upgrade gitea and drop bitnami postgres

fix: pinning postgresql
fix traffic policy
2025-11-08 01:26:59 +01:00 · 2025-01-15 07:18:11 +01:00 · 2025-01-15 07:17:56 +01:00 · 2025-01-15 07:00:19 +01:00 · 2023-03-25 01:05:32 +01:00 · 2023-01-22 13:48:10 +01:00
7 changed files with 328 additions and 79 deletions
--- a/.terraform.lock.hcl
+++ b/.terraform.lock.hcl
@@ -22,42 +22,42 @@ provider "registry.terraform.io/hashicorp/aws" {
 }

 provider "registry.terraform.io/hashicorp/helm" {
-  version     = "2.5.1"
-  constraints = "~> 2.5.1"
+  version     = "2.8.0"
+  constraints = "2.8.0"
  hashes = [
-    "h1:NasRPC0qqlpGqcF3dsSoOFu7uc5hM+zJm+okd8FgrnQ=",
-    "zh:140b9748f0ad193a20d69e59d672f3c4eda8a56cede56a92f931bd3af020e2e9",
-    "zh:17ae319466ed6538ad49e011998bb86565fe0e97bc8b9ad7c8dda46a20f90669",
-    "zh:3a8bd723c21ba70e19f0395ed7096fc8e08bfc23366f1c3f06a9107eb37c572c",
-    "zh:3aae3b82adbe6dca52f1a1c8cf51575446e6b0f01f1b1f3b30de578c9af4a933",
-    "zh:3f65221f40148df57d2888e4f31ef3bf430b8c5af41de0db39a2b964e1826d7c",
-    "zh:650c74c4f46f5eb01df11d8392bdb7ebee3bba59ac0721000a6ad731ff0e61e2",
-    "zh:930fb8ab4cd6634472dfd6aa3123f109ef5b32cbe6ef7b4695fae6751353e83f",
-    "zh:ae57cd4b0be4b9ca252bc5d347bc925e35b0ed74d3dcdebf06c11362c1ac3436",
-    "zh:d15b1732a8602b6726eac22628b2f72f72d98b75b9c6aabceec9fd696fda696a",
-    "zh:d730ede1656bd193e2aea5302acec47c4905fe30b96f550196be4a0ed5f41936",
-    "zh:f010d4f9d8cd15936be4df12bf256cb2175ca1dedb728bd3a866c03d2ee7591f",
+    "h1:abRryu69lsIGXctqjMVoaKqi74eE12Vzd2FLpds1/PI=",
+    "zh:1e42d1a04c07d4006844e477ca32b5f45b04f6525dbbbe00b6be6e6ec5a11c54",
+    "zh:2f87187cb48ccfb18d12e2c4332e7e822923b659e7339b954b7db78aff91529f",
+    "zh:391fe49b4d2dc07bc717248a3fc6952189cfc49c596c514ad72a29c9a9f9d575",
+    "zh:89272048e1e63f3edc3e83dfddd5a9fd4bd2a4ead104e67de1e14319294dedf1",
+    "zh:a5a057c3435a854389ce8a1d98a54aaa7cbab68aca7baa436a605897aa70ff7e",
+    "zh:b1098e53e1a8a3afcd325ecd0328662156b3d9c3d80948f19ba3a4eb870cee2b",
+    "zh:b676f949e8274a2b6c3fa41f5428ea597125579c7b93bb50bb73a5e295a7a447",
+    "zh:cdf7e9460f28c2dbfe49a79a5022bd0d474ff18120d340738aa35456ba77ebca",
+    "zh:e24b59b4ed1c593facbf8051ec58550917991e2e017f3085dac5fb902d9908cb",
+    "zh:e3b5e1f5543cac9d9031a028f1c1be4858fb80fae69f181f21e9465e366ebfa2",
+    "zh:e9fddc0bcdb28503078456f0088851d45451600d229975fd9990ee92c7489a10",
    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
  ]
 }

