mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby HuskyandClaude Sonnet 5
5670a941d4
User wants actual GitLab on the VPS, not just Gitea's pull-mirror -
deliberate scope increase from the original plan's 'keep the VPS
lighter' design for git hosting specifically.
Simplified single-node equivalent of apps/gitlab (home) - same chart
version (7.7.0), same Authentik OIDC provider/client_id (added a second
redirect_uri to the shared GitLab provider in infrastructure/authentik/
gitlab-blueprint.yaml), same known chart bugs already diagnosed at home
(redis-init-fix.yaml for the initializer-ordering bug) - but:
- 1 CNPG instance (local-path) instead of home's 3-instance HA
- No Praefect - pointless HA routing with a single Gitaly node
- No PgBouncer - direct CNPG connection, traffic is low enough
- No SAML, no Container Registry, no KAS - addable later if needed
- Own Traefik Ingress + https-redirect Middleware from the start
(found needed the hard way on Vault/Gitea/n8n/Nextcloud/Authentik
earlier this session - applying that lesson here immediately)
New Vault paths this needed: secret/vps/gitlab-redis (freshly generated,
this Redis instance is new, nothing to reuse) and widened the
vps-eso-reader policy to also allow secret/gitlab-oauth (the shared
Authentik client, already used by home's GitLab).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
35 lines
1.1 KiB
YAML
35 lines
1.1 KiB
YAML
# Shares the same Authentik OAuth2 provider/client_id as home's GitLab
|
|
# (infrastructure/authentik/gitlab-blueprint.yaml has both redirect_uris
|
|
# registered). Same Vault path (secret/gitlab-oauth) home's copy reads
|
|
# from - vps-eso-reader policy widened to allow this one extra path
|
|
# (infrastructure/vps-eso/manifests/clustersecretstore.yaml's policy,
|
|
# applied live via vault CLI, not git-tracked - matches how every other
|
|
# Vault policy/auth-method in this repo is set up).
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: gitlab-oidc
|
|
namespace: gitlab
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: vault-backend
|
|
target:
|
|
name: gitlab-oidc-secret
|
|
creationPolicy: Owner
|
|
template:
|
|
type: Opaque
|
|
data:
|
|
GITLAB_OIDC_CLIENT_ID: "{{ .clientId }}"
|
|
GITLAB_OIDC_CLIENT_SECRET: "{{ .clientSecret }}"
|
|
data:
|
|
- secretKey: clientId
|
|
remoteRef:
|
|
key: gitlab-oauth
|
|
property: client-id
|
|
- secretKey: clientSecret
|
|
remoteRef:
|
|
key: gitlab-oauth
|
|
property: client-secret
|