feat(k8s/gitea): add Gitea with PostgreSQL, backups, and Authelia OIDC

kubernetes/app/archmirror/configmap-sync.yaml

@@ -22,26 +22,13 @@ data:
     fi
 
     mkdir -p "$TARGET_DIR"
-
-    do_rsync() {
-        rsync --timeout=600 \
-              -rltH --no-perms --chmod=D755,F664 --safe-links --delete-delay --delay-updates \
-              -v --info=progress2 \
-              "$@"
-    }
-
     for i in $(seq 1 $MAX_RETRIES); do
         log "Sync attempt $i/$MAX_RETRIES from $MIRROR_URL"
 
-        # Pass 1: sync packages, skip db/files indices so they are never updated
-        # before their referenced package files arrive (avoids 404s).
-        # Pass 2: sync everything including indices now that packages are present.
-        if do_rsync \
-                --exclude='*.db' --exclude='*.db.*' \
-                --exclude='*.files' --exclude='*.files.*' \
-                "$MIRROR_URL/" "$TARGET_DIR/" \
-            && do_rsync \
-                "$MIRROR_URL/" "$TARGET_DIR/"; then
+        if rsync --timeout=600 \
+                 -rlptH --safe-links --delete-delay --delay-updates \
+                 -v --info=progress2 \
+                 "$MIRROR_URL/" "$TARGET_DIR/"; then
             log "Sync completed successfully"
             exit 0
         fi

kubernetes/app/gitea/release.yaml

@@ -94,8 +94,6 @@ spec:
           autoDiscoverUrl: https://auth.${AUTHELIA_DOMAIN}/.well-known/openid-configuration
 
       config:
-        repository:
-          DEFAULT_BRANCH: master
         server:
           DOMAIN: ${GITEA_HOST}
           ROOT_URL: https://${GITEA_HOST}/

kubernetes/app/media/cronjob-backup.yaml

@@ -129,7 +129,7 @@ spec:
                   mountPath: /backup
           containers:
             - name: resticprofile
-              image: creativeprojects/resticprofile:0.33.1
+              image: creativeprojects/resticprofile:0.32.0
               command:
                 - sh
                 - -c

kubernetes/app/media/deployment-qbittorrent.yaml

@@ -29,7 +29,7 @@ spec:
               mountPath: /media
       containers:
         - name: qbittorrent
-          image: lscr.io/linuxserver/qbittorrent:5.2.0
+          image: lscr.io/linuxserver/qbittorrent:5.1.4
           envFrom:
             - configMapRef:
                 name: media-common-env

kubernetes/infrastructure/controllers/renovate/cronjob.yaml

@@ -23,21 +23,14 @@ spec:
               image: renovate/renovate:39
               env:
                 - name: RENOVATE_PLATFORM
-                  value: gitea
-                - name: RENOVATE_ENDPOINT
-                  value: https://gitea.berezovskyi.dev/api/v1
+                  value: github
                 - name: RENOVATE_REPOSITORIES
-                  value: '["oleksandr/homelab"]'
+                  value: '["berezovskyi-oleksandr/homelab"]'
                 - name: RENOVATE_TOKEN
                   valueFrom:
                     secretKeyRef:
                       name: renovate
-                      key: gitea-token
-                - name: RENOVATE_GITHUB_COM_TOKEN
-                  valueFrom:
-                    secretKeyRef:
-                      name: renovate
-                      key: github-com-token
+                      key: github-token
                 - name: LOG_LEVEL
                   value: info
               resources:

kubernetes/infrastructure/controllers/renovate/secret.sops.yaml

@@ -4,8 +4,7 @@ metadata:
     name: renovate
     namespace: renovate
 stringData:
-    gitea-token: ENC[AES256_GCM,data:rgJUYnLvlnha1q5VCU99OGXvAEME3t2RdyAtMVnzTTvVf2ux5nxWMg==,iv:5i+D8kM8P0HKOHkq3TDSkC6xzNz1juZWWGdC/uHcmZI=,tag:YkqTcBvFAozpkgl9sPeWxA==,type:str]
-    github-com-token: ENC[AES256_GCM,data:OGYg/7LKtx2FTsKEUvrMf81VUTc9nRAvZN9YKwCiAwWQhc2IgAUdWQ==,iv:/2d3Kvu45L6a3BXxrClOY5376S3n28Sw1lyZ9QGsEjM=,tag:Wjp2+J53vRbqKmlQAe9Dvg==,type:str]
+    github-token: ENC[AES256_GCM,data:6SjztGjm1T0hNzgj3wpuqa31mdJdZItX0iZUA8l8v/4NhBmxDfMpu2YR8CyikZNcaTMhW4ty/nAYTPIBa8btGClArRV6p+aKrb9E35/LZmy5LIgg5ElZ5gaX+zIY,iv:Jx6Vwn6uaWTPw+fIsYOLJ68WSdZeHfEyq1nNYEidBZo=,tag:KTv6eABellIh9Putw2zSRw==,type:str]
 sops:
     age:
         - recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
@@ -17,7 +16,7 @@ sops:
             WFpEUzFtWkcyZ0ExSno5cTBIaU5ENmsKkGzvTtT0chu+B9XfDI2vRl5FXd46NWoh
             uADvff8Y3s0zwco7d4KiKQ3RNUnCQdThLBw/kJJSLf2012KgcGtwFA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-09T09:04:27Z"
-    mac: ENC[AES256_GCM,data:YENWAnnhT/cGliy1iQ6zVW1FM0TW1nsujstvl5seqO1VwiOXwj/oPkVBxg1E8r8tIV9/af6vY/yo05RkNUuSgB2jYfA/dPYL1knGzfDPPqo2hrDYWKnO3Mpnjpe5u263gIGB4elE/MM61cXLucb7NbW7G6n3vTkbTXxtjakJOOY=,iv:kHpYTrOGVG1lP7KhXrnf/bXKmes+SAIkwLfFxJR/zq0=,tag:lsiER37cfgFcgt1utUGAww==,type:str]
+    lastmodified: "2026-03-19T19:19:10Z"
+    mac: ENC[AES256_GCM,data:obHqpPjipCJXzO+uO6JzaaGyzKaZwsTQx0UcipJmaXHrxveUZSWNkzFlQG11Zebi9owLSZxMigz172EIV2TUiNf03/G39HrajqRDMN/rQXH335ReBLZepzqhQekSJcQ8dT7GONpIYUmfsbm/mG31yg7RYJkmaUPfZyCAnNk1EJ0=,iv:/EDy+trJqPoEuxLgiNJBeoLkP87boxWtGHu7jmo/f8g=,tag:5LkSH5eTviNIS5Q/SU46Iw==,type:str]
     encrypted_regex: ^(data|stringData|email)$
-    version: 3.12.2
+    version: 3.12.1

renovate.json

@@ -3,13 +3,12 @@
   "extends": [
     "config:recommended",
     ":semanticCommits",
-    "local>oleksandr/homelab//kubernetes/app/jellyfin/renovate.json",
-    "local>oleksandr/homelab//kubernetes/app/media/renovate.json",
-    "local>oleksandr/homelab//kubernetes/app/immich/renovate.json"
+    "local>berezovskyi-oleksandr/homelab//kubernetes/app/jellyfin/renovate.json",
+    "local>berezovskyi-oleksandr/homelab//kubernetes/app/media/renovate.json",
+    "local>berezovskyi-oleksandr/homelab//kubernetes/app/immich/renovate.json"
   ],
   "enabledManagers": ["kubernetes", "custom.regex"],
   "automergeType": "branch",
   "ignoreTests": true,
-  "assignees": ["oleksandr"],
-  "gitAuthor": "Renovate Bot <renovate@whitesourcesoftware.com>"
+  "assignees": ["berezovskyi-oleksandr"]
 }