git-pages helm chart
This commit is contained in:
moilanik
@@ -0,0 +1,6 @@
|
||||
apiVersion: v2
|
||||
name: git-pages
|
||||
description: Codeberg git-pages for CI HTML reports (apex site, Traefik BasicAuth publish)
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "0.9.1"
|
||||
@@ -0,0 +1,74 @@
|
||||
# git-pages
|
||||
|
||||
Jaettu **Gitea CI -raporttien** tallennus- ja lukupaikka: HTML-raportit (esim. Cucumber)
|
||||
commit-kohtaisiin polkuihin, selaimella avattavina linkkeinä Gitean commitin CI-job
|
||||
raportista. Kuvaus ja perustelut: [docs/](docs/).
|
||||
|
||||
---
|
||||
|
||||
## Käyttöönotto
|
||||
|
||||
### 1. Secretit
|
||||
|
||||
[docs/secrets.md](docs/secrets.md)
|
||||
|
||||
### 2. Instanssin values-tiedosto
|
||||
|
||||
`values.yaml` sisältää jaetut vakiot. Ympäristökohtaiset arvot omaan tiedostoon, esim.
|
||||
`dev-values.yaml` / `prod-values.yaml`:
|
||||
|
||||
```yaml
|
||||
ingress:
|
||||
host: pages.example.com # julkinen host (luku + julkaisu)
|
||||
|
||||
certificate:
|
||||
issuerRef:
|
||||
name: letsencrypt-prod # cert-manager ClusterIssuer / Issuer
|
||||
kind: ClusterIssuer
|
||||
|
||||
persistence:
|
||||
storageClass: "" # tyhjä = klusterin oletus
|
||||
size: 5Gi
|
||||
|
||||
retention:
|
||||
giteaApiUrl: https://gitea.example.com
|
||||
rules:
|
||||
default:
|
||||
maxAgeDays: 90
|
||||
keepMin: 5
|
||||
branches:
|
||||
main:
|
||||
maxAgeDays: 365
|
||||
keepMin: 20
|
||||
```
|
||||
|
||||
Esimerkki dev-ympäristöstä: [dev-values.yaml](dev-values.yaml).
|
||||
|
||||
### 3. Helm-asennus
|
||||
|
||||
Repojuuresta (sama `NS` kuin [docs/secrets.md](docs/secrets.md)):
|
||||
|
||||
```bash
|
||||
NS=git-pages
|
||||
VALUES=git-pages/dev-values.yaml
|
||||
|
||||
helm upgrade --install git-pages ./git-pages \
|
||||
-n "$NS" --create-namespace \
|
||||
-f "$VALUES"
|
||||
|
||||
helm template git-pages ./git-pages -f "$VALUES"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## CI-julkaisu
|
||||
|
||||
Workflow tarvitsee vähintään:
|
||||
|
||||
| Muuttuja | Kuvaus |
|
||||
|----------|--------|
|
||||
| `PAGES_HOST` | Sama kuin `ingress.host` (julkinen lukulinkki) |
|
||||
| `GIT_PAGES_PUBLISH_URL` | `https://{ingress.host}` |
|
||||
| `GIT_PAGES_PUBLISH_TOKEN` | Gitea Actions secret — sama arvo kuin publish-auth-secretissa |
|
||||
|
||||
Julkaisu repossa: `scripts/publish-git-pages.sh` (dogfood: `.gitea/workflows/ci-engine.yml`).
|
||||
@@ -0,0 +1,28 @@
|
||||
# Dev instance — overrides values.yaml constants.
|
||||
# helm upgrade --install git-pages ./git-pages -n git-pages -f dev-values.yaml
|
||||
|
||||
ingress:
|
||||
host: ci-reports.helm-dev.keskikuja.site
|
||||
|
||||
certificate:
|
||||
issuerRef:
|
||||
name: letsencrypt-prod
|
||||
kind: ClusterIssuer
|
||||
|
||||
persistence:
|
||||
storageClass: ""
|
||||
size: 5Gi
|
||||
|
||||
retention:
|
||||
giteaApiUrl: https://gitea.app.keskikuja.site
|
||||
rules:
|
||||
default:
|
||||
maxAgeDays: 90
|
||||
keepMin: 5
|
||||
branches:
|
||||
main:
|
||||
maxAgeDays: 365
|
||||
keepMin: 20
|
||||
master:
|
||||
maxAgeDays: 365
|
||||
keepMin: 20
|
||||
@@ -0,0 +1,143 @@
|
||||
# Architecture — git-pages
|
||||
|
||||
> Komponentit, datavirrat ja rajapinnat. Miksi näin on rakennettu: [design-rationale.md](design-rationale.md).
|
||||
> Secretit: [secrets.md](secrets.md). Teknologiat: [tech-stack.md](tech-stack.md).
|
||||
|
||||
Tämä dokumentti koskee vain `git-pages/`-palvelua — ei juuren `gitea-ci-library`-kirjastoa.
|
||||
|
||||
---
|
||||
|
||||
## Yleiskuvaus
|
||||
|
||||
git-pages on jaettu **HTML-raporttiarkisto**: yksi apex-host, monta Gitea-repoa, commit-kohtaiset
|
||||
raporttipolut. Julkaisija (esim. CI) puskaa sisällön tar-arkistona; lukija avaa raportin
|
||||
selaimella commit-linkistä.
|
||||
|
||||
Codeberg git-pages ajaa `PAGES_INSECURE=1` — sovellus ei tee forge-authia. Julkaisu- ja
|
||||
TLS-rajaukset ovat Kubernetes-kerroksessa (Traefik, cert-manager, Secretit).
|
||||
|
||||
---
|
||||
|
||||
## Komponentit
|
||||
|
||||
| Komponentti | Rooli |
|
||||
|-------------|-------|
|
||||
| **git-pages Pod** | Codeberg git-pages `0.9.1`, filesystem-storage `/app/data` |
|
||||
| **PVC** | Raporttisisältö (`{owner}/{repo}/reports/{sha8}/…`) |
|
||||
| **Service** | ClusterIP :3000 git-pagesille |
|
||||
| **Traefik IngressRoute** | Julkaisu (PATCH/PUT + BasicAuth) ja luku (GET/HEAD) eri säännöillä |
|
||||
| **Traefik Middleware** | `git-pages-publish-auth` (BasicAuth), HTTPS-redirect |
|
||||
| **cert-manager Certificate** | TLS → Secret `git-pages-tls` |
|
||||
| **CronJob `git-pages-retention`** | Päivittäinen siivous (PVC + Gitea branch-lista) |
|
||||
|
||||
| Secret | Rooli |
|
||||
|--------|-------|
|
||||
| `git-pages-publish-auth` | htpasswd julkaisuun (Traefik) |
|
||||
| `git-pages-retention-gitea` | Gitea PAT branch-listaan (CronJob) |
|
||||
|
||||
---
|
||||
|
||||
## URL ja sisältö
|
||||
|
||||
Julkinen osoite = **selvä URL** + **Gitea-yhteensopiva polku**:
|
||||
|
||||
```
|
||||
https://pages.example.com/acme-corp/backend-api/reports/abc12345/index.html
|
||||
└─ selvä URL ─┘ └────────── Gitea-yhteensopiva polku ──────────┘
|
||||
```
|
||||
|
||||
Levyllä (apex index-site):
|
||||
|
||||
```
|
||||
/app/data/
|
||||
{owner}/
|
||||
{repo}/
|
||||
reports/
|
||||
{sha8}/
|
||||
index.html
|
||||
.meta # branch, sha, published_at
|
||||
```
|
||||
|
||||
Apex-juuri `/` on tyhjä — ei landing-sivua.
