# Gitea with SQLite; everything (repositories, database, SSH host keys) lives in
# /var/lib/gitea on the music node.
# `replicas` is deliberately not set: Argo CD does not manage it, so the instance
# can be scaled to 0 with kubectl during a data migration without being healed back.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitea
  labels:
    app: gitea
spec:
  selector:
    matchLabels:
      app: gitea
  strategy:
    type: Recreate # two instances must never open the same SQLite database
  template:
    metadata:
      labels:
        app: gitea
    spec:
      nodeSelector:
        kubernetes.io/hostname: music
      volumes:
        - name: storage
          hostPath:
            path: /var/lib/gitea
            type: DirectoryOrCreate
      containers:
        - name: gitea
          image: gitea/gitea:28.0.0
          resources:
            requests:
              memory: 1Gi
              cpu: "1"
            limits:
              memory: 4Gi
              cpu: "4"
          env:
            - name: GITEA__service__REGISTER_MANUAL_CONFIRM
              value: "true"
            - name: GITEA__service__ENABLE_CAPTCHA
              value: "true"
            - name: GITEA__service__REQUIRE_CAPTCHA_FOR_LOGIN
              value: "false"
            - name: GITEA__service__REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA
              value: "true"
            - name: GITEA__service__CAPTCHA_TYPE
              value: cfturnstile
            - name: GITEA__security__ALLOWED_HOST_LIST
              value: "*"
          envFrom:
            - secretRef:
                name: gitea-runner-act-runner-secrets
          ports:
            - name: http
              containerPort: 3000
              protocol: TCP
            - name: ssh
              containerPort: 22
              protocol: TCP
          readinessProbe:
            httpGet:
              path: /api/healthz
              port: http
            periodSeconds: 10
            timeoutSeconds: 5
          volumeMounts:
            - name: storage
              mountPath: /data