gitea-install.yaml

---
apiVersion: v1
kind: Namespace
metadata:
  name: gitea
---
# Source: gitea/charts/memcached/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitea-memcached
  namespace: gitea
  labels:
    app.kubernetes.io/name: memcached
    helm.sh/chart: memcached-5.9.0
    app.kubernetes.io/instance: gitea
    app.kubernetes.io/managed-by: Helm
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: memcached
      app.kubernetes.io/instance: gitea
  replicas: 1
  template:
    metadata:
      labels:
        app.kubernetes.io/name: memcached
        helm.sh/chart: memcached-5.9.0
        app.kubernetes.io/instance: gitea
        app.kubernetes.io/managed-by: Helm
    spec:
      affinity:
        podAffinity:

        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/name: memcached
                    app.kubernetes.io/instance: gitea
                namespaces:
                  - "gitea"
                topologyKey: kubernetes.io/hostname
              weight: 1
        nodeAffinity:

      securityContext:
        fsGroup: 1001
        runAsUser: 1001
      serviceAccountName: gitea-memcached
      containers:
        - name: memcached
          image: docker.io/bitnami/memcached:1.6.9-debian-10-r114
          imagePullPolicy: "IfNotPresent"
          args:
            - /run.sh
          env:
            - name: BITNAMI_DEBUG
              value: "false"
          ports:
            - name: memcache
              containerPort: 11211
          livenessProbe:
            tcpSocket:
              port: memcache
            initialDelaySeconds: 30
            timeoutSeconds: 5
            failureThreshold: 6
          readinessProbe:
            tcpSocket:
              port: memcache
            initialDelaySeconds: 5
            timeoutSeconds: 3
            periodSeconds: 5
          resources:
            limits: {}
            requests:
              cpu: 250m
              memory: 256Mi
          volumeMounts:
            - name: tmp
              mountPath: /tmp
          securityContext:
            readOnlyRootFilesystem: false
      volumes:
        - name: tmp
          emptyDir: {}
---
# Source: gitea/charts/memcached/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: gitea-memcached
  namespace: gitea
  labels:
    app.kubernetes.io/name: memcached
    helm.sh/chart: memcached-5.9.0
    app.kubernetes.io/instance: gitea
    app.kubernetes.io/managed-by: Helm
  annotations:
spec:
  type: ClusterIP
  ports:
    - name: memcache
      port: 11211
      targetPort: memcache
      nodePort: null
  selector:
    app.kubernetes.io/name: memcached
    app.kubernetes.io/instance: gitea
---
# Source: gitea/charts/memcached/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: true
metadata:
  name: gitea-memcached
  namespace: gitea
  labels:
    app.kubernetes.io/name: memcached
    helm.sh/chart: memcached-5.9.0
    app.kubernetes.io/instance: gitea
    app.kubernetes.io/managed-by: Helm
---
# Source: gitea/charts/postgresql/templates/secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: gitea-postgresql
  labels:
    app.kubernetes.io/name: postgresql
    helm.sh/chart: postgresql-10.3.17
    app.kubernetes.io/instance: gitea
    app.kubernetes.io/managed-by: Helm
  namespace: gitea
type: Opaque
data:
  postgresql-postgres-password: "MlFMck9jN2tYZw=="
  postgresql-password: "Z2l0ZWE="
---
# Source: gitea/charts/postgresql/templates/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: gitea-postgresql
  labels:
    app.kubernetes.io/name: postgresql
    helm.sh/chart: postgresql-10.3.17
    app.kubernetes.io/instance: gitea
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: primary
  annotations:
  namespace: gitea
spec:
  serviceName: gitea-postgresql-headless
  replicas: 1
  updateStrategy:
    type: RollingUpdate
  selector:
    matchLabels:
      app.kubernetes.io/name: postgresql
      app.kubernetes.io/instance: gitea
      role: primary
  template:
    metadata:
      name: gitea-postgresql
      labels:
        app.kubernetes.io/name: postgresql
        helm.sh/chart: postgresql-10.3.17
        app.kubernetes.io/instance: gitea
        app.kubernetes.io/managed-by: Helm
        role: primary
        app.kubernetes.io/component: primary
    spec:
      affinity:
        podAffinity:

        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/name: postgresql
                    app.kubernetes.io/instance: gitea
                    app.kubernetes.io/component: primary
                namespaces:
                  - "gitea"
                topologyKey: kubernetes.io/hostname
              weight: 1
        nodeAffinity:

      securityContext:
        fsGroup: 1001
      containers:
        - name: gitea-postgresql
          image: docker.io/bitnami/postgresql:11.11.0-debian-10-r62
          imagePullPolicy: "IfNotPresent"
          resources:
            requests:
              cpu: 250m
              memory: 256Mi
          securityContext:
            runAsUser: 1001
          env:
            - name: BITNAMI_DEBUG
              value: "false"
            - name: POSTGRESQL_PORT_NUMBER
              value: "5432"
            - name: POSTGRESQL_VOLUME_DIR
              value: "/bitnami/postgresql"
            - name: PGDATA
              value: "/bitnami/postgresql/data"
            - name: POSTGRES_POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: gitea-postgresql
                  key: postgresql-postgres-password
            - name: POSTGRES_USER
              value: "gitea"
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: gitea-postgresql
                  key: postgresql-password
            - name: POSTGRES_DB
              value: "gitea"
            - name: POSTGRESQL_ENABLE_LDAP
              value: "no"
            - name: POSTGRESQL_ENABLE_TLS
              value: "no"
            - name: POSTGRESQL_LOG_HOSTNAME
              value: "false"
            - name: POSTGRESQL_LOG_CONNECTIONS
              value: "false"
            - name: POSTGRESQL_LOG_DISCONNECTIONS
              value: "false"
            - name: POSTGRESQL_PGAUDIT_LOG_CATALOG
              value: "off"
            - name: POSTGRESQL_CLIENT_MIN_MESSAGES
              value: "error"
            - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
              value: "pgaudit"
          ports:
            - name: tcp-postgresql
              containerPort: 5432
          livenessProbe:
            exec:
              command:
                - /bin/sh
                - -c
                - exec pg_isready -U "gitea" -d "dbname=gitea" -h 127.0.0.1 -p 5432
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 5
            successThreshold: 1
            failureThreshold: 6
          readinessProbe:
            exec:
              command:
                - /bin/sh
                - -c
                - -e
                - |
                  exec pg_isready -U "gitea" -d "dbname=gitea" -h 127.0.0.1 -p 5432
                  [ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 5
            successThreshold: 1
            failureThreshold: 6
          volumeMounts:
            - name: dshm
              mountPath: /dev/shm
            - name: data
              mountPath: /bitnami/postgresql
              subPath:
      volumes:
        - name: dshm
          emptyDir:
            medium: Memory
            sizeLimit: 1Gi
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes:
          - "ReadWriteOnce"
        resources:
          requests:
            storage: "10Gi"
---
# Source: gitea/charts/postgresql/templates/svc-headless.yaml
apiVersion: v1
kind: Service
metadata:
  name: gitea-postgresql-headless
  labels:
    app.kubernetes.io/name: postgresql
    helm.sh/chart: postgresql-10.3.17
    app.kubernetes.io/instance: gitea
    app.kubernetes.io/managed-by: Helm
    # Use this annotation in addition to the actual publishNotReadyAddresses
    # field below because the annotation will stop being respected soon but the
    # field is broken in some versions of Kubernetes:
    # https://github.com/kubernetes/kubernetes/issues/58662
    service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
  namespace: gitea
spec:
  type: ClusterIP
  clusterIP: None
  # We want all pods in the StatefulSet to have their addresses published for
  # the sake of the other Postgresql pods even before they're ready, since they
  # have to be able to talk to each other in order to become ready.
  publishNotReadyAddresses: true
  ports:
    - name: tcp-postgresql
      port: 5432
      targetPort: tcp-postgresql
  selector:
    app.kubernetes.io/name: postgresql
    app.kubernetes.io/instance: gitea
---
# Source: gitea/charts/postgresql/templates/svc.yaml
apiVersion: v1
kind: Service
metadata:
  name: gitea-postgresql
  labels:
    app.kubernetes.io/name: postgresql
    helm.sh/chart: postgresql-10.3.17
    app.kubernetes.io/instance: gitea
    app.kubernetes.io/managed-by: Helm
  annotations:
  namespace: gitea
spec:
  type: ClusterIP
  ports:
    - name: tcp-postgresql
      port: 5432
      targetPort: tcp-postgresql
  selector:
    app.kubernetes.io/name: postgresql
    app.kubernetes.io/instance: gitea
    role: primary
---
# Source: gitea/templates/gitea/config.yaml
apiVersion: v1
kind: Secret
metadata:
  name: gitea-inline-config
  labels:
    helm.sh/chart: gitea-6.0.3
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
    app.kubernetes.io/version: "1.17.3"
    version: "1.17.3"
    app.kubernetes.io/managed-by: Helm
  namespace: gitea
type: Opaque
stringData:
  _generals_: ""
  cache: |-
    ADAPTER=memcache
    ENABLED=true
    HOST=gitea-memcached.gitea.svc.cluster.local:11211
  database: |-
    DB_TYPE=postgres
    HOST=gitea-postgresql.gitea.svc.cluster.local:5432
    NAME=gitea
    PASSWD=gitea
    USER=gitea
  metrics: ENABLED=false
  repository: ROOT=/data/git/gitea-repositories
  security: INSTALL_LOCK=true
  server: |-
    APP_DATA_PATH=/data
    DOMAIN=localhost:31333
    ENABLE_PPROF=false
    HTTP_PORT=3000
    PROTOCOL=https
    ROOT_URL=https://localhost:31333
    SSH_DOMAIN=localhost
    SSH_LISTEN_PORT=22
    SSH_PORT=22