|
||||
|
||||
---
|
||||
|
||||
## Järjestelmäkaavio
|
||||
|
||||
```mermaid
|
||||
flowchart TB
|
||||
subgraph ext["Ulkoiset"]
|
||||
PUB["Julkaisija\n(CI)"]
|
||||
BR["Selain"]
|
||||
GITEA["Gitea API\n(branch-lista)"]
|
||||
end
|
||||
|
||||
subgraph edge["Reuna"]
|
||||
TRAEFIK["Traefik\nIngressRoute + Middleware"]
|
||||
CM["cert-manager\nTLS"]
|
||||
end
|
||||
|
||||
subgraph cluster["git-pages"]
|
||||
GP["git-pages Pod"]
|
||||
PVC["PVC /app/data"]
|
||||
CJ["CronJob retention"]
|
||||
end
|
||||
|
||||
PUB -->|"PATCH/PUT + BasicAuth\ntar"| TRAEFIK
|
||||
BR -->|"GET/HEAD"| TRAEFIK
|
||||
TRAEFIK --> GP
|
||||
CM --> TRAEFIK
|
||||
GP --> PVC
|
||||
CJ -->|"read branches"| GITEA
|
||||
CJ --> PVC
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Julkaisu
|
||||
|
||||
1. Julkaisija paketoi `{owner}/{repo}/reports/{sha8}/` tar-arkistoksi (sis. `.meta`)
|
||||
2. `PATCH` tai `PUT` apex-URL:iin (`https://{host}/`) + `Content-Type: application/x-tar`
|
||||
3. Traefik tarkistaa BasicAuth (`publish` + token) → välittää git-pagesille
|
||||
4. git-pages kirjoittaa PVC:lle
|
||||
|
||||
Julkaisu kulkee aina julkisen ingressin kautta — ei suoraa ClusterIP-kirjoitusta ulkopuolelta.
|
||||
|
||||
---
|
||||
|
||||
## Luku
|
||||
|
||||
1. Selain avaa commit-statuslinkin (GET/HEAD)
|
||||
2. Traefik välittää git-pagesille ilman julkaisu-Middlewarea
|
||||
3. git-pages palauttaa HTML:n polusta
|
||||
|
||||
Luku-auth (OIDC) ei ole toteutettu — GET/HEAD on julkinen, jos URL tunnetaan.
|
||||
Katso [design-rationale.md — Luku-auth](design-rationale.md#luku-auth).
|
||||
|
||||
---
|
||||
|
||||
## Retention
|
||||
|
||||
CronJob `git-pages-retention` (oletus kerran päivässä):
|
||||
|
||||
1. Skaalaa git-pages deployment hetkeksi pois (RWO-PVC)
|
||||
2. Käy läpi `reports/{sha8}/.meta`
|
||||
3. **Poistettu branch** — jos `.meta.branch` ei ole Gitean branch-listassa → poista (aina)
|
||||
4. **Aktiivinen branch** — `maxAgeDays` + `keepMin` (`retention.rules` instanssiarvoissa)
|
||||
5. Skaalaa deployment takaisin
|
||||
|
||||
Gitea API: `GET /api/v1/repos/{owner}/{repo}/branches` — `read:repository` PAT.
|
||||
Katso [secrets.md](secrets.md).
|
||||
|
||||
---
|
||||
|
||||
## Rajapinnat
|
||||
|
||||
| Suunta | Protokolla | Auth | Kuvaus |
|
||||
|--------|------------|------|--------|
|
||||
| Julkaisija → Traefik | HTTPS PATCH/PUT | BasicAuth `publish` | tar → apex site |
|
||||
| Selain → Traefik | HTTPS GET/HEAD | — (tänään) | HTML-raportti |
|
||||
| CronJob → Gitea | HTTPS GET | PAT `read:repository` | branch-lista per repo |
|
||||
| Traefik → git-pages | HTTP :3000 | — | sisäverkko |
|
||||
|
||||
git-pages ei käytä Gitea forge-API:a julkaisuun eikä `pages`-branchia.
|
||||
@@ -0,0 +1,180 @@
|
||||
# Design Rationale — git-pages
|
||||
|
||||
> Miksi git-pages on rakennettu näin. Arvot, periaatteet ja reunaehdot.
|
||||
>
|
||||
> Tämä dokumentti on **normatiivinen** `git-pages/`-alikansiolle. Se ei kuvaa juuren
|
||||
> `gitea-ci-library`-kirjastoa eikä sen workfloweja.
|
||||
>
|
||||
> Liittyvät dokumentit: [architecture.md](architecture.md), [tech-stack.md](tech-stack.md), [secrets.md](secrets.md).
|
||||
|
||||
---
|
||||
|
||||
## Miksi tämä on olemassa
|
||||
|
||||
### Ongelma
|
||||
|
||||
CI-testiajoista syntyy HTML-raportteja. Esimerkiksi Cucumber-testiraportti toimii
|
||||
elävänä dokumentaationa git commitin tilasta.
|
||||
|
||||
Gitea ei tarjoa web-selaimella selattavaa arkistoa näille HTML-raporteille.
|
||||
|
||||
git-pages ratkaisee tämän ongelman.
|
||||
|
||||
| Vaihtoehto | Miksi ei riitä |
|
||||
|---|---|
|
||||
| **Gitea Actions -artifactit** | Vain ZIP-lataus — HTML ei renderöidy selaimessa |
|
||||
| **Gitea `pages`-branch** | Yksi branch per repo; rinnakkaiset buildit törmäävät saman branchin pushissa |
|
||||
| **Gitea Releases** | Sotkee julkaisuhistorian satojen CI-buildien raporteilla |
|
||||
|
||||
### Ongelma URL:ssa (hylätty malli)
|
||||
|
||||
Alkuvaiheen malli sitoi hostin repoon: `https://{owner}.{host}/{repo}/...`
|
||||
(subdomain per owner). Julkinen linkki piti sitten “kääntää” Gitea-tyyliseksi poluksi
|
||||
Traefik-rewritellä (`/{owner}/{repo}/...` → eri `Host` + lyhyempi polku).
