Will Anderson
a301302138
CF Access was blocking /api/actions/* even with the correct service-token headers — the gRPC Actions ping endpoint returns 403 through Cloudflare. Direct connection to the GKE Network LB IP (34.31.145.131) bypasses CF entirely. Verified /api/actions/ping returns 200 from the LB IP directly.
101 lines
2.6 KiB
YAML
101 lines
2.6 KiB
YAML
---
|
|
# gitea-proxy — plain nginx proxy to GKE Gitea LB IP
|
|
#
|
|
# Routes directly to the GKE Network LB IP, bypassing Cloudflare entirely.
|
|
# No CF Access service-token auth needed. The runners can't add custom HTTP
|
|
# headers, so going through Cloudflare Access is not viable for the gRPC
|
|
# Actions ping endpoint (/api/actions/*).
|
|
#
|
|
# Runners use:
|
|
# GITEA_INSTANCE_URL: http://gitea-proxy.ci.svc.cluster.local:3000
|
|
#
|
|
# The GKE Gitea LB IP (34.31.145.131) is the external IP of the
|
|
# gitea Service in the gitea namespace on the GKE cluster.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: gitea-proxy-config
|
|
namespace: ci
|
|
data:
|
|
default.conf: |
|
|
server {
|
|
listen 3000;
|
|
|
|
location / {
|
|
# Direct to GKE Gitea LB IP — bypasses Cloudflare/CF Access entirely.
|
|
proxy_pass http://34.31.145.131;
|
|
|
|
# Tell Gitea which hostname it's being served as so self-referencing
|
|
# URLs (clone URLs, webhook URLs) are generated correctly.
|
|
proxy_set_header Host git.neuralplatform.ai;
|
|
|
|
# Forward all original request headers (auth tokens, etc).
|
|
proxy_pass_request_headers on;
|
|
|
|
# Rewrite Location headers in redirects back to the proxy URL.
|
|
proxy_redirect http://34.31.145.131/
|
|
http://gitea-proxy.ci.svc.cluster.local:3000/;
|
|
|
|
# Standard proxy headers.
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto http;
|
|
|
|
# Allow large request bodies (git push payloads).
|
|
client_max_body_size 512m;
|
|
}
|
|
}
|
|
---
|
|
# Deployment
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: gitea-proxy
|
|
namespace: ci
|
|
labels:
|
|
app: gitea-proxy
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: gitea-proxy
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: gitea-proxy
|
|
annotations:
|
|
config-version: "2026-05-05-direct-lb"
|
|
spec:
|
|
containers:
|
|
- name: nginx
|
|
image: nginx:alpine
|
|
ports:
|
|
- containerPort: 3000
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/nginx/conf.d
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 64Mi
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: gitea-proxy-config
|
|
---
|
|
# Service — ClusterIP reachable by all runner pods as gitea-proxy.ci:3000
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: gitea-proxy
|
|
namespace: ci
|
|
spec:
|
|
selector:
|
|
app: gitea-proxy
|
|
ports:
|
|
- port: 3000
|
|
targetPort: 3000
|