feat(gitea): refactor configuration to use structured app_config and add TLS support

terraform/modules/apps/gitea/main.tf

@@ -12,18 +12,38 @@ resource "kubernetes_namespace" "gitea" {
   }
 }
 
-resource "kubernetes_secret" "gitea_mail_credentials" {
+resource "kubernetes_manifest" "internal_cert" {
+  count = var.tls_enabled ? 1 : 0
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+    metadata = {
+      name      = "internal-cert"
+      namespace = kubernetes_namespace.gitea.metadata[0].name
+    }
+    spec = {
+      secretName = "internal-cert"
+      issuerRef = {
+        name = var.issuer
+        kind = "ClusterIssuer"
+      }
+      commonName = var.fqdn
+      dnsNames   = [var.fqdn]
+    }
+  }
+}
+
+resource "kubernetes_config_map" "gitea_config" {
   metadata {
-    name      = "gitea-mail-credentials"
+    name      = "gitea-config"
     namespace = kubernetes_namespace.gitea.metadata[0].name
   }
   data = {
-    username = var.smtp_username
-    password = var.smtp_password
+    "app.ini" = local.config
   }
-  type = "Opaque"
 }
 
+
 resource "kubernetes_service_account" "gitea_service_account" {
 
   metadata {
@@ -34,61 +54,6 @@ resource "kubernetes_service_account" "gitea_service_account" {
   automount_service_account_token = false
 }
 
-resource "kubernetes_service" "gitea_http" {
-  metadata {
-    name      = "http"
-    namespace = kubernetes_namespace.gitea.metadata[0].name
-  }
-  spec {
-    port {
-      port        = 80
-      target_port = "http"
-    }
-    selector = {
-      app = "gitea"
-    }
-    cluster_ip = "None"
-  }
-}
-
-resource "kubernetes_ingress_v1" "gitea_ingress" {
-  metadata {
-    name      = "gitea-ingress"
-    namespace = kubernetes_namespace.gitea.metadata[0].name
-
-    annotations = {
-      "kubernetes.io/ingress.class"                         = "public"
-      "cert-manager.io/cluster-issuer"                      = "letsencrypt-prod"
-      "nginx.ingress.kubernetes.io/ssl-redirect"            = "true"
-      "nginx.ingress.kubernetes.io/proxy-body-size"         = "8m"
-      "nginx.ingress.kubernetes.io/proxy-request-buffering" = "on"
-      "nginx.ingress.kubernetes.io/proxy-buffer-size"       = "32k"
-      "nginx.ingress.kubernetes.io/proxy-buffers-number"    = "16"
-    }
-  }
-  spec {
-    tls {
-      hosts       = [var.fqdn]
-      secret_name = "gitea-tls"
-    }
-    rule {
-      host = var.fqdn
-      http {
-        path {
-          backend {
-            service {
-              name = "http"
-              port {
-                number = 80
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-}
-
 resource "kubernetes_deployment" "gitea" {
 
   depends_on = [module.gitea_database]
@@ -111,6 +76,9 @@ resource "kubernetes_deployment" "gitea" {
         labels = {
           app = "gitea"
         }
+        annotations = {
+          "checksum/config" = local.config_checksum
+        }
       }
       spec {
         service_account_name = kubernetes_service_account.gitea_service_account.metadata[0].name
@@ -149,30 +117,10 @@ resource "kubernetes_deployment" "gitea" {
             failure_threshold     = 3
           }
 
-          dynamic "env" {
-            for_each = local.gitea_env_vars
-            content {
-              name  = env.key
-              value = env.value
-            }
-          }
           security_context {
             allow_privilege_escalation = false
           }
 
-          dynamic "env" {
-            for_each = local.gitea_secrets
-            content {
-              name = env.key
-              value_from {
-                secret_key_ref {
-                  key  = env.value.key
-                  name = env.value.name
-                }
-              }
-            }
-          }
-
           port {
             container_port = 3000
             name           = "http"
@@ -186,6 +134,19 @@ resource "kubernetes_deployment" "gitea" {
             mount_path = "/data"
             name       = "persistent-storage"
           }
+          volume_mount {
+            mount_path = "/data/gitea/conf/app.ini"
+            name       = "gitea-config"
+            sub_path   = "app.ini"
+          }
+          dynamic "volume_mount" {
+            for_each = var.tls_enabled ? [1] : []
+            content {
+              mount_path = "/etc/ssl/certs/private"
+              name       = "internal-cert"
+              read_only  = true
+            }
+          }
         }
         volume {
           name = "persistent-storage"
@@ -193,54 +154,35 @@ resource "kubernetes_deployment" "gitea" {
             path = local.gitea_path
           }
         }
+        volume {
+          name = "gitea-config"
+          config_map {
+            name = kubernetes_config_map.gitea_config.metadata[0].name
+          }
+        }
+        dynamic "volume" {
+          for_each = var.tls_enabled ? [1] : []
+          content {
+            name = "internal-cert"
+            secret {
+              secret_name = kubernetes_manifest.internal_cert[0].manifest["metadata"]["name"]
+              items {
+                key  = "tls.crt"
+                path = "tls.crt"
+              }
+              items {
+                key  = "tls.key"
+                path = "tls.key"
+              }
+            }
+          }
+        }
       }
     }
   }
-}
 
-resource "kubernetes_role" "gitea_ssh_access" {
-  metadata {
-    name      = "gitea-ssh-access"
-    namespace = kubernetes_namespace.gitea.metadata[0].name
-  }
-  rule {
-    api_groups = [""]
-    resources  = ["pods", "pods/log"]
-    verbs      = ["get", "list"]
-  }
-  rule {
-    api_groups = [""]
-    resources  = ["pods/exec"]
-    verbs      = ["create"]
+  lifecycle {
+    ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]]
   }
 }
 
-resource "kubernetes_role_binding" "gitea_ssh_access" {
-  metadata {
-    name      = "gitea-ssh-access"
-    namespace = kubernetes_namespace.gitea.metadata[0].name
-  }
-  role_ref {
-    api_group = "rbac.authorization.k8s.io"
-    kind      = "Role"
-    name      = kubernetes_role.gitea_ssh_access.metadata[0].name
-  }
-  subject {
-    kind      = "ServiceAccount"
-    name      = kubernetes_service_account.gitea_service_account.metadata[0].name
-    namespace = kubernetes_namespace.gitea.metadata[0].name
-  }
-}
-
-resource "kubernetes_secret" "gitea_access_token" {
-  metadata {
-    annotations = {
-      "kubernetes.io/service-account.name" = kubernetes_service_account.gitea_service_account.metadata[0].name
-    }
-    name      = "git-token"
-    namespace = kubernetes_namespace.gitea.metadata[0].name
-  }
-
-  type                           = "kubernetes.io/service-account-token"
-  wait_for_service_account_token = true
-}