|
||||
|
||||
Tämä oli ongelmallinen:
|
||||
|
||||
- per-owner middleware / rewrite kube-resursseina
|
||||
- julkaisu-URL ja lukemis-URL eri muodossa
|
||||
- wildcard-TLS tai monimutkainen cert-hallinta
|
||||
- vaikea selittää kehittäjälle mistä host tulee
|
||||
|
||||
### Ratkaisu — `selvä_url` + Gitea-yhteensopiva polku
|
||||
|
||||
URL rakennetaan kahdesta erillisestä osasta, ei yhdestä sekavasta kaavasta:
|
||||
|
||||
| Osa | Mistä | Esimerkki |
|
||||
|-----|-------|-----------|
|
||||
| **Selvä URL** | Organisaation kiinteä pages-host | `https://pages.example.com` |
|
||||
| **Gitea-yhteensopiva polku** | Repo (`{owner}/{repo}`) + commit | `/acme-corp/backend-api/reports/abc12345/index.html` |
|
||||
|
||||
**Julkinen linkki** = selvä URL + polku (yksi merkkijono commit-statusiin, ei rewritea):
|
||||
|
||||
`https://pages.example.com/acme-corp/backend-api/reports/abc12345/index.html`
|
||||
|
||||
Polku vastaa Gitea Pages -käytäntöä (`/{owner}/{repo}/...`). Host on aina sama —
|
||||
ei `{owner}.pages...`-subdomainia.
|
||||
|
||||
Julkaisija (CI tai muu asiakas) lähettää tar-arkiston PATCH/PUT:lla. Lukija hakee
|
||||
HTML:n GET:llä. Ei Gitea-git-integraatiota eikä `pages`-branchia.
|
||||
|
||||
**Codebergin security-malli ei sovellu tähän käyttöön** — forge-auth (Gitea PAT +
|
||||
`write:repository`), DNS TXT -haaste ja muut git-pagesin sisäänrakennetut valtuutus-
|
||||
mekanismit on ohitettu kokonaan (`PAGES_INSECURE=1`). Niiden sijaan Kubernetes-kerros
|
||||
hoitaa rajauksen: Traefik BasicAuth julkaisuun, cert-manager TLS:ään, erillinen
|
||||
publish-token ([secrets.md](secrets.md)). Sovellus palvelee sisältöä; klusteri päättää
|
||||
kuka saa kirjoittaa.
|
||||
|
||||
---
|
||||
|
||||
## Suunnitteluperiaatteet
|
||||
|
||||
### 1. Selvä URL + Gitea-yhteensopiva polku
|
||||
|
||||
Julkinen osoite = kiinteä apex-host + polku `/{owner}/{repo}/reports/{sha8}/...`.
|
||||
Apex-juuri `/` on tyhjä tarkoituksella — ei landing-sivua.
|
||||
|
||||
**Miksi:** Kehittäjä näkee Gitea-tyylisen polun; infra näkee yhden hostin. Ei Traefik-
|
||||
rewritea, ei per-owner subdomaineja, ei erillistä “julkaisu-URL vs. lukemis-URL” -kaavaa.
|
||||
Yksi TLS-sertifikaatti, yksi IngressRoute, yksi PVC.
|
||||
|
||||
### 2. Julkaisu ja luku erotettu
|
||||
|
||||
Julkaisu (PATCH/PUT) vaatii Traefik BasicAuthin. Luku (GET/HEAD) on erillinen reitti —
|
||||
katso [Luku-auth](#luku-auth) alla.
|
||||
|
||||
**Miksi:** git-pages ajaa `PAGES_INSECURE=1` — sovellus ei validoi julkaisuoikeuksia.
|
||||
Kirjoitusoikeus on eksplisiittisesti Traefik Middlewaressä (`git-pages-publish-auth`).
|
||||
|
||||
### 3. Yksi publish-token, kaksi säilöä
|
||||
|
||||
Sama plaintext-token: klusterin Secretissä htpasswd-hashina, julkaisijan secret-holvissa
|
||||
(esim. CI-alustan Actions-secret).
|
||||
|
||||
**Miksi:** Ei Gitea PAT:ia eikä `write:repository` -oikeutta. Token antaa vain
|
||||
julkaisuoikeuden tähän palveluun. Yksi arvo, kaksi paikkaa — ks. [secrets.md](secrets.md).
|
||||
|
||||
### 4. Secretit erillisessä hallinnassa
|
||||
|
||||
`git-pages-publish-auth` luodaan ennen käyttöönottoa — ei osana sovelluksen konfiguraatiotiedostoja.
|
||||
|
||||
**Miksi:** Salaisuudet eivät kulje versionoiduissa arvoissa. Rotaatio ja SealedSecrets
|
||||
pysyvät operaattorin hallussa. Ks. [secrets.md](secrets.md).
|
||||
|
||||
### 5. Minimaalinen parametrisointi
|
||||
|
||||
Instance-arvot (`host`, `issuer`, PVC) `{env}-values.yaml`:ssa. Resurssinimet,
|
||||
secret-nimet ja Traefik-wire kovakoodattu templatessa.
|
||||
|
||||
**Miksi:** Parametrisoi vain se, mikä vaihtelee instanssien välillä (host, TLS-issuer,
|
||||
levy). Vakioidut nimet ja wire pysyvät ennustettavina kaikissa asennuksissa.
|
||||
|
||||
---
|
||||
|
||||
## Puutteet
|
||||
|
||||
Tietoisesti avoimet asiat — eivät estä nykyistä julkaisu- ja lukumallia.
|
||||
|
||||
### Luku-auth
|
||||
|
||||
Julkaisu on suojattu (Traefik BasicAuth). **Luku ei ole:** GET/HEAD on julkinen — kuka
|
||||
tuntee URL:n voi lukea raportin.
|
||||
|
||||
Tavoite: Traefik OIDC GET/HEAD-reitille (Gitea OAuth2 -provider). Session säilyy —
|
||||
commit-statuslinkki toimii kirjautumisen jälkeen ilman uutta julkaisuoikeutta.
|
||||
|
||||
Ei toteutettu. Julkaisu- ja luku-reitit pysyvät erillisinä; OIDC lisätään vain lukupuolelle.