    CERT_FILE=cert.pem
    KEY_FILE=key.pem
---
# Source: gitea/templates/gitea/config.yaml
apiVersion: v1
kind: Secret
metadata:
  name: gitea
  labels:
    helm.sh/chart: gitea-6.0.3
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
    app.kubernetes.io/version: "1.17.3"
    version: "1.17.3"
    app.kubernetes.io/managed-by: Helm
  namespace: gitea
type: Opaque
stringData:
  config_environment.sh: |-
    #!/usr/bin/env bash
    set -euo pipefail

    function env2ini::log() {
      printf "${1}\n"
    }

    function env2ini::read_config_to_env() {
      local section="${1}"
      local line="${2}"

      if [[ -z "${line}" ]]; then
        # skip empty line
        return
      fi
      
      # 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
      local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"

      if [[ -z "${setting}" ]]; then
        env2ini::log '  ! invalid setting'
        exit 1
      fi

      local value=''
      local regex="^${setting}(\s*)=(\s*)(.*)"
      if [[ $line =~ $regex ]]; then
        value="${BASH_REMATCH[3]}"
      else
        env2ini::log '  ! invalid setting'
        exit 1
      fi

      env2ini::log "    + '${setting}'"

      if [[ -z "${section}" ]]; then
        export "ENV_TO_INI____${setting^^}=${value}"                           # '^^' makes the variable content uppercase
        return
      fi

      local masked_section="${section//./_0X2E_}"                            # '//' instructs to replace all matches
      masked_section="${masked_section//-/_0X2D_}"

      export "ENV_TO_INI__${masked_section^^}__${setting^^}=${value}"        # '^^' makes the variable content uppercase
    }

    function env2ini::reload_preset_envs() {
      env2ini::log "Reloading preset envs..."

      while read -r line; do
        if [[ -z "${line}" ]]; then
          # skip empty line
          return
        fi

        # 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
        local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"

        if [[ -z "${setting}" ]]; then
          env2ini::log '  ! invalid setting'
          exit 1
        fi

        local value=''
        local regex="^${setting}(\s*)=(\s*)(.*)"
        if [[ $line =~ $regex ]]; then
          value="${BASH_REMATCH[3]}"
        else
          env2ini::log '  ! invalid setting'
          exit 1
        fi

        env2ini::log "  + '${setting}'"

        export "${setting^^}=${value}"                           # '^^' makes the variable content uppercase
      done < "/tmp/existing-envs"

      rm /tmp/existing-envs
    }


    function env2ini::process_config_file() {
      local config_file="${1}"
      local section="$(basename "${config_file}")"

      if [[ $section == '_generals_' ]]; then
        env2ini::log "  [ini root]"
        section=''
      else
        env2ini::log "  ${section}"
      fi

      while read -r line; do
        env2ini::read_config_to_env "${section}" "${line}"
      done < <(awk 1 "${config_file}")                             # Helm .toYaml trims the trailing new line which breaks line processing; awk 1 ... adds it back while reading
    }

    function env2ini::load_config_sources() {
      local path="${1}"

      if [[ -d "${path}" ]]; then
        env2ini::log "Processing $(basename "${path}")..."

