asd

🤖 Split up helm chart workflows

The following patch adapts the CI workflows. The worflows has been splitted into
dedicated parts. For example the `helm template` and `helm unittest` command is
now a seperate step to notice that a change affects the template mechanism but
not the unittest. This was priviously not possible, because both commands were
part of one step.

🤖 Changelog Issue

Additionally has the changelog workflow be improved. The shell commands has
been migrated to a dedicated file named `.gitea/scripts/changelog.sh`. This has
the advantage, that the shellcheck plugin of IDE's support developers by
developing such shell scripts. Furthermore, the used container image has been
replaced by the ubuntu:latest image of the act_runner. This make it more
comfortable in using `curl` or `jq`, because the complete set of features/flags
are
avialable instead of the previously used container image
`docker.io/thegeeklab/git-sv:2.0.5`. Final note to the shell script
`changelog.sh`, this can now be executed locally as well as on ARM-based
act_runners and helps to test the helm chart in own Gitea environments
beforehand.

🤖 Markdown linter

In addition, a new workflow for markdown files has now been introduced. This
checks the `README.md` file for links, ensures that it is properly formatted,
and verifies that the parameters match those in `values.yaml`. Here, too, the
commands have been outsourced to separate jobs so that more precise interaction
is possible in the event of an error.

⚠️ Warning

This patch also requires an adjustment in branch protection. There, the
workflows that must be successful before a merge must be redefined.

Reviewed-on: https://gitea.com/gitea/helm-gitea/pulls/959
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Markus Pesch <markus.pesch@cryptic.systems>
Co-committed-by: Markus Pesch <markus.pesch@cryptic.systems>

.gitea/scripts/add-annotations.sh

@@ -0,0 +1,125 @@
+#!/bin/bash
+
+set -e -o pipefail
+
+chart_file="Chart.yaml"
+if [ ! -f "${chart_file}" ]; then
+  echo "ERROR: ${chart_file} not found!" 1>&2
+  exit 1
+fi
+
+default_new_tag="$(git tag --sort=-version:refname | head -n 1)"
+default_old_tag="$(git tag --sort=-version:refname | head -n 2 | tail -n 1)"
+
+if [ -z "${1}" ]; then
+  echo "Enter start tag [${default_old_tag}]:"
+  read -r old_tag
+  if [ -z "${old_tag}" ]; then
+    old_tag="${default_old_tag}"
+  fi
+
+  while [ -z "$(git tag --list "${old_tag}")" ]; do
+    echo "ERROR: Tag '${old_tag}' not found!" 1>&2
+    echo "Enter start tag [${default_old_tag}]:"
+    read -r old_tag
+    if [ -z "${old_tag}" ]; then
+      old_tag="${default_old_tag}"
+    fi
+  done
+else
+  old_tag=${1}
+  if [ -z "$(git tag --list "${old_tag}")" ]; then
+    echo "ERROR: Tag '${old_tag}' not found!" 1>&2
+    exit 1
+  fi
+fi
+
+if [ -z "${2}" ]; then
+  echo "Enter end tag [${default_new_tag}]:"
+  read -r new_tag
+  if [ -z "${new_tag}" ]; then
+    new_tag="${default_new_tag}"
+  fi
+
+  while [ -z "$(git tag --list "${new_tag}")" ]; do
+    echo "ERROR: Tag '${new_tag}' not found!" 1>&2
+    echo "Enter end tag [${default_new_tag}]:"
+    read -r new_tag
+    if [ -z "${new_tag}" ]; then
+      new_tag="${default_new_tag}"
+    fi
+  done
+else
+  new_tag=${2}
+
+  if [ -z "$(git tag --list "${new_tag}")" ]; then
+    echo "ERROR: Tag '${new_tag}' not found!" 1>&2
+    exit 1
+  fi
+fi
+
+change_log_yaml=$(mktemp)
+echo "[]" > "${change_log_yaml}"
+
+function map_type_to_kind() {
+  case "${1}" in
+    feat)
+      echo "added"
+    ;;
+    fix)
+      echo "fixed"
+    ;;
+    chore|style|test|ci|docs|refac)
+      echo "changed"
+    ;;
+    revert)
+      echo "removed"
+    ;;
+    sec)
+      echo "security"
+    ;;
+    *)
+      echo "skip"
+    ;;
+  esac
+}
+
+commit_titles="$(git log --pretty=format:"%s" "${old_tag}..${new_tag}")"
+
+echo "INFO: Generate change log entries from ${old_tag} until ${new_tag}"
+
+while IFS= read -r line; do
+  if [[ "${line}" =~ ^([a-zA-Z]+)(\([^\)]+\))?\:\ (.+)$ ]]; then
+    type="${BASH_REMATCH[1]}"
+    kind=$(map_type_to_kind "${type}")
+
+    if [ "${kind}" == "skip" ]; then
+      continue
+    fi
+
+    desc="${BASH_REMATCH[3]}"
+
+    echo "- ${kind}: ${desc}"
+
+    jq --arg kind "${kind}" --arg description "${desc}" '. += [ $ARGS.named ]' < "${change_log_yaml}" > "${change_log_yaml}.new"
+    mv "${change_log_yaml}.new" "${change_log_yaml}"
+
+  fi
+done <<< "${commit_titles}"
+
+if [ -s "${change_log_yaml}" ]; then
+  yq --inplace --input-format json --output-format yml "${change_log_yaml}"
+  yq --no-colors --inplace ".annotations.\"artifacthub.io/changes\" |= loadstr(\"${change_log_yaml}\") | sort_keys(.)" "${chart_file}"
+else
+  echo "ERROR: Changelog file is empty: ${change_log_yaml}" 1>&2
+  exit 1
+fi
+
+rm "${change_log_yaml}"
+
+regexp=".*-alpha-[0-9]+(\.[0-9]+){,2}$"
+if [[ "${new_tag}" =~ $regexp ]]; then
+  yq --inplace '.annotations."artifacthub.io/prerelease" = "true"' "${chart_file}"
+else
+  yq --inplace '.annotations."artifacthub.io/prerelease" = "false"' "${chart_file}"
+fi

.gitea/scripts/update-changelog.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+
+DEFAULT_GITEA_SERVER_URL="${GITHUB_SERVER_URL:-"https://gitea.com"}"
+DEFAULT_GITEA_REPOSITORY="${GITHUB_REPOSITORY:-"gitea/helm-gitea"}"
+DEFAULT_GITEA_TOKEN="${ISSUE_RW_TOKEN:-""}"
+
+if [ -z "${1}" ]; then
+  read -p "Enter hostname of the Gitea instance [${DEFAULT_GITEA_SERVER_URL}]: " CURRENT_GITEA_SERVER_URL
+  if [ -z "${CURRENT_GITEA_SERVER_URL}" ]; then
+    CURRENT_GITEA_SERVER_URL="${DEFAULT_GITEA_SERVER_URL}"
+  fi
+else
+  CURRENT_GITEA_SERVER_URL=$1
+fi
+
+if [ -z "${2}" ]; then
+  read -p "Enter name of the git repository [${DEFAULT_GITEA_REPOSITORY}]: " CURRENT_GITEA_REPOSITORY
+  if [ -z "${CURRENT_GITEA_REPOSITORY}" ]; then
+    CURRENT_GITEA_REPOSITORY="${DEFAULT_GITEA_REPOSITORY}"
+  fi
+else
+  CURRENT_GITEA_REPOSITORY=$2
+fi
+
+if [ -z "${3}" ]; then
+  read -p "Enter token to access the Gitea instance [${DEFAULT_GITEA_TOKEN}]: " CURRENT_GITEA_TOKEN
+  if [ -z "${CURRENT_GITEA_TOKEN}" ]; then
+    CURRENT_GITEA_TOKEN="${DEFAULT_GITEA_TOKEN}"
+  fi
+else
+  CURRENT_GITEA_TOKEN=$3
+fi
+
+if ! git sv rn -o /tmp/changelog.md; then
+  echo "ERROR: Failed to generate /tmp/changelog.md" 1>&2
+  exit 1
+fi
+
+CURL_ARGS=(
+  "--data-urlencode" "q=Changelog for upcoming version"
+  # "--data-urlencode=\"q=Changelog for upcoming version\""
+  "--data-urlencode" "state=open"
+  "--fail"
+  "--header" "Accept: application/json"
+  "--header" "Authorization: token ${CURRENT_GITEA_TOKEN}"
+  "--request" "GET"
+  "--silent"
+)
+
+if ! ISSUE_NUMBER="$(curl "${CURL_ARGS[@]}" "${CURRENT_GITEA_SERVER_URL}/api/v1/repos/${CURRENT_GITEA_REPOSITORY}/issues" | jq '.[].number')"; then
+  echo "ERROR: Failed query issue number" 1>&2
+  exit 1
+fi
+export ISSUE_NUMBER
+
+if ! echo "" | jq --raw-input --slurp --arg title "Changelog for upcoming version" --arg body "$(cat /tmp/changelog.md)" '{title: $title, body: $body}' 1> /tmp/payload.json; then
+  echo "ERROR: Failed to create JSON payload file" 1>&2
+  exit 1
+fi
+
+CURL_ARGS=(
+  "--data" "@/tmp/payload.json"
+  "--fail"
+  "--header" "Authorization: token ${CURRENT_GITEA_TOKEN}"
+  "--header" "Content-Type: application/json"
+  "--location"
+  "--silent"
+  "--output" "/dev/null"
+)
+
+if [ -z "${ISSUE_NUMBER}" ]; then
+  if ! curl "${CURL_ARGS[@]}" --request POST "${CURRENT_GITEA_SERVER_URL}/api/v1/repos/${CURRENT_GITEA_REPOSITORY}/issues"; then
+    echo "ERROR: Failed to create new issue!" 1>&2
+    exit 1
+  else
+    echo "INFO: Successfully created new issue!"
+  fi
+else
+  if ! curl "${CURL_ARGS[@]}" --request PATCH "${CURRENT_GITEA_SERVER_URL}/api/v1/repos/${CURRENT_GITEA_REPOSITORY}/issues/${ISSUE_NUMBER}"; then
+    echo "ERROR: Failed to update issue with ID ${ISSUE_NUMBER}!" 1>&2
+    exit 1
+  else
+    echo "INFO: Successfully updated existing issue with ID ${ISSUE_NUMBER}!"
+    echo "INFO: ${CURRENT_GITEA_SERVER_URL}/${CURRENT_GITEA_REPOSITORY}/issues/${ISSUE_NUMBER}"
+  fi
+fi

.gitea/workflows/bash.yaml

@@ -1,29 +0,0 @@
-name: Bash
-
-on:
-  pull_request:
-    types: [ "opened", "reopened", "synchronize" ]
-  push:
-    branches:
-    - '**'
-    tags-ignore:
-    - '**'
-  workflow_dispatch: {}
-
-jobs:
-  bash-unittest:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      with:
-        submodules: true
-    - env:
-          TERM: xterm
-      name: Run bash unittests
-      run: make bash/unittest
-
-  shellcheck:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-    - uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0

.gitea/workflows/changelog.yml

@@ -1,32 +0,0 @@
-name: changelog
-
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  changelog:
-    runs-on: ubuntu-latest
-    container: docker.io/thegeeklab/git-sv:2.1.3
-    steps:
-      - name: install tools
-        run: |
-          apk add -q --update --no-cache nodejs curl jq sed
-      - uses: actions/checkout@v7.0.0
-        with:
-          fetch-depth: 0
-      - name: Generate upcoming changelog
-        run: |
-          git sv rn -o changelog.md
-          export RELEASE_NOTES=$(cat changelog.md)
-          export ISSUE_NUMBER=$(curl -s "https://gitea.com/api/v1/repos/gitea/helm-gitea/issues?state=open&q=Changelog%20for%20upcoming%20version" | jq '.[].number')
-
-          echo $RELEASE_NOTES
-          JSON_DATA=$(echo "" | jq -Rs --arg title 'Changelog for upcoming version' --arg body "$(cat changelog.md)" '{title: $title, body: $body}')
-
-          if [ -z "$ISSUE_NUMBER" ]; then
-            curl -s -X POST "https://gitea.com/api/v1/repos/gitea/helm-gitea/issues" -H "Authorization: token ${{ secrets.ISSUE_RW_TOKEN }}" -H "Content-Type: application/json" -d "$JSON_DATA"
-          else
-            curl -s -X PATCH "https://gitea.com/api/v1/repos/gitea/helm-gitea/issues/$ISSUE_NUMBER" -H "Authorization: token ${{ secrets.ISSUE_RW_TOKEN }}" -H "Content-Type: application/json" -d "$JSON_DATA"
-          fi

.gitea/workflows/commitlint.yml

@@ -1,16 +1,17 @@
-name: Commit Linter
+name: Rum commitlint
 
 on:
   pull_request:
-    branches: [ "*" ]
+    branches: [ '**' ]
     types: [ "opened", "edited" ]
 
 jobs:
   check-and-test:
+    container: docker.io/commitlint/commitlint:19.9.1
+    name: Execute commitlint
     runs-on: ubuntu-latest
-    container: docker.io/commitlint/commitlint:21.2.1
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@v5.0.0
-      - name: Verify PR title
+      - name: Check PR title
         run: |
           echo "${{ gitea.event.pull_request.title }}" | commitlint --config .commitlintrc.json

.gitea/workflows/helm.yaml

@@ -1,41 +0,0 @@
-name: Helm
-
-on:
-  pull_request:
-    types: [ "opened", "reopened", "synchronize" ]
-  push:
-    branches:
-    - '**'
-    tags-ignore:
-    - '**'
-  workflow_dispatch: {}
-
-jobs:
-  helm-lint:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-    - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
-      with:
-        version: v4.3.0 # renovate: datasource=github-releases depName=helm/helm
-    - name: Update helm dependencies
-      run: helm dependency update
-    - name: Lint helm files
-      run: |
-        helm lint --values values.yaml .
-
-  helm-unittest:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-    - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
-      with:
-        version: v4.3.0 # renovate: datasource=github-releases depName=helm/helm
-    - env:
-        HELM_UNITTEST_VERSION: v1.0.0 #renovate: datasource=github-releases depName=helm-unittest/helm-unittest
-      name: Install helm-unittest
-      run: helm plugin install --verify=false --version "${HELM_UNITTEST_VERSION}" https://github.com/helm-unittest/helm-unittest
-    - name: Update helm dependencies
-      run: helm dependency update
-    - name: Execute helm unittests
-      run: helm unittest --strict --file 'unittests/**/*.yaml' .

.gitea/workflows/helm.yml

@@ -0,0 +1,75 @@
+name: Run Helm tests
+
+on:
+  pull_request:
+    branches: [ '**' ]
+  push:
+    branches: [ '**' ]
+    tags-ignore: [ '**' ]
+  workflow_call: {}
+
+env:
+  # renovate: datasource=github-releases depName=helm-unittest/helm-unittest
+  HELM_UNITTEST_VERSION: "v1.0.1"
+
+jobs:
+  helm-lint:
+    container: docker.io/alpine/helm:3.18.6
+    name: Execute helm lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install additional tools
+        run: |
+          apk update
+          apk add --update bash make nodejs
+      - uses: actions/checkout@v5.0.0
+      - name: Install helm chart dependencies
+        run: helm dependency build
+      - name: Execute helm lint
+        run: helm lint
+
+  helm-template:
+    container: docker.io/alpine/helm:3.18.6
+    name: Execute helm template
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install additional tools
+        run: |
+          apk update
+          apk add --update bash make nodejs
+      - uses: actions/checkout@v5.0.0
+      - name: Install helm chart dependencies
+        run: helm dependency build
+      - name: Execute helm template
+        run: helm template --debug gitea-helm .
+
+  helm-unittest:
+    container: docker.io/alpine/helm:3.18.6
+    name: Execute helm unittest
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install additional tools
+        run: |
+          apk update
+          apk add --update bash make nodejs npm yamllint ncurses
+      - uses: actions/checkout@v5.0.0
+      - name: Install helm chart dependencies
+        run: helm dependency build
+      - name: Install helm plugin 'unittest'
+        run: |
+          helm plugin install --version ${{ env.HELM_UNITTEST_VERSION }} https://github.com/helm-unittest/helm-unittest
+          git submodule update --init --recursive
+      - name: Execute helm unittest
+        env:
+          TERM: xterm
+        run: make unittests
+
+
+
+
+      # - name: verify readme
+      #   run: |
+      #     make readme
+      #     git diff --exit-code --name-only README.md
+      # - name: yaml lint
+      #   uses: https://github.com/ibiqlik/action-yamllint@v3

.gitea/workflows/markdown-linters.yaml

@@ -1,44 +0,0 @@
-name: Markdown linter
-
-on:
-  pull_request:
-    paths: [ "**/*.md" ]
-    types: [ "opened", "reopened", "synchronize" ]
-  push:
-    branches:
-    - '**'
-    paths: [ "**/*.md" ]
-    tags-ignore:
-    - '**'
-  workflow_dispatch: {}
-
-jobs:
-  markdown-link-checker:
-    container:
-      image: docker.io/library/node:26.8.2-alpine
-    runs-on: ubuntu-latest
-    steps:
-    - name: Install tooling
-      run: |
-        apk update
-        apk add git npm
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-    - name: Verify links in markdown files
-      run: |
-        npm install
-        npm run readme:link
-
-  markdown-lint:
-    container:
-      image: docker.io/library/node:26.8.2-alpine
-    runs-on: ubuntu-latest
-    steps:
-    - name: Install tooling
-      run: |
-        apk update
-        apk add git
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-    - name: Lint markdown files
-      run: |
-        npm install
-        npm run readme:lint

.gitea/workflows/markdown-linters.yml

@@ -0,0 +1,52 @@
+name: Markdown linter
+
+on:
+  pull_request:
+    types: [ "opened", "reopened", "synchronize" ]
+  push:
+    branches: [ '**' ]
+    tags-ignore: [ '**' ]
+  workflow_dispatch: {}
+
+jobs:
+  readme-link:
+    container:
+      image: docker.io/library/node:24.9.0-alpine
+    name: Execute npm run readme:link
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v5.0.0
+    - name: Execute npm run readme:link
+      run: |
+        npm install
+        npm run readme:link
+
+  readme-lint:
+    container:
+      image: docker.io/library/node:24.9.0-alpine
+    name: Execute npm run readme:lint
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v5.0.0
+    - name: Execute npm run readme:lint
+      run: |
+        npm install
+        npm run readme:lint
+
+  readme-parameters:
+    container:
+      image: docker.io/library/node:24.9.0-alpine
+    name: Execute npm run readme:parameters
+    runs-on: ubuntu-latest
+    steps:
+    - name: Install tooling
+      run: |
+        apk update
+        apk add git
+    - uses: actions/checkout@v5.0.0
+    - name: Execute npm run readme:parameters
+      run: |
+        npm install
+        npm run readme:parameters
+    - name: Compare diff
+      run: git diff --exit-code --name-only README.md

.gitea/workflows/release-version.yml

@@ -1,94 +1,174 @@
-name: generate-chart
+name: Release
+
+env:
+  GPG_PRIVATE_KEY_FILE: ${{ runner.temp }}/private.key
+  GPG_PRIVATE_KEY_FINGERPRINT: ${{ vars.GPG_PRIVATE_KEY_FINGERPRINT }}
+  GPG_PRIVATE_KEY_PASSPHRASE_FILE: ${{ runner.temp }}/passphrase.txt
 
 on:
   push:
-    tags:
+    tags: [ '**' ]
-      - "*"
 
 jobs:
-  generate-chart-publish:
+  publish-chart:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: azure/setup-helm@v4.3.1
+        with:
+          version: "v4.0.1" # renovate: datasource=github-tags depName=helm/helm
+
+      - name: Install helm plugins
+        env:
+          HELM_SIGSTORE_VERSION: "0.3.0" # renovate: datasource=github-tags depName=sigstore/helm-sigstore extractVersion='^v(?<version>\d+\.\d+\.\d+)$'
+          HELM_SCHEMA_VALUES_VERSION: "2.3.1" # renovate: datasource=github-tags depName=losisin/helm-values-schema-json extractVersion='^v(?<version>\d+\.\d+\.\d+)$'
+          HELM_UNITTEST_VERSION: "1.0.3" # renovate: datasource=github-tags depName=helm-unittest/helm-unittest extractVersion='^v(?<version>\d+\.\d+\.\d+)$'
+        run: |
+          helm plugin install --verify=false https://github.com/sigstore/helm-sigstore.git --version "${HELM_SIGSTORE_VERSION}" 1> /dev/null
+          helm plugin install --verify=false https://github.com/losisin/helm-values-schema-json.git --version "${HELM_SCHEMA_VALUES_VERSION}" 1> /dev/null
+          helm plugin install --verify=false https://github.com/helm-unittest/helm-unittest.git --version "${HELM_UNITTEST_VERSION}" 1> /dev/null
+          helm plugin list
+
+      - name: GPG configuration
+        env:
+          GPG_PRIVATE_KEY_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
+          GPG_PRIVATE_KEY: ${{ secrets.GPGSIGN_KEY }}
+        run: |
+          # Configure GPG and GPG Agent
+          mkdir --parents "${HOME}/.gnupg"
+          chmod 0700 "${HOME}/.gnupg"
+
+          cat > "${HOME}/.gnupg/gpg.conf" <<EOF
+          use-agent
+          pinentry-mode loopback
+          EOF
+
+          cat > "${HOME}/.gnupg/gpg-agent.conf" <<EOF
+          allow-loopback-pinentry
+          max-cache-ttl 86400
+          default-cache-ttl 86400
+          EOF
+
+          gpgconf --kill gpg-agent
+          gpgconf --launch gpg-agent
+
+          # Import GPG private key
+          cat 1> "${GPG_PRIVATE_KEY_PASSPHRASE_FILE}" <<< "${GPG_PRIVATE_KEY_PASSPHRASE}"
+          cat 1> "${GPG_PRIVATE_KEY_FILE}" <<< "${GPG_PRIVATE_KEY}"
+          gpg --batch --yes --passphrase-fd 0 --import "${GPG_PRIVATE_KEY_FILE}" <<< "${GPG_PRIVATE_KEY_PASSPHRASE}"
+
+          # Export GPG keyring
+          gpg --batch --yes --export "${GPG_PRIVATE_KEY_FINGERPRINT}" 1> "${HOME}/.gnupg/pubring.gpg"
+          gpg --batch --yes --passphrase-fd 0 --export-secret-keys "${GPG_PRIVATE_KEY_FINGERPRINT}" 1> "${HOME}/.gnupg/secring.gpg" <<< "${GPG_PRIVATE_KEY_PASSPHRASE}"
+
+      - uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 0
 
-      - name: Install packages via apt
-        run: |
-          apt update --yes
-          apt install --yes curl ca-certificates curl gnupg jq
-
-      - name: Install helm
-        env:
-          # renovate: datasource=docker depName=alpine/helm
-          HELM_VERSION: "3.21.3"
-        run: |
-          curl --fail --location --output /dev/stdout --silent --show-error https://get.helm.sh/helm-v${HELM_VERSION}-linux-$(dpkg --print-architecture).tar.gz | tar --extract --gzip --file /dev/stdin
-          mv linux-$(dpkg --print-architecture)/helm /usr/local/bin/
-          rm --force --recursive linux-$(dpkg --print-architecture) helm-v${HELM_VERSION}-linux-$(dpkg --print-architecture).tar.gz
-          helm version
-
-      - name: Install docker-ce via apt
-        run: |
-          install -m 0755 -d /etc/apt/keyrings
-          curl --fail --location --silent --show-error https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
-          chmod a+r /etc/apt/keyrings/docker.gpg
-          echo "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
-          apt update --yes
-          apt install --yes python3 python3-pip apt-transport-https docker-ce-cli
-
-      - name: Install awscli
-        run: |
-          pip install awscli --break-system-packages
-          aws --version
-
-      - name: Import GPG key
-        id: import_gpg
-        uses: https://github.com/crazy-max/ghaction-import-gpg@v7
-        with:
-          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
-          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
-          fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0
-
       - name: Add Artifacthub.io annotations
-        uses: volker-raschek/ah-annotations@v0.2.0
-
-      # Using helm gpg plugin as 'helm package --sign' has issues with gpg2: https://github.com/helm/helm/issues/2843
-      - name: package chart
         run: |
-          echo ${{ secrets.DOCKER_CHARTS_PASSWORD }} | docker login -u ${{ secrets.DOCKER_CHARTS_USERNAME }} --password-stdin
+          NEW_TAG="$(git tag --sort=-version:refname | head --lines 1)"
-          # FIXME: use upstream after https://github.com/technosophos/helm-gpg/issues/1 is solved
+          OLD_TAG="$(git tag --sort=-version:refname | head --lines 2 | tail --lines 1)"
-          helm plugin install https://github.com/pat-s/helm-gpg
+          .gitea/scripts/add-annotations.sh "${OLD_TAG}" "${NEW_TAG}"
+
+      - name: Extract meta information
+        run: |
+          echo "GITEA_SERVER_HOSTNAME=$(echo "${GITHUB_SERVER_URL}" | cut --delimiter '/' --fields 3)" >> $GITHUB_ENV
+          echo "PACKAGE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+          echo "REPOSITORY_NAME=$(echo ${GITHUB_REPOSITORY} | cut --delimiter '/' --fields 2)" >> $GITHUB_ENV
+          echo "REPOSITORY_OWNER=$(echo ${GITHUB_REPOSITORY} | cut --delimiter '/' --fields 1)" >> $GITHUB_ENV
+
+      - name: Package chart
+        run: |
           helm dependency build
-          helm package --version "${GITHUB_REF#refs/tags/v}" ./
+          helm package \
-          mkdir gitea
+            --sign \
-          mv gitea*.tgz gitea/
+            --key "$(gpg --with-colons --list-keys "${GPG_PRIVATE_KEY_FINGERPRINT}" | grep uid | cut --delimiter ':' --fields 10)" \
-          curl --fail --location --output gitea/index.yaml --silent --show-error https://dl.gitea.com/charts/index.yaml
+            --keyring "${HOME}/.gnupg/secring.gpg" \
-          helm repo index gitea/ --url https://dl.gitea.com/charts --merge gitea/index.yaml
+            --passphrase-file "${GPG_PRIVATE_KEY_PASSPHRASE_FILE}" \
-          # push to dockerhub
+            --version "${PACKAGE_VERSION}" ./
-          echo ${{ secrets.DOCKER_CHARTS_PASSWORD }} | helm registry login -u ${{ secrets.DOCKER_CHARTS_USERNAME }} registry-1.docker.io --password-stdin
-          helm push gitea/gitea-${GITHUB_REF#refs/tags/v}.tgz oci://registry-1.docker.io/giteacharts
-          helm registry logout registry-1.docker.io
 
-      - name: Copy files to Cloudflare R2
+      - uses: docker/login-action@v3.7.0
+        with:
+          username: ${{ secrets.DOCKER_IO_USERNAME }}
+          password: ${{ secrets.DOCKER_IO_PASSWORD }}
+
+      - name: Upload package as OCI artifact to docker.io
         env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
+          DOCKER_IO_REPO_NAME: ${{ vars.DOCKER_IO_REPO_NAME }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
-          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
         run: |
-          aws s3 sync gitea/ s3://${CLOUDFLARE_R2_BUCKET}/charts/ --endpoint-url https://${CLOUDFLARE_R2_ACCOUNT_ID}.r2.cloudflarestorage.com
+          helm push *-${PACKAGE_VERSION}.tgz "oci://registry-1.docker.io/${DOCKER_IO_REPO_NAME}"
 
