mirror of
https://github.com/git-pkgs/proxy.git
synced 2026-11-08 23:35:46 -05:00
173 lines
4.4 KiB
YAML
173 lines
4.4 KiB
YAML
# More than one replica requires config.data.database on Postgres and
|
|
# deploymentStrategy: RollingUpdate. Storage can be object storage (with
|
|
# persistence disabled) or a file:// URL on a ReadWriteMany volume
|
|
# (persistence.accessModes: [ReadWriteMany]). With upstream.git, each
|
|
# replica also needs its own git.cache_dir.
|
|
replicaCount: 1
