prole/mock_val/init_forgejo.sh

#!/usr/bin/env bash
set -euo pipefail

PROG="init_forgejo"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# shellcheck disable=SC1090
source "$SCRIPT_DIR/prole_cfg.sh"

MODE="$(prole_normalize_mode "${PROLE_MODE:-${DEPLOYMENT_MODE:-k3d}}")"
NAMESPACE="${FORGEJO_NAMESPACE:-}"
CFG_PATH=""
FORCE=0

usage() {
  cat <<EOF
Usage:
  $PROG [options] [deploy]

Options:
  --mode <k3d|k3s|k8s|local>   Deployment mode (default: ${MODE:-k3d})
  -n, --namespace <name>       Target namespace (default: forgejo)
  -c, --config <prole.cfg>     Path to prole.cfg (defaults to detected)
  --force                      Delete existing Forgejo resources before deploy
  --help                       Show this help

Behavior:
  - Applies a minimal Forgejo Deployment/Service manifest.
  - Uses CloudNativePG (CNPG) Postgres as the database backend.
  - By default, creates a dedicated DB + role inside the CNPG cluster.
EOF
}

die() { echo "[ERROR] $*" >&2; exit 2; }
log() { echo "[INFO] $*"; }
warn() { echo "[WARN] $*" >&2; }

while [[ $# -gt 0 ]]; do
  case "$1" in
    --mode) MODE="$(prole_normalize_mode "${2:-}")"; shift 2 ;;
    --mode=*) MODE="$(prole_normalize_mode "${1#*=}")"; shift 1 ;;
    -n|--namespace) NAMESPACE="${2:-}"; shift 2 ;;
    --namespace=*) NAMESPACE="${1#*=}"; shift 1 ;;
    -c|--config) CFG_PATH="${2:-}"; shift 2 ;;
    --config=*) CFG_PATH="${1#*=}"; shift 1 ;;
    --force) FORCE=1; shift 1 ;;
    -h|--help) usage; exit 0 ;;
    *) break ;;
  esac
done

# Resolve config path and namespace defaults from prole.cfg when present
if [[ -z "$CFG_PATH" && -n "${PROLE_CONF:-}" && -f "${PROLE_CONF}/prole.cfg" ]]; then
  CFG_PATH="${PROLE_CONF}/prole.cfg"
elif [[ -z "$CFG_PATH" && -f "$SCRIPT_DIR/../conf/prole.cfg" ]]; then
  CFG_PATH="$SCRIPT_DIR/../conf/prole.cfg"
fi

if [[ -z "$NAMESPACE" && -n "$CFG_PATH" ]]; then
  maybe_ns="$(_prole_cfg_extract_key "$CFG_PATH" "GITOPS_NAMESPACE")"
  [[ -z "$maybe_ns" ]] && maybe_ns="$(_prole_cfg_extract_key "$CFG_PATH" "FORGEJO_NAMESPACE")"
  NAMESPACE="$maybe_ns"
fi
NAMESPACE="${NAMESPACE:-forgejo}"
export FORGEJO_NAMESPACE="$NAMESPACE"

case "$MODE" in
  k3d|k3s|k8s|local) ;;
  *) die "Unsupported mode '$MODE' (use k3d, k3s, k8s, or local)" ;;
esac
export PROLE_MODE="$MODE"

command -v kubectl >/dev/null || die "kubectl not found"

DB_NAMESPACE="${PROLE_NAMESPACE:-}"
if [[ -z "$DB_NAMESPACE" && -n "$CFG_PATH" ]]; then
  DB_NAMESPACE="$(_prole_cfg_extract_key "$CFG_PATH" "NAMESPACE")"
fi
DB_NAMESPACE="${DB_NAMESPACE:-default}"

CNPG_CLUSTER_NAME="${CNPG_CLUSTER_NAME:-knoe-db}"
FORGEJO_DB_NAME="${FORGEJO_DB_NAME:-forgejo}"
FORGEJO_DB_USER="${FORGEJO_DB_USER:-forgejo}"
FORGEJO_DB_PASSWORD="${FORGEJO_DB_PASSWORD:-}"
if [[ -z "$FORGEJO_DB_PASSWORD" ]]; then
  # 24 chars alnum for broad chart compatibility.
  FORGEJO_DB_PASSWORD=$(LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom 2>/dev/null | head -c 24 || true)
fi

