fix(k8s/gitea): patch act_runner storageClassName around chart 0.1.0 bug

README.md

@@ -26,7 +26,6 @@ homelab-v2/
     │   └── configs/        # ClusterIssuer, MetalLB config
     ├── app/
     │   ├── archmirror/
-    │   ├── blog/
     │   ├── external/       # External service vars (e.g. Home Assistant)
     │   ├── firefly/
     │   ├── gitea/
@@ -59,7 +58,6 @@ homelab-v2/
 | **Homepage** | Dashboard aggregator |
 | **Podsync** | Podcast downloader |
 | **Archmirror** | Local Arch Linux package repository mirror |
-| **Blog** | Personal static blog served via git-sync + nginx (gh-pages branch) |
 
 ## Infrastructure Stack
 

kubernetes/app/blog/configmap-nginx.yaml

@@ -1,28 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blog-nginx-config
-  namespace: blog
-data:
-  default.conf: |
-    server {
-        listen 8080;
-        server_name _;
-        root /git/current;
-        index index.html;
-
-        location /health {
-            access_log off;
-            return 200 "OK";
-            add_header Content-Type text/plain;
-        }
-
-        location ~ /\.git {
-            deny all;
-            return 404;
-        }
-
-        location / {
-            try_files $uri $uri/ =404;
-        }
-    }

kubernetes/app/blog/deployment.yaml

@@ -1,149 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: blog
-  namespace: blog
-  labels:
-    app: blog
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: blog
-  template:
-    metadata:
-      labels:
-        app: blog
-    spec:
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-        # git-sync (uid 65533) writes files; fsGroup makes the emptyDir group-writable by that uid
-        fsGroup: 65533
-      initContainers:
-        - name: git-sync-init
-          image: registry.k8s.io/git-sync/git-sync:v4.5.1
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: GITSYNC_REPO
-              valueFrom:
-                secretKeyRef:
-                  name: blog-git-credentials
-                  key: GITSYNC_REPO
-            - name: GITSYNC_ROOT
-              value: "/git"
-            - name: GITSYNC_REF
-              value: "gh-pages"
-            - name: GITSYNC_LINK
-              value: "current"
-            - name: GITSYNC_DEPTH
-              value: "1"
-            - name: GITSYNC_ONE_TIME
-              value: "true"
-            - name: GITSYNC_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: blog-git-credentials
-                  key: GITSYNC_USERNAME
-            - name: GITSYNC_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: blog-git-credentials
-                  key: GITSYNC_PASSWORD
-          securityContext:
-            runAsUser: 65533
-            runAsGroup: 65533
-          volumeMounts:
-            - name: git-content
-              mountPath: /git
-          resources:
-            requests:
-              cpu: 10m
-              memory: 64Mi
-            limits:
-              memory: 128Mi
-      containers:
-        - name: nginx
-          image: nginxinc/nginx-unprivileged:1.30.0-alpine3.23
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 8080
-              name: http
-              protocol: TCP
-          securityContext:
-            runAsUser: 101
-            runAsGroup: 101
-          volumeMounts:
-            - name: git-content
-              mountPath: /git
-            - name: nginx-config
-              mountPath: /etc/nginx/conf.d/default.conf
-              subPath: default.conf
-          livenessProbe:
-            httpGet:
-              port: 8080
-              path: /health
-            initialDelaySeconds: 10
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              port: 8080
-              path: /health
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-            limits:
-              memory: 64Mi
-        - name: git-sync
-          image: registry.k8s.io/git-sync/git-sync:v4.5.1
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: GITSYNC_REPO
-              valueFrom:
-                secretKeyRef:
-                  name: blog-git-credentials
-                  key: GITSYNC_REPO
-            - name: GITSYNC_ROOT
-              value: "/git"
-            - name: GITSYNC_REF
-              value: "gh-pages"
-            - name: GITSYNC_LINK
-              value: "current"
-            - name: GITSYNC_DEPTH
-              value: "1"
-            - name: GITSYNC_PERIOD
-              value: "30s"
-            - name: GITSYNC_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: blog-git-credentials
-                  key: GITSYNC_USERNAME
-            - name: GITSYNC_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: blog-git-credentials
-                  key: GITSYNC_PASSWORD
-          securityContext:
-            runAsUser: 65533
-            runAsGroup: 65533
-          volumeMounts:
-            - name: git-content
-              mountPath: /git
-          resources:
-            requests:
-              cpu: 5m
-              memory: 32Mi
-            limits:
-              memory: 64Mi
-      volumes:
-        - name: git-content
-          emptyDir: {}
-        - name: nginx-config
-          configMap:
-            name: blog-nginx-config