        while read -d '' configFile; do
          env2ini::process_config_file "${configFile}"
        done < <(find "${path}" -type l -not -name '..data' -print0)

        env2ini::log "\n"
      fi
    }

    function env2ini::generate_initial_secrets() {
      # These environment variables will either be
      #   - overwritten with user defined values,
      #   - initially used to set up Gitea
      # Anyway, they won't harm existing app.ini files

      export ENV_TO_INI__SECURITY__INTERNAL_TOKEN=$(gitea generate secret INTERNAL_TOKEN)
      export ENV_TO_INI__SECURITY__SECRET_KEY=$(gitea generate secret SECRET_KEY)
      export ENV_TO_INI__OAUTH2__JWT_SECRET=$(gitea generate secret JWT_SECRET)
      export ENV_TO_INI__SERVER__LFS_JWT_SECRET=$(gitea generate secret LFS_JWT_SECRET)

      env2ini::log "...Initial secrets generated\n"
    }

    env | (grep ENV_TO_INI || [[ $? == 1 ]]) > /tmp/existing-envs

    # MUST BE CALLED BEFORE OTHER CONFIGURATION
    env2ini::generate_initial_secrets

    env2ini::load_config_sources '/env-to-ini-mounts/inlines/'
    env2ini::load_config_sources '/env-to-ini-mounts/additionals/'

    # load existing envs to override auto generated envs
    env2ini::reload_preset_envs

    env2ini::log "=== All configuration sources loaded ===\n"

    # safety to prevent rewrite of secret keys if an app.ini already exists
    if [ -f ${GITEA_APP_INI} ]; then
      env2ini::log 'An app.ini file already exists. To prevent overwriting secret keys, these settings are dropped and remain unchanged:'
      env2ini::log '  - security.INTERNAL_TOKEN'
      env2ini::log '  - security.SECRET_KEY'
      env2ini::log '  - oauth2.JWT_SECRET'
      env2ini::log '  - server.LFS_JWT_SECRET'

      unset ENV_TO_INI__SECURITY__INTERNAL_TOKEN
      unset ENV_TO_INI__SECURITY__SECRET_KEY
      unset ENV_TO_INI__OAUTH2__JWT_SECRET
      unset ENV_TO_INI__SERVER__LFS_JWT_SECRET
    fi

    environment-to-ini -o $GITEA_APP_INI -p ENV_TO_INI
---
# Source: gitea/templates/gitea/http-svc.yaml
apiVersion: v1
kind: Service
metadata:
  name: gitea-http
  labels:
    helm.sh/chart: gitea-6.0.3
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
    app.kubernetes.io/version: "1.17.3"
    version: "1.17.3"
    app.kubernetes.io/managed-by: Helm
  annotations: {}
  namespace: gitea
spec:
  type: NodePort
  ports:
  - port: 443
    protocol: TCP
    targetPort: 3000
    nodePort: 31333
  selector:
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
---
# Source: gitea/templates/gitea/init.yaml
apiVersion: v1
kind: Secret
metadata:
  name: gitea-init
  labels:
    helm.sh/chart: gitea-6.0.3
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
    app.kubernetes.io/version: "1.17.3"
    version: "1.17.3"
    app.kubernetes.io/managed-by: Helm
  namespace: gitea
type: Opaque
stringData:
  init_directory_structure.sh: |-
    #!/usr/bin/env bash

    set -euo pipefail

    set -x
    chown 1000:1000 /data
    mkdir -p /data/git/.ssh
    chmod -R 700 /data/git/.ssh
    [ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf

    # prepare temp directory structure
    mkdir -p "${GITEA_TEMP}"
    chown 1000:1000 "${GITEA_TEMP}"
    chmod ug+rwx "${GITEA_TEMP}"

    # configure certs
    cd $GITEA_CUSTOM
    echo "$CERT_CONTENTS" > cert.pem
    echo "$KEY_CONTENTS" > key.pem
    chmod ug+rw *.pem
    cd -

  configure_gitea.sh: |-
    #!/usr/bin/env bash

    set -euo pipefail

    echo '==== BEGIN GITEA CONFIGURATION ===='

