Skip to content

migrate: gitea-dev #1181

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
uni-kakurenbo wants to merge 4 commits into
base: main
Choose a base branch
from
Open

migrate: gitea-dev #1181

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
94b51f4
migrate: gitea-dev (in-progress)
uni-kakurenbo Sep 24, 2025
434b71c
fixup! migrate: gitea-dev (in-progress)
uni-kakurenbo Jan 6, 2026
4f98349
fixup! fixup! migrate: gitea-dev (in-progress)
uni-kakurenbo Mar 25, 2026
cfdb754
fixup! fixup! fixup! migrate: gitea-dev (in-progress)
uni-kakurenbo Mar 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions gitea-dev/certificate.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: gitea

spec:
issuerRef:
kind: ClusterIssuer
name: dns-cluster-issuer
secretName: gitea-tls
duration: 2160h0m0s # 90d
renewBefore: 720h0m0s # 30d
dnsNames:
- git-dev.trapti.tech
101 changes: 101 additions & 0 deletions gitea-dev/config/app.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,101 @@
APP_NAME = traP Gitea Develop
RUN_MODE = prod
WORK_PATH = /data/gitea

[repository]
ROOT = /data/git/repositories
DISABLED_REPO_UNITS = repo.wiki

[repository.local]
LOCAL_COPY_PATH = /data/gitea/tmp/local-repo

[repository.upload]
TEMP_PATH = /data/gitea/uploads

Copy link
Copy Markdown
Collaborator

@Kentaro1043 Kentaro1043 Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[repository.signing]が抜けてる気がします

Copy link
Copy Markdown
Contributor Author

@uni-kakurenbo uni-kakurenbo Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

今の [repository.signing] の設定ってどこで確認できますか？
m011 の /srv/gitea/app.ini.bak を見ても特に何も見つからず.....

[server]
APP_DATA_PATH = /data/gitea
DOMAIN = git-dev.trapti.tech
SSH_DOMAIN = git-dev.trapti.tech
HTTP_PORT = 3000
ROOT_URL = https://git-dev.trapti.tech/
DISABLE_SSH = false
SSH_PORT = 2222
SSH_LISTEN_PORT = 2222
LFS_START_SERVER = true
START_SSH_SERVER = true

[database]
PATH = /data/gitea/gitea.db
DB_TYPE = mysql
HOST = private.kmbk.tokyotech.org:33060
Copy link
Copy Markdown
Collaborator

@Kentaro1043 Kentaro1043 Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tailscaleになってなさそうです

Suggested change
HOST = private.kmbk.tokyotech.org:33060
HOST = tailscale.kmbk.tokyotech.org:33060

NAME = service_gitea_dev
USER = service_gitea_dev
LOG_SQL = false

[indexer]
ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve

[session]
PROVIDER_CONFIG = /data/gitea/sessions

[picture]
AVATAR_UPLOAD_PATH = /data/gitea/avatars
REPOSITORY_AVATAR_UPLOAD_PATH = /data/gitea/repo-avatars

[attachment]
STORAGE_TYPE = minio

[log]
MODE = console
LEVEL = Debug
ROOT_PATH = /data/gitea/log

[security]
INSTALL_LOCK = true
REVERSE_PROXY_LIMIT = 1
REVERSE_PROXY_TRUSTED_PROXIES = *
REVERSE_PROXY_AUTHENTICATION_EMAIL = X-Forwarded-User-Email
REVERSE_PROXY_AUTHENTICATION_USER = X-Forwarded-User

[service]
DISABLE_REGISTRATION = true
REQUIRE_SIGNIN_VIEW = true
ENABLE_REVERSE_PROXY_AUTHENTICATION = false
ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = true
NO_REPLY_ADDRESS = trap.jp
ENABLE_REVERSE_PROXY_EMAIL = true
DEFAULT_KEEP_EMAIL_PRIVATE = true
DEFAULT_ORG_MEMBER_VISIBLE = true
ENABLE_NOTIFY_MAIL = true
ENABLE_BASIC_AUTHENTICATION = false
Comment on lines +60 to +70
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

リバースプロキシ認証の設定に矛盾があります。

ENABLE_REVERSE_PROXY_AUTHENTICATION = falseに設定されていますが、ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = trueとENABLE_REVERSE_PROXY_EMAIL = trueが有効になっています。認証が無効な状態でこれらの設定は機能しません。意図した動作を確認してください。

