Add GitOps stack for abrban.com with Gitea Actions CI/CD.

Harbor in-cluster builds via Kaniko, ArgoCD auto-sync, and production Helm values for abrban.com domains. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-02 01:27:20 +03:30
parent ee5bd0a291
commit 5ed2ef0958
39 changed files with 1841 additions and 99 deletions
@@ -0,0 +1,57 @@
+# Gitea Actions runner — host mode + Kaniko (no docker.sock; k3s uses containerd)
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-act-runner-token
+  namespace: gitea
+type: Opaque
+stringData:
+  token: "nL63VkZEyqpCNFdF3AMM9wzQLdLlATUvXSe5Tj0R"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea-act-runner
+  namespace: gitea
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gitea-act-runner
+  template:
+    metadata:
+      labels:
+        app: gitea-act-runner
+    spec:
+      imagePullSecrets:
+        - name: registry-pull-secret
+      initContainers:
+        - name: kaniko-bin
+          image: registry.abrban.com/abrban/kaniko-executor:v1.23.2
+          imagePullPolicy: IfNotPresent
+          command: ["sh", "-c", "cp /kaniko/executor /kaniko-bin/executor && chmod +x /kaniko-bin/executor"]
+          volumeMounts:
+            - name: kaniko-bin
+              mountPath: /kaniko-bin
+      containers:
+        - name: runner
+          image: registry.abrban.com/abrban/act-runner:0.2.11
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: GITEA_INSTANCE_URL
+              value: https://git.abrban.com
+            - name: GITEA_RUNNER_REGISTRATION_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-act-runner-token
+                  key: token
+            - name: GITEA_RUNNER_NAME
+              value: k8s-abr-runner
+            - name: GITEA_RUNNER_LABELS
+              value: abrban-kaniko:host
+          volumeMounts:
+            - name: kaniko-bin
+              mountPath: /kaniko
+      volumes:
+        - name: kaniko-bin
+          emptyDir: {}
@@ -0,0 +1,55 @@
+global:
+  imagePullSecrets:
+    - registry-pull-secret
+  storageClass: local-path
+
+# Local copy in abrban/ (seeded by copy-gitea-image job) — kubelet pulls without proxy-cache
+image:
+  registry: registry.abrban.com
+  repository: abrban/gitea
+  tag: 1.26.1
+  rootless: true
+
+gitea:
+  config:
+    database:
+      DB_TYPE: sqlite3
+    server:
+      DOMAIN: git.abrban.com
+      ROOT_URL: https://git.abrban.com/
+      SSH_DOMAIN: git.abrban.com
+    actions:
+      ENABLED: true
+
+ingress:
+  enabled: true
+  className: traefik
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+  hosts:
+    - host: git.abrban.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: abrban-wildcard-tls
+      hosts:
+        - git.abrban.com
+
+persistence:
+  enabled: true
+  storageClass: local-path
+  size: 10Gi
+
+# SQLite — no extra DB images to pull
+postgresql:
+  enabled: false
+
+valkey-cluster:
+  enabled: false
+
+valkey:
+  enabled: false
+
+postgresql-ha:
+  enabled: false