82a0df387143ed22701d5f22c109a4d5c9924dd4e437",
+    "zh:8115fd21965954fa4568c09331e05bb29da967fab8d077419aed09954378e216",
+    "zh:8efdc95fde108f777ed9c79ae25dc17aea9771903250f5c5c8a4c726b90a345f",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:9d42a7bc34d84b70c1d1bcc215cabd63abbcbd0352b70bd84da6c3916634932f",
+    "zh:aacbcceb241aa475888c0869e87593182edeced3170c76a0c960dd9c905df449",
+    "zh:c7fe7904511052e4102870256819a1917177572cf684f0611ebf767f9c1fbaa8",
+    "zh:c8e07c3424663d1d0e7e32f4ade8099c19f6326d37c6da98104d90c986ff66fc",
+    "zh:e47cafbd38b56ef14fd8d727b4ffea847c166b1c684f585ee5fb78983b537248",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/helm" {
+  version     = "2.8.0"
+  constraints = "2.8.0"
+  hashes = [
+    "h1:abRryu69lsIGXctqjMVoaKqi74eE12Vzd2FLpds1/PI=",
+    "zh:1e42d1a04c07d4006844e477ca32b5f45b04f6525dbbbe00b6be6e6ec5a11c54",
+    "zh:2f87187cb48ccfb18d12e2c4332e7e822923b659e7339b954b7db78aff91529f",
+    "zh:391fe49b4d2dc07bc717248a3fc6952189cfc49c596c514ad72a29c9a9f9d575",
+    "zh:89272048e1e63f3edc3e83dfddd5a9fd4bd2a4ead104e67de1e14319294dedf1",
+    "zh:a5a057c3435a854389ce8a1d98a54aaa7cbab68aca7baa436a605897aa70ff7e",
+    "zh:b1098e53e1a8a3afcd325ecd0328662156b3d9c3d80948f19ba3a4eb870cee2b",
+    "zh:b676f949e8274a2b6c3fa41f5428ea597125579c7b93bb50bb73a5e295a7a447",
+    "zh:cdf7e9460f28c2dbfe49a79a5022bd0d474ff18120d340738aa35456ba77ebca",
+    "zh:e24b59b4ed1c593facbf8051ec58550917991e2e017f3085dac5fb902d9908cb",
+    "zh:e3b5e1f5543cac9d9031a028f1c1be4858fb80fae69f181f21e9465e366ebfa2",
+    "zh:e9fddc0bcdb28503078456f0088851d45451600d229975fd9990ee92c7489a10",
+    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/kubernetes" {
+  version     = "2.16.1"
+  constraints = "~> 2.11, ~> 2.16.1"
+  hashes = [
+    "h1:i+DwtJK82sIWmTcQA9lL0mlET+14/QpUqv10fU2o3As=",
+    "zh:06224975f5910d41e73b35a4d5079861da2c24f9353e3ebb015fbb3b3b996b1c",
+    "zh:2bc400a8d9fe7755cca27c2551564a9e2609cfadc77f526ef855114ee02d446f",
+    "zh:3a479014187af1d0aec3a1d3d9c09551b801956fe6dd29af1186dec86712731b",
+    "zh:73fb0a69f1abdb02858b6589f7fab6d989a0f422f7ad95ed662aaa84872d3473",
+    "zh:a33852cd382cbc8e06d3f6c018b468ad809d24d912d64722e037aed1f9bf39db",
+    "zh:b533ff2214dca90296b1d22eace7eaa7e3efe5a7ae9da66a112094abc932db4f",
+    "zh:ddf74d8bb1aeb01dc2c36ef40e2b283d32b2a96db73f6daaf179fa2f10949c80",
+    "zh:e720f3a15d34e795fa9ff90bc755e838ebb4aef894aa2a423fb16dfa6d6b0667",
+    "zh:e789ae70a658800cb0a19ef7e4e9b26b5a38a92b43d1f41d64fc8bb46539cefb",
+    "zh:e8aed7dc0bd8f843d607dee5f72640dbef6835a8b1c6ea12cea5b4ec53e463f7",
+    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+    "zh:fb3ac4f43c8b0dfc0b0103dd0f062ea72b3a34518d4c8808e3a44c9a3dd5f024",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/random" {
+  version = "3.4.3"
+  hashes = [
+    "h1:xZGZf18JjMS06pFa4NErzANI98qi59SEcBsOcS2P2yQ=",
+    "zh:41c53ba47085d8261590990f8633c8906696fa0a3c4b384ff6a7ecbf84339752",
+    "zh:59d98081c4475f2ad77d881c4412c5129c56214892f490adf11c7e7a5a47de9b",
+    "zh:686ad1ee40b812b9e016317e7f34c0d63ef837e084dea4a1f578f64a6314ad53",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:84103eae7251384c0d995f5a257c72b0096605048f757b749b7b62107a5dccb3",
+    "zh:8ee974b110adb78c7cd18aae82b2729e5124d8f115d484215fd5199451053de5",
+    "zh:9dd4561e3c847e45de603f17fa0c01ae14cae8c4b7b4e6423c9ef3904b308dda",
+    "zh:bb07bb3c2c0296beba0beec629ebc6474c70732387477a65966483b5efabdbc6",
+    "zh:e891339e96c9e5a888727b45b2e1bb3fcbdfe0fd7c5b4396e4695459b38c8cb1",
+    "zh:ea4739860c24dfeaac6c100b2a2e357106a89d18751f7693f3c31ecf6a996f8d",
+    "zh:f0c76ac303fd0ab59146c39bc121c5d7d86f878e9a69294e29444d4c653786f8",
+    "zh:f143a9a5af42b38fed328a161279906759ff39ac428ebcfe55606e05e1518b93",
+  ]
+}

