From ee6c74aed06b9cf37ec8d54e4fe0751d388637b6 Mon Sep 17 00:00:00 2001
From: djg <djg@ch4t.buzz>
Date: Mon, 21 Sep 2026 22:16:01 +0000
Subject: [PATCH] initial import: k8s manifests and infra docs

---
 forgejo/k8s/forgejo.yaml | 192 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 192 insertions(+)
 create mode 100644 forgejo/k8s/forgejo.yaml

diff --git a/forgejo/k8s/forgejo.yaml b/forgejo/k8s/forgejo.yaml
new file mode 100644
index 0000000..eeb2d5d
--- /dev/null
+++ b/forgejo/k8s/forgejo.yaml
@@ -0,0 +1,192 @@
+# ============================================================
+# Forgejo — self-hosted git forge on k3s
+# https://git.ch4t.buzz
+# ============================================================
+
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: forgejo
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: forgejo-data
+  namespace: forgejo
+spec:
+  accessModes: [ReadWriteOnce]
+  resources:
+    requests:
+      storage: 20Gi
+  storageClassName: local-path
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: forgejo
+  namespace: forgejo
+  labels:
+    app: forgejo
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: forgejo
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: forgejo
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: djg-oracle-sl
+      tolerations:
+        - key: node-role.kubernetes.io/master
+          operator: Exists
+          effect: NoSchedule
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
+      securityContext:
+        fsGroup: 1000
+      initContainers:
+        - name: init-dirs
+          image: busybox:latest
+          command: ["sh", "-c", "mkdir -p /data/gitea && chown -R 1000:1000 /data"]
+          volumeMounts:
+            - name: data
+              mountPath: /data
+      containers:
+        - name: forgejo
+          image: codeberg.org/forgejo/forgejo:9
+          ports:
+            - name: http
+              containerPort: 3000
+            - name: ssh
+              containerPort: 22
+          env:
+            - name: GITEA__server__DOMAIN
+              value: "git.ch4t.buzz"
+            - name: GITEA__server__ROOT_URL
+              value: "https://git.ch4t.buzz/"
+            - name: GITEA__server__HTTP_PORT
+              value: "3000"
+            - name: GITEA__server__SSH_DOMAIN
+              value: "git.ch4t.buzz"
+            - name: GITEA__server__SSH_PORT
+              value: "30022"
+            - name: GITEA__server__START_SSH_SERVER
+              value: "false"
+            - name: GITEA__server__DISABLE_SSH
+              value: "true"
+            - name: GITEA__database__DB_TYPE
+              value: "sqlite3"
+            - name: GITEA__database__PATH
+              value: "/data/gitea/gitea.db"
+            - name: GITEA__repository__ROOT
+              value: "/data/git/repositories"
+            - name: GITEA__log__MODE
+              value: "console"
+            - name: GITEA__log__LEVEL
+              value: "info"
+            - name: GITEA__actions__ENABLED
+              value: "true"
+            - name: GITEA__actions__DEFAULT_ACTIONS_URL
+              value: "https://code.forgejo.org"
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              memory: 256Mi
+              cpu: 100m
+            limits:
+              memory: 1Gi
+              cpu: 1000m
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 20
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 30
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: forgejo-data
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: forgejo-http
+  namespace: forgejo
+spec:
+  selector:
+    app: forgejo
+  ports:
+    - name: http
+      port: 3000
+      targetPort: http
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: forgejo-ssh
+  namespace: forgejo
+spec:
+  type: NodePort
+  selector:
+    app: forgejo
+  ports:
+    - name: ssh
+      port: 22
+      targetPort: ssh
+      nodePort: 30022
+
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: forgejo
+  namespace: forgejo
+spec:
+  rules:
+    - host: git.ch4t.buzz
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: forgejo-http
+                port:
+                  number: 3000
+  tls:
+    - hosts:
+        - git.ch4t.buzz
+      secretName: forgejo-tls
+
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: forgejo
+  namespace: forgejo
+spec:
+  secretName: forgejo-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - git.ch4t.buzz