 provider "registry.terraform.io/hashicorp/kubernetes" {
-  version     = "2.11.0"
-  constraints = "~> 2.11.0, ~> 2.11"
+  version     = "2.16.1"
+  constraints = "~> 2.11, ~> 2.16.1"
  hashes = [
-    "h1:pJiAJwZKUaoAJ4x+3ONJkwEVkjrwGROCGFgj7noPO58=",
-    "zh:143a19dd0ea3b07fc5e3d9231f3c2d01f92894385c98a67327de74c76c715843",
-    "zh:1fc757d209e09c3cf7848e4274daa32408c07743698fbed10ee52a4a479b62b6",
-    "zh:22dfebd0685749c51a8f765d51a1090a259778960ac1cd4f32021a325b2b9b72",
-    "zh:3039b3b76e870cd8fc404cf75a29c66b171c6ba9b6182e131b6ae2ca648ec7c0",
-    "zh:3af0a15562fcab4b5684b18802e0239371b2b8ff9197ed069ff4827f795a002b",
-    "zh:50aaf20336d1296a73315adb66f7687f75bd5c6b1f93a894b95c75cc142810ec",
-    "zh:682064fabff895ec351860b4fe0321290bbbb17c2a410b62c9bea0039400650e",
-    "zh:70ac914d5830b3371a2679d8f77cc20c419a6e12925145afae6c977c8eb90934",
-    "zh:710aa02cccf7b0f3fb50880d6d2a7a8b8c9435248666616844ba71f74648cddc",
-    "zh:88e418118cd5afbdec4984944c7ab36950bf48e8d3e09e090232e55eecfb470b",
-    "zh:9cef159377bf23fa331f8724fdc6ce27ad39a217a4bae6df3b1ca408fc643da6",
+    "h1:i+DwtJK82sIWmTcQA9lL0mlET+14/QpUqv10fU2o3As=",
+    "zh:06224975f5910d41e73b35a4d5079861da2c24f9353e3ebb015fbb3b3b996b1c",
+    "zh:2bc400a8d9fe7755cca27c2551564a9e2609cfadc77f526ef855114ee02d446f",
+    "zh:3a479014187af1d0aec3a1d3d9c09551b801956fe6dd29af1186dec86712731b",
+    "zh:73fb0a69f1abdb02858b6589f7fab6d989a0f422f7ad95ed662aaa84872d3473",
+    "zh:a33852cd382cbc8e06d3f6c018b468ad809d24d912d64722e037aed1f9bf39db",
+    "zh:b533ff2214dca90296b1d22eace7eaa7e3efe5a7ae9da66a112094abc932db4f",
+    "zh:ddf74d8bb1aeb01dc2c36ef40e2b283d32b2a96db73f6daaf179fa2f10949c80",
+    "zh:e720f3a15d34e795fa9ff90bc755e838ebb4aef894aa2a423fb16dfa6d6b0667",
+    "zh:e789ae70a658800cb0a19ef7e4e9b26b5a38a92b43d1f41d64fc8bb46539cefb",
+    "zh:e8aed7dc0bd8f843d607dee5f72640dbef6835a8b1c6ea12cea5b4ec53e463f7",
    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+    "zh:fb3ac4f43c8b0dfc0b0103dd0f062ea72b3a34518d4c8808e3a44c9a3dd5f024",
  ]
 }

--- a/README.md
+++ b/README.md
@@ -19,13 +19,13 @@ The following requirements are needed by this module:

 The following providers are used by this module:

- <a name="provider_aws"></a> [aws](#provider\_aws) (~> 4.9.0)
+- <a name="provider_aws"></a> [aws](#provider\_aws) (4.9.0)

- <a name="provider_helm"></a> [helm](#provider\_helm) (~> 2.5.1)
+- <a name="provider_helm"></a> [helm](#provider\_helm) (2.5.1)

- <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) (~> 2.11.0)
+- <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) (2.11.0)

- <a name="provider_random"></a> [random](#provider\_random)
+- <a name="provider_random"></a> [random](#provider\_random) (3.4.3)

