feat(gitea): move Gitea into the gitea namespace (stage 2 of #878 )

- kubernetes/apps/gitea: every object in namespace gitea; applied by a new gitea Flux Kustomization (clusters/homelab/gitea.yaml) instead of apps. gitea-allow-metrics-scrape dropped: the gitea-ns baseline already admits monitoring. - Rotators (flux-git, review-bot) and the Prometheus gitea job use gitea.gitea.svc. - bootstrap.sh waits for the gitea KS. Data: data-gitea-0 is not copied. The PV (reclaimPolicy Retain) is rebound to a PVC gitea/data-gitea-0 pre-created with volumeName, which the new StatefulSet adopts. gitea-tls is pre-issued in the gitea namespace so HTTPS has no certificate gap. Refs #878 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Merge pull request 'feat(gitea): prepare the gitea namespace (stage 1 of #878 )' (#905 ) from feat/gitea-namespace-phase1 into master
2026-09-23 07:44:26 +02:00 · 2026-09-23 05:35:18 +00:00 · 2026-09-23 07:30:36 +02:00 · 2026-09-23 05:16:03 +00:00 · 2026-09-23 05:13:16 +00:00 · 2026-09-23 05:12:40 +00:00
27 changed files with 215 additions and 82 deletions
@@ -101,7 +101,7 @@ steps:
        bash scripts/ci/make-diag-kubeconfig.sh

  - name: alert-triage-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -14,8 +14,8 @@
 #                 and  ci-claude:latest.  The Containerfile makes this layer
 #                 byte-reproducible, so rebuilding an unchanged version dedups
 #                 in the registry instead of orphaning a fresh ~260 MB copy.
-#   3. bump-pr  — (only when the version actually changed) rewrite the 5
-#                 consumer pins to  ci-claude:<version>  and open a PR. A human
+#   3. bump-pr  — (only when any pin is off the latest version) rewrite every
+#                 consumer pin to  ci-claude:<version>  and open a PR. A human
 #                 reviews and merges it; nothing auto-merges.
 #
 # TAG SCHEME — deliberately version tags (ci-claude:<claude-version>), NOT the dated
@@ -107,31 +107,22 @@ steps:
          [0-9]*.[0-9]*.[0-9]*) : ;;
          *) echo "npm returned an implausible version '$$NEW' — aborting."; exit 1 ;;
        esac
-        # The tag every consumer currently references. They are kept identical,
-        # so this must resolve to EXACTLY ONE non-empty tag; anything else
-        # (no match, or a partial/disagreeing set) aborts rather than risk a
-        # corrupting sed later. Counting with `grep -c .` (non-empty lines)
-        # instead of `wc -l` is deliberate: an empty result yields 0 here but
-        # 1 under wc -l, which would slip past the guard.
-        CUR=$$(grep -hoE 'ci-claude:[0-9A-Za-z._-]+' $$CONSUMERS | sed 's/^ci-claude://' | sort -u)
-        NTAGS=$$(printf '%s' "$$CUR" | grep -c . || true)
-        if [ -z "$$CUR" ] || [ "$$NTAGS" -ne 1 ]; then
-          echo "Expected exactly one ci-claude tag across the consumers, got [$$CUR]."
-          echo "Refusing to guess — fix the pins by hand."; exit 1
-        fi
-        echo "latest=$$NEW  current=$$CUR  event=$$CI_PIPELINE_EVENT"
+        # Distinct tags the consumers currently reference. Divergent pins are
+        # normal (a pipeline bumped on its own); the bump rewrites all of them.
