infrastructure/servers/legion/gitea.tf

# Gitea — local git server for private/sensitive infrastructure repos
# Accessible at git.neuralplatform.dev (internal only, real TLS)

resource "kubernetes_config_map" "gitea_custom_css" {
  metadata {
    name      = "gitea-custom-css"
    namespace = kubernetes_namespace.git.metadata[0].name
  }

  data = {
    "header.tmpl" = <<-TMPL
      <link rel="stylesheet" href="/assets/css/custom.css">
    TMPL


    "custom.css" = <<-CSS
      /* ── Typography & base ── */
      :root {
        --color-primary: #6366f1;
        --color-primary-dark: #4f46e5;
        --color-secondary: #8b5cf6;
        --color-bg: #0f0f17;
        --color-surface: #16161f;
        --color-surface-2: #1e1e2e;
        --color-border: #2a2a3d;
        --color-text: #e2e2f0;
        --color-text-muted: #8888aa;
        --color-green: #22d3a5;
        --radius: 10px;
      }

      body {
        background: var(--color-bg) !important;
        color: var(--color-text) !important;
        font-family: "Inter", -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif !important;
      }

      /* ── Top navbar ── */
      .navbar, #navbar {
        background: var(--color-surface) !important;
        border-bottom: 1px solid var(--color-border) !important;
        box-shadow: 0 1px 12px rgba(0,0,0,0.4) !important;
      }

      .navbar .brand svg, .navbar .brand img { filter: brightness(1.2); }

      /* ── Sidebar & panels ── */
      .repository, .ui.container, .ui.segment,
      .ui.card, .ui.cards > .card {
        background: var(--color-surface) !important;
        border: 1px solid var(--color-border) !important;
        border-radius: var(--radius) !important;
      }

      /* ── Buttons ── */
      .ui.primary.button, .ui.green.button {
        background: var(--color-primary) !important;
        border: none !important;
        border-radius: 8px !important;
      }
      .ui.primary.button:hover { background: var(--color-primary-dark) !important; }

      /* ── Inputs ── */
      input, textarea, select,
      .ui.input > input, .ui.dropdown {
        background: var(--color-surface-2) !important;
        border: 1px solid var(--color-border) !important;
        color: var(--color-text) !important;
        border-radius: 8px !important;
      }

      /* ── Sign-in page ── */
      .user.signin .ui.segment,
      .user.signup .ui.segment {
        background: var(--color-surface) !important;
        border: 1px solid var(--color-border) !important;
        border-radius: 16px !important;
        box-shadow: 0 8px 32px rgba(0,0,0,0.5) !important;
        padding: 2.5rem !important;
      }

      /* ── Repo file tree ── */
      .repository.file.list .file-list {
        background: var(--color-surface) !important;
        border-radius: var(--radius) !important;
        border: 1px solid var(--color-border) !important;
      }

      .repository.file.list .file-list tr:hover td {
        background: var(--color-surface-2) !important;
      }

      /* ── Labels & badges ── */
      .ui.label { border-radius: 6px !important; }

      /* ── Dashboard activity feed ── */
      .feeds .news { border-bottom: 1px solid var(--color-border) !important; }

      /* ── Code blocks ── */
      pre, code {
        background: var(--color-surface-2) !important;
        border: 1px solid var(--color-border) !important;
        border-radius: 6px !important;
      }

      /* ── Muted footer ── */
      #footer {
        background: var(--color-surface) !important;
        border-top: 1px solid var(--color-border) !important;
        color: var(--color-text-muted) !important;
      }
    CSS
  }
}

resource "kubernetes_namespace" "git" {
  metadata {
    name = "git"
    labels = {
      managed-by = "terraform"
      tier       = "infrastructure"
    }
  }
}

resource "kubernetes_persistent_volume_claim" "gitea_data" {
  wait_until_bound = false
  metadata {
    name      = "gitea-data"
    namespace = kubernetes_namespace.git.metadata[0].name
  }
  spec {
    access_modes = ["ReadWriteOnce"]
    resources {
      requests = {
        storage = "20Gi"
      }
    }
  }
}

resource "kubernetes_secret" "gitea_db_secret" {
  metadata {
    name      = "gitea-db"
    namespace = kubernetes_namespace.git.metadata[0].name
  }
  data = {
    password = var.gitea_db_password
  }
}

# Deployment + Service managed by Argo CD — see servers/legion/apps/gitea.yaml

resource "kubernetes_ingress_v1" "gitea" {
  metadata {
    name      = "gitea"
    namespace = kubernetes_namespace.git.metadata[0].name
    annotations = {
      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
    }
  }

  spec {
    tls {
      hosts       = [var.gitea_domain]
      secret_name = "gitea-tls"
    }
    rule {
      host = var.gitea_domain
      http {
        path {
          path      = "/"
          path_type = "Prefix"
          backend {
            service {
              name = "gitea"
              port { number = 3000 }
            }
          }
        }
      }
    }
  }

  depends_on = [helm_release.cert_manager]
}