 ## Modules

--- a/gitea.tf
+++ b/gitea.tf
@@ -5,25 +5,30 @@ resource "kubernetes_namespace" "this" {
 }

 resource "helm_release" "this" {
-  name      = "gitea"
+  name      = local.instance_name
  namespace = kubernetes_namespace.this.metadata.0.name

  repository = "https://dl.gitea.io/charts/"
  chart      = "gitea"
-  version    = "6.0.3"
+  version    = "12.4.0"

  create_namespace = false

+  set {
+    name  = "clusterDomain"
+    value = "k8s.lawndale"
+  }
+
  values = [
    jsonencode({
      ingress = {
        enabled   = true
+        className = "traefik"
        annotations = {
-          "kubernetes.io/ingress.class"                             = "traefik"
          "traefik.ingress.kubernetes.io/router.entrypoints"        = "websecure"
          "traefik.ingress.kubernetes.io/router.tls"                = "true"
-          "traefik.ingress.kubernetes.io/router.tls.certresolver"   = "acme-thomasklein-me"
          "traefik.ingress.kubernetes.io/router.tls.domains.0.main" = local.ingress_domain
+          "cert-manager.io/cluster-issuer"                          = "acme-thomasklein-me"
        }
        hosts = [
          {
@@ -36,6 +41,27 @@ resource "helm_release" "this" {
            ]
          }
        ]
+        tls = [
+          {
+            secretName = "git-thomasklein-me-tls"
+            hosts = [
+              local.ingress_domain
+            ]
+          }
+        ]
+      }
+      service = {
+        http = {
+          internalTrafficPolicy = "Cluster"
+        }
+      }
+    }),
+    jsonencode({
+      service = {
+        ssh = {
+          type                  = "LoadBalancer"
+          externalTrafficPolicy = "Local"
+        }
      }
    }),
    jsonencode({
@@ -65,7 +91,7 @@ resource "helm_release" "this" {
            ISSUE_INDEXER_TYPE = "db" # bleve doesn't like 9p filesystems :/
          }
          metrics = {
-              ENABLED = false ## the metrics not really worth it
+            ENABLED = false ## the metrics are not really worth it
          }
          service = {
            DISABLE_REGISTRATION = true
@@ -77,29 +103,83 @@ resource "helm_release" "this" {
        }
      }
    }),
+    jsonencode({
+      gitea = {
+        config = {
+          mailer = {
+            ENABLED   = true
+            FROM      = "gitea@git.thomasklein.me"
+            PROTOCOL  = "smtp"
+            SMTP_ADDR = "nat.lawndale"
+            SMTP_PORT = "25"
+          }
+        }
+      }
+    }),
    jsonencode({
      persistence = {
        enabled   = true
-        existingClaim = module.gitea_persistance.pvc_name
+        create    = false
+        claimName = module.gitea_persistance.pvc_name
      }
    }),
    jsonencode({
      postgresql = {
-        enabled = true
-        persistence = {
-          enabled       = true
-          existingClaim = module.postgres_persistance.pvc_name
+        enabled = false
      }
-        podSecurityContext = {
-          enabled = true
+      "postgresql-ha" = {
+        enabled = false
+      }
+      "redis-cluster" = {
+        enabled = false
+      }
+      "valkey-cluster" = {
+        enabled = false
+      }
+      "valkey" = {
+        enabled = false
+      }
+    }),
+    # Non-HA config base, see https://gitea.com/gitea/helm-chart/src/tag/v10.1.4#single-pod-configurations 
+    jsonencode({
+      gitea = {
+        config = {
+          database = {
+            DB_TYPE = "postgres"
+            NAME = local.postgresql_dbname
+            HOST = "${kubernetes_service.postgresql.metadata.0.name}.${kubernetes_namespace.this.metadata.0.name}.svc.k8s.lawndale"
+          }
+          session = {
+            PROVIDER = "db"
+          }
+          cache = {
+            ADAPTER = "memory"
+          }
+          queue = {
+            TYPE = "level"
+          }
+          indexer = {
+            ISSUE_INDEXER_TYPE   = "bleve"
+            REPO_INDEXER_ENABLED = true
          }
-        volumePermissions = {
-          enabled = true
        }
      }
    }),
  ]

+  set_sensitive {
+    name = "gitea.config.database.PASSWD"
+    value = random_password.postgresql.result
+  }
+
+  # set_sensitive {
+  #   name  = "postgresql.global.postgresql.auth.password"
+  #   value = random_password.postgresql_gitea.result
+  # }
+  # set_sensitive {
+  #   name  = "postgresql.global.postgresql.auth.postgresPassword"
+  #   value = random_password.postgresql.result
+  # }
  set_sensitive {
    name  = "gitea.oauth[0].key"
    value = aws_cognito_user_pool_client.gitea.id
@@ -115,6 +195,14 @@ resource "helm_release" "this" {
  }
 }