|
||||
|
||||
### Retention
|
||||
|
||||
CronJob `git-pages-retention` (kerran päivässä) skannaa PVC:n ja poistaa vanhentuneet
|
||||
raportit. Julkaisija kirjoittaa `reports/{sha8}/.meta` (branch, sha, published_at).
|
||||
|
||||
| Sääntö | Konfiguroitavissa? | Kuvaus |
|
||||
|--------|-------------------|--------|
|
||||
| **Poistettu branch** | Ei — aina | Jos `.meta.branch` ei ole Giteassa enää, raportti poistetaan |
|
||||
| **maxAgeDays** | Kyllä (`dev-values`) | Aktiivisen branchin raportit vanhemmat kuin N päivää |
|
||||
| **keepMin** | Kyllä (`dev-values`) | Aktiivisella branchilla pidetään vähintään N uusinta |
|
||||
|
||||
Poistettujen branchien siivous ei tarvitse parametreja. Jäljelle jääneille branchille
|
||||
säännöt tulevat `retention.rules` (`default` + `branches.{name}`).
|
||||
|
||||
**Puutteet:** tagattuja commiteja ei suojata erikseen. RWO-PVC vaatii lyhyen katkon
|
||||
(deployment skaalataan 0:ksi ajon ajaksi).
|
||||
|
||||
Secret: `git-pages-retention-gitea` — Gitea PAT branch-listaan. Ks. [secrets.md](secrets.md).
|
||||
|
||||
---
|
||||
|
||||
## Rajat
|
||||
|
||||
- **Ei forge-integraatiota** — ei `pages`-branchia, ei Gitea API -hakua, ei forge-authia
|
||||
- **Ei julkaisijalogiikkaa** — kuka julkaisee ja milloin on julkaisijan vastuulla
|
||||
- **Ei sisäverkon ohitusjulkaisua** — julkaisu kulkee julkisen ingressin kautta (BasicAuth)
|
||||
|
||||
---
|
||||
|
||||
## Teknologiavalinnat
|
||||
|
||||
| Valinta | Miksi |
|
||||
|---------|-------|
|
||||
| **Codeberg git-pages** `0.9.1` | Natiivi apex index-site + tar-pohjainen PATCH/PUT -julkaisu |
|
||||
| **Filesystem + PVC** | Yksinkertainen, yksi replica, ei erillistä objektivarastoa |
|
||||
| **Traefik IngressRoute + Middleware** | Julkaisuauth erillään sovelluksesta; GET/HEAD eri säännöllä |
|
||||
| **cert-manager** | TLS automaattisesti (`git-pages-tls`) |
|
||||
| **Helm v3** | Toistettava asennus; instanssikohtaiset arvot erillisessä values-tiedostossa |
|
||||
|
||||
---
|
||||
|
||||
## Mitä tietoisesti hylättiin
|
||||
|
||||
| Hylätty | Syy |
|
||||
|---------|-----|
|
||||
| **deadnews/gitea-pages** | Vetää sisällön Gitea API:sta — ei sopinut CI-push-malliin |
|
||||
| **Gitea `pages`-branch** | Race condition rinnakkaisissa buildeissa |
|
||||
| **Per-owner subdomain** (`{owner}.pages...`) | Ongelmallinen URL; vaatii rewrite-middlewarea polun kääntämiseen |
|
||||
| **Traefik path→host -rewrite** | Korvattu apex + Gitea-polulla — yksi selvä URL commit-linkissä |
|
||||
| **Gitea forge-auth / PAT** | `write:repository` liian laaja oikeus vain raporttijulkaisuun |
|
||||
| **DNS TXT -haaste julkaisuun** | Operatiivinen kompleksisuus ilman hyötyä BasicAuthiin verrattuna |
|
||||
| **Helm-managed publish Secret** | Arvot values-tiedostoihin on kielletty; manuaalinen lähde totuudelle |
|
||||
| **Image tag `v0.9.1`** | Oikea tagi on `0.9.1` (ei `v`-etuliitettä) |
|
||||
@@ -0,0 +1,96 @@
|
||||
# Secrets - Prerequisites
|
||||
|
||||
`git-pages` requires the following Kubernetes Secrets to exist before the cluster
|
||||
consumers can use them. These secrets are not managed by Helm — create them manually or
|
||||
via external secret management (SealedSecrets, External Secrets Operator, Vault).
|
||||
|
||||
TLS (`git-pages-tls`) is issued by cert-manager — not a manual prerequisite.
|
||||
|
||||
---
|
||||
|
||||
## Secret Inventory
|
||||
|
||||
| Secret | Keys | Consumers | Required |
|
||||
|--------|------|-----------|----------|
|
||||
| `git-pages-publish-auth` | `users` | Traefik Middleware `git-pages-publish-auth` | Always |
|
||||
| `git-pages-retention-gitea` | `token` | CronJob `git-pages-retention` | Always |
|
||||
|
||||
---
|
||||
|
||||
## Tokens
|
||||
|
||||
### Publish token
|
||||
|
||||
Ei Gitea PAT. Satunnainen merkkijono (`GIT_PAGES_PUBLISH_TOKEN`), joka menee kahteen paikkaan:
|
||||
|
||||
| Paikka | Muoto |
|
||||
|--------|-------|
|
||||
| Kubernetes `git-pages-publish-auth` | htpasswd: `publish:<hash>` |
|
||||
| Gitea Actions secret `GIT_PAGES_PUBLISH_TOKEN` | sama plaintext |
|
||||
|
||||
CI käyttää sitä Traefik BasicAuthiin. Ei git-kirjoitusoikeutta.
|
||||
|
||||
**Vienti Giteaan:** Organization or Repository → Settings → Actions → Secrets →
|
||||
`GIT_PAGES_PUBLISH_TOKEN` = publish-tokenin plaintext (org secret, jos usea repo julkaisee).
|
||||
|
||||
### Retention token
|
||||
|
||||
Gitea PAT CronJobille. CronJob listaa branchit repokohtaisesti
|
||||
(`GET /api/v1/repos/{owner}/{repo}/branches`) ja poistaa raportit, joiden `.meta.branch`
|
||||
ei ole enää Giteassa.
|
||||
|
||||
Tarvitaan vain **`read:repository`**. Ei `write:repository`. Tokenin omistajan täytyy
|
||||
nähdä kaikki repot, joista raportteja on levyllä.