kubernetes/app/blog/ingress.yaml

@@ -1,23 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: blog
-  namespace: blog
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-spec:
-  tls:
-    - hosts:
-        - ${BLOG_HOST}
-      secretName: blog-tls
-  rules:
-    - host: ${BLOG_HOST}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: blog
-                port:
-                  number: 8080

kubernetes/app/blog/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: blog

kubernetes/app/blog/networkpolicy.yaml

@@ -1,26 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: default-deny-ingress
-  namespace: blog
-spec:
-  podSelector: {}
-  policyTypes:
-    - Ingress
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-ingress-controller
-  namespace: blog
-spec:
-  podSelector:
-    matchLabels:
-      app: blog
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik

kubernetes/app/blog/secret.sops.yaml

@@ -1,24 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: blog-git-credentials
-    namespace: blog
-stringData:
-    GITSYNC_USERNAME: ENC[AES256_GCM,data:6cZnsgZ53xsU,iv:j2qvZr+odimHPnlMKz9xTe8q+zXvyRDF9spH8TkcmBw=,tag:ik6DJ4cMfcNc5UHY5vRy3A==,type:str]
-    GITSYNC_PASSWORD: ENC[AES256_GCM,data:mjQJuOuH2YQ1i1JVO+lFZ7WYLmy4RjCi2xZRErU5hRNi2SdgRo0fwg==,iv:9pl3nVmlnynJ4jMke1Hy4ACBuMyM+65vmGR2kS705I0=,tag:K1dQ9YwVN0sZjieAOU3KWw==,type:str]
-    GITSYNC_REPO: ENC[AES256_GCM,data:ETjdkCP/PSa6HSD9M6JdvWbci/lRwegzzyuPb/IQmX58sxwqT2gUjooVKtcylzsE,iv:kOpvSQYznyxfmLjrehdRuEtwevoceDo0h/vbXTuu/i8=,tag:x+DEmoZUxRN6OksDJ9mQIQ==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYR3FFRWdPajVzbjZGem1N
-            OXA2aVhtSWRxQUpGcDFxLzBFQWkyMlh5L2pvCkgvM25IVTBqSFZ3QmJDaGxqSTJ2
-            blQyOTQwaThRbkhzZ01uUmVoaXg5VHMKLS0tIHJJWlJoSmRXRi90M2VHSTlvdnBH
-            VjRWTHRSWUE0VFpqakwxUmx3aENqYUUK21JXxrt792sHoI2TCYU3aIQKKLL9f8oq
-            1o+qkueVYSYmVetrqcjSWqfGE496BYi+pd4a0mmRwaLpLCZIIgtlvA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
-    encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-05-11T19:25:53Z"
-    mac: ENC[AES256_GCM,data:jK/48Q7INbbcjZWASbS7ob1RrfDNm27jGnm1taL7hEMDC0k7n3igqlqSHmy7ZxCeUUe3Y+s7Jv9Ss1xITEPoUEYFphGrYeDUBVNtVfhBavTEaTPAuEv7WRA8xGpjXH0t9ernwwMyMQJRatazgX2jcc3rfzHMshs7cf5oeov15Zk=,iv:lg0ad1nDFDHBPv8Xvsn63V7SDPMo1p47gvSNFGJGw1I=,tag:fXatyOSOD/rCjEcpvDQpAw==,type:str]
-    version: 3.13.0