+resource "random_password" "postgresql_gitea" {
+  length = 5
+}
+
+resource "random_password" "postgresql" {
+  length = 10
+}
+
 resource "random_password" "gitea_admin" {
  length  = 16
  special = true
--- a/locals.tf
+++ b/locals.tf
@@ -1,5 +1,6 @@
 locals {
  ingress_domain = "git.thomasklein.me"
+  instance_name = "gitea"
 }

 data "aws_region" "current" {}
--- a/postgresql.tf
+++ b/postgresql.tf
@@ -0,0 +1,186 @@
+locals {
+  postgresql_user    = "gitea"
+  postgresql_version = "18"
+  postgresql_dbname  = "gitea"
+}
+resource "kubernetes_service" "postgresql_headless" {
+  metadata {
+    name      = "${local.instance_name}-postgresql-hl"
+    namespace = kubernetes_namespace.this.metadata.0.name
+    labels = {
+      "app.kubernetes.io/instance"   = local.instance_name
+      "app.kubernetes.io/managed-by" = "terraform"
+      "app.kubernetes.io/version"    = local.postgresql_version
+      "app.kubernetes.io/name"       = "postgresql"
+    }
+  }
+  spec {
+    type       = "ClusterIP"
+    cluster_ip = null
+    selector = {
+      "app.kubernetes.io/instance" = local.instance_name
+      "app.kubernetes.io/name"     = "postgresql"
+    }
+    port {
+      name        = "tcp-postgresql"
+      port        = 5432
+      protocol    = "TCP"
+      target_port = "tcp-postgresql"
+    }
+  }
+}
+
+resource "kubernetes_service" "postgresql" {
+  metadata {
+    name      = "${local.instance_name}-postgresql"
+    namespace = kubernetes_namespace.this.metadata.0.name
+    labels = {
+      "app.kubernetes.io/instance"   = local.instance_name
+      "app.kubernetes.io/managed-by" = "terraform"
+      "app.kubernetes.io/version"    = local.postgresql_version
+      "app.kubernetes.io/name"       = "postgresql"
+    }
+  }
+  spec {
+    type       = "ClusterIP"
+    selector = {
+      "app.kubernetes.io/instance" = local.instance_name
+      "app.kubernetes.io/name"     = "postgresql"
+    }
+    port {
+      name        = "tcp-postgresql"
+      port        = 5432
+      protocol    = "TCP"
+      target_port = "tcp-postgresql"
+    }
+  }
+}
+
+resource "kubernetes_secret" "postgresql" {
+  metadata {
+    namespace = kubernetes_namespace.this.metadata.0.name
+    name      = "${local.instance_name}-postgresql"
+  }
+  data = {
+    password = sensitive(random_password.postgresql.result)
+  }
+}
+
+resource "kubernetes_stateful_set" "postgresql" {
+  metadata {
+    namespace = kubernetes_namespace.this.metadata.0.name
+    name      = "${local.instance_name}-postgresql"
+    labels = {
+      "app.kubernetes.io/instance"   = local.instance_name
+      "app.kubernetes.io/managed-by" = "terraform"
+      "app.kubernetes.io/version"    = local.postgresql_version
+      "app.kubernetes.io/name"       = "postgresql"
+    }
+  }
+  spec {
+    replicas = 1
+    selector {
+      match_labels = {
+        "app.kubernetes.io/instance" = local.instance_name
+        "app.kubernetes.io/name"     = "postgresql"
+      }
+    }
+    service_name = kubernetes_service.postgresql.metadata.0.name
+    
+    template {
+      metadata {
+        labels = {
+          "app.kubernetes.io/instance"   = local.instance_name
+          "app.kubernetes.io/managed-by" = "terraform"
+          "app.kubernetes.io/version"    = local.postgresql_version
+          "app.kubernetes.io/name"       = "postgresql"
+        }
+        name = "${local.instance_name}-postgresql"
+      }
+      spec {
+        automount_service_account_token = false
+        container {
+          name              = "postgresql"
+          image             = "docker.io/library/postgres:${local.postgresql_version}-trixie"
+          image_pull_policy = "IfNotPresent"
+
+          env {
+            name  = "POSTGRES_DB"
+            value = local.postgresql_dbname
+          }
+          env {
+            name  = "POSTGRES_USER"
+            value = local.postgresql_user
+          }
+          env {
+            name = "POSTGRES_PASSWORD"
+            value_from {
+              secret_key_ref {
+                key  = "password"
+                name = kubernetes_secret.postgresql.metadata.0.name
+              }
+            }
+          }
+          port {
+            container_port = 5432
+            protocol       = "TCP"
+            name           = "tcp-postgresql"
+          }
+          volume_mount {
+            name       = "data"
+            mount_path = "/var/lib/postgresql"
+          }
+          # volume_mount {
+          #   name       = "data"
+          #   mount_path = "/var/lib/postgresql/data"
+          #   sub_path   = "data"
+          # }
+          # resources {
+          #   limits = {
+          #     "cpu" = "1"
+          #     "memory" = "1Gi"
+          #   }
+          # }
+          liveness_probe {
+            failure_threshold     = 6
+            initial_delay_seconds = 30
+            period_seconds        = 15
+            timeout_seconds       = 10
+            exec {
+              command = [
+                "/bin/sh",
+                "-c",
+                "exec pg_isready -U ${local.postgresql_user} -d 'dbname=${local.postgresql_dbname}' -h 127.0.0.1 -p 5432"
+              ]
+            }
+          }
+        }
+        volume {
+          name = "data"
+          persistent_volume_claim {
+            claim_name = module.postgres_persistance.pvc_name
+          }
+        }
+      }
+    }
+  }
+}
+
+
+# image = {
+#   tag = "12.20.0-debian-12-r26"
+# }
+# primary = {
+#   persistence = {
+#     enabled       = true
+#     existingClaim = module.postgres_persistance.pvc_name
+#     claimName     = module.postgres_persistance.pvc_name
+#   }
+#   podSecurityContext = {
+#     enabled = true
+#   }
+#   volumePermissions = {
+#     enabled = true
+#   }
+# }
+      
--- a/provider.tf
+++ b/provider.tf
@@ -7,12 +7,12 @@ terraform {