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@gitea-dev/config/app.ini` around lines 60 - 70,
設定の矛盾があります：ENABLE_REVERSE_PROXY_AUTHENTICATION が false のまま
ENABLE_REVERSE_PROXY_AUTO_REGISTRATION と ENABLE_REVERSE_PROXY_EMAIL を true
にしています。期待する動作に合わせて整合させてください — リバースプロキシ認証を使うなら
ENABLE_REVERSE_PROXY_AUTHENTICATION を true に切り替え、また必要に応じて
ENABLE_REVERSE_PROXY_AUTO_REGISTRATION / ENABLE_REVERSE_PROXY_EMAIL を true
にし、認証を使わないならこれらを false にしてください（参照する設定キー：ENABLE_REVERSE_PROXY_AUTHENTICATION,
ENABLE_REVERSE_PROXY_AUTO_REGISTRATION, ENABLE_REVERSE_PROXY_EMAIL）。


[lfs]
STORAGE_TYPE = minio

[storage.minio]
MINIO_ENDPOINT = s3.ap-northeast-1.wasabisys.com
MINIO_BUCKET = trap-gitea-dev
MINIO_LOCATION = ap-northeast-1
MINIO_USE_SSL = true
MINIO_CHECKSUM_ALGORITHM = md5
Comment thread
Kentaro1043 marked this conversation as resolved.

[actions]
DEFAULT_ACTIONS_URL = github

[openid]
ENABLE_OPENID_SIGNIN = false

[default]
APP_NAME = traP Git Develop

[mailer]
ENABLED = true

[metrics]
ENABLED = true

[oauth2]
ENABLED = false

[admin]
USER_DISABLED_FEATURES = deletion,change_username,change_full_name
49 changes: 49 additions & 0 deletions gitea-dev/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: gitea
name: gitea
spec:
replicas: 1
selector:
matchLabels:
app: gitea
strategy:
type: Recreate
template:
metadata:
labels:
app: gitea
spec:
containers:
- env:
- name: USER_GID
value: "1002"
- name: USER_UID
value: "996"
Comment on lines +19 to +24
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

gitea-secretsがコンテナに注入されていません。

gitea-dev/secrets/secrets.yamlで定義されているgitea-secrets（データベースパスワード、SECRET_KEY、MinIO認証情報など）がDeploymentに注入されていません。これがPR説明で言及されている「app.iniに認証情報を埋め込む方法がわからない」問題の解決策です。GiteaはGITEA__section__KEY形式の環境変数で設定を上書きできます。

🐛 envFromを追加してシークレットを注入 
       containers:
         - env:
             - name: USER_GID
               value: "1002"
             - name: USER_UID
               value: "996"
+          envFrom:
+            - secretRef:
+                name: gitea-secrets
           image: gitea-latest
           name: gitea
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
containers:
- env:
- name: USER_GID
value: "1002"
- name: USER_UID
value: "996"
containers:
- env:
- name: USER_GID
value: "1002"
- name: USER_UID
value: "996"
envFrom:
- secretRef:
name: gitea-secrets
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@gitea-dev/deployment.yaml` around lines 19 - 24, The Deployment does not
inject the gitea-secrets into the container, so add an envFrom secret reference
to the container spec to load all Gitea config keys (use secret name
"gitea-secrets"); specifically, within the containers: - envFrom: - secretRef:
name: gitea-secrets (placed alongside the existing env entries) so
GITEA__section__KEY style secrets (DB password, SECRET_KEY, MinIO creds) are
available as environment variables to Gitea; ensure the secret exists and avoid
duplicating keys already set via individual env entries.

image: gitea-latest
name: gitea
ports:
- containerPort: 3000
protocol: TCP
- containerPort: 2222
hostPort: 2222
protocol: TCP
volumeMounts:
- name: storage
mountPath: /data
- name: config
mountPath: /app.ini
Comment on lines +36 to +40
Copy link
Copy Markdown
Collaborator

@Kentaro1043 Kentaro1043 Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

何故か開発環境にはなかったけど、timezoneをホストと合わせるのが良い気がします 該当箇所

Comment on lines +39 to +40
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

app.iniのマウントパスが正しくありません。

Giteaはデフォルトで/data/gitea/conf/app.iniから設定を読み込みます。現在のマウントパス/app.iniではGiteaが設定を検出できません。また、subPathを使用してファイルを直接マウントする必要があります。

🐛 正しいマウントパスに修正 
           volumeMounts:
             - name: storage
               mountPath: /data
             - name: config
-              mountPath: /app.ini
+              mountPath: /data/gitea/conf/app.ini
+              subPath: app.ini
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@gitea-dev/deployment.yaml` around lines 36 - 37, The config volume mount
currently sets mountPath: /app.ini which Gitea will not read; update the
volumeMount (the entry with name: config and mountPath) to mount the file at
Gitea's expected path /data/gitea/conf/app.ini and add subPath: app.ini so the
single file from the volume is mounted (i.e., change mountPath to
/data/gitea/conf/app.ini and add subPath: app.ini in the same volumeMount
stanza).

