ansible/roles/openshift-apps/dist-git/README.md

Dist-git OpenShift App Role

Deploys Fedora dist-git (src) on OpenShift via the Forgejo/Gitea Helm chart: namespace, storage, PostgreSQL, Valkey, Helm release, CI runners, and in-cluster dump backups.

Playbook: playbooks/openshift-apps/dist-git.yml

Kept in feature parity with roles/openshift-apps/forgejo but with dist-git naming (dist-git namespace, dist-git-ha, distgit_* private vars, packager OIDC map).

Entry point and execution model

• Hosts: os_control_stg (prod os_control still commented in the playbook), gather_facts: false
• Where work runs: On the control host under /root/ocp4/openshift-apps/dist-git/ — templates rendered there, then applied with kubernetes.core.k8s, oc apply, or kubernetes.core.helm
• Pattern: Hybrid OpenShift app — raw manifests plus the upstream forgejo-helm chart
• Secrets/config: env (production / staging) ternaries in templates/values.yaml.j2. Sensitive vars from private vars (/srv/private/ansible/vars.yml)

Task flow (tasks/main.yaml)

1. Control-host backup orchestration

• Creates /root/ocp4/openshift-apps/dist-git/backups/{script,log}/
• Templates backup helper scripts and installs orchestration scripts on the control host
• Cron on the control host (root) uses oc exec against the dist-git pod:
  • 02:00 — run_dist_git_backup.sh (runs forgejo dump into the scratch PVC)
  • 03:00 — run_dist_git_pruning.sh (prunes old dumps on the scratch PVC)

Dump zips are named dist-git-dump-*.zip and retained on the in-cluster scratch PVC (dist-git-backup-scratch, 500Gi CephFS) at /var/lib/forgejo/backup-scratch. Pruning keeps 2 daily backups with size protection (same logic as forgejo).

Backup variables

Variable	Default	Purpose
distgit_backup_scratch_mount_path	/var/lib/forgejo/backup-scratch	In-pod path where dump zips are retained
distgit_backup_monitoring_enabled	false	Enable Zabbix dump backup monitoring on the control host

When prod is enabled on os-control, set distgit_backup_monitoring_enabled: true in host_vars (same pattern as forgejo on os-control01).

2. Kubernetes foundation

Step	Task file	Deploys
Namespace	create-dist-git-namespace.yaml	dist-git namespace
Storage	create-dist-git-pvc.yaml	PV + PVC (NetApp / ostree notes in templates)
Backup scratch	create-dist-git-backup-scratch-pvc.yaml	PVC dist-git-backup-scratch (500Gi CephFS ocs-storagecluster-cephfs, RWX)
Database	create-postgres-operator-config.yaml	Crunchy PostgresCluster dist-git-ha + metrics Service dist-git-ha-metrics (:9187)
Cache	deploy-valkey.yaml	Standalone Valkey (1 replica) + valkey-exporter (:9121)
App	call-helm.yaml	Helm release dist-git
Metrics	helm + patch-dist-git-http-service-oauth-proxy.yaml	oauth-proxy sidecar; /metrics auth
Zabbix metrics SA	create-dist-git-metrics-zabbix-sa-rbac.yaml	SA + RBAC + token Secret

3. Application (Helm)

• DB: External Crunchy Postgres
• Cache: Standalone Valkey — redis:// to valkey-0.valkey.dist-git.svc.cluster.local:6379/0 (not cluster mode)
• Auth: OIDC to Fedora Accounts with packager group-team-map
• Metrics: oauth-proxy; SAR on service dist-git-http

4. CI runners

Same pipeline as forgejo (load → vars → secret → SA RBAC → VM → register). Runner definitions live under runners/<env>/ (stub only until populated). Uses ansible-role-forgejo-runner via ansible-pull on the VM.

5. Backup monitoring

When distgit_backup_monitoring_enabled: true, tasks/monitoring.yaml deploys /usr/lib/zabbix/check_dist_git_backup.sh, a 15-minute cron collector, and imports Dist-git Backup Monitoring via Zabbix API. See files/zabbix/README.md.

Monitoring scrape URLs (in-cluster Zabbix proxy)

Target	URL
App /metrics	Public hostname /metrics (Bearer token from dist-git-metrics-zabbix SA)
Postgres exporter	http://dist-git-ha-metrics.dist-git.svc.cluster.local:9187/metrics
Valkey exporter	http://valkey-exporter.dist-git.svc.cluster.local:9121/metrics

Zabbix template exports: files/zabbix/ — app, PostgreSQL, Valkey, and backup monitoring templates (see README there).

Private vars to set (ansible-private)

Beyond existing distgit_* / distgit_stg_* hostnames, DB, OIDC, Valkey password, runner secrets:

• distgit_metrics / distgit_stg_metrics — enable app Prometheus endpoint
• distgit_metrics_servicemonitor / distgit_stg_metrics_servicemonitor (usually false)
• distgit_oauth_proxy_cookie_secret / distgit_stg_oauth_proxy_cookie_secret (openssl rand -base64 32)

Ops notes

• First deploy after Valkey standalone alignment replaces any prior 6-node cluster; expect brief cache/session disruption.
• Theme ConfigMap task remains available but is not wired in main.yaml (same as forgejo).