add tool to gitea

2026-06-05 02:34:00 +10:00
commit 532b912ffb
25 changed files with 4981 additions and 0 deletions
@@ -0,0 +1,175 @@
+# Generated by kforge — do not edit manually.
+# Re-generate: kforge gitea-actions > .gitea/workflows/deploy.yml
+#
+# Required Gitea org secrets:
+#   DOCKER_USERNAME, DOCKER_PASSWORD, KFORGE_NODE_IP
+#   CLOUDFLARE_API_TOKEN, CF_ZONE_ID_* (per zone)
+#   SOPS_AGE_KEY
+# Required Gitea repo secrets:
+#   KUBE_HOST, KUBE_TOKEN, KUBE_CERTIFICATE
+
+name: Build and Deploy
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Create short commit hash
+        run: echo "SHORT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+
+      - name: Login to registry
+        uses: docker/login-action@v2
+        with:
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          registry: registry.natelubitz.com
+          username: ${{ secrets.DOCKER_USERNAME }}
+
+      - name: Build and push image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile
+          platforms: linux/amd64
+          provenance: false
+          push: true
+          sbom: false
+          tags: |
+            registry.natelubitz.com/midterm-tenant/main-ui:latest
+            registry.natelubitz.com/midterm-tenant/main-ui:${{ env.SHORT_SHA }}
+
+      - name: Install kforge
+        run: |
+          KFORGE_VERSION="latest"
+          curl -fsSL "https://kforge/releases/download/${KFORGE_VERSION}/kforge-linux-amd64" -o /usr/local/bin/kforge
+          chmod +x /usr/local/bin/kforge
+
+      - name: Validate kforge config (Staging)
+        run: kforge validate
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          KFORGE_NODE_IP: ${{ secrets.KFORGE_NODE_IP }}
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
+
+      - name: Apply cluster secrets (Staging)
+        run: kforge secrets apply --env staging
+        env:
+          KUBE_CERTIFICATE: ${{ secrets.KUBE_CERTIFICATE }}
+          KUBE_HOST: ${{ secrets.KUBE_HOST }}
+          KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
+
+      - name: Ensure DNS records (Staging)
+        run: kforge dns ensure --env staging
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          KFORGE_NODE_IP: ${{ secrets.KFORGE_NODE_IP }}
+          KUBE_CERTIFICATE: ${{ secrets.KUBE_CERTIFICATE }}
+          KUBE_HOST: ${{ secrets.KUBE_HOST }}
+          KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
+
+      - name: Generate manifests (Staging)
+        run: kforge generate --env staging --output .kforge-out --set image_tag=${{ env.SHORT_SHA }}
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          KFORGE_NODE_IP: ${{ secrets.KFORGE_NODE_IP }}
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
+
+      - name: Apply manifests (Staging)
+        uses: actions-hub/kubectl@master
+        with:
+          args: apply -f .kforge-out/staging-core.yaml -n staging --insecure-skip-tls-verify
+        env:
+          KUBE_CERTIFICATE: ${{ secrets.KUBE_CERTIFICATE }}
+          KUBE_HOST: ${{ secrets.KUBE_HOST }}
+          KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
+
+      - name: Apply infra manifests (Staging)
+        uses: actions-hub/kubectl@master
+        with:
+          args: apply -f .kforge-out/ -l app=stag-midterm-tenant-main-ui -n staging --insecure-skip-tls-verify
+        env:
+          KUBE_CERTIFICATE: ${{ secrets.KUBE_CERTIFICATE }}
+          KUBE_HOST: ${{ secrets.KUBE_HOST }}
+          KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
+
+      - name: Rollout restart (Staging)
+        uses: actions-hub/kubectl@master
+        with:
+          args: rollout restart deployment/stag-midterm-tenant-main-ui -n staging --insecure-skip-tls-verify
+        env:
+          KUBE_CERTIFICATE: ${{ secrets.KUBE_CERTIFICATE }}
+          KUBE_HOST: ${{ secrets.KUBE_HOST }}
+          KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
+
+      - name: Validate kforge config (Production)
+        run: kforge validate
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          KFORGE_NODE_IP: ${{ secrets.KFORGE_NODE_IP }}
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