    { # try
      gitea migrate
    } || { # catch
      echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
      exit 1
    }
    function configure_admin_user() {
      local ACCOUNT_ID=$(gitea admin user list --admin | grep -e "\s\+${GITEA_ADMIN_USERNAME}\s\+" | awk -F " " "{printf \$1}")
      if [[ -z "${ACCOUNT_ID}" ]]; then
        echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
        gitea admin user create --admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "gitea@local.domain" --must-change-password=false
        echo '...created.'
      else
        echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
        gitea admin user change-password --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}"
        echo '...password sync done.'
      fi
    }

    configure_admin_user

    function configure_ldap() {
        echo 'no ldap configuration... skipping.'
    }

    configure_ldap

    function configure_oauth() {
        echo 'no oauth configuration... skipping.'
    }

    configure_oauth

    echo '==== END GITEA CONFIGURATION ===='
---
# Source: gitea/templates/gitea/ssh-svc.yaml
apiVersion: v1
kind: Service
metadata:
  name: gitea-ssh
  labels:
    helm.sh/chart: gitea-6.0.3
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
    app.kubernetes.io/version: "1.17.3"
    version: "1.17.3"
    app.kubernetes.io/managed-by: Helm
  annotations: {}
  namespace: gitea
spec:
  type: NodePort
  ports:
    - name: ssh
      port: 22
      targetPort: 22
      protocol: TCP
      nodePort: 31322
  selector:
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
---
# Source: gitea/templates/gitea/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: gitea
  namespace: gitea
  labels:
    helm.sh/chart: gitea-6.0.3
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
    app.kubernetes.io/version: "1.17.3"
    version: "1.17.3"
    app.kubernetes.io/managed-by: Helm
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: gitea
      app.kubernetes.io/instance: gitea
  serviceName: gitea
  template:
    metadata:
      annotations:
        checksum/config: e70327e3d8fdbee8185e012c8aca9dbcb55978bd681f867f14e2a68e92fda3d4
      labels:
        helm.sh/chart: gitea-6.0.3
        app: gitea
        app.kubernetes.io/name: gitea
        app.kubernetes.io/instance: gitea
        app.kubernetes.io/version: "1.17.3"
        version: "1.17.3"
        app.kubernetes.io/managed-by: Helm
    spec:
      securityContext:
        fsGroup: 1000
      initContainers:
        - name: init-directories
          image: "gitea/gitea:1.17.3"
          imagePullPolicy: Always
          command: ["/usr/sbin/init_directory_structure.sh"]
          env:
            - name: GITEA_APP_INI
              value: /data/gitea/conf/app.ini
            - name: GITEA_CUSTOM
              value: /data/gitea
            - name: GITEA_WORK_DIR
              value: /data
            - name: GITEA_TEMP
              value: /tmp/gitea
            - name: KEY_CONTENTS
              value: |-
                -----BEGIN RSA PRIVATE KEY-----
                MIIEpQIBAAKCAQEAvlcKmLpfI6teIGIeVwjijSwY8PefL7l6xHHUFEKcgBmpaHWv
                /GHlI9XONDw6AlOGtg4oTeRs3jivooLCYM5udOQcfKo7BXGVByoVPX2mv8dA4Ebo
                FuneqaVvOMpPwoRK5kvbAtnk9h0KT2nSfPujZU6yHMNA0EHPUvBlJmNGxc5oVHQW
                8Y+RkgLI9VAzLp8bhgTS1ATlVC/YPQ+qp6hsLRa+LlNTKQxBRAal751Q+9U136bD
                f83P37tx2Azx47NfXXDijijX6ggdScGlSl/cgPjcQyvXL0PAD23pE67d371iEDHN
