Migrate gitea to the org-badhouseplants ns

2025-03-25 20:39:09 +01:00 · 2025-03-25 20:39:09 +01:00 · e3f77b6bee
commit e3f77b6bee
parent fe5419f2ed
5 changed files with 282 additions and 64 deletions
--- a/installations/applications/helmfile-badhouseplants.yaml
+++ b/installations/applications/helmfile-badhouseplants.yaml
@ -20,6 +20,7 @@ releases:
    chart: gitea/gitea
    version: 11.0.0
    namespace: applications
+    installed: false
    inherit:
      - template: default-env-values
      - template: default-env-secrets
@ -67,23 +68,13 @@ releases:
      - template: env-values
      - template: env-secrets

-  - name: navidrome
-    chart: allangers-charts/navidrome
-    namespace: applications
-    installed: false
-    version: 0.5.0
+  - name: app-gitea
+    chart: gitea/gitea
+    version: 11.0.0
+    namespace: org-badhouseplants
    inherit:
-      - template: default-env-values
-      - template: ext-traefik-middleware
-
-  - name: navidrome-private
-    chart: allangers-charts/navidrome
-    namespace: applications
-    version: 0.5.0
-    installed: false
-    inherit:
-      - template: default-env-values
-      - template: default-env-secrets
+      - template: env-values
+      - template: env-secrets

  - name: server-xray-public
    chart: allangers-charts/server-xray
--- a/values/badhouseplants/org-badhouseplants/app-gitea/secrets.yaml
+++ b/values/badhouseplants/org-badhouseplants/app-gitea/secrets.yaml
@ -0,0 +1,50 @@
+gitea:
+    admin:
+        username: ENC[AES256_GCM,data:U230S8544mg=,iv:yL45Opnqp5T4h7erEv0pRHWtH1th8uu1Y4wfeY2aJcQ=,tag:a4vsJEOxlmHj1mwqcUGbiw==,type:str]
+        password: ENC[AES256_GCM,data:IpwOetFEvxt0/tGkiJ8bBI+OR/E=,iv:8OA48CiWeMyqZVs2lp+UzfyymUNQfdgmAQV33+AVQ+s=,tag:stgAMSnB5dCzFu4zvZeVRA==,type:str]
+    config:
+        storage:
+            MINIO_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:cn3NsFx0TH0fw6mJt6cArMRyQ6Qng3gIPQ==,iv:Jv+rweQzEXfVWuWycjGSi54jRAm0XEEcNxZ6flbUZWM=,tag:6O9KvcnaVEME5lXl6msZLw==,type:str]
+        mailer:
+            PASSWD: ENC[AES256_GCM,data:3UL0uvz49J3GIOo/eVWKYLrDG+u/lvCr8Q==,iv:HBQKF42R3tHFQxkUoRzsiPCUkFM40qpjM0SYrQSxugE=,tag:iua/nXoogjxnkj9T6UB/Sw==,type:str]
+        database:
+            PASSWD: ENC[AES256_GCM,data:DbL7wryYRQAEzujWNL4I0AwEq6Cr2r78FXQOAw==,iv:Oc2IYwD7iy7AlYVnhvSc61ttOf20qJyuuDnx4yF3/YE=,tag:aLa8+r0kYvzFSuF3hvhL2w==,type:str]
+        session:
+            PROVIDER_CONFIG: ENC[AES256_GCM,data:owsHUHdmzGiFgtD3+nRBmHYKcsNQXblbuCO8V0tLAAMvJBRHSA5YG1TL3Quy2186yoZCPiAdeQwg/o2Iutk2Mlc6/NmeurZbxomV8dWBuqJfn6t44xnDgFnEXpxE5kB5lNCtcjKXmpxC4fkoUVscOyZFmKp9uTgH,iv:evmTZH5NzMB3nhqLhuBmTTF4ztJX9a/ZMTOmYMqSaxs=,tag:dLnk9xt+moGoBhx7tqazig==,type:str]