|
||||
|
||||
**Ei viedä Giteaan** — vain Kubernetes Secret `git-pages-retention-gitea`.
|
||||
|
||||
**PAT Giteassa (read only):**
|
||||
|
||||
1. Kirjaudu Gitea-käyttäjällä, jolla on luku kaikkiin raporttirepoihin
|
||||
2. **Settings** → **Applications** → **Generate New Token**
|
||||
3. Token name: esim. `git-pages-retention`
|
||||
4. Scopes: valitse vain **`read:repository`** — älä valitse `write:repository` eikä muita
|
||||
5. **Generate Token** → kopioi token heti (näytetään vain kerran)
|
||||
6. Aseta shelliin: `export GITEA_RETENTION_TOKEN='gitea_pat_…'`
|
||||
|
||||
---
|
||||
|
||||
## Create Secrets
|
||||
|
||||
```bash
|
||||
NS=git-pages
|
||||
|
||||
# Publish
|
||||
GIT_PAGES_PUBLISH_TOKEN="$(openssl rand -base64 24)"
|
||||
|
||||
kubectl create secret generic git-pages-publish-auth \
|
||||
--from-literal=users="$(docker run --rm httpd:2-alpine htpasswd -nb publish "$GIT_PAGES_PUBLISH_TOKEN")" \
|
||||
-n $NS
|
||||
|
||||
echo "Gitea Actions → GIT_PAGES_PUBLISH_TOKEN:"
|
||||
echo "$GIT_PAGES_PUBLISH_TOKEN"
|
||||
|
||||
# Retention (PAT luotu yllä Giteassa)
|
||||
kubectl create secret generic git-pages-retention-gitea \
|
||||
--from-literal=token="$GITEA_RETENTION_TOKEN" \
|
||||
-n $NS
|
||||
|
||||
kubectl get secrets -n $NS
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Secret Management (Production)
|
||||
|
||||
Secrets can be created manually with the snippets above, or migrated to a secret management
|
||||
solution. The `kubectl create` blocks are the rolling source — replace them with the target
|
||||
tool's equivalent when ready:
|
||||
|
||||
| Approach | Replaces `kubectl create` with |
|
||||
|----------|-------------------------------|
|
||||
| Manual rotation | Re-run the same snippets with new values |
|
||||
| SealedSecrets | `kubeseal` encrypted manifest |
|
||||
| External Secrets Operator | `ExternalSecret` CR pointing to the vault |
|
||||
| Vault / other | Vault agent / CSI driver injection |
|
||||
|
||||
Structure of `docs/secrets.md` stays identical regardless of the chosen approach.
|
||||
@@ -0,0 +1,81 @@
|
||||
# Tech Stack — git-pages
|
||||
|
||||
> Mitä teknologioita `git-pages/` Helm chart käyttää ja edellyttää. Tämä dokumentti koskee vain
|
||||
> `git-pages/`-alikansiota monorepossa — ei juuren `gitea-ci-library`-kirjastoa.
|
||||
|
||||
---
|
||||
|
||||
## Sovellus
|
||||
|
||||
| Teknologia | Versio | Käyttö |
|
||||
|---|---|---|
|
||||
| **git-pages** (Codeberg) | `0.9.1` | Staattinen sisältö, apex index-site (`/.index`), HTTP PATCH/PUT -julkaisu |
|
||||
| **Filesystem storage** | — | Sisältö PVC:llä (`/app/data`) |
|
||||
| **TOML** | — | Sovellusconfig ConfigMapissa (`config.toml`) |
|
||||
|
||||
Image: `codeberg.org/git-pages/git-pages:0.9.1` (ei `v`-etuliitettä tagissa).
|
||||
|
||||
Chart ajaa `PAGES_INSECURE=1` — julkaisuvaltuutus Traefik Middlewaressä, ei forge-authia.
|
||||
|
||||
---
|
||||
|
||||
## Alusta ja verkko
|
||||
|
||||
| Teknologia | Versio / minimi | Käyttö |
|
||||
|---|---|---|
|
||||
| **Kubernetes** | 1.24+ | Deployment, Service, PVC, Secret |
|
||||
| **Helm** | v3 | Chart asennus ja päivitys |
|
||||
| **Traefik** | CRD `traefik.io/v1alpha1` | IngressRoute, Middleware (`basicAuth`, HTTPS-redirect) |
|
||||
| **cert-manager** | — | TLS-sertifikaatti (`git-pages-tls`) |
|
||||
|
||||
---
|
||||
|
||||
## Pysyvyys
|
||||
|
||||
| Teknologia | Käyttö |
|
||||
|---|---|
|
||||
| **PersistentVolumeClaim** | Raporttisisältö (`ReadWriteOnce`) |
|
||||
| **storageClass** | Instance-kohtainen (`dev-values.yaml`) |
|
||||
|
||||
---
|
||||
|
||||
## Esiehdot (klusteri)
|
||||
|
||||
| Resurssi | Lähde | Dokumentti |
|
||||
|---|---|---|
|
||||
| `git-pages-publish-auth` | Manuaalinen Secret | [secrets.md](secrets.md) |
|
||||
| `git-pages-tls` | cert-manager Certificate | Automaattinen asennuksessa |
|
||||
| `ClusterIssuer` | Klusteri (esim. `letsencrypt-prod`) | `dev-values.yaml` |
|
||||
|
||||
---
|
||||
|
||||
## Asennustyökalut (operaattori)
|
||||
|
||||
| Työkalu | Käyttö |
|
||||
|---|---|
|
||||
| **kubectl** | Secretin luonti |
|
||||
| **openssl** | Publish-tokenin generointi (`rand -base64 24`) |
|
||||
| **Docker** (`httpd:2-alpine`) | htpasswd-rivin generointi |
|
||||
|
||||
---
|
||||
|
||||
## Konfiguraatio
|
||||
|
||||
| Tiedosto | Kerros | Sisältö |
|
||||
|---|---|---|
|
||||
| `values.yaml` | Chart-vakiot | Image, resurssit, Traefik entrypointit |
|
||||
| `{env}-values.yaml` | Instanssi | Host, issuer, PVC koko/storageClass |
|
||||
|
||||
Esimerkki: `helm upgrade --install git-pages ./git-pages -n git-pages -f dev-values.yaml`
|
||||
|
||||
---
|
||||
|
||||
## Mitä EI käytetä
|
||||
|
||||
| Teknologia | Syy |
|
||||
|---|---|
|
||||
| **Gitea `pages`-branch** | Ei Gitea git-pages -integraatiota |
|
||||
| **deadnews/gitea-pages** | Ei Gitea API -hakua |
|
||||
| **MinIO / S3** | Erillinen raporttivarasto — ei tämän chartin scope |
|
||||
| **Gitea forge-auth / PAT** | Julkaisu BasicAuth-tokenilla (`git-pages-publish-auth`) |
