From a3f216fc2cce2299cf66e174fb927cc05dde97dd Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sun, 26 Jul 2026 09:57:28 +0300 Subject: forgejo: add a standalone Forgejo install at code.f3s.buetow.org Deliberately independent of the cgit git-server: separate namespace (services), separate NFS volumes, separate SSH NodePort (30222 vs 30022), and no shared storage. cgit keeps serving the existing 80 bare repos at c-git.f3s.buetow.org and is not touched. Forgejo starts empty; repos get migrated by hand later. ArgoCD deliberately keeps reading conf.git from the existing git-server, so Forgejo has no consumers and cannot take cluster deploys down with it. SQLite rather than a PostgreSQL pod: single writer (replicas 1 + Recreate) and NFSv4.2 does real byte-range locking, so the usual SQLite-on-NFS failure mode does not apply. Uses the -rootless image so the pod runs wholly as UID 1000 with all capabilities dropped, and both volumes carry the .nfs-sentinel guard. The installer is locked and registration disabled because the instance is reachable from the internet; the admin account is created via the CLI. code.f3s.buetow.org added to @f3s_hosts, which drives the DNS zone, the relayd route, the ACME cert and the gogios checks. Not yet activated: the ArgoCD Application still needs applying, the NFS directories creating, and the frontends deploying. See f3s/forgejo/README.md. Co-Authored-By: Claude Opus 5 --- frontends/Rexfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'frontends/Rexfile') diff --git a/frontends/Rexfile b/frontends/Rexfile index 57f8141..3e72227 100644 --- a/frontends/Rexfile +++ b/frontends/Rexfile @@ -85,7 +85,7 @@ our $secrets = sub { read_file './secrets/' . shift }; # k3s cluster running on FreeBSD in my LAN our @f3s_hosts = - qw/f3s.buetow.org ychat.f3s.buetow.org player.f3s.buetow.org xplayer.f3s.buetow.org pihole.f3s.buetow.org jellyfin.f3s.buetow.org navidrome.f3s.buetow.org git.f3s.buetow.org c-git.f3s.buetow.org immich.f3s.buetow.org argocd.f3s.buetow.org keybr.f3s.buetow.org anki.f3s.buetow.org bag.f3s.buetow.org flux.f3s.buetow.org audiobookshelf.f3s.buetow.org garage.f3s.buetow.org grafana.f3s.buetow.org radicale.f3s.buetow.org syncthing.f3s.buetow.org koreader.f3s.buetow.org filebrowser.f3s.buetow.org webdav.f3s.buetow.org pkgrepo.f3s.buetow.org goprecords.f3s.buetow.org ipv6test.f3s.buetow.org ipv4.ipv6test.f3s.buetow.org ipv6.ipv6test.f3s.buetow.org/; + qw/f3s.buetow.org ychat.f3s.buetow.org player.f3s.buetow.org xplayer.f3s.buetow.org pihole.f3s.buetow.org jellyfin.f3s.buetow.org navidrome.f3s.buetow.org git.f3s.buetow.org c-git.f3s.buetow.org code.f3s.buetow.org immich.f3s.buetow.org argocd.f3s.buetow.org keybr.f3s.buetow.org anki.f3s.buetow.org bag.f3s.buetow.org flux.f3s.buetow.org audiobookshelf.f3s.buetow.org garage.f3s.buetow.org grafana.f3s.buetow.org radicale.f3s.buetow.org syncthing.f3s.buetow.org koreader.f3s.buetow.org filebrowser.f3s.buetow.org webdav.f3s.buetow.org pkgrepo.f3s.buetow.org goprecords.f3s.buetow.org ipv6test.f3s.buetow.org ipv4.ipv6test.f3s.buetow.org ipv6.ipv6test.f3s.buetow.org/; # optionally, only enable manually for temp time, as no password protection yet # push @f3s_hosts, 'registry.f3s.buetow.org'; -- cgit v1.2.3