-  release-gitea:
+      - uses: docker/login-action@v3.7.0
-    needs: generate-chart-publish
+        with:
-    runs-on: ubuntu-latest
+          registry: ${{ github.server_url }}
-    container: docker.io/thegeeklab/git-sv:2.1.3
+          username: ${{ secrets.GT_PACKAGE_REGISTRY_USERNAME }}
-    steps:
+          password: ${{ secrets.GT_PACKAGE_REGISTRY_TOKEN }}
-      - name: install tools
+
+      - name: Upload package as OCI artifact to Gitea
         run: |
-          apk add -q --update --no-cache nodejs
+          helm push *-${PACKAGE_VERSION}.tgz "oci://${GITEA_SERVER_HOSTNAME}/${REPOSITORY_OWNER}/${REPOSITORY_NAME}"
-      - uses: actions/checkout@v7.0.0
+
+      - name: Upload package as Helm chart to Gitea
+        env:
+          GITEA_REGISTRY_TOKEN: ${{ secrets.GT_PACKAGE_REGISTRY_TOKEN }}
+        run: |
+          for package in *"${PACKAGE_VERSION}.tgz"*; do
+            curl \
+              --fail \
+              --show-error \
+              --request POST \
+              --user "${REPOSITORY_OWNER}:${GITEA_REGISTRY_TOKEN}" \
+              --upload-file "${package}" \
+                https://${GITEA_SERVER_HOSTNAME}/api/packages/${REPOSITORY_OWNER}/helm/api/charts
+          done
+
+
+      # - name: Build new index.yaml
+      #   run: |
+      #     mkdir gitea
+      #     curl \
+      #       --fail \
+      #       --header \
+      #       --location \
+      #       --output gitea/index.yaml \
+      #       --show-error \
+      #       --silent \
+      #         https://dl.gitea.com/charts/index.yaml
+
+      #     helm repo index \
+      #       --merge gitea/index.yaml \
+      #       --url https://dl.gitea.com/charts \
+      #         gitea/
+
+      # - uses: aws-actions/configure-aws-credentials@v6.0.0
+      #   with:
+      #     aws-access-key-id: ${{ secrets.AWS_KEY_ID }}
+      #     aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      #     aws-region: ${{ secrets.AWS_REGION }}
+
+      # - name: Upload package as Helm chart to AWS S3
+      #   run: |
+      #     aws s3 sync gitea/ s3://${{ secrets.AWS_S3_BUCKET }}/charts/
+
+  publish-release-notes:
+    needs: publish-chart
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install gitsv
+        env:
+          GITSV_VERSION: v2.0.9 # renovate: datasource=github-releases depName=thegeeklab/git-sv
+        run: |
+          curl \
+            --fail \
+            --location \
+            --output git-sv \
+            --output-dir /usr/local/bin \
+            --silent \
+            --show-error \
+              https://github.com/thegeeklab/git-sv/releases/download/${GITSV_VERSION}/git-sv-linux-$(dpkg --print-architecture)
+          git-sv --version
+
+      - uses: actions/checkout@v6.0.0
         with:
           fetch-tags: true
           fetch-depth: 0
@@ -96,12 +176,12 @@ jobs:
       - name: Create changelog
         run: |
           git sv current-version
-          git sv release-notes -t ${GITHUB_REF#refs/tags/} -o CHANGELOG.md
+          git sv release-notes -t "${PACKAGE_VERSION}" -o CHANGELOG.md
-          sed -i '1,2d' CHANGELOG.md # remove version
+          sed -i '1,2d' CHANGELOG.md
           cat CHANGELOG.md
 
       - name: Release
-        uses: https://github.com/akkuman/gitea-release-action@v1
+        uses: akkuman/gitea-release-action@v1.3.5
         with:
           body_path: CHANGELOG.md
           token: "${{ secrets.RELEASE_TOKEN }}"

.gitea/workflows/update-changelog.yml

@@ -0,0 +1,29 @@
+name: Update changelog
+
+on:
+  push:
+    branches: [ "main" ]
+  workflow_dispatch: {}
+
+jobs:
+  changelog:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install packages via apt-get
+        run: |
+          apt-get update &&
+          apt-get install --yes curl jq
+      - uses: actions/checkout@v5.0.0
+        with:
+          fetch-depth: 0
+      - name: Install git-sv
+        env:
+          GIT_SV_VERSION: v2.0.4 # renovate: datasource=github-releases depName=thegeeklab/git-sv
+        run: |
+          curl --fail --location --output /usr/local/bin/git-sv --silent --show-error https://github.com/thegeeklab/git-sv/releases/download/${GIT_SV_VERSION}/git-sv-linux-$(dpkg --print-architecture)
+          chmod +x /usr/local/bin/git-sv
+          git-sv --version
+      - name: Update changelog issue
+        env:
+          ISSUE_RW_TOKEN: ${{ secrets.ISSUE_RW_TOKEN }}
+        run: .gitea/scripts/update-changelog.sh

.github/copilot-instructions.md

@@ -1,75 +0,0 @@
-# Gitea Helm Chart — Copilot Instructions
-
-## Project Overview
-
-Kubernetes Helm chart for deploying [Gitea](https://gitea.com). Uses Go/Helm templating (`templates/`), YAML values (`values.yaml`), and includes a sub-chart for Valkey. The database is provisioned as a CloudNativePG `Cluster` resource, the operator itself is not part of the chart.
-
-## Build & Test
-
-```bash
-make missing-dot       # Check if the @param annotations are missing a trailing dot.
-make readme            # Regenerate README.md parameter table + lint + link checker
-make helm/unittest     # Run Helm unit tests (helm-unittest plugin required)
-make bash/unittest     # Run bash/bats script tests (requires git submodule init)
-```
-
-Always run `make readme` after changing `values.yaml` `@param` annotations.
-Always run `make helm/unittest` after changing templates or unit tests.
-
-## Conventions
-
-### values.yaml
-
-- Use `## @param path.to.key Description` annotations for every user-facing value. These drive the auto-generated README parameter table.
-- Property ordering within a resource block: `enabled`, `annotations`, `labels` first, then type-specific fields.
-- Top-level keys are sorted alphabetically within their section group.
-- Use [Helm Values](https://docs.renovatebot.com/modules/manager/helm-values/#additional-information) pattern from renovatebot. Ensure that the attributes `registry`, `repository` and `tag` are available as part of the dict `image`. For example:
-
-```yaml
-image:
-  registry: docker.io
-  repository: library/busybox
-  tag: 0.1.0
-```
-
-### Templates
-
-- Helm templates live in `templates/`. Helpers live in `templates/_helpers.tpl`.
-- Use camelCase for all files and variables (e.g `httpRoute`, `backendTLSPolicy`, `gatewayAPI`, `statefulSet`).
-- Use `include "gitea.fullname"` for naming resources.
-- Use `fail` for required-value validation with clear error messages referencing the full values path.
-- Ensure, that the attributes `annotations`, `labels`, `name` and `namespace` are alphabetically sorted.
-- Render all attributes, even if they are empty, to prevent drift in Argo CD. For example, `labels` must be rendered, while `annotations` are defined as `yaml:"annotations,omitempty"`.
-- Use plural for `*.tpl` files, because they may contain functions for multiple resources of the same kind (e.g. `_services.tpl` for `httpService.yaml` or `sshService.yaml`, `_backendTLSPolicies.tpl` for `backendTLSPolicy.yaml`).
-- Use as prefix of YAML files the resource kind (e.g., `deployment.yaml` for `Deployment` resources). If there are multiple resources of the same kind, use a descriptive suffix (e.g., `deployment_metrics.yaml` for a `Deployment` related to metrics).
-- Short names like `pvc` for Persistent Volume Claims or `svc` for Services are not allowed in file names or key names.
-- Render `Secret` payloads as base64 `data` and never as `stringData`. The API server drops `stringData` and persists everything under `data`, so Helm's three-way merge cannot prune a key that was removed from the values — the stale key survives every upgrade. For example:
-
-```yaml
-data:
-  app.ini: {{ $config | b64enc }}
-```
-
-### Unit Tests
-
-- Helm unit tests live in `unittests/helm/` mirroring the template structure. A suite belongs into the directory of the template it asserts on, never into the directory of a template it only renders as a side effect.
-- Test files are YAML using the [helm-unittest](https://github.com/helm-unittest/helm-unittest) format.
-- Name test files in camelCase after the scenario they cover (e.g. `signingEnabled.yaml`), use `basics.yaml` for the default scenario and do not repeat the directory name in the file name. The `make helm/unittest` glob only matches one directory level, so every suite must live in a subdirectory.
-- Each test must set all required values explicitly — do not rely on cross-test state.
-- The `values.yaml` file must pass `yamllint`. The configuration is in `.yamllint.yaml`. Use `make yamllint` to run the linter.
-- The title of the unit test should clearly describe the scenario being tested. As title must be use a short sentence starting with a capital letter and ending without a period.
-- The `suite` title follows the pattern `Test <subject> <scenario>` (e.g. `Test deployment probes`). It must be unique across all suites, because `helm unittest` identifies a failing suite by this title.
-- Each unit test must explicitly set a custom namespace and release name, rather than relying on defaults.
-- Assert `Secret` content via `data.*` with `decodeBase64: true` and add a `notExists` assertion for `stringData`.
-
-### Commits & PRs
-
-- Follow [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) for PR titles and commit messages (e.g. `feat:`, `fix:`, `refactor:`, `docs:`, `style:`).
-- See `CONTRIBUTING.md` for full PR requirements.
-- Explain in detail why a change is needed, not just what the change is. Include links to relevant issues, PRs, or external references.
-- Add co-authors for any contributions that are not your own. Use the `Co-authored-by:` trailer in the commit message.
-
-### Documentation
-
-- `docs/` contains topic-specific guides (e.g. `gateway-api.md`, `ha-setup.md`).
-- `README.md` parameter tables are auto-generated — never edit them manually.

.helmignore

@@ -36,6 +36,6 @@ unittests/
 .prettierignore
 .yamllint
 CODEOWNERS
-renovate.json
+renovate.json5
 .commitlintrc.json
 .gitsv/

.markdownlink.json

@@ -0,0 +1,8 @@
+{
+  "projectBaseUrl":"${workspaceFolder}",
+  "ignorePatterns": [
+    {
+      "pattern": "^http://localhost"
+    }
+  ]
+}

.vscode/settings.json

@@ -1,10 +1,7 @@
 {
     "yaml.schemas": {
-        "https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.1.1/schema/helm-testsuite.json": [
+        "https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.0.1/schema/helm-testsuite.json": [
             "/unittests/**/*.yaml"
-        ],
-        "https://docs.renovatebot.com/renovate-schema.json":[
-          "renovate.json"
         ]
     },
     "yaml.schemaStore.enable": true,

.yamllint

@@ -1,21 +1,20 @@
 ---
 extends: default
+
 ignore: |
-  charts
   .yamllint
   node_modules
   templates
   unittests/bash
 
 rules:
-  braces:
-    max-spaces-inside: 2
-  comments:
-    min-spaces-from-content: 1
-  comments-indentation: disable
-  document-start: disable
-  line-length: disable
   truthy:
     allowed-values: ['true', 'false']
-    check-keys: false
+    check-keys: False
     level: error
+  line-length: disable
+  document-start: disable
+  comments:
+    min-spaces-from-content: 1
+  braces:
+    max-spaces-inside: 2

CODEOWNERS

@@ -1 +1 @@
-* @volker.raschek @ChristopherHX
+* @rossigee @volker.raschek @ChristopherHX

CONTRIBUTING.md

@@ -37,14 +37,14 @@ For local development and testing of pull requests, the following workflow can
 be used:
 
 1. Install `minikube` and `helm`.
-2. Start a `minikube` cluster via `minikube start`.
+1. Start a `minikube` cluster via `minikube start`.
-3. From the `gitea/helm-gitea` directory execute the following command.
+1. From the `gitea/helm-gitea` directory execute the following command.
    This will install the dependencies listed in `Chart.yml` and deploy the current state of the helm chart found locally.
    If you want to test a branch, make sure to switch to the respective branch first.
    `helm install --dependency-update gitea . -f values.yaml`.
-4. Gitea is now deployed in `minikube`. To access it, it's port needs to be forwarded first from `minikube` to localhost
+1. Gitea is now deployed in `minikube`.
-   first via `kubectl --namespace default port-forward svc/gitea-http 3000:3000`. Now Gitea is accessible at
+   To access it, it's port needs to be forwarded first from `minikube` to localhost first via `kubectl --namespace
-   `localhost:3000`.
+default port-forward svc/gitea-http 3000:3000`. Now Gitea is accessible at [http://localhost:3000](http://localhost:3000).
 
 ### Unit tests
 

Chart.lock

@@ -1,6 +1,15 @@
 dependencies:
+- name: postgresql
+  repository: oci://registry-1.docker.io/bitnamicharts
+  version: 16.7.27
+- name: postgresql-ha
+  repository: oci://registry-1.docker.io/bitnamicharts
+  version: 16.3.2
+- name: valkey-cluster
+  repository: oci://registry-1.docker.io/bitnamicharts
+  version: 3.0.24
 - name: valkey
-  repository: https://valkey.io/valkey-helm
+  repository: oci://registry-1.docker.io/bitnamicharts
-  version: 0.10.0
+  version: 3.0.31
-digest: sha256:c3deb43d02228f143e1c9525f5ce06dc6a78646e763c7a73c5ec8ea0101ed2f5
+digest: sha256:ceb6a1890cfdc2627abb85d3e2a4baa64d30afd21dcfabce978a824a67f0a2bb
-generated: "2026-10-04T00:24:11.331968211+02:00"
+generated: "2025-08-30T00:03:04.59764502Z"

Chart.yaml

@@ -3,7 +3,8 @@ name: gitea
 description: Gitea Helm chart for Kubernetes
 type: application
 version: 0.0.0
-appVersion: 28.0.0
+# renovate datasource=github-releases depName=go-gitea/gitea extractVersion=^v(?<version>.*)$
+appVersion: 1.24.6
 icon: https://gitea.com/assets/img/logo.svg
 
 annotations:
@@ -25,6 +26,9 @@ sources:
   - https://docker.gitea.com/gitea
 
 maintainers:
+  # https://gitea.com/rossigee
+  - name: Ross Golder
+    email: ross@golder.org
   # https://gitea.com/volker.raschek
   - name: Markus Pesch
     email: markus.pesch+apps@cryptic.systems
@@ -36,8 +40,23 @@ maintainers:
     email: christopher.homberger@web.de
 
 dependencies:
+  # https://github.com/bitnami/charts/blob/main/bitnami/postgresql
+  - name: postgresql
+    repository: oci://registry-1.docker.io/bitnamicharts
+    version: 16.7.27
+    condition: postgresql.enabled
+  # https://github.com/bitnami/charts/blob/main/bitnami/postgresql-ha/Chart.yaml
+  - name: postgresql-ha
+    repository: oci://registry-1.docker.io/bitnamicharts
+    version: 16.3.2
+    condition: postgresql-ha.enabled
+  # https://github.com/bitnami/charts/blob/main/bitnami/valkey-cluster/Chart.yaml
+  - name: valkey-cluster
+    repository: oci://registry-1.docker.io/bitnamicharts
+    version: 3.0.24
+    condition: valkey-cluster.enabled
   # https://github.com/bitnami/charts/blob/main/bitnami/valkey/Chart.yaml
   - name: valkey
-    repository: https://valkey.io/valkey-helm
+    repository: oci://registry-1.docker.io/bitnamicharts
-    version: 0.10.0
+    version: 3.0.31
     condition: valkey.enabled

Makefile

@@ -1,67 +1,29 @@
 SHELL := /usr/bin/env bash -O globstar
 
-# CLEAN
+.PHONY: prepare-environment
-# ==============================================================================
+prepare-environment:
-PHONY+=clean
+	npm install
-clean:
-	-rm -rf charts *.tar.gz *.tar.gz.sig node_modules
 
-# MISSING DOT
+.PHONY: readme
-# ==============================================================================
+readme: prepare-environment
-PHONY+=missing-dot
+	npm run readme:parameters
-missing-dot:
+	npm run readme:lint
-	grep --perl-regexp '## @(param|skip).*[^.]$$' values.yaml
 
-# README
+.PHONY: unittests
-# ==============================================================================
+unittests: unittests-helm unittests-bash
-PHONY+=readme
-readme: readme/link readme/lint readme/parameters
 
-PHONY+=readme/link
+.PHONY: unittests-helm
-readme/link:
+unittests-helm:
-	npm install && npm run readme:link
+	helm unittest --strict -f 'unittests/helm/**/*.yaml' -f 'unittests/helm/values-conflicting-checks.yaml' ./
 
-PHONY+=readme/lint
+.PHONY: unittests-bash
-readme/lint:
+unittests-bash:
-	npm install && npm run readme:lint
-
-PHONY+=readme/parameters
-readme/parameters:
-	npm install && npm run readme:parameters
-
-# HELM DEPENDENCIES
-# ==============================================================================
-PHONY+=helm/dependency-update
-helm/dependency-update:
-	helm dependency update
-
-# HELM UNITTESTS
-# ==============================================================================
-PHONY+=helm/unittest
-helm/unittest:
-	helm unittest --strict --file 'unittests/helm/**/*.yaml' ./
-
-# BASH PREPARE
-# ==============================================================================
-PHONY+=bash/prepare
-bash/prepare:
-	git submodule init
-	git submodule update
-
-# BASH UNITTESTS
-# ==============================================================================
-PHONY+=bash/unittest
-bash/unittest:
 	./unittests/bash/bats/bin/bats --pretty ./unittests/bash/tests/**/*.bats
 
-# YAML LINT
+.PHONY: update-helm-dependencies
-# ==============================================================================
+update-helm-dependencies:
-PHONY+=yamllint
+	helm dependency update
-yamllint:
-	yamllint -c .yamllint.yaml .
 
-# PHONY
+.PHONY: yamllint
-# ==============================================================================
+yamllint:
-# Declare the contents of the PHONY variable as phony. We keep that information
+	yamllint -c .yamllint .
-# in a variable so we can use it in if_changed.
-.PHONY: ${PHONY}

docs/gateway-api.md

@@ -1,269 +0,0 @@
-# Gateway API
-
-This chart can expose Gitea through [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/) resources
-alongside (or instead of) the existing `Ingress` and OpenShift `Route` support. The following resources
-are rendered:
-
-- `HTTPRoute` — required for HTTP traffic
-- `TCPRoute` — optional, typically for SSH (port 22)
-- `BackendTLSPolicy` — optional, for encrypted backend traffic
-- `ClientSettingsPolicy` — optional, **NGINX Gateway Fabric only**, to raise the client request body size limit
-
-All resources are disabled by default. Enabling them requires Gateway API CRDs (and an implementation that supports them) to already be installed in the cluster.
-
-The chart does **not** render a `Gateway` resource — provisioning and managing the Gateway is the responsibility of the cluster / platform administrator.
-
-## Prerequisites
-
-| Resource               | API version                          | Status (as of writing) |
-| ---------------------- | ------------------------------------ | ---------------------- |
-| `HTTPRoute`            | `gateway.networking.k8s.io/v1`       | GA                     |
-| `TCPRoute`             | `gateway.networking.k8s.io/v1`       | GA (v1.4+)             |
-| `BackendTLSPolicy`     | `gateway.networking.k8s.io/v1`       | GA (v1.2+)             |
-| `ClientSettingsPolicy` | `gateway.nginx.org/v1alpha1`         | NGINX Gateway Fabric   |
-
-## Common topology
-
-Most users should attach to a pre-existing, shared `Gateway` managed by the cluster administrator:
-
-```yaml
-gatewayAPI:
-  core:
-    httpRoute:
-      enabled: true
-      tls: true            # the shared Gateway terminates TLS
-      hostnames:
-        - git.example.com
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: shared-gateway
-          namespace: gateway-system
-          sectionName: https-gitea   # pin to a specific listener (see below)
-    tcpRoute:
-      enabled: true
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: shared-gateway
-          namespace: gateway-system
-          sectionName: ssh
-```
-
-With this configuration:
-
-- `ROOT_URL`, `DOMAIN`, and `SSH_DOMAIN` resolve to the first HTTPRoute hostname.
-- Setting `gatewayAPI.core.httpRoute.tls: true` switches `ROOT_URL` to `https://`.
-- The default HTTPRoute rule forwards `/` to the Gitea HTTP `Service`. The default TCPRoute rule forwards to the SSH `Service`.
-- Custom `rules` and `hostnames` are rendered through `tpl`, so Helm template expressions work inside them.
-
-### Why `sectionName` matters
-
-Omitting `sectionName` attaches the route to **every** matching listener on the Gateway. On implementations
-that use per-host HTTPS listeners (Envoy Gateway, Cilium Gateway), that means Gitea's HTTPRoute will try
-to bind to every HTTPS listener — usually not what you want. Always pin to a named listener
-(e.g. `https-gitea`, `ssh`) when the Gateway has more than one. The corresponding listener on the Gateway
-side typically looks like:
-
-```yaml
-listeners:
-  - name: https-gitea
-    port: 443
-    protocol: HTTPS
-    hostname: git.example.com
-    tls:
-      certificateRefs:
-        - name: git-example-com-tls
-    allowedRoutes:
-      kinds:
-        - kind: HTTPRoute
-      namespaces:
-        from: Selector
-        selector:
-          matchLabels:
-            kubernetes.io/metadata.name: gitea
-  - name: ssh
-    port: 22
-    protocol: TCP
-    allowedRoutes:
-      kinds:
-        - kind: TCPRoute
-      namespaces:
-        from: Selector
-        selector:
-          matchLabels:
-            kubernetes.io/metadata.name: gitea
-```
-
-### Sharing a hostname between HTTP and SSH
-
-HTTP (443) and SSH (22) are different ports, so a single hostname like `git.example.com` can serve both —
-clients disambiguate by port. This is the recommended pattern: one DNS record, `ssh git@git.example.com`
-and `https://git.example.com` both work, and `SSH_DOMAIN` / `DOMAIN` resolve to the same value with no
-extra configuration.
-
-If you want SSH on a **different** hostname (e.g. `gitea-ssh.example.com`), set it explicitly — the chart
-cannot infer it from TCPRoute config because TCPRoutes don't carry hostnames:
-
-```yaml
-gitea:
-  config:
-    server:
-      SSH_DOMAIN: gitea-ssh.example.com
-```
-
-## BackendTLSPolicy
-
-Use this when the Gitea HTTP backend is terminating TLS itself (for example, when running Gitea with
-`PROTOCOL=https`, or when fronting another HTTPS service from the same chart) and the Gateway needs to
-verify the backend certificate before forwarding the request.
-
-### Configuring Gitea to serve HTTPS directly
-
-Gitea serves HTTPS via three `[server]` app.ini options
-([cheat sheet](https://docs.gitea.com/administration/config-cheat-sheet#server-server)). Mount the
-cert/key with `deployment.volumes` + `deployment.gitea.volumeMounts` and point Gitea at them with absolute paths:
-
-```yaml
-gitea:
-  config:
-    server:
-      PROTOCOL: https
-      CERT_FILE: /etc/gitea-tls/tls.crt
-      KEY_FILE: /etc/gitea-tls/tls.key
-
-deployment:
-  gitea:
-    volumeMounts:
-      - name: gitea-tls
-        mountPath: /etc/gitea-tls
-        readOnly: true
-  volumes:
-    - name: gitea-tls
-      secret:
-        secretName: gitea-backend-tls   # cert-manager-issued Secret, etc.
-```
-
-- Relative `CERT_FILE`/`KEY_FILE` values resolve against Gitea's `CustomPath` (`/data/gitea` in the
-  official image); absolute paths are clearer.
-- Both options are ignored when `gitea.config.server.ENABLE_ACME` is `true`.
-- For chained certs, the server cert comes first, intermediates after.
-- The Service still forwards raw TCP — no `service.http.*` changes needed. The pod's container port
-  (3000 by default) is now speaking HTTPS instead of HTTP.
-
-### BackendTLSPolicy example
-
-Verify the backend with a CA bundle stored in a `ConfigMap`:
-
-```yaml
-gatewayAPI:
-  core:
-    backendTLSPolicy:
-      enabled: true
-      validation:
-        hostname: gitea.svc.cluster.local
-        caCertificateRefs:
-          - name: gitea-backend-ca
-            group: ""
-            kind: ConfigMap
-```
-
-This renders a single `BackendTLSPolicy` whose `targetRefs` defaults to the chart's HTTP `Service`
-(`<fullname>-http`), and whose `validation` is passed through verbatim. `validation` is required by the
-API; the template fails fast if omitted.
-
-### System CA trust and explicit targetRefs
-
-To trust the system CA store (Gateway API v1.1+) or target a different Service, use `wellKnownCACertificates`
-and `targetRefs`:
-
-```yaml
-gatewayAPI:
-  core:
-    backendTLSPolicy:
-      enabled: true
-      targetRefs:
-        - group: ""
-          kind: Service
-          name: gitea-sidecar
-      validation:
-        hostname: sidecar.gitea.svc.cluster.local
-        wellKnownCACertificates: System
-```
-
-Notes:
-
-- `targetRefs[].kind` is almost always `Service`; `group: ""` is the core API group.
-- `wellKnownCACertificates: System` requires Gateway API v1.1 and an implementation that supports it
-  (otherwise stick with `caCertificateRefs`).
-- The corresponding HTTPRoute must reference the backend by the same `Service` (and, if used,
-  `sectionName`/`port`) — `BackendTLSPolicy` attaches to the Service-side reference, not to the route.
-
-## Raising the request body size limit (NGINX Gateway Fabric)
-
-NGINX defaults `client_max_body_size` to `1m`. Requests exceeding it are rejected with `413 Request
-Entity Too Large`. This blocks uploading larger artifacts to Gitea's package/container registry (container
-images, DEB/RPM packages, etc.). With the NGINX **Ingress** controller you raised this via the
-`nginx.ingress.kubernetes.io/proxy-body-size` annotation — that annotation does **not** apply to Gateway
-API. NGINX Gateway Fabric instead reads the limit from a
-[`ClientSettingsPolicy`](https://docs.nginx.com/nginx-gateway-fabric/reference/api/) (`spec.body.maxSize`).
-
-This is specific to **NGINX Gateway Fabric**. Other implementations (Envoy Gateway, Cilium, Istio, …) do
-**not** impose a default request body size limit, so large uploads work without any extra configuration —
-leave `gatewayAPI.nginx.clientSettingsPolicies` disabled.
-
-```yaml
-gatewayAPI:
-  enabled: true
-  nginx:
-    clientSettingsPolicies:
-      enabled: true
-      body:
-        maxSize: 100m   # bytes, or with a k / m / g suffix; 0 disables the limit
-```
-
-This renders a single `ClientSettingsPolicy` whose `targetRef` defaults to the chart's `HTTPRoute`
-(`<fullname>`), so the limit applies to all traffic routed to Gitea. `body` is required when enabled; the
-template fails fast if omitted. `spec.body` is passed through verbatim, so other fields (e.g. `timeout`)
-are supported too.
-
-To attach the policy elsewhere — for example the whole `Gateway` so the limit is inherited by every route —
-override `targetRef`:
-
-```yaml
-gatewayAPI:
-  nginx:
-    clientSettingsPolicies:
-      enabled: true
-      targetRef:
-        group: gateway.networking.k8s.io
-        kind: Gateway
-        name: shared-gateway
-      body:
-        maxSize: 100m
-```
-
-Notes:
-
-- `ClientSettingsPolicy` is an inherited policy: attaching it to a `Gateway` cascades to its routes, while
-  attaching it to an `HTTPRoute` scopes it to that route only.
-- The policy must live in the same namespace as its `targetRef`.
-- Gitea also enforces its own upload limits independently (`gitea.config` `[repository.upload]` and
-  `[packages]` sections) — raising the proxy limit alone is not always sufficient.
-
-## Interaction with `ingress` and `route`
-
-The three exposure mechanisms are independent and can coexist, but `ROOT_URL` / `DOMAIN` / `SSH_DOMAIN` resolution uses the first defined source in this order:
-
-1. `route.host` (when `route.enabled`)
-2. `httpRoute.hostnames[0]` (when `gatewayAPI.core.httpRoute.enabled`)
-3. First `ingress.hosts[0].host`
-4. The in-cluster Service DNS name
-
-Likewise, `ROOT_URL` becomes `https://` if any of these terminate TLS: `route.tls.termination`, `ingress.tls`, or `gatewayAPI.core.httpRoute.tls`.
-
-## SSH considerations
-
-- `TCPRoute` is GA since Gateway API v1.4. Older CRD bundles only ship the `v1alpha2` version, so make sure the installed CRDs are at least v1.4.
-- If your Gateway implementation does not support `TCPRoute`, keep using `service.ssh.type: LoadBalancer` (or `NodePort`) and only enable `httpRoute` for HTTP traffic.
-- The default TCPRoute rule points at the Gitea SSH `Service` on `service.ssh.port` (typically 22), which itself proxies to `gitea.config.server.SSH_LISTEN_PORT` inside the pod.

docs/ha-setup.md

@@ -14,7 +14,7 @@ They might cost a bit more than using a self-hosted k8s variant but are usually
 Also they can be centrally managed and are not linked to the Gitea helm chart or namespace.
 Please consider using external services before you start with your Gitea HA setup, it will make your life (and the life of the Gitea maintainers) easier.
 