+        cache:
+            HOST: ENC[AES256_GCM,data:feiTcBqztm76LZgNShj0Go0IRNgG9UwCQP9KrdexosP2XCnSe+giyKoIcADiHQFYVbnnkpw7/UqNxgM0Tx+EQ9eyFKY+PaFyCSFmQwikmAWakDJ+hQNM1VaNaDKdeLiGIeI7nO2MH9hGDMzPWtUgMNBxc9tTS38l,iv:Rcr+uiZMWbG9IPeMm+eiNf3W3yz2L7yqSkJSKUhWHtk=,tag:3cLuUAEU6CZvvUYKF1cCAQ==,type:str]
+        queue:
+            CONN_STR: ENC[AES256_GCM,data:Mw7W72M3HitiAEG1ihWctXyYqHJuSiKBZvQDDRjA4O9Yg9Zsbq+/HVcnh074zbiTjCO/496FLiy88HuAw8lksZ7MXXVvRI7rIcFKFZLpHcjAqkBnB301SGalK/R4bSisECsYIFPjKuh+s4PIuPEIgFtZuiEvYdbT,iv:uYwjzUObav2Hs/JgRIYbGBFNcZm++qS2QqKpz6Ma6EA=,tag:0okDz0yzL4eSat/0roYJ2A==,type:str]
+    oauth:
+        - name: ENC[AES256_GCM,data:sN+DzBKd,iv:0HNSbQEDLsV76DIRHdWnPs9SI/bHRZz6Fw+8B8Hhuns=,tag:mwTWy9VSXapPu3uLk7LgSQ==,type:str]
+          provider: ENC[AES256_GCM,data:m74moJ8h,iv:QfE5F3vpIlEzIftHlX/qpNvsnAab8gTd4CHyECHNcmQ=,tag:JefFm9mfYJSKzBDOb/l6BA==,type:str]
+          key: ENC[AES256_GCM,data:7ScP3oXE0zTnaqL3AigHby39fMk=,iv:sXllPawkQ5BcKmC1iBUJ2WOEPK2lm6W3q+GrprHZhAc=,tag:vSCB9w5x6jjPNu5b5ZEMzw==,type:str]
+          secret: ENC[AES256_GCM,data:XG9D5IUX4MqJzKf+aB7MCeDJAQlIzMxSv3ByAZQAdZCI+5my+cMfeg==,iv:s3e0wFznoX55MeEQj+dK0QrzzatGzDBKfT4xDD00cOA=,tag:vk32YQcPs0kAIOj61YwHww==,type:str]
+        - name: ENC[AES256_GCM,data:eBSL9xrBDN50,iv:TiC3jjpfwS6A9x6PAkMIorwJ9CecxblzEFt5+ZmSW6I=,tag:XA6UrnJbkUyDBgOY9xfIPw==,type:str]
+          provider: ENC[AES256_GCM,data:yh4TBYDI2R0a4f1qSg==,iv:hx8pAuo//U+YY5a2cq/KyoK4qcKbSXWtkrDvACWLU2c=,tag:uJ9JNWdDjb0eTS0ZJXHDaw==,type:str]
+          skip_local_2fa: ENC[AES256_GCM,data:8YwpOw==,iv:2R3Zc4HK/U31SVcXR3xi9J/kJySR3osA8xN3YhvRxBk=,tag:SzBFOwEmczW59SHLGCMb5Q==,type:str]
+          key: ENC[AES256_GCM,data:rLR8ve4=,iv:qOVIBiFjsOrrRg/mca5l7SHc2GdVAdyz0TV3Q7lJlQg=,tag:tYEzx7SoeoAC9/lgWU91uA==,type:str]
+          secret: ENC[AES256_GCM,data:r7sWVeqWTnqbt7ArzpADD5A1fYU6+KSpLohWJuSbEUyPAzOSxfZGxSYNfAwaxACOgmJJnxUeQ9l71nyUDWzGMrFkLr+o+WcQmSTPV3+3iMHDsTdgjEb+tIZFdi0Z5PJ8DCBxjckmbG5cx3O3Kyrjc24SNHCVb62lhduZH1fIlT0=,iv:kvtMCpiOUx10zTKt/ZYQh3leYaY9+v169Sq+sYIScHQ=,tag:t8txjt3xuVKWA7QgBJYuiw==,type:str]
+          autoDiscoverUrl: ENC[AES256_GCM,data:SG2ev/BshOBP0NQnpZRQErZDAEWdReiwp2pb2JJBWZmFvC67//t8WZu1/wilfQjJvJdsDGwk9Rwncoxya5Fb9uKYDAQKzqULJk70Er9pyNaowFbMxiMm+ws=,iv:B9GM9MLIrKTtRfyDxltlFvvm01aRCTQnyiemH4qzjGs=,tag:Wqji+fKliEGJRZ4inTmbXw==,type:str]
+          iconUrl: ENC[AES256_GCM,data:lcW3npgyrc50GIYCyTh5Gpht2CU6hX67j13XNOvGQybU2dsA9BtqpmH0OMQz4b1g/XkuHAp5j3I0wLnGvhXXf4mEugzt8g==,iv:X/kHS77OJLDuNN2lTAWLqPARJ1QZMY1ImuS+xmkUlgM=,tag:0ZRh7eH6dYdZd250Lb/+xA==,type:str]
