summaryrefslogtreecommitdiff
path: root/f3s/git-server/helm-chart
AgeCommit message (Collapse)Author
2 daysgit-server: rename cgit ingress from cgit.f3s.buetow.org to c-git.f3s.buetow.orgPaul Buetow
2026-05-25Add NFS sentinel initContainer for git-server s5Paul Buetow
2026-05-16f3s: set strategy Recreate on single-replica stateful deploymentsPaul Buetow
Prevents NFS-lock races during rolling updates. The hostPath PVs point at an NFS-shared directory mounted on every r-node, so RWO is not actually enforced across nodes — under the default RollingUpdate strategy the new pod can start on a different node and grab the same data dir while the old pod still holds file locks, producing errors like postgres' "could not write to file postmaster.pid: Unknown error 512". Applied to: immich-postgres, audiobookshelf, anki-sync-server, registry, pkgrepo, player, wallabag, miniflux-postgres, opodsync, radicale, kobo-sync-server, keybr, filebrowser, git-server, goprecords, jellyfin. (syncthing and navidrome already had it.) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-02-07fix(git-server): copy SSH keys from NFS to local emptyDirPaul Buetow
OpenSSH refuses to load host keys from NFS for security reasons. The solution is to store keys in persistent NFS (so they survive restarts) but copy them to a local emptyDir at startup (so sshd can read them). This ensures: - SSH host keys persist across pod restarts - sshd can successfully load the keys from local storage - Clients don't see "host key changed" warnings Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07fix(git-server): add sshd_config to persistent storagePaul Buetow
The sshd_config file needs to be in the persistent SSH directory for the git-server container to start properly. Added ConfigMap and updated initContainer to copy it on first deployment. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07fix(git-server): persist SSH host keys across pod restartsPaul Buetow
SSH host keys are now stored in persistent NFS storage instead of ephemeral emptyDir. Keys are only generated once on first deployment, preventing known_hosts updates on every pod restart. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-07feat: add LAN ingresses for all servicesPaul Buetow
Add *.f3s.lan.buetow.org ingress resources for all services to enable LAN access with TLS termination. This allows direct access from the 192.168.1.0/24 network through the FreeBSD CARP/relayd setup. Services updated: - argocd: argocd.f3s.lan.buetow.org - cgit: cgit.f3s.lan.buetow.org - grafana: grafana.f3s.lan.buetow.org - anki-sync-server: anki.f3s.lan.buetow.org - apache: f3s.lan.buetow.org, www.f3s.lan.buetow.org, standby.f3s.lan.buetow.org - audiobookshelf: audiobookshelf.f3s.lan.buetow.org - filebrowser: filebrowser.f3s.lan.buetow.org - immich: immich.f3s.lan.buetow.org - ipv6test: ipv6test.f3s.lan.buetow.org (+ ipv4/ipv6 subdomains) - keybr: keybr.f3s.lan.buetow.org - koreader-sync-server: koreader.f3s.lan.buetow.org - miniflux: flux.f3s.lan.buetow.org - opodsync: gpodder.f3s.lan.buetow.org - radicale: radicale.f3s.lan.buetow.org - syncthing: syncthing.f3s.lan.buetow.org - tracing-demo: tracing-demo.f3s.lan.buetow.org - wallabag: bag.f3s.lan.buetow.org - webdav: webdav.f3s.lan.buetow.org All LAN ingresses use: - TLS with f3s-lan-tls certificate (cert-manager) - Traefik entrypoints: web,websecure - Same backend services as external ingresses Also fixed koreader-sync-server ingress to use modern annotations. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-01-10Simplify git-server path from /repos/repos to /reposPaul Buetow
Changes: - Mount PVC with subPath: repos in deployment - Update cgit scan-path from /repos/repos to /repos - Update git-http-backend GIT_PROJECT_ROOT to /repos - Update all documentation to reflect simplified paths This eliminates the redundant /repos/repos duplication and simplifies all git URLs to ssh://git@r0:30022/repos/<repo>.git format. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-10Update git-server README to use explicit NodePort in gitsyncer configPaul Buetow
Replace git@git-server:/repos/repos with ssh://git@r0:30022/repos/repos in the documentation to match the actual configuration and make the NodePort usage explicit. SSH alias approach now documented as optional. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-10Add comprehensive README for git-server helm chartPaul Buetow
Includes: - Component overview (SSH, HTTP, cgit) - Access methods (SSH, HTTP, web UI) - Gitsyncer integration guide - ArgoCD integration - Security configuration - Troubleshooting guide - Maintenance procedures
2026-01-10Add nginx timeouts for git-http-backend to fix large clone issuesPaul Buetow
ArgoCD was experiencing 'early EOF' errors during git fetch operations. Added fastcgi timeout settings to prevent connection closures: - fastcgi_read_timeout: 300s (5 minutes) - fastcgi_send_timeout: 300s (5 minutes) - fastcgi_buffering: off (stream responses immediately) This fixes: curl 18 transfer closed with outstanding read data remaining
2026-01-10Set HOME=/tmp for cgit container to allow git config writesPaul Buetow
Non-root container cannot write to /.gitconfig, setting HOME=/tmp allows git to write config files
2026-01-10Add git safe.directory config for NFS repository ownershipPaul Buetow
Fixes 'dubious ownership' error when git-http-backend runs as UID 33 accessing repository owned by UID 1001:33
2026-01-10Fix: Install git-daemon instead of git for git-http-backendPaul Buetow