-This helm chart tries to help as much as possible to simplify and assert the provisioning of a HA-ready Gitea instance by implementing smart conditionals if `deployment.replicas` is set to a value > 1.
+This helm chart tries to help as much as possible to simplify and assert the provisioning of a HA-ready Gitea instance by implementing smart conditionals if `replicaCount` is set to a value > 1.
 Nevertheless, we cannot guarantee for every possible combination of Gitea settings to work together perfectly in a HA setup.
 As a general advice, we recommend to have a test environment aside on which to test possible changes/upgrades before applying these to a production installation.
 
@@ -28,8 +28,8 @@ In addition, the following components are required for full HA-readiness:
 - A HA-ready cache (`valkey-cluster`)
 - A HA-ready DB
 
-`cloudnativePG.enabled`, which defaults to `false`, must be enabled for a HA setup.
+`postgres.enabled`, which default to `true`, must be set to `false` for a HA setup.
-It requires the CloudNativePG operator to be installed cluster-wide beforehand.
+The default `postgres` chart dependency is not HA-ready (there's a dedicated `postgres-ha` chart).
 
 The following sections discuss each of the components in more detail.
 Note that for each component discussed, the shown configurations only provides a (working) starting point, not necessarily the most optimal setup.
@@ -153,31 +153,15 @@ persistence:
 
