2026-06-21 15:38:26 +02:00
parent 042fcd76e5
commit 80f3fbecef
1 changed files with 111 additions and 0 deletions
							
							
							
						
@@ -0,0 +1,111 @@
# Stand up Gitea + migrate repos + move cockpit registry — Design (Phase 2B)
**Date:** 2026-06-21
**Status:** Design (approved)
**Repo:** foxhunt (IaC current home; relocation to fxhnt is Phase 2D)
**Part of:** Phase 2 (GitLab → Gitea consolidation, [[project_phase2_gitlab_to_gitea]]). 2A (TF state →
Scaleway) DONE. This is **2B**. 2C (GitLab removal) and 2D (IaC relocation) follow.
## Motivation
Self-hosted GitLab uses ~6.5 GiB RAM across 17 pods (webservice 1.96 GiB + 3× sidekiq ~3 GiB + gitaly +
registry + prometheus + …). The active work is the Python `fxhnt` fund; GitLab is Rust-era overkill.
Replace it with **Gitea** (~150–250 MiB, chart + existing Postgres) for git hosting, and move the
**cockpit container image** to **Scaleway Container Registry** so GitLab can be removed in 2C without
breaking the live cockpit deploy.
## Decisions (from brainstorming)
- **Gitea install:** `gitea/gitea` Helm chart. Subcharts `postgresql`/`redis-cluster`/`redis`/`memcached`
  **disabled**. Built-in **Actions disabled** (Argo does CI/CD). Cache = memory (single replica).
- **Database:** reuse the **existing in-cluster `postgres`** (svc `postgres:5432`, already has a backup
  cronjob). Create a dedicated `gitea` database + role.
- **Repos:** migrate **both** — `fxhnt` (active) and `foxhunt` (876 MB, flagged **archived/read-only**) —
  via `git push --mirror` from existing local clones.
- **Canonical hostname stays `git.fxhnt.ai`** (no permanent `gitea.fxhnt.ai`, no remote-URL churn).
  Gitea comes up internal-only; validate over a port-forward; then cut `git.fxhnt.ai` (HTTPS) + SSH
  `:2222` over to Gitea in one switch. GitLab keeps running (unaddressed) as the 2C-removal fallback.
- **Container registry:** cockpit image → **Scaleway Container Registry** (`rg.fr-par.scw.cloud/bizworx/`,
  namespace exists). Retire the in-cluster GitLab registry. External/managed, no registry pod.
- **Argo integration:** Gitea push webhook → Argo Events webhook eventsource → sensor → submit
  `wftmpl/fxhnt-cockpit`. Replaces the old `gitlab-push-eventsource`.
## Components
1. **`infra/k8s/gitea/` (new):** Helm values `values.yaml` + a thin install (release `gitea`, ns
   `foxhunt`). Storage: 1 PVC `sbs-default-retain` ~5 Gi (foxhunt 876 MB + fxhnt + headroom). Resources:
   requests 128 Mi/100m, limits 512 Mi. Admin user + secrets from a k8s secret (NOT committed).
   Gitea config: `server.SSH_PORT`/`SSH_LISTEN_PORT`, `server.ROOT_URL=https://git.fxhnt.ai/`,
   `server.DISABLE_SSH=false`, DB type `postgres` → `postgres:5432/gitea`.
2. **Postgres prep:** one-time `psql` on the existing `postgres` pod — `CREATE ROLE gitea …; CREATE
   DATABASE gitea OWNER gitea;`. Credentials in a k8s secret consumed by the Gitea release.
3. **Exposure:**
   - HTTPS: extend the nginx `*.fxhnt.ai` proxy (`infra/k8s/gitlab/tailscale-proxy.yaml`) — at cutover,
     repoint the `git.fxhnt.ai` server block `proxy_pass` → `gitea-http.foxhunt.svc:3000`.
   - SSH: repoint the Tailscale-exposed `:2222` → Gitea SSH service at cutover.
   - Registry `:5050` server block: removed (Scaleway registry is external, not proxied here).
4. **Registry migration:**
   - `fxhnt/infra/argo/cockpit-build-deploy.yaml`: kaniko `--destination` + `--cache-repo` →
     `rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:latest` (+ cache repo); drop the `--insecure-registry`/
     `--skip-tls-verify` GitLab flags (Scaleway is TLS); auth via a Scaleway registry dockerconfig secret.