                EK4CRPxyMV7lZvYw2y9np/jVF1Zn1EsKOLcy0wIDAQABAoIBAQCA+A1QCwgn7Res
                LY+NPZH0Qersa3xLJAxRSyd+Stwr2Dd3dja2dcaDD33W2vAbX2kptlIM5Tf3IsWv
                AZafbYBeZ6n9toKjX6Cw6AzYS2lPDL2iuajMzc53eIbyHfMJRAZUIRXWyrlfIbI4
                uOVMllzSag45evtRoSXPdt+ysRXlNJkdtPaFY/fYzZdDr8uqSs+Kx80LRAjo1Be9
                oACq26Rs7sMGXOdg+r2QL74aNY1DDXrOKD3LqVMnssIXuigJ/ZdrtgMPELiKDyi+
                tSFAZ5q2izMyuhC3tmnYRtPWRd6IZsV8gpSx94iw2Pa2JH/svK7RnIJdqnWAsBwb
                0Ko+7aRhAoGBAOSUeT4r8j8l9jBFwuWgLBbAV/EutFrhCYg10ktnJHvDB/jU/Htr
                EugVtptQnHKECg9XFeaQIiCrWtw9aAuJOViuzeZ0IvHrlAwIjxGG7CzN1oGLu+Y7
                3UfEbT5WPqHZbJq4i4vRvNZY804mZSzuXzXnRGjcknt0mJg5KgVebRlbAoGBANUs
                PvEEdiuqVl1kKbMCF5kzKvCMQPZ7Da5qDZcWMtdnB64h9g/HRywskGli4GdWNsic
                xZn1i2Jc6suehEtd3l0C1+QxnVjOEFcL30X8JsB8jUMC57q0GxEA5UVljwPNjrfl
                d7xq28GxtSLNg4PRbLm53k/80vSsMsFAaBzHnI3pAoGBAKj/dRyYVUSHBpvuGAi6
                AZ7YmqyAwWunkeqZEGAbZAf0zEIXBo0hPxtEYnw2f1TTdrScyF5tFi5dQpIu/Gv7
                CuEcbLMEDooaiJzU/yIQRTFjBkNFUqkIfbP/8Fz0Wt5C6F8ELngzm5BGt6yCCq/L
                la0+zX9SBSMts1xodz7872CdAoGAfkeqtY4mDrHmXYajaSaZIij8i+kZ5ql4rlSm
                3lTJI28mTpJRuIEdeV6g4b0wICcjZu3v5MdfnZJbiOnLhvYBbunrSIPXqS7Q4S/o
                QQYhUq+14veKnMBqtETqjJSgBumzXN7zckt/CRwjqI1EFkdueAtSVeH4efa0TmTA
                CCR7alkCgYEAtym0m6GGblSKf5JvWGIT295seLXlV4K89wFCsu1A7zBw8SGYAy2W
                fcWLdZX0E9doSnkTKB0gOlhkjsxarKwdYevQ3/QeecaeDlNG56G4Dk75/kjUctUl
                ZW8OT12EexBYvQz9ktS8twSmWyRiUv1UYFjF16JQ6J8bdomuSH+gnqo=
                -----END RSA PRIVATE KEY-----
            - name: CERT_CONTENTS
              value: |-
                -----BEGIN CERTIFICATE-----
                MIIDczCCAlugAwIBAgIQRWIhuDNxiuif0qo61EEefDANBgkqhkiG9w0BAQsFADAi
                MRAwDgYDVQQKEwdBY21lIENvMQ4wDAYDVQQDEwVHaXRlYTAeFw0yMjEyMDgxNzE1
                MDFaFw0yMzEyMDgxNzE1MDFaMCIxEDAOBgNVBAoTB0FjbWUgQ28xDjAMBgNVBAMT
                BUdpdGVhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvlcKmLpfI6te
                IGIeVwjijSwY8PefL7l6xHHUFEKcgBmpaHWv/GHlI9XONDw6AlOGtg4oTeRs3jiv
                ooLCYM5udOQcfKo7BXGVByoVPX2mv8dA4EboFuneqaVvOMpPwoRK5kvbAtnk9h0K
                T2nSfPujZU6yHMNA0EHPUvBlJmNGxc5oVHQW8Y+RkgLI9VAzLp8bhgTS1ATlVC/Y
                PQ+qp6hsLRa+LlNTKQxBRAal751Q+9U136bDf83P37tx2Azx47NfXXDijijX6ggd
                ScGlSl/cgPjcQyvXL0PAD23pE67d371iEDHNEK4CRPxyMV7lZvYw2y9np/jVF1Zn
                1EsKOLcy0wIDAQABo4GkMIGhMA4GA1UdDwEB/wQEAwICpDATBgNVHSUEDDAKBggr
                BgEFBQcDATAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRiRYVn6dg4g7ib8INU
                srD4nIDjpjBKBgNVHREEQzBBgglsb2NhbGhvc3SCImdpdGVhLWh0dHAuZ2l0ZWEu
                c3ZjLmNsdXN0ZXIubG9jYWyHBKwSAAKHBKwSAAOHBKwSAAQwDQYJKoZIhvcNAQEL
                BQADggEBABXv5SgXORK8S0LNsiCu0of85jGf2sIF3HrePPG0wJ6+6klRdNfc1q8p
                xMU449Rtiu376wEiVWQKTxDqPYhs9FUB82B5zSz/hvaPcp0pdyGwRYsZcrhJIP4l
                jePhm7DKJxif/qgF/SUVoeyM6JBPYDKtEX6OY9Fqz8YGBzTs6SPbcy0R2GNzKUPN
                GHLJeYaQyftti1K5OcOOiHFbugSx9MPiwzjiz4PMrhqX4Z2KzBR8HopyV9SZlCjk
                I6baRxx9L+2XUCHjUJmQsJK/qyqsQAycvA0uuVoIAu76V82SLVhgTF8PviSgDvqg
                xC1mgd32vVqezjjM1QnLFGXc62HqNF0=
                -----END CERTIFICATE-----
          volumeMounts:
            - name: init
              mountPath: /usr/sbin
            - name: temp
              mountPath: /tmp
            - name: data
              mountPath: /data

