feat(forge): securing /metrics endpoint for staging

Signed-off-by: Anton Medvedev <amedvede@redhat.com>

roles/openshift-apps/forgejo/README.md

@@ -34,6 +34,7 @@ Backup dumps are NFS-mounted on `os-control01` (see `inventory/host_vars/os-cont
 | Database | `create-postgres-operator-config.yaml` | Crunchy `PostgresCluster` `forgejo-ha` (PG 17, 2 replicas, pgBackRest); 30s wait |
 | Cache | `deploy-valkey.yaml` | 6-replica Valkey StatefulSet + Service + ConfigMap + Secret (`valkey` tag, `oc apply`) |
 | App | `call-helm.yaml` | Forgejo Helm release |
+| Metrics (staging) | `patch-forgejo-http-service-oauth-proxy.yaml` | oauth-proxy sidecar via Helm; Service targets proxy |
 
 Custom theme ConfigMap task is **commented out** in `main.yaml` (`create-custom-theme-configmap.yaml`). Theme CSS is in `files/themes/` and referenced in Helm values (`fedora-auto`, etc.).
 
@@ -55,6 +56,7 @@ Notable Helm settings:
 - **Cache:** External Valkey via `redis+cluster://` in `gitea.config.cache` (chart `redis-cluster` subchart enabled; live cache is the separate Valkey StatefulSet)
 - **Auth:** OpenID Connect to Fedora Accounts with `group-team-map` for org/team RBAC
 - **Admin:** Private vars; `passwordMode: keepUpdated`
+- **Metrics (staging only):** oauth-proxy sidecar on the Forgejo pod; `/metrics` requires OpenShift OAuth (SAR: `get` service `forgejo-http` in namespace `forgejo`). Production unchanged.
 
 ### 4. CI runners (Forgejo Actions)
 

roles/openshift-apps/forgejo/defaults/main.yml

@@ -17,3 +17,10 @@ forgejo_runnerhost_packages:
   - sed
   - zabbix-agent
   - ca-certificates
+
+# Staging only: oauth-proxy sidecar on the Forgejo pod protects /metrics via OpenShift OAuth.
+# Set forgejo_stg_oauth_proxy_cookie_secret in ansible-private (openssl rand -base64 32).
+forgejo_metrics_oauth_proxy_port: 8080
+forgejo_metrics_oauth_proxy_image: registry.redhat.io/openshift4/ose-oauth-proxy:v4.16
+forgejo_metrics_oauth_proxy_route_name: forgejo-http
+forgejo_metrics_oauth_proxy_service_name: forgejo-http

roles/openshift-apps/forgejo/tasks/call-helm.yaml

@@ -10,6 +10,7 @@
   ansible.builtin.git:
     repo: "https://codeberg.org/fedora/forgejo-helm.git"
     dest: /tmp/forgejo-helm_repo
+    version: main
 
 - name: Build Helm chart dependencies
   ansible.builtin.command:

roles/openshift-apps/forgejo/tasks/main.yaml

@@ -3,11 +3,13 @@
   ansible.builtin.file:
     path: "/root/ocp4/openshift-apps/forgejo/"
     state: directory
+    mode: '0755'
 
 - name: Ensures forgejo backup directories exist
   ansible.builtin.file:
     path: "{{ item }}"
     state: directory
+    mode: '0755'
   loop:
     - /root/ocp4/openshift-apps/forgejo/backups/
     - /root/ocp4/openshift-apps/forgejo/backups/script/
@@ -51,15 +53,39 @@
     hour: "3"
     job: "/root/ocp4/openshift-apps/forgejo/backups/run_forgejo_pruning.sh >> /root/ocp4/openshift-apps/forgejo/backups/log/prune_cronjob.log 2>&1"
 