git-http-backend is in the git-daemon package in Alpine, not the base git package
2026-01-10Add initContainer to install git-http-backendPaul Buetow
- New initContainer installs git and copies git-http-backend to shared /tmp volume - Updated nginx config to use /tmp/git-http-backend - Removed apk add from cgit container (was failing due to non-root user)
2026-01-10Install git-daemon package for git-http-backend supportPaul Buetow
2026-01-10Enable HTTP git operations in repository configPaul Buetow
- Make /repos mount read-write on cgit container - Set http.receivepack=true and http.uploadpack=true in git config - Allows git clone/fetch/push via HTTP - Fixes 403 Forbidden error from git-http-backend
2026-01-10Fix nginx: copy fastcgi_params to /tmp and reference itPaul Buetow
- Copy /etc/nginx/fastcgi_params to /tmp/fastcgi_params - Update include path to /tmp/fastcgi_params - Fixes 'No such file or directory' error
2026-01-10Fix git-http-backend: insert location into existing server blockPaul Buetow
- Use sed to insert git-http-backend location into default.conf - Location must be inside server block, not separate file - Fixes nginx config syntax error
2026-01-10Fix: remove apk install, use git already in alpine-cgit imagePaul Buetow
2026-01-10Add git-http-backend for HTTP git operationsPaul Buetow
- Install git package in cgit container - Add nginx config for git-http-backend via fcgiwrap - Supports git clone/fetch/pull over HTTP at /conf.git/ path - cgit remains for web UI at /conf/ path - Eliminates need for SSH and SSH agent sidecar
2026-01-10Fix git-server non-root deploymentPaul Buetow
- Generate SSH host keys in initContainer with correct ownership - Remove deprecated UsePrivilegeSeparation from sshd_config - Fix NFS repository permissions (UID 1001, GID 33) - Configure git shared repository mode
2026-01-09Remove SETUID/SETGID capabilities from cgit containerPaul Buetow
cgit doesn't need privilege escalation capabilities when running as UID 33 with writable /tmp for runtime files. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix cgit nginx config - update correct socket path in default.confPaul Buetow
The fcgiwrap socket path is configured in /etc/nginx/conf.d/default.conf, not cgit.conf. Copy conf.d directory to /tmp and update socket path there. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix cgit container permissions - use writable /tmp for runtime filesPaul Buetow
- Mount emptyDir volume at /tmp for cgit runtime files - Copy nginx.conf to /tmp and modify there (read-only /etc) - Move nginx PID file to /tmp/nginx.pid - Move fcgiwrap socket to /tmp/fcgiwrap.sock - Update cgit.conf to use new socket location Allows cgit to run as non-root (UID 33) without write access to /etc or /var. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Use proper security contexts for NFS access without chownPaul Buetow
Changes: - Set fsGroup: 33 at pod level for proper NFS group access - Updated git user to UID 1001, GID 33 (www-data) to match NFS ownership - Run git-server container as UID 1001:33 (non-root) - Run cgit container as UID 33:33 (non-root) - Disabled SSH privilege separation (UsePrivilegeSeparation no) - Removed unnecessary capabilities (SETGID, SETUID, SYS_CHROOT) This follows the same pattern as filebrowser and webdav services, using security contexts instead of chown operations on NFS. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix cgit URL generation by setting virtual-rootPaul Buetow
Added virtual-root=/ to cgitrc to prevent duplicate path segments in generated URLs. This fixes the "Invalid request" error when clicking links in the cgit web interface. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix cgit scan-path to match repository structurePaul Buetow
Repository is at /repos/repos/conf.git, so scan-path should be /repos/repos to generate correct URLs in the web interface. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Make .ssh directory world-readable for SELinux compatibilityPaul Buetow
SELinux prevents root from accessing 700 directories in some contexts. Use 755 for directory and 644 for authorized_keys to allow access. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Remove readOnly flag from git-ssh-writable mountPaul Buetow
The emptyDir needs to be writable for SSH to access authorized_keys. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix nested .ssh directory issuePaul Buetow
Remove extra .ssh directory creation in initContainer. The emptyDir mount point itself is /home/git/.ssh. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix authorized_keys permissions via initContainerPaul Buetow
Copy authorized_keys from secret to emptyDir with git user ownership. This allows SSH to read the keys for authentication. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Add SETGID and SETUID capabilities to git-serverPaul Buetow
SSH privilege separation requires setgroups() and setuid() syscalls. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Add SSH connectivity for git-server and configure ArgoCDPaul Buetow
- Enable SYS_CHROOT capability for git-server SSH to work in containers - Configure ArgoCD repo-server to use SSH key for git-server access - Set DEBUG3 logging in sshd for troubleshooting (temp) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix fcgiwrap socket permissions for nginx workersPaul Buetow
Nginx workers (running as user nginx) couldn't connect to fcgiwrap.sock created by root. Add chmod 666 to make the socket world-accessible.