          securityContext: {}
        - name: init-app-ini
          image: "gitea/gitea:1.17.3"
          imagePullPolicy: Always
          command: ["/usr/sbin/config_environment.sh"]
          env:
            - name: GITEA_APP_INI
              value: /data/gitea/conf/app.ini
            - name: GITEA_CUSTOM
              value: /data/gitea
            - name: GITEA_WORK_DIR
              value: /data
            - name: GITEA_TEMP
              value: /tmp/gitea
          volumeMounts:
            - name: config
              mountPath: /usr/sbin
            - name: temp
              mountPath: /tmp
            - name: data
              mountPath: /data
            - name: inline-config-sources
              mountPath: /env-to-ini-mounts/inlines/

          securityContext: {}
        - name: configure-gitea
          image: "gitea/gitea:1.17.3"
          command: ["/usr/sbin/configure_gitea.sh"]
          imagePullPolicy: Always
          securityContext:
            runAsUser: 1000
          env:
            - name: GITEA_APP_INI
              value: /data/gitea/conf/app.ini
            - name: GITEA_CUSTOM
              value: /data/gitea
            - name: GITEA_WORK_DIR
              value: /data
            - name: GITEA_TEMP
              value: /tmp/gitea
            - name: GITEA_ADMIN_USERNAME
              value: "gitea_admin"
            - name: GITEA_ADMIN_PASSWORD
              value: "r8sA8CPHD9!bt6d"
          volumeMounts:
            - name: init
              mountPath: /usr/sbin
            - name: temp
              mountPath: /tmp
            - name: data
              mountPath: /data

      terminationGracePeriodSeconds: 60
      containers:
        - name: gitea
          image: "gitea/gitea:1.17.3"
          imagePullPolicy: Always
          env:
            # SSH Port values have to be set here as well for openssh configuration
            - name: SSH_LISTEN_PORT
              value: "22"
            - name: SSH_PORT
              value: "22"
            - name: GITEA_APP_INI
              value: /data/gitea/conf/app.ini
            - name: GITEA_CUSTOM
              value: /data/gitea
            - name: GITEA_WORK_DIR
              value: /data
            - name: GITEA_TEMP
              value: /tmp/gitea
            - name: TMPDIR
              value: /tmp/gitea
            - name: GITEA__repository__ENABLE_PUSH_CREATE_USER
              value: "true"
          ports:
            - name: ssh
              containerPort: 22
            - name: http
              containerPort: 3000
          livenessProbe:
            failureThreshold: 10
            initialDelaySeconds: 200
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: http
            timeoutSeconds: 1
          readinessProbe:
            failureThreshold: 3
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: http
            timeoutSeconds: 1
          resources: {}
          securityContext: {}
          volumeMounts:
            - name: temp
              mountPath: /tmp
            - name: data
              mountPath: /data

      volumes:
        - name: init
          secret:
            secretName: gitea-init
            defaultMode: 110
        - name: config
          secret:
            secretName: gitea
            defaultMode: 110
        - name: inline-config-sources
          secret:
            secretName: gitea-inline-config
        - name: temp
          emptyDir: {}
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes:
          - "ReadWriteOnce"
        resources:
          requests:
            storage: "10Gi"