restartPolicy: Always
volumes:
- name: storage
persistentVolumeClaim:
claimName: gitea-storage
- name: config
configMap:
name: gitea-config
items:
- key: app.ini
path: app.ini
mode: 0666
20 changes: 20 additions & 0 deletions gitea-dev/ingress-route.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: gitea
spec:
entryPoints:
- websecure
tls:
secretName: gitea-tls
routes:
- kind: Rule
match: Host(`git-dev.trapti.tech`)
services:
- name: gitea
port: 3000
- kind: Rule
match: Host(`git-dev.trapti.tech`)
services:
- name: gitea
port: 2222
Copy link
Copy Markdown
Collaborator

@Kentaro1043 Kentaro1043 Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ここはIngressを通らないので必要なさそうです

Suggested change
- kind: Rule
match: Host(`git-dev.trapti.tech`)
services:
- name: gitea
port: 2222

11 changes: 11 additions & 0 deletions gitea-dev/ksops.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
apiVersion: viaduct.ai/v1
kind: ksops
metadata:
name: ksops
annotations:
config.kubernetes.io/function: |
exec:
path: ksops

files:
- ./secrets/secrets.yaml
19 changes: 19 additions & 0 deletions gitea-dev/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
resources:
- certificate.yaml
- deployment.yaml
- ingress-route.yaml
- service.yaml
- volume-storage.yaml

images:
- name: gitea-latest
newName: ghcr.io/traptitech/gitea
newTag: latest

generators:
- ksops.yaml

configMapGenerator:
- name: gitea-config
files:
- ./config/app.ini
29 changes: 29 additions & 0 deletions gitea-dev/secrets/secrets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
apiVersion: v1
kind: Secret
metadata:
name: gitea-secrets
annotations:
kustomize.config.k8s.io/needs-hash: "true"
stringData:
GITEA__server__LFS_JWT_SECRET: ENC[AES256_GCM,data:v0DWaK6X52SH+lMbbYakEvANpBb2x3SrqnA4yjlpsN6UkpBdu0HzlACuNw==,iv:RyOfNbBbJeiYO6qi3mgBVZntLVotdsjOdvik311pl94=,tag:v3sIfGjh134o1pXLmjYSpw==,type:str]
GITEA__database__PASSWD: ENC[AES256_GCM,data:yAkzbPoticTV8q8ueq2a+myH6XNWRvnvNEflbJhQjkQ=,iv:QaXygC1DFda2VubMuugvY9nvcnckFYaLhTfaFXAu3TE=,tag:UVjlyTRXenHvG79sMDgeHQ==,type:str]
GITEA__security__SECRET_KEY: ENC[AES256_GCM,data:CEtC6PTSefDrciCY8JC7tBYYvcdKp2bLzsTxma/jvPwKrVNKeq9NFfL1lZdcn4zY40flK81MeIjIcky2AoKsTw==,iv:rWYomg/n554GuNz8QKkIpVuu+j1rcDIkFJgA9w/d3ig=,tag:JeO/+e0R+fwBws+8LD0KFA==,type:str]
GITEA__security__INTERNAL_TOKEN: ENC[AES256_GCM,data:8h2ga9WR4ZxRd1lIN9fj4N60zK+4ZS308eEw0C7jbq3s4IlHA9lo0BX1QNBxZwSmNo/hx9ryJdswwNHytAK944oNRjD6+aem20x5tnTw+sYq2FxDIgBFbIFmnOu82oOWMdKJILzmMRt5,iv:9lKZEGHJ0ueZwTKGcmgEhuNJmIOkeeL7smsHlmLp6A0=,tag:TD6mF00DjX8aWlNX8/oheg==,type:str]
GITEA__storage_0X2E_minio__MINIO_ACCESS_KEY_ID: ENC[AES256_GCM,data:udb2Z1BrKj7LE8WqKkVsag0pCXQ=,iv:gr/MigXLuInqUdjXJkbmvx/Xc5DKV+7eAGbq+Y75sig=,tag:c0lntI535CuEo1RaYtO57g==,type:str]
GITEA__storage_0X2E_minio__MINIO_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:3gC+8470oS+TYaizsDNLF7NsEh+3/Hip1jkQ01fcchXQxENT/s9UNw==,iv:U9tC1N3q/uMuqeVfWk0l8OnCpOrbD8o25Tj7mkfoCDo=,tag:QZ9w8IMi9ZYXDph/sPU0aA==,type:str]
GITEA__oauth2__JWT_SECRET: ENC[AES256_GCM,data:2bDzDrgMZpV03XXLyqfmXwJiB7Xdl5S3UxmDUBj525jHwYj5xm+0NeoDDQ==,iv:/J0ctup2Qfj1IW7W3GkJVNDhU7KQyy8e5+b7KQeos+o=,tag:Jhfsyy0BcEeNHFoVugNc/w==,type:str]
sops:
age:
- recipient: age156red4ptw5huzpwlfnrukg4htuucdweu9jg8usjz98ggmeyedces3xqplq
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCbWpkcHQzMy80RUhZYXpZ
TkRmVjZGcWtnUml5VWxNdnMrQURVdVVMaEJFCnRQTG9hVDBtb0xlTXpBang2Qmtu
M2NubGh3VDBNR2IwczVmOHRvRjZXdnMKLS0tIGZTSVd5RlZlMk42QVFyU1BpWVN0
SFBKQ2JhZ1FhbWJzbG04V3VIc3laa0UKb2u/tLkA653azNfBgWDC2EzmFWMYw6YY
iAIeQqDmr1sALoWxsRI4yRtkcVVkwyW//+5bRM4SEFvGmrMujxcx6w==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-01-06T14:48:12Z"
mac: ENC[AES256_GCM,data:RJKSOHUnccFTsY+4LLtXW3Pm6A8Tkbtwsod9K6Xg1i+rAtOFT7xjiEIoTrY1SpozHDru161ej4ZZWjmnciBOLBwL8EXjVV/PYJmrcqHqMyDDcpnMrdcTWDnhYMC1wCuTtk70OtBAQTyvMYUsXhMMCcoHGKZfqzVPyrFWgmc0fco=,iv:mCRlnIeaHZ3ImhvGJNLKIRG2fa4Wk7G9OkeiSbEMyiU=,tag:huWiLfQdGJgHFPgnF7UZtQ==,type:str]
unencrypted_regex: ^(apiVersion|metadata|kind|type)$
version: 3.10.2
13 changes: 13 additions & 0 deletions gitea-dev/service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
apiVersion: v1
kind: Service
metadata:
labels:
app: gitea
name: gitea
spec:
ports:
- name: "3000"
port: 3000
targetPort: 3000
Comment on lines +8 to +11
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# 他のgitea環境でServiceがSSHポートを公開しているか確認
fd -e yaml . -x grep -l "kind: Service" {} \; | xargs -I{} sh -c 'echo "=== {} ===" && cat {}'

