diff options
Diffstat (limited to 'f3s/forgejo/helm-chart')
| -rw-r--r-- | f3s/forgejo/helm-chart/templates/deployment.yaml | 16 | ||||
| -rw-r--r-- | f3s/forgejo/helm-chart/templates/persistent-volume.yaml | 5 |
2 files changed, 20 insertions, 1 deletions
diff --git a/f3s/forgejo/helm-chart/templates/deployment.yaml b/f3s/forgejo/helm-chart/templates/deployment.yaml index 132fed4..ba19dfa 100644 --- a/f3s/forgejo/helm-chart/templates/deployment.yaml +++ b/f3s/forgejo/helm-chart/templates/deployment.yaml @@ -96,11 +96,25 @@ spec: value: "true" - name: FORGEJO__server__SSH_LISTEN_PORT value: "2222" + # SSH_DOMAIN is deliberately NOT code.f3s.buetow.org: that name resolves + # to the OpenBSD gateways, which forward 443 only, and *.f3s.lan points + # at the CARP storage VIP rather than a k3s node. Advertise a node that + # actually answers on the NodePort, so the clone URLs Forgejo renders + # are ones that work. - name: FORGEJO__server__SSH_DOMAIN - value: "code.f3s.buetow.org" + value: "r0.lan.buetow.org" - name: FORGEJO__server__SSH_PORT value: "30222" + # Behind relayd -> Traefik, Forgejo's default trusts only 127.0.0.0/8, + # so every request would be attributed to the Traefik pod IP: real client + # IPs lost from the audit trail and per-IP rate limiting defeated. That + # matters here because the instance is internet-facing. 10.42.0.0/16 is + # the k3s pod CIDR; Traefik is already configured to pass the correct + # X-Forwarded-For (see f3s/traefik-config). + - name: FORGEJO__security__REVERSE_PROXY_TRUSTED_PROXIES + value: "10.42.0.0/16" + # This instance is reachable from the public internet through relayd. # Lock the installer (otherwise the first visitor gets the setup wizard) # and keep signups closed; create the admin with the CLI, see README. diff --git a/f3s/forgejo/helm-chart/templates/persistent-volume.yaml b/f3s/forgejo/helm-chart/templates/persistent-volume.yaml index 40c8788..c17446d 100644 --- a/f3s/forgejo/helm-chart/templates/persistent-volume.yaml +++ b/f3s/forgejo/helm-chart/templates/persistent-volume.yaml @@ -46,6 +46,10 @@ metadata: namespace: services spec: storageClassName: "" + # Pinned explicitly: without volumeName the 1Gi config claim below would also + # be a valid match for this 20Gi volume, leaving the binding to the + # smallest-sufficient-PV heuristic. + volumeName: forgejo-data-pv accessModes: - ReadWriteOnce resources: @@ -59,6 +63,7 @@ metadata: namespace: services spec: storageClassName: "" + volumeName: forgejo-config-pv accessModes: - ReadWriteOnce resources: |