infrastructure/servers/gcp/k8s/gitea/deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitea
  namespace: gitea
  labels:
    app: gitea
spec:
  replicas: 1
  # Recreate — only one pod can hold the RWO PVC at a time.
  # Scale to multiple replicas only after adding shared storage (e.g. Filestore).
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: gitea
  template:
    metadata:
      labels:
        app: gitea
    spec:
      serviceAccountName: gitea

      containers:
        - name: gitea
          image: gitea/gitea:1.25.5
          ports:
            - name: http
              containerPort: 3000
            - name: ssh
              containerPort: 22
          env:
            # Database — connect through the Cloud SQL Auth Proxy unix socket
            - name: GITEA__database__DB_TYPE
              value: postgres
            # Unix socket path used by the Cloud SQL Auth Proxy sidecar
            - name: GITEA__database__HOST
              value: /cloudsql/neuron-785695:us-central1:neuron-prod-pg15
            - name: GITEA__database__NAME
              value: gitea
            - name: GITEA__database__USER
              value: gitea
            - name: GITEA__database__PASSWD
              valueFrom:
                secretKeyRef:
                  name: gitea-db
                  key: password
            # Server
            - name: GITEA__server__DOMAIN
              value: git.neuralplatform.ai
            - name: GITEA__server__ROOT_URL
              value: https://git.neuralplatform.ai
            - name: GITEA__server__SSH_DOMAIN
              value: git.neuralplatform.ai
            - name: GITEA__server__SSH_PORT
              value: "22"
            - name: GITEA__server__START_SSH_SERVER
              value: "false"
            # Service
            - name: GITEA__service__DISABLE_REGISTRATION
              value: "true"
            - name: GITEA__service__REQUIRE_SIGNIN_VIEW
              value: "false"
            # Security
            - name: GITEA__security__INSTALL_LOCK
              value: "true"
            # Packages
            - name: GITEA__packages__ENABLED
              value: "true"
            # Webhooks — allow calls back into the cluster and GKE VPC
            - name: GITEA__webhook__ALLOWED_HOST_LIST
              value: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
            # Actions
            - name: GITEA__actions__ENABLED
              value: "true"
            - name: GITEA__actions__DEFAULT_ACTIONS_URL
              value: https://code.forgejo.org
          volumeMounts:
            - name: data
              mountPath: /data
            - name: cloudsql-socket
              mountPath: /cloudsql
            - name: custom-css
              mountPath: /data/gitea/custom/public/assets/css/custom.css
              subPath: custom.css
            - name: custom-css
              mountPath: /data/gitea/custom/templates/custom/header.tmpl
              subPath: header.tmpl
          resources:
            requests:
              memory: 256Mi
              cpu: 100m
            limits:
              memory: 512Mi
              cpu: 500m
          readinessProbe:
            httpGet:
              path: /
              port: 3000
            initialDelaySeconds: 10
            periodSeconds: 10
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /
              port: 3000
            initialDelaySeconds: 30
            periodSeconds: 15
            failureThreshold: 3

        # Cloud SQL Auth Proxy sidecar — provides unix socket at /cloudsql/
        # Authenticates to Cloud SQL using Workload Identity (no key file).
        - name: cloud-sql-proxy
          image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2
          args:
            - "--structured-logs"
            - "--unix-socket=/cloudsql"
            - "neuron-785695:us-central1:neuron-prod-pg15"
          securityContext:
            runAsNonRoot: true
          volumeMounts:
            - name: cloudsql-socket
              mountPath: /cloudsql
          resources:
            requests:
              memory: 32Mi
              cpu: 10m
            limits:
              memory: 128Mi
              cpu: 100m

      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: gitea-data
        - name: cloudsql-socket
          emptyDir: {}
        - name: custom-css
          configMap:
            name: gitea-custom-css
---
apiVersion: v1
kind: Service
metadata:
  name: gitea
  namespace: gitea
  annotations:
    # External GCP Network LB — Cloudflare proxies in front, provides TLS.
    # After provisioning, get the external IP:
    #   kubectl --context=gke_neuron-785695_us-central1_neuron-platform -n gitea get svc gitea
    # Update Cloudflare DNS A record for git.neuralplatform.ai to this IP.
    cloud.google.com/load-balancer-type: "External"
spec:
  selector:
    app: gitea
  ports:
    - name: http
      port: 80
      targetPort: 3000
    - name: ssh
      port: 22
      targetPort: 22
  type: LoadBalancer