feat(k8s): add K8s manifests for all homelab services

traefik, gitea, adguard, nextcloud, errorpages, homepages,
uptime-kuma, kener, checkmk, headscale, dockmon, metube,
downtify, portainer, netronome, userbot

Includes Helm values, deployments, services, ingress routes,
configmaps, secrets (placeholders), postgres statefulsets,
kustomize overlays, and Traefik dynamic configuration.

gitea/k8s/config.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-config
+  namespace: gitea
+data:
+  GITEA__server__DOMAIN: "gitea.gigaforust.internal"
+  GITEA__server__ROOT_URL: "https://gitea.gigaforust.internal"
+  GITEA__server__SSH_DOMAIN: "gitssh.gigaforust.internal"
+  GITEA__server__SSH_PORT: "2221"
+
+  GITEA__database__DB_TYPE: "postgres"
+  GITEA__database__HOST: "gitea-postgres-service:5432"
+  GITEA__database__NAME: "gitea"
+  GITEA__security__REVERSE_PROXY_LIMIT: "1"
+  GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES: "*"
+  
+  GITEA__mailer__ENABLED: "false"
+  USER_UID: "1000"
+  USER_GID: "1000"

gitea/k8s/gitea.yaml

@@ -0,0 +1,71 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-service
+  namespace: gitea
+spec:
+  selector:
+    app: gitea
+  ports:
+  - port: 3000
+    name: http
+    targetPort: 3000
+  - port: 2221
+    name: ssh
+    targetPort: 2221
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea-deployment
+  namespace: gitea
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gitea
+  template:
+    metadata:
+      labels:
+        app: gitea
+    spec:
+      containers:
+      - name: gitea
+        image: docker.gitea.com/gitea:1.26
+        envFrom:
+        - configMapRef:
+            name: gitea-config
+        - secretRef:
+            name: gitea-secrets
+        ports:
+        - containerPort: 3000
+          name: http
+        - containerPort: 2221
+          name: ssh
+        volumeMounts:
+        - name: gitea-data
+          mountPath: /data
+        resources:
+          requests:
+            memory: "512Mi"
+            cpu: "500m"
+          limits:
+            memory: "1.5Gi"
+            cpu: "1500m"
+      volumes:
+      - name: gitea-data
+        persistentVolumeClaim:
+          claimName: gitea-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gitea-pvc
+  namespace: gitea
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+---

gitea/k8s/ingressroute.yaml

@@ -0,0 +1,81 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-dev
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`gitea.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: gitea-service
+      port: 3000
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-local
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`gitea.workstation.internal`)
+    kind: Rule
+    services:
+    - name: gitea-service
+      port: 3000
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-prod
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`gitea.forust.xyz`)
+    kind: Rule
+    services:
+    - name: gitea-service
+      port: 3000
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-registry
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`gcr.forust.xyz`) && PathPrefix(`/v2`)
+    kind: Rule
+    services:
+    - name: gitea-service
+      port: 3000
+  tls:
+    {}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: gitea-ssh
+  namespace: gitea
+spec:
+  entryPoints:
+    - ssh
+  routes:
+  - match: HostSNI(`*`)
+    services:
+    - name: gitea-service
+      port: 2221

gitea/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea

gitea/k8s/postgres.yaml

@@ -0,0 +1,62 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-postgres-service
+  namespace: gitea
+spec:
+  clusterIP: None
+  selector:
+    app: gitea-postgres
+  ports:
+  - port: 5432
+    targetPort: 5432
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: gitea-postgres-statefulset
+  namespace: gitea
+spec:
+  selector:
+    matchLabels:
+      app: gitea-postgres
+  serviceName: gitea-postgres-service
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: gitea-postgres
+    spec:
+      containers:
+      - name: gitea-postgres
+        image: postgres:14
+        env:
+        - name: POSTGRES_USER
+          valueFrom:
+            secretKeyRef:
+              name: gitea-secrets
+              key: GITEA__database__USER
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: gitea-secrets
+              key: GITEA__database__PASSWD
+        - name: POSTGRES_DB
+          valueFrom:
+            secretKeyRef:
+              name: gitea-secrets
+              key: GITEA__database__USER
+        ports:
+        - containerPort: 5432
+          name: postgres
+        volumeMounts:
+        - name: postgres-data
+          mountPath: /var/lib/postgresql/data
+  volumeClaimTemplates:
+  - metadata:
+      name: postgres-data
+    spec:
+      accessModes: [ "ReadWriteOnce" ]
+      resources:
+        requests:
+          storage: 1Gi