 ## Database
 
-By enabling `cloudnativePG`, the chart renders a [CloudNativePG](https://cloudnative-pg.io/) `Cluster`, which provides a HA-ready PostgreSQL via streaming replication.
+If you do not have an HA-ready DB, using a managed database service in the cloud might be the easiest and most robust solution.
-The CloudNativePG operator itself is not part of this chart and has to be [installed cluster-wide](https://cloudnative-pg.io/documentation/current/installation_upgrade/) beforehand.
+Remember: disable the built-in `postgres` dependency and configure the database connection manually via `gitea.config.database`:
-For that reason the option is disabled by default.
 
 ```yml
-cloudnativePG:
-  enabled: true
-  instances: 3
-  storage:
-    size: 10Gi
-    storageClass: <storage class>
-  walStorage:
-    enabled: true
-    size: 2Gi
-    storageClass: <storage class>
-```
-
-If you do not want to run the operator, using a managed database service in the cloud might be the easiest and most robust solution.
-Remember: keep `cloudnativePG` disabled and configure the database connection manually via `gitea.config.database`:
-
-```yml
-cloudnativePG:
-  enabled: false
-
 gitea:
+  database:
+    builtIn:
+      postgresql:
+        enabled: false
   config:
     database:
       DB_TYPE: postgres
@@ -191,4 +175,4 @@ gitea:
 - Currently Cron jobs are run on all replicas as no leader election is implemented.
   See [https://github.com/go-gitea/gitea/issues/13791](https://github.com/go-gitea/gitea/issues/13791) for a discussion and possible solution.
 
-- Running with multiple replicas slows down Gitea a bit, i.e. page loading time increases.
+- Running with multiple replicas slows down Gitea a bit, i.e. page loading time increases. 

package.json

@@ -9,13 +9,13 @@
     "npm": ">=8.0.0"
   },
   "scripts": {
-    "readme:link": "markdown-link-check *.md",
+    "readme:link": "markdown-link-check --config .markdownlink.json *.md",
     "readme:lint": "markdownlint *.md -f",
     "readme:parameters": "readme-generator -v values.yaml -r README.md"
   },
   "devDependencies": {
     "@bitnami/readme-generator-for-helm": "^2.5.0",
     "markdown-link-check": "^3.13.6",
-    "markdownlint-cli": "^0.49.0"
+    "markdownlint-cli": "^0.45.0"
   }
 }

renovate.json

@@ -1,136 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "gitea>gitea/renovate-config",
-    "helpers:pinGitHubActionDigests",
-    ":automergeMinor",
-    "schedule:automergeDaily",
-    "schedule:weekends"
-  ],
-  "labels": [
-    "kind/dependency"
-  ],
-  "digest": {
-    "automerge": true
-  },
-  "automergeStrategy": "squash",
-  "git-submodules": {
-    "enabled": true
-  },
-  "customManagers": [
-    {
-      "description": "Gitea-version of https://docs.renovatebot.com/presets-regexManagers/#regexmanagersgithubactionsversions",
-      "customType": "regex",
-      "managerFilePatterns": [
-        "/.gitea/workflows/.+\\.ya?ml$/"
-      ],
-      "matchStrings": [
-        "# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[a-z-0-9]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:\\s*[\"']?(?<currentValue>.+?)[\"']?\\s"
-      ]
-    },
-    {
-      "description": "Detect helm-unittest yaml schema file",
-      "customType": "regex",
-      "managerFilePatterns": [
-        "/.vscode/settings\\.json$/"
-      ],
-      "matchStrings": [
-        "https:\\/\\/raw\\.githubusercontent\\.com\\/(?<depName>[^\\s]+?)\\/(?<currentValue>v[0-9.]+?)\\/schema\\/helm-testsuite\\.json"
-      ],
-      "datasourceTemplate": "github-releases"
-    },
-    {
-      "description": "Automatically detect new Gitea releases",
-      "customType": "regex",
-      "datasourceTemplate": "github-releases",
-      "depNameTemplate": "gitea/gitea",
-      "extractVersionTemplate": "^v(?<version>.*)$",
-      "managerFilePatterns": [
-        "/(^|/)Chart\\.ya?ml$/"
-      ],
-      "matchStrings": [
-        "^appVersion:\\s+[\"']?(?<currentVersion>\\S+)[\"']?$"
-      ]
-    }
-  ],
-  "lockFileMaintenance": {
-    "enabled": true,
-    "commitMessageAction": "update",
-    "commitMessageTopic": "lockfiles",
-    "schedule": [
-      "at any time"
-    ]
-  },
-  "packageRules": [
-    {
-      "groupName": "subcharts (minor & patch)",
-      "matchManagers": [
-        "helmv3"
-      ],
-      "matchUpdateTypes": [
-        "minor",
-        "patch",
-        "digest"
-      ]
-    },
-    {
-      "groupName": "bats testing framework",
-      "matchManagers": [
-        "git-submodules"
-      ],
-      "matchUpdateTypes": [
-        "minor",
-        "patch",
-        "digest"
-      ]
-    },
-    {
-      "groupName": "workflow dependencies (minor & patch)",
-      "matchManagers": [
-        "github-actions",
-        "npm",
-        "custom.regex"
-      ],
-      "matchUpdateTypes": [
-        "minor",
-        "patch",
-        "digest"
-      ],
-      "matchFileNames": [
-        "!Chart.yaml"
-      ]
-    },
-    {
-      "description": "Update README.md on changes in values.yaml",
-      "matchManagers": [
-        "helm-values"
-      ],
-      "postUpgradeTasks": {
-        "commands": [
-          "install-tool node",
-          "make readme"
-        ],
-        "fileFilters": [
-          "README.md"
-        ],
-        "executionMode": "update"
-      }
-    },
-    {
-      "description": "Override changelog url for Helm image, to have release notes in our PRs",
-      "matchDepNames": [
-        "alpine/helm"
-      ],
-      "changelogUrl": "https://github.com/helm/helm"
-    },
-    {
-      "description": "Bump Gitea as fast as possible - not only on weekends",
-      "matchDepNames": [
-        "go-gitea/gitea"
-      ],
-      "schedule": [
-        "at any time"
-      ]
-    }
-  ]
-}

renovate.json5

@@ -0,0 +1,132 @@
+{
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+  extends: [
+    'gitea>gitea/renovate-config',
+    ':automergeMinor',
+    'schedule:automergeDaily',
+    'schedule:weekends',
+  ],
+  labels: [
+    'kind/dependency',
+  ],
+  digest: {
+    automerge: true,
+  },
+  automergeStrategy: 'squash',
+  'git-submodules': {
+    enabled: true,
+  },
+  customManagers: [
+    {
+      description: 'Gitea-version of https://docs.renovatebot.com/presets-regexManagers/#regexmanagersgithubactionsversions',
+      customType: 'regex',
+      managerFilePatterns: [
+        '/.gitea/workflows/.+\\.ya?ml$/',
+      ],
+      matchStrings: [
+        '# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[a-z-0-9]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:\\s*["\']?(?<currentValue>.+?)["\']?\\s',
+      ],
+    },
+    {
+      description: 'Detect helm-unittest yaml schema file',
+      customType: 'regex',
+      managerFilePatterns: [
+        '/.vscode/settings\\.json$/',
+      ],
+      matchStrings: [
+        'https:\\/\\/raw\\.githubusercontent\\.com\\/(?<depName>[^\\s]+?)\\/(?<currentValue>v[0-9.]+?)\\/schema\\/helm-testsuite\\.json',
+      ],
+      datasourceTemplate: 'github-releases',
+    },
+    {
+      description: 'Automatically detect new Gitea releases',
+      customType: 'regex',
+      managerFilePatterns: [
+        '/(^|/)Chart\\.yaml$/',
+      ],
+      matchStrings: [
+        '# renovate datasource=(?<datasource>\\S+) depName=(?<depName>\\S+) extractVersion=(?<extractVersion>\\S+)\\nappVersion:\\s?(?<currentValue>\\S+)\\n',
+      ],
+    },
+  ],
+  lockFileMaintenance: {
+    "enabled": true,
+    "commitMessageAction": "update",
+    "commitMessageTopic": "lockfiles",
+    schedule: [
+      'at any time',
+    ]
+  },
+  packageRules: [
+    {
+      groupName: 'subcharts (minor & patch)',
+      matchManagers: [
+        'helmv3',
+      ],
+      matchUpdateTypes: [
+        'minor',
+        'patch',
+        'digest',
+      ],
+    },
+    {
+      groupName: 'bats testing framework',
+      matchManagers: [
+        'git-submodules',
+      ],
+      matchUpdateTypes: [
+        'minor',
+        'patch',
+        'digest',
+      ],
+    },
+    {
+      groupName: 'workflow dependencies (minor & patch)',
+      matchManagers: [
+        'github-actions',
+        'npm',
+        'custom.regex',
+      ],
+      matchUpdateTypes: [
+        'minor',
+        'patch',
+        'digest',
+      ],
+      matchFileNames: [
+        '!Chart.yaml',
+      ],
+    },
+    {
+      description: 'Update README.md on changes in values.yaml',
+      matchManagers: [
+        'helm-values',
+      ],
+      postUpgradeTasks: {
+        commands: [
+          'install-tool node',
+          'make readme',
+        ],
+        fileFilters: [
+          'README.md',
+        ],
+        executionMode: 'update',
+      },
+    },
+    {
+      description: 'Override changelog url for Helm image, to have release notes in our PRs',
+      matchDepNames: [
+        'alpine/helm',
+      ],
+      changelogUrl: 'https://github.com/helm/helm',
+    },
+    {
+      description: 'Bump Gitea as fast as possible - not only on weekends',
+      matchDepNames: [
+        'go-gitea/gitea',
+      ],
+      schedule: [
+        'at any time',
+      ],
+    },
+  ],
+}

scripts/act_runner/token.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+
+set -eu
+
+timeout_delay=15
+
+check_token() {
+  set +e
+
+  echo "Checking for existing token..."
+  token="$(kubectl get secret "$SECRET_NAME" -o jsonpath="{.data['token']}" 2> /dev/null)"
+  [ $? -ne 0 ] && return 1
+  [ -z "$token" ] && return 2
+  return 0
+}
+
+create_token() {
+  echo "Waiting for new token to be generated..."
+  begin=$(date +%s)
+  end=$((begin + timeout_delay))
+  while true; do
+    [ -f /data/actions/token ] && return 0
+    [ "$(date +%s)" -gt $end ] && return 1
+    sleep 5
+  done
+}
+
+store_token() {
+  echo "Storing the token in Kubernetes secret..."
+  kubectl patch secret "$SECRET_NAME" -p "{\"data\":{\"token\":\"$(base64 /data/actions/token | tr -d '\n')\"}}"
+}
+
+if check_token; then
+  echo "Key already in place, exiting."
+  exit
+fi
+
+if ! create_token; then
+  echo "Checking for an existing act runner token in secret $SECRET_NAME timed out after $timeout_delay"
+  exit 1
+fi
+
+store_token

scripts/init-containers/config/config_environment.sh

@@ -2,8 +2,7 @@
 set -euo pipefail
 
 function env2ini::log() {
-  # '%b' expands the \n escapes of the callers without treating the message itself as a format string
+  printf "${1}\n"
-  printf '%b\n' "${1}"
 }
 
 function env2ini::read_config_to_env() {
@@ -16,8 +15,7 @@ function env2ini::read_config_to_env() {
   fi
 
   # 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
-  local setting
+  local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
-  setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
 
   if [[ -z "${setting}" ]]; then
     env2ini::log '  ! invalid setting'
@@ -56,8 +54,7 @@ function env2ini::reload_preset_envs() {
     fi
 
     # 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
-    local setting
+    local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
-    setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
 
     if [[ -z "${setting}" ]]; then
       env2ini::log '  ! invalid setting'
@@ -78,13 +75,13 @@ function env2ini::reload_preset_envs() {
     export "${setting^^}=${value}"                           # '^^' makes the variable content uppercase
   done < "$TMP_EXISTING_ENVS_FILE"
 
-  rm "$TMP_EXISTING_ENVS_FILE"
+  rm $TMP_EXISTING_ENVS_FILE
 }
 
+
 function env2ini::process_config_file() {
   local config_file="${1}"
-  local section
+  local section="$(basename "${config_file}")"
-  section="$(basename "${config_file}")"
 
   if [[ $section == '_generals_' ]]; then
     env2ini::log "  [ini root]"
@@ -104,7 +101,7 @@ function env2ini::load_config_sources() {
   if [[ -d "${path}" ]]; then
     env2ini::log "Processing $(basename "${path}")..."
 
-    while read -r -d '' configFile; do
+    while read -d '' configFile; do
       env2ini::process_config_file "${configFile}"
     done < <(find "${path}" -type l -not -name '..data' -print0)
 
@@ -118,20 +115,16 @@ function env2ini::generate_initial_secrets() {
   #   - initially used to set up Gitea
   # Anyway, they won't harm existing app.ini files
 
-  GITEA__SECURITY__INTERNAL_TOKEN="$(gitea generate secret INTERNAL_TOKEN)"
+  export GITEA__SECURITY__INTERNAL_TOKEN=$(gitea generate secret INTERNAL_TOKEN)
-  GITEA__SECURITY__SECRET_KEY="$(gitea generate secret SECRET_KEY)"
+  export GITEA__SECURITY__SECRET_KEY=$(gitea generate secret SECRET_KEY)
-  GITEA__OAUTH2__JWT_SECRET="$(gitea generate secret JWT_SECRET)"
+  export GITEA__OAUTH2__JWT_SECRET=$(gitea generate secret JWT_SECRET)
-  GITEA__SERVER__LFS_JWT_SECRET="$(gitea generate secret LFS_JWT_SECRET)"
+  export GITEA__SERVER__LFS_JWT_SECRET=$(gitea generate secret LFS_JWT_SECRET)
-  export GITEA__SECURITY__INTERNAL_TOKEN \
-         GITEA__SECURITY__SECRET_KEY \
-         GITEA__OAUTH2__JWT_SECRET \
-         GITEA__SERVER__LFS_JWT_SECRET
 
   env2ini::log "...Initial secrets generated\n"
 }
 
 # save existing envs prior to script execution. Necessary to keep order of preexisting and custom envs
-env | (grep -e '^GITEA__' || [[ $? == 1 ]]) > "$TMP_EXISTING_ENVS_FILE"
+env | (grep -e '^GITEA__' || [[ $? == 1 ]]) > $TMP_EXISTING_ENVS_FILE
 
 # MUST BE CALLED BEFORE OTHER CONFIGURATION
 env2ini::generate_initial_secrets
@@ -145,7 +138,7 @@ env2ini::reload_preset_envs
 env2ini::log "=== All configuration sources loaded ===\n"
 
 # safety to prevent rewrite of secret keys if an app.ini already exists
-if [ -f "${GITEA_APP_INI}" ]; then
+if [ -f ${GITEA_APP_INI} ]; then
   env2ini::log 'An app.ini file already exists. To prevent overwriting secret keys, these settings are dropped and remain unchanged:'
   env2ini::log '  - security.INTERNAL_TOKEN'
   env2ini::log '  - security.SECRET_KEY'
@@ -158,4 +151,4 @@ if [ -f "${GITEA_APP_INI}" ]; then
   unset GITEA__SERVER__LFS_JWT_SECRET
 fi
 
-gitea config edit-ini --apply-env --config "$GITEA_APP_INI" --out "$GITEA_APP_INI"
+environment-to-ini -o $GITEA_APP_INI

templates/NOTES.txt

@@ -1,12 +1,5 @@
 1. Get the application URL by running these commands:
-{{- if .Values.route.enabled }}
+{{- if .Values.ingress.enabled }}
-  {{- if .Values.route.host }}
-  {{ include "gitea.public_protocol" . }}://{{ tpl .Values.route.host . }}{{ .Values.route.path }}
-  {{- else }}
-  export ROUTE_HOST=$(kubectl get route --namespace {{ .Release.Namespace }} {{ include "gitea.fullname" . }} -o jsonpath="{.spec.host}")
-  echo {{ include "gitea.public_protocol" . }}://$ROUTE_HOST{{ .Values.route.path }}
-  {{- end }}
-{{- else if .Values.ingress.enabled }}
 {{- range $host := .Values.ingress.hosts }}
   {{- range .paths }}
   http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}

templates/_backendTLSPolicies.tpl

@@ -1,30 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.backendTLSPolicy.annotations" -}}
-{{- with .Values.gatewayAPI.core.backendTLSPolicy.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* enabled */}}
-
-{{- define "gitea.backendTLSPolicy.enabled" -}}
-{{- if and .Values.gatewayAPI.enabled
-          .Values.gatewayAPI.core.backendTLSPolicy.enabled
--}}
-true
-{{- else -}}
-false
-{{- end -}}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.backendTLSPolicy.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.gatewayAPI.core.backendTLSPolicy.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}

templates/_clientSettingsPolicies.tpl

@@ -1,30 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.clientSettingsPolicies.annotations" -}}
-{{- with .Values.gatewayAPI.nginx.clientSettingsPolicies.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* enabled */}}
-
-{{- define "gitea.clientSettingsPolicies.enabled" -}}
-{{- if and .Values.gatewayAPI.enabled
-          .Values.gatewayAPI.nginx.clientSettingsPolicies.enabled
--}}
-true
-{{- else -}}
-false
-{{- end -}}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.clientSettingsPolicies.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.gatewayAPI.nginx.clientSettingsPolicies.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}

templates/_clusters.tpl

@@ -1,24 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.cluster.cloudnativePG.annotations" -}}
-{{- with .Values.cloudnativePG.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.cluster.cloudnativePG.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.cloudnativePG.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{/* names */}}
-
-{{- define "gitea.cluster.cloudnativePG.name" -}}
-{{ include "gitea.fullname" . }}-postgresql
-{{- end }}

templates/_deployments.tpl

@@ -1,38 +0,0 @@
-{{/* annotations */}}
-
-{{- define "gitea.deployment.annotations" -}}
-{{- with .Values.deployment.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* initContainers */}}
-
-{{- define "gitea.deployment.initContainers" -}}
-{{- $links := list "initAppIni" "initConfigureGPG" "initConfigureGitea" "initDirectories" }}
-{{- range $index, $entry := .Values.deployment.initContainers }}
-{{- if and (hasKey $entry "container") (hasKey $entry "link") }}
-{{- fail (printf "deployment.initContainers[%d]: `container` and `link` are mutually exclusive" $index) }}
-{{- else if hasKey $entry "container" }}
-{{- list $entry.container | toYaml | nindent 0 }}
-{{- else if hasKey $entry "link" }}
-{{- if not (has $entry.link $links) }}
-{{- fail (printf "deployment.initContainers[%d]: unknown link `%s`, expected one of: %s" $index $entry.link (join ", " $links)) }}
-{{- end }}
-{{- with include (printf "gitea.initContainer.%s" $entry.link) $ }}
-{{- nindent 0 . }}
-{{- end }}
-{{- else }}
-{{- fail (printf "deployment.initContainers[%d]: either `container` or `link` must be set" $index) }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.deployment.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.deployment.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}

templates/_helpers.tpl

@@ -43,25 +43,15 @@ Create chart name and version as used by the chart label.
 Create image name and tag used by the deployment.
 */}}
 {{- define "gitea.image" -}}
-{{- include "gitea.image.name" (list . .Values.deployment.gitea.image) -}}
+{{- $fullOverride := .Values.image.fullOverride | default "" -}}
-{{- end -}}
+{{- $registry := .Values.global.imageRegistry | default .Values.image.registry -}}
-
+{{- $repository := .Values.image.repository -}}
-{{/*
-Create image name and tag from an arbitrary `image` dict.
-Arguments: (list $root $image)
-*/}}
-{{- define "gitea.image.name" -}}
-{{- $root := index . 0 -}}
-{{- $image := index . 1 -}}
-{{- $fullOverride := $image.fullOverride | default "" -}}
-{{- $registry := $root.Values.global.imageRegistry | default $image.registry -}}
-{{- $repository := $image.repository -}}
 {{- $separator := ":" -}}
-{{- $tag := $image.tag | default $root.Chart.AppVersion | toString -}}
+{{- $tag := .Values.image.tag | default .Chart.AppVersion | toString -}}
-{{- $rootless := ternary "-rootless" "" ($image.rootless) -}}
+{{- $rootless := ternary "-rootless" "" (.Values.image.rootless) -}}
 {{- $digest := "" -}}
-{{- if $image.digest }}
+{{- if .Values.image.digest }}
-    {{- $digest = (printf "@%s" ($image.digest | toString)) -}}
+    {{- $digest = (printf "@%s" (.Values.image.digest | toString)) -}}
 {{- end -}}
 {{- if $fullOverride }}
     {{- printf "%s" $fullOverride -}}
@@ -86,73 +76,22 @@ imagePullSecrets:
 {{- end }}
 {{- end -}}
 
+
 {{/*
-Return true when OpenShift compatibility defaults should be rendered.
+Storage Class
-If openshift.enabled is unset, auto-detect via the SCC API.
 */}}
-{{- define "gitea.openshift.enabled" -}}
+{{- define "gitea.persistence.storageClass" -}}
-{{- if kindIs "bool" .Values.openshift.enabled -}}
+{{- $storageClass :=  (tpl ( default "" .Values.persistence.storageClass) .) | default (tpl ( default "" .Values.global.storageClass) .) }}
-{{ ternary "true" "false" .Values.openshift.enabled }}
+{{- if $storageClass }}
-{{- else if .Capabilities.APIVersions.Has "security.openshift.io/v1/SecurityContextConstraints" -}}
+storageClassName: {{ $storageClass | quote }}
-true
+{{- end }}
-{{- else -}}
-false
-{{- end -}}
 {{- end -}}
 
 {{/*
-Return the pod's hostUsers setting. Renders nothing unless explicitly set to a boolean.
+Common annotations
 */}}
-{{- define "gitea.hostUsers" -}}
+{{- define "gitea.annotations" -}}
-{{- if kindIs "bool" .Values.deployment.hostUsers -}}
+{{- end }}
-{{ ternary "true" "false" .Values.deployment.hostUsers }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Render pod securityContext. On non-OpenShift clusters an empty map defaults fsGroup to 1000.
-*/}}
-{{- define "gitea.deployment.securityContext" -}}
-{{- $securityContext := deepCopy .Values.deployment.securityContext -}}
-{{- if and (ne (include "gitea.openshift.enabled" . | trim) "true") (not (hasKey $securityContext "fsGroup")) -}}
-{{- $_ := set $securityContext "fsGroup" 1000 -}}
-{{- end -}}
-{{- if gt (len $securityContext) 0 -}}
-{{ toYaml $securityContext }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Render container securityContext with OpenShift restricted SCC defaults when enabled.
-*/}}
-{{- define "gitea.containerSecurityContext" -}}
-{{- $root := index . 0 -}}
-{{- $containerSecurityContext := deepCopy (index . 1) -}}
-{{- if eq (include "gitea.openshift.enabled" $root | trim) "true" -}}
-{{- $containerSecurityContext = mergeOverwrite (dict
-  "allowPrivilegeEscalation" false
-  "capabilities" (dict "drop" (list "ALL"))
-  "runAsNonRoot" true
-  "seccompProfile" (dict "type" "RuntimeDefault")
-) $containerSecurityContext -}}
-{{- end -}}
-{{- if gt (len $containerSecurityContext) 0 -}}
-{{ toYaml $containerSecurityContext }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Render the securityContext for init containers that execute Gitea/GPG commands.
-These default to runAsUser 1000 outside OpenShift to preserve existing behavior.
-*/}}
-{{- define "gitea.commandInitContainerSecurityContext" -}}
-{{- $root := index . 0 -}}
-{{- $containerSecurityContext := deepCopy (index . 1) -}}
-{{- if and (ne (include "gitea.openshift.enabled" $root | trim) "true") (not (hasKey $containerSecurityContext "runAsUser")) -}}
-{{- $_ := set $containerSecurityContext "runAsUser" 1000 -}}
-{{- end -}}
-{{- include "gitea.containerSecurityContext" (list $root $containerSecurityContext) -}}
-{{- end -}}
 
 {{/*
 Common labels
@@ -161,8 +100,17 @@ Common labels
 helm.sh/chart: {{ include "gitea.chart" . }}
 app: {{ include "gitea.name" . }}
 {{ include "gitea.selectorLabels" . }}
-app.kubernetes.io/version: {{ .Values.deployment.gitea.image.tag | default .Chart.AppVersion | quote }}
+app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
-version: {{ .Values.deployment.gitea.image.tag | default .Chart.AppVersion | quote }}
+version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{- define "gitea.labels.actRunner" -}}
+helm.sh/chart: {{ include "gitea.chart" . }}
+app: {{ include "gitea.name" . }}-act-runner
+{{ include "gitea.selectorLabels.actRunner" . }}
+app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
+version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end -}}
 
@@ -174,27 +122,46 @@ app.kubernetes.io/name: {{ include "gitea.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
 
-{{- define "cloudnativePG.dns" -}}
+{{- define "gitea.selectorLabels.actRunner" -}}
-{{- if .Values.cloudnativePG.enabled -}}
+app.kubernetes.io/name: {{ include "gitea.name" . }}-act-runner
-{{- printf "%s-rw.%s.svc.%s:5432" (include "gitea.cluster.cloudnativePG.name" .) (.Values.namespace | default .Release.Namespace) .Values.clusterDomain -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{- define "postgresql-ha.dns" -}}
+{{- if (index .Values "postgresql-ha").enabled -}}
+{{- printf "%s-postgresql-ha-pgpool.%s.svc.%s:%g" .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "postgresql-ha" "service" "ports" "postgresql") -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "postgresql.dns" -}}
+{{- if (index .Values "postgresql").enabled -}}
+{{- printf "%s-postgresql.%s.svc.%s:%g" .Release.Name .Release.Namespace .Values.clusterDomain .Values.postgresql.global.postgresql.service.ports.postgresql -}}
 {{- end -}}
 {{- end -}}
 
 {{- define "valkey.dns" -}}
-{{- if (index .Values "valkey").enabled -}}
+{{- if and ((index .Values "valkey-cluster").enabled) ((index .Values "valkey").enabled) -}}
-{{- printf "redis://:%s@%s-valkey.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index (index .Values "valkey").auth.aclUsers "default").password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey").service.port -}}
+{{- fail "valkey and valkey-cluster cannot be enabled at the same time. Please only choose one." -}}
+{{- else if (index .Values "valkey-cluster").enabled -}}
+{{- printf "redis+cluster://:%s@%s-valkey-cluster-headless.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index .Values "valkey-cluster").global.valkey.password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey-cluster").service.ports.valkey -}}
+{{- else if (index .Values "valkey").enabled -}}
+{{- printf "redis://:%s@%s-valkey-headless.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index .Values "valkey").global.valkey.password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey").master.service.ports.valkey -}}
 {{- end -}}
 {{- end -}}
 
 {{- define "valkey.port" -}}
-{{- if (index .Values "valkey").enabled -}}
+{{- if (index .Values "valkey-cluster").enabled -}}
-{{ (index .Values "valkey").service.port }}
+{{ (index .Values "valkey-cluster").service.ports.valkey }}
+{{- else if (index .Values "valkey").enabled -}}
+{{ (index .Values "valkey").master.service.ports.valkey }}
 {{- end -}}
 {{- end -}}
 
 {{- define "valkey.servicename" -}}
-{{- if (index .Values "valkey").enabled -}}
+{{- if (index .Values "valkey-cluster").enabled -}}
-{{- printf "%s-valkey.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
+{{- printf "%s-valkey-cluster-headless.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
+{{- else if (index .Values "valkey").enabled -}}
+{{- printf "%s-valkey-headless.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
 {{- end -}}
 {{- end -}}
 
@@ -202,18 +169,6 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- printf "%s-http.%s.svc.%s" (include "gitea.fullname" .) .Release.Namespace .Values.clusterDomain -}}
 {{- end -}}
 
-{{- define "gitea.public_hostname" -}}
-{{- if and .Values.route.enabled .Values.route.host -}}
-{{ tpl .Values.route.host . }}
-{{- else if and .Values.gatewayAPI.enabled .Values.gatewayAPI.core.httpRoute.enabled (gt (len .Values.gatewayAPI.core.httpRoute.hostnames) 0) -}}
-{{ tpl (index .Values.gatewayAPI.core.httpRoute.hostnames 0) $ }}
-{{- else if gt (len .Values.ingress.hosts) 0 -}}
-{{ tpl (index .Values.ingress.hosts 0).host $ }}
-{{- else -}}
-{{ include "gitea.default_domain" . }}
-{{- end -}}
-{{- end -}}
-
 {{- define "gitea.ldap_settings" -}}
 {{- $idx := index . 0 }}
 {{- $values := index . 1 }}
@@ -264,11 +219,7 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
 
 {{- define "gitea.public_protocol" -}}
-{{- if and .Values.route.enabled .Values.route.tls.termination -}}
+{{- if and .Values.ingress.enabled (gt (len .Values.ingress.tls) 0) -}}
-https
-{{- else if and .Values.ingress.enabled (gt (len .Values.ingress.tls) 0) -}}
-https
-{{- else if and .Values.gatewayAPI.enabled .Values.gatewayAPI.core.httpRoute.enabled .Values.gatewayAPI.core.httpRoute.tls -}}
 https
 {{- else -}}
 {{ .Values.gitea.config.server.PROTOCOL }}
@@ -282,7 +233,7 @@ https
   {{- $generals := list -}}
   {{- $inlines := dict -}}
 
-  {{- range $key, $value := .Values.gitea.config }}
+  {{- range $key, $value := .Values.gitea.config  }}
     {{- if kindIs "map" $value }}
       {{- if gt (len $value) 0 }}
         {{- $section := default list (get $inlines $key) -}}
@@ -361,7 +312,7 @@ https
     {{- $_ := set .Values.gitea.config.metrics "TOKEN" .Values.gitea.metrics.token -}}
   {{- end -}}
   {{- /* valkey queue */ -}}
-  {{- if (index .Values "valkey").enabled -}}
+  {{- if or ((index .Values "valkey-cluster").enabled) ((index .Values "valkey").enabled) -}}
     {{- $_ := set .Values.gitea.config.queue "TYPE" "redis" -}}
     {{- $_ := set .Values.gitea.config.queue "CONN_STR" (include "valkey.dns" .) -}}
     {{- $_ := set .Values.gitea.config.session "PROVIDER" "redis" -}}
@@ -401,7 +352,11 @@ https
     {{- $_ := set .Values.gitea.config.server "PROTOCOL" "http" -}}
   {{- end -}}
   {{- if not (.Values.gitea.config.server.DOMAIN) -}}
-    {{- $_ := set .Values.gitea.config.server "DOMAIN" (include "gitea.public_hostname" .) -}}
+    {{- if gt (len .Values.ingress.hosts) 0 -}}
+      {{- $_ := set .Values.gitea.config.server "DOMAIN" ( tpl (index .Values.ingress.hosts 0).host $) -}}
+    {{- else -}}
+      {{- $_ := set .Values.gitea.config.server "DOMAIN" (include "gitea.default_domain" .) -}}
+    {{- end -}}
   {{- end -}}
   {{- if not .Values.gitea.config.server.ROOT_URL -}}
     {{- $_ := set .Values.gitea.config.server "ROOT_URL" (printf "%s://%s" (include "gitea.public_protocol" .) .Values.gitea.config.server.DOMAIN) -}}
@@ -413,7 +368,7 @@ https
     {{- $_ := set .Values.gitea.config.server "SSH_PORT" .Values.service.ssh.port -}}
   {{- end -}}
   {{- if not (hasKey .Values.gitea.config.server "START_SSH_SERVER") -}}
-    {{- if .Values.deployment.gitea.image.rootless -}}
+    {{- if .Values.image.rootless -}}
       {{- $_ := set .Values.gitea.config.server "START_SSH_SERVER" "true" -}}
       {{- if not (hasKey .Values.gitea.config.server "SSH_LISTEN_PORT") -}}
         {{- if not .Values.gitea.config.server.SSH_LISTEN_PORT -}}
@@ -435,23 +390,52 @@ https
 {{- end -}}
 
 {{- define "gitea.inline_configuration.defaults.database" -}}
-  {{- if .Values.cloudnativePG.enabled -}}
+  {{- if (index .Values "postgresql-ha" "enabled") -}}
-    {{/* PASSWD is injected as an env-to-ini variable from the credentials Secret. */}}
     {{- $_ := set .Values.gitea.config.database "DB_TYPE"   "postgres" -}}
     {{- if not (.Values.gitea.config.database.HOST) -}}
-      {{- $_ := set .Values.gitea.config.database "HOST"      (include "cloudnativePG.dns" .) -}}
+      {{- $_ := set .Values.gitea.config.database "HOST"      (include "postgresql-ha.dns" .) -}}
     {{- end -}}
-    {{- $_ := set .Values.gitea.config.database "NAME"      .Values.cloudnativePG.credentials.database -}}
+    {{- $_ := set .Values.gitea.config.database "NAME"      (index .Values "postgresql-ha" "global" "postgresql" "database") -}}
-    {{- $_ := set .Values.gitea.config.database "USER"      .Values.cloudnativePG.credentials.username -}}
+    {{- $_ := set .Values.gitea.config.database "USER"      (index .Values "postgresql-ha" "global" "postgresql" "username") -}}
+    {{- $_ := set .Values.gitea.config.database "PASSWD"    (index .Values "postgresql-ha" "global" "postgresql" "password") -}}
+  {{- end -}}
+  {{- if (index .Values "postgresql" "enabled") -}}
+    {{- $_ := set .Values.gitea.config.database "DB_TYPE"   "postgres" -}}
+    {{- if not (.Values.gitea.config.database.HOST) -}}
+      {{- $_ := set .Values.gitea.config.database "HOST"      (include "postgresql.dns" .) -}}
+    {{- end -}}
+    {{- $_ := set .Values.gitea.config.database "NAME"      .Values.postgresql.global.postgresql.auth.database -}}
+    {{- $_ := set .Values.gitea.config.database "USER"      .Values.postgresql.global.postgresql.auth.username -}}
+    {{- $_ := set .Values.gitea.config.database "PASSWD"    .Values.postgresql.global.postgresql.auth.password -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "gitea.init-additional-mounts" -}}
+  {{- /* Honor the deprecated extraVolumeMounts variable when defined */ -}}
+  {{- if gt (len .Values.extraInitVolumeMounts) 0 -}}
+    {{- toYaml .Values.extraInitVolumeMounts -}}
+  {{- else if gt (len .Values.extraVolumeMounts) 0 -}}
+    {{- toYaml .Values.extraVolumeMounts -}}
   {{- end -}}
 {{- end -}}
 
 {{- define "gitea.container-additional-mounts" -}}
-  {{- if gt (len .Values.deployment.gitea.volumeMounts) 0 -}}
+  {{- /* Honor the deprecated extraVolumeMounts variable when defined */ -}}
-    {{- toYaml .Values.deployment.gitea.volumeMounts -}}
+  {{- if gt (len .Values.extraContainerVolumeMounts) 0 -}}
+    {{- toYaml .Values.extraContainerVolumeMounts -}}
+  {{- else if gt (len .Values.extraVolumeMounts) 0 -}}
+    {{- toYaml .Values.extraVolumeMounts -}}
   {{- end -}}
 {{- end -}}
 
+{{- define "gitea.gpg-key-secret-name" -}}
+{{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }}
+{{- end -}}
+
+{{- define "gitea.serviceAccountName" -}}
+{{ .Values.serviceAccount.name | default (include "gitea.fullname" .) }}
+{{- end -}}
+
 {{- define "ingress.annotations" -}}
   {{- if .Values.ingress.annotations }}
   annotations:
@@ -464,6 +448,14 @@ https
   {{- end }}
 {{- end -}}
 
+{{- define "gitea.admin.passwordMode" -}}
