test: flux local cluster setup with infra-devops post

2026-03-25 12:08:55 +08:00
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-actions-dind-config
+  namespace: infra-gitops
+data:
+  daemon.json: |-
+    {
+      "mtu": 1280
+    }
@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-custom-templates
+  namespace: infra-gitops
+data:
+  home.tmpl: |-
+    {{template "base/head" .}}
+    <div class="page-content home">
+            <div class="ui stackable middle very relaxed page grid">
+                    <div class="sixteen wide center aligned centered column">
+                            <div>
+                                    <img class="logo" width="220" height="220" src="{{AssetUrlPrefix}}/img/logo.svg"/>
+                            </div>
+                            <div class="hero">
+                                    <h1 class="ui icon header title">
+                                            {{AppName}}
+                                    </h1>
+                                    <h2><a href="https://dev.cm">Dev.cm</a> - Git {{ctx.Locale.Tr "repository"}}</h2>
+                            </div>
+                    </div>
+            </div>
+    </div>
+    {{template "base/footer" .}}
+
+  extra_links.tmpl: |-
+    <a class="item" href="https://dev.cm" target="_blank">{{if eq ctx.Locale.Lang "zh-CN"}}博客{{else}}Blog{{end}}</a>
+    <a class="item extra-links-end" href="https://fillcode.com" target="_blank">Fillcode</a>
+    <style>
+      .extra-links-end ~ a { display:none !important; }
+    </style>
@@ -0,0 +1,47 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitea-actions
+  namespace: infra-gitops
+spec:
+  interval: 30m
+  dependsOn:
+    - name: gitea
+  chart:
+    spec:
+      chart: actions
+      version: 0.0.2
+      sourceRef:
+        kind: HelmRepository
+        name: gitea
+        namespace: infra-gitops
+      interval: 12h
+  values:
+    enabled: true
+    statefulset:
+      actRunner:
+        config: |
+          log:
+            level: info
+          cache:
+            enabled: true
+          container:
+            require_docker: true
+            docker_timeout: 300s
+            # 使用bridge网络模式，解决新建任务临时网络mtu与主机不一致的问题
+            network: bridge
+      dind:
+        # 挂载dind docker配置文件，解决mtu带来的网络问题
+        extraVolumeMounts:
+          - name: dind-config-volume
+            mountPath: /etc/docker/daemon.json
+            subPath: daemon.json
+      extraVolumes:
+        - name: dind-config-volume
+          configMap:
+            name: gitea-actions-dind-config
+      persistence:
+        size: 10Gi
+    giteaRootURL: http://gitea-http.infra-gitops.svc.cluster.local:3000
+    existingSecret: gitea-actions
+    existingSecretKey: token
@@ -0,0 +1,111 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitea
+  namespace: infra-gitops
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: gitea
+      version: 12.5.0
+      sourceRef:
+        kind: HelmRepository
+        name: gitea
+        namespace: infra-gitops
+      interval: 12h
+  values:
+    redis-cluster:
+      enabled: false
+    postgresql-ha:
+      enabled: false
+    image:
+      tag: 1.25.5
+    ingress:
+      enabled: true
+      className: nginx
+      annotations:
+        nginx.ingress.kubernetes.io/proxy-body-size: "50m"
+        nginx.ingress.kubernetes.io/configuration-snippet: |
+          proxy_set_header Accept-Encoding "";
+          subs_filter_types text/html;
+          subs_filter '<(script|img|link)([^>]*) (src|href)="/' '<$1$2 $3="https://cdn.fillcode.com/git-dev-cm/' ri;
+          subs_filter 'url\(\/' 'url(https://cdn.fillcode.com/git-dev-cm/' ri;
+          subs_filter '<head>' '<head><script src="/__static/pwa-cdn.js"></script>' ri;
+      hosts:
+        - host: git.dev.cm
+          paths:
+            - path: /
+              pathType: Prefix
+    gitea:
+      podAnnotations:
+        backup.velero.io/backup-volumes: data
+      config:
+        APP_NAME: Git Dev.cm
+        RUN_MODE: prod
+        server:
+          DOMAIN: git.dev.cm
