app/codehosting/forgejo.libsonnet

/*

    Deploy a Forgejo instance with PostgreSQL database and additional PV for git data.
    Pre-provision the secrets with:

    kubectl -n $KUBE_NAMESPACE create secret generic forgejo \
      --from-literal=postgres_password=$(pwgen -s 24 1) \
      --from-literal=secret_key=$(pwgen -s 128 1) \
      --from-literal=admin_password=$(pwgen -s 128 1) \
      --from-literal=oauth2_client_id=$SSO_CLIENT_ID \
      --from-literal=oauth2_client_secret=$SSO_CLIENT_SECRET \
      --from-literal=ldap_bind_dn=$LDAP_BIND_DN \
      --from-literal=ldap_bind_password=$LDAP_BIND_PASSWORD \
      --from-literal=smtp_password=$SMTP_PASSWORD

    Import objectstore secret:

    ceph_ns=ceph-waw3; ceph_pool=waw-hdd-redundant-3
    kubectl -n $ceph_ns get secrets rook-ceph-object-user-${ceph_pool}-object-codehosting -o json | jq 'del(.metadata.namespace,.metadata.resourceVersion,.metadata.uid) | .metadata.creationTimestamp=null' | kubectl apply -f - -n $KUBE_NAMESPACE

    Import oidc auth trigger:

    kubectl -n $KUBE_NAMESPACE exec deploy/postgres -i -- psql -U forgejo forgejo < create-oidc-binding.sql

*/

local kube = import "../../kube/kube.libsonnet";
local postgres = import "../../kube/postgres.libsonnet";

{
    local forgejo = self,
    local cfg = forgejo.cfg,
    cfg:: {
        namespace: error "namespace must be set",
        prefix: "",

        image: "codeberg.org/forgejo/forgejo:1.20.5-0",
        storageClassName: "waw-hdd-redundant-3",
        storageSize: { git: "200Gi" },

        admin_username: error "admin_username must be set",
        admin_email: error "admin_email must be set",

        # Forgejo configuration, roughly representing the structure of app.ini
        instanceName: error "instanceName (e.g. 'Warsaw Hackerspace Forgejo') must be set",
        runMode: "prod",
        altDomains: [],
        server: {
            domain: error "domain (e.g. git.hackerspace.pl) must be set",
            sshDomain: cfg.server.domain,
            rootURL: "https://" + cfg.server.domain + "/",
            offlineMode: "true",
        },
        security: {
            installLock: "true",
        },
        service: {
            disableRegistration: "false",
            allowOnlyExternalRegistration: "true",
        },

        s3: {
            endpoint: "rook-ceph-rgw-waw-hdd-redundant-3-object.ceph-waw3.svc:80", #{ secretKeyRef: {name: "rook-ceph-object-user-waw-hdd-redundant-3-object-codehosting", key: "Endpoint" } },
            accessKey: { secretKeyRef: {name: "rook-ceph-object-user-waw-hdd-redundant-3-object-codehosting", key: "AccessKey" } },
            secretKey: { secretKeyRef: {name: "rook-ceph-object-user-waw-hdd-redundant-3-object-codehosting", key: "SecretKey" } },
            bucket: "codehosting",
        },

        mailer: {
            from: "forgejo@hackerspace.pl",
            host: "mail.hackerspace.pl",
            port: 465,
            user: "forgejo",
            password: { secretKeyRef: { name: "forgejo", key: "smtp_password" } },
        },
    },

    name(suffix):: cfg.prefix + suffix,
    ns: kube.Namespace(cfg.namespace),

    postgres: postgres {
        cfg+: {
            namespace: cfg.namespace,
            appName: "forgejo",
            database: "forgejo",
            username: "forgejo",
            password: { secretKeyRef: { name: "forgejo", key: "postgres_password" } },
            storageClassName: cfg.storageClassName,
        },
    },

    configMap: forgejo.ns.Contain(kube.ConfigMap(forgejo.name("forgejo"))) {
        data: {
            "app.ini.template": importstr 'app.ini.template',
            "entrypoint.sh": importstr 'entrypoint.sh',
            "bootstrap-auth.sh": importstr 'bootstrap-auth.sh',
        },
    },

    dataVolume: forgejo.ns.Contain(kube.PersistentVolumeClaim(forgejo.name("forgejo"))) {
        spec+: {
            storageClassName: cfg.storageClassName,
            accessModes: [ "ReadWriteOnce" ],
            resources: {
                requests: {
                    storage: cfg.storageSize.git,
                },
            },
        },
    },

    forgejoCustom: forgejo.ns.Contain(kube.ConfigMap(forgejo.name("forgejo-custom"))) {
        data: {
            "signin_inner.tmpl": importstr 'signin_inner.tmpl',
        },
    },