+{{- if has .Values.gitea.admin.passwordMode (tuple "keepUpdated" "initialOnlyNoReset" "initialOnlyRequireReset") -}}
+{{ .Values.gitea.admin.passwordMode }}
+{{- else -}}
+{{ printf "gitea.admin.passwordMode must be set to one of 'keepUpdated', 'initialOnlyNoReset', or 'initialOnlyRequireReset'. Received: '%s'" .Values.gitea.admin.passwordMode | fail }}
+{{- end -}}
+{{- end -}}
+
 {{/* Create a functioning probe object for rendering. Given argument must be either a livenessProbe, readinessProbe, or startupProbe */}}
 {{- define "gitea.deployment.probe" -}}
   {{- $probe := unset . "enabled" -}}
@@ -481,3 +473,7 @@ https
   {{- end -}}
   {{- toYaml $probe -}}
 {{- end -}}
+
+{{- define "gitea.metrics-secret-name" -}}
+{{ default (printf "%s-metrics-secret" (include "gitea.fullname" .)) }}
+{{- end -}}

templates/_httpRoutes.tpl

@@ -1,30 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.httpRoute.annotations" -}}
-{{- with .Values.gatewayAPI.core.httpRoute.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* enabled */}}
-
-{{- define "gitea.httpRoute.enabled" -}}
-{{- if and .Values.gatewayAPI.enabled
-          .Values.gatewayAPI.core.httpRoute.enabled
--}}
-true
-{{- else -}}
-false
-{{- end -}}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.httpRoute.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.gatewayAPI.core.httpRoute.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}

templates/_ingresses.tpl

@@ -1,32 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.ingress.annotations" -}}
-{{- with .Values.ingress.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.ingress.enabled" -}}
-{{- if and .Values.ingress.enabled .Values.service.http.enabled -}}
-true
-{{- else -}}
-false
-{{- end }}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.ingress.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.ingress.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{/* name */}}
-
-{{- define "gitea.ingress.name" -}}
-{{ include "gitea.fullname" . }}
-{{- end }}

templates/_initContainers.tpl

@@ -1,305 +0,0 @@
-{{/* initDirectories */}}
-
-{{- define "gitea.initContainer.initDirectories" -}}
-{{- $config := .Values.deployment.initDirectories -}}
-- name: init-directories
-  image: "{{ include "gitea.image.name" (list . $config.image) }}"
-  imagePullPolicy: {{ $config.image.pullPolicy }}
-  command:
-    - "{{ .Values.initContainersScriptsVolumeMountPath }}/init_directory_structure.sh"
-  env:
-    - name: GITEA_APP_INI
-      value: /data/gitea/conf/app.ini
-    - name: GITEA_CUSTOM
-      value: /data/gitea
-    - name: GITEA_WORK_DIR
-      value: /data
-    - name: GITEA_TEMP
-      value: /tmp/gitea
-    {{- if .Values.deployment.gitea.env }}
-    {{- toYaml .Values.deployment.gitea.env | nindent 4 }}
-    {{- end }}
-    {{- if .Values.secrets.gpg.enabled }}
-    - name: GNUPGHOME
-      valueFrom:
-        secretKeyRef:
-          name: {{ include "gitea.secret.gpg.name" . }}
-          key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
-    {{- end }}
-    {{- with $config.env }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- with $config.envFrom }}
-  envFrom:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  volumeMounts:
-    - name: init
-      mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
-    - name: temp
-      mountPath: /tmp
-    - name: data
-      mountPath: /data
-      {{- if .Values.persistence.new.subPath }}
-      subPath: {{ .Values.persistence.new.subPath }}
-      {{- end }}
-    {{- with $config.volumeMounts }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- with (include "gitea.containerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
-  securityContext:
-    {{- . | nindent 4 }}
-  {{- end }}
-  resources:
-    {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
-{{- end }}
-
-{{/* initAppIni */}}
-
-{{- define "gitea.initContainer.initAppIni" -}}
-{{- $config := .Values.deployment.initAppIni -}}
-- name: init-app-ini
-  image: "{{ include "gitea.image.name" (list . $config.image) }}"
-  imagePullPolicy: {{ $config.image.pullPolicy }}
-  {{- if .Values.gitea.extraEnvSourceFile }}
-  command:
-  - "/bin/bash"
-  - "-c"
-  args:
-  - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
-  {{- else }}
-  command:
-  - "{{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
-  {{- end }}
-  env:
-    - name: GITEA_APP_INI
-      value: /data/gitea/conf/app.ini
-    - name: GITEA_CUSTOM
-      value: /data/gitea
-    - name: GITEA_WORK_DIR
-      value: /data
-    - name: GITEA_TEMP
-      value: /tmp/gitea
-    - name: TMP_EXISTING_ENVS_FILE
-      value: /tmp/existing-envs
-    - name: ENV_TO_INI_MOUNT_POINT
-      value: /env-to-ini-mounts
-    {{- if .Values.cloudnativePG.enabled }}
-    - name: GITEA__database__PASSWD
-      valueFrom:
-        secretKeyRef:
-          key: {{ include "gitea.secret.cloudnativePG.passwordKey" . }}
-          name: {{ include "gitea.secret.cloudnativePG.name" . }}
-    {{- end }}
-    {{- if .Values.deployment.gitea.env }}
-    {{- toYaml .Values.deployment.gitea.env | nindent 4 }}
-    {{- end }}
-    {{- if .Values.gitea.additionalConfigFromEnvs }}
-    {{- tpl (toYaml .Values.gitea.additionalConfigFromEnvs) $ | nindent 4 }}
-    {{- end }}
-    {{- with $config.env }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- with $config.envFrom }}
-  envFrom:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  volumeMounts:
-    - name: config
-      mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
-    - name: temp
-      mountPath: /tmp
-    - name: data
-      mountPath: /data
-      {{- if .Values.persistence.new.subPath }}
-      subPath: {{ .Values.persistence.new.subPath }}
-      {{- end }}
-    - name: inline-config-sources
-      mountPath: /env-to-ini-mounts/inlines/
-    {{- range $idx, $value := .Values.gitea.additionalConfigSources }}
-    - name: additional-config-sources-{{ $idx }}
-      mountPath: "/env-to-ini-mounts/additionals/{{ $idx }}/"
-    {{- end }}
-    {{- with $config.volumeMounts }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- with (include "gitea.containerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
-  securityContext:
-    {{- . | nindent 4 }}
-  {{- end }}
-  resources:
-    {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
-{{- end }}
-
-{{/* initConfigureGPG */}}
-
-{{- define "gitea.initContainer.initConfigureGPG" -}}
-{{- $config := .Values.deployment.initConfigureGPG -}}
-{{- if .Values.secrets.gpg.enabled -}}
-- name: configure-gpg
-  image: "{{ include "gitea.image.name" (list . $config.image) }}"
-  {{- if .Values.gitea.extraEnvSourceFile }}
-  command:
-  - "/bin/bash"
-  - "-c"
-  args:
-  - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
-  {{- else }}
-  command:
-  - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
-  {{- end }}
-  imagePullPolicy: {{ $config.image.pullPolicy }}
-  {{- with (include "gitea.commandInitContainerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
-  securityContext:
-    {{- . | nindent 4 }}
-  {{- end }}
-  env:
-    - name: GNUPGHOME
-      valueFrom:
-        secretKeyRef:
-          name: {{ include "gitea.secret.gpg.name" . }}
-          key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
-    - name: TMP_RAW_GPG_KEY
-      value: /raw/private.asc
-    {{- with $config.env }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- with $config.envFrom }}
-  envFrom:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  volumeMounts:
-    - name: init
-      mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
-    - name: data
-      mountPath: /data
-      {{- if .Values.persistence.new.subPath }}
-      subPath: {{ .Values.persistence.new.subPath }}
-      {{- end }}
-    - name: gpg-private-key
-      mountPath: /raw
-      readOnly: true
-    {{- with $config.volumeMounts }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  resources:
-    {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
-{{- end }}
-{{- end }}
-
-{{/* initConfigureGitea */}}
-
-{{- define "gitea.initContainer.initConfigureGitea" -}}
-{{- $config := .Values.deployment.initConfigureGitea -}}
-- name: configure-gitea
-  image: "{{ include "gitea.image.name" (list . $config.image) }}"
-  {{- if .Values.gitea.extraEnvSourceFile }}
-  command:
-  - "/bin/bash"
-  - "-c"
-  args:
-  - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
-  {{- else }}
-  command:
-  - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
-  {{- end }}
-  imagePullPolicy: {{ $config.image.pullPolicy }}
-  {{- with (include "gitea.commandInitContainerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
-  securityContext:
-    {{- . | nindent 4 }}
-  {{- end }}
-  env:
-    - name: GITEA_APP_INI
-      value: /data/gitea/conf/app.ini
-    - name: GITEA_CUSTOM
-      value: /data/gitea
-    - name: GITEA_WORK_DIR
-      value: /data
-    - name: GITEA_TEMP
-      value: /tmp/gitea
-    {{- if $config.image.rootless }}
-    - name: HOME
-      value: /data/gitea/git
-    {{- end }}
-    {{- if .Values.gitea.ldap }}
-    {{- range $idx, $value := .Values.gitea.ldap }}
-    {{- if $value.existingSecret }}
-    - name: GITEA_LDAP_BIND_DN_{{ $idx }}
-      valueFrom:
-        secretKeyRef:
-          key:  bindDn
-          name: {{ $value.existingSecret }}
-    - name: GITEA_LDAP_PASSWORD_{{ $idx }}
-      valueFrom:
-        secretKeyRef:
-          key:  bindPassword
-          name: {{ $value.existingSecret }}
-    {{- else }}
-    - name: GITEA_LDAP_BIND_DN_{{ $idx }}
-      value: {{ $value.bindDn | quote }}
-    - name: GITEA_LDAP_PASSWORD_{{ $idx }}
-      value: {{ $value.bindPassword | quote }}
-    {{- end }}
-    {{- end }}
-    {{- end }}
-    {{- if .Values.gitea.oauth }}
-    {{- range $idx, $value := .Values.gitea.oauth }}
-    {{- if $value.existingSecret }}
-    - name: GITEA_OAUTH_KEY_{{ $idx }}
-      valueFrom:
-        secretKeyRef:
-          key:  key
-          name: {{ $value.existingSecret }}
-    - name: GITEA_OAUTH_SECRET_{{ $idx }}
-      valueFrom:
-        secretKeyRef:
-          key:  secret
-          name: {{ $value.existingSecret }}
-    {{- end }}
-    {{- end }}
-    {{- end }}
-    {{- if .Values.secrets.admin.enabled }}
-    - name: GITEA_ADMIN_USERNAME
-      valueFrom:
-        secretKeyRef:
-          key: {{ include "gitea.secret.admin.usernameKey" . }}
-          name: {{ include "gitea.secret.admin.name" . }}
-    - name: GITEA_ADMIN_PASSWORD
-      valueFrom:
-        secretKeyRef:
-          key: {{ include "gitea.secret.admin.passwordKey" . }}
-          name: {{ include "gitea.secret.admin.name" . }}
-    - name: GITEA_ADMIN_EMAIL
-      valueFrom:
-        secretKeyRef:
-          key: {{ include "gitea.secret.admin.emailKey" . }}
-          name: {{ include "gitea.secret.admin.name" . }}
-    - name: GITEA_ADMIN_PASSWORD_MODE
-      value: {{ include "gitea.secret.admin.passwordMode" $ }}
-    {{- end }}
-    {{- if .Values.deployment.gitea.env }}
-    {{- toYaml .Values.deployment.gitea.env | nindent 4 }}
-    {{- end }}
-    {{- with $config.env }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- with $config.envFrom }}
-  envFrom:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  volumeMounts:
-    - name: init
-      mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
-    - name: temp
-      mountPath: /tmp
-    - name: data
-      mountPath: /data
-      {{- if .Values.persistence.new.subPath }}
-      subPath: {{ .Values.persistence.new.subPath }}
-      {{- end }}
-    {{- with $config.volumeMounts }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  resources:
-    {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
-{{- end }}

templates/_networkPolicy.tpl

@@ -0,0 +1,19 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "gitea.networkPolicy.annotations" -}}
+{{ include "gitea.annotations" . }}
+{{- if .Values.networkPolicy.annotations }}
+{{ toYaml .Values.networkPolicy.annotations }}
+{{- end }}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "gitea.networkPolicy.labels" -}}
+{{ include "gitea.labels" . }}
+{{- if .Values.networkPolicy.labels }}
+{{ toYaml .Values.networkPolicy.labels }}
+{{- end }}
+{{- end }}

templates/_persistentVolumeClaims.tpl

@@ -1,38 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.persistentVolumeClaim.annotations" -}}
-{{- with .Values.persistence.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* enabled */}}
-
-{{- define "gitea.persistentVolumeClaim.enabled" -}}
-{{- if and .Values.persistence.enabled (not .Values.persistence.existingPersistentVolumeClaim.enabled) -}}
-true
-{{- else -}}
-false
-{{- end }}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.persistentVolumeClaim.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.persistence.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{/* name */}}
-
-{{- define "gitea.persistentVolumeClaim.name" -}}
-{{- if .Values.persistence.existingPersistentVolumeClaim.enabled -}}
-{{ required "persistence.existingPersistentVolumeClaim.persistentVolumeClaimName is required when persistence.existingPersistentVolumeClaim.enabled is true" .Values.persistence.existingPersistentVolumeClaim.persistentVolumeClaimName }}
-{{- else -}}
-{{ include "gitea.fullname" . }}
-{{- end }}
-{{- end }}

templates/_pod.tpl

@@ -0,0 +1,17 @@
+---
+
+{{/* labels */}}
+
+{{- define "gitea.pod.labels" -}}
+{{- include "gitea.labels" . }}
+{{- if .Values.deployment.labels }}
+{{ toYaml .Values.deployment.labels }}
+{{- end }}
+{{- end }}
+
+{{- define "gitea.pod.selectorLabels" -}}
+{{- include "gitea.selectorLabels" . }}
+{{- if .Values.deployment.labels }}
+{{ toYaml .Values.deployment.labels }}
+{{- end }}
+{{- end }}

templates/_pods.tpl

@@ -1,57 +0,0 @@
----
-
-{{/* annotations */}}
-
-{{- define "gitea.pod.annotations" -}}
-
-{{/* secret - admin */}}
-{{- if and .Values.secrets.admin.enabled .Values.secrets.admin.addSHASumAnnotation }}
-checksum/admin: {{ include "gitea.secret.checksum" (list . "admin") }}
-{{- end }}
-
-{{/* secret - cloudnativePG */}}
-{{- if and .Values.cloudnativePG.enabled .Values.cloudnativePG.credentials.addSHASumAnnotation }}
-checksum/cloudnativePG: {{ include "gitea.secret.checksum" (list . "cloudnativePG") }}
-{{- end }}
-
-{{/* secret - config */}}
-{{- if and .Values.secrets.config.enabled .Values.secrets.config.addSHASumAnnotation }}
-checksum/config: {{ include "gitea.secret.checksum" (list . "config") }}
-{{- end }}
-
-{{/* secret - gpg */}}
-{{- if and .Values.secrets.gpg.enabled .Values.secrets.gpg.addSHASumAnnotation }}
-checksum/gpg: {{ include "gitea.secret.checksum" (list . "gpg") }}
-{{- end }}
-
-{{/* secret - init */}}
-{{- if and .Values.secrets.init.enabled .Values.secrets.init.addSHASumAnnotation }}
-checksum/init: {{ include "gitea.secret.checksum" (list . "init") }}
-{{- end }}
-
-{{/* secret - inlineConfig */}}
-{{- if and .Values.secrets.inlineConfig.enabled .Values.secrets.inlineConfig.addSHASumAnnotation }}
-checksum/inlineConfig: {{ include "gitea.secret.checksum" (list . "inlineConfig") }}
-{{- end }}
-
-{{/* secret - metrics */}}
-{{- if and .Values.secrets.metrics.enabled .Values.secrets.metrics.addSHASumAnnotation }}
-checksum/metrics: {{ include "gitea.secret.checksum" (list . "metrics") }}
-{{- end }}
-
-{{/* secret - ldap */}}
-{{- range $idx, $value := .Values.gitea.ldap }}
-checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }}
-{{- end }}
-
-{{/* secret - oauth */}}
-{{- range $idx, $value := .Values.gitea.oauth }}
-checksum/oauth_{{ $idx }}: {{ include "gitea.oauth_settings" (list $idx $value) | sha256sum }}
-{{- end }}
-
-{{/* custom pod annotations */}}
-{{- with .Values.gitea.podAnnotations }}
-{{ toYaml . }}
-{{- end }}
-
-{{- end }}

templates/_secrets.tpl

@@ -1,239 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.secret.admin.annotations" -}}
-{{- with .Values.secrets.admin.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.cloudnativePG.annotations" -}}
-{{- with .Values.cloudnativePG.credentials.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.config.annotations" -}}
-{{- with .Values.secrets.config.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.gpg.annotations" -}}
-{{- with .Values.secrets.gpg.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.init.annotations" -}}
-{{- with .Values.secrets.init.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.inlineConfig.annotations" -}}
-{{- with .Values.secrets.inlineConfig.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.metrics.annotations" -}}
-{{- with .Values.secrets.metrics.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* checksums */}}
-
-{{/*
-SHA sum of a Secret, used to trigger a rollout whenever its content changes.
-User-provided Secrets are looked up in the cluster, chart-managed ones are rendered, because the
-cluster still holds their pre-upgrade state.
-Arguments: (list $root $key)
-*/}}
-{{- define "gitea.secret.checksum" -}}
-{{- $root := index . 0 -}}
-{{- $key := index . 1 -}}
-{{- $config := index $root.Values.secrets $key -}}
-{{- if eq $key "cloudnativePG" -}}
-{{- $config = $root.Values.cloudnativePG.credentials -}}
-{{- end -}}
-{{- if $config.existingSecret.enabled -}}
-{{- $namespace := $root.Values.namespace | default $root.Release.Namespace -}}
-{{- $name := include (printf "gitea.secret.%s.name" $key) $root -}}
-{{- lookup "v1" "Secret" $namespace $name | toYaml | sha256sum -}}
-{{- else -}}
-{{- include (printf "%s/secret_%s.yaml" $root.Template.BasePath $key) $root | sha256sum -}}
-{{- end -}}
-{{- end }}
-
-
-{{/* labels */}}
-
-{{- define "gitea.secret.admin.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.secrets.admin.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.cloudnativePG.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.cloudnativePG.credentials.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.config.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.secrets.config.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.gpg.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.secrets.gpg.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.init.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.secrets.init.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.inlineConfig.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.secrets.inlineConfig.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.metrics.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.secrets.metrics.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{/* names */}}
-
-{{- define "gitea.secret.admin.name" -}}
-{{- if .Values.secrets.admin.existingSecret.enabled -}}
-{{ required "`secrets.admin.existingSecret.secretName` must be set when `secrets.admin.existingSecret.enabled` is enabled" .Values.secrets.admin.existingSecret.secretName }}
-{{- else -}}
-{{ include "gitea.fullname" . }}-admin
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.cloudnativePG.name" -}}
-{{- if .Values.cloudnativePG.credentials.existingSecret.enabled -}}
-{{ required "`cloudnativePG.credentials.existingSecret.secretName` must be set when `cloudnativePG.credentials.existingSecret.enabled` is enabled" .Values.cloudnativePG.credentials.existingSecret.secretName }}
-{{- else -}}
-{{ include "gitea.cluster.cloudnativePG.name" . }}-app
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.config.name" -}}
-{{- if .Values.secrets.config.existingSecret.enabled -}}
-{{ required "`secrets.config.existingSecret.secretName` must be set when `secrets.config.existingSecret.enabled` is enabled" .Values.secrets.config.existingSecret.secretName }}
-{{- else -}}
-{{ include "gitea.fullname" . }}-config
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.gpg.name" -}}
-{{- if .Values.secrets.gpg.existingSecret.enabled -}}
-{{ required "`secrets.gpg.existingSecret.secretName` must be set when `secrets.gpg.existingSecret.enabled` is enabled" .Values.secrets.gpg.existingSecret.secretName }}
-{{- else -}}
-{{ include "gitea.fullname" . }}-gpg-key
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.init.name" -}}
-{{- if .Values.secrets.init.existingSecret.enabled -}}
-{{ required "`secrets.init.existingSecret.secretName` must be set when `secrets.init.existingSecret.enabled` is enabled" .Values.secrets.init.existingSecret.secretName }}
-{{- else -}}
-{{ include "gitea.fullname" . }}-init
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.inlineConfig.name" -}}
-{{- if .Values.secrets.inlineConfig.existingSecret.enabled -}}
-{{ required "`secrets.inlineConfig.existingSecret.secretName` must be set when `secrets.inlineConfig.existingSecret.enabled` is enabled" .Values.secrets.inlineConfig.existingSecret.secretName }}
-{{- else -}}
-{{ include "gitea.fullname" . }}-inline-config
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.metrics.name" -}}
-{{- if .Values.secrets.metrics.existingSecret.enabled -}}
-{{ required "`secrets.metrics.existingSecret.secretName` must be set when `secrets.metrics.existingSecret.enabled` is enabled" .Values.secrets.metrics.existingSecret.secretName }}
-{{- else -}}
-{{ include "gitea.fullname" . }}-metrics
-{{- end -}}
-{{- end }}
-
-{{/* keys */}}
-
-{{- define "gitea.secret.admin.emailKey" -}}
-{{- if .Values.secrets.admin.existingSecret.enabled -}}
-{{ .Values.secrets.admin.existingSecret.emailKey }}
-{{- else -}}
-email
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.admin.passwordKey" -}}
-{{- if .Values.secrets.admin.existingSecret.enabled -}}
-{{ .Values.secrets.admin.existingSecret.passwordKey }}
-{{- else -}}
-password
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.admin.usernameKey" -}}
-{{- if .Values.secrets.admin.existingSecret.enabled -}}
-{{ .Values.secrets.admin.existingSecret.usernameKey }}
-{{- else -}}
-username
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.cloudnativePG.passwordKey" -}}
-{{- if .Values.cloudnativePG.credentials.existingSecret.enabled -}}
-{{ .Values.cloudnativePG.credentials.existingSecret.passwordKey }}
-{{- else -}}
-password
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.gpg.gpgHomeKey" -}}
-{{- if .Values.secrets.gpg.existingSecret.enabled -}}
-{{ .Values.secrets.gpg.existingSecret.gpgHomeKey }}
-{{- else -}}
-gpgHome
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.gpg.privateKeyKey" -}}
-{{- if .Values.secrets.gpg.existingSecret.enabled -}}
-{{ .Values.secrets.gpg.existingSecret.privateKeyKey }}
-{{- else -}}
-privateKey
-{{- end -}}
-{{- end }}
-
-{{/* misc */}}
-
-{{- define "gitea.secret.admin.passwordMode" -}}
-{{- if has .Values.secrets.admin.passwordMode (tuple "keepUpdated" "initialOnlyNoReset" "initialOnlyRequireReset") -}}
-{{ .Values.secrets.admin.passwordMode }}
-{{- else -}}
-{{ printf "`secrets.admin.passwordMode` must be set to one of 'keepUpdated', 'initialOnlyNoReset', or 'initialOnlyRequireReset'. Received: '%s'" .Values.secrets.admin.passwordMode | fail }}
-{{- end -}}
-{{- end }}

templates/_serviceAccounts.tpl

@@ -1,38 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.serviceAccount.annotations" -}}
-{{- with .Values.serviceAccount.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* enabled */}}
-
-{{- define "gitea.serviceAccount.enabled" -}}
-{{- if and .Values.serviceAccount.enabled (not .Values.serviceAccount.existingServiceAccount.enabled) -}}
-true
-{{- else -}}
-false
-{{- end }}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.serviceAccount.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.serviceAccount.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{/* name */}}
-
-{{- define "gitea.serviceAccount.name" -}}
-{{- if .Values.serviceAccount.existingServiceAccount.enabled -}}
-{{ required "serviceAccount.existingServiceAccount.existingServiceAccountName is required when serviceAccount.existingServiceAccount.enabled is true" .Values.serviceAccount.existingServiceAccount.existingServiceAccountName }}
-{{- else -}}
-{{ include "gitea.fullname" . }}
-{{- end }}
-{{- end }}

templates/_services.tpl

@@ -1,11 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* names */}}
-
-{{- define "gitea.service.http.name" -}}
-{{ include "gitea.fullname" . }}-http
-{{- end }}
-
-{{- define "gitea.service.ssh.name" -}}
-{{ include "gitea.fullname" . }}-ssh
-{{- end }}

templates/_tcpRoutes.tpl

@@ -1,30 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.tcpRoute.annotations" -}}
-{{- with .Values.gatewayAPI.core.tcpRoute.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* enabled */}}
-
-{{- define "gitea.tcpRoute.enabled" -}}
-{{- if and .Values.gatewayAPI.enabled
-           .Values.gatewayAPI.core.tcpRoute.enabled
--}}
-true
-{{- else -}}
-false
-{{- end -}}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.tcpRoute.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.gatewayAPI.core.tcpRoute.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}

templates/backendTLSPolicy.yaml

@@ -1,30 +0,0 @@
-{{- if eq (include "gitea.backendTLSPolicy.enabled" .) "true" -}}
-{{- if not (keys .Values.gatewayAPI.core.backendTLSPolicy.validation) }}
-{{- fail "gatewayAPI.core.backendTLSPolicy.validation is required" }}
-{{- end }}
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: BackendTLSPolicy
-metadata:
-  {{- with (include "gitea.backendTLSPolicy.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.backendTLSPolicy.labels" .) }}
-  labels:
-    {{- . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.fullname" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-spec:
-  targetRefs:
-    {{- if .Values.gatewayAPI.core.backendTLSPolicy.targetRefs }}
-    {{- toYaml .Values.gatewayAPI.core.backendTLSPolicy.targetRefs | nindent 4 }}
-    {{- else }}
-    - group: ""
-      kind: Service
-      name: {{ include "gitea.service.http.name" . }}
-    {{- end }}
-  validation:
-    {{- toYaml .Values.gatewayAPI.core.backendTLSPolicy.validation | nindent 4 }}
-{{- end }}

templates/check-actions-not-present.yaml

@@ -0,0 +1,3 @@
+{{- if .Values.actions -}}
+    {{- fail "The actions sub-chart has been outsourced to a dedicated chart available at https://gitea.com/gitea/helm-actions. For assistance with the migration process, check https://gitea.com/gitea/helm-actions/issues/9." -}}
+{{- end -}}

templates/clientSettingsPolicy.yaml

@@ -1,30 +0,0 @@
-{{- if eq (include "gitea.clientSettingsPolicies.enabled" .) "true" -}}
-{{- if not (keys .Values.gatewayAPI.nginx.clientSettingsPolicies.body) }}
-{{- fail "gatewayAPI.nginx.clientSettingsPolicies.body is required" }}
-{{- end }}
----
-apiVersion: gateway.nginx.org/v1alpha1
-kind: ClientSettingsPolicy
-metadata:
-  {{- with (include "gitea.clientSettingsPolicies.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.clientSettingsPolicies.labels" .) }}
-  labels:
-    {{- . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.fullname" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-spec:
-  targetRef:
-    {{- if .Values.gatewayAPI.nginx.clientSettingsPolicies.targetRef }}
-    {{- toYaml .Values.gatewayAPI.nginx.clientSettingsPolicies.targetRef | nindent 4 }}
-    {{- else }}
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: {{ include "gitea.fullname" . }}
-    {{- end }}
-  body:
-    {{- toYaml .Values.gatewayAPI.nginx.clientSettingsPolicies.body | nindent 4 }}
-{{- end }}

templates/cluster.yaml

@@ -1,51 +0,0 @@
-{{- if .Values.cloudnativePG.enabled -}}
-{{- $registry := .Values.global.imageRegistry | default .Values.cloudnativePG.image.registry -}}
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  {{- with (include "gitea.cluster.cloudnativePG.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  labels:
-    {{- include "gitea.cluster.cloudnativePG.labels" . | nindent 4 }}
-  name: {{ include "gitea.cluster.cloudnativePG.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-spec:
-  {{- with .Values.cloudnativePG.affinity }}
-  affinity:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  bootstrap:
-    initdb:
-      database: {{ .Values.cloudnativePG.credentials.database | quote }}
-      owner: {{ .Values.cloudnativePG.credentials.username | quote }}
-      secret:
-        name: {{ include "gitea.secret.cloudnativePG.name" . }}
-  imageName: {{ printf "%s/%s:%s" $registry .Values.cloudnativePG.image.repository (.Values.cloudnativePG.image.tag | toString) | quote }}
-  instances: {{ .Values.cloudnativePG.instances }}
-  monitoring:
-    enablePodMonitor: {{ .Values.cloudnativePG.monitoring.enablePodMonitor }}
-  postgresql:
-    parameters:
-      {{- toYaml .Values.cloudnativePG.postgresql.parameters | nindent 6 }}
-  priorityClassName: {{ .Values.cloudnativePG.priorityClassName | quote }}
-  resources:
-    {{- toYaml .Values.cloudnativePG.resources | nindent 4 }}
-  storage:
-    size: {{ .Values.cloudnativePG.storage.size | quote }}
-    {{- with .Values.cloudnativePG.storage.storageClass }}
-    storageClass: {{ . | quote }}
-    {{- end }}
-  {{- with .Values.cloudnativePG.topologySpreadConstraints }}
-  topologySpreadConstraints:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- if .Values.cloudnativePG.walStorage.enabled }}
-  walStorage:
-    size: {{ .Values.cloudnativePG.walStorage.size | quote }}
-    {{- with .Values.cloudnativePG.walStorage.storageClass }}
-    storageClass: {{ . | quote }}
-    {{- end }}
-  {{- end }}
-{{- end -}}

templates/config.yaml

@@ -0,0 +1,57 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "gitea.fullname" . }}-inline-config
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "gitea.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  {{- include "gitea.inline_configuration" . | nindent 2 }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "gitea.fullname" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "gitea.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+{{ (.Files.Glob "scripts/init-containers/config/*.sh").AsConfig | indent 2 }}
+  assertions: |
+
+    {{- /*assert that only one PG dep is enabled */ -}}
+    {{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}}
+      {{- fail "Only one of postgresql or postgresql-ha can be enabled at the same time." -}}
+    {{- end }}
+    
+    {{- /* multiple replicas assertions */ -}}
+    {{- if gt (.Values.replicaCount | int) 1 -}}
+      {{- if .Values.gitea.config.cron -}}
+        {{- if .Values.gitea.config.cron.GIT_GC_REPOS -}}
+          {{- if eq .Values.gitea.config.cron.GIT_GC_REPOS.ENABLED true -}}
+            {{ fail "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'." }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+    
+      {{- if eq (first .Values.persistence.accessModes) "ReadWriteOnce" -}}
+        {{- fail "When using multiple replicas, a RWX file system is required and persistence.accessModes[0] must be set to ReadWriteMany." -}}
+      {{- end }}
+      {{- if .Values.gitea.config.indexer -}}
+        {{- if eq .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE "bleve" -}}
+          {{- fail "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)." -}}
+        {{- end }}
+        {{- if .Values.gitea.config.indexer.REPO_INDEXER_TYPE -}}
+          {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_TYPE "bleve" -}}
+            {{- if .Values.gitea.config.indexer.REPO_INDEXER_ENABLED -}}
+              {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_ENABLED true -}}
+                {{- fail "When using multiple replicas, the repo indexer (gitea.config.indexer.REPO_INDEXER_TYPE) must be set to 'meilisearch' or 'elasticsearch' or disabled." -}}
+              {{- end }}
+            {{- end }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+      
+    {{- end }}

templates/deployment.yaml

@@ -1,75 +1,289 @@
-{{- if .Values.deployment.enabled -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  {{- with (include "gitea.deployment.annotations" . | fromYaml) }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.deployment.labels" . | fromYaml) }}
-  labels:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
   name: {{ include "gitea.fullname" . }}
   namespace: {{ .Values.namespace | default .Release.Namespace }}
+  annotations:
+    {{- if .Values.deployment.annotations }}
+    {{- toYaml .Values.deployment.annotations | nindent 4 }}
+    {{- end }}
+  labels:
+    {{- include "gitea.labels" . | nindent 4 }}
+    {{- if .Values.deployment.labels }}
+    {{- toYaml .Values.deployment.labels | nindent 4 }}
+    {{- end }}
 spec:
-  replicas: {{ .Values.deployment.replicas }}
+  replicas: {{ .Values.replicaCount }}
   strategy:
-    type: {{ .Values.deployment.strategy.type }}
+    type: {{ .Values.strategy.type }}
-    {{- if eq .Values.deployment.strategy.type "RollingUpdate" }}
+    {{- if eq .Values.strategy.type "RollingUpdate" }}
     rollingUpdate:
-      maxUnavailable: {{ .Values.deployment.strategy.rollingUpdate.maxUnavailable }}
+      maxUnavailable: {{ .Values.strategy.rollingUpdate.maxUnavailable }}
