fad06fd
image:
repository: harbor.gitdata.me/app/gitdata
tag: "9da24e1"
pullPolicy: IfNotPresent
serviceAccount:
create: true
config:
env:
APP_REDIS__MODE: "cluster"
APP_REDIS__POOL_SIZE: "8"
APP_S3__ENDPOINT: "http://rustfs-svc.rustfs.svc.cluster.local:9000"
APP_S3__PUBLIC_ENDPOINT: "https://object.gitdata.ai"
APP_S3__BUCKET: "gitdata"
APP_S3__REGION: "us-east-1"
APP_S3__PATH_STYLE: "true"
APP_SEARCH__ENABLED: "true"
APP_SEARCH__URL: "http://meilisearch.meilisearch.svc.cluster.local:7700"
APP_SEARCH__INDEX_PREFIX: "gitdata"
APP_LIVEKIT__ENABLED: "true"
APP_LIVEKIT__URL: "wss://livekit.gitdata.ai"
APP_LIVEKIT__API_URL: "https://livekit.gitdata.ai"
APP_PUSH__ENABLED: "true"
APP_PUSH__VAPID_PUBLIC_KEY: "BG4X_BUPF-hgTX7xCzpRw9B1y3RO3y6lEBcuh0A62S4A1sjs79C54gUOzp3h8zy0oFsjVFM7A2OVM_6crzhLhMw"
APP_PUSH__VAPID_SUBJECT: "mailto:bot@mail.gitdata.ai"
APP_WEB__WEB_BASE_URL: "https://gitdata.ai"
APP_WEB__CORS_ALLOW_ORIGINS: '["https://gitdata.ai"]'
APP_SESSION__COOKIE_SECURE: "true"
APP_SESSION__MEMORY_LIFESPAN_SECS: "0"
APP_GIT__BASE_URL: "https://gitdata.ai"
APP_LIVEKIT__RECORDING_ENABLED: "false"
APP_EMAIL__ENABLED: "true"
APP_EMAIL__SMTP_HOST: "smtpdm.aliyun.com"
APP_EMAIL__SMTP_PORT: "465"
APP_EMAIL__SMTP_USERNAME: "bot@mail.gitdata.ai"
APP_EMAIL__FROM_ADDRESS: "bot@mail.gitdata.ai"
APP_EMAIL__FROM_NAME: "GitData"
APP_EMAIL_QUEUE__ENABLED: "true"
# CI 开关：runner 注册走 /api/v1/runner/register，该处理函数第一件事就是
# ensure_enabled()（lib/ci/src/service.rs:46），关闭时直接返回 403 Forbidden。
# 开启后必须同时提供 APP_CI__SECRET_ENCRYPTION_KEY（已在 gitdata-env Secret 中）。
APP_CI__ENABLED: "true"
# 必须是纯 origin（无路径前缀）：lib/ci/src/actions_runtime.rs:158 actions_runtime_url()
# 会用 reqwest::Url::parse 校验，带路径就报 "must be a URL origin without a path prefix"。
# 用跨命名空间 FQDN：runner 池在 gitdata-runners 命名空间，这个 URL 会随 claim
# 响应下发（lib/ci/src/actions_payload.rs:87 runtime_url），必须两边都能解析。
APP_CI__RUNTIME_BASE_URL: "http://gitdata-webhook.gitdata.svc.cluster.local:3005"
RUST_LOG: "info,session::session_store=error"
OTEL_TRACES_SAMPLER: "parentbased_traceidratio"
OTEL_TRACES_SAMPLER_ARG: "0.2"
metrics:
otlpEndpoint: "http://otel-collector.monitoring.svc.cluster.local:4318"
ingress:
enabled: true
controller: traefik
className: traefik
host: gitdata.ai
annotations:
traefik.ingress.kubernetes.io/service.sticky.cookie: "true"
traefik.ingress.kubernetes.io/service.sticky.cookie.name: "GD-AFFINITY"
traefik.ingress.kubernetes.io/service.sticky.cookie.httpOnly: "true"
traefik.ingress.kubernetes.io/service.sticky.cookie.secure: "true"
traefik.ingress.kubernetes.io/service.sticky.cookie.sameSite: "Lax"
tls:
enabled: true
secretName: ""
clusterIssuer: cloudflare-acme-cluster-issuer
apihost:
resources:
requests: { cpu: 250m, memory: 512Mi }
limits: { memory: 1Gi }
autoscaling:
enabled: true
minReplicas: 2
maxReplicas: 6
targetCPUUtilizationPercentage: 65
targetMemoryUtilizationPercentage: 80
behavior:
scaleUp:
stabilizationWindowSeconds: 20
policies:
- type: Percent
value: 100
periodSeconds: 30
- type: Pods
value: 4
periodSeconds: 30
selectPolicy: Max
scaleDown:
stabilizationWindowSeconds: 300
policies:
- type: Pods
value: 1
periodSeconds: 60
githost:
enabled: true
replicaCount: 1
httpPort: 9418
ssh:
enabled: true
containerPort: 2222
cloneHost: "ssh.gitdata.ai"
clonePort: 22
service:
type: LoadBalancer
port: 22
annotations:
metallb.universe.tf/loadBalancerIPs: "47.239.98.8"
adminhost:
enabled: true
ingress:
enabled: true
host: admin.gitdata.ai
className: traefik
tls:
enabled: true
secretName: ""
clusterIssuer: cloudflare-acme-cluster-issuer
webhook:
enabled: true
ingress:
enabled: true
host: hooks.gitdata.ai
className: traefik
tls:
enabled: true
secretName: ""
clusterIssuer: cloudflare-acme-cluster-issuer
ai:
enabled: true
baseUrl: "https://api.deepseek.com"
model: "deepseek-flash"
reviewEnabled: true
summaryEnabled: true
releaseNotesEnabled: true
queueTopic: "gitdata:ai"
dlqTopic: "gitdata:ai:dlq"
maxAttempts: 3
requestTimeoutSecs: 600
contextMaxBytes: 524288
maxFindings: 20
maxOutputTokens: 4096
thinkingBudget: 2048
temperature: "0.2"
summaryCommitLimit: 50
botUsername: "ai-reviewer"
botDisplayName: "AI Reviewer"
outputLanguage: "zh-CN"
aihost:
enabled: true
replicaCount: 1
port: 3006
concurrency: 2
pollIntervalSecs: 5
retryBackoffBaseSecs: 2
resources:
requests: { cpu: 100m, memory: 256Mi }
limits: { memory: 1Gi }
extraEnv: []
persistence:
repos:
enabled: true
existingClaim: gitdata-repos
size: 2Ti
storageClassName: aliyun-nfs-pro
accessModes: ["ReadWriteMany"]
mountPath: /opt/gitdata
migrate:
enabled: true
synchost:
enabled: true
replicaCount: 2
mails:
enabled: true
im:
enabled: true
autoscaling:
enabled: true
minReplicas: 2
maxReplicas: 6
targetCPUUtilizationPercentage: 70
targetMemoryUtilizationPercentage: 80
behavior:
scaleUp:
stabilizationWindowSeconds: 30
policies:
- type: Percent
value: 100
periodSeconds: 60
- type: Pods
value: 2
periodSeconds: 60
selectPolicy: Max
scaleDown:
stabilizationWindowSeconds: 600
policies:
- type: Pods
value: 1
periodSeconds: 120
runner:
enabled: false
actionsImage:
repository: harbor.gitdata.me/app/gitdata-act
tag: ""
pullPolicy: IfNotPresent