ansible/roles/openshift-apps/forgejo

Forgejo OpenShift App Role

Deploys Fedora Forgejo (git forge) on OpenShift: namespace, storage, PostgreSQL, Valkey, Helm release, CI runners, and control-host backups.

Playbook: playbooks/openshift-apps/forgejo.yml

Entry point and execution model

• Hosts: os_control_stg:os_control (OpenShift control nodes), gather_facts: false
• Where work runs: On the control host under /root/ocp4/openshift-apps/forgejo/ — templates are rendered there, then applied with kubernetes.core.k8s, oc apply, or kubernetes.core.helm
• Pattern: Hybrid OpenShift app — raw manifests plus the upstream forgejo-helm chart (not the composable openshift/* roles)
• Secrets/config: Production vs staging uses env (production / staging) and ternaries in templates/values.yaml.j2. Sensitive vars (passwords, OIDC keys, runner secrets) come from private vars (/srv/private/ansible/vars.yml), not this repo

Task flow (tasks/main.yaml)

1. Control-host backup infrastructure

Before cluster resources:

• Creates /root/ocp4/openshift-apps/forgejo/backups/{script,dump,log}/
• Copies backup scripts from files/
• Cron on the control host:
  • 02:00 — run_forgejo_backup.sh (rsync scripts into Forgejo pod, DB dump, pull dump back)
  • 03:00 — run_forgejo_pruning.sh (prune old dumps)

Backup dumps are NFS-mounted on os-control01 (see inventory/host_vars/os-control01.rdu3.fedoraproject.org).

2. Kubernetes foundation

Step	Task file	Deploys
Namespace	create-forgejo-namespace.yaml	forgejo namespace
Storage	create-forgejo-pvc.yaml	PV + PVC gitea-shared-storage (NetApp NFS forgejo-volume, RWX 100Gi)
Database	create-postgres-operator-config.yaml	Crunchy PostgresCluster forgejo-ha (PG 17, 2 replicas, pgBackRest); 30s wait
Cache	deploy-valkey.yaml	Standalone Valkey StatefulSet (1 replica) + headless Service + ConfigMap + Secret (valkey tag, oc apply)
App	call-helm.yaml	Forgejo Helm release
Metrics	call-helm.yaml + patch-forgejo-http-service-oauth-proxy.yaml	oauth-proxy sidecar; Service targets oauth-proxy port; /metrics auth only
Zabbix metrics SA	create-forgejo-metrics-zabbix-sa-rbac.yaml	SA, view RoleBinding, system:auth-delegator ClusterRoleBinding, token Secret

Custom theme ConfigMap task is commented out in main.yaml (create-custom-theme-configmap.yaml). Theme CSS is in files/themes/ and referenced in Helm values (fedora-auto, etc.).

3. Forgejo application (Helm)

call-helm.yaml:

1. Renders templates/values.yaml.j2 → helm-values.yaml
2. Clones https://codeberg.org/fedora/forgejo-helm.git to /tmp/forgejo-helm_repo
3. Runs helm dependency update
4. Deploys release forgejo in namespace forgejo via kubernetes.core.helm

Notable Helm settings:

• Image: Quay (forgejo_prod_quay_image / forgejo_stg_quay_image), rootless
• Route: OpenShift Route (not Ingress); forgejo_hostname / forgejo_stg_hostname
• Persistence: Pre-created PVC gitea-shared-storage (persistence.create: false)
• DB: External Crunchy Postgres, not chart PostgreSQL
• Cache: Standalone Valkey via gitea.config.cache.ADAPTER / HOST (redis:// to valkey-0.valkey.forgejo.svc.cluster.local; cluster mode is not used because Forgejo runs a single replica). Metrics via valkey-exporter Deployment (oliver006/redis_exporter) on :9121/metrics for in-cluster Zabbix scrape.
• Auth: OpenID Connect to Fedora Accounts with group-team-map for org/team RBAC
• Admin: Private vars; passwordMode: keepUpdated
• Metrics: oauth-proxy sidecar on the Forgejo pod; /metrics requires OpenShift OAuth (SAR: get service forgejo-http in namespace forgejo). SA redirect URI is the public hostname (forgejo_hostname / forgejo_stg_hostname), not a Route-relative URI.

4. CI runners (Forgejo Actions)

Step	Task file	Purpose
Load runners	load-forgejo-runners.yaml	Merges runners/<env>/*.yml with private registration secrets
Runner vars	copy-forgejo-runner-vars.yaml	Renders runner vars from forgejo-runners.yaml.j2
Runner secret	create-forgejo-runner-config-secret.yaml	K8s Secret for runner VM
VM RBAC	create-forgejo-runnerhost-sa-rbac.yaml	ServiceAccount, Role, RoleBinding, token Secret
Runner VM	create-forgejo-runnerhost-vm.yaml	KubeVirt VM + headless Service
Registration	register-runners.yaml	forgejo-cli actions register in Forgejo pod

Runner host:

• KubeVirt VM forgejo-runnerhost-vm (Fedora u1.xlarge, 30Gi)
• Packages in defaults/main.yml (ansible, podman, python3-kubernetes, etc.)
• SA token via serial disk SATOKEN000001
• Cloud-init runs ansible-pull from ansible-role-forgejo-runner (in-repo clone is commented out)
• forgejo-runners-vars.yaml (K8s Secret → config watcher) supplies runner list, Zabbix PSK, and agent Server= allowlist (proxy DNS + 10.16.0.0/16 + OpenShift pod CIDR 10.128.0.0/14 for proxy pod source IPs)
• load-forgejo-runners.yaml merges runners/<env>/*.yml with secret dicts from private vars, then register-runners.yaml registers them (idempotent; tolerates duplicate key)

Variables

• defaults/main.yml — namespace, headless service name, runnerhost packages, Zabbix agent Server= allowlist for in-cluster proxy
• vars/main.yml — openshift_user_id for PV ownership

Most operational variables live in private/group vars (hostnames, DB, OIDC, runner secrets, Valkey password, etc.).

Related code

• roles/openshift-apps/dist-git — reuses /root/ocp4/openshift-apps/forgejo/ for theme ConfigMaps
• .forgejo/workflows/ — CI for this ansible repo runs on this Forgejo instance

Design notes

1. Mixed deploy paths: kubernetes.core.k8s, oc apply (Valkey), and Helm
2. Runner registration is in Ansible; runner daemons are configured via ansible-pull on the VM
3. Backups are control-host cron jobs using oc rsync / oc exec, not in-cluster CronJobs
4. Same playbook runs prod and staging; env selects all branching