feat(gitea): refactor configuration to use structured app_config and add TLS support

2025-05-09 22:21:33 +02:00
parent 9de7d52192
commit 17a54f6792
13 changed files with 487 additions and 206 deletions
@@ -0,0 +1,63 @@
+
+resource "kubernetes_service" "gitea_http" {
+  metadata {
+    name      = "http"
+    namespace = kubernetes_namespace.gitea.metadata[0].name
+  }
+  spec {
+    port {
+      port        = var.tls_enabled ? 443 : 80
+      target_port = "http"
+    }
+    selector = {
+      app = "gitea"
+    }
+    cluster_ip = "None"
+  }
+}
+
+resource "kubernetes_ingress_v1" "gitea_ingress" {
+  metadata {
+    name      = "gitea-ingress"
+    namespace = kubernetes_namespace.gitea.metadata[0].name
+
+    annotations = merge({
+      "kubernetes.io/ingress.class"                         = "public"
+      "cert-manager.io/cluster-issuer"                      = "letsencrypt-prod"
+      "nginx.ingress.kubernetes.io/ssl-redirect"            = "true"
+      "nginx.ingress.kubernetes.io/proxy-body-size"         = "8m"
+      "nginx.ingress.kubernetes.io/proxy-request-buffering" = "on"
+      "nginx.ingress.kubernetes.io/proxy-buffer-size"       = "32k"
+      "nginx.ingress.kubernetes.io/proxy-buffers-number"    = "16"
+      },
+      var.tls_enabled ? {
+        "nginx.org/ssl-services"                       = "http"
+        "nginx.org/ssl-redirect"                       = "true"
+        "nginx.org/redirect-to-https"                  = "true"
+        "nginx.ingress.kubernetes.io/backend-protocol" = "HTTPS"
+      } : {}
+    )
+
+  }
+  spec {
+    tls {
+      hosts       = [var.fqdn]
+      secret_name = "gitea-tls"
+    }
+    rule {
+      host = var.fqdn
+      http {
+        path {
+          backend {
+            service {
+              name = "http"
+              port {
+                number = var.tls_enabled ? 443 : 80
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}