Repository: traPtitech/manifest

Length of output: 50375

🏁 Script executed:

#!/bin/bash
# Find and examine gitea-dev service configuration
find . -path "*/gitea-dev/*" -name "service.yaml" -o -path "*/gitea-dev/*" -name "*.yaml" | head -20

Repository: traPtitech/manifest

Length of output: 294

🏁 Script executed:

#!/bin/bash
# Look for gitea-dev service.yaml specifically
fd "service.yaml" . | grep gitea

Repository: traPtitech/manifest

Length of output: 141

🏁 Script executed:

#!/bin/bash
# Check the gitea-dev directory structure
ls -la gitea-dev/ 2>/dev/null || find . -type d -name "gitea-dev" | head -5

Repository: traPtitech/manifest

Length of output: 756

🏁 Script executed:

cat -n gitea-dev/service.yaml

Repository: traPtitech/manifest

Length of output: 332

🏁 Script executed:

cat -n gitea-dev/deployment.yaml

Repository: traPtitech/manifest

Length of output: 1480

🏁 Script executed:

cat -n gitea-dev/ingress-route.yaml

Repository: traPtitech/manifest

Length of output: 591

ServiceがIngressRouteで参照されているポート2222を公開していません。

IngressRouteの2つ目のルール（17-20行目）がポート2222をサービスに指定していますが、Serviceの定義にはポート2000のみが含まれています。Deploymentではコンテナポート2222にhostPort: 2222が設定されているため、現在の構成ではIngressRouteのルーティングが機能しません。Serviceに以下のポート定義を追加してください：

  ports:
    - name: "3000"
      port: 3000
      targetPort: 3000
    - name: "2222"
      port: 2222
      targetPort: 2222
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@gitea-dev/service.yaml` around lines 8 - 11, The Service is missing the port
for SSH (2222) referenced by the IngressRoute rule; update the Service resource
to include an additional port entry for port 2222 (name "2222", port 2222,
targetPort 2222) so it matches the IngressRoute rule and the Deployment's
containerPort/hostPort 2222, ensuring the IngressRoute routing can reach the
pods.

selector:
app: gitea
11 changes: 11 additions & 0 deletions gitea-dev/volume-storage.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: gitea-storage
spec:
resources:
requests:
storage: 100Mi
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
Loading