---

###
# Gitea
# --------------------------------------
# Single-pod, expendable instance for RO view only.
# No need for HA or pod spreading affinity settings.
#
# Gotchas:
# - When persistence is enabled the pod requires a volume, but the volume is stored only in one availability zone.
#   Need to force pod and volume in the same zone. Or find a better solution.
# - The 'RollingUpdate' strategy has issues with persistence.
#   Lock files on disk need to be exclusive and leave new pods crashing.
#
# Default values: `helm show values --repo 'https://dl.gitea.com/charts/' 'gitea'`
###

image:
  registry: 012345678901.dkr.ecr.eu-west-1.amazonaws.com
  repository: docker-hub-cache/gitea/gitea
  tag: 1.22.2
  rootless: true
postgresql-ha:
  # single-pod, expendable instance for RO view only, no need for HA
  enabled: false
redis-cluster:
  # single-pod, expendable instance for RO view only, no need for HA
  enabled: false
persistence:
  enabled: true
  create: true
  mount: true
  claimName: gitea-shared-storage
  size: 10Gi
  accessModes:
    - ReadWriteOnce
affinity:
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
        - matchExpressions:
            - # required due to persistence, see Gotchas in the top comment
              key: topology.kubernetes.io/zone
              operator: In
              values:
                - eu-west-1a
strategy:
  type: Recreate  # 'RollingUpdate' has issues with persistence, see Gotchas in the top comment
resources:
  requests:
    # usually runs on 4m CPUs and 80Mi RAM when chilling unused
    cpu: 10m
    memory: 128Mi
  limits:
    # bump resources up a lot when needing fast migrations
    # not usually necessary for normal use
    cpu: 100m
    memory: 196Mi
ingress:
  enabled: true
  className: alb
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/load-balancer-name: gitea
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/certificate-arn: >-
      arn:aws:acm:eu-west-1:012345678901:certificate/01234567-abcd-0123-abcd-0123456789ab
    alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-2016-08
    alb.ingress.kubernetes.io/ssl-redirect: 443
  hosts:
    - host: gitea.company.com
      paths:
        - path: /
          pathType: Prefix
gitea:
  admin:
    existingSecret: gitea-admin-secret
    email: admin@company.com
    passwordMode: keepUpdated
  config:
    server:
      ROOT_URL: https://gitea.company.com  # needed due to tls termination on the ingress
      LANDING_PAGE: login
    database:
      DB_TYPE: sqlite3
    queue:
      TYPE: level
    admin:
      DISABLE_REGULAR_ORG_CREATION: true
    oauth2_client:
      ENABLE_AUTO_REGISTRATION: true
      REGISTER_EMAIL_CONFIRM: true  # only use if mailer settings are working
      USERNAME: email
      UPDATE_AVATAR: true
    service:
      DISABLE_REGISTRATION: true
      DEFAULT_KEEP_EMAIL_PRIVATE: true
      DEFAULT_ALLOW_CREATE_ORGANIZATION: false
      DEFAULT_USER_VISIBILITY: limited  # visible to authenticated users only
      DEFAULT_ORG_VISIBILITY: limited  # visible to authenticated users only
    mailer:
      ENABLED: true
      PROTOCOL: smtp+starttls
      SMTP_ADDR: email-smtp.eu-west-1.amazonaws.com
      SMTP_PORT: 587
      USER: AKIA2HKHF0123456ABCD
      PASSWD: ABCD…ABCD
      FROM: noreply@gitea.company.com
    cache:
      ADAPTER: memory
    session:
      PROVIDER: memory
    migrations:
      ALLOWED_DOMAINS: gitlab.company.com
