domain-incoming/apps/gitea/datas.tf

locals {
  common-labels = {
    "vynil.solidite.fr/owner-name" = var.instance
    "vynil.solidite.fr/owner-namespace" = var.namespace
    "vynil.solidite.fr/owner-category" = var.category
    "vynil.solidite.fr/owner-component" = var.component
    "app.kubernetes.io/managed-by" = "vynil"
    "app.kubernetes.io/instance" = var.instance
  }
  removePatch = <<-EOF
    - op: remove
      path: /spec/loadBalancerIP
  EOF
  modifyPatch = <<-EOF
    - op: replace
      path: /spec/loadBalancerIP
      value: "${var.load-balancer.ip}"
    EOF
}

data "kubernetes_secret_v1" "postgresql_password" {
  depends_on = [kubectl_manifest.prj_pg]
  metadata {
    name = "${var.instance}-${var.component}-pg-app"
    namespace = var.namespace
  }
}

data "kubernetes_secret_v1" "authentik" {
  metadata {
    name = "authentik"
    namespace = "${var.domain}-auth"
  }
}

data "kustomization_overlay" "data" {
  common_labels = local.common-labels
  namespace = var.namespace
  resources = [for file in fileset(path.module, "*.yaml"): file if ! contains(["index.yaml", "v1_ConfigMap_gitea-themes.yaml"], file)]
  patches {
    target {
      kind = "Deployment"
      name = "gitea"
    }
    patch = <<-EOF
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: gitea
        annotations:
          secret.reloader.stakater.com/reload: "gitea-ldap,gitea-admin-user"
      spec:
        replicas: ${var.replicas}
        template:
          spec:
            initContainers:
            - name: init-directories
              image: "${var.images.gitea.registry}/${var.images.gitea.repository}:${var.images.gitea.tag}"
              imagePullPolicy: "${var.images.gitea.pullPolicy}"
            - name: init-app-ini
              image: "${var.images.gitea.registry}/${var.images.gitea.repository}:${var.images.gitea.tag}"
              imagePullPolicy: IfNotPresent
            - name: configure-gitea
              image: "${var.images.gitea.registry}/${var.images.gitea.repository}:${var.images.gitea.tag}"
              imagePullPolicy: IfNotPresent
              env:
              - name: VYNIL_OAUTH_DISCOVERY
                value: "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/${var.component}-${var.instance}/.well-known/openid-configuration"
              - name: GITEA_OAUTH_KEY_0
                valueFrom:
                  secretKeyRef:
                    name: "${var.component}-${var.instance}-id"
                    key: client-id
              - name: GITEA_OAUTH_SECRET_0
                valueFrom:
                  secretKeyRef:
                    name: "${var.component}-${var.instance}-secret"
                    key: client-secret
              - name: LDAP_USER_SEARCH_BASE
                valueFrom:
                  secretKeyRef:
                    key:  user-search-base
                    name: gitea-ldap
              - name: LDAP_USER_FILTER
                valueFrom:
                  secretKeyRef:
                    key:  user-filter
                    name: gitea-ldap
              - name: LDAP_ADMIN_FILTER
                valueFrom:
                  secretKeyRef:
                    key:  admin-filter
                    name: gitea-ldap
              - name: LDAP_HOST
                valueFrom:
                  secretKeyRef:
                    key:  endpoint
                    name: gitea-ldap
              - name: TZ
                value: ${var.timezone}
            containers:
            - name: gitea
              image: "${var.images.gitea.registry}/${var.images.gitea.repository}:${var.images.gitea.tag}"
              imagePullPolicy: IfNotPresent
              env:
              - name: SSH_LISTEN_PORT
                value: "2222"
              - name: SSH_PORT
                value: "${var.ssh-port}"
              - name: SSH_LOG_LEVEL
                value: "INFO"
              - name: TZ
                value: ${var.timezone}
    EOF
  }

  patches {
    target {
      kind = "PersistentVolumeClaim"
      name = "gitea-shared-storage"
    }
    patch = <<-EOF
      kind: PersistentVolumeClaim
      apiVersion: v1
      metadata:
        name: gitea-shared-storage
        annotations:
          k8up.io/backup: "true"
      spec:
        accessModes:
        - "${var.volume.accessMode}"
        volumeMode: Filesystem
        resources:
          requests:
            storage: "${var.volume.size}"
    EOF
  }
  patches {
    target {
      kind = "Service"
      name = "gitea-ssh"
    }
    patch = <<-EOF
    - op: replace
      path: /spec/ports/0/port
      value: ${var.ssh-port}
    EOF
  }
  patches {
    target {
      kind = "Service"
      name = "gitea-ssh"
    }
    patch = var.load-balancer.ip==""?local.removePatch:local.modifyPatch
  }
}