-- include_tasks: create-forgejo-namespace.yaml
-- include_tasks: create-forgejo-pvc.yaml
-- include_tasks: create-postgres-operator-config.yaml
-# - include_tasks: create-custom-theme-configmap.yaml
-- include_tasks: deploy-valkey.yaml
-- include_tasks: call-helm.yaml
-- include_tasks: load-forgejo-runners.yaml
-- include_tasks: copy-forgejo-runner-vars.yaml
-- include_tasks: create-forgejo-runner-config-secret.yaml
-- include_tasks: create-forgejo-runnerhost-sa-rbac.yaml
-- include_tasks: create-forgejo-runnerhost-vm.yaml
-- include_tasks: register-runners.yaml
+- name: Create forgejo namespace
+  ansible.builtin.include_tasks: create-forgejo-namespace.yaml
+
+- name: Create forgejo PVC
+  ansible.builtin.include_tasks: create-forgejo-pvc.yaml
+
+- name: Create postgres operator config
+  ansible.builtin.include_tasks: create-postgres-operator-config.yaml
+
+- name: Deploy valkey
+  ansible.builtin.include_tasks: deploy-valkey.yaml
+
+- name: Deploy Forgejo via Helm
+  ansible.builtin.include_tasks: call-helm.yaml
+
+- name: Point forgejo-http Service at oauth-proxy sidecar (staging)
+  ansible.builtin.include_tasks: patch-forgejo-http-service-oauth-proxy.yaml
+  when: env == "staging"
+
+- name: Load forgejo runners
+  ansible.builtin.include_tasks: load-forgejo-runners.yaml
+
+- name: Copy forgejo runner vars
+  ansible.builtin.include_tasks: copy-forgejo-runner-vars.yaml
+
+- name: Create forgejo runner config secret
+  ansible.builtin.include_tasks: create-forgejo-runner-config-secret.yaml
+
+- name: Create forgejo runnerhost SA RBAC
+  ansible.builtin.include_tasks: create-forgejo-runnerhost-sa-rbac.yaml
+
+- name: Create forgejo runnerhost VM
+  ansible.builtin.include_tasks: create-forgejo-runnerhost-vm.yaml
+
+- name: Register forgejo runners
+  ansible.builtin.include_tasks: register-runners.yaml

roles/openshift-apps/forgejo/tasks/patch-forgejo-http-service-oauth-proxy.yaml

@@ -0,0 +1,18 @@
+---
+# forgejo-helm Service targetPort "http" points at Forgejo :3000; with the oauth-proxy
+# sidecar, Route traffic must reach the proxy instead (staging only).
+- name: Point forgejo-http Service at oauth-proxy sidecar
+  kubernetes.core.k8s:
+    state: present
+    merge_type: merge
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: forgejo-http
+        namespace: "{{ forgejo_namespace }}"
+      spec:
+        ports:
+          - name: http
+            port: 3000
+            targetPort: "{{ forgejo_metrics_oauth_proxy_port }}"

roles/openshift-apps/forgejo/templates/values.yaml.j2

@@ -288,11 +288,20 @@ deployment:
 serviceAccount:
   create: true
   name: 'forgejo-http'
+{% if env == "staging" %}
+  automountServiceAccountToken: true
+  imagePullSecrets: []
+  annotations:
+    serviceaccounts.openshift.io/oauth-redirectreference.primary: |
+      {"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"{{ forgejo_metrics_oauth_proxy_route_name }}"}}
+  labels: {}
+{% else %}
   automountServiceAccountToken: false
   imagePullSecrets: []
   # - name: private-registry-access
   annotations: {}
   labels: {}
+{% endif %}
 
 ## @section Persistence
 #
@@ -328,6 +337,33 @@ extraVolumes: []
 #   secret:
 #     secretName: gitea-postgres-ssl
 
+## @param extraContainers Additional sidecar containers (staging: oauth-proxy for /metrics)
+{% if env == "staging" %}
+extraContainers:
+  - name: oauth-proxy
+    image: {{ forgejo_metrics_oauth_proxy_image }}
+    ports:
+      - name: oauth-proxy
+        containerPort: {{ forgejo_metrics_oauth_proxy_port }}
+    args:
+      - --http-address=:{{ forgejo_metrics_oauth_proxy_port }}
+      - --provider=openshift
+      - --openshift-service-account=forgejo-http
+      - --upstream=http://127.0.0.1:3000/
+      - --cookie-secret={{ forgejo_stg_oauth_proxy_cookie_secret | mandatory }}
+      - --bypass-auth-except-for=^/metrics
+      - --pass-basic-auth=false
+      - '--openshift-sar={"namespace":"{{ forgejo_namespace }}","resource":"services","resourceName":"{{ forgejo_metrics_oauth_proxy_service_name }}","verb":"get"}'
+    resources:
+      requests:
+        cpu: 10m
+        memory: 32Mi
+      limits:
+        memory: 128Mi
+{% else %}
+extraContainers: []
+{% endif %}
+
 ## @param extraContainerVolumeMounts Mounts that are only mapped into the Forgejo runtime/main container, to e.g. override custom templates.
 extraContainerVolumeMounts: []