|
||||
| **Helm-managed publish Secret** | `publishAuth.create: false` — secret manuaalisesti |
|
||||
@@ -0,0 +1,140 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
DATA_ROOT="${DATA_ROOT:-/app/data}"
|
||||
CONFIG="${RETENTION_CONFIG:-/etc/retention/retention.json}"
|
||||
GITEA_API_URL="${GITEA_API_URL:?GITEA_API_URL is required}"
|
||||
GITEA_TOKEN="${GITEA_TOKEN:?GITEA_TOKEN is required}"
|
||||
|
||||
[ -d "$DATA_ROOT" ] || { echo "ERROR: data root missing: $DATA_ROOT" >&2; exit 1; }
|
||||
[ -f "$CONFIG" ] || { echo "ERROR: config missing: $CONFIG" >&2; exit 1; }
|
||||
|
||||
default_max_age=$(jq -r '.default.maxAgeDays' "$CONFIG")
|
||||
default_keep_min=$(jq -r '.default.keepMin' "$CONFIG")
|
||||
|
||||
gitea_get() {
|
||||
curl -fsS -H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Accept: application/json" "${GITEA_API_URL}${1}"
|
||||
}
|
||||
|
||||
branch_names_for_repo() {
|
||||
local owner="$1" repo="$2" page=1
|
||||
while true; do
|
||||
local resp count
|
||||
resp=$(gitea_get "/api/v1/repos/${owner}/${repo}/branches?limit=50&page=${page}")
|
||||
count=$(echo "$resp" | jq 'length')
|
||||
[ "$count" -eq 0 ] && break
|
||||
echo "$resp" | jq -r '.[].name'
|
||||
[ "$count" -lt 50 ] && break
|
||||
page=$((page + 1))
|
||||
done
|
||||
}
|
||||
|
||||
rule_max_age() {
|
||||
local branch="$1" v
|
||||
v=$(jq -r --arg b "$branch" '.branches[$b].maxAgeDays // empty' "$CONFIG")
|
||||
[ -n "$v" ] && echo "$v" || echo "$default_max_age"
|
||||
}
|
||||
|
||||
rule_keep_min() {
|
||||
local branch="$1" v
|
||||
v=$(jq -r --arg b "$branch" '.branches[$b].keepMin // empty' "$CONFIG")
|
||||
[ -n "$v" ] && echo "$v" || echo "$default_keep_min"
|
||||
}
|
||||
|
||||
delete_report_dir() {
|
||||
echo "DELETE $1 ($2)"
|
||||
rm -rf "$1"
|
||||
}
|
||||
|
||||
age_days() {
|
||||
local meta="$1" published epoch_pub now
|
||||
published=$(jq -r '.published_at // empty' "$meta")
|
||||
if [ -z "$published" ]; then
|
||||
epoch_pub=$(stat -c %Y "$(dirname "$meta")" 2>/dev/null || stat -f %m "$(dirname "$meta")")
|
||||
else
|
||||
epoch_pub=$(date -u -d "$published" +%s 2>/dev/null || echo 0)
|
||||
fi
|
||||
now=$(date -u +%s)
|
||||
[ "$epoch_pub" -eq 0 ] && echo 99999 && return
|
||||
echo $(( (now - epoch_pub) / 86400 ))
|
||||
}
|
||||
|
||||
CACHE_DIR=$(mktemp -d)
|
||||
trap 'rm -rf "$CACHE_DIR"' EXIT
|
||||
|
||||
active_branches_file() {
|
||||
local owner="$1" repo="$2"
|
||||
local cache="${CACHE_DIR}/${owner}__${repo}.branches"
|
||||
if [ ! -f "$cache" ]; then
|
||||
branch_names_for_repo "$owner" "$repo" | sort -u > "$cache"
|
||||
fi
|
||||
echo "$cache"
|
||||
}
|
||||
|
||||
branch_active() {
|
||||
grep -Fxq "$2" "$1"
|
||||
}
|
||||
|
||||
parse_report_path() {
|
||||
local report_dir="$1" rel rest
|
||||
rel="${report_dir#"${DATA_ROOT}/"}"
|
||||
REPO_OWNER="${rel%%/*}"
|
||||
rest="${rel#*/}"
|
||||
REPO_NAME="${rest%%/*}"
|
||||
}
|
||||
|
||||
# Pass 1: deleted branches (always — no config)
|
||||
while IFS= read -r meta; do
|
||||
report_dir=$(dirname "$meta")
|
||||
parse_report_path "$report_dir"
|
||||
branch=$(jq -r '.branch // empty' "$meta")
|
||||
[ -n "$branch" ] || continue
|
||||
|
||||
cache=$(active_branches_file "$REPO_OWNER" "$REPO_NAME")
|
||||
if ! branch_active "$cache" "$branch"; then
|
||||
delete_report_dir "$report_dir" "branch deleted: ${branch}"
|
||||
fi
|
||||
done < <(find "$DATA_ROOT" -path '*/reports/*/.meta' -type f 2>/dev/null)
|
||||
|
||||
# Pass 2: age + keepMin for active branches (newest first)
|
||||
SURVIVORS="${CACHE_DIR}/survivors.tsv"
|
||||
: > "$SURVIVORS"
|
||||
|
||||
while IFS= read -r meta; do
|
||||
report_dir=$(dirname "$meta")
|
||||
[ -d "$report_dir" ] || continue
|
||||
parse_report_path "$report_dir"
|
||||
branch=$(jq -r '.branch // empty' "$meta")
|
||||
[ -n "$branch" ] || continue
|
||||
|
||||
cache=$(active_branches_file "$REPO_OWNER" "$REPO_NAME")
|
||||
branch_active "$cache" "$branch" || continue
|
||||
|
||||
printf '%s\t%s\t%s\t%s\n' "${REPO_OWNER}/${REPO_NAME}" "$branch" "$report_dir" "$(age_days "$meta")" >> "$SURVIVORS"
|
||||
done < <(find "$DATA_ROOT" -path '*/reports/*/.meta' -type f 2>/dev/null)
|
||||
|
||||
current_key=""
|
||||
kept=0
|
||||
|
||||
while IFS=$'\t' read -r repo_key branch report_dir days; do
|
||||
key="${repo_key}|${branch}"
|
||||
if [ "$key" != "$current_key" ]; then
|
||||
current_key="$key"
|
||||
kept=0
|
||||
max_age=$(rule_max_age "$branch")
|
||||
keep_min=$(rule_keep_min "$branch")
|
||||
fi
|
||||
|
||||
if [ "$days" -gt "$max_age" ]; then
|
||||
delete_report_dir "$report_dir" "older than ${max_age}d (branch ${branch})"
|
||||
continue
|
||||
fi
|
||||
|
||||
kept=$((kept + 1))
|
||||
if [ "$kept" -gt "$keep_min" ]; then
|
||||
delete_report_dir "$report_dir" "exceeds keepMin ${keep_min} (branch ${branch})"
|
||||
fi
|
||||
done < <(sort -t $'\t' -k1,1 -k2,2 -k4,4n "$SURVIVORS")
|
||||
|
||||
echo "Retention cleanup finished."