+          scopes: ENC[AES256_GCM,data:GtTGDrDZwU1r5vEsxg==,iv:/7yMuJpxlML3R1X8onDSFbJVwpYFtnLamaI+X148Tlk=,tag:e8HkvzdpkhDvedVzm7jG3w==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6d2JneUUzM1VkM1lvclA3
+            aC9wMGpKSGU5ZnVaUTNlVDNsMlNaOVRNYVdzCkpzVUJzNHN2TmhHektzOC93Vjlj
+            SVU3cUxVUm4wWjJQRWZRdWlRMEU1eUEKLS0tIHRLOEJERXBMd0NFajNjbHhPVVNl
+            b1cyT0RYa3hzbFJjc254bHJMcDIzeTgK/aX6f60NBz6w1TaOFSZDRE7rPniebb75
+            iwO74fJtl5g9WxAG5yByxJ455Uhc2R/+VBbK5BcYFt9cboIgkUrS2A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-03-25T19:15:08Z"
+    mac: ENC[AES256_GCM,data:ySAOo8j+p9O0v8xYFcjuD6e/pc9LtLxLWC4TdP7mjhdfwwaaoJW96DLEbSYxYN7Co8zHFqdMp5e76SgvhWwP2LNmHLunJ3LNU6u6NSMEFLCSyjAM8KiqB4bTNq7Kf9H2FZbAN58YKXpZEFECJpxoLg2Q9MdRp+BvgURDa2QLZRc=,iv:Ay5vMdrKbNpFyir/N4+mPuOwKwIVupZbeJFKA+DWFDA=,tag:+YUSXQYMfu59oF+hjg0XMg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4
--- a/values/badhouseplants/org-badhouseplants/app-gitea/values.yaml
+++ b/values/badhouseplants/org-badhouseplants/app-gitea/values.yaml
@ -0,0 +1,176 @@
+# ------------------------------------------
+# -- Kubernetes related values
+# ------------------------------------------
+ingress:
+  enabled: true
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    kubernetes.io/tls-acme: "true"
+    kubernetes.io/ingress.allow-http: "false"
+    kubernetes.io/ingress.global-static-ip-name: ""
+    cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    external-dns.alpha.kubernetes.io/ingress-hostname-source: defined-hosts-only
+  hosts:
+    - host: gitea.badhouseplants.net
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: gitea.badhouseplants.net
+      hosts:
+        - gitea.badhouseplants.net
+replicaCount: 1
+clusterDomain: cluster.local
+resources:
+  limits:
+    memory: 1024Mi
+    cpu: 1
+  requests:
+    cpu: 1
+    memory: 1024Mi
+persistence:
+  enabled: true
+  size: 15Gi
+  accessModes:
+    - ReadWriteOnce
+# ------------------------------------------
+# -- Main Gitea settings
+# ------------------------------------------
+gitea:
+  metrics:
+    enabled: true
+    serviceMonitor:
+      # -- TODO(@allanger): Enable it once prometheus is configured
+      enabled: false
+  config:
+    database:
+      DB_TYPE: postgres
+      HOST: postgres17-postgresql.databases.svc.cluster.local
+      NAME: org-badhouseplants-app-gitea
+      USER: org-badhouseplants-app-gitea
+    APP_NAME: Bad Houseplants Gitea
+    ui:
+      meta:
+        AUTHOR: Bad Houseplants
+        DESCRIPTION: '...by allanger'
+    repository:
