apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitea
  labels:
    app: gitea
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: gitea
  template:
    metadata:
      labels:
        app: gitea
    spec:
      securityContext:
        fsGroup: 1000
      containers:
        - name: gitea
          image: gitea/gitea:28.3.0
          env:
            - name: USER_UID
              value: "1000"
            - name: USER_GID
              value: "1000"
            - name: TZ
              value: Europe/Amsterdam
            - name: GITEA__server__ROOT_URL
              value: https://git.rubenhensen.nl/
            - name: GITEA__server__DOMAIN
              value: git.rubenhensen.nl
            - name: GITEA__server__PROTOCOL
              value: http
            - name: GITEA__server__HTTP_PORT
              value: "3000"
            - name: GITEA__server__DISABLE_SSH
              value: "true"
            - name: GITEA__database__DB_TYPE
              value: sqlite3
            - name: GITEA__database__PATH
              value: /data/gitea/gitea.db
            - name: GITEA__security__INSTALL_LOCK
              value: "true"
            - name: GITEA__log__MODE
              value: console
          ports:
            - containerPort: 3000
              name: http
              protocol: TCP
          resources:
            requests:
              cpu: 20m
              memory: 336Mi
            limits:
              memory: 1Gi
          # /api/healthz checks the database and the cache.
          readinessProbe:
            httpGet:
              path: /api/healthz
              port: http
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            httpGet:
              path: /api/healthz
              port: http
            initialDelaySeconds: 60
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 5
          volumeMounts:
            - mountPath: /data
              name: data
            # Trust store without the compromised eMudhra intermediates,
            # see ca-bundle/. Drop once the image ships a fixed bundle.
            - mountPath: /etc/ssl/certs
              name: patched-ca-bundle
              readOnly: true
      restartPolicy: Always
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: gitea-data
        - name: patched-ca-bundle
          configMap:
            name: patched-ca-bundle