# The gitea chart's gitea-http/gitea-ssh services are HEADLESS (clusterIP: None), so they resolve to the
# pod IP (100.64.x.x). That range OVERLAPS the Tailscale CGNAT range (100.64.0.0/10), so the tailscale
# sidecar in the tailscale-gitlab-proxy pod swallows traffic to the pod IP. These normal ClusterIP services
# give Gitea a service IP in the service CIDR (10.32.x.x, outside the tailscale range) — the proxy nginx +
# socat target these instead. (GitLab worked because its webservice svc was a normal ClusterIP.)
apiVersion: v1
kind: Service
metadata:
  name: gitea-web
  namespace: foxhunt
  labels:
    app.kubernetes.io/name: gitea
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
  ports:
    - name: http
      port: 3000
      targetPort: 3000
      protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
  name: gitea-sshd
  namespace: foxhunt
  labels:
    app.kubernetes.io/name: gitea
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
  ports:
    - name: ssh
      port: 22
      targetPort: 2222   # rootless gitea listens on 2222 internally (can't bind privileged 22)
      protocol: TCP