+      DEFAULT_BRANCH: main
+      MAX_CREATION_LIMIT: 0
+      DISABLED_REPO_UNITS: repo.wiki
+    service:
+      DISABLE_REGISTRATION: false
+    server:
+      DOMAIN: gitea.badhouseplants.net
+      ROOT_URL: https://gitea.badhouseplants.net
+      LFS_START_SERVER: true
+      LANDING_PAGE: explore
+      START_SSH_SERVER: true
+    storage:
+      STORAGE_TYPE: minio
+      MINIO_ENDPOINT: "s3.badhouseplants.net:443"
+      MINIO_ACCESS_KEY_ID: gitea
+      MINIO_BUCKET: gitea
+      MINIO_LOCATION: us-east-1
+      MINIO_USE_SSL: true
+    admin:
+      DISABLE_REGULAR_ORG_CREATION: true
+    packages:
+      ENABLED: true
+    cron:
+      enabled: true
+    attachment:
+      MAX_SIZE: 100
+    actions:
+      ENABLED: true
+    oauth2_client:
+      REGISTER_EMAIL_CONFIRM: false
+      ENABLE_AUTO_REGISTRATION: true
+    session:
+      PROVIDER: redis
+    cache:
+      ENABLED: true
+      ADAPTER: redis
+    queue:
+      TYPE: redis
+    mailer:
+      ENABLED: true
+      FROM: bot@badhouseplants.net
+      PROTOCOL: smtp+startls
+      SMTP_ADDR: stalwart.badhouseplants.net
+      SMTP_PORT: 587
+      USER: bot
+    indexer:
+      REPO_INDEXER_ENABLED: true
+      REPO_INDEXER_PATH: indexers/repos.bleve
+      MAX_FILE_SIZE: 1048576
+      REPO_INDEXER_EXCLUDE: resources/bin/**
+    picture:
+      ENABLE_FEDERATED_AVATAR: false
+service:
+  ssh:
+    type: ClusterIP
+    port: 22
+    clusterIP:
+extraDeploy:
+  - |-
+    apiVersion: kinda.rocks/v1beta1
+    kind: Database
+    metadata:
+      generation: 1
+      labels:
+        app.kubernetes.io/managed-by: Helm
+      name: {{ include "gitea.fullname" $ }}
+    spec:
+      backup:
+        cron: 0 0 * * *
+        enable: false
+      credentials:
+        templates:
+        - name: CONNECTION_STRING
+          secret: true
+          template: {{` '{{ .Protocol }}://{{ .Username }}:{{ .Password }}@{{ .Hostname }}:{{.Port }}/{{ .Database }}' `}}
+      deletionProtected: true
+      instance: postgres17
+      postgres: {}
+      secretName: {{ include "gitea.fullname" $ }}-db-creds
+  - |-
+    apiVersion: traefik.io/v1alpha1
+    kind: IngressRouteTCP
+    metadata:
+      name: {{ include "gitea.fullname" $ }}-ssh
+    spec:
+      entryPoints:
+      - ssh
+      routes:
+      - match: HostSNI(`*`)
+        services:
+        - name: {{ include "gitea.fullname" $ }}-ssh
+          nativeLB: true
+          port: 22
+
+# ------------------------------------------
+# -- Disabled dependencies
+# ------------------------------------------
+postgresql-ha:
+  enabled: false