-      maxSurge: {{ .Values.deployment.strategy.rollingUpdate.maxSurge }}
+      maxSurge: {{ .Values.strategy.rollingUpdate.maxSurge }}
     {{- end }}
   selector:
     matchLabels:
-      {{- include "gitea.selectorLabels" . | nindent 6 }}
+      {{- include "gitea.pod.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      {{- with (include "gitea.pod.annotations" . | fromYaml) }}
       annotations:
-        {{- toYaml . | nindent 8 }}
+        checksum/config: {{ include (print $.Template.BasePath "/config.yaml") . | sha256sum }}
-      {{- end }}
+        {{- range $idx, $value := .Values.gitea.ldap }}
-      labels:
+        checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }}
-        {{- include "gitea.labels" . | nindent 8 }}
-        {{- if .Values.deployment.labels }}
-        {{- toYaml .Values.deployment.labels | nindent 8 }}
         {{- end }}
+        {{- range $idx, $value := .Values.gitea.oauth }}
+        checksum/oauth_{{ $idx }}: {{ include "gitea.oauth_settings" (list $idx $value) | sha256sum }}
+        {{- end }}
+        {{- with .Values.gitea.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      labels:
+        {{- include "gitea.pod.labels" . | nindent 8 }}
     spec:
-      {{- $hostUsers := include "gitea.hostUsers" . | trim }}
+      {{- if .Values.schedulerName }}
-      {{- $securityContext := include "gitea.deployment.securityContext" . | trim }}
+      schedulerName: "{{ .Values.schedulerName }}"
-      {{- $containerSecurityContext := include "gitea.containerSecurityContext" (list . (deepCopy .Values.deployment.gitea.securityContext)) | trim }}
-      {{- if .Values.deployment.schedulerName }}
-      schedulerName: "{{ .Values.deployment.schedulerName }}"
       {{- end }}
-      {{- if .Values.serviceAccount.enabled }}
+      {{- if (or .Values.serviceAccount.create .Values.serviceAccount.name) }}
-      serviceAccountName: {{ include "gitea.serviceAccount.name" . }}
+      serviceAccountName: {{ include "gitea.serviceAccountName" . }}
       {{- end }}
-      {{- if .Values.deployment.priorityClassName }}
+      {{- if .Values.priorityClassName }}
-      priorityClassName: "{{ .Values.deployment.priorityClassName }}"
+      priorityClassName: "{{ .Values.priorityClassName }}"
-      {{- end }}
-      {{- if $hostUsers }}
-      hostUsers: {{ $hostUsers }}
       {{- end }}
       {{- include "gitea.images.pullSecrets" . | nindent 6 }}
-      {{- if $securityContext }}
       securityContext:
-        {{- $securityContext | nindent 8 }}
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      {{- end }}
       initContainers:
-        {{- include "gitea.deployment.initContainers" . | trim | nindent 8 }}
+        {{- if .Values.preExtraInitContainers }}
+        {{- toYaml .Values.preExtraInitContainers | nindent 8 }}
+        {{- end }}
+        - name: init-directories
+          image: "{{ include "gitea.image" . }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command:
+            - "{{ .Values.initContainersScriptsVolumeMountPath }}/init_directory_structure.sh"
+          env:
+            - name: GITEA_APP_INI
+              value: /data/gitea/conf/app.ini
+            - name: GITEA_CUSTOM
+              value: /data/gitea
+            - name: GITEA_WORK_DIR
+              value: /data
+            - name: GITEA_TEMP
+              value: /tmp/gitea
+            {{- if .Values.deployment.env }}
+            {{- toYaml .Values.deployment.env | nindent 12 }}
+            {{- end }}
+            {{- if .Values.signing.enabled }}
+            - name: GNUPGHOME
+              value: {{ .Values.signing.gpgHome }}
+            {{- end }}
+          volumeMounts:
+            - name: init
+              mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
+            - name: temp
+              mountPath: /tmp
+            - name: data
+              mountPath: /data
+              {{- if .Values.persistence.subPath }}
+              subPath: {{ .Values.persistence.subPath }}
+              {{- end }}
+            {{- include "gitea.init-additional-mounts" . | nindent 12 }}
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          resources:
+            {{- toYaml .Values.initContainers.resources | nindent 12 }}
+        - name: init-app-ini
+          image: "{{ include "gitea.image" . }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command:
+          - "{{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
+          env:
+            - name: GITEA_APP_INI
+              value: /data/gitea/conf/app.ini
+            - name: GITEA_CUSTOM
+              value: /data/gitea
+            - name: GITEA_WORK_DIR
+              value: /data
+            - name: GITEA_TEMP
+              value: /tmp/gitea
+            - name: TMP_EXISTING_ENVS_FILE
+              value: /tmp/existing-envs
+            - name: ENV_TO_INI_MOUNT_POINT
+              value: /env-to-ini-mounts
+            {{- if .Values.deployment.env }}
+            {{- toYaml .Values.deployment.env | nindent 12 }}
+            {{- end }}
+            {{- if .Values.gitea.additionalConfigFromEnvs }}
+            {{- tpl (toYaml .Values.gitea.additionalConfigFromEnvs) $ | nindent 12 }}
+            {{- end }}
+          volumeMounts:
+            - name: config
+              mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
+            - name: temp
+              mountPath: /tmp
+            - name: data
+              mountPath: /data
+              {{- if .Values.persistence.subPath }}
+              subPath: {{ .Values.persistence.subPath }}
+              {{- end }}
+            - name: inline-config-sources
+              mountPath: /env-to-ini-mounts/inlines/
+            {{- range $idx, $value := .Values.gitea.additionalConfigSources }}
+            - name: additional-config-sources-{{ $idx }}
+              mountPath: "/env-to-ini-mounts/additionals/{{ $idx }}/"
+            {{- end }}
+            {{- include "gitea.init-additional-mounts" . | nindent 12 }}
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          resources:
+            {{- toYaml .Values.initContainers.resources | nindent 12 }}
+        {{- if .Values.signing.enabled }}
+        - name: configure-gpg
+          image: "{{ include "gitea.image" . }}"
+          command:
+          - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            {{- /* By default this container runs as user 1000 unless otherwise stated */ -}}
+            {{- $csc := deepCopy .Values.containerSecurityContext -}}
+            {{- if not (hasKey $csc "runAsUser") -}}
+            {{- $_ := set $csc "runAsUser" 1000 -}}
+            {{- end -}}
+            {{- toYaml $csc | nindent 12 }}
+          env:
+            - name: GNUPGHOME
+              value: {{ .Values.signing.gpgHome }}
+            - name: TMP_RAW_GPG_KEY
+              value: /raw/private.asc
+          volumeMounts:
+            - name: init
+              mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
+            - name: data
+              mountPath: /data
+              {{- if .Values.persistence.subPath }}
+              subPath: {{ .Values.persistence.subPath }}
+              {{- end }}
+            - name: gpg-private-key
+              mountPath: /raw
+              readOnly: true
+            {{- if .Values.extraVolumeMounts }}
+            {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.initContainers.resources | nindent 12 }}
+        {{- end }}
+        - name: configure-gitea
+          image: "{{ include "gitea.image" . }}"
+          command:
+          - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            {{- /* By default this container runs as user 1000 unless otherwise stated */ -}}
+            {{- $csc := deepCopy .Values.containerSecurityContext -}}
+            {{- if not (hasKey $csc "runAsUser") -}}
+            {{- $_ := set $csc "runAsUser" 1000 -}}
+            {{- end -}}
+            {{- toYaml $csc | nindent 12 }}
+          env:
+            - name: GITEA_APP_INI
+              value: /data/gitea/conf/app.ini
+            - name: GITEA_CUSTOM
+              value: /data/gitea
+            - name: GITEA_WORK_DIR
+              value: /data
+            - name: GITEA_TEMP
+              value: /tmp/gitea
+            {{- if .Values.image.rootless }}
+            - name: HOME
+              value: /data/gitea/git
+            {{- end }}
+            {{- if .Values.gitea.ldap }}
+            {{- range $idx, $value := .Values.gitea.ldap }}
+            {{- if $value.existingSecret }}
+            - name: GITEA_LDAP_BIND_DN_{{ $idx }}
+              valueFrom:
+                secretKeyRef:
+                  key:  bindDn
+                  name: {{ $value.existingSecret }}
+            - name: GITEA_LDAP_PASSWORD_{{ $idx }}
+              valueFrom:
+                secretKeyRef:
+                  key:  bindPassword
+                  name: {{ $value.existingSecret }}
+            {{- else }}
+            - name: GITEA_LDAP_BIND_DN_{{ $idx }}
+              value: {{ $value.bindDn | quote }}
+            - name: GITEA_LDAP_PASSWORD_{{ $idx }}
+              value: {{ $value.bindPassword | quote }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
+            {{- if .Values.gitea.oauth }}
+            {{- range $idx, $value := .Values.gitea.oauth }}
+            {{- if $value.existingSecret }}
+            - name: GITEA_OAUTH_KEY_{{ $idx }}
+              valueFrom:
+                secretKeyRef:
+                  key:  key
+                  name: {{ $value.existingSecret }}
+            - name: GITEA_OAUTH_SECRET_{{ $idx }}
+              valueFrom:
+                secretKeyRef:
+                  key:  secret
+                  name: {{ $value.existingSecret }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
+            {{- if .Values.gitea.admin.existingSecret }}
+            - name: GITEA_ADMIN_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  key:  username
+                  name: {{ .Values.gitea.admin.existingSecret }}
+            - name: GITEA_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  key:  password
+                  name: {{ .Values.gitea.admin.existingSecret }}
+            {{- else }}
+            - name: GITEA_ADMIN_USERNAME
+              value: {{ .Values.gitea.admin.username | quote }}
+            - name: GITEA_ADMIN_PASSWORD
+              value: {{ .Values.gitea.admin.password | quote }}
+            {{- end }}
+            - name: GITEA_ADMIN_PASSWORD_MODE
+              value: {{ include "gitea.admin.passwordMode" $ }}
+            {{- if .Values.deployment.env }}
+            {{- toYaml .Values.deployment.env | nindent 12 }}
+            {{- end }}
+          volumeMounts:
+            - name: init
+              mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
+            - name: temp
+              mountPath: /tmp
+            - name: data
+              mountPath: /data
+              {{- if .Values.persistence.subPath }}
+              subPath: {{ .Values.persistence.subPath }}
+              {{- end }}
+            {{- include "gitea.init-additional-mounts" . | nindent 12 }}
+          resources:
+            {{- toYaml .Values.initContainers.resources | nindent 12 }}
+        {{- if .Values.postExtraInitContainers }}
+        {{- toYaml .Values.postExtraInitContainers | nindent 8 }}
+        {{- end }}
       terminationGracePeriodSeconds: {{ .Values.deployment.terminationGracePeriodSeconds }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ include "gitea.image" . }}"
-          imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
           env:
             # SSH Port values have to be set here as well for openssh configuration
             - name: SSH_LISTEN_PORT
               value: {{ .Values.gitea.config.server.SSH_LISTEN_PORT | quote }}
             - name: SSH_PORT
               value: {{ .Values.gitea.config.server.SSH_PORT | quote }}
-            {{- if not .Values.deployment.gitea.image.rootless }}
+            {{- if not .Values.image.rootless }}
             - name: SSH_LOG_LEVEL
               value: {{ .Values.gitea.ssh.logLevel | quote }}
             {{- end }}
@@ -81,35 +295,26 @@ spec:
               value: /data
             - name: GITEA_TEMP
               value: /tmp/gitea
-            {{- with .Values.deployment.gitea.resources }}
+            {{- if and (hasKey .Values.resources "limits") (hasKey .Values.resources.limits "cpu") }}
-            {{- if and (hasKey . "limits") (hasKey (.limits | default dict) "cpu") }}
             - name: GOMAXPROCS
               valueFrom:
                 resourceFieldRef:
                   divisor: "1"
                   resource: limits.cpu
             {{- end }}
-            {{- end }}
             - name: TMPDIR
               value: /tmp/gitea
-            {{- if .Values.deployment.gitea.image.rootless }}
+            {{- if .Values.image.rootless }}
             - name: HOME
               value: /data/gitea/git
             {{- end }}
-            {{- if .Values.secrets.gpg.enabled }}
+            {{- if .Values.signing.enabled }}
             - name: GNUPGHOME
-              valueFrom:
+              value: {{ .Values.signing.gpgHome }}
-                secretKeyRef:
-                  name: {{ include "gitea.secret.gpg.name" . }}
-                  key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
             {{- end }}
-            {{- if .Values.deployment.gitea.env }}
+            {{- if .Values.deployment.env }}
-            {{- toYaml .Values.deployment.gitea.env | nindent 12 }}
+            {{- toYaml .Values.deployment.env | nindent 12 }}
             {{- end }}
-          {{- with .Values.deployment.gitea.envFrom }}
-          envFrom:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
           ports:
             - name: ssh
               containerPort: {{ .Values.gitea.config.server.SSH_LISTEN_PORT }}
@@ -135,18 +340,21 @@ spec:
             {{- include "gitea.deployment.probe" .Values.gitea.startupProbe | nindent 12 }}
           {{- end }}
           resources:
-            {{- toYaml (.Values.deployment.gitea.resources | default dict) | nindent 12 }}
+            {{- toYaml .Values.resources | nindent 12 }}
-          {{- if $containerSecurityContext }}
           securityContext:
-            {{- $containerSecurityContext | nindent 12 }}
+            {{- /* Honor the deprecated securityContext variable when defined */ -}}
-          {{- end }}
+            {{- if .Values.containerSecurityContext -}}
+            {{ toYaml .Values.containerSecurityContext | nindent 12 -}}
+            {{- else -}}
+            {{ toYaml .Values.securityContext | nindent 12 -}}
+            {{- end }}
           volumeMounts:
             - name: temp
               mountPath: /tmp
             - name: data
               mountPath: /data
-              {{- if .Values.persistence.new.subPath }}
+              {{- if .Values.persistence.subPath }}
-              subPath: {{ .Values.persistence.new.subPath }}
+              subPath: {{ .Values.persistence.subPath }}
               {{- end }}
             {{- include "gitea.container-additional-mounts" . | nindent 12 }}
         {{- if .Values.extraContainers }}
@@ -156,66 +364,63 @@ spec:
       hostAliases:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.deployment.nodeSelector }}
+      {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-    {{- with .Values.deployment.affinity }}
+    {{- with .Values.affinity }}
       affinity:
         {{- toYaml . | nindent 8 }}
     {{- end }}
-    {{- with .Values.deployment.topologySpreadConstraints }}
+    {{- with .Values.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
     {{- end }}
-    {{- with .Values.deployment.tolerations }}
+    {{- with .Values.tolerations }}
       tolerations:
         {{- toYaml . | nindent 8 }}
     {{- end }}
-    {{- if .Values.deployment.dnsConfig }}
+    {{- if .Values.dnsConfig }}
       dnsConfig:
-        {{- toYaml .Values.deployment.dnsConfig | nindent 8 }}
+        {{- toYaml .Values.dnsConfig | nindent 8 }}
-    {{- end }}
-    {{- with .Values.deployment.resources }}
-      resources:
-        {{- toYaml . | nindent 8 }}
     {{- end }}
       volumes:
         - name: init
           secret:
-            secretName: {{ include "gitea.secret.init.name" . }}
+            secretName: {{ include "gitea.fullname" . }}-init
             defaultMode: 110
         - name: config
           secret:
-            secretName: {{ include "gitea.secret.config.name" . }}
+            secretName: {{ include "gitea.fullname" . }}
             defaultMode: 110
-        {{- if gt (len .Values.deployment.volumes) 0 }}
+        {{- if gt (len .Values.extraVolumes) 0 }}
-        {{- toYaml .Values.deployment.volumes | nindent 8 }}
+        {{- toYaml .Values.extraVolumes | nindent 8 }}
         {{- end }}
         - name: inline-config-sources
           secret:
-            secretName: {{ include "gitea.secret.inlineConfig.name" . }}
+            secretName: {{ include "gitea.fullname" . }}-inline-config
         {{- range $idx, $value := .Values.gitea.additionalConfigSources }}
         - name: additional-config-sources-{{ $idx }}
           {{- toYaml $value | nindent 10 }}
         {{- end }}
         - name: temp
           emptyDir: {}
-        {{- if .Values.secrets.gpg.enabled }}
+        {{- if .Values.signing.enabled }}
         - name: gpg-private-key
           secret:
-            secretName: {{ include "gitea.secret.gpg.name" . }}
+            secretName: {{ include "gitea.gpg-key-secret-name" . }}
             items:
-              - key: {{ include "gitea.secret.gpg.privateKeyKey" . }}
+              - key: privateKey
                 path: private.asc
             defaultMode: 0100
         {{- end }}
   {{- if .Values.persistence.enabled }}
+    {{- if .Values.persistence.mount }}
         - name: data
           persistentVolumeClaim:
-            claimName: {{ include "gitea.persistentVolumeClaim.name" . }}
+            claimName: {{ .Values.persistence.claimName }}
-  {{- else }}
+    {{- end }}
+  {{- else if not .Values.persistence.enabled }}
         - name: data
           emptyDir: {}
   {{- end }}
-{{- end }}

templates/deprecation.yaml

@@ -14,12 +14,12 @@
   {{- if kindIs "map" .Values.gitea.ldap -}}
     {{- fail "You can configure multiple LDAP sources. Please refer to the changelog and switch `gitea.ldap` from object to array notation." -}}
   {{- end -}}
-
+  
   {{/* OAUTH SOURCES */}}
   {{- if kindIs "map" .Values.gitea.oauth -}}
     {{- fail "You can configure multiple OAuth sources. Please refer to the changelog and switch `gitea.oauth` from object to array notation." -}}
   {{- end -}}
-
+  
   {{/* BUILTIN */}}
   {{- if .Values.gitea.cache -}}
     {{- if .Values.gitea.cache.builtIn -}}
@@ -31,137 +31,4 @@
       {{- fail "`gitea.database.builtIn` does no longer exist. Builtin databases can be configured inside the dependencies itself. Please refer to the changelog." -}}
     {{- end -}}
   {{- end -}}
-  {{- if .Values.gitea.admin -}}
-    {{- fail "`gitea.admin` does no longer exist. Please refer to the changelog and configure `secrets.admin` instead." -}}
-  {{- end -}}
-
-  {{/* SIGNING */}}
-  {{- if .Values.signing -}}
-    {{- fail "`signing` does no longer exist. Please refer to the changelog and configure `secrets.gpg` instead." -}}
-  {{- end -}}
-
-  {{/* AFFINITY */}}
-  {{- if .Values.affinity -}}
-    {{- fail "`affinity` does no longer exist. Please refer to the changelog and configure `deployment.affinity` instead." -}}
-  {{- end -}}
-
-  {{/* CONTAINER SECURITY CONTEXT */}}
-  {{- if .Values.containerSecurityContext -}}
-    {{- fail "`containerSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.gitea.securityContext` instead." -}}
-  {{- end -}}
-
-  {{/* DEPLOYMENT ENV */}}
-  {{- if .Values.deployment.env -}}
-    {{- fail "`deployment.env` does no longer exist. Please refer to the changelog and configure `deployment.gitea.env` instead." -}}
-  {{- end -}}
-
-  {{/* DNS CONFIG */}}
-  {{- if .Values.dnsConfig -}}
-    {{- fail "`dnsConfig` does no longer exist. Please refer to the changelog and configure `deployment.dnsConfig` instead." -}}
-  {{- end -}}
-
-  {{/* EXTRA CONTAINER VOLUME MOUNTS */}}
-  {{- if .Values.extraContainerVolumeMounts -}}
-    {{- fail "`extraContainerVolumeMounts` does no longer exist. Please refer to the changelog and configure `deployment.gitea.volumeMounts` instead." -}}
-  {{- end -}}
-
-  {{/* EXTRA INIT VOLUME MOUNTS */}}
-  {{- if .Values.extraInitVolumeMounts -}}
-    {{- fail "`extraInitVolumeMounts` does no longer exist. Please refer to the changelog and configure `deployment.<initContainer>.volumeMounts` instead." -}}
-  {{- end -}}
-
-  {{/* EXTRA VOLUME MOUNTS */}}
-  {{- if .Values.extraVolumeMounts -}}
-    {{- fail "`extraVolumeMounts` does no longer exist. Please refer to the changelog and configure `deployment.gitea.volumeMounts` and `deployment.<initContainer>.volumeMounts` instead." -}}
-  {{- end -}}
-
-  {{/* EXTRA VOLUMES */}}
-  {{- if .Values.extraVolumes -}}
-    {{- fail "`extraVolumes` does no longer exist. Please refer to the changelog and configure `deployment.volumes` instead." -}}
-  {{- end -}}
-
-  {{/* INGRESS CLASS NAME */}}
-  {{- if hasKey .Values.ingress "className" -}}
-    {{- fail "`ingress.className` does no longer exist. Please refer to the changelog and configure `ingress.ingressClassName` instead." -}}
-  {{- end -}}
-
-  {{/* NODE SELECTOR */}}
-  {{- if .Values.nodeSelector -}}
-    {{- fail "`nodeSelector` does no longer exist. Please refer to the changelog and configure `deployment.nodeSelector` instead." -}}
-  {{- end -}}
-
-  {{/* OPENSHIFT HOST USERS */}}
-  {{- if hasKey .Values.openshift "hostUsers" -}}
-    {{- fail "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead." -}}
-  {{- end -}}
-
-  {{/* POSTGRESQL */}}
-  {{- if index .Values "postgresql" -}}
-    {{- fail "`postgresql` does no longer exist. Please refer to the changelog and configure `cloudnativePG` instead, which requires the CloudNativePG operator to be installed in the cluster." -}}
-  {{- end -}}
-
-  {{/* POSTGRESQL HA */}}
-  {{- if index .Values "postgresql-ha" -}}
-    {{- fail "`postgresql-ha` does no longer exist. Please refer to the changelog and configure `cloudnativePG` instead, which requires the CloudNativePG operator to be installed in the cluster." -}}
-  {{- end -}}
-
-  {{/* PRIORITY CLASS NAME */}}
-  {{- if .Values.priorityClassName -}}
-    {{- fail "`priorityClassName` does no longer exist. Please refer to the changelog and configure `deployment.priorityClassName` instead." -}}
-  {{- end -}}
-
-  {{/* POD SECURITY CONTEXT */}}
-  {{- if .Values.podSecurityContext -}}
-    {{- fail "`podSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` instead." -}}
-  {{- end -}}
-
-  {{/* POST EXTRA INIT CONTAINERS */}}
-  {{- if .Values.postExtraInitContainers -}}
-    {{- fail "`postExtraInitContainers` does no longer exist. Please refer to the changelog and append an entry with a `container` key to `deployment.initContainers` instead." -}}
-  {{- end -}}
-
-  {{/* PRE EXTRA INIT CONTAINERS */}}
-  {{- if .Values.preExtraInitContainers -}}
-    {{- fail "`preExtraInitContainers` does no longer exist. Please refer to the changelog and prepend an entry with a `container` key to `deployment.initContainers` instead." -}}
-  {{- end -}}
-
-  {{/* RESOURCES */}}
-  {{- if .Values.resources -}}
-    {{- fail "`resources` does no longer exist. Please refer to the changelog and configure `deployment.gitea.resources` instead." -}}
-  {{- end -}}
-
-  {{/* REPLICA COUNT */}}
-  {{- if .Values.replicaCount -}}
-    {{- fail "`replicaCount` does no longer exist. Please refer to the changelog and configure `deployment.replicas` instead." -}}
-  {{- end -}}
-
-  {{/* SCHEDULER NAME */}}
-  {{- if .Values.schedulerName -}}
-    {{- fail "`schedulerName` does no longer exist. Please refer to the changelog and configure `deployment.schedulerName` instead." -}}
-  {{- end -}}
-
-  {{/* SECURITY CONTEXT */}}
-  {{- if .Values.securityContext -}}
-    {{- fail "`securityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` and `deployment.gitea.securityContext` instead." -}}
-  {{- end -}}
-
-  {{/* STRATEGY */}}
-  {{- if .Values.strategy -}}
-    {{- fail "`strategy` does no longer exist. Please refer to the changelog and configure `deployment.strategy` instead." -}}
-  {{- end -}}
-
-  {{/* TEST */}}
-  {{- if .Values.test -}}
-    {{- fail "`test` does no longer exist. Please refer to the changelog. The `helm test` connection Pod has been removed without replacement." -}}
-  {{- end -}}
-
-  {{/* TOLERATIONS */}}
-  {{- if .Values.tolerations -}}
-    {{- fail "`tolerations` does no longer exist. Please refer to the changelog and configure `deployment.tolerations` instead." -}}
-  {{- end -}}
-
-  {{/* TOPOLOGY SPREAD CONSTRAINTS */}}
-  {{- if .Values.topologySpreadConstraints -}}
-    {{- fail "`topologySpreadConstraints` does no longer exist. Please refer to the changelog and configure `deployment.topologySpreadConstraints` instead." -}}
-  {{- end -}}
 {{- end -}}

templates/extra-list.yaml

@@ -1,8 +1,8 @@
 {{- range .Values.extraDeploy }}
 ---
 {{- if typeIs "string" . }}
-    {{ tpl . $ }}
+    {{- tpl . $ }}
 {{- else }}
-    {{ tpl (. | toYaml) $ }}
+    {{- tpl (. | toYaml) $ }}
 {{- end }}
 {{- end }}

templates/gpg-secret.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.signing.enabled -}}
+{{- if and (empty .Values.signing.privateKey) (empty .Values.signing.existingSecret) -}}
+  {{- fail "Either specify `signing.privateKey` or `signing.existingSecret`" -}}
+{{- end }}
+{{- if and (not (empty .Values.signing.privateKey)) (empty .Values.signing.existingSecret) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "gitea.gpg-key-secret-name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "gitea.labels" . | nindent 4 }}
+type: Opaque
+data:
+  privateKey: {{ .Values.signing.privateKey | b64enc }}
+{{- end }}
+{{- end }}

templates/http-svc.yaml

@@ -1,15 +1,15 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
+  name: {{ include "gitea.fullname" . }}-http
-    {{- toYaml .Values.service.http.annotations | nindent 4 }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
   labels:
     {{- include "gitea.labels" . | nindent 4 }}
     {{- if .Values.service.http.labels }}
     {{- toYaml .Values.service.http.labels  | nindent 4 }}
     {{- end }}
-  name: {{ include "gitea.service.http.name" . }}
+  annotations:
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
+    {{- toYaml .Values.service.http.annotations | nindent 4 }}
 spec:
   type: {{ .Values.service.http.type }}
   {{- if eq .Values.service.http.type "LoadBalancer" }}

templates/httpRoute.yaml

@@ -1,42 +0,0 @@
-{{- if eq (include "gitea.httpRoute.enabled" .) "true" -}}
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  {{- with (include "gitea.httpRoute.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.httpRoute.labels" .) }}
-  labels:
-    {{- . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.fullname" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-spec:
-  parentRefs:
-    {{- if .Values.gatewayAPI.core.httpRoute.parentRefs }}
-    {{- toYaml .Values.gatewayAPI.core.httpRoute.parentRefs | nindent 4 }}
-    {{- else }}
-    {{- fail "gatewayAPI.core.httpRoute.parentRefs is required" }}
-    {{- end }}
-  {{- with .Values.gatewayAPI.core.httpRoute.hostnames }}
-  hostnames:
-    {{- tpl (toYaml .) $ | nindent 4 }}
-  {{- end }}
-  rules:
-    {{- if .Values.gatewayAPI.core.httpRoute.rules }}
-    {{- tpl (toYaml .Values.gatewayAPI.core.httpRoute.rules) $ | nindent 4 }}
-    {{- else }}
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      backendRefs:
-        - group: ""
-          kind: Service
-          name: {{ include "gitea.service.http.name" . }}
-          port: {{ .Values.service.http.port }}
-          weight: 1
-    {{- end }}
-{{- end }}

templates/ingress.yaml

@@ -1,20 +1,29 @@
-{{- if eq (include "gitea.ingress.enabled" .) "true" -}}
+{{- if .Values.ingress.enabled -}}
----
+{{- $fullName := include "gitea.fullname" . -}}
+{{- $httpPort := .Values.service.http.port -}}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  {{- with (include "gitea.ingress.annotations" .) }}
+  name: {{ $fullName }}
-  annotations:
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.ingress.labels" .) }}
   labels:
-    {{- . | nindent 4 }}
+    {{- include "gitea.labels" . | nindent 4 }}
-  {{- end }}
+  annotations:
-  name: {{ include "gitea.ingress.name" . }}
+    {{- range $key, $value := .Values.ingress.annotations }}
-  namespace: {{ .Release.Namespace }}
+      {{ $key }}: {{ $value | quote }}
+    {{- end }}
 spec:
-  ingressClassName: {{ tpl .Values.ingress.ingressClassName . }}
+  ingressClassName: {{ tpl .Values.ingress.className . }}
+{{- if .Values.ingress.tls }}
+  tls:
+  {{- range .Values.ingress.tls }}
+    - hosts:
+      {{- range .hosts }}
+        - {{ tpl . $ | quote }}
+      {{- end }}
+      secretName: {{ .secretName }}
+  {{- end }}
+{{- end }}
   rules:
     {{- range .Values.ingress.hosts }}
     - host: {{ tpl .host $ | quote }}
@@ -27,17 +36,17 @@ spec:
             pathType: {{ default "Prefix" $.Values.ingress.pathType }}
             backend:
               service:
-                name: {{ include "gitea.service.http.name" $ }}
+                name: {{ $fullName }}-http
                 port:
-                  number: {{ $.Values.service.http.port }}
+                  number: {{ $httpPort }}
           {{- else }}
           - path: {{ .path | default "/" }}
             pathType: {{ .pathType | default "Prefix" }}
             backend:
               service:
-                name: {{ include "gitea.service.http.name" $ }}
+                name: {{ $fullName }}-http
                 port:
-                  number: {{ $.Values.service.http.port }}
+                  number: {{ $httpPort }}
           {{- end }}
           {{- end }}
           {{- else }}
@@ -45,19 +54,9 @@ spec:
             pathType: "Prefix"
             backend:
               service:
-                name: {{ include "gitea.service.http.name" $ }}
+                name: {{ $fullName }}-http
                 port:
-                  number: {{ $.Values.service.http.port }}
+                  number: {{ $httpPort }}
           {{- end }}
     {{- end }}
-  {{- if .Values.ingress.tls }}
-  tls:
-    {{- range .Values.ingress.tls }}
-    - hosts:
-      {{- range .hosts }}
-        - {{ tpl . $ | quote }}
-      {{- end }}
-      secretName: {{ .secretName }}
-    {{- end }}
-  {{- end }}
 {{- end }}

templates/init.yaml

@@ -0,0 +1,228 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "gitea.fullname" . }}-init
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "gitea.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+{{ (.Files.Glob "scripts/init-containers/init/*.sh").AsConfig | indent 2 }}
+  init_directory_structure.sh: |-
+    #!/usr/bin/env bash
+
+    set -euo pipefail
+
+    {{- if .Values.initPreScript }}
+    # BEGIN: initPreScript
+    {{- with .Values.initPreScript -}}
+    {{ . | nindent 4}}
+    {{- end -}}
+    # END: initPreScript
+    {{- end }}
+
+    {{- if not .Values.image.rootless }}
+    chown -v 1000:1000 /data
+    {{- end }}
+    mkdir -pv /data/git/.ssh
+    chmod -Rv 700 /data/git/.ssh
+    [ ! -d /data/gitea/conf ] && mkdir -pv /data/gitea/conf
+
+    # prepare temp directory structure
+    mkdir -pv "${GITEA_TEMP}"
+    {{- if not .Values.image.rootless }}
+    chown -v 1000:1000 "${GITEA_TEMP}"
+    {{- end }}
+    chmod -v ug+rwx "${GITEA_TEMP}"
+
+    {{ if .Values.signing.enabled -}}
+    if [ ! -d "${GNUPGHOME}" ]; then
+      mkdir -pv "${GNUPGHOME}"
+      chmod -v 700 "${GNUPGHOME}"
+      chown -v 1000:1000 "${GNUPGHOME}"
+    fi
+    {{- end }}
+
+  configure_gitea.sh: |-
+    #!/usr/bin/env bash
+
+    set -euo pipefail
+
+    echo '==== BEGIN GITEA CONFIGURATION ===='
+
+    { # try
+      gitea migrate
+    } || { # catch
+      echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
+      exit 1
+    }
+
+    {{- if include "valkey.servicename" . }}
+    function test_valkey_connection() {
+      local RETRY=0
+      local MAX=30
+      
+      echo 'Wait for valkey to become avialable...'
+      until [ "${RETRY}" -ge "${MAX}" ]; do
+        nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break
+        RETRY=$[${RETRY}+1]
+        echo "...not ready yet (${RETRY}/${MAX})"
+      done
+
+      if [ "${RETRY}" -ge "${MAX}" ]; then
+        echo "Valkey not reachable after '${MAX}' attempts!"
+        exit 1
+      fi
+    }
+
+    test_valkey_connection
+    {{- end }}
+    
+
+    {{- if or .Values.gitea.admin.existingSecret (and .Values.gitea.admin.username .Values.gitea.admin.password) }}
