759ae5e
# Default values for gitdata.
nameOverride: ""
fullnameOverride: ""
image:
repository: gitdata
# 留空则用 Chart.appVersion 作为 tag
tag: ""
pullPolicy: IfNotPresent
imagePullSecrets: []
serviceAccount:
create: true
name: ""
annotations: {}
# ---------------------------------------------------------------------------
# 运行时配置。全部通过 Figment 的 APP_* 环境变量注入（见 docs/技术架构.md §12）。
# config.env -> ConfigMap（非敏感）
# secret.env -> Secret（敏感）；生产建议改用 existingSecret + 外部密钥管理
# ---------------------------------------------------------------------------
# 非敏感配置（string->string，值会被转成 APP_* 环境变量）
config:
env:
APP_REDIS__URL: "redis://redis-master:6379"
APP_S3__ENDPOINT: ""
APP_S3__BUCKET: ""
APP_S3__REGION: "us-east-1"
APP_S3__PATH_STYLE: "true"
# 读写库/副本、配额等其余段均可在此覆盖，例如：
# APP_DATABASE__REPLICAS: '[{url="postgres://readonly@pg:5432/gitdata"}]'
APP_SEARCH__ENABLED: "false"
APP_SEARCH__URL: "http://meilisearch:7700"
APP_SEARCH__INDEX_PREFIX: "gitdata"
APP_IMPORT__ENABLED: "false"
# Web Push：默认关闭；开启前必须同时提供 APP_PUSH__VAPID_PUBLIC_KEY（此处）
# 与 APP_PUSH__VAPID_PRIVATE_KEY（secret.env）。密钥生成见 config/default.toml。
APP_PUSH__ENABLED: "false"
APP_PUSH__VAPID_PUBLIC_KEY: ""
APP_PUSH__VAPID_SUBJECT: "mailto:ops@example.com"
# 自建 forge 的内网地址需显式加白，例如：
# APP_IMPORT__ALLOWED_HOSTS: '["gitea.internal","gitlab.svc.cluster.local"]'
# 认证中心：浏览器走 OIDC，服务间走 gRPC（x-rpc-key）。
APP_OAUTH__ENABLED: "true"
APP_OAUTH__ISSUER: "https://auth.gitdata.ai"
APP_OAUTH__CLIENT_ID: "gitdata-web"
APP_OAUTH__REDIRECT_URI: "https://gitdata.ai/api/v1/auth/callback"
APP_OAUTH__AUDIENCE: "gitdata.ai"
APP_OAUTH__GRPC_ENDPOINT: "http://kenoauth:18082"
RUST_LOG: "info"
# 敏感配置（渲染为 Secret）。注意 AppConfig 的 Debug 会带出密钥，
# 切勿在任何日志里 {:?} 打印配置。
secret:
# 留空则不创建 Secret，仅使用 existingSecret
create: true
existingSecret: ""
env:
APP_DATABASE__URL: "postgres://postgres:CHANGE_ME@postgres:5432/gitdata"
APP_OAUTH__RPC_KEY: "" # 与 KenOAuth auth.oauth.rpc_key 一致，>=32 字节
APP_INTERNAL__SERVICE_KEY: "" # /api/v1/internal/* 服务密钥，>=32 字节
APP_POW__MAC_KEY: "" # base64 >=32 字节
APP_AUTH__TOTP_ENCRYPTION_KEY: "" # base64 >=32 字节（实测必填）
APP_S3__ACCESS_KEY_ID: ""
APP_S3__SECRET_ACCESS_KEY: ""
APP_SEARCH__API_KEY: ""
APP_IMPORT__TOKEN_SECRET: "" # >=32 字节，加密导入任务里的源站令牌
APP_CI__SECRET_ENCRYPTION_KEY: "" # base64 >=32 字节，CI secrets / webhook 加密密钥
APP_PUSH__VAPID_PRIVATE_KEY: "" # base64url 32 字节 P-256 标量，Web Push 签名私钥
podSecurityContext:
fsGroup: 10001
securityContext:
runAsNonRoot: true
runAsUser: 10001
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
nodeSelector: {}
tolerations: []
affinity: {}
podAnnotations: {}
podLabels: {}
# ---------------------------------------------------------------------------
# 组件
# ---------------------------------------------------------------------------
migrate:
enabled: true # pre-install / pre-upgrade hook Job
resources:
requests: { cpu: 100m, memory: 128Mi }
limits: { memory: 512Mi }
extraEnv: []
apihost:
enabled: true
replicaCount: 2
port: 3000
resources:
requests: { cpu: 250m, memory: 256Mi }
limits: { memory: 1Gi }
autoscaling:
enabled: false
minReplicas: 2
maxReplicas: 8
targetCPUUtilizationPercentage: 70
targetMemoryUtilizationPercentage: 0
# Empty map renders no `behavior:` block (k8s default scaling policy).
behavior: {}
maxSurge: 1
maxUnavailable: 0
podAntiAffinity: soft # soft | hard | ""
topologySpreadConstraints: []
extraEnv: []
pdb:
enabled: true
minAvailable: 1
oauth:
enabled: false
image: harbor.gitdata.me/app/kenoauth:latest
pullPolicy: IfNotPresent
replicaCount: 1
httpPort: 18081
grpcPort: 18082
# Secret containing config.yaml (mounted at /app/config). Empty = env-only config.
existingSecret: ""
extraEnv: []
resources:
requests: { cpu: 100m, memory: 128Mi }
limits: { memory: 512Mi }
githost:
enabled: true
# SSH host key 落在共享 PVC 上；多副本前请预先放入同一把 key，
# 否则每个 Pod 各自生成会导致客户端 known_hosts 抖动
replicaCount: 1
httpPort: 9418
ssh:
enabled: true
# 非 root 进程绑不了 22，容器内监听 2222，Service 映射 22->2222
containerPort: 2222
service:
type: LoadBalancer
port: 22
nodePort: "" # type=NodePort 时可选
annotations: {}
externalIPs: []
# clone URL（对外展示/拼接用），一般填 LB 域名或 IP
cloneHost: ""
clonePort: 22
resources:
requests: { cpu: 250m, memory: 256Mi }
limits: { memory: 1Gi }
extraEnv: []
pdb:
enabled: false
minAvailable: 1
synchost:
enabled: true
replicaCount: 2
resources:
requests: { cpu: 200m, memory: 192Mi }
limits: { memory: 768Mi }
extraEnv: []
# 独立增量索引 worker（app/searchhost）。二进制不监听端口，因此没有探针。
searchhost:
enabled: false
replicaCount: 1
resources:
requests: { cpu: 200m, memory: 256Mi }
limits: { memory: 1Gi }
extraEnv: []
# worker 类程序的独立健康端点（apihost/githost/im 挂在自己业务端口上）
health:
enabled: true
synchostPort: 3002
im:
enabled: true
replicaCount: 2
port: 3001
resources:
requests: { cpu: 100m, memory: 128Mi }
limits: { memory: 512Mi }
autoscaling:
enabled: false
minReplicas: 2
maxReplicas: 6
targetCPUUtilizationPercentage: 70
# 0 disables the memory metric. Against the 128Mi request this is the
# connection-count guard: each live socket costs buffers plus its own
# pubsub pump, and the limit (512Mi) is far above where a pod should be.
targetMemoryUtilizationPercentage: 0
behavior: {}
maxSurge: 1
maxUnavailable: 0
podAntiAffinity: soft # soft | hard | ""
extraEnv: []
pdb:
enabled: true
minAvailable: 1
# ---------------------------------------------------------------------------
# 存储：githost 与 synchost 共享 bare 仓库，需要 RWX
# ---------------------------------------------------------------------------
persistence:
repos:
enabled: true
size: 50Gi
storageClassName: "" # "" = 默认 StorageClass
accessModes: ["ReadWriteMany"]
existingClaim: ""
mountPath: /opt/gitdata
# ---------------------------------------------------------------------------
# Ingress：同源 TLS 终结；*.git -> githost，/ws/v1 -> im，其余 -> apihost
#
# controller 决定路由怎么写：
# nginx —— 主 Ingress 用 regex path + ImplementationSpecific（配 use-regex 注解）
# traefik —— 主 Ingress 只写前缀路由；*.git 由 templates/ingressroute-githost.yaml
# 的 IngressRoute（PathRegexp）接管 —— traefik 的 Ingress provider 不支持
# 正则 path，ImplementationSpecific 会被当字面前缀处理。
# 其它控制器请把 controller 设成非 nginx 值，并按需在 className/annotations 里给出自己的语义。
# ---------------------------------------------------------------------------
ingress:
enabled: true
controller: nginx
className: nginx
host: gitdata.example.com
# githost 路由匹配（仅 controller=nginx 使用）
githostPath: "^/(.*\\.git)(/|$)|^/[^/]+/[^/]+/(HEAD$|info/|objects/|git-upload-pack|git-receive-pack)"
# traefik 用的正则（覆盖 owner/repo.git 与多级 group）；同时放行省略 .git 的 git
# 协议端点 —— actions/checkout 用 GITHUB_SERVER_URL + GITHUB_REPOSITORY 拼远程地址，
# 不带 .git 后缀，只按 *.git 匹配会把它打到 apihost 的 SPA 上。
githostPathRegexp: "^/.+\\.git(/|$)|^/[^/]+/[^/]+/(HEAD$|info/|objects/|git-upload-pack|git-receive-pack)"
annotations: {}
tls:
enabled: true
secretName: "" # 留空 = <fullname>-tls
clusterIssuer: "" # 填 cert-manager ClusterIssuer 自动签发
# 大文件 push / 长 RPC
proxyBodySize: "0" # 0 = 不限制
proxyReadTimeout: 3600
proxySendTimeout: 3600
proxyConnectTimeout: 60
metrics:
# OTLP 推送（无 scrape 端点，见 §13）
otlpEndpoint: ""
webhook:
enabled: true
replicaCount: 1
port: 3005
resources:
requests: { cpu: 100m, memory: 128Mi }
limits: { memory: 512Mi }
extraEnv: []
# 外部 runner 通过该域名接入调度中心；留空则仅集群内 Service 可达
ingress:
enabled: true
className: nginx
host: hooks.gitdata.example.com
annotations: {}
tls:
enabled: false
secretName: ""
runner:
# 默认关闭：多数部署在自有机器上运行 runner 二进制
enabled: false
actionsImage:
repository: gitdata-act
tag: ""
pullPolicy: IfNotPresent
replicaCount: 1
labels: ["self-hosted", "docker"]
capacity: 1
dockerEnabled: false
serverUrl: ""
resources:
requests: { cpu: 500m, memory: 512Mi }
limits: { memory: 4Gi }
extraEnv: []