+redis-cluster:
+  enabled: false
+
+# extraDeploy:
+#   - |
+#       {{- if $.Capabilities.APIVersions.Has "traefik.io/v1alpha1/IngressRouteTCP" }}
+#       apiVersion: traefik.io/v1alpha1
+#       kind: IngressRouteTCP
+#       metadata:
+#         name: {{ include "gitea.fullname" . }}-ssh
+#       spec:
+#         entryPoints:
+#           - ssh
+#         routes:
+#           - match: HostSNI('*')
+#             services:
+#               - name: "{{ include "gitea.fullname" . }}-ssh"
+#                 port: 22
+#                 nativeLB: true
+#       {{- end }}
--- a/values/badhouseplants/secrets.gitea.yaml
+++ b/values/badhouseplants/secrets.gitea.yaml
@ -1,50 +1,50 @@
 gitea:
-  admin:
-    username: ENC[AES256_GCM,data:1yKnMnzbHno=,iv:AWqprQPRloJhZEtyhF8+5dgxyHXtK+2HLxHa+gU+Aw0=,tag:Irk65xjOWgFBfPUJGVcQcg==,type:str]
-    password: ENC[AES256_GCM,data:8hbWwHlNyxzNe6PCYJ2w5b8oUi0=,iv:GtkHDZFUzk9rVh7ASmk+Qb/litPD5QX38hWLR24pgSU=,tag:bmdNTBDt2Mrxp1cVXmJwcQ==,type:str]
-  config:
-    storage:
-      MINIO_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:tLHwP5ZsoxKnaG38hNNXvXoy4PTuxlUT3w==,iv:bR0eL0MHOdT3CnsQrjdlEfwCEye41/ts/vsQf3ju1cU=,tag:XxpkrS88muDolMcB0r9rWg==,type:str]
-    mailer:
-      PASSWD: ENC[AES256_GCM,data:tw+vJSoedon/a3VhXkcpupumdbBnyMbSzQ==,iv:xoxIm855BhNsNfq+5L33yIDFKx8igNuEV71IDt0WNzQ=,tag:i9FJe0x4PqaMb/SBN0yXCg==,type:str]
-    database:
-      PASSWD: ENC[AES256_GCM,data:pB7YPucwcXwD9fzJsckZshz7ZLM=,iv:23k90tX465WltrQwSyx8Hixe2hnya/dx6aIvr3ti1wA=,tag:NvgN1g181yCBu5Mf7uYmGQ==,type:str]
-    session:
-      PROVIDER_CONFIG: ENC[AES256_GCM,data:Ipcta9fyfGCygYqpisgiy0rCckP5Ma5bNs2ClFNn0lnm1LQOJDdDLiQDr5u9L/WG6Bs2WhHbeSrdjxyZdCKv9pd1CfmB7S9eNcp2w+4hhofwUVcKW89rj9HYEHSLuY8C4Y5KbJKKl6PkY/JmTzyVSpSMDHYadf3j,iv:YsMR3zwZODENuy+WvKy8AdByKTuI7ng0hf1AJT+CMQk=,tag:9hOo08OLybdNgr7wvRPvyw==,type:str]
-    cache:
-      HOST: ENC[AES256_GCM,data:K0FpmrMo1TlUnHHHRKcKVQ8NYeOr+YEeQjajEIM1x5XPjkxYUmywyVL8f5qNLkvotAtD941Rw9CQ7NRof0NketkYyC8gJsndfznGPjhfqH5a0MUWDu9tAfGUzWGzXxC0uq4Ne1eRhu4SjZljZybqk5qQR00Zc/qX,iv:izMvr/kdes3+Gl1a6URnWyQ5TwYqTDMOBskHxPZZpgo=,tag:MWdLA5PV/+bEPWgXHw9OQA==,type:str]
-    queue:
-      CONN_STR: ENC[AES256_GCM,data:MsKkRcKpCGmvcL2lP5N+WuCNGp68gPw5HCpvCjEbYPoJcl5j6mAV5bBGqmiaIpvRbBu1EL1riHMmFD55efSJ6XueOXPG997iwE7KISdPjAWA92ZFe/zFzSW5EfBz3BvgsxzkMk3gR2usid0BvKXLPztLSvAYOR1l,iv:S4BunQMCS33JZUL8x4dRSbMtKQoI0f3Iw9IQ663hqfw=,tag:G7Xpp4d0VKzHRb0ju+F+WA==,type:str]
-  oauth:
-    - name: ENC[AES256_GCM,data:ruqXMi7A,iv:hzOf08m5WO/0ZLrsDdco2RuWquiR9n5hwZqcug7Gx1E=,tag:hwumITH28nq0z5i4Z4FvcQ==,type:str]