|
||||
@@ -0,0 +1,19 @@
|
||||
#!/usr/bin/env bash
|
||||
# Scale down git-pages, run PVC cleanup (RWO), scale back up.
|
||||
set -euo pipefail
|
||||
|
||||
NAMESPACE="${NAMESPACE:?NAMESPACE is required}"
|
||||
DEPLOYMENT="${DEPLOYMENT:?DEPLOYMENT is required}"
|
||||
|
||||
echo "Scaling ${DEPLOYMENT} to 0..."
|
||||
kubectl scale "deployment/${DEPLOYMENT}" --replicas=0 -n "$NAMESPACE"
|
||||
kubectl wait --for=delete pod \
|
||||
-l "app.kubernetes.io/name=git-pages,app.kubernetes.io/instance=${INSTANCE}" \
|
||||
-n "$NAMESPACE" --timeout=180s
|
||||
|
||||
/scripts/retention-cleanup.sh
|
||||
|
||||
echo "Scaling ${DEPLOYMENT} to 1..."
|
||||
kubectl scale "deployment/${DEPLOYMENT}" --replicas=1 -n "$NAMESPACE"
|
||||
|
||||
echo "Retention job done."
|
||||
@@ -0,0 +1,16 @@
|
||||
git-pages installed.
|
||||
|
||||
See docs/secrets.md for secret prerequisites (K8s + Gitea Actions).
|
||||
|
||||
Install:
|
||||
helm upgrade --install git-pages ./git-pages -n {{ .Release.Namespace }} -f dev-values.yaml
|
||||
|
||||
Host: https://{{ .Values.ingress.host }}
|
||||
Reports: https://{{ .Values.ingress.host }}/{owner}/{repo}/reports/{sha8}/index.html
|
||||
|
||||
Publish (CI):
|
||||
PATCH https://{{ .Values.ingress.host }}/
|
||||
Authorization: Basic publish:<GIT_PAGES_PUBLISH_TOKEN>
|
||||
|
||||
Upgrade: helm upgrade {{ .Release.Name }} ./git-pages -n {{ .Release.Namespace }} -f dev-values.yaml
|
||||
Uninstall: helm uninstall {{ .Release.Name }} -n {{ .Release.Namespace }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- define "git-pages.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "git-pages.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "git-pages.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "git-pages.labels" -}}
|
||||
helm.sh/chart: {{ include "git-pages.chart" . }}
|
||||
{{ include "git-pages.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "git-pages.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "git-pages.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "git-pages.componentLabels" -}}
|
||||
{{ include "git-pages.labels" . }}
|
||||
app.kubernetes.io/component: pages-server
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{- if and .Values.ingress.enabled .Values.certificate.enabled }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ include "git-pages.fullname" . }}-tls
|
||||
labels:
|
||||
{{- include "git-pages.componentLabels" . | nindent 4 }}
|
||||
spec:
|
||||
secretName: git-pages-tls
|
||||
dnsNames:
|
||||
- {{ .Values.ingress.host | quote }}
|
||||
issuerRef:
|
||||
name: {{ .Values.certificate.issuerRef.name }}
|
||||
kind: {{ .Values.certificate.issuerRef.kind }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "git-pages.fullname" . }}-config
|
||||
labels:
|
||||
{{- include "git-pages.componentLabels" . | nindent 4 }}
|
||||
data:
|
||||
config.toml: |
|
||||
log-format = "text"
|
||||
|
||||
[server]
|
||||
pages = "tcp/:3000"
|
||||
caddy = "-"
|
||||
metrics = "tcp/:3002"
|
||||
|
||||
[storage]
|
||||
type = "fs"
|
||||
|
||||
[storage.fs]
|
||||
root = "/app/data"
|
||||
@@ -0,0 +1,68 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "git-pages.fullname" . }}
|
||||
labels:
|
||||
{{- include "git-pages.componentLabels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "git-pages.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "git-pages.componentLabels" . | nindent 8 }}
|
||||
spec:
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
containers:
|
||||
- name: git-pages
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command:
|
||||
- git-pages
|
||||
args:
|
||||
- -config
|
||||
- /etc/git-pages/config.toml
|
||||
{{- if .Values.pagesInsecure }}
|
||||
env:
|
||||
- name: PAGES_INSECURE
|
||||
value: "1"
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 3000
|
||||
protocol: TCP
|
||||
- name: metrics
|
||||
containerPort: 3002
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /etc/git-pages
|
||||
readOnly: true
|
||||
{{- if .Values.persistence.enabled }}
|
||||
- name: data
|
||||
mountPath: /app/data
|
||||
{{- end }}
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: http
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 20
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ include "git-pages.fullname" . }}-config
|
||||
{{- if .Values.persistence.enabled }}
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ include "git-pages.fullname" . }}-data
|
||||
{{- end }}
|
||||
@@ -0,0 +1,48 @@
|
||||
{{- if .Values.ingress.enabled }}
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: {{ include "git-pages.fullname" . }}
|
||||
labels:
|
||||
{{- include "git-pages.componentLabels" . | nindent 4 }}
|
||||
spec:
|
||||
entryPoints:
|
||||
- {{ .Values.ingress.entryPoints.websecure }}
|
||||
routes:
|
||||
- match: >-
|
||||
Host(`{{ .Values.ingress.host }}`) &&
|
||||
(Method(`PATCH`) || Method(`PUT`))
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: {{ include "git-pages.fullname" . }}-publish-auth
|
||||
services:
|
||||
- name: {{ include "git-pages.fullname" . }}
|
||||
port: {{ .Values.service.port }}
|
||||
- match: Host(`{{ .Values.ingress.host }}`) && (Method(`GET`) || Method(`HEAD`))
|
||||
kind: Rule
|
||||
services:
|
||||
- name: {{ include "git-pages.fullname" . }}
|
||||
port: {{ .Values.service.port }}
|
||||
tls:
|
||||
secretName: git-pages-tls
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: {{ include "git-pages.fullname" . }}-http
|
||||
labels:
|
||||
{{- include "git-pages.componentLabels" . | nindent 4 }}
|
||||
spec:
|
||||
entryPoints:
|
||||
- {{ .Values.ingress.entryPoints.web }}
|
||||
routes:
|
||||
- match: >-
|
||||
Host(`{{ .Values.ingress.host }}`) &&
|
||||
!PathPrefix(`/.well-known/acme-challenge/`)
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: {{ include "git-pages.fullname" . }}-https-redirect
|
||||
services:
|
||||
- name: {{ include "git-pages.fullname" . }}
|
||||
port: {{ .Values.service.port }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,22 @@
|
||||
{{- if .Values.ingress.enabled }}
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: {{ include "git-pages.fullname" . }}-publish-auth
|
||||
labels:
|
||||
{{- include "git-pages.componentLabels" . | nindent 4 }}
|
||||
spec:
|
||||
basicAuth:
|
||||
secret: git-pages-publish-auth