README.md

@@ -19,13 +19,13 @@ The following requirements are needed by this module:
 
 The following providers are used by this module:
 
-- <a name="provider_aws"></a> [aws](#provider\_aws) (~> 4.9.0)
+- <a name="provider_aws"></a> [aws](#provider\_aws) (4.9.0)
 
-- <a name="provider_helm"></a> [helm](#provider\_helm) (~> 2.5.1)
+- <a name="provider_helm"></a> [helm](#provider\_helm) (2.5.1)
 
-- <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) (~> 2.11.0)
+- <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) (2.11.0)
 
-- <a name="provider_random"></a> [random](#provider\_random)
+- <a name="provider_random"></a> [random](#provider\_random) (3.4.3)
 
 ## Modules
 

gitea.tf

@@ -5,25 +5,30 @@ resource "kubernetes_namespace" "this" {
 }
 
 resource "helm_release" "this" {
-  name      = "gitea"
+  name      = local.instance_name
   namespace = kubernetes_namespace.this.metadata.0.name
 
   repository = "https://dl.gitea.io/charts/"
   chart      = "gitea"
-  version    = "5.0.0"
+  version    = "12.4.0"
 
   create_namespace = false
 
+  set {
+    name  = "clusterDomain"
+    value = "k8s.lawndale"
+  }
+
   values = [
     jsonencode({
       ingress = {
-        enabled = true
+        enabled   = true
+        className = "traefik"
         annotations = {
-          "kubernetes.io/ingress.class"                             = "traefik"
           "traefik.ingress.kubernetes.io/router.entrypoints"        = "websecure"
           "traefik.ingress.kubernetes.io/router.tls"                = "true"
-          "traefik.ingress.kubernetes.io/router.tls.certresolver"   = "acme-thomasklein-me"
           "traefik.ingress.kubernetes.io/router.tls.domains.0.main" = local.ingress_domain
+          "cert-manager.io/cluster-issuer"                          = "acme-thomasklein-me"
         }
         hosts = [
           {
@@ -36,6 +41,27 @@ resource "helm_release" "this" {
             ]
           }
         ]
+        tls = [
+          {
+            secretName = "git-thomasklein-me-tls"
+            hosts = [
+              local.ingress_domain
+            ]
+          }
+        ]
+      }
+      service = {
+        http = {
+          internalTrafficPolicy = "Cluster"
+        }
+      }
+    }),
+    jsonencode({
+      service = {
+        ssh = {
+          type                  = "LoadBalancer"
+          externalTrafficPolicy = "Local"
+        }
       }
     }),
     jsonencode({
@@ -65,10 +91,10 @@ resource "helm_release" "this" {
             ISSUE_INDEXER_TYPE = "db" # bleve doesn't like 9p filesystems :/
           }
           metrics = {
-              ENABLED = false ## the metrics not really worth it
+            ENABLED = false ## the metrics are not really worth it
           }
           service = {
-              DISABLE_REGISTRATION = true
+            DISABLE_REGISTRATION = true
           }
         }
         admin = {
@@ -77,29 +103,83 @@ resource "helm_release" "this" {
         }
       }
     }),
+    jsonencode({
+      gitea = {
+        config = {
+          mailer = {
+            ENABLED   = true
+            FROM      = "gitea@git.thomasklein.me"
+            PROTOCOL  = "smtp"
+            SMTP_ADDR = "nat.lawndale"
+            SMTP_PORT = "25"
+          }
+        }
+      }
+    }),
     jsonencode({
       persistence = {
-        enabled       = true
+        enabled   = true
-        existingClaim = module.gitea_persistance.pvc_name
+        create    = false
+        claimName = module.gitea_persistance.pvc_name
       }
     }),
     jsonencode({
       postgresql = {
-        enabled = true
+        enabled = false
-        persistence = {
+      }
-          enabled       = true
+      "postgresql-ha" = {
-          existingClaim = module.postgres_persistance.pvc_name
+        enabled = false
-        }
+      }
-        podSecurityContext = {
+      "redis-cluster" = {
-          enabled = true
+        enabled = false
-        }
+      }
-        volumePermissions = {
+      "valkey-cluster" = {
-          enabled = true
+        enabled = false
+      }
+      "valkey" = {
+        enabled = false
+      }
+    }),
+    # Non-HA config base, see https://gitea.com/gitea/helm-chart/src/tag/v10.1.4#single-pod-configurations 
+    jsonencode({
+      gitea = {
+        config = {
+          database = {
+            DB_TYPE = "postgres"
+            NAME = local.postgresql_dbname
+            HOST = "${kubernetes_service.postgresql.metadata.0.name}.${kubernetes_namespace.this.metadata.0.name}.svc.k8s.lawndale"
+          }
+          session = {
+            PROVIDER = "db"
+          }
+          cache = {
+            ADAPTER = "memory"
+          }
+          queue = {
+            TYPE = "level"
+          }
+          indexer = {
+            ISSUE_INDEXER_TYPE   = "bleve"
+            REPO_INDEXER_ENABLED = true
+          }
         }
       }
     }),
   ]
 
