diff options
Diffstat (limited to 'f3s')
| -rw-r--r-- | f3s/forgejo/Justfile | 11 | ||||
| -rw-r--r-- | f3s/forgejo/README.md | 28 | ||||
| -rw-r--r-- | f3s/forgejo/helm-chart/templates/deployment.yaml | 16 | ||||
| -rw-r--r-- | f3s/forgejo/helm-chart/templates/persistent-volume.yaml | 5 |
4 files changed, 50 insertions, 10 deletions
diff --git a/f3s/forgejo/Justfile b/f3s/forgejo/Justfile index ee78a62..e7c4cad 100644 --- a/f3s/forgejo/Justfile +++ b/f3s/forgejo/Justfile @@ -34,10 +34,17 @@ restart: @echo "Restarting forgejo..." kubectl rollout restart -n {{NAMESPACE}} deployment/forgejo -# One-time after the first successful start. Prompts for the password. +# One-time after the first successful start. This is the ONLY way in: the web +# installer is locked and registration is disabled. +# `admin user create` does not prompt -- without --password or --random-password +# it exits with "must set either password or random-password flag". Use a +# generated password (printed once, to stdout) rather than passing one on the +# command line where it would land in shell history and ps output. create-admin username="paul" email="paul.buetow@gmail.com": + @echo "The generated password is printed below -- copy it now, it is shown only once." kubectl exec -n {{NAMESPACE}} -it deploy/forgejo -- \ - forgejo admin user create --admin --username {{username}} --email {{email}} + forgejo admin user create --admin --username {{username}} --email {{email}} \ + --random-password # Open a shell as the git user inside the running instance. shell: diff --git a/f3s/forgejo/README.md b/f3s/forgejo/README.md index ecc35a6..9758b29 100644 --- a/f3s/forgejo/README.md +++ b/f3s/forgejo/README.md @@ -49,9 +49,14 @@ doas mkdir -p /data/nfs/k3svolumes/forgejo/data /data/nfs/k3svolumes/forgejo/con doas touch /data/nfs/k3svolumes/forgejo/data/.nfs-sentinel \ /data/nfs/k3svolumes/forgejo/config/.nfs-sentinel doas chown -R 1000:1000 /data/nfs/k3svolumes/forgejo -doas chmod -R 0750 /data/nfs/k3svolumes/forgejo +doas chmod 0750 /data/nfs/k3svolumes/forgejo/data /data/nfs/k3svolumes/forgejo/config +doas chmod 0644 /data/nfs/k3svolumes/forgejo/data/.nfs-sentinel \ + /data/nfs/k3svolumes/forgejo/config/.nfs-sentinel ``` +The sentinel files are 0644 per `f3s/docs/nfs-sentinel-initcontainer.md` — do not +sweep them up in a recursive chmod of the directories. + The PVs use `type: Directory`, so the pod will not schedule until these exist. ### 2. Publish the hostname @@ -65,14 +70,21 @@ so the certificate has to exist first: ```sh cd frontends -rex -H blowfish.buetow.org:2 nsd httpd acme acme_invoke relayd -rex -H fishfinger.buetow.org:2 nsd httpd acme acme_invoke relayd +rex -H blowfish.buetow.org:2 nsd httpd acme acme_invoke relayd gogios +rex -H fishfinger.buetow.org:2 nsd httpd acme acme_invoke relayd gogios ``` `acme.sh` copies the `foo.zone` cert as a placeholder for any host that has none -yet, so relayd will still start on the first pass; the real certificate arrives -on the same run. Deploying one gateway at a time avoids restarting both public -frontends simultaneously. +yet, so relayd will still start on the first pass. The *real* certificate is only +issued on the gateway currently holding the DNS master IP — `acme.sh` skips +`acme-client` on the standby, which keeps the placeholder until a failover. That +is normal; the standby is not serving the name yet. + +`gogios` is included because the TLS and HTTP checks for the new host are +rendered from `@acme_hosts`; without it `code.f3s.buetow.org` gets no monitoring. + +Deploying one gateway at a time avoids restarting both public frontends +simultaneously. ### 3. Deploy @@ -80,7 +92,9 @@ frontends simultaneously. kubectl apply -f ../argocd-apps/services/forgejo.yaml ``` -Or just push — ArgoCD picks it up automatically. +This apply is required and cannot be skipped: there is no app-of-apps or +ApplicationSet watching `f3s/argocd-apps/`, so pushing the repo alone does +nothing. Once the Application exists, later edits to the chart do auto-sync. ### 4. Create the admin user diff --git a/f3s/forgejo/helm-chart/templates/deployment.yaml b/f3s/forgejo/helm-chart/templates/deployment.yaml index 132fed4..ba19dfa 100644 --- a/f3s/forgejo/helm-chart/templates/deployment.yaml +++ b/f3s/forgejo/helm-chart/templates/deployment.yaml @@ -96,11 +96,25 @@ spec: value: "true" - name: FORGEJO__server__SSH_LISTEN_PORT value: "2222" + # SSH_DOMAIN is deliberately NOT code.f3s.buetow.org: that name resolves + # to the OpenBSD gateways, which forward 443 only, and *.f3s.lan points + # at the CARP storage VIP rather than a k3s node. Advertise a node that + # actually answers on the NodePort, so the clone URLs Forgejo renders + # are ones that work. - name: FORGEJO__server__SSH_DOMAIN - value: "code.f3s.buetow.org" + value: "r0.lan.buetow.org" - name: FORGEJO__server__SSH_PORT value: "30222" + # Behind relayd -> Traefik, Forgejo's default trusts only 127.0.0.0/8, + # so every request would be attributed to the Traefik pod IP: real client + # IPs lost from the audit trail and per-IP rate limiting defeated. That + # matters here because the instance is internet-facing. 10.42.0.0/16 is + # the k3s pod CIDR; Traefik is already configured to pass the correct + # X-Forwarded-For (see f3s/traefik-config). + - name: FORGEJO__security__REVERSE_PROXY_TRUSTED_PROXIES + value: "10.42.0.0/16" + # This instance is reachable from the public internet through relayd. # Lock the installer (otherwise the first visitor gets the setup wizard) # and keep signups closed; create the admin with the CLI, see README. diff --git a/f3s/forgejo/helm-chart/templates/persistent-volume.yaml b/f3s/forgejo/helm-chart/templates/persistent-volume.yaml index 40c8788..c17446d 100644 --- a/f3s/forgejo/helm-chart/templates/persistent-volume.yaml +++ b/f3s/forgejo/helm-chart/templates/persistent-volume.yaml @@ -46,6 +46,10 @@ metadata: namespace: services spec: storageClassName: "" + # Pinned explicitly: without volumeName the 1Gi config claim below would also + # be a valid match for this 20Gi volume, leaving the binding to the + # smallest-sufficient-PV heuristic. + volumeName: forgejo-data-pv accessModes: - ReadWriteOnce resources: @@ -59,6 +63,7 @@ metadata: namespace: services spec: storageClassName: "" + volumeName: forgejo-config-pv accessModes: - ReadWriteOnce resources: |