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: {{ include "git-pages.fullname" . }}-https-redirect
|
||||
labels:
|
||||
{{- include "git-pages.componentLabels" . | nindent 4 }}
|
||||
spec:
|
||||
redirectScheme:
|
||||
scheme: https
|
||||
permanent: true
|
||||
{{- end }}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if and .Values.publishAuth.create .Values.publishAuth.htpasswdUsers }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: git-pages-publish-auth
|
||||
labels:
|
||||
{{- include "git-pages.componentLabels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
users: |
|
||||
{{ .Values.publishAuth.htpasswdUsers }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,17 @@
|
||||
{{- if .Values.persistence.enabled }}
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "git-pages.fullname" . }}-data
|
||||
labels:
|
||||
{{- include "git-pages.componentLabels" . | nindent 4 }}
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.persistence.accessMode }}
|
||||
{{- if .Values.persistence.storageClass }}
|
||||
storageClassName: {{ .Values.persistence.storageClass | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{- if .Values.persistence.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: git-pages-retention
|
||||
labels:
|
||||
{{- include "git-pages.componentLabels" . | nindent 4 }}
|
||||
data:
|
||||
retention.json: |
|
||||
{{- .Values.retention.rules | toJson | nindent 4 }}
|
||||
retention-cleanup.sh: |
|
||||
{{- .Files.Get "files/retention-cleanup.sh" | nindent 4 }}
|
||||
retention-run.sh: |
|
||||
{{- .Files.Get "files/retention-run.sh" | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,78 @@
|
||||
{{- if .Values.persistence.enabled }}
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: git-pages-retention
|
||||
labels:
|
||||
{{- include "git-pages.componentLabels" . | nindent 4 }}
|
||||
spec:
|
||||
schedule: {{ .Values.retention.schedule | quote }}
|
||||
concurrencyPolicy: Forbid
|
||||
successfulJobsHistoryLimit: 3
|
||||
failedJobsHistoryLimit: 3
|
||||
jobTemplate:
|
||||
spec:
|
||||
backoffLimit: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: git-pages-retention
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
spec:
|
||||
serviceAccountName: git-pages-retention
|
||||
restartPolicy: OnFailure
|
||||
containers:
|
||||
- name: retention
|
||||
image: "{{ .Values.retention.image.repository }}:{{ .Values.retention.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.retention.image.pullPolicy }}
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
command:
|
||||
- bash
|
||||
- -c
|
||||
- |
|
||||
set -euo pipefail
|
||||
apt-get update -qq
|
||||
apt-get install -y --no-install-recommends curl jq >/dev/null
|
||||
chmod +x /scripts/retention-run.sh /scripts/retention-cleanup.sh
|
||||
/scripts/retention-run.sh
|
||||
env:
|
||||
- name: NAMESPACE
|
||||
value: {{ .Release.Namespace | quote }}
|
||||
- name: DEPLOYMENT
|
||||
value: {{ include "git-pages.fullname" . | quote }}
|
||||
- name: INSTANCE
|
||||
value: {{ .Release.Name | quote }}
|
||||
- name: DATA_ROOT
|
||||
value: /app/data
|
||||
- name: RETENTION_CONFIG
|
||||
value: /etc/retention/retention.json
|
||||
- name: GITEA_API_URL
|
||||
value: {{ required "retention.giteaApiUrl is required" .Values.retention.giteaApiUrl | quote }}
|
||||
- name: GITEA_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: git-pages-retention-gitea
|
||||
key: token
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /app/data
|
||||
- name: scripts
|
||||
mountPath: /scripts
|
||||
- name: config
|
||||
mountPath: /etc/retention
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ include "git-pages.fullname" . }}-data
|
||||
- name: scripts
|
||||
configMap:
|
||||
name: git-pages-retention
|
||||
defaultMode: 0755
|
||||
- name: config
|
||||
configMap:
|
||||
name: git-pages-retention
|
||||
items:
|
||||
- key: retention.json
|
||||
path: retention.json
|
||||
{{- end }}
|
||||
@@ -0,0 +1,37 @@
|
||||
{{- if .Values.persistence.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: git-pages-retention
|
||||
labels:
|
||||
{{- include "git-pages.componentLabels" . | nindent 4 }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: git-pages-retention
|
||||
labels:
|
||||
{{- include "git-pages.componentLabels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments", "deployments/scale"]
|
||||
verbs: ["get", "patch", "update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "list", "watch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: git-pages-retention
|
||||
labels:
|
||||
{{- include "git-pages.componentLabels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: git-pages-retention
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: git-pages-retention
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "git-pages.fullname" . }}
|
||||
labels:
|
||||
{{- include "git-pages.componentLabels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
selector:
|
||||
{{- include "git-pages.selectorLabels" . | nindent 4 }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
@@ -0,0 +1,55 @@
|
||||
# Constants — shared across all instances. Do not put per-env values here.
|
||||
# Per instance: use {env}-values.yaml (e.g. dev-values.yaml):
|
||||
# helm install git-pages ./git-pages -n git-pages -f dev-values.yaml
|
||||
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
image:
|
||||
repository: codeberg.org/git-pages/git-pages
|
||||
tag: "0.9.1"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
pagesInsecure: true
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 3000
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
accessMode: ReadWriteOnce
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 512Mi
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
entryPoints:
|
||||
websecure: websecure
|
||||
web: web
|
||||
|
||||
certificate:
|
||||
enabled: true
|
||||
|
||||
# Optional Helm-managed secret — prefer manual create (see docs/secrets.md).
|
||||
publishAuth:
|
||||
create: false
|
||||
htpasswdUsers: ""
|
||||
|
||||
retention:
|
||||
schedule: "0 3 * * *"
|
||||
image:
|
||||
repository: bitnami/kubectl
|
||||
tag: "1.31.4"
|
||||
pullPolicy: IfNotPresent
|
||||
rules:
|
||||
default:
|
||||
maxAgeDays: 90
|
||||
keepMin: 5
|
||||
branches: {}
|
||||
Reference in New Issue
Block a user