    statefulSet: forgejo.ns.Contain(kube.StatefulSet(forgejo.name("forgejo"))) {
        spec+: {
            replicas: 1,
            template+: {
                spec+: {
                    securityContext: {
                        runAsUser: 1000,
                        runAsGroup: 1000,
                        fsGroup: 1000,
                    },
                    volumes_: {
                        configmap: kube.ConfigMapVolume(forgejo.configMap),
                        custom: kube.ConfigMapVolume(forgejo.forgejoCustom),
                        data: kube.PersistentVolumeClaimVolume(forgejo.dataVolume),
                        empty: kube.EmptyDirVolume(),
                    },
                    containers_: {
                        server: kube.Container(forgejo.name("forgejo")) {
                            image: cfg.image,
                            command: [ "bash", "/usr/bin/entrypoint" ],
                            ports_: {
                                server: { containerPort: 3000 },
                                ssh: { containerPort: 22 },
                            },
                            readinessProbe: {
                                tcpSocket: {
                                    port: "server",
                                },
                                initialDelaySeconds: 5,
                                periodSeconds: 5,
                                successThreshold: 1,
                                failureThreshold: 3
                            },
                            env_: {
                                APP_NAME: cfg.instanceName,
                                RUN_MODE: cfg.runMode,
                                INSTALL_LOCK: cfg.security.installLock,
                                SECRET_KEY: { secretKeyRef: { name: "forgejo", key: "secret_key" } },
                                DB_TYPE: "postgres",
                                DB_HOST: "postgres:5432",
                                DB_USER: forgejo.postgres.cfg.username,
                                DB_PASSWD: forgejo.postgres.cfg.password,
                                DB_NAME: forgejo.postgres.cfg.appName,
                                DOMAIN: cfg.server.domain,
                                SSH_DOMAIN: cfg.server.sshDomain,
                                SSH_LISTEN_PORT: "2222",
                                ROOT_URL: forgejo.cfg.server.rootURL,
                                DISABLE_REGISTRATION: cfg.service.disableRegistration,
                                ALLOW_ONLY_EXTERNAL_REGISTRATION: cfg.service.allowOnlyExternalRegistration,
                                OFFLINE_MODE: cfg.server.offlineMode,
                                USER_UID: "1000",
                                USER_GID: "1000",
                                GITEA_CUSTOM: "/custom",
                                MINIO_ENDPOINT: cfg.s3.endpoint,
                                MINIO_BUCKET: cfg.s3.bucket,
                                MINIO_ACCESS_KEY_ID: cfg.s3.accessKey,
                                MINIO_SECRET_ACCESS_KEY: cfg.s3.secretKey,
                                MAILER_FROM: cfg.mailer.from,
                                MAILER_HOST: cfg.mailer.host,
                                MAILER_PORT: cfg.mailer.port,
                                MAILER_USER: cfg.mailer.user,
                                MAILER_PASSWORD: cfg.mailer.password,
                            },
                            volumeMounts: [
                                { name: "configmap", subPath: "entrypoint.sh", mountPath: "/usr/bin/entrypoint" },
                                { name: "configmap", subPath: "app.ini.template", mountPath: "/etc/templates/app.ini" },
                                { name: "data", mountPath: "/data" },
                                { name: "empty", mountPath: "/custom" },
                                { name: "custom", subPath: "signin_inner.tmpl", mountPath: "/custom/templates/user/auth/signin_inner.tmpl" },
                            ],
                        },
                    },
                    initContainers: [
                        kube.Container(forgejo.name("forgejo-dbmigrate")) {
                            image: forgejo.statefulSet.spec.template.spec.containers_.server.image,
                            command: [ "bash", "/usr/bin/entrypoint", "/app/gitea/gitea", "migrate" ],
                            env_: forgejo.statefulSet.spec.template.spec.containers_.server.env_,
                            volumeMounts: forgejo.statefulSet.spec.template.spec.containers_.server.volumeMounts,
                        },
                        kube.Container(forgejo.name("forgejo-bootstrap-auth")) {
                            image: forgejo.statefulSet.spec.template.spec.containers_.server.image,
                            command: [
                              "bash", "/bootstrap-auth.sh"
                            ],
                            env_: forgejo.statefulSet.spec.template.spec.containers_.server.env_ + {
                              ADMIN_PASSWORD: { secretKeyRef: { name: "forgejo", key: "admin_password" } },
                              SSO_CLIENT_ID: { secretKeyRef: { name: "forgejo", key: "oauth2_client_id" } },
                              SSO_CLIENT_SECRET: { secretKeyRef: { name: "forgejo", key: "oauth2_client_secret" } },
                              LDAP_BIND_DN: { secretKeyRef: { name: "forgejo", key: "ldap_bind_dn" } },
                              LDAP_BIND_PASSWORD: { secretKeyRef: { name: "forgejo", key: "ldap_bind_password" } },
                            },
                            volumeMounts: forgejo.statefulSet.spec.template.spec.containers_.server.volumeMounts + [
                                { name: "configmap", subPath: "bootstrap-auth.sh", mountPath: "/bootstrap-auth.sh" },
                            ]
                        },
                    ],
                },
            },
        },
    },

    svc: forgejo.ns.Contain(kube.Service(forgejo.name("forgejo"))) {
        target_pod:: forgejo.statefulSet.spec.template,
        spec+: {
            ports: [
                { name: "server", port: 80, targetPort: 3000, protocol: "TCP" },
                { name: "ssh", port: 22, targetPort: 2222, protocol: "TCP" },
            ],
        },
    },

    ingress: forgejo.ns.Contain(kube.Ingress(forgejo.name("forgejo"))) {
        metadata+: {
            annotations+: {
                "kubernetes.io/tls-acme": "true",
                "cert-manager.io/cluster-issuer": "letsencrypt-prod",
                "nginx.ingress.kubernetes.io/proxy-body-size": "0",
            },
        },
        spec+: {
            tls: [
                { hosts: [cfg.server.domain] + cfg.altDomains, secretName: forgejo.name("acme") },
            ],
            rules: [
                {
                    host: domain,
                    http: {
                        paths: [
                            { path: "/", backend: forgejo.svc.name_port },
                        ],
                    },
                }
                for domain in [cfg.server.domain] + cfg.altDomains
            ],
        },
    },

}