+        CUR=$$(grep -hoE 'ci-claude:[0-9][0-9A-Za-z._-]*' $$CONSUMERS | sed 's/^ci-claude://' | sort -u | tr '\n' ' ' | sed 's/ $$//')
+        [ -n "$$CUR" ] || { echo "No ci-claude pin found in the consumers — aborting."; exit 1; }
+        echo "latest=$$NEW  current=[$$CUR]  event=$$CI_PIPELINE_EVENT"
        printf '%s' "$$NEW" > "$$CI_WORKSPACE/.ci-refresh/version"
        printf '%s' "$$CUR" > "$$CI_WORKSPACE/.ci-refresh/current"
-        # Build when the version changed, or on a push (Containerfile edit must
-        # ship even if the version is unchanged). Bump the pins only when the
-        # version the consumers reference is not the latest.
+        # Build when any pin is off latest, or on a push (Containerfile edit must
+        # ship even if the version is unchanged). Bump when any pin is off latest.
        if [ "$$CUR" != "$$NEW" ] || [ "$$CI_PIPELINE_EVENT" = "push" ]; then
          touch "$$CI_WORKSPACE/.ci-refresh/do-build"; echo "will build $$NEW"
        else
          echo "already on $$NEW — nothing to build"
        fi
        if [ "$$CUR" != "$$NEW" ]; then
-          touch "$$CI_WORKSPACE/.ci-refresh/do-bump"; echo "will open bump PR $$CUR -> $$NEW"
+          touch "$$CI_WORKSPACE/.ci-refresh/do-bump"; echo "will open bump PR [$$CUR] -> $$NEW"
        else
          echo "consumers already pin $$NEW — no PR"
        fi
@@ -175,6 +166,9 @@ steps:
      - |
        [ -f "$$CI_WORKSPACE/.ci-refresh/do-bump" ] || { echo "no version change — no PR"; exit 0; }
        set -eu
+        # Secret values can carry a trailing newline; it breaks the push URL and the auth header.
+        PUSH_TOKEN=$$(printf '%s' "$$PUSH_TOKEN" | tr -d '\r\n')
+        [ -n "$$PUSH_TOKEN" ] || { echo "PUSH_TOKEN is empty — aborting"; exit 1; }
        NEW=$$(cat "$$CI_WORKSPACE/.ci-refresh/version")
        CUR=$$(cat "$$CI_WORKSPACE/.ci-refresh/current")
        # Both were validated non-empty by the decide step; re-assert before a
@@ -190,9 +184,11 @@ steps:
        # is not a maintained list.
        CONSUMERS=$$(grep -rlE 'ci-claude:[0-9]' .woodpecker)
        [ -n "$$CONSUMERS" ] || { echo "No ci-claude consumers found — refusing to continue."; exit 1; }
-        # Exact-string swap of the current tag for the new one, consumers only.
+        # NEW goes into a sed replacement: allow only a plain x.y.z version.
+        printf '%s' "$$NEW" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$$' || { echo "refusing non-x.y.z version '$$NEW'"; exit 1; }
+        # Every version-pinned tag becomes NEW, whatever it was; consumers only.
        for f in $$CONSUMERS; do
-          sed -i "s#ci-claude:$$CUR#ci-claude:$$NEW#g" "$$f"
+          sed -i "s#ci-claude:[0-9][0-9A-Za-z._-]*#ci-claude:$$NEW#g" "$$f"
        done
        # Author is claude-bot (the PAT's account); the commit subject makes
        # the automated-bump nature clear.
@@ -17,6 +17,6 @@ when:

 steps:
  - name: model-selection-tests
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
    commands:
      - sh scripts/ci/test-model-selection.sh
@@ -26,7 +26,7 @@ steps:
    # fetch-models.sh response mapping. No cluster, no secrets, no network — the
    # ci-claude image just provides sh + jq. Keeps the flag-injection regression
    # test from rotting (it exercises the exact injection shapes).
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
    commands:
      - sh scripts/ci/test-model-selection.sh

@@ -62,7 +62,7 @@ steps:
      - bash scripts/ci/make-diag-kubeconfig.sh

  - name: issue-fix-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -65,7 +65,7 @@ when:

 steps:
  - name: pr-review-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -70,7 +70,7 @@ steps:
    # this step is skipped — otherwise we'd fork-bomb PRs.
    when:
      - branch: master
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -30,7 +30,7 @@ when:

 steps:
  - name: update-audit-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.250
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -16,7 +16,7 @@ when:

 steps:
  - name: checkout-notes
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.278
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
    pull: true
    environment:
      WIKI_BOT_TOKEN:
@@ -32,7 +32,7 @@ steps:
        echo "raw backlog: $$(ls notes/raw/*.md | grep -v _index.md | wc -l) file(s)"

  - name: distill
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.278
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
    pull: true
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
@@ -62,7 +62,7 @@ steps:
          -p

  - name: audit
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.278
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
    pull: true
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
@@ -91,7 +91,7 @@ steps:
          -p

  - name: push-notes
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.278
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
    pull: true
    environment:
      WIKI_BOT_TOKEN:
@@ -2,7 +2,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: gitea
-  namespace: apps
+  namespace: gitea
  labels:
    app.kubernetes.io/name: gitea
  annotations:
@@ -2,7 +2,7 @@ apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP
 metadata:
  name: gitea-ssh
-  namespace: apps
+  namespace: gitea
  labels:
    app.kubernetes.io/name: gitea
 spec:
@@ -1,28 +1,8 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: gitea-allow-metrics-scrape
-  namespace: apps
-spec:
-  # Prometheus (monitoring ns) scrapes gitea's /metrics on :3000. The apps
-  # default-deny-ingress only allows same-ns / home-assistant / host, so the
-  # scrape is dropped (context deadline exceeded). This became necessary only
-  # after the LXC->in-cluster cutover — the old static target was external, so
-  # no in-cluster policy applied. Scoped to the gitea pod + :3000.
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: gitea
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            "k8s:io.kubernetes.pod.namespace": monitoring
-      toPorts:
-        - ports:
-            - port: "3000"
-              protocol: TCP
---
+# Prometheus scrape and Traefik are admitted by the namespace baseline in
+# infrastructure/network-policies/gitea-ns.yaml.
+#
 # Secret rotation: the flux-git rotator (openbao ns) reaches gitea to mint a new
-# flux PAT. It uses the in-cluster Service (gitea.apps.svc:3000) — the public
+# flux PAT. It uses the in-cluster Service (gitea.gitea.svc:3000) — the public
 # gitea.renner.uno name hairpins off the ingress LB from a pod (same failure as
 # pve.renner.uno). Scoped to the gitea pod :3000 and the rotator label; the
 # egress half is rotator-gitea-flux-egress in network-policies/openbao-ns.yaml.
@@ -30,7 +10,7 @@ apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: gitea-allow-flux-rotator
-  namespace: apps
+  namespace: gitea
 spec:
  endpointSelector:
    matchLabels:
@@ -54,7 +34,7 @@ apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
  name: gitea-allow-review-bot-rotator
-  namespace: apps
+  namespace: gitea
 spec:
  endpointSelector:
    matchLabels:
@@ -13,7 +13,7 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
  name: gitea
-  namespace: apps
+  namespace: gitea
  labels:
    app.kubernetes.io/name: gitea
 spec:
@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
  name: gitea
-  namespace: apps
+  namespace: gitea
  labels:
    app.kubernetes.io/name: gitea
 spec:
@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: StatefulSet
 metadata:
  name: gitea
-  namespace: apps
+  namespace: gitea
  labels:
    app.kubernetes.io/name: gitea
 spec:
@@ -152,7 +152,7 @@ spec:
          # NOTE: volumeClaimTemplates is immutable on an existing StatefulSet,
          # so bumping this value cannot be `kubectl apply`-ed in place — Flux
          # will reject the whole object. Landing this size change requires a
-          # one-time `kubectl delete statefulset gitea -n apps --cascade=orphan`
+          # one-time `kubectl delete statefulset gitea -n gitea --cascade=orphan`
