jakman85andClaude Opus 4.8
cc89b4b830
Author-only Phase-2 components (platform suspended; cluster untouched): - platform/longhorn: 3-replica SC + bulk external-mount indirection (R-STATE) - platform/monitoring: kube-prometheus-stack + Loki + Alloy (dev-trimmed) + 8 alert rules (R-OBS) - platform/cilium: parity fix (k8sServiceHost=10.73.0.11 + masquerade) safe to adopt Phase 2 - conformance: partial L2 tests (worker hit session limit; incomplete — see DECISIONS-LOG K2) - bootstrap/gitea: fix rootless-podman perms (host bind-mount -> named volume) Flux installed on the cluster; host Gitea up + repo pushed; GitRepository BLOCKED by host firewalld (VM->10.73.0.1:3000) — needs one operator sudo command (DECISIONS-LOG). Known issue K1: cluster-vars substitution-var case mismatch (fix before un-suspend). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
58 lines
2.8 KiB
Bash
Executable File
58 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# bootstrap/gitea/bootstrap-gitea.sh — run a SINGLE Gitea container on the HOST (outside the
|
|
# cluster) as the Phase-1 GitOps bootstrap source. While the cluster is built, Flux (in-cluster)
|
|
# reconciles this repo from the host Gitea over the k3s-dev NAT gateway. This is the "local
|
|
# bootstrap source" that migrates to in-cluster Gitea in Phase 6 (docs/05 "Source-of-truth",
|
|
# CONTRIBUTING.md).
|
|
#
|
|
# Run by the OPERATOR at bring-up — NOT during author-only, NOT by any agent.
|
|
set -euo pipefail
|
|
ENGINE="${ENGINE:-podman}"
|
|
GITEA_IMAGE="${GITEA_IMAGE:-docker.io/gitea/gitea:1.22}" # pinned; bump if needed
|
|
NAME="${GITEA_NAME:-home-k3s-bootstrap-gitea}"
|
|
HTTP_PORT="${GITEA_HTTP_PORT:-3000}"
|
|
SSH_PORT="${GITEA_SSH_PORT:-2222}"
|
|
# Use a NAMED podman volume, not a host bind-mount: rootless podman maps the container's uid to a
|
|
# subuid that can't write a host-owned dir, so Gitea fails to create /data/gitea/conf/app.ini.
|
|
DATA_VOLUME="${GITEA_DATA_VOLUME:-gitea-bootstrap-data}"
|
|
DATA_DIR="podman volume ${DATA_VOLUME}" # display label only (data lives in the named volume)
|
|
# The cluster VMs reach the host on the k3s-dev NAT gateway (10.73.0.1). ROOT_URL must match so
|
|
# clone/redirect URLs are correct from inside the cluster.
|
|
# NOTE: firewalld's `libvirt` zone (owns virbrN) blocks VM->host:3000 by default. Open it once:
|
|
# sudo firewall-cmd --zone=libvirt --add-port=3000/tcp --permanent && sudo firewall-cmd --reload
|
|
HOST_NAT_IP="${HOST_NAT_IP:-10.73.0.1}"
|
|
ORG="${GITEA_ORG:-Home-Network}"
|
|
REPO="${GITEA_REPO:-home-network-k3s-impl}"
|
|
|
|
"$ENGINE" volume create "${DATA_VOLUME}" >/dev/null 2>&1 || true
|
|
if "$ENGINE" container exists "$NAME" 2>/dev/null; then
|
|
echo "Gitea container '${NAME}' already exists — starting it."
|
|
"$ENGINE" start "$NAME" >/dev/null
|
|
else
|
|
"$ENGINE" run -d --name "$NAME" --restart unless-stopped \
|
|
-p "${HTTP_PORT}:3000" -p "${SSH_PORT}:22" \
|
|
-v "${DATA_VOLUME}:/data" \
|
|
-e GITEA__server__ROOT_URL="http://${HOST_NAT_IP}:${HTTP_PORT}/" \
|
|
-e GITEA__server__SSH_PORT="${SSH_PORT}" \
|
|
-e GITEA__security__INSTALL_LOCK=true \
|
|
"$GITEA_IMAGE"
|
|
fi
|
|
|
|
cat <<EOF
|
|
|
|
Gitea (bootstrap source) at http://${HOST_NAT_IP}:${HTTP_PORT}/ data: ${DATA_DIR}
|
|
|
|
One-time setup (manual — keeps creds out of this script):
|
|
1. Create an admin user:
|
|
${ENGINE} exec -u git ${NAME} gitea admin user create \\
|
|
--username <admin> --password <pw> --email <you@example> --admin
|
|
2. In the UI (or API) create org '${ORG}' and a **PUBLIC** repo '${REPO}'
|
|
(public => Flux needs no git credentials; this Gitea is NAT-only, not internet-exposed).
|
|
3. Push this repo up:
|
|
git remote add bootstrap http://<admin>:<pw>@${HOST_NAT_IP}:${HTTP_PORT}/${ORG}/${REPO}.git
|
|
git push bootstrap main
|
|
|
|
Flux's flux-system GitRepository url is already wired to:
|
|
http://${HOST_NAT_IP}:${HTTP_PORT}/${ORG}/${REPO}.git (clusters/dev)
|
|
EOF
|