# bootstrap/gitea — Phase-1 host Gitea (GitOps bootstrap source)

Solves the self-hosted-git chicken-and-egg for Phase 1: the platform's Gitea will eventually run
*in* the cluster (Phase 6), but the cluster needs a git source to bootstrap *from*. So during
bring-up we run **a single Gitea container on the host**, outside the cluster, and Flux pulls this
repo from it.

## How it fits
- `bootstrap-gitea.sh` starts `gitea/gitea` on the host with a persistent data dir, HTTP on
  `:3000`, reachable from the cluster VMs on the **k3s-dev NAT gateway `10.73.0.1`**.
- The repo is pushed to it as a **public** repo (`Home-Network/home-network-k3s-impl`) — public so
  Flux needs no credentials; safe because this Gitea is **NAT-only, not internet-exposed**.
- Flux's `flux-system` GitRepository is wired to
  `http://10.73.0.1:3000/Home-Network/home-network-k3s-impl.git` (inlined in
  `clusters/dev/kustomization.yaml`). `bootstrap/flux/bootstrap.sh` then `apply -k clusters/dev` and
  Flux reconciles from here.

## Bring-up order (operator, at execution time — not now)
1. `./bootstrap/gitea/bootstrap-gitea.sh` → create admin + public repo → `git push bootstrap main`.
2. `tofu apply` (infra/tofu) — VMs + `k3s-dev` net.
3. Ansible `site.yml` — k3s HA + Cilium.
4. `bootstrap/sops/age-keygen.sh` → `install-age-key.sh` → `bootstrap/flux/bootstrap.sh`.
5. Flux reconciles `clusters/dev` from the host Gitea.

## Phase 6 cutover
Once the **in-cluster** Gitea is onboarded (`gitea.home.keithjackson.dev`), push the repo there,
repoint the `flux-system` GitRepository URL, and keep an **off-cluster mirror** (docs/05
"Circularity & DR"). The host Gitea can then be retired.

## Notes
- Pinned `gitea/gitea:1.22` (override `GITEA_IMAGE`); data at
  `~/.local/share/home-k3s-bootstrap-gitea` (override `GITEA_DATA_DIR`).
- No secrets here: admin credentials are created interactively at bring-up, never committed.