summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-01-09Fix cgit scan-path to match repository structurePaul Buetow
Repository is at /repos/repos/conf.git, so scan-path should be /repos/repos to generate correct URLs in the web interface. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Migrate all applications from Codeberg to self-hosted gitPaul Buetow
Updated 17 application manifests to use internal git-server: - Monitoring: grafana-ingress, prometheus, pushgateway - Services: anki-sync-server, audiobookshelf, filebrowser, immich, keybr, kobo-sync-server, miniflux, opodsync, radicale, syncthing, tracing-demo, wallabag, webdav - Infra: registry All applications now fetch from: ssh://git@git-server.cicd.svc.cluster.local/repos/repos/conf.git Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Migrate example-apache-volume-claim to self-hosted gitPaul Buetow
Test migration of first application from Codeberg to internal git-server. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Test: verify SSH push worksPaul Buetow
2026-01-09Migrate all applications from Codeberg to self-hosted gitPaul Buetow
Updated 17 application manifests to use internal git-server: - Monitoring: grafana-ingress, prometheus, pushgateway - Services: anki-sync-server, audiobookshelf, filebrowser, immich, keybr, kobo-sync-server, miniflux, opodsync, radicale, syncthing, tracing-demo, wallabag, webdav - Infra: registry All applications now fetch from: ssh://git@git-server.cicd.svc.cluster.local/repos/repos/conf.git Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Migrate example-apache-volume-claim to self-hosted gitPaul Buetow
Test migration of first application from Codeberg to internal git-server. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Reduce SSH logging from DEBUG3 to INFOPaul Buetow
Debug logging was useful for troubleshooting but not needed in production. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Unlock git user account for SSH authenticationPaul Buetow
SSH requires user accounts to be unlocked (not have ! in shadow). Use 'passwd -u' to unlock the git user account. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Make .ssh directory world-readable for SELinux compatibilityPaul Buetow
SELinux prevents root from accessing 700 directories in some contexts. Use 755 for directory and 644 for authorized_keys to allow access. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Remove readOnly flag from git-ssh-writable mountPaul Buetow
The emptyDir needs to be writable for SSH to access authorized_keys. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Add git-shell to /etc/shells for SSH validityPaul Buetow
SSH requires user shells to be listed in /etc/shells. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix nested .ssh directory issuePaul Buetow
Remove extra .ssh directory creation in initContainer. The emptyDir mount point itself is /home/git/.ssh. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix authorized_keys permissions via initContainerPaul Buetow
Copy authorized_keys from secret to emptyDir with git user ownership. This allows SSH to read the keys for authentication. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Add SETGID and SETUID capabilities to git-serverPaul Buetow
SSH privilege separation requires setgroups() and setuid() syscalls. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Add SSH connectivity for git-server and configure ArgoCDPaul Buetow
- Enable SYS_CHROOT capability for git-server SSH to work in containers - Configure ArgoCD repo-server to use SSH key for git-server access - Set DEBUG3 logging in sshd for troubleshooting (temp) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix fcgiwrap socket permissions for nginx workersPaul Buetow
Nginx workers (running as user nginx) couldn't connect to fcgiwrap.sock created by root. Add chmod 666 to make the socket world-accessible.
2026-01-09Fix cgit port mapping - nginx listens on port 80Paul Buetow
The cgit nginx default.conf listens on port 80, not 8080. Update: - Container port from 8080 to 80 - Service targetPort from 8080 to 80
2026-01-09Add SETGID and SETUID capabilities to cgit containerPaul Buetow
Nginx workers need these capabilities to drop privileges. Add SETGID and SETUID to allow nginx workers to start properly.
2026-01-09Remove fsGroup to fix nginx worker setgid errorsPaul Buetow
The fsGroup: 1000 was causing nginx workers to fail with setgid errors even after removing 'user nginx;' directive. Since both containers run as root, fsGroup is not needed for repo access.