   - `fxhnt/infra/k8s/orchestration/dagster.yaml` + dashboard: image ref →
     `rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:latest`; `imagePullSecrets` → Scaleway registry secret.
   - Create the Scaleway registry pull/push secret (dockerconfigjson) in `foxhunt` ns.
5. **Argo Events wiring:** `infra/k8s/argo/events/` — a Gitea webhook eventsource + sensor that submits
   `fxhnt-cockpit` on push to `fxhnt` default branch (reuses the surviving eventbus + workflow-trigger
   machinery). Webhook secret in a k8s secret; configured in Gitea repo settings.
6. **Deploy script:** `fxhnt/scripts/argo-deploy-cockpit.sh` + the `fxhnt-cockpit` wftmpl clone URL →
   Gitea (`git.fxhnt.ai`). After cutover the remote name is unchanged, so this is a clone-source confirm.
## Data flow
Dev pushes to `git.fxhnt.ai` (Gitea) → webhook → Argo Events sensor → `fxhnt-cockpit` workflow → kaniko
builds + pushes to Scaleway registry → `kubectl apply` + rollout → dagster/dashboard pull the new image
from Scaleway. Terraform unaffected (state external since 2A).
## Migration & cutover sequence (each step verified)
1. Create `gitea` DB on existing postgres + secrets.
2. `helm install gitea` (internal svc only). Verify `/api/healthz` 200, admin login via port-forward.
3. Port-forward Gitea; `git push --mirror` `fxhnt` and `foxhunt` to it; mark `foxhunt` archived.
4. **Validate (pre-cutover):** clone both repos back from the port-forward, diff top commit SHAs vs
   GitLab — must match.
5. **Registry migration:** create Scaleway registry secret; update kaniko build (+cache) + deploy image
   refs; run one cockpit build → confirm image in Scaleway registry + a test rollout pulls it OK.
6. **Cutover:** repoint nginx `git.fxhnt.ai` → Gitea + SSH `:2222` → Gitea; remove the `:5050` block.
   Verify `git.fxhnt.ai` serves Gitea (web + clone + SSH push).
7. **Wire Argo Events:** add Gitea webhook → sensor; test push to `fxhnt` main fires a cockpit deploy.
## Safety / reversibility
- GitLab stays fully running throughout 2B (just unaddressed after cutover) — rollback = repoint nginx/SSH
  back to GitLab. Removal is **2C** only.
- The Scaleway registry change is additive until the deploy refs flip; the GitLab registry image stays as
  fallback until 2C.
- All repo data validated (SHA diff) before the public name moves.
- Secrets (DB creds, admin, webhook, registry dockerconfig) are k8s secrets — **never committed**.
## Risks
- **Registry auth:** Scaleway registry needs a valid API-key dockerconfig for both kaniko push and pod
  pull. Mitigation: test the build+rollout (step 5) before cutover.
- **Gitea↔Postgres coupling:** Gitea shares the existing `postgres`. If that instance is later removed,
  Gitea breaks. Acceptable (postgres is a kept platform service with backups); noted for 2C/2D.
- **SSH port collision at cutover:** GitLab + Gitea can't both own `:2222` on the Tailscale proxy. Cutover
  flips it atomically; brief push unavailability during the switch (single maintainer — fine).
- **Webhook reachability:** Gitea (in-cluster) must reach the Argo Events webhook svc in-cluster — same
  ns, no Tailscale hop needed.
## Out of scope
GitLab helm uninstall + GitLab buckets/state cleanup (**2C**); `git mv` IaC foxhunt → fxhnt (**2D**).
## Acceptance criteria
- Gitea running (1 pod, existing postgres), `/api/healthz` 200, ~≤300 MiB.
- Both repos in Gitea; clone SHAs match GitLab; `foxhunt` archived.
- Cockpit image builds to + deploys from Scaleway Container Registry; `dashboard.fxhnt.ai` 200 on the
  Scaleway-sourced image.
- `git.fxhnt.ai` (HTTPS + SSH `:2222`) serves Gitea; git remotes unchanged.
- Push to `fxhnt` main auto-triggers a cockpit deploy via Argo Events.
- GitLab still running as fallback (removed in 2C).