+    function configure_admin_user() {
+      local full_admin_list=$(gitea admin user list --admin)
+      local actual_user_table=''
+
+      # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
+      local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)"
+      if [[ "${full_admin_list}" =~ $regex ]]; then
+        actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
+      else
+        # This code block should never be reached, as long as the output table header remains the same.
+        # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
+
+        echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users."
+        echo "       Please review the output of 'gitea admin user list --admin' shown below."
+        echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
+        echo "DEBUG: Output of 'gitea admin user list --admin'"
+        echo "--"
+        echo "${full_admin_list}"
+        echo "--"
+        exit 1
+      fi
+
+      local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
+      if [[ -z "${ACCOUNT_ID}" ]]; then
+        local -a create_args
+        create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email {{ .Values.gitea.admin.email | quote }})
+        if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
+          create_args+=(--must-change-password=true)
+        else
+          create_args+=(--must-change-password=false)
+        fi
+        echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
+        gitea admin user create "${create_args[@]}"
+        echo '...created.'
+      else
+        if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then
+          echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
+          # See https://gitea.com/gitea/helm-gitea/issues/673
+          # --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior
+          #   which acted as if it were provided with =false. If the argument is present in this version of gitea, then we
+          #   should add it to prevent requiring frequent admin password resets.
+          local -a change_args
+          change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
+          if gitea admin user change-password --help | grep -qF -- '--must-change-password'; then
+            change_args+=(--must-change-password=false)
+          fi
+          gitea admin user change-password "${change_args[@]}"
+          echo '...password sync done.'
+        else
+          echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping."
+        fi
+      fi
+    }
+
+    configure_admin_user
+    {{- end }}
+
+    function configure_ldap() {
+      {{- if .Values.gitea.ldap }}
+      {{- range $idx, $value := .Values.gitea.ldap }}
+      local LDAP_NAME={{ (printf "%s" $value.name) | squote }}
+      local full_auth_list=$(gitea admin auth list --vertical-bars)
+      local actual_auth_table=''
+
+      # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
+      local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
+      if [[ "${full_auth_list}" =~ $regex ]]; then
+        actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
+      else
+        # This code block should never be reached, as long as the output table header remains the same.
+        # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
+
+        echo "ERROR: 'configure_ldap' was not able to determine the current list of authentication sources."
+        echo "       Please review the output of 'gitea admin auth list --vertical-bars' shown below."
+        echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
+        echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
+        echo "--"
+        echo "${full_auth_list}"
+        echo "--"
+        exit 1
+      fi
+
+      local GITEA_AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${LDAP_NAME}\s+\|" | grep -iE '\|LDAP \(via BindDN\)\s+\|' | awk -F " "  "{print \$1}")
+
+      if [[ -z "${GITEA_AUTH_ID}" ]]; then
+        echo "No ldap configuration found with name '${LDAP_NAME}'. Installing it now..."
+        gitea admin auth add-ldap {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
+        echo '...installed.'
+      else
+        echo "Existing ldap configuration with name '${LDAP_NAME}': '${GITEA_AUTH_ID}'. Running update to sync settings..."
+        gitea admin auth update-ldap --id "${GITEA_AUTH_ID}" {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
+        echo '...sync settings done.'
+      fi
+      {{- end }}
+      {{- else }}
+        echo 'no ldap configuration... skipping.'
+      {{- end }}
+    }
+
+    configure_ldap
+
+    function configure_oauth() {
+      {{- if .Values.gitea.oauth }}
+      {{- range $idx, $value := .Values.gitea.oauth }}
+      local OAUTH_NAME={{ (printf "%s" $value.name) | squote }}
+      local full_auth_list=$(gitea admin auth list --vertical-bars)
+      local actual_auth_table=''
+
+      # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
+      local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
+      if [[ "${full_auth_list}" =~ $regex ]]; then
+        actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
+      else
+        # This code block should never be reached, as long as the output table header remains the same.
+        # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
+
+        echo "ERROR: 'configure_oauth' was not able to determine the current list of authentication sources."
+        echo "       Please review the output of 'gitea admin auth list --vertical-bars' shown below."
+        echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
+        echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
+        echo "--"
+        echo "${full_auth_list}"
+        echo "--"
+        exit 1
+      fi
+
+      local AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${OAUTH_NAME}\s+\|" | grep -iE '\|OAuth2\s+\|' | awk -F " "  "{print \$1}")
+
+      if [[ -z "${AUTH_ID}" ]]; then
+        echo "No oauth configuration found with name '${OAUTH_NAME}'. Installing it now..."
+        gitea admin auth add-oauth {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
+        echo '...installed.'
+      else
+        echo "Existing oauth configuration with name '${OAUTH_NAME}': '${AUTH_ID}'. Running update to sync settings..."
+        gitea admin auth update-oauth --id "${AUTH_ID}" {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
+        echo '...sync settings done.'
+      fi
+      {{- end }}
+      {{- else }}
+        echo 'no oauth configuration... skipping.'
+      {{- end }}
+    }
+
+    configure_oauth
+
+    echo '==== END GITEA CONFIGURATION ===='

templates/metrics-secret.yaml

@@ -0,0 +1,12 @@
+{{- if and (.Values.gitea.metrics.enabled) (.Values.gitea.metrics.serviceMonitor.enabled) (.Values.gitea.metrics.token) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "gitea.metrics-secret-name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "gitea.labels" . | nindent 4 }}
+type: Opaque
+data:
+  token: {{ .Values.gitea.metrics.token  | b64enc }}
+{{- end }}

templates/networkPolicy.yaml

@@ -0,0 +1,32 @@
+{{- if .Values.networkPolicy.enabled }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  {{- with (include "gitea.networkPolicy.annotations" . | fromYaml) }}
+  annotations:
+    {{- tpl (toYaml .) $ | nindent 4 }}
+  {{- end }}
+  {{- with (include "gitea.networkPolicy.labels" . | fromYaml) }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  name: {{ include "gitea.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "gitea.pod.selectorLabels" $ | nindent 6 }}
+  {{- with .Values.networkPolicy.policyTypes }}
+  policyTypes:
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
+  {{- with .Values.networkPolicy.egress }}
+  egress:
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
+  {{- with .Values.networkPolicy.ingress }}
+  ingress:
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
+{{- end }}

templates/persistentVolumeClaim.yaml

@@ -1,33 +0,0 @@
-{{- if eq (include "gitea.persistentVolumeClaim.enabled" .) "true" }}
----
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  {{- with (include "gitea.persistentVolumeClaim.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.persistentVolumeClaim.labels" .) }}
-  labels:
-    {{- . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.persistentVolumeClaim.name" . }}
-  namespace: {{ .Release.Namespace }}
-spec:
-  accessModes:
-  {{- if gt (.Values.deployment.replicas | int) 1 }}
-      - ReadWriteMany
-  {{- else }}
-    {{- .Values.persistence.new.accessModes | toYaml | nindent 4 }}
-  {{- end }}
-  resources:
-    requests:
-      storage: {{ .Values.persistence.new.size }}
-  {{- with .Values.persistence.new.storageClassName }}
-  storageClassName: {{ . }}
-  {{- end }}
-  volumeMode: Filesystem
-  {{- with .Values.persistence.new.persistentVolumeName }}
-  volumeName: {{ . }}
-  {{- end }}
-{{- end }}

templates/pvc.yaml

@@ -0,0 +1,26 @@
+{{- if and .Values.persistence.enabled .Values.persistence.create }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ .Values.persistence.claimName }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  annotations:
+{{ .Values.persistence.annotations | toYaml | indent 4}}
+  labels:
+{{ .Values.persistence.labels | toYaml | indent 4}}
+spec:
+  accessModes:
+  {{- if gt (.Values.replicaCount | int) 1 }}
+      - ReadWriteMany
+  {{- else }}
+    {{- .Values.persistence.accessModes | toYaml | nindent 4 }}
+  {{- end }}
+  volumeMode: Filesystem
+  {{- include "gitea.persistence.storageClass" . | nindent 2 }}
+  {{- with .Values.persistence.volumeName }}
+  volumeName: {{ . }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size }}
+{{- end }}

templates/route.yaml

@@ -1,52 +0,0 @@
-{{- if .Values.route.enabled -}}
-{{- $fullName := include "gitea.fullname" . -}}
-apiVersion: route.openshift.io/v1
-kind: Route
-metadata:
-  name: {{ $fullName }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  labels:
-    {{- include "gitea.labels" . | nindent 4 }}
-  {{- with .Values.route.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  {{- if .Values.route.host }}
-  host: {{ tpl .Values.route.host . | quote }}
-  {{- end }}
-  {{- if .Values.route.path }}
-  path: {{ tpl .Values.route.path . | quote }}
-  {{- end }}
-  to:
-    kind: Service
-    name: {{ include "gitea.service.http.name" . }}
-  port:
-    targetPort: http
-  wildcardPolicy: {{ .Values.route.wildcardPolicy }}
-  {{- with .Values.route.tls }}
-  {{- if .termination }}
-  tls:
-    termination: {{ .termination }}
-    {{- if .insecureEdgeTerminationPolicy }}
-    insecureEdgeTerminationPolicy: {{ .insecureEdgeTerminationPolicy }}
-    {{- end }}
-    {{- if .key }}
-    key: |
-      {{- .key | nindent 6 }}
-    {{- end }}
-    {{- if .certificate }}
-    certificate: |
-      {{- .certificate | nindent 6 }}
-    {{- end }}
-    {{- if .caCertificate }}
-    caCertificate: |
-      {{- .caCertificate | nindent 6 }}
-    {{- end }}
-    {{- if .destinationCACertificate }}
-    destinationCACertificate: |
-      {{- .destinationCACertificate | nindent 6 }}
-    {{- end }}
-  {{- end }}
-  {{- end }}
-{{- end }}

templates/secret_admin.yaml

@@ -1,21 +0,0 @@
-{{- if and (.Values.secrets.admin.enabled) (not .Values.secrets.admin.existingSecret.enabled) -}}
-{{- if or (empty .Values.secrets.admin.new.username) (empty .Values.secrets.admin.new.password) -}}
-  {{- fail "Either specify `secrets.admin.new.username` and `secrets.admin.new.password` or reference an existing Secret via `secrets.admin.existingSecret`" -}}
-{{- end }}
-apiVersion: v1
-kind: Secret
-metadata:
-  {{- with (include "gitea.secret.admin.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  labels:
-    {{- include "gitea.secret.admin.labels" . | nindent 4 }}
-  name: {{ include "gitea.secret.admin.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-type: Opaque
-data:
-  email: {{ .Values.secrets.admin.new.email | b64enc }}
-  password: {{ .Values.secrets.admin.new.password | b64enc }}
-  username: {{ .Values.secrets.admin.new.username | b64enc }}
-{{- end }}

templates/secret_cloudnativePG.yaml

@@ -1,18 +0,0 @@
-{{- if and .Values.cloudnativePG.enabled (not .Values.cloudnativePG.credentials.existingSecret.enabled) -}}
-apiVersion: v1
-kind: Secret
-metadata:
-  {{- with (include "gitea.secret.cloudnativePG.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  labels:
-    {{- include "gitea.secret.cloudnativePG.labels" . | nindent 4 }}
-  name: {{ include "gitea.secret.cloudnativePG.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-type: kubernetes.io/basic-auth
-data:
-  password: {{ required "`cloudnativePG.credentials.new.password` must be set when `cloudnativePG.enabled` is enabled" .Values.cloudnativePG.credentials.new.password | b64enc | quote }}
-  {{- /* CloudNativePG requires the username of a basic-auth bootstrap Secret to match the owner of the Cluster. */}}
-  username: {{ required "`cloudnativePG.credentials.username` must be set when `cloudnativePG.enabled` is enabled" .Values.cloudnativePG.credentials.username | b64enc | quote }}
-{{- end -}}

templates/secret_config.yaml

@@ -1,53 +0,0 @@
-{{- /* Evaluated outside of the Secret so the guards also run with an existing Secret. */ -}}
-{{- $assertions := include "gitea.config.assertions" . -}}
-{{- if not .Values.secrets.config.existingSecret.enabled -}}
----
-apiVersion: v1
-kind: Secret
-metadata:
-  {{- with (include "gitea.secret.config.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  labels:
-    {{- include "gitea.secret.config.labels" . | nindent 4 }}
-  name: {{ include "gitea.secret.config.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-type: Opaque
-data:
-{{ (.Files.Glob "scripts/init-containers/config/*.sh").AsSecrets | indent 2 }}
-  assertions: {{ $assertions | b64enc | quote }}
-{{- end }}
-
-{{- define "gitea.config.assertions" -}}
-
-  {{- /* multiple replicas assertions */ -}}
-  {{- if gt (.Values.deployment.replicas | int) 1 -}}
-    {{- if .Values.gitea.config.cron -}}
-      {{- if .Values.gitea.config.cron.GIT_GC_REPOS -}}
-        {{- if eq .Values.gitea.config.cron.GIT_GC_REPOS.ENABLED true -}}
-          {{ fail "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'." }}
-        {{- end }}
-      {{- end }}
-    {{- end }}
-
-    {{- if eq (first .Values.persistence.new.accessModes) "ReadWriteOnce" -}}
-      {{- fail "When using multiple replicas, a RWX file system is required and persistence.new.accessModes[0] must be set to ReadWriteMany." -}}
-    {{- end }}
-    {{- if .Values.gitea.config.indexer -}}
-      {{- if eq .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE "bleve" -}}
-        {{- fail "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)." -}}
-      {{- end }}
-      {{- if .Values.gitea.config.indexer.REPO_INDEXER_TYPE -}}
-        {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_TYPE "bleve" -}}
-          {{- if .Values.gitea.config.indexer.REPO_INDEXER_ENABLED -}}
-            {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_ENABLED true -}}
-              {{- fail "When using multiple replicas, the repo indexer (gitea.config.indexer.REPO_INDEXER_TYPE) must be set to 'meilisearch' or 'elasticsearch' or disabled." -}}
-            {{- end }}
-          {{- end }}
-        {{- end }}
-      {{- end }}
-    {{- end }}
-
-  {{- end }}
-{{- end }}

templates/secret_gpg.yaml

@@ -1,20 +0,0 @@
-{{- if and (.Values.secrets.gpg.enabled) (not .Values.secrets.gpg.existingSecret.enabled) -}}
-{{- if empty .Values.secrets.gpg.new.privateKey -}}
-  {{- fail "Either specify `secrets.gpg.new.privateKey` or reference an existing Secret via `secrets.gpg.existingSecret`" -}}
-{{- end }}
-apiVersion: v1
-kind: Secret
-metadata:
-  {{- with (include "gitea.secret.gpg.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  labels:
-    {{- include "gitea.secret.gpg.labels" . | nindent 4 }}
-  name: {{ include "gitea.secret.gpg.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-type: Opaque
-data:
-  gpgHome: {{ .Values.secrets.gpg.new.gpgHome | b64enc }}
-  privateKey: {{ .Values.secrets.gpg.new.privateKey | b64enc }}
-{{- end }}

templates/secret_init.yaml

@@ -1,239 +0,0 @@
-{{- if not .Values.secrets.init.existingSecret.enabled -}}
-apiVersion: v1
-kind: Secret
-metadata:
-  {{- with (include "gitea.secret.init.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  labels:
-    {{- include "gitea.secret.init.labels" . | nindent 4 }}
-  name: {{ include "gitea.secret.init.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-type: Opaque
-data:
-{{ (.Files.Glob "scripts/init-containers/init/*.sh").AsSecrets | indent 2 }}
-  configure_gitea.sh: {{ include "gitea.init.configureGitea" . | trimAll "\n" | b64enc | quote }}
-  init_directory_structure.sh: {{ include "gitea.init.initDirectoryStructure" . | trimAll "\n" | b64enc | quote }}
-{{- end }}
-
-{{- define "gitea.init.initDirectoryStructure" -}}
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-{{- if .Values.initPreScript }}
-# BEGIN: initPreScript
-{{- with .Values.initPreScript -}}
-{{ . | nindent 0 }}
-{{- end -}}
-# END: initPreScript
-{{- end }}
-
-{{- if not .Values.deployment.gitea.image.rootless }}
-chown -v 1000:1000 /data
-{{- end }}
-mkdir -pv /data/git/.ssh
-chmod -Rv 700 /data/git/.ssh
-[ ! -d /data/gitea/conf ] && mkdir -pv /data/gitea/conf
-
-# prepare temp directory structure
-mkdir -pv "${GITEA_TEMP}"
-{{- if not .Values.deployment.gitea.image.rootless }}
-chown -v 1000:1000 "${GITEA_TEMP}"
-{{- end }}
-chmod -v ug+rwx "${GITEA_TEMP}"
-
-{{ if .Values.secrets.gpg.enabled -}}
-if [ ! -d "${GNUPGHOME}" ]; then
-  mkdir -pv "${GNUPGHOME}"
-  chmod -v 700 "${GNUPGHOME}"
-  chown -v 1000:1000 "${GNUPGHOME}"
-fi
-{{- end }}
-{{- end }}
-
-{{- define "gitea.init.configureGitea" -}}
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-echo '==== BEGIN GITEA CONFIGURATION ===='
-
-{ # try
-  gitea migrate
-} || { # catch
-  echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
-  exit 1
-}
-
-{{- if include "valkey.servicename" . }}
-function test_valkey_connection() {
-  local RETRY=0
-  local MAX=30
-
-  echo 'Wait for valkey to become avialable...'
-  until [ "${RETRY}" -ge "${MAX}" ]; do
-    RES_OPTIONS="ndots:0" nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break
-    RETRY=$[${RETRY}+1]
-    echo "...not ready yet (${RETRY}/${MAX})"
-  done
-
-  if [ "${RETRY}" -ge "${MAX}" ]; then
-    echo "Valkey not reachable after '${MAX}' attempts!"
-    exit 1
-  fi
-}
-
-test_valkey_connection
-{{- end }}
-
-
-{{- if .Values.secrets.admin.enabled }}
-function configure_admin_user() {
-  local full_admin_list=$(gitea admin user list --admin)
-  local actual_user_table=''
-
-  # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
-  local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)"
-  if [[ "${full_admin_list}" =~ $regex ]]; then
-    actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
-  else
-    # This code block should never be reached, as long as the output table header remains the same.
-    # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
-
-    echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users."
-    echo "       Please review the output of 'gitea admin user list --admin' shown below."
-    echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
-    echo "DEBUG: Output of 'gitea admin user list --admin'"
-    echo "--"
-    echo "${full_admin_list}"
-    echo "--"
-    exit 1
-  fi
-
-  local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
-  if [[ -z "${ACCOUNT_ID}" ]]; then
-    local -a create_args
-    create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "${GITEA_ADMIN_EMAIL}")
-    if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
-      create_args+=(--must-change-password=true)
-    else
-      create_args+=(--must-change-password=false)
-    fi
-    echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
-    gitea admin user create "${create_args[@]}"
-    echo '...created.'
-  else
-    if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then
-      echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
-      # See https://gitea.com/gitea/helm-gitea/issues/673
-      # --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior
-      #   which acted as if it were provided with =false. If the argument is present in this version of gitea, then we
-      #   should add it to prevent requiring frequent admin password resets.
-      local -a change_args
-      change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
-      if gitea admin user change-password --help | grep -F -- '--must-change-password' >/dev/null; then
-        change_args+=(--must-change-password=false)
-      fi
-      gitea admin user change-password "${change_args[@]}"
-      echo '...password sync done.'
-    else
-      echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping."
-    fi
-  fi
-}
-
-configure_admin_user
-{{- end }}
-
-function configure_ldap() {
-  {{- if .Values.gitea.ldap }}
-  {{- range $idx, $value := .Values.gitea.ldap }}
-  local LDAP_NAME={{ (printf "%s" $value.name) | squote }}
-  local full_auth_list=$(gitea admin auth list --vertical-bars)
-  local actual_auth_table=''
-
-  # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
-  local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
-  if [[ "${full_auth_list}" =~ $regex ]]; then
-    actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
-  else
-    # This code block should never be reached, as long as the output table header remains the same.
-    # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
-
-    echo "ERROR: 'configure_ldap' was not able to determine the current list of authentication sources."
-    echo "       Please review the output of 'gitea admin auth list --vertical-bars' shown below."
-    echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
-    echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
-    echo "--"
-    echo "${full_auth_list}"
-    echo "--"
-    exit 1
-  fi
-
-  local GITEA_AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${LDAP_NAME}\s+\|" | grep -iE '\|LDAP \(via BindDN\)\s+\|' | awk -F " "  "{print \$1}")
-
-  if [[ -z "${GITEA_AUTH_ID}" ]]; then
-    echo "No ldap configuration found with name '${LDAP_NAME}'. Installing it now..."
-    gitea admin auth add-ldap {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
-    echo '...installed.'
-  else
-    echo "Existing ldap configuration with name '${LDAP_NAME}': '${GITEA_AUTH_ID}'. Running update to sync settings..."
-    gitea admin auth update-ldap --id "${GITEA_AUTH_ID}" {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
-    echo '...sync settings done.'
-  fi
-  {{- end }}
-  {{- else }}
-    echo 'no ldap configuration... skipping.'
-  {{- end }}
-}
-
-configure_ldap
-
-function configure_oauth() {
-  {{- if .Values.gitea.oauth }}
-  {{- range $idx, $value := .Values.gitea.oauth }}
-  local OAUTH_NAME={{ (printf "%s" $value.name) | squote }}
-  local full_auth_list=$(gitea admin auth list --vertical-bars)
-  local actual_auth_table=''
-
-  # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
-  local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
-  if [[ "${full_auth_list}" =~ $regex ]]; then
-    actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
-  else
-    # This code block should never be reached, as long as the output table header remains the same.
-    # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
-
-    echo "ERROR: 'configure_oauth' was not able to determine the current list of authentication sources."
-    echo "       Please review the output of 'gitea admin auth list --vertical-bars' shown below."
-    echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
-    echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
-    echo "--"
-    echo "${full_auth_list}"
-    echo "--"
-    exit 1
-  fi
-
-  local AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${OAUTH_NAME}\s+\|" | grep -iE '\|OAuth2\s+\|' | awk -F " "  "{print \$1}")
-
-  if [[ -z "${AUTH_ID}" ]]; then
-    echo "No oauth configuration found with name '${OAUTH_NAME}'. Installing it now..."
-    gitea admin auth add-oauth {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
-    echo '...installed.'
-  else
-    echo "Existing oauth configuration with name '${OAUTH_NAME}': '${AUTH_ID}'. Running update to sync settings..."
-    gitea admin auth update-oauth --id "${AUTH_ID}" {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
-    echo '...sync settings done.'
-  fi
-  {{- end }}
-  {{- else }}
-    echo 'no oauth configuration... skipping.'
-  {{- end }}
-}
-
-configure_oauth
-
-echo '==== END GITEA CONFIGURATION ===='
-{{- end }}

templates/secret_inlineConfig.yaml

@@ -1,21 +0,0 @@
-{{- /* Evaluated outside of the Secret because it populates `.Values.gitea.config` for the other templates. */ -}}
-{{- $inlineConfiguration := include "gitea.inline_configuration" . -}}
-{{- if not .Values.secrets.inlineConfig.existingSecret.enabled -}}
----
-apiVersion: v1
-kind: Secret
-metadata:
-  {{- with (include "gitea.secret.inlineConfig.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  labels:
-    {{- include "gitea.secret.inlineConfig.labels" . | nindent 4 }}
-  name: {{ include "gitea.secret.inlineConfig.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-type: Opaque
-data:
-  {{- range $key, $value := fromYaml $inlineConfiguration }}
-  {{ $key }}: {{ $value | b64enc | quote }}
-  {{- end }}
-{{- end }}

templates/secret_metrics.yaml

@@ -1,16 +0,0 @@
-{{- if and (.Values.gitea.metrics.enabled) (.Values.gitea.metrics.serviceMonitor.enabled) (.Values.gitea.metrics.token) (not .Values.secrets.metrics.existingSecret.enabled) -}}
-apiVersion: v1
-kind: Secret
-metadata:
-  {{- with (include "gitea.secret.metrics.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  labels:
-    {{- include "gitea.secret.metrics.labels" . | nindent 4 }}
-  name: {{ include "gitea.secret.metrics.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-type: Opaque
-data:
-  token: {{ .Values.gitea.metrics.token  | b64enc }}
-{{- end }}

templates/serviceAccount.yaml

@@ -1,21 +0,0 @@
-{{- if eq (include "gitea.serviceAccount.enabled" .) "true" }}
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  {{- with (include "gitea.serviceAccount.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.serviceAccount.labels" .) }}
-  labels:
-    {{- . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.serviceAccount.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-automountServiceAccountToken: {{ .Values.serviceAccount.new.automountServiceAccountToken }}
-{{- with .Values.serviceAccount.new.imagePullSecrets }}
-imagePullSecrets:
-  {{- . | toYaml | nindent 2 }}
-{{- end }}
-{{- end }}

templates/serviceaccount.yaml

@@ -0,0 +1,21 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "gitea.serviceAccountName" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "gitea.labels" . | nindent 4 }}
+    {{- with .Values.serviceAccount.labels }}
+    {{- . | toYaml | nindent 4 }}
+  {{- end }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- . | toYaml | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
+{{- with .Values.serviceAccount.imagePullSecrets }}
+imagePullSecrets:
+  {{- . | toYaml | nindent 2 }}
+{{- end }}
+{{- end }}

templates/servicemonitor.yaml

@@ -36,7 +36,7 @@ spec:
     authorization:
       type: Bearer
       credentials:
-        name: {{ include "gitea.secret.metrics.name" . }}
+        name: {{ include "gitea.metrics-secret-name" . }}
         key: token
         optional: false
     {{- end }}

templates/ssh-svc.yaml

@@ -1,15 +1,15 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
+  name: {{ include "gitea.fullname" . }}-ssh
-    {{- toYaml .Values.service.ssh.annotations | nindent 4 }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
   labels:
     {{- include "gitea.labels" . | nindent 4 }}
     {{- if .Values.service.ssh.labels }}
     {{- toYaml .Values.service.ssh.labels  | nindent 4 }}
     {{- end }}
-  name: {{ include "gitea.service.ssh.name" . }}
+  annotations:
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
+    {{- toYaml .Values.service.ssh.annotations | nindent 4 }}
 spec:
   type: {{ .Values.service.ssh.type }}
   {{- if eq .Values.service.ssh.type "LoadBalancer" }}

templates/tcpRoute.yaml

@@ -1,34 +0,0 @@
-{{- if eq (include "gitea.tcpRoute.enabled" .) "true" -}}
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: TCPRoute
-metadata:
-  {{- with (include "gitea.tcpRoute.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.tcpRoute.labels" .) }}
-  labels:
-    {{- . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.fullname" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-spec:
-  parentRefs:
-    {{- if .Values.gatewayAPI.core.tcpRoute.parentRefs }}
-    {{- toYaml .Values.gatewayAPI.core.tcpRoute.parentRefs | nindent 4 }}
-    {{- else }}
-    {{- fail "gatewayAPI.core.tcpRoute.parentRefs is required" }}
-    {{- end }}
-  rules:
-    {{- if .Values.gatewayAPI.core.tcpRoute.rules }}
-    {{- tpl (toYaml .Values.gatewayAPI.core.tcpRoute.rules) $ | nindent 4 }}
-    {{- else }}
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: {{ include "gitea.service.ssh.name" . }}
-          port: {{ .Values.service.ssh.port }}
-          weight: 1
-    {{- end }}
-{{- end }}

templates/tests/test-http-connection.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.test.enabled }}
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "gitea.fullname" . }}-test-connection"
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+{{ include "gitea.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test-success
+spec:
+  containers:
+    - name: wget
+      image: "{{ .Values.test.image.name }}:{{ .Values.test.image.tag }}"
+      command: ['wget']
+      args:  ['{{ include "gitea.fullname" . }}-http:{{ .Values.service.http.port }}']
+  restartPolicy: Never
+{{- end }}

unittests/bash/tests/init-containers/config/config_environment.bats

@@ -9,51 +9,27 @@ function setup() {
   export GITEA_APP_INI="$BATS_TEST_TMPDIR/app.ini"
   export TMP_EXISTING_ENVS_FILE="$BATS_TEST_TMPDIR/existing-envs"
   export ENV_TO_INI_MOUNT_POINT="$BATS_TEST_TMPDIR/env-to-ini-mounts"
-  export GITEA_EDIT_INI_EXPECTED=0
-  export PATH="$BATS_TEST_TMPDIR/bin:$PATH"
 
-  mkdir -p "$BATS_TEST_TMPDIR/bin"
+  stub gitea \
-  cat >"$BATS_TEST_TMPDIR/bin/gitea" <<'EOF'
+      "generate secret INTERNAL_TOKEN : echo 'mocked-internal-token'" \
-#!/usr/bin/env bash
+      "generate secret SECRET_KEY : echo 'mocked-secret-key'" \
-set -euo pipefail
+      "generate secret JWT_SECRET : echo 'mocked-jwt-secret'" \
-
+      "generate secret LFS_JWT_SECRET : echo 'mocked-lfs-jwt-secret'"
-case "$*" in
-  'generate secret INTERNAL_TOKEN')
-    echo 'mocked-internal-token'
-    ;;
-  'generate secret SECRET_KEY')
-    echo 'mocked-secret-key'
-    ;;
-  'generate secret JWT_SECRET')
-    echo 'mocked-jwt-secret'
-    ;;
-  'generate secret LFS_JWT_SECRET')
-    echo 'mocked-lfs-jwt-secret'
-    ;;
-  "config edit-ini --apply-env --config $GITEA_APP_INI --out $GITEA_APP_INI")
-    if [ "$GITEA_EDIT_INI_EXPECTED" -eq 1 ]; then
-      echo 'Stubbed gitea config edit-ini was called!'
-      exit 0
-    fi
-
-    echo 'Unexpected gitea config edit-ini invocation' >&2
-    exit 127
-    ;;
-  *)
-    echo "Unexpected gitea invocation: $*" >&2
-    exit 127
-    ;;
-esac
-EOF
-  chmod +x "$BATS_TEST_TMPDIR/bin/gitea"
 }
 
 function teardown() {
-  :
+  unstub gitea
+  # This condition exists due to https://github.com/jasonkarns/bats-mock/pull/37 being still open
+  if [ $ENV_TO_INI_EXPECTED -eq 1 ]; then
+    unstub environment-to-ini
+  fi
 }
 
-function expect_gitea_config_edit_ini_call() {
+# This function exists due to https://github.com/jasonkarns/bats-mock/pull/37 being still open
-  export GITEA_EDIT_INI_EXPECTED=1
+function expect_environment_to_ini_call() {
+  export ENV_TO_INI_EXPECTED=1
+  stub environment-to-ini \
+    "-o $GITEA_APP_INI : echo 'Stubbed environment-to-ini was called!'"
 }
 
 function execute_test_script() {
@@ -80,18 +56,18 @@ function write_mounted_file() {
 }
 
 @test "works as expected when nothing is configured" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   run $PROJECT_ROOT/scripts/init-containers/config/config_environment.sh
 
   assert_success
   assert_line '...Initial secrets generated'
   assert_line 'Reloading preset envs...'
   assert_line '=== All configuration sources loaded ==='
-  assert_line 'Stubbed gitea config edit-ini was called!'
+  assert_line 'Stubbed environment-to-ini was called!'
 }
 
 @test "exports initial secrets" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   run execute_test_script
 
   assert_success
@@ -102,7 +78,7 @@ function write_mounted_file() {
 }
 