kubernetes/app/blog/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: blog
-  namespace: blog
-spec:
-  selector:
-    app: blog
-  ports:
-    - port: 8080
-      targetPort: 8080
-      name: http

kubernetes/app/gitea/namespace.yaml

@@ -2,6 +2,3 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: gitea
-  labels:
-    # act_runner DinD sidecar requires privileged; relax PSA enforce for this ns
-    pod-security.kubernetes.io/enforce: privileged

kubernetes/app/gitea/release-actions.yaml

@@ -30,14 +30,14 @@ spec:
         patches:
           - target:
               kind: StatefulSet
-              name: gitea-gitea-actions-act-runner
+              name: gitea-actions-act-runner
             patch: |
               - op: add
                 path: /spec/volumeClaimTemplates/0/spec/storageClassName
                 value: nfs-synology-ssd
   values:
     enabled: true
-    giteaRootURL: http://gitea-gitea-http.gitea.svc.cluster.local:3000
+    giteaRootURL: http://gitea-http.gitea.svc.cluster.local:3000
     existingSecret: gitea-runner-token
     existingSecretKey: token
     statefulset:

kubernetes/app/gitea/renovate.json

@@ -1,33 +0,0 @@
-{
-  "customManagers": [
-    {
-      "customType": "regex",
-      "description": "Track gitea rootless image; chart appends -rootless to tag automatically",
-      "fileMatch": ["kubernetes/app/gitea/release\\.yaml$"],
-      "matchStrings": [
-        "(?<indentation>\\s+)# renovate: currentValue=(?<currentValue>[^\\s]+) currentDigest=(?<currentDigest>sha256:[a-f0-9]+)\\n\\s+tag: [^\\s]+\\n\\s+digest: [^\\s]+"
-      ],
-      "depNameTemplate": "gitea/gitea",
-      "datasourceTemplate": "docker",
-      "autoReplaceStringTemplate": "{{indentation}}# renovate: currentValue={{newValue}} currentDigest={{#if newDigest}}{{{newDigest}}}{{else}}{{{currentDigest}}}{{/if}}\n{{indentation}}tag: {{newMajor}}.{{newMinor}}.{{newPatch}}\n{{indentation}}digest: {{#if newDigest}}{{{newDigest}}}{{else}}{{{currentDigest}}}{{/if}}"
-    }
-  ],
-  "packageRules": [
-    {
-      "matchFileNames": ["kubernetes/app/gitea/**"],
-      "semanticCommitScope": "k8s/gitea"
-    },
-    {
-      "matchFileNames": ["kubernetes/app/gitea/**"],
-      "matchPackageNames": ["gitea/gitea"],
-      "matchUpdateTypes": ["patch", "minor"],
-      "automerge": true
-    },
-    {
-      "description": "Ignore infrastructure images",
-      "matchFileNames": ["kubernetes/app/gitea/**"],
-      "matchPackageNames": ["creativeprojects/resticprofile", "postgres"],
-      "enabled": false
-    }
-  ]
-}