2026-01-09Remove 'user nginx;' directive to fix nginx worker errorsPaul Buetow
When running as root with fsGroup, nginx workers fail trying to setgid. Remove the 'user nginx;' directive from nginx.conf at startup using sed. This allows nginx to run workers as root without permission errors.
2026-01-09Run spawn-fcgi as root to avoid setgid errorsPaul Buetow
Remove -u nginx -g nginx from spawn-fcgi command to run as root. This avoids nginx worker process setgid permission errors.
2026-01-09Override cgit entrypoint to skip chown/chmodPaul Buetow
The cgit image entrypoint always tries to chown /var/cache/cgit which fails with permission errors. Override the entrypoint to directly: 1. Spawn fcgiwrap as nginx user 2. Start nginx in foreground This skips the problematic chown/chmod and template substitution.
2026-01-09Disable cgit caching to avoid permission issuesPaul Buetow
Instead of fighting permission issues with the cgit cache directory, disable caching entirely by: - Setting cache-size=0 in cgitrc - Removing cgit-cache emptyDir volume and mounts - Simplifying initContainer (only SSH keys setup needed) cgit will work without caching, just slightly slower for large repos.
2026-01-09Run cgit as root - required for nginx and spawn-fcgiPaul Buetow
cgit image needs root to: - Bind sockets with spawn-fcgi - Run nginx master process - Write to /var/run/nginx.pid The initContainer already sets up cache dir with proper permissions.
2026-01-09Set USE_CUSTOM_CONFIG=true to skip cgit template substitutionPaul Buetow
The cgit entrypoint tries to write to /etc/cgitrc which is mounted read-only from our ConfigMap. Set USE_CUSTOM_CONFIG=true to use our custom cgitrc directly without template substitution.
2026-01-09Fix cgit permissions - use UID 101 (nginx user)Paul Buetow
The cgit image runs as nginx user (UID 101), not www-data (UID 33). - Update initContainer to chown cache to 101:1000 - Update cgit securityContext to runAsUser: 101
2026-01-09Fix permissions using fsGroup and initContainer patternPaul Buetow
Follow webdav/filebrowser pattern for proper permission handling: - Add fsGroup: 1000 at pod level for git repo access - Add initContainer to chown emptyDir volumes - Run git-server as root (required for sshd) - Run cgit as user 33 (www-data) - Restore cgit-cache emptyDir volume with proper ownership
2026-01-09Run containers as root and use emptyDir for writeable dirsPaul Buetow
- Mount emptyDir for /etc/ssh to allow SSH host key generation - Mount emptyDir for /var/cache/cgit to allow cache initialization - Run both containers as root with proper capabilities - Copy sshd_config at runtime from /tmp to /etc/ssh - Add imagePullPolicy: Always to force image refresh
2026-01-09Fix SSH host keys and container securityPaul Buetow
- Generate SSH host keys at runtime via entrypoint script - Remove fsGroup security context to fix emptyDir permissions - Allow cgit to initialize cache directory as root
2026-01-09Fix sshd_config and cgit permissionsPaul Buetow
- Remove unsupported UsePAM option from sshd_config - Run cgit as root to allow cache directory initialization - Add CHOWN and DAC_OVERRIDE capabilities for cgit
2026-01-09Fix git-server deploymentPaul Buetow
- Use registry.lan.buetow.org for deployment (internal DNS) - Add emptyDir volume for cgit cache directory - Add README.md with deployment and secret management instructions This fixes image pull issues and cgit permission errors.