2026-01-09Fix cgit port mapping - nginx listens on port 80Paul Buetow
The cgit nginx default.conf listens on port 80, not 8080. Update: - Container port from 8080 to 80 - Service targetPort from 8080 to 80
2026-01-09Add SETGID and SETUID capabilities to cgit containerPaul Buetow
Nginx workers need these capabilities to drop privileges. Add SETGID and SETUID to allow nginx workers to start properly.
2026-01-09Remove fsGroup to fix nginx worker setgid errorsPaul Buetow
The fsGroup: 1000 was causing nginx workers to fail with setgid errors even after removing 'user nginx;' directive. Since both containers run as root, fsGroup is not needed for repo access.
2026-01-09Remove 'user nginx;' directive to fix nginx worker errorsPaul Buetow
When running as root with fsGroup, nginx workers fail trying to setgid. Remove the 'user nginx;' directive from nginx.conf at startup using sed. This allows nginx to run workers as root without permission errors.
2026-01-09Run spawn-fcgi as root to avoid setgid errorsPaul Buetow
Remove -u nginx -g nginx from spawn-fcgi command to run as root. This avoids nginx worker process setgid permission errors.
2026-01-09Override cgit entrypoint to skip chown/chmodPaul Buetow
The cgit image entrypoint always tries to chown /var/cache/cgit which fails with permission errors. Override the entrypoint to directly: 1. Spawn fcgiwrap as nginx user 2. Start nginx in foreground This skips the problematic chown/chmod and template substitution.
2026-01-09Disable cgit caching to avoid permission issuesPaul Buetow
Instead of fighting permission issues with the cgit cache directory, disable caching entirely by: - Setting cache-size=0 in cgitrc - Removing cgit-cache emptyDir volume and mounts - Simplifying initContainer (only SSH keys setup needed) cgit will work without caching, just slightly slower for large repos.
2026-01-09Run cgit as root - required for nginx and spawn-fcgiPaul Buetow
cgit image needs root to: - Bind sockets with spawn-fcgi - Run nginx master process - Write to /var/run/nginx.pid The initContainer already sets up cache dir with proper permissions.
2026-01-09Set USE_CUSTOM_CONFIG=true to skip cgit template substitutionPaul Buetow
The cgit entrypoint tries to write to /etc/cgitrc which is mounted read-only from our ConfigMap. Set USE_CUSTOM_CONFIG=true to use our custom cgitrc directly without template substitution.
2026-01-09Fix cgit permissions - use UID 101 (nginx user)Paul Buetow
The cgit image runs as nginx user (UID 101), not www-data (UID 33). - Update initContainer to chown cache to 101:1000 - Update cgit securityContext to runAsUser: 101
2026-01-09Fix permissions using fsGroup and initContainer patternPaul Buetow
Follow webdav/filebrowser pattern for proper permission handling: - Add fsGroup: 1000 at pod level for git repo access - Add initContainer to chown emptyDir volumes - Run git-server as root (required for sshd) - Run cgit as user 33 (www-data) - Restore cgit-cache emptyDir volume with proper ownership
2026-01-09Run containers as root and use emptyDir for writeable dirsPaul Buetow
- Mount emptyDir for /etc/ssh to allow SSH host key generation - Mount emptyDir for /var/cache/cgit to allow cache initialization - Run both containers as root with proper capabilities - Copy sshd_config at runtime from /tmp to /etc/ssh - Add imagePullPolicy: Always to force image refresh
2026-01-09Fix SSH host keys and container securityPaul Buetow
- Generate SSH host keys at runtime via entrypoint script - Remove fsGroup security context to fix emptyDir permissions - Allow cgit to initialize cache directory as root
2026-01-09Fix sshd_config and cgit permissionsPaul Buetow
- Remove unsupported UsePAM option from sshd_config - Run cgit as root to allow cache directory initialization - Add CHOWN and DAC_OVERRIDE capabilities for cgit
2026-01-09Fix git-server deploymentPaul Buetow
- Use registry.lan.buetow.org for deployment (internal DNS) - Add emptyDir volume for cgit cache directory - Add README.md with deployment and secret management instructions This fixes image pull issues and cgit permission errors.
generated by cgit v1.2.3 (git 2.25.1) at 2026-06-09 11:40:38 +0000