    helm = {
      source  = "hashicorp/helm"
-      version = "~> 2.5.1"
+      version = "2.8.0"
    }

    kubernetes = {
      source  = "hashicorp/kubernetes"
-      version = "~> 2.11.0"
+      version = "~> 2.16.1"
    }

  }
--- a/ssh-ingresstcproute.tf
+++ b/ssh-ingresstcproute.tf
@@ -1,26 +0,0 @@
-resource "kubernetes_manifest" "ingress_tcp_route" {
-    manifest = {
-        apiVersion = "traefik.containo.us/v1alpha1"
-        kind = "IngressRouteTCP"
-        metadata = {
-            name = "gitea-ssh"
-            namespace = kubernetes_namespace.this.metadata.0.name
-        }
-        spec = {
-            entryPoints = [
-                "gitssh",
-            ]
-            routes: [
-                {
-                    match = "HostSNI(`*`)"
-                    services = [
-                        {
-                            name = "gitea-ssh"
-                            port = 22
-                        }
-                    ]
-                }
-            ]
-        }
-    }
-}
Author	SHA1	Message	Date
Tamas Kiss	40f6bea423	upgrade gitea and drop bitnami postgres All checks were successful continuous-integration/drone/push Build is passing Details continuous-integration/drone Build is passing Details	2025-11-08 01:26:59 +01:00
Tamas Kiss	c9253637f7	fix: pinning postgresql All checks were successful continuous-integration/drone/push Build is passing Details	2025-01-15 07:18:11 +01:00
Tamas Kiss	f69e2e4d2a	fix traffic policy	2025-01-15 07:17:56 +01:00
Tamas Kiss	8e72d7acb3	upgrade to 10.1.4 Some checks reported errors continuous-integration/drone/push Build was killed Details	2025-01-15 07:00:19 +01:00
Tamas Kiss	91683d69a3	dep: upgrade gitea helm chart Some checks failed continuous-integration/drone/push Build is failing Details	2023-03-25 01:05:32 +01:00
Tamas Kiss	77d9658931	lawndale is skver	2023-01-22 13:48:10 +01:00
Tamas Kiss	a59ec8481e	dep: update providers	2023-01-22 13:47:50 +01:00
Tamas Kiss	a01718f345	docs: update README.md All checks were successful continuous-integration/drone/push Build is passing Details	2022-12-04 12:56:00 +01:00