ansible/roles/openshift-apps/dist-git

Dist-git OpenShift App Role

Deploys Fedora dist-git (src) on OpenShift via the Forgejo/Gitea Helm chart: namespace, storage, PostgreSQL, Valkey, Helm release, CI runners, and control-host backups.

Playbook: playbooks/openshift-apps/dist-git.yml

Kept in feature parity with roles/openshift-apps/forgejo but with dist-git naming (dist-git namespace, dist-git-ha, distgit_* private vars, packager OIDC map).

Entry point and execution model

• Hosts: os_control_stg (prod os_control still commented in the playbook), gather_facts: false
• Where work runs: On the control host under /root/ocp4/openshift-apps/dist-git/ — templates rendered there, then applied with kubernetes.core.k8s, oc apply, or kubernetes.core.helm
• Pattern: Hybrid OpenShift app — raw manifests plus the upstream forgejo-helm chart
• Secrets/config: env (production / staging) ternaries in templates/values.yaml.j2. Sensitive vars from private vars (/srv/private/ansible/vars.yml)

Task flow (tasks/main.yaml)

1. Control-host backup infrastructure

• Creates /root/ocp4/openshift-apps/dist-git/backups/{script,dump,log}/
• Cron: 02:00 backup, 03:00 prune

2. Kubernetes foundation

Step	Task file	Deploys
Namespace	create-dist-git-namespace.yaml	dist-git namespace
Storage	create-dist-git-pvc.yaml	PV + PVC (NetApp / ostree notes in templates)
Database	create-postgres-operator-config.yaml	Crunchy PostgresCluster dist-git-ha + metrics Service dist-git-ha-metrics (:9187)
Cache	deploy-valkey.yaml	Standalone Valkey (1 replica) + valkey-exporter (:9121)
App	call-helm.yaml	Helm release dist-git
Metrics	helm + patch-dist-git-http-service-oauth-proxy.yaml	oauth-proxy sidecar; /metrics auth
Zabbix metrics SA	create-dist-git-metrics-zabbix-sa-rbac.yaml	SA + RBAC + token Secret

3. Application (Helm)

• DB: External Crunchy Postgres
• Cache: Standalone Valkey — redis:// to valkey-0.valkey.dist-git.svc.cluster.local:6379/0 (not cluster mode)
• Auth: OIDC to Fedora Accounts with packager group-team-map
• Metrics: oauth-proxy; SAR on service dist-git-http

4. CI runners

Same pipeline as forgejo (load → vars → secret → SA RBAC → VM → register). Runner definitions live under runners/<env>/ (stub only until populated). Uses ansible-role-forgejo-runner via ansible-pull on the VM.

Monitoring scrape URLs (in-cluster Zabbix proxy)

Target	URL
App /metrics	Public hostname /metrics (Bearer token from dist-git-metrics-zabbix SA)
Postgres exporter	http://dist-git-ha-metrics.dist-git.svc.cluster.local:9187/metrics
Valkey exporter	http://valkey-exporter.dist-git.svc.cluster.local:9121/metrics

Zabbix template exports: files/zabbix/ (manual import; see README there).

Private vars to set (ansible-private)

Beyond existing distgit_* / distgit_stg_* hostnames, DB, OIDC, Valkey password, runner secrets:

• distgit_metrics / distgit_stg_metrics — enable app Prometheus endpoint
• distgit_metrics_servicemonitor / distgit_stg_metrics_servicemonitor (usually false)
• distgit_oauth_proxy_cookie_secret / distgit_stg_oauth_proxy_cookie_secret (openssl rand -base64 32)

Ops notes

• First deploy after Valkey standalone alignment replaces any prior 6-node cluster; expect brief cache/session disruption.
• Theme ConfigMap task remains available but is not wired in main.yaml (same as forgejo).