-      provider: ENC[AES256_GCM,data:Sx2HqTQ/,iv:DDhq7jVZdgD5MAFFeSt6KdsC0FSrpQWA+gu9gOg6Iwo=,tag:kOnrbDlwGLMrgKsF8hTGdA==,type:str]
-      key: ENC[AES256_GCM,data:itycutnIMsO2lb8M5UysL72Iq9k=,iv:E1b1zBGfew3bf72OxLoKQoosgPDqy8my1JMWvwBGpcE=,tag:iJGrMKbrqTD5NHYWvFxqxQ==,type:str]
-      secret: ENC[AES256_GCM,data:mOpFm2yKl1aBu3TcJkO/Gm69XQh36le4ohsueq9t58cIHDucrksBmA==,iv:zW3zde+XcD3wmJcOKZ0lrPCBA2OPHoF+8/T+6PJpP5w=,tag:27ssfjvp2oX9yglNJLalFQ==,type:str]
-    - name: ENC[AES256_GCM,data:8LPw6LKoUcMf,iv:/jNSUD9jcGxghxexh5063Le+t+xAbirHlc/1oG3JCq0=,tag:OA1LpeMNRi+Pkhr4cdseAw==,type:str]
-      provider: ENC[AES256_GCM,data:aqLm3vOS5b+cDBjnaA==,iv:/3teGaszsJEo9ya1Uy51xAxPC4zyMO08qm1Ag6sFb2A=,tag:iByKJjRGQcEiT8Zoe4cRnA==,type:str]
-      skip_local_2fa: ENC[AES256_GCM,data:YZMe+A==,iv:VE8i+fA/xbv4Ii6vDjsclbuzHp9lva+jOBIYE0vsKNA=,tag:OXAZnoa/zISVBmhaojVB+w==,type:str]
-      key: ENC[AES256_GCM,data:6mbjR2k=,iv:8zRBVFyF7XyTA96yfaWX8NtOC2f2abbyv7qUzizB+dc=,tag:BeBR+bijZFHepscsXJkoNw==,type:str]
-      secret: ENC[AES256_GCM,data:vM4LI6MFwF9co+qCzZwl+q7pKDtIiMj7jMwckleijtVOgnfafrMTKZsA4LbeKICm1p3kuj1qmdRzDgyCzGyCejwMwsd8Yze4gMKZb6wfnhOhaj11Yby40+xHHb8ogCzPfAH7TkOi+99Y2yMpfiw2i5UZvQK1oTjZLzMfJ0fK15k=,iv:F01nIJjOiZCueOaIa1p//ND4XA1wvNow9Crq73nHUVQ=,tag:KifiHsOa49Iah4SW28YMVA==,type:str]
-      autoDiscoverUrl: ENC[AES256_GCM,data:k1O5weiok0ybMfEwDfEaXu76AvUmgRHz3vGy5bShvdGxf/SQZVJJv0XntF9ifbfhYRKzJCt1BpVGkXQnHhMWntkolLUsv/r6OKZPjpwOtEozhI95fcjax1Y=,iv:2LFUB07dWs2tcCSibhoiJ8w3NoPMrpfEhAqb28TbdxY=,tag:iJtqPNf8nsjMVzF2Du+DVw==,type:str]
-      iconUrl: ENC[AES256_GCM,data:Jr8Ej4zfe319HX4ruXrDSB5ZuuEfbuvEeIVHt13E7xx3NvPF9qrOZip40hmAR7dc1nW5m6aX6GxP5gbonr90wZRCf8HA9A==,iv:ykfp9vlCZnjR+7H9NTokW8AOr0EHEq6vkwWDSMYiU5Q=,tag:MbX/8yRj6XwBgU+MbylAKg==,type:str]
-      scopes: ENC[AES256_GCM,data:Lr+kdYTfCVQE25ZGeA==,iv:O6OYdDg/PGj0p2A9vjxPaDBRtUctS1j4TO/5V1gSQ88=,tag:tlDUKeGRIL3Rqep/mpdRZQ==,type:str]
+    admin:
+        username: ENC[AES256_GCM,data:XdPhs58Q9gw=,iv:OC1PBo59fDJoGapR5ddOJ3aP//lIp2O+IUFxZ7p8Y2U=,tag:xubvAEW/Fn+oyhxvsUfU+A==,type:str]
+        password: ENC[AES256_GCM,data:FLIa8F0y596vVOM6ih9sHl9r4VM=,iv:lXzCTCA0g2hjia4NSfrUhfXL6Pr7UkSQRcXxbnWg1do=,tag:a1iRT01JWuEH0B9N5U3DuQ==,type:str]
+    config:
+        storage:
+            MINIO_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:PF4yojmx0lgNT2dKVyCXwY5HTScbiIN5Zg==,iv:6LQ7S5DHmk9yo4GkhvWt7uDkGrCfPdI7K/VuGtWmX+w=,tag:YiFcVaAwSw7ymw430IAjgQ==,type:str]
+        mailer:
+            PASSWD: ENC[AES256_GCM,data:3IHYRUj0jgojliVqfZAHXHnL0jqX4zz/gQ==,iv:jnJhJVQKDdpf/2zkJBOh+J5KPfQ8HMNqcdegzw4wsos=,tag:iV4FCaR7yv4/2o30Bk0mOg==,type:str]
+        database:
+            PASSWD: ENC[AES256_GCM,data:hRcButljKxyK2kpkHEOOVVcc+/o=,iv:2gXfHlveKVZJivb+x52Ntqx2io679rSTOddb+N0lSFc=,tag:QAV1d/NhYpdcueyEO8/Zmg==,type:str]
+        session:
+            PROVIDER_CONFIG: ENC[AES256_GCM,data:UFPgJIBlAiiWvE+kxb3zSqkqLONQoWbgyiORYnQUPhH/CICGmI/zuxxlkSKTHk3EPhV0Zd3zaG1chI8jpYX1d0y8pBdHg9IncsolGncj4P4jgiS0p7yup1e0yWHBmbyCwEErFr7h//TDC1zojcdoCuViZSMEfg89,iv:gSiTMscOca0mIC7JJx4SQIaMFvoTZkHHJUynHubgr7w=,tag:JFTdwuqtkvBiHLMXC0PsBA==,type:str]
+        cache:
+            HOST: ENC[AES256_GCM,data:JVIJ/OUU+mxzHVdHhtiOgs4kq5xkpdy8xSedpVjw+L7PkhPjVtGyQ6KNhM04Yqe2CbdLJJQWks2gcYnVp3l7Lmf1OXND5IOhfzzuO2tcZkClqww4KSEGuOoUz2nb3U3TEt5sFQtsPMruEnEqD+qhtz5P+TQrSsxX,iv:6ACIES1T71UH9nW5bCnvL2V8kVr+rxPs3uy/7fh0g94=,tag:bjJVglzPvDAeEdZ5lafU9g==,type:str]
+        queue:
+            CONN_STR: ENC[AES256_GCM,data:a3Ye/OgqUxGhysskzfSwP2IVCpt1oMegema+oW0s6OaD5POXho+vTUiutEV33ruk07PtBi6zYnukoAXVlT5l2xVfvWLKebDT56Jc0K+k0fmzO5R0tcvyg6c3DaoEdfcs7ih4OXGfgD8bCmMCGHUtYZnHYqACMLUQ,iv:1xryG/UYu7zm3zhx/bvtYf23E8xNDHmi8Us0FCKgZg8=,tag:FwLJvK+uWQvmIYmmp4IjQQ==,type:str]
+    oauth:
+        - name: ENC[AES256_GCM,data:1HbV3MFK,iv:87vcJ57cwyfXIvfTG5lbn8NXl2OxwzXTwJuja8N8ozs=,tag:CTsu4f+GE3d8H4Mu+G1ZvA==,type:str]
+          provider: ENC[AES256_GCM,data:bB0yq9oJ,iv:icFjcFRPU6yLoToqz+L2dsC61tClM3y9RuWt1ORjAio=,tag:gCiMVVT1gA6UfyrMkYrPMw==,type:str]
+          key: ENC[AES256_GCM,data:Yr9hJMRpeFa8CvbELFy7PhS5E7A=,iv:lwRygPesEp50MWM04RpRP7ARIiuoLXlIfxjx6R7X5y4=,tag:Zl7mivC9/BvyUCl/UGqw6g==,type:str]
+          secret: ENC[AES256_GCM,data:hShUsbiZjHcYkPHx3YG0UekTM+HsrmT30R0Qa0/6WWIXjn0PoZqBWQ==,iv:CfbPvj+H0VpmhRPoPsHus1eUmPC06u313PqJ/cO7QtM=,tag:5EhZbN6ylXhmCjWaHIq70A==,type:str]
+        - name: ENC[AES256_GCM,data:dkrcYEhE/0qh,iv:rmRZLqFJ6IJ2D4cXhe0VfKE/Fn33aJ+0JzccT23Uayc=,tag:vF82viM5iPIuXVkVDofcGg==,type:str]
+          provider: ENC[AES256_GCM,data:z4By7Eq1cS1z4f3l9g==,iv:WBAvO3PutqxzhSrkFVPVTexf1FhTLYA3ej55uis/7sQ=,tag:oo2Mxh2h66Fny2r3tY2rdQ==,type:str]
+          skip_local_2fa: ENC[AES256_GCM,data:K0Zwsw==,iv:h9u4eCWadGKzXQzdCGLhmVQUub77YbVCujYEVGUIa90=,tag:oFOxu6VQnOOorB77MlmnkQ==,type:str]
+          key: ENC[AES256_GCM,data:kV0u7XE=,iv:KUOrvGVCB9R2OaPPy1N2fMNXneuSdnyl3a+JHlxN7Cw=,tag:XH/v7NFfkjGIkffICmHVhQ==,type:str]
+          secret: ENC[AES256_GCM,data:mOfvg3DO+/hjsvyzugeEfQejYPA2Yy89dlMvgrzMBeeTKkx8btB9wpMzKiSCMr3tAyIyqrxpdhJ0OxCMhH8gQJcC/FeE8SkYtRW3/gGqgodDjDyWAFOMufnvlsxM8z9zKEroH85GU+RLvzXp3Ylj3GMb1mooNutz6NDle1OHFTM=,iv:fUrf8JHUS+44mp+mtpw0jpZrNA+8YmsTU5NgmWOBT7g=,tag:1S2gNFUf0VheDta7pNgnzA==,type:str]