+  set_sensitive {
+    name = "gitea.config.database.PASSWD"
+    value = random_password.postgresql.result
+  }
+
+  # set_sensitive {
+  #   name  = "postgresql.global.postgresql.auth.password"
+  #   value = random_password.postgresql_gitea.result
+  # }
+  # set_sensitive {
+  #   name  = "postgresql.global.postgresql.auth.postgresPassword"
+  #   value = random_password.postgresql.result
+  # }
   set_sensitive {
     name  = "gitea.oauth[0].key"
     value = aws_cognito_user_pool_client.gitea.id
@@ -115,6 +195,14 @@ resource "helm_release" "this" {
   }
 }
 
+resource "random_password" "postgresql_gitea" {
+  length = 5
+}
+
+resource "random_password" "postgresql" {
+  length = 10
+}
+
 resource "random_password" "gitea_admin" {
   length  = 16
   special = true

locals.tf

@@ -1,5 +1,6 @@
 locals {
   ingress_domain = "git.thomasklein.me"
+  instance_name = "gitea"
 }
 
 data "aws_region" "current" {}

postgresql.tf

@@ -0,0 +1,186 @@
+locals {
+  postgresql_user    = "gitea"
+  postgresql_version = "18"
+  postgresql_dbname  = "gitea"
+}
+resource "kubernetes_service" "postgresql_headless" {
+  metadata {
+    name      = "${local.instance_name}-postgresql-hl"
+    namespace = kubernetes_namespace.this.metadata.0.name
+    labels = {
+      "app.kubernetes.io/instance"   = local.instance_name
+      "app.kubernetes.io/managed-by" = "terraform"
+      "app.kubernetes.io/version"    = local.postgresql_version
+      "app.kubernetes.io/name"       = "postgresql"
+    }
+  }
+  spec {
+    type       = "ClusterIP"
+    cluster_ip = null
+    selector = {
+      "app.kubernetes.io/instance" = local.instance_name
+      "app.kubernetes.io/name"     = "postgresql"
+    }
+    port {
+      name        = "tcp-postgresql"
+      port        = 5432
+      protocol    = "TCP"
+      target_port = "tcp-postgresql"
+    }
+  }
+}
+
+resource "kubernetes_service" "postgresql" {
+  metadata {
+    name      = "${local.instance_name}-postgresql"
+    namespace = kubernetes_namespace.this.metadata.0.name
+    labels = {
+      "app.kubernetes.io/instance"   = local.instance_name
+      "app.kubernetes.io/managed-by" = "terraform"
+      "app.kubernetes.io/version"    = local.postgresql_version
+      "app.kubernetes.io/name"       = "postgresql"
+    }
+  }
+  spec {
+    type       = "ClusterIP"
+    selector = {
+      "app.kubernetes.io/instance" = local.instance_name
+      "app.kubernetes.io/name"     = "postgresql"
+    }
+    port {
+      name        = "tcp-postgresql"
+      port        = 5432
+      protocol    = "TCP"
+      target_port = "tcp-postgresql"
+    }
+  }
+}
+
+resource "kubernetes_secret" "postgresql" {
+  metadata {
+    namespace = kubernetes_namespace.this.metadata.0.name
+    name      = "${local.instance_name}-postgresql"
+  }
+  data = {
+    password = sensitive(random_password.postgresql.result)
+  }
+}
+
+resource "kubernetes_stateful_set" "postgresql" {
+  metadata {
+    namespace = kubernetes_namespace.this.metadata.0.name
+    name      = "${local.instance_name}-postgresql"
+    labels = {
+      "app.kubernetes.io/instance"   = local.instance_name
+      "app.kubernetes.io/managed-by" = "terraform"
+      "app.kubernetes.io/version"    = local.postgresql_version
+      "app.kubernetes.io/name"       = "postgresql"
+    }
+  }
+  spec {
+    replicas = 1
+    selector {
+      match_labels = {
+        "app.kubernetes.io/instance" = local.instance_name
+        "app.kubernetes.io/name"     = "postgresql"
+      }
+    }
+    service_name = kubernetes_service.postgresql.metadata.0.name
+    
+    template {
+      metadata {
+        labels = {
+          "app.kubernetes.io/instance"   = local.instance_name