          # (pod + PVC keep running) so Flux re-creates the STS from this
          # template and re-adopts them. After the cleanup_packages GC reclaims
          # the ~10G of orphaned blobs, real usage is ~9G, so 40Gi is headroom.
@@ -3,8 +3,8 @@ kind: Kustomization
 resources:
  - gatus/
  - external-dns/
-  - gitea/
  - ical-proxy/
+  # gitea/ has its own `gitea` Kustomization (clusters/homelab/gitea.yaml, #878).
  # woodpecker/ moved to its own dedicated `woodpecker` Kustomization
  # (clusters/homelab/woodpecker.yaml) so its wp-pg CNPG cluster's barman
  # dependency + Cluster health-gating don't contaminate this shared apps KS.
@@ -91,12 +91,11 @@ spec:
        # Additional scrape targets not covered by ServiceMonitors.
        additionalScrapeConfigs:
          # Gitea exposes /metrics anonymously on its main HTTP port. The
-          # `gitea_*` metrics power the gitea-overview dashboard. Gitea now runs
-          # in-cluster (StatefulSet in apps ns; LXC 114 retired), so scrape the
-          # ClusterIP Service directly instead of the dead LXC hostname.
+          # `gitea_*` metrics power the gitea-overview dashboard. Scrapes the
+          # ClusterIP Service of the StatefulSet in the gitea namespace.
          - job_name: gitea
            static_configs:
-              - targets: ["gitea.apps.svc.cluster.local:3000"]
+              - targets: ["gitea.gitea.svc.cluster.local:3000"]
            metrics_path: /metrics

    # Grafana
@@ -1946,6 +1946,7 @@ if phase_runs wait-apps; then
    # apps waits on infrastructure-ceph-cluster (Ceph mon/mgr/OSD bring-up
    # is genuinely 5–10 min on a fresh OSD-wiped cluster).
    wait_kustomization apps                "apps"                                                90
+    wait_kustomization gitea               "Gitea (incl. data-gitea-0 PVC)"                      90
    wait_kustomization influxdb            "InfluxDB (HR install + token Jobs)"                  600
    wait_kustomization woodpecker          "Woodpecker CI (incl. wp-pg CNPG backend)"            600
    wait_kustomization authentik           "Authentik (incl. ak-pg CNPG backend)"                600
@@ -0,0 +1,20 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: gitea
+  namespace: flux-system
+spec:
+  # Gitea in its own `gitea` namespace (#878), formerly under the shared `apps` KS.
+  interval: 10m
+  retryInterval: 2m
+  timeout: 15m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./kubernetes/apps/gitea
+  prune: true
+  wait: true
+  dependsOn:
+    - name: infrastructure
+    - name: infrastructure-crds
+    - name: infrastructure-ceph-cluster
@@ -179,6 +179,14 @@ kind: Namespace
 metadata:
  name: woodpecker
 ---
+# Gitea, moving out of the shared `apps` namespace (issue #878). Declared here
+# like `woodpecker` above, so it exists before infrastructure-crds applies its
+# CiliumNetworkPolicies. No pod-security labels: the cluster default applies.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea
+---
 # Local LLM inference (kubernetes/apps/llama-server). Declared here, like
 # `woodpecker` above, so the `infrastructure` KS creates it before
 # `infrastructure-crds` applies the namespace's CiliumNetworkPolicies.
@@ -169,6 +169,9 @@ spec:
        - matchLabels:
            "k8s:io.kubernetes.pod.namespace": apps
            app.kubernetes.io/name: gitea
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": gitea
+            app.kubernetes.io/name: gitea
      toPorts:
        - ports:
            - port: "8080"
@@ -0,0 +1,104 @@
+---
+# Baseline policy for the `gitea` namespace (issue #878).
+#
+# endpointSelector: {} — every rule applies to every pod in the namespace.
+# Workload-scoped grants go in their own policy with their own selector.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: default-deny
+  namespace: gitea
+spec:
+  endpointSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": gitea
+    # Prometheus scrape of /metrics.
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+    # Kubelet probes and hostNetwork siblings.
+    - fromEntities:
+        - host
+        - remote-node
+    # ICMP from any cluster pod; required once an L4 policy selects the pod.
+    # See woodpecker-ns.yaml for the rationale. INGRESS ONLY.
+    - fromEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      icmps:
+        - fields:
+            - { type: 0,   family: IPv4 }
+            - { type: 3,   family: IPv4 }
+            - { type: 8,   family: IPv4 }
+            - { type: 11,  family: IPv4 }
+            - { type: 12,  family: IPv4 }
+            - { type: 1,   family: IPv6 }
+            - { type: 2,   family: IPv6 }
+            - { type: 3,   family: IPv6 }
+            - { type: 4,   family: IPv6 }
+            - { type: 128, family: IPv6 }
+            - { type: 129, family: IPv6 }
+            - { type: 133, family: IPv6 }
+            - { type: 134, family: IPv6 }
+            - { type: 135, family: IPv6 }
+            - { type: 136, family: IPv6 }
+            - { type: 143, family: IPv6 }
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": gitea
+    # Webhooks to hosts served by Traefik (ci.renner.uno).
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+    # Push webhook of the notes repo to wiki-index.
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ai
+            app.kubernetes.io/name: wiki-index
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    # Push mirror to GitHub and other external targets.
+    - toEntities:
+        - host
+        - remote-node
+        - world
+---
+# Traefik serves git.renner.uno / gitea.renner.uno (:3000) and the gitea-ssh
+# entrypoint (:2222). Lives beside the baseline so both land in one reconcile.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: gitea-allow-traefik
+  namespace: gitea
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: gitea
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+      toPorts:
+        - ports:
+            - port: "3000"
+              protocol: TCP
+            - port: "2222"
+              protocol: TCP
@@ -22,6 +22,7 @@ resources:
  - external-secrets-ns.yaml
  - woodpecker-ci-ns.yaml
  - woodpecker-ns.yaml
+  - gitea-ns.yaml
  - trmnl-ns.yaml
  - wordpress-ns.yaml
  - ai-ns.yaml
@@ -144,6 +144,9 @@ spec:
        - matchLabels:
            "k8s:io.kubernetes.pod.namespace": apps
            app.kubernetes.io/name: gitea
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": gitea
+            app.kubernetes.io/name: gitea
      toPorts:
        - ports:
            - port: "3000"
@@ -169,6 +172,9 @@ spec:
        - matchLabels:
            "k8s:io.kubernetes.pod.namespace": apps
            app.kubernetes.io/name: gitea
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": gitea
+            app.kubernetes.io/name: gitea
      toPorts:
        - ports:
            - port: "3000"
@@ -6,7 +6,7 @@
 # newest. A token that fails verification is deleted and the run aborts without
 # storing, so Flux is never stranded.
 #
-# gitea is reached at the in-cluster Service gitea.apps.svc:3000 — the public
+# gitea is reached at the in-cluster Service gitea.gitea.svc:3000 — the public
 # name hairpins off the ingress LB from a pod. Needs BOTH netpol halves
 # (gitea-allow-flux-rotator + rotator-gitea-flux-egress).
 #
@@ -76,7 +76,7 @@ spec:
                - name: BAO_PATH
                  value: homelab/infrastructure/flux-git
                - name: GITEA_URL
-                  value: http://gitea.apps.svc.cluster.local:3000
+                  value: http://gitea.gitea.svc.cluster.local:3000
                - name: GITEA_VERIFY_REPO
                  value: k.renner/homelab
                - name: GITEA_SCOPES
@@ -24,7 +24,7 @@
 # synced. Quarterly cadence + backoffLimit:1 makes a two-cycle failure unlikely,
 # but a failed sync should be fixed before the next run rather than left.
 #
-# gitea is reached in-cluster at gitea.apps.svc:3000, woodpecker at
+# gitea is reached in-cluster at gitea.gitea.svc:3000, woodpecker at
 # woodpecker.woodpecker.svc:8000 (it moved out of `apps` in the namespace
 # migration — see kubernetes/apps/woodpecker/MIGRATION-namespace.md). Needs
 # the netpol halves: gitea-allow-review-bot-rotator + woodpecker-allow-rotators
@@ -99,7 +99,7 @@ spec:
                - name: BAO_PATH
                  value: homelab/infrastructure/review-bot
                - name: GITEA_URL
-                  value: http://gitea.apps.svc.cluster.local:3000
+                  value: http://gitea.gitea.svc.cluster.local:3000
                # Private repo review-bot collaborates on: the pull check is a
                # real access verification (git-upload-pack on a PRIVATE repo
                # needs a token with access), not the "any valid token" weakness
@@ -225,15 +225,9 @@ metadata:
  labels:
    app.kubernetes.io/part-of: homelab-backup
 spec:
-  # Daily at 07:15 local (next free stagger slot after home-assistant-daily
-  # at 06:45). Covers every stateful workload in the shared `apps`
-  # namespace — currently Gitea (data-gitea-0, the Flux GitOps source of
-  # truth) and Woodpecker (data-woodpecker-server-0), plus gatus-data.
-  # Added 2026-07-14 (issue #186): the apps namespace had no Velero
-  # schedule at all, so the in-cluster Gitea/Woodpecker PVCs migrated from
-  # the legacy LXCs (see MIGRATION-gitea-woodpecker.md) were unprotected.
-  # No CNPG cluster runs in this namespace (both Gitea and Woodpecker use
-  # SQLite), so no labelSelector exclusion is needed.
+  # Daily at 07:15 local. Every PVC in the shared `apps` namespace: Gitea's
+  # data-gitea-0 until it moves to the `gitea` namespace (#878), gatus-data.
+  # No CNPG cluster runs here, so no labelSelector exclusion is needed.
  schedule: "15 7 * * *"
  useOwnerReferencesInBackup: false
  template:
@@ -247,6 +241,27 @@ spec:
 ---
 apiVersion: velero.io/v1
 kind: Schedule
+metadata:
+  name: gitea-daily
+  namespace: velero
+  labels:
+    app.kubernetes.io/part-of: homelab-backup
+spec:
+  # Daily at 07:45 local. data-gitea-0 (SQLite, repos, LFS, packages) once
+  # Gitea runs in the `gitea` namespace (#878).