+          autoDiscoverUrl: ENC[AES256_GCM,data:XhZD57N1lMKvWUJtE1mMAw8TiECqGKHc6V7a4GjlG9hI51AeVPMeUtn5NhPj15ChjazDRWooZUQIYwNhaOMMtZ0OB+vW2eELo84y+islxPtzTm3gPdX2wtw=,iv:PTcNXkBCqh2F2fAzvxKZt++Yi3lnwetNWrfSgrrpeNE=,tag:OBRmdS+/rGViObEZozl2bg==,type:str]
+          iconUrl: ENC[AES256_GCM,data:VKrfFl5XZTPHGX+05Byw+h8tEb25NWoHSnws5dylc8XMlARq30LIFPMftuCAJ9Ig3oLqH5LIyDH59Bcy/pEBw3osw8jaow==,iv:iZGR4UvZv+YrjURsax7SDXx4HwtDXbn+G6oUVRWV9xA=,tag:x2mxauopN+vjuUjkZyAjBw==,type:str]
+          scopes: ENC[AES256_GCM,data:3TejcQxM0K60YVGJwA==,iv:R/E0Xfe9nI343TyOO/1FycvFXg6sP4j2DZrb05SuK8o=,tag:TAkoBe7LSRfdRz3UIlvZzQ==,type:str]
 sops:
-  kms: []
-  gcp_kms: []
-  azure_kv: []
-  hc_vault: []
-  age:
-    - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-      enc: |
-        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2V1RNMmlZaDJDMzBXekF1
-        YmdlYjNBTEhaYU5YYTZ6U1pHckl5YVZ4WVV3Cml5RzkyeHVCV3FlbEpoanlZOWk4
-        RlVoL1VISDEzODRaYUs0N3JldXE4Q28KLS0tIDdqK3IxcHpQdWJoNHR4VCt4MVNm
-        M25EVzZsS21OajdEKytoc2VBYm5SMU0K1wvfQOqBbAPyh1SxiONFSFO+a591HG/2
-        DJvP643yXIWBOiNTxjbQDygYmxwk9GbFmGlVf0pQoUEuH9D4SgCwJA==
-        -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2024-10-14T08:08:22Z"
-  mac: ENC[AES256_GCM,data:Mel9AWdHERKt5xsDI7KmgINBCMAsfYrs/jgwQol+UVuiFXU73tAFeUqOZRDFwuzKBfxQExv8etBlgV8Q6Pdg0VojBLLz75BYZdqz5RD1VnllJ7y5/jCwCTyTbWxYQZpgj8dle0KA2NxoMraLIQY+gnvunqlAcIJgPZG9KY1UB3w=,iv:Nozpe5X8kwSrb2sturuCQBA8XhEQSI5nLRzBuCDFfz0=,tag:8kVcjwLDNTBmvDRPj2ELyQ==,type:str]
-  pgp: []
-  unencrypted_suffix: _unencrypted
-  version: 3.9.1
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2Y01NOU5WWnZ6S1VaTm5G
+            KzhBSGhSQXZCbWEzckhIN2dEUUFISUN4NWpjCnBMMDhaS3Z3NTB6ZVJoak9nWTgv
+            WmhqSlh0Nmlna3NoMlQ3VjdZQ21IczAKLS0tIG5JVVJ1dmloYXVxZWhrVGFKMFcx
+            MXI3NnozVURjTzEwTk1vNjBZRDlmbkEKsBHUyaVMtl8lxKo6tRP2++WRf0RnwW6Z
+            EFhh4sywF/w2W7lSz1PAGUItp7YI55L6v6F3z4hsJjqSpxL/1F17QA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-03-25T18:38:21Z"
+    mac: ENC[AES256_GCM,data:iogjVYVKmj11IELxm7fAhUGpbp7upBAXQMu3bgWTL7LVe+624Nb//1sDAMUQAHsQEVq5R98gBsPZc5STVGvbxNrAQaElivhtxGCyHi9B1imFGmfHzaqu9j2VUC5IdF18gyizPHdJt+SLUfhg//3dsO3Emv/GfunzzXLDGkRQC60=,iv:bxgPg4HioG31P/0IhBPyZCkVkXeaTXoA4N5josDrWrE=,tag:xkQcIKszrG5iBNHyJdkP0g==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4
--- a/values/badhouseplants/values.gitea.yaml
+++ b/values/badhouseplants/values.gitea.yaml
@ -128,6 +128,7 @@ service:
    type: ClusterIP
    port: 22
    clusterIP:
+
 # ------------------------------------------
 # -- Disabled dependencies
 # ------------------------------------------