 @test "does NOT export initial secrets when app.ini already exists" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   touch $GITEA_APP_INI
 
   run execute_test_script
@@ -116,7 +92,7 @@ function write_mounted_file() {
 }
 
 @test "ensures that preset environment variables take precedence over auto-generated ones" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   export GITEA__OAUTH2__JWT_SECRET="pre-defined-jwt-secret"
 
   run execute_test_script
@@ -126,7 +102,7 @@ function write_mounted_file() {
 }
 
 @test "ensures that preset environment variables take precedence over mounted ones" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   export GITEA__OAUTH2__JWT_SECRET="pre-defined-jwt-secret"
   write_mounted_file "inlines" "oauth2" "$(cat << EOF
 JWT_SECRET=inline-jwt-secret
@@ -141,7 +117,7 @@ EOF
 }
 
 @test "ensures that additionals take precedence over inlines" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   write_mounted_file "inlines" "oauth2" "$(cat << EOF
 JWT_SECRET=inline-jwt-secret
 EOF
@@ -160,7 +136,7 @@ EOF
 }
 
 @test "ensures that dotted/dashed sections are properly masked" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   write_mounted_file "inlines" "repository.pull-request" "$(cat << EOF
 WORK_IN_PROGRESS_PREFIXES=WIP:,[WIP]
 EOF
@@ -176,7 +152,7 @@ EOF
 ##### THIS IS A BUG, BUT I WANT IT TO BE COVERED BY TESTS #####
 ###############################################################
 @test "ensures uppercase section and setting names (🐞)" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   export GITEA__oauth2__JwT_Secret="pre-defined-jwt-secret"
   write_mounted_file "inlines" "repository.pull-request" "$(cat << EOF
 WORK_IN_progress_PREFIXES=WIP:,[WIP]
@@ -191,7 +167,7 @@ EOF
 }
 
 @test "treats top-level configuration as section-less" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   write_mounted_file "inlines" "_generals_" "$(cat << EOF
 APP_NAME=Hello top-level configuration
 RUN_MODE=dev

unittests/helm/admin-secret/basics.yaml

@@ -1,64 +0,0 @@
-suite: Test admin secret
-release:
-  name: gitea-unittests
-  namespace: testing
-templates:
-  - templates/secret_admin.yaml
-tests:
-  - it: "Skip rendering when the admin user is disabled"
-    set:
-      secrets.admin.enabled: false
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: "Skip rendering when an existing Secret is referenced"
-    set:
-      secrets.admin.enabled: true
-      secrets.admin.existingSecret.enabled: true
-      secrets.admin.existingSecret.secretName: "external-secret-reference"
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: "Fail when no credentials are configured"
-    set:
-      secrets.admin.new.password: ""
-    asserts:
-      - failedTemplate:
-          errorMessage: Either specify `secrets.admin.new.username` and `secrets.admin.new.password` or reference an existing Secret via `secrets.admin.existingSecret`
-
-  - it: "Render the Secret with the default credentials"
-    asserts:
-      - hasDocuments:
-          count: 1
-      - documentIndex: 0
-        containsDocument:
-          kind: Secret
-          apiVersion: v1
-          name: gitea-unittests-admin
-      - isNotNullOrEmpty:
-          path: metadata.labels
-      - equal:
-          path: data.email
-          value: "Z2l0ZWFAbG9jYWwuZG9tYWlu"
-      - equal:
-          path: data.password
-          value: "cjhzQThDUEhEOSFidDZk"
-      - equal:
-          path: data.username
-          value: "Z2l0ZWFfYWRtaW4="
-
-  - it: "Render custom annotations and labels"
-    set:
-      secrets.admin.new.annotations:
-        custom-annotation: annotation-value
-      secrets.admin.new.labels:
-        custom-label: label-value
-    asserts:
-      - equal:
-          path: metadata.annotations["custom-annotation"]
-          value: annotation-value
-      - equal:
-          path: metadata.labels["custom-label"]
-          value: label-value

unittests/helm/check-actions-not-present.yaml

@@ -0,0 +1,12 @@
+suite: Check if actions raises an error
+release:
+  name: gitea-unittests
+  namespace: testing
+tests:
+  - it: fails when trying to configure actions due to removal
+    set:
+      actions:
+        enabled: true
+    asserts:
+      - failedTemplate:
+          errorMessage: The actions sub-chart has been outsourced to a dedicated chart available at https://gitea.com/gitea/helm-actions. For assistance with the migration process, check https://gitea.com/gitea/helm-actions/issues/9.

unittests/helm/cluster/basics.yaml

@@ -1,182 +0,0 @@
-suite: Test cluster basics
-release:
-  name: gitea-unittests
-  namespace: testing
-tests:
-  - it: "Render nothing when cloudnativePG is disabled"
-    templates:
-      - templates/cluster.yaml
-      - templates/secret_cloudnativePG.yaml
-    set:
-      cloudnativePG:
-        enabled: false
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: "Render the Cluster with the default values"
-    template: templates/cluster.yaml
-    set:
-      cloudnativePG:
-        enabled: true
-    asserts:
-      - containsDocument:
-          kind: Cluster
-          apiVersion: postgresql.cnpg.io/v1
-          name: gitea-unittests-postgresql
-          namespace: testing
-      - equal:
-          path: spec.instances
-          value: 3
-      - equal:
-          path: spec.imageName
-          value: "ghcr.io/cloudnative-pg/postgresql:18.0"
-      - equal:
-          path: spec.bootstrap.initdb
-          value:
-            database: "gitea"
-            owner: "gitea"
-            secret:
-              name: gitea-unittests-postgresql-app
-      - equal:
-          path: spec.storage.size
-          value: "10Gi"
-      - notExists:
-          path: spec.storage.storageClass
-      - notExists:
-          path: spec.walStorage
-      - notExists:
-          path: spec.affinity
-      - notExists:
-          path: spec.topologySpreadConstraints
-
-  - it: "Render the credential Secret with the default values"
-    template: templates/secret_cloudnativePG.yaml
-    set:
-      cloudnativePG:
-        enabled: true
-    asserts:
-      - containsDocument:
-          kind: Secret
-          apiVersion: v1
-          name: gitea-unittests-postgresql-app
-          namespace: testing
-      - equal:
-          path: type
-          value: kubernetes.io/basic-auth
-      - equal:
-          path: data.password
-          decodeBase64: true
-          value: "gitea"
-      - equal:
-          path: data.username
-          decodeBase64: true
-          value: "gitea"
-      - notExists:
-          path: data.database
-      - notExists:
-          path: stringData
-
-  - it: "Render no credential Secret when an existing Secret is used"
-    template: templates/secret_cloudnativePG.yaml
-    set:
-      cloudnativePG:
-        enabled: true
-        credentials:
-          existingSecret:
-            enabled: true
-            secretName: my-credentials
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: "Reference the existing Secret in the Cluster"
-    template: templates/cluster.yaml
-    set:
-      cloudnativePG:
-        enabled: true
-        credentials:
-          existingSecret:
-            enabled: true
-            secretName: my-credentials
-          database: my-database
-          username: my-username
-    asserts:
-      - equal:
-          path: spec.bootstrap.initdb
-          value:
-            database: "my-database"
-            owner: "my-username"
-            secret:
-              name: my-credentials
-
-  - it: "Apply the storage and walStorage customizations"
-    template: templates/cluster.yaml
-    set:
-      cloudnativePG:
-        enabled: true
-        storage:
-          size: 1337Mi
-          storageClass: my-storage-class
-        walStorage:
-          enabled: true
-          size: 42Mi
-          storageClass: my-wal-storage-class
-    asserts:
-      - equal:
-          path: spec.storage
-          value:
-            size: "1337Mi"
-            storageClass: "my-storage-class"
-      - equal:
-          path: spec.walStorage
-          value:
-            size: "42Mi"
-            storageClass: "my-wal-storage-class"
-
-  - it: "Apply the scheduling customizations"
-    template: templates/cluster.yaml
-    set:
-      cloudnativePG:
-        enabled: true
-        affinity:
-          nodeSelector:
-            disktype: ssd
-          podAntiAffinityType: required
-          tolerations:
-            - key: my-key
-              operator: Equal
-              value: my-value
-              effect: NoSchedule
-        priorityClassName: my-priority-class
-        topologySpreadConstraints:
-          - maxSkew: 1
-            topologyKey: topology.kubernetes.io/zone
-            whenUnsatisfiable: DoNotSchedule
-            labelSelector:
-              matchLabels:
-                app.kubernetes.io/name: gitea
-    asserts:
-      - equal:
-          path: spec.affinity
-          value:
-            nodeSelector:
-              disktype: ssd
-            podAntiAffinityType: required
-            tolerations:
-              - key: my-key
-                operator: Equal
-                value: my-value
-                effect: NoSchedule
-      - equal:
-          path: spec.priorityClassName
-          value: my-priority-class
-      - equal:
-          path: spec.topologySpreadConstraints
-          value:
-            - maxSkew: 1
-              topologyKey: topology.kubernetes.io/zone
-              whenUnsatisfiable: DoNotSchedule
-              labelSelector:
-                matchLabels:
-                  app.kubernetes.io/name: gitea

unittests/helm/config/actions-config.yaml

@@ -0,0 +1,24 @@
+suite: config template | actions config
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/config.yaml
+tests:
+  - it: "actions are enabled by default (based on vanilla Gitea behavior)"
+    template: templates/config.yaml
+    asserts:
+      - documentIndex: 0
+        notExists:
+          path: stringData.actions
+
+  - it: "actions can be disabled via inline config"
+    template: templates/config.yaml
+    set:
+      gitea.config.actions.ENABLED: false
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.actions
+          value: |-
+            ENABLED=false

unittests/helm/config/actions.yaml

@@ -1,25 +0,0 @@
-suite: Test config actions
-release:
-  name: gitea-unittests
-  namespace: testing
-templates:
-  - templates/secret_inlineConfig.yaml
-tests:
-  - it: "Enable actions by default to match vanilla Gitea"
-    template: templates/secret_inlineConfig.yaml
-    asserts:
-      - documentIndex: 0
-        notExists:
-          path: data.actions
-
-  - it: "Disable actions via the inline config"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      gitea.config.actions.ENABLED: false
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.actions
-          decodeBase64: true
-          value: |-
-            ENABLED=false

unittests/helm/config/cache-config.yaml

@@ -0,0 +1,66 @@
+suite: config template | cache config
+release:
+  name: gitea-unittests
+  namespace: testing
+tests:
+  - it: "cache is configured correctly for valkey-cluster"
+    template: templates/config.yaml
+    set:
+      valkey-cluster:
+        enabled: true
+      valkey:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.cache
+          value: |-
+            ADAPTER=redis
+            HOST=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+
+  - it: "cache is configured correctly for valkey"
+    template: templates/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: true
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.cache
+          value: |-
+            ADAPTER=redis
+            HOST=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+
+  - it: "cache is configured correctly for 'memory' when valkey (or valkey-cluster) is disabled"
+    template: templates/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.cache
+          value: |-
+            ADAPTER=memory
+            HOST=
+
+  - it: "cache can be customized when valkey (or valkey-cluster) is disabled"
+    template: templates/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: false
+      gitea.config.cache.ADAPTER: custom-adapter
+      gitea.config.cache.HOST: custom-host
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.cache
+          value: |-
+            ADAPTER=custom-adapter
+            HOST=custom-host

unittests/helm/config/cache.yaml

@@ -1,48 +0,0 @@
-suite: Test config cache
-release:
-  name: gitea-unittests
-  namespace: testing
-tests:
-  - it: "Configure the cache for valkey"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: true
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.cache
-          decodeBase64: true
-          value: |-
-            ADAPTER=redis
-            HOST=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
-
-  - it: "Configure the cache for 'memory' when valkey is disabled"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: false
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.cache
-          decodeBase64: true
-          value: |-
-            ADAPTER=memory
-            HOST=
-
-  - it: "Customize the cache when valkey is disabled"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: false
-      gitea.config.cache.ADAPTER: custom-adapter
-      gitea.config.cache.HOST: custom-host
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.cache
-          decodeBase64: true
-          value: |-
-            ADAPTER=custom-adapter
-            HOST=custom-host

unittests/helm/config/database.yaml

@@ -1,48 +0,0 @@
-suite: Test config database
-release:
-  name: gitea-unittests
-  namespace: testing
-tests:
-  - it: "Connect to the read-write Service of the CloudNativePG Cluster"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      cloudnativePG:
-        enabled: true
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.database
-          decodeBase64: true
-          pattern: HOST=gitea-unittests-postgresql-rw.testing.svc.cluster.local:5432
-
-  - it: "Connect to the read-write Service of the CloudNativePG Cluster with a custom cluster domain"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      clusterDomain: my-special-cluster.local
-      cloudnativePG:
-        enabled: true
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.database
-          decodeBase64: true
-          pattern: HOST=gitea-unittests-postgresql-rw.testing.svc.my-special-cluster.local:5432
-
-  - it: "Connect to the configured CloudNativePG database"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      cloudnativePG:
-        enabled: true
-        credentials:
-          database: gitea-database
-          username: gitea-username
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.database
-          decodeBase64: true
-          value: |-
-            DB_TYPE=postgres
-            HOST=gitea-unittests-postgresql-rw.testing.svc.cluster.local:5432
-            NAME=gitea-database
-            USER=gitea-username

unittests/helm/config/environmentScript.yaml

@@ -1,25 +0,0 @@
-suite: Test config environment script
-release:
-  name: gitea-unittests
-  namespace: testing
-templates:
-  - templates/secret_admin.yaml
-  - templates/secret_config.yaml
-tests:
-  - it: "Write app.ini from the environment variables via `gitea config edit-ini`"
-    template: templates/secret_config.yaml
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data["config_environment.sh"]
-          decodeBase64: true
-          pattern: 'gitea config edit-ini --apply-env --config .+GITEA_APP_INI.+ --out .+GITEA_APP_INI'
-  - it: "Render data instead of stringData so removed keys are pruned on upgrade"
-    template: templates/secret_config.yaml
-    asserts:
-      - documentIndex: 0
-        notExists:
-          path: stringData
-      - documentIndex: 0
-        exists:
-          path: data["config_environment.sh"]

unittests/helm/config/metrics-section_metrics-token.yaml

@@ -1,10 +1,10 @@
-suite: Test config metrics token
+suite: config template | metrics section (metrics token)
 release:
   name: gitea-unittests
   namespace: testing
 tests:
-  - it: "Configure the metrics token when it is set"
+  - it: metrics token is set
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
     set:
       gitea:
         metrics:
@@ -13,13 +13,12 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: data.metrics
+          path: stringData.metrics
-          decodeBase64: true
           value: |-
             ENABLED=true
             TOKEN=somepassword
-  - it: "Omit the metrics token when it is empty"
+  - it: metrics token is empty
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
     set:
       gitea:
         metrics:
@@ -28,12 +27,11 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: data.metrics
+          path: stringData.metrics
-          decodeBase64: true
           value: |-
             ENABLED=true
-  - it: "Omit the metrics token when it is nil"
+  - it: metrics token is nil
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
     set:
       gitea:
         metrics:
@@ -42,12 +40,11 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: data.metrics
+          path: stringData.metrics
-          decodeBase64: true
           value: |-
             ENABLED=true
-  - it: "Omit the metrics token when metrics are disabled"
+  - it: does not configures a token if metrics are disabled
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
     set:
       gitea:
         metrics:
@@ -56,7 +53,6 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: data.metrics
+          path: stringData.metrics
-          decodeBase64: true
           value: |-
             ENABLED=false

unittests/helm/config/queue-config.yaml

@@ -0,0 +1,66 @@
+suite: config template | queue config
+release:
+  name: gitea-unittests
+  namespace: testing
+tests:
+  - it: "queue is configured correctly for valkey-cluster"
+    template: templates/config.yaml
+    set:
+      valkey-cluster:
+        enabled: true
+      valkey:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.queue
+          value: |-
+            CONN_STR=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+            TYPE=redis
+
+  - it: "queue is configured correctly for valkey"
+    template: templates/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: true
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.queue
+          value: |-
+            CONN_STR=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+            TYPE=redis
+
+  - it: "queue is configured correctly for 'levelDB' when valkey (and valkey-cluster) is disabled"
+    template: templates/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.queue
+          value: |-
+            CONN_STR=
+            TYPE=level
+
+  - it: "queue can be customized when valkey (and valkey-cluster) are disabled"
+    template: templates/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: false
+      gitea.config.queue.TYPE: custom-type
+      gitea.config.queue.CONN_STR: custom-connection-string
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.queue
+          value: |-
+            CONN_STR=custom-connection-string
+            TYPE=custom-type

unittests/helm/config/queue.yaml

@@ -1,48 +0,0 @@
-suite: Test config queue
-release:
-  name: gitea-unittests
-  namespace: testing
-tests:
-  - it: "Configure the queue for valkey"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: true
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.queue
-          decodeBase64: true
-          value: |-
-            CONN_STR=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
-            TYPE=redis
-
-  - it: "Configure the queue for 'levelDB' when valkey is disabled"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: false
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.queue
-          decodeBase64: true
-          value: |-
-            CONN_STR=
-            TYPE=level
-
-  - it: "Customize the queue when valkey is disabled"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: false
-      gitea.config.queue.TYPE: custom-type
-      gitea.config.queue.CONN_STR: custom-connection-string
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.queue
-          decodeBase64: true
-          value: |-
-            CONN_STR=custom-connection-string
-            TYPE=custom-type

unittests/helm/config/server-section_domain.yaml

@@ -0,0 +1,67 @@
+suite: config template | server section (domain related)
+release:
+  name: gitea-unittests
+  namespace: testing
+tests:
+  - it: "[default values] uses ingress host for DOMAIN|SSH_DOMAIN|ROOT_URL"
+    template: templates/config.yaml
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nDOMAIN=git.example.com
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nSSH_DOMAIN=git.example.com
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nROOT_URL=http://git.example.com
+
+  ################################################
+
+  - it: "[no ingress hosts] uses gitea http service for DOMAIN|SSH_DOMAIN|ROOT_URL"
+    template: templates/config.yaml
+    set:
+      ingress:
+        hosts: []
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nDOMAIN=gitea-unittests-http.testing.svc.cluster.local
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nSSH_DOMAIN=gitea-unittests-http.testing.svc.cluster.local
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nROOT_URL=http://gitea-unittests-http.testing.svc.cluster.local
+
+  ################################################
+
+  - it: "[provided via values] uses that for DOMAIN|SSH_DOMAIN|ROOT_URL"
+    template: templates/config.yaml
+    set:
+      gitea.config.server.DOMAIN: provided.example.com
+      ingress:
+        hosts:
+          - host: non-used.example.com
+            paths:
+              - path: /
+                pathType: Prefix
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nDOMAIN=provided.example.com
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nSSH_DOMAIN=provided.example.com
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nROOT_URL=http://provided.example.com

unittests/helm/config/serverDomain.yaml

@@ -1,175 +0,0 @@
-suite: Test config server domain
-release:
-  name: gitea-unittests
-  namespace: testing
-tests:
-  - it: "[default values] Use the ingress host for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/secret_inlineConfig.yaml
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nDOMAIN=git.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nSSH_DOMAIN=git.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nROOT_URL=http://git.example.com
-
-  ################################################
-
-  - it: "[no ingress hosts] Use the HTTP Service for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      ingress:
-        hosts: []
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nDOMAIN=gitea-unittests-http.testing.svc.cluster.local
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nSSH_DOMAIN=gitea-unittests-http.testing.svc.cluster.local
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nROOT_URL=http://gitea-unittests-http.testing.svc.cluster.local
-
-  ################################################
-
-  - it: "[provided via values] Use the configured values for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      gitea.config.server.DOMAIN: provided.example.com
-      ingress:
-        hosts:
-          - host: non-used.example.com
-            paths:
-              - path: /
-                pathType: Prefix
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nDOMAIN=provided.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nSSH_DOMAIN=provided.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nROOT_URL=http://provided.example.com
-
-  ################################################
-
-  - it: "[route enabled] Use the Route host for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      route:
-        enabled: true
-        host: route.example.com
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nDOMAIN=route.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nSSH_DOMAIN=route.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nROOT_URL=http://route.example.com
-
-  ################################################
-
-  - it: "[route tls termination] Use https for ROOT_URL"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      route:
-        enabled: true
-        host: route.example.com
-        tls:
-          termination: edge
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nROOT_URL=https://route.example.com
-
-  ################################################
-
-  - it: "[HTTPRoute enabled] Use the first hostname for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      ingress:
-        hosts: []
-      gatewayAPI:
-        enabled: true
-        core:
-          httpRoute:
-            enabled: true
-            hostnames:
-              - gw.example.com
-            parentRefs:
-              - name: shared-gateway
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nDOMAIN=gw.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nSSH_DOMAIN=gw.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nROOT_URL=http://gw.example.com
-
-  ################################################
-
-  - it: "[HTTPRoute tls] Switch ROOT_URL to https"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      ingress:
-        hosts: []
-      gatewayAPI:
-        enabled: true
-        core:
-          httpRoute:
-            enabled: true
-            tls: true
-            hostnames:
-              - gw.example.com
-            parentRefs:
-              - name: shared-gateway
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nROOT_URL=https://gw.example.com

unittests/helm/config/session-config.yaml

@@ -0,0 +1,66 @@
+suite: config template | session config
+release:
+  name: gitea-unittests
+  namespace: testing
+tests:
+  - it: "session is configured correctly for valkey-cluster"
+    template: templates/config.yaml
+    set:
+      valkey-cluster:
+        enabled: true
+      valkey:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.session
+          value: |-
+            PROVIDER=redis
+            PROVIDER_CONFIG=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+
+  - it: "session is configured correctly for valkey"
+    template: templates/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: true
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.session
+          value: |-
+            PROVIDER=redis
+            PROVIDER_CONFIG=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+
+  - it: "session is configured correctly for 'memory' when valkey (and valkey-cluster) is disabled"
+    template: templates/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.session
+          value: |-
+            PROVIDER=memory
+            PROVIDER_CONFIG=
+
+  - it: "session can be customized when valkey (and valkey-cluster) is disabled"
+    template: templates/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: false
+      gitea.config.session.PROVIDER: custom-provider
+      gitea.config.session.PROVIDER_CONFIG: custom-provider-config
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.session
+          value: |-
+            PROVIDER=custom-provider
+            PROVIDER_CONFIG=custom-provider-config

unittests/helm/config/session.yaml

@@ -1,48 +0,0 @@
-suite: Test config session
-release:
-  name: gitea-unittests
-  namespace: testing
-tests:
-  - it: "Configure the session for valkey"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: true
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.session
-          decodeBase64: true
-          value: |-
-            PROVIDER=redis
-            PROVIDER_CONFIG=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
-
-  - it: "Configure the session for 'memory' when valkey is disabled"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: false
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.session
-          decodeBase64: true
-          value: |-
-            PROVIDER=memory
-            PROVIDER_CONFIG=
-
-  - it: "Customize the session when valkey is disabled"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: false
-      gitea.config.session.PROVIDER: custom-provider
-      gitea.config.session.PROVIDER_CONFIG: custom-provider-config
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.session
-          decodeBase64: true
-          value: |-
-            PROVIDER=custom-provider
-            PROVIDER_CONFIG=custom-provider-config

unittests/helm/dependency-checks/customization-integrity-postgresql-ha.yaml

@@ -0,0 +1,129 @@
+suite: Dependency checks | Customization integrity | postgresql-ha
+release:
+  name: gitea-unittests
+  namespace: testing
+set:
+  postgresql:
+    enabled: false
+  postgresql-ha:
+    enabled: true
+    global:
+      postgresql:
+        database: gitea-database
+        password: gitea-password
+        username: gitea-username
+    postgresql:
+      repmgrPassword: custom-password-repmgr
+      postgresPassword: custom-password-postgres
+      password: custom-password-overwritten-by-global-postgresql-password
+    pgpool:
+      adminPassword: custom-password-pgpool
+      srCheckPassword: custom-password-sr-check
+    service:
+      ports:
+        postgresql: 1234
+    persistence:
+      size: 1337Mi
+tests:
+  - it: "[postgresql-ha] DB settings are applied as expected"
+    template: charts/postgresql-ha/templates/postgresql/statefulset.yaml
+    asserts:
+      - documentIndex: 0
+        contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: POSTGRES_DB
+            value: "gitea-database"
+      - documentIndex: 0
+        contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: POSTGRES_USER
+            value: "gitea-username"
+  - it: "[postgresql-ha] DB passwords are applied as expected"
+    template: charts/postgresql-ha/templates/postgresql/secrets.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: data["repmgr-password"]
+          value: "Y3VzdG9tLXBhc3N3b3JkLXJlcG1ncg=="
+      - documentIndex: 0
+        equal:
+          path: data["postgres-password"]
+          value: "Y3VzdG9tLXBhc3N3b3JkLXBvc3RncmVz"
+      - documentIndex: 0
+        equal:
+          path: data["password"]
+          value: "Z2l0ZWEtcGFzc3dvcmQ=" # postgresql-ha.postgresql.password is overwritten by postgresql-ha.global.postgresql.password and should not be referenced here
+  - it: "[postgresql-ha] pgpool.adminPassword is applied as expected"
+    template: charts/postgresql-ha/templates/pgpool/secrets.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: data["admin-password"]
+          value: "Y3VzdG9tLXBhc3N3b3JkLXBncG9vbA=="
+  - it: "[postgresql-ha] pgpool.adminPassword is applied as expected"
+    template: charts/postgresql-ha/templates/pgpool/secrets.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: data["admin-password"]
+          value: "Y3VzdG9tLXBhc3N3b3JkLXBncG9vbA=="
+  - it: "[postgresql-ha] pgpool.adminPassword is applied as expected"
+    template: charts/postgresql-ha/templates/pgpool/secrets.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: data["admin-password"]
+          value: "Y3VzdG9tLXBhc3N3b3JkLXBncG9vbA=="
+  - it: "[postgresql-ha] pgpool.srCheckPassword is applied as expected"
+    template: charts/postgresql-ha/templates/pgpool/secrets.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: data["sr-check-password"]
+          value: "Y3VzdG9tLXBhc3N3b3JkLXNyLWNoZWNr"
+  - it: "[postgresql-ha] persistence.size is applied as expected"
+    template: charts/postgresql-ha/templates/postgresql/statefulset.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: spec.volumeClaimTemplates[0].spec.resources.requests.storage
+          value: "1337Mi"
+  - it: "[postgresql-ha] service.ports.postgresql is applied as expected"
+    template: charts/postgresql-ha/templates/pgpool/service.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: spec.ports[0].port
+          value: 1234
+  - it: "[postgresql-ha] renders the referenced service"
+    template: charts/postgresql-ha/templates/pgpool/service.yaml
+    asserts:
+      - containsDocument:
+          kind: Service
+          apiVersion: v1
+          name: gitea-unittests-postgresql-ha-pgpool
+          namespace: testing
+  - it: "[gitea] connects to pgpool service"
+    template: templates/config.yaml
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.database
+          pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.cluster.local:1234
+  - it: "[gitea] connects to configured database"
+    template: templates/config.yaml
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.database
+          pattern: NAME=gitea-database
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.database
+          pattern: USER=gitea-username
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.database
+          pattern: PASSWD=gitea-password