a13labs.infra/terraform/modules/apps/gitea/main.tf

resource "kubernetes_namespace" "gitea" {
  metadata {
    annotations = {
      name = "gitea"
    }

    labels = {
      name = "gitea"
    }

    name = "gitea"
  }
}

resource "kubernetes_manifest" "internal_cert" {
  count = var.tls_enabled ? 1 : 0
  manifest = {
    apiVersion = "cert-manager.io/v1"
    kind       = "Certificate"
    metadata = {
      name      = "internal-cert"
      namespace = kubernetes_namespace.gitea.metadata[0].name
    }
    spec = {
      secretName = "internal-cert"
      issuerRef = {
        name = var.issuer
        kind = "ClusterIssuer"
      }
      commonName = var.fqdn
      dnsNames   = [var.fqdn]
    }
  }
}

resource "kubernetes_secret" "gitea_config" {
  metadata {
    name      = "gitea-config"
    namespace = kubernetes_namespace.gitea.metadata[0].name
  }
  data = {
    "app.ini" = local.config
  }
  type = "Opaque"
}


resource "kubernetes_service_account" "gitea_service_account" {

  metadata {
    name      = "gitea-app-sa"
    namespace = kubernetes_namespace.gitea.metadata[0].name
  }

  automount_service_account_token = false
}

resource "kubernetes_deployment" "gitea" {

  depends_on = [module.gitea_database]

  metadata {
    name      = "gitea-app"
    namespace = kubernetes_namespace.gitea.metadata[0].name
  }
  spec {
    selector {
      match_labels = {
        app = "gitea"
      }
    }
    strategy {
      type = "Recreate"
    }
    template {
      metadata {
        labels = {
          app = "gitea"
        }
        annotations = {
          "checksum/config" = local.config_checksum
        }
      }
      spec {
        service_account_name = kubernetes_service_account.gitea_service_account.metadata[0].name
        container {
          name              = "gitea"
          image             = "gitea/gitea:${var.tag}"
          image_pull_policy = "Always"

          resources {
            requests = {
              memory = "100Mi"
            }
          }

          liveness_probe {
            http_get {
              path   = "/api/healthz"
              port   = "http"
              scheme = var.tls_enabled ? "HTTPS" : "HTTP"
            }
            initial_delay_seconds = 200
            period_seconds        = 300
            success_threshold     = 1
            failure_threshold     = 5
          }

          readiness_probe {
            tcp_socket {
              port = "http"
            }
            initial_delay_seconds = 5
            period_seconds        = 10
            success_threshold     = 1
            failure_threshold     = 3
          }

          security_context {
            allow_privilege_escalation = false
            run_as_group               = 1000
            run_as_user                = 1000
            read_only_root_filesystem  = true
          }

          port {
            container_port = 3000
            name           = "http"
          }

          volume_mount {
            mount_path = "/data"
            name       = "persistent-storage"
          }
          volume_mount {
            mount_path = "/etc/gitea/app.ini"
            name       = "gitea-config"
            sub_path   = "app.ini"
          }
          volume_mount {
            name       = "tmp"
            mount_path = "/tmp"
          }
          dynamic "volume_mount" {
            for_each = var.tls_enabled ? [1] : []
            content {
              mount_path = "/etc/ssl/certs/private"
              name       = "internal-cert"
              read_only  = true
            }
          }
        }
        volume {
          name = "persistent-storage"
          host_path {
            path = local.gitea_path
          }
        }
        volume {
          name = "gitea-config"
          secret {
            secret_name = kubernetes_secret.gitea_config.metadata[0].name
            items {
              key  = "app.ini"
              path = "app.ini"
            }
          }
        }
        volume {
          name = "tmp"
          empty_dir {
            medium = "Memory"
          }
        }
        dynamic "volume" {
          for_each = var.tls_enabled ? [1] : []
          content {
            name = "internal-cert"
            secret {
              secret_name = kubernetes_manifest.internal_cert[0].manifest["metadata"]["name"]
              items {
                key  = "tls.crt"
                path = "tls.crt"
              }
              items {
                key  = "tls.key"
                path = "tls.key"
              }
            }
          }
        }
      }
    }
  }

  lifecycle {
    ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]]
  }
}