forgejo: add a standalone Forgejo install at code.f3s.buetow.org

Deliberately independent of the cgit git-server: separate namespace (services),
separate NFS volumes, separate SSH NodePort (30222 vs 30022), and no shared
storage. cgit keeps serving the existing 80 bare repos at c-git.f3s.buetow.org
and is not touched. Forgejo starts empty; repos get migrated by hand later.

ArgoCD deliberately keeps reading conf.git from the existing git-server, so
Forgejo has no consumers and cannot take cluster deploys down with it.

SQLite rather than a PostgreSQL pod: single writer (replicas 1 + Recreate) and
NFSv4.2 does real byte-range locking, so the usual SQLite-on-NFS failure mode
does not apply. Uses the -rootless image so the pod runs wholly as UID 1000
with all capabilities dropped, and both volumes carry the .nfs-sentinel guard.

The installer is locked and registration disabled because the instance is
reachable from the internet; the admin account is created via the CLI.

code.f3s.buetow.org added to @f3s_hosts, which drives the DNS zone, the relayd
route, the ACME cert and the gogios checks.

Not yet activated: the ArgoCD Application still needs applying, the NFS
directories creating, and the frontends deploying. See f3s/forgejo/README.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 44 insertions, 0 deletions

diff --git a/f3s/forgejo/Justfile b/f3s/forgejo/Justfile
new file mode 100644
index 0000000..ee78a62
--- /dev/null
+++ b/f3s/forgejo/Justfile
@@ -0,0 +1,44 @@
+NAMESPACE := "services"
+APP_NAME := "forgejo"
+
+status:
+    @echo "=== Pods ==="
+    @kubectl get pods -n {{NAMESPACE}} | grep forgejo
+    @echo ""
+    @echo "=== Services ==="
+    @kubectl get svc -n {{NAMESPACE}} forgejo forgejo-ssh
+    @echo ""
+    @echo "=== Ingress ==="
+    @kubectl get ingress -n {{NAMESPACE}} forgejo-ingress forgejo-ingress-lan
+    @echo ""
+    @echo "=== PVCs ==="
+    @kubectl get pvc -n {{NAMESPACE}} | grep forgejo
+    @echo ""
+    @echo "=== ArgoCD Status ==="
+    @kubectl get application {{APP_NAME}} -n cicd -o jsonpath='Sync: {.status.sync.status}, Health: {.status.health.status}' 2>/dev/null && echo ""
+
+logs lines="100":
+    kubectl logs -n {{NAMESPACE}} -l app=forgejo --tail={{lines}} -f
+
+port-forward port="3000":
+    @echo "Forwarding forgejo to localhost:{{port}}"
+    kubectl port-forward -n {{NAMESPACE}} svc/forgejo {{port}}:80
+
+sync:
+    @echo "Triggering ArgoCD sync..."
+    @kubectl annotate application {{APP_NAME}} -n cicd argocd.argoproj.io/refresh=normal --overwrite
+    @sleep 2
+    @kubectl get application {{APP_NAME}} -n cicd -o jsonpath='Sync: {.status.sync.status}, Health: {.status.health.status}' && echo ""
+
+restart:
+    @echo "Restarting forgejo..."
+    kubectl rollout restart -n {{NAMESPACE}} deployment/forgejo
+
+# One-time after the first successful start. Prompts for the password.
+create-admin username="paul" email="paul.buetow@gmail.com":
+    kubectl exec -n {{NAMESPACE}} -it deploy/forgejo -- \
+        forgejo admin user create --admin --username {{username}} --email {{email}}
+
+# Open a shell as the git user inside the running instance.
+shell:
+    kubectl exec -n {{NAMESPACE}} -it deploy/forgejo -- /bin/sh