+          ROOT_URL: https://git.dev.cm/
+        database:
+          DB_TYPE: postgres
+          HOST: cnpg17-cluster-sh-rw.infra-data:5432
+          NAME: gitea
+          USER: app
+          SSL_MODE: disable
+        session:
+          PROVIDER: redis
+        cache:
+          ADAPTER: redis
+        queue:
+          TYPE: redis
+        repository:
+          DEFAULT_REPO_UNITS: repo.code,repo.releases,repo.issues,repo.pulls
+        actions:
+          ENABLED: true
+          DEFAULT_ACTIONS_URL: github
+        service:
+          DISABLE_REGISTRATION: true
+          NO_REPLY_ADDRESS: noreply.dev.cm
+        picture:
+          GRAVATAR_SOURCE: https://cravatar.cn/avatar/
+        i18n:
+          LANGS: zh-CN,en-US
+          NAMES: 简体中文,English
+        other:
+          SHOW_FOOTER_VERSION: false
+          SHOW_FOOTER_POWERED_BY: false
+        log:
+          LEVEL: Info
+        ui:
+          THEMES: gitea-auto, gitea-light, gitea-dark, github-auto, github-light, github-dark, github-soft-dark
+          DEFAULT_THEME: github-auto
+      additionalConfigFromEnvs:
+        - name: GITEA__DATABASE__PASSWD
+          valueFrom:
+            secretKeyRef:
+              name: cnpg17-cluster-sh-app
+              key: password
+        - name: REDIS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: valkey-cluster-sh
+              key: valkey-password
+        - name: GITEA__SESSION__PROVIDER_CONFIG
+          value: "redis://:$(REDIS_PASSWORD)@valkey-cluster-sh-headless.infra-data:6379/0?pool_size=100&idle_timeout=180s"
+        - name: GITEA__CACHE__HOST
+          value: "redis://:$(REDIS_PASSWORD)@valkey-cluster-sh-headless.infra-data:6379/0?pool_size=100&idle_timeout=180s"
+        - name: GITEA__QUEUE__CONN_STR
+          value: "redis://:$(REDIS_PASSWORD)@valkey-cluster-sh-headless.infra-data:6379/0?pool_size=100&idle_timeout=180s"
+    valkey-cluster:
+      enabled: false
+    extraVolumes:
+      - name: gitea-custom-templates-volume
+        configMap:
+          name: gitea-custom-templates
+    extraContainerVolumeMounts:
+      - name: gitea-custom-templates-volume
+        subPath: home.tmpl
+        mountPath: /data/gitea/templates/home.tmpl
+      - name: gitea-custom-templates-volume
+        subPath: extra_links.tmpl
+        mountPath: /data/gitea/templates/custom/extra_links.tmpl
@@ -0,0 +1,30 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea-static
+  namespace: infra-gitops
+  annotations:
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    nginx.ingress.kubernetes.io/proxy-buffering: "on"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      proxy_cache cache;
+      proxy_cache_valid 200 302 7d;
+      proxy_cache_valid 404 10m;
+      proxy_cache_valid any 1h;
+      proxy_cache_use_stale error timeout updating http_404 http_500 http_502 http_503 http_504;
+      proxy_cache_bypass $http_x_purge;
+      proxy_ignore_headers Cache-Control;
+      add_header X-Cache-Status $upstream_cache_status;
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: git.dev.cm
+      http:
+        paths:
+          - path: /(.*\.(css|js|png|jpg|jpeg|gif|svg|webp|ico|woff|woff2|ttf|eot)|avatars/[^/]+)$
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: gitea-http
+                port:
+                  number: 3000
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrelease-gitea.yaml
+  - helmrelease-gitea-actions.yaml
+  - configmap-templates.yaml
+  - configmap-actions-dind.yaml
+  - ingress-static-gitea.yaml
+  - loadbalancer-ssh.yaml
+  - networkpolicy-gitea.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-ssh-lb
+  namespace: infra-gitops
+spec:
+  selector:
+    app.kubernetes.io/name: gitea
+    app.kubernetes.io/instance: gitea
+  ports:
+    - protocol: TCP
+      port: 22
+      targetPort: 2222
+  type: LoadBalancer
@@ -0,0 +1,16 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-gitea
+  namespace: infra-gitops
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: gitea
+  ingress:
+    - {}
+  egress:
+    - {}
+  policyTypes:
+    - Ingress
+    - Egress