kubernetes/config/cluster-vars.sops.yaml

@@ -35,11 +35,11 @@ stringData:
     SEERR_HOST: ENC[AES256_GCM,data:l64ttp+rLNU8GfwIE4fhJROSMDEb,iv:1vHOw0LyGN9OMhYemhtRq9GE2fc4J2EprZU3bp/h4kk=,tag:WNV0Jh7816ra7IIOBMspBg==,type:str]
     FIREFLY_HOST: ENC[AES256_GCM,data:EQdrW33PVlD/brZCqh/sTkqLdPWW/bo=,iv:zbNnjsT1J6lpCEWtvNyL4A3bjWsusCjI5goWcZ8hajk=,tag:VwA6YA056bsyYIKB+X59bw==,type:str]
     GITEA_HOST: ENC[AES256_GCM,data:Ky3tXS9E9iadabpVzoK5zEbigmtn,iv:t6OdQeQ7Kxzb7qbi+KeoOkJd0XE2Dse5P1fFyiHM6tg=,tag:GpmHtVDr0IQVbpbALVx40g==,type:str]
-    BLOG_HOST: ENC[AES256_GCM,data:eADRFTla/PPFLVCoP9uKvPZ1YhY=,iv://xbCGLkZ6guGMDU0MnVtGR0adgMqNbe0zrCerj7w8k=,tag:HHXvN6y3YvJ4U4TkENkYVA==,type:str]
     BACKUP_LOCAL_HOST: ENC[AES256_GCM,data:ABaTI3NKkhF7K2FpPwvvrHA0l/tCxAi4Qek=,iv:34ixxSpKU1c12uoMdk4nz2Vo/+5A/npB7NWMsWFytIM=,tag:qjw2fQBebCKnqCnAPiBHaw==,type:str]
 sops:
     age:
-        - enc: |
+        - recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXekorS3lvckhHelE0NGVP
             Z0JSSmtTRk1yZEoxTVU4MnhaN2VjajU2cmhnCkEyWU0yandxUnZGZm5yWXJmQlM4
@@ -47,8 +47,7 @@ sops:
             MGJ6TFpwR0diNjlEN2syZkhNMFNwRDQK9pzmQGB0GQu6ogMIJW+kugvBNj3w+dxW
             bfEF9GAznIM/N5rPytF4wNgqwfoAF7GwumgA+iD43wprKtUJn+6dqw==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+    lastmodified: "2026-04-29T19:47:22Z"
+    mac: ENC[AES256_GCM,data:WgVeGY1tGl3Y97FRGNVEkM2J4WKeHil6ki2Jsww1QOsAdGyL7QaL0vPpfRfDc8FRHhyeahS7ShacUvBKnL5Lihxnrqhkd8wA0BgxONk0k/W8/WtU/tvhXpTwxTWgQ5VyPtX3QwwkAcGTARBu+Xrp2y9QGXU8NPO56eH6cUGPEW4=,iv:KjZbbRfhy4ZHtv38MHlX8jxK+9pp/U2aGaX+d8HRK3E=,tag:wcdQVdpYR9czzeYMi554oQ==,type:str]
     encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-05-11T19:20:10Z"
+    version: 3.12.2
-    mac: ENC[AES256_GCM,data:eA4MCmIA7iuC6gelQqWfIWPBb5w+93BLfU2ZhqLMbIna+OIk0tOjogcVz89H+x72ryMB+39a1vD+cYzLcF16Zl0uVHB5UiK9UDssJ26nbt8SK18F9Ew0a0WLp+gCj2qNAB2Od8+rLOKccfmHm1x+C5RuvYnRE4A1U1VNu6sPx3Q=,iv:epN8ZWNF0taoWm94eR+Unx9TUvjSIlKMgacLfbyj94w=,tag:a9f+8K7SOQmFJaZZ2PjnMQ==,type:str]
-    version: 3.13.0

renovate.json

@@ -5,8 +5,7 @@
     ":semanticCommits",
     "local>oleksandr/homelab//kubernetes/app/jellyfin/renovate.json",
     "local>oleksandr/homelab//kubernetes/app/media/renovate.json",
-    "local>oleksandr/homelab//kubernetes/app/immich/renovate.json",
+    "local>oleksandr/homelab//kubernetes/app/immich/renovate.json"
-    "local>oleksandr/homelab//kubernetes/app/gitea/renovate.json"
   ],
   "enabledManagers": ["kubernetes", "custom.regex"],
   "automergeType": "branch",