---
# gitea-proxy — plain nginx proxy to GKE Gitea LB IP
#
# Routes directly to the GKE Network LB IP, bypassing Cloudflare entirely.
# No CF Access service-token auth needed. The runners can't add custom HTTP
# headers, so going through Cloudflare Access is not viable for the gRPC
# Actions ping endpoint (/api/actions/*).
#
# Runners use:
#   GITEA_INSTANCE_URL: http://gitea-proxy.ci.svc.cluster.local:3000
#
# The GKE Gitea LB IP (34.31.145.131) is the external IP of the
# gitea Service in the gitea namespace on the GKE cluster.
apiVersion: v1
kind: ConfigMap
metadata:
  name: gitea-proxy-config
  namespace: ci
data:
  default.conf: |
    server {
      listen 3000;

      location / {
        # Direct to GKE Gitea LB IP — bypasses Cloudflare/CF Access entirely.
        proxy_pass http://34.31.145.131;

        # Tell Gitea which hostname it's being served as so self-referencing
        # URLs (clone URLs, webhook URLs) are generated correctly.
        proxy_set_header Host git.neuralplatform.ai;

        # Forward all original request headers (auth tokens, etc).
        proxy_pass_request_headers on;

        # Rewrite Location headers in redirects back to the proxy URL.
        proxy_redirect http://34.31.145.131/
                       http://gitea-proxy.ci.svc.cluster.local:3000/;

        # Standard proxy headers.
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto http;

        # Allow large request bodies (git push payloads).
        client_max_body_size 512m;
      }
    }
---
# Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitea-proxy
  namespace: ci
  labels:
    app: gitea-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gitea-proxy
  template:
    metadata:
      labels:
        app: gitea-proxy
      annotations:
        config-version: "2026-05-05-direct-lb"
    spec:
      containers:
        - name: nginx
          image: nginx:alpine
          ports:
            - containerPort: 3000
          volumeMounts:
            - name: config
              mountPath: /etc/nginx/conf.d
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
            limits:
              cpu: 200m
              memory: 64Mi
      volumes:
        - name: config
          configMap:
            name: gitea-proxy-config
---
# Service — ClusterIP reachable by all runner pods as gitea-proxy.ci:3000
apiVersion: v1
kind: Service
metadata:
  name: gitea-proxy
  namespace: ci
spec:
  selector:
    app: gitea-proxy
  ports:
    - port: 3000
      targetPort: 3000