+          "app.kubernetes.io/managed-by" = "terraform"
+          "app.kubernetes.io/version"    = local.postgresql_version
+          "app.kubernetes.io/name"       = "postgresql"
+        }
+        name = "${local.instance_name}-postgresql"
+      }
+      spec {
+        automount_service_account_token = false
+        container {
+          name              = "postgresql"
+          image             = "docker.io/library/postgres:${local.postgresql_version}-trixie"
+          image_pull_policy = "IfNotPresent"
+
+          env {
+            name  = "POSTGRES_DB"
+            value = local.postgresql_dbname
+          }
+          env {
+            name  = "POSTGRES_USER"
+            value = local.postgresql_user
+          }
+          env {
+            name = "POSTGRES_PASSWORD"
+            value_from {
+              secret_key_ref {
+                key  = "password"
+                name = kubernetes_secret.postgresql.metadata.0.name
+              }
+            }
+          }
+          port {
+            container_port = 5432
+            protocol       = "TCP"
+            name           = "tcp-postgresql"
+          }
+          volume_mount {
+            name       = "data"
+            mount_path = "/var/lib/postgresql"
+          }
+          # volume_mount {
+          #   name       = "data"
+          #   mount_path = "/var/lib/postgresql/data"
+          #   sub_path   = "data"
+          # }
+          # resources {
+          #   limits = {
+          #     "cpu" = "1"
+          #     "memory" = "1Gi"
+          #   }
+          # }
+          liveness_probe {
+            failure_threshold     = 6
+            initial_delay_seconds = 30
+            period_seconds        = 15
+            timeout_seconds       = 10
+            exec {
+              command = [
+                "/bin/sh",
+                "-c",
+                "exec pg_isready -U ${local.postgresql_user} -d 'dbname=${local.postgresql_dbname}' -h 127.0.0.1 -p 5432"
+              ]
+            }
+          }
+        }
+        volume {
+          name = "data"
+          persistent_volume_claim {
+            claim_name = module.postgres_persistance.pvc_name
+          }
+        }
+      }
+    }
+  }
+}
+
+
+# image = {
+#   tag = "12.20.0-debian-12-r26"
+# }
+# primary = {
+#   persistence = {
+#     enabled       = true
+#     existingClaim = module.postgres_persistance.pvc_name
+#     claimName     = module.postgres_persistance.pvc_name
+#   }
+#   podSecurityContext = {
+#     enabled = true
+#   }
+#   volumePermissions = {
+#     enabled = true
+#   }
+# }
+      

provider.tf

@@ -7,12 +7,12 @@ terraform {
 
     helm = {
       source  = "hashicorp/helm"
-      version = "~> 2.5.1"
+      version = "2.8.0"
     }
 
     kubernetes = {
       source  = "hashicorp/kubernetes"
-      version = "~> 2.11.0"
+      version = "~> 2.16.1"
     }
 
   }

ssh-ingresstcproute.tf

@@ -1,26 +0,0 @@
-resource "kubernetes_manifest" "ingress_tcp_route" {
-    manifest = {
-        apiVersion = "traefik.containo.us/v1alpha1"
-        kind = "IngressRouteTCP"
-        metadata = {
-            name = "gitea-ssh"
-            namespace = kubernetes_namespace.this.metadata.0.name
-        }
-        spec = {
-            entryPoints = [
-                "gitssh",
-            ]
-            routes: [
-                {
-                    match = "HostSNI(`*`)"
-                    services = [
-                        {
-                            name = "gitea-ssh"
-                            port = 22
-                        }
-                    ]
-                }
-            ]
-        }
-    }
-}