DB_HOST="${CNPG_CLUSTER_NAME}-rw.${DB_NAMESPACE}.svc.cluster.local"
DB_PORT="${FORGEJO_DB_PORT:-5432}"

kubectl get ns "$NAMESPACE" >/dev/null 2>&1 || kubectl create namespace "$NAMESPACE" >/dev/null 2>&1

if [[ "$FORCE" -eq 1 ]]; then
  warn "--force specified; removing existing Forgejo resources in namespace $NAMESPACE"
  kubectl -n "$NAMESPACE" delete deploy/forgejo svc/forgejo-http svc/forgejo-ssh ingress/forgejo >/dev/null 2>&1 || true
fi

ensure_db() {
  local primary_pod=""
  primary_pod=$(kubectl -n "$DB_NAMESPACE" get pods \
    -l "cnpg.io/cluster=${CNPG_CLUSTER_NAME},role=primary" \
    -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
  if [[ -z "$primary_pod" ]]; then
    primary_pod=$(kubectl -n "$DB_NAMESPACE" get pods \
      -l "cnpg.io/cluster=${CNPG_CLUSTER_NAME}" \
      -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
  fi
  if [[ -z "$primary_pod" ]]; then
    die "Could not find CNPG pod for cluster '${CNPG_CLUSTER_NAME}' in namespace '${DB_NAMESPACE}'"
  fi

  log "Ensuring database '${FORGEJO_DB_NAME}' and role '${FORGEJO_DB_USER}' exist in CNPG cluster '${CNPG_CLUSTER_NAME}' (ns=${DB_NAMESPACE})"

  # Create role/db idempotently.
  kubectl -n "$DB_NAMESPACE" exec "$primary_pod" -- bash -lc "psql -v ON_ERROR_STOP=1 -U postgres -d postgres" <<SQL
DO \$\$
BEGIN
  IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = '${FORGEJO_DB_USER}') THEN
    CREATE ROLE ${FORGEJO_DB_USER} LOGIN PASSWORD '${FORGEJO_DB_PASSWORD}';
  END IF;
END
\$\$;

DO \$\$
BEGIN
  IF NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = '${FORGEJO_DB_NAME}') THEN
    CREATE DATABASE ${FORGEJO_DB_NAME} OWNER ${FORGEJO_DB_USER};
  END IF;
END
\$\$;
SQL

  # Store app connection info in the Forgejo namespace.
  kubectl -n "$NAMESPACE" create secret generic forgejo-db \
    --from-literal=host="$DB_HOST" \
    --from-literal=port="$DB_PORT" \
    --from-literal=database="$FORGEJO_DB_NAME" \
    --from-literal=username="$FORGEJO_DB_USER" \
    --from-literal=password="$FORGEJO_DB_PASSWORD" \
    --dry-run=client -o yaml | kubectl apply -f - >/dev/null
}

ensure_db

FORGEJO_IMAGE_REPO="${FORGEJO_IMAGE_REPO:-codeberg.org/forgejo/forgejo}"
FORGEJO_IMAGE_TAG="${FORGEJO_IMAGE_TAG:-latest}"

log "Deploying Forgejo to namespace '$NAMESPACE' (mode=$MODE)"

cat <<EOF | kubectl apply -n "$NAMESPACE" -f -
apiVersion: apps/v1
kind: Deployment
metadata:
  name: forgejo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: forgejo
  template:
    metadata:
      labels:
        app: forgejo
    spec:
      containers:
        - name: forgejo
          image: ${FORGEJO_IMAGE_REPO}:${FORGEJO_IMAGE_TAG}
          ports:
            - name: http
              containerPort: 3000
            - name: ssh
              containerPort: 2222
          env:
            # Prefer Forgejo prefix, but also set Gitea-style keys for compatibility.
            - name: FORGEJO__database__DB_TYPE
              value: postgres
            - name: FORGEJO__database__HOST
              valueFrom:
                secretKeyRef:
                  name: forgejo-db
                  key: host
            - name: FORGEJO__database__NAME
              valueFrom:
                secretKeyRef:
                  name: forgejo-db
                  key: database
            - name: FORGEJO__database__USER
              valueFrom:
                secretKeyRef:
                  name: forgejo-db
                  key: username
            - name: FORGEJO__database__PASSWD
              valueFrom:
                secretKeyRef:
                  name: forgejo-db
                  key: password
            - name: GITEA__database__DB_TYPE
              value: postgres
            - name: GITEA__database__HOST
              value: ${DB_HOST}:${DB_PORT}
            - name: GITEA__database__NAME
              valueFrom:
                secretKeyRef:
                  name: forgejo-db
                  key: database
            - name: GITEA__database__USER
              valueFrom:
                secretKeyRef:
                  name: forgejo-db
                  key: username
            - name: GITEA__database__PASSWD
              valueFrom:
                secretKeyRef:
                  name: forgejo-db
                  key: password
---
apiVersion: v1
kind: Service
metadata:
  name: forgejo-http
spec:
  selector:
    app: forgejo
  ports:
    - name: http
      port: 3000
      targetPort: 3000
---
apiVersion: v1
kind: Service
metadata:
  name: forgejo-ssh
spec:
  selector:
    app: forgejo
  ports:
    - name: ssh
      port: 2222
      targetPort: 2222
EOF

log "Waiting for deployment rollout..."
kubectl -n "$NAMESPACE" rollout status deploy/forgejo --timeout=10m

log "Done. Service endpoints:"
kubectl -n "$NAMESPACE" get svc forgejo-http forgejo-ssh