jakman85andClaude Opus 4.8
e6b4062310
Run a single Gitea container on the host (bootstrap/gitea/), outside the cluster, while the cluster is built; Flux pulls this repo from it over the k3s-dev NAT gateway (http://10.73.0.1:3000/Home-Network/home-network-k3s-impl.git, public repo => no creds, NAT-only). Wired the flux-system GitRepository url in clusters/dev. Migrates to in-cluster Gitea in Phase 6. Pins confirmed. Author-only; gate PASS. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
34 lines
1.9 KiB
Markdown
34 lines
1.9 KiB
Markdown
# bootstrap/gitea — Phase-1 host Gitea (GitOps bootstrap source)
|
|
|
|
Solves the self-hosted-git chicken-and-egg for Phase 1: the platform's Gitea will eventually run
|
|
*in* the cluster (Phase 6), but the cluster needs a git source to bootstrap *from*. So during
|
|
bring-up we run **a single Gitea container on the host**, outside the cluster, and Flux pulls this
|
|
repo from it.
|
|
|
|
## How it fits
|
|
- `bootstrap-gitea.sh` starts `gitea/gitea` on the host with a persistent data dir, HTTP on
|
|
`:3000`, reachable from the cluster VMs on the **k3s-dev NAT gateway `10.73.0.1`**.
|
|
- The repo is pushed to it as a **public** repo (`Home-Network/home-network-k3s-impl`) — public so
|
|
Flux needs no credentials; safe because this Gitea is **NAT-only, not internet-exposed**.
|
|
- Flux's `flux-system` GitRepository is wired to
|
|
`http://10.73.0.1:3000/Home-Network/home-network-k3s-impl.git` (inlined in
|
|
`clusters/dev/kustomization.yaml`). `bootstrap/flux/bootstrap.sh` then `apply -k clusters/dev` and
|
|
Flux reconciles from here.
|
|
|
|
## Bring-up order (operator, at execution time — not now)
|
|
1. `./bootstrap/gitea/bootstrap-gitea.sh` → create admin + public repo → `git push bootstrap main`.
|
|
2. `tofu apply` (infra/tofu) — VMs + `k3s-dev` net.
|
|
3. Ansible `site.yml` — k3s HA + Cilium.
|
|
4. `bootstrap/sops/age-keygen.sh` → `install-age-key.sh` → `bootstrap/flux/bootstrap.sh`.
|
|
5. Flux reconciles `clusters/dev` from the host Gitea.
|
|
|
|
## Phase 6 cutover
|
|
Once the **in-cluster** Gitea is onboarded (`gitea.home.keithjackson.dev`), push the repo there,
|
|
repoint the `flux-system` GitRepository URL, and keep an **off-cluster mirror** (docs/05
|
|
"Circularity & DR"). The host Gitea can then be retired.
|
|
|
|
## Notes
|
|
- Pinned `gitea/gitea:1.22` (override `GITEA_IMAGE`); data at
|
|
`~/.local/share/home-k3s-bootstrap-gitea` (override `GITEA_DATA_DIR`).
|
|
- No secrets here: admin credentials are created interactively at bring-up, never committed.
|