2026-01-09Add self-hosted git server with SSH and cgit web UIPaul Buetow
Deploy a self-hosted git repository solution to replace external Codeberg dependency. Components: - SSH git server: Alpine-based container with OpenSSH and git - cgit web UI: Browse repositories at cgit.f3s.buetow.org - Single pod design: git-server + cgit containers sharing storage Infrastructure: - Docker image in git-server/docker-image/ with Justfile build automation - Helm chart in git-server/helm-chart/ for Kubernetes deployment - 5Gi ReadWriteMany PVC for NFS-backed repository storage - ClusterIP service for ArgoCD internal access - NodePort 30022 for external SSH push access - Traefik ingress for cgit web UI ArgoCD Application manifest deployed to cicd namespace. Note: SSH keys must be created as Kubernetes secrets manually, not in git. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Test: verify SSH push worksPaul Buetow
2026-01-09Reduce SSH logging from DEBUG3 to INFOPaul Buetow
Debug logging was useful for troubleshooting but not needed in production. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Unlock git user account for SSH authenticationPaul Buetow
SSH requires user accounts to be unlocked (not have ! in shadow). Use 'passwd -u' to unlock the git user account. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Make .ssh directory world-readable for SELinux compatibilityPaul Buetow
SELinux prevents root from accessing 700 directories in some contexts. Use 755 for directory and 644 for authorized_keys to allow access. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Remove readOnly flag from git-ssh-writable mountPaul Buetow
The emptyDir needs to be writable for SSH to access authorized_keys. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Add git-shell to /etc/shells for SSH validityPaul Buetow
SSH requires user shells to be listed in /etc/shells. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix nested .ssh directory issuePaul Buetow
Remove extra .ssh directory creation in initContainer. The emptyDir mount point itself is /home/git/.ssh. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix authorized_keys permissions via initContainerPaul Buetow
Copy authorized_keys from secret to emptyDir with git user ownership. This allows SSH to read the keys for authentication. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Add SETGID and SETUID capabilities to git-serverPaul Buetow
SSH privilege separation requires setgroups() and setuid() syscalls. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Add SSH connectivity for git-server and configure ArgoCDPaul Buetow
- Enable SYS_CHROOT capability for git-server SSH to work in containers - Configure ArgoCD repo-server to use SSH key for git-server access - Set DEBUG3 logging in sshd for troubleshooting (temp) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix fcgiwrap socket permissions for nginx workersPaul Buetow
Nginx workers (running as user nginx) couldn't connect to fcgiwrap.sock created by root. Add chmod 666 to make the socket world-accessible.
2026-01-09Fix cgit port mapping - nginx listens on port 80Paul Buetow
The cgit nginx default.conf listens on port 80, not 8080. Update: - Container port from 8080 to 80 - Service targetPort from 8080 to 80
2026-01-09Add SETGID and SETUID capabilities to cgit containerPaul Buetow
Nginx workers need these capabilities to drop privileges. Add SETGID and SETUID to allow nginx workers to start properly.
2026-01-09Remove fsGroup to fix nginx worker setgid errorsPaul Buetow
The fsGroup: 1000 was causing nginx workers to fail with setgid errors even after removing 'user nginx;' directive. Since both containers run as root, fsGroup is not needed for repo access.
2026-01-09Remove 'user nginx;' directive to fix nginx worker errorsPaul Buetow
When running as root with fsGroup, nginx workers fail trying to setgid. Remove the 'user nginx;' directive from nginx.conf at startup using sed. This allows nginx to run workers as root without permission errors.
2026-01-09Run spawn-fcgi as root to avoid setgid errorsPaul Buetow
Remove -u nginx -g nginx from spawn-fcgi command to run as root. This avoids nginx worker process setgid permission errors.
2026-01-09Override cgit entrypoint to skip chown/chmodPaul Buetow
The cgit image entrypoint always tries to chown /var/cache/cgit which fails with permission errors. Override the entrypoint to directly: 1. Spawn fcgiwrap as nginx user 2. Start nginx in foreground This skips the problematic chown/chmod and template substitution.
2026-01-09Disable cgit caching to avoid permission issuesPaul Buetow
Instead of fighting permission issues with the cgit cache directory, disable caching entirely by: - Setting cache-size=0 in cgitrc - Removing cgit-cache emptyDir volume and mounts - Simplifying initContainer (only SSH keys setup needed) cgit will work without caching, just slightly slower for large repos.
generated by cgit v1.2.3 (git 2.25.1) at 2026-06-11 02:56:35 +0000