jakman85andClaude Opus 4.8
73c4475d34
Two defects blocked in-cluster Gitea from becoming the Flux source: 1. Storage mountPath: the renderer hard-coded /data/<name>, so Gitea's PVC mounted at /data/data while Gitea writes all state to /data — real repos/DB landed on the ephemeral rootfs. Add an OPTIONAL `mountPath` to the storage schema + render.py (default stays /data/<name>, back-compat). catalog/gitea.yaml sets data.mountPath: /data. Only gitea.yaml's rendered mount changes; every other app renders byte-identical. 2. Headless install: the instance was un-installed (INSTALL_LOCK=false, ephemeral SECRET_KEY, no admin, API 404). A Gitea-only supplementary manifest (apps/gitea-bootstrap-patch.yaml) patches the rendered Deployment with GITEA__security__INSTALL_LOCK=true, a FIXED SECRET_KEY from a persistent SOPS secret (apps/gitea-bootstrap-secret.sops.yaml), ROOT_URL/DOMAIN, and a postStart hook that idempotently creates a break-glass local admin. State persists on the now-correct /data Longhorn PVC. The env/lifecycle wiring is a supplementary kustomize patch because the ServiceDefinition schema/renderer does not yet express env/envFrom/lifecycle — noted as a renderer follow-up (TODO in the patch). Co-Authored-By: Claude Opus 4.8 <[email protected]>
21 lines
901 B
YAML
21 lines
901 B
YAML
---
|
|
# Onboarded services (WS-APPS). Each app is rendered from its catalog/ ServiceDefinition by
|
|
# catalog/render.py and committed here; the `apps` Flux Kustomization (clusters/base/apps.yaml,
|
|
# dependsOn platform-config) reconciles this directory. Image-automation CRs are omitted for now
|
|
# (--no-image-automation) until the Flux image controllers are installed.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- pihole.yaml
|
|
- gitea.yaml
|
|
- gitea-bootstrap-secret.sops.yaml # SOPS: fixed SECRET_KEY + break-glass admin creds (decrypted by Flux)
|
|
- sonarr.yaml
|
|
- radarr.yaml
|
|
- plex.yaml
|
|
- qbittorrent.yaml
|
|
- jackett.yaml
|
|
# Gitea-only supplementary patch: headless-install env + break-glass admin postStart hook.
|
|
# The renderer does not yet emit env/lifecycle (renderer follow-up); see gitea-bootstrap-patch.yaml.
|
|
patches:
|
|
- path: gitea-bootstrap-patch.yaml
|