+  schedule: "45 7 * * *"
+  useOwnerReferencesInBackup: false
+  template:
+    includedNamespaces:
+      - gitea
+    includedResources:
+      - persistentvolumeclaims
+    storageLocation: default
+    ttl: 720h0m0s
+    snapshotMoveData: true
+---
+apiVersion: velero.io/v1
+kind: Schedule
 metadata:
  name: trmnl-daily
  namespace: velero
Author	SHA1	Message	Date
claude-botandClaude Opus 5.5	eb23d3ac6e	feat(gitea): move Gitea into the gitea namespace (stage 2 of #878 ) ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details - kubernetes/apps/gitea: every object in namespace gitea; applied by a new gitea Flux Kustomization (clusters/homelab/gitea.yaml) instead of apps. gitea-allow-metrics-scrape dropped: the gitea-ns baseline already admits monitoring. - Rotators (flux-git, review-bot) and the Prometheus gitea job use gitea.gitea.svc. - bootstrap.sh waits for the gitea KS. Data: data-gitea-0 is not copied. The PV (reclaimPolicy Retain) is rebound to a PVC gitea/data-gitea-0 pre-created with volumeName, which the new StatefulSet adopts. gitea-tls is pre-issued in the gitea namespace so HTTPS has no certificate gap. Refs #878 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-23 07:44:26 +02:00
k.renner	c1e3f3fb98	Merge pull request 'feat(gitea): prepare the gitea namespace (stage 1 of #878 )' (#905 ) from feat/gitea-namespace-phase1 into master ci/woodpecker/cron/issue-fix Pipeline was successful Details ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#905	2026-09-23 05:35:18 +00:00
claude-botandClaude Opus 5.5	036399095b	feat(gitea): prepare the gitea namespace (stage 1 of #878 ) ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details Additive only, nothing moves yet: - Namespace gitea, declared in infrastructure like woodpecker. - network-policies/gitea-ns.yaml: baseline (same-ns, monitoring, host, ICMP; egress to traefik, kube-dns, wiki-index, world) and gitea-allow-traefik for :3000 and :2222. - openbao rotator egress (flux-git, review-bot) and wiki-index ingress also admit gitea in the gitea namespace; the apps entries stay until stage 3. - Velero schedule gitea-daily (07:45) so data-gitea-0 stays backed up after the move; apps-daily comment updated (Woodpecker left apps). Refs #878 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-23 07:30:36 +02:00
k.renner	0bac0051b2	Merge pull request 'chore(ci): bump ci-claude image to 2.1.280' (#904 ) from ci-image/claude-2.1.280 into master ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#904	2026-09-23 05:16:03 +00:00
claude-bot	41a65b65a3	chore(ci): bump ci-claude image to 2.1.280 ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details	2026-09-23 05:13:16 +00:00
k.renner	a530f7c8e6	Merge pull request 'fix(ci-claude-refresh): bump divergent pins instead of aborting' (#903 ) from fix/ci-claude-refresh-mixed-pins into master ci/woodpecker/push/ci-claude-refresh Pipeline was successful Details ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#903	2026-09-23 05:12:40 +00:00
claude-botandClaude Opus 5.5	8fff4b4012	fix(ci-claude-refresh): bump divergent pins instead of aborting ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details decide required every consumer to pin the same ci-claude tag and aborted otherwise (pipeline 10497: [2.1.250 2.1.278]), which needed a hand fix before the latest version could roll out. Record all distinct tags, bump whenever any is off latest, and rewrite every version-pinned tag to the new one with a validated x.y.z version. Merging this is itself a push touching the pipeline file, so the refresh runs, builds the latest image, and opens the bump PR. Refs #889 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-23 07:06:56 +02:00
k.renner	0ada3df260	Merge pull request 'fix(ci-claude-refresh): strip CR/LF from the bump token before use' (#901 ) from fix/ci-claude-bump-token-newline into master ci/woodpecker/push/ci-claude-refresh Pipeline failed Details Reviewed-on: k.renner/homelab#901	2026-09-23 05:03:19 +00:00
claude-botandClaude Opus 5.5	2144554cfc	fix(ci-claude-refresh): strip CR/LF from the bump token before use ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details Pipeline 10186 failed in bump-pr with 'url contains a newline in its username component': ci_claude_bump_bot_token carries a trailing newline, so the push URL (and the PR API auth header) broke. Strip CR/LF once at the top of the step and fail fast if the token ends up empty. This makes the step independent of how the secret value was written. Closes #889 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-23 06:59:15 +02:00
k.renner	dba810b87b	Merge pull request 'fix(paperless): raise the memory limit to 4Gi' (#900 ) from worktree-fix-paperless-memory-limit into master ci/woodpecker/cron/e2e Pipeline failed Details ci/woodpecker/cron/security-scan Pipeline was successful Details ci/woodpecker/cron/wiki-maintenance Pipeline was successful Details ci/woodpecker/cron/issue-fix Pipeline was successful Details ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#900	2026-09-21 19:29:08 +00:00