+
+      - name: Apply cluster secrets (Production)
+        run: kforge secrets apply --env production
+        env:
+          KUBE_CERTIFICATE: ${{ secrets.KUBE_CERTIFICATE }}
+          KUBE_HOST: ${{ secrets.KUBE_HOST }}
+          KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
+
+      - name: Ensure DNS records (Production)
+        run: kforge dns ensure --env production
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          KFORGE_NODE_IP: ${{ secrets.KFORGE_NODE_IP }}
+          KUBE_CERTIFICATE: ${{ secrets.KUBE_CERTIFICATE }}
+          KUBE_HOST: ${{ secrets.KUBE_HOST }}
+          KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
+
+      - name: Generate manifests (Production)
+        run: kforge generate --env production --output .kforge-out --set image_tag=${{ env.SHORT_SHA }}
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          KFORGE_NODE_IP: ${{ secrets.KFORGE_NODE_IP }}
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
+
+      - name: Apply manifests (Production)
+        uses: actions-hub/kubectl@master
+        with:
+          args: apply -f .kforge-out/production-core.yaml -n production --insecure-skip-tls-verify
+        env:
+          KUBE_CERTIFICATE: ${{ secrets.KUBE_CERTIFICATE }}
+          KUBE_HOST: ${{ secrets.KUBE_HOST }}
+          KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
+
+      - name: Apply infra manifests (Production)
+        uses: actions-hub/kubectl@master
+        with:
+          args: apply -f .kforge-out/ -l app=prod-midterm-tenant-main-ui -n production --insecure-skip-tls-verify
+        env:
+          KUBE_CERTIFICATE: ${{ secrets.KUBE_CERTIFICATE }}
+          KUBE_HOST: ${{ secrets.KUBE_HOST }}
+          KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
+
+      - name: Rollout restart (Production)
+        uses: actions-hub/kubectl@master
+        with:
+          args: rollout restart deployment/prod-midterm-tenant-main-ui -n production --insecure-skip-tls-verify
+        env:
+          KUBE_CERTIFICATE: ${{ secrets.KUBE_CERTIFICATE }}
+          KUBE_HOST: ${{ secrets.KUBE_HOST }}
+          KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
@@ -0,0 +1,90 @@
+meta:
+  name: main-ui
+  tenant: midterm-tenant
+
+registry:
+  url: registry.natelubitz.com
+  pull_secret: regcred
+
+dns:
+  provider: cloudflare
+  cloudflare:
+    api_token: ${CLOUDFLARE_API_TOKEN}
+    zones:
+      - name: natelubitz.com
+        zone_id: ${CF_ZONE_ID_NATELUBITZ}
+      - name: midtermtenant.com
+        zone_id: ${CF_ZONE_ID_MIDTERM}
+    proxied: false
+  node_ip: ${KFORGE_NODE_IP}
+
+cluster:
+  tls_issuer: letsencrypt-prod
+  ingress_class: nginx
+  cnpg:
+    host: cnpg-main-rw.default.svc.cluster.local
+
+defaults:
+  port: 3000
+  health_check:
+    path: /healthcheck
+
+infrastructure:
+  database:
+    provider: cnpg
+  cache:
+    provider: valkey
+    mode: standalone
+
+environments:
+  staging:
+    namespace: staging
+    image_tag: latest
+    env_vars:
+      - name: VITE_BASE_URL
+        value: https://api-staging.midtermtenant.com
+        type: plain
+    ingress:
+      hosts:
+        - hostname: mtt-ui-staging.natelubitz.com
+          tls: true
+          dns_record: true
+      auth:
+        enabled: true
+        users:
+          - nate
+    lifecycle:
+      delete: false
+
+  production:
+    namespace: production
+    image_tag: latest
+    env_vars:
+      - name: VITE_BASE_URL
+        value: https://api.midtermtenant.com
+        type: plain
+    ingress:
+      hosts:
+        - hostname: mtt-ui.natelubitz.com
+          tls: true
+          dns_record: true
+        - hostname: midtermtenant.com
+          tls: true
+          dns_record: false
+      auth:
+        enabled: false
+    infrastructure:
+      cache:
+        mode: cluster
+        replicas: 3
+    cron_jobs:
+      - name: db-cleanup
+        schedule: "0 2 * * *"
+        command: ["node", "scripts/cleanup.js"]
+        inherit_env: true
+        env_vars:
+          - name: CLEANUP_BATCH_SIZE
+            value: "500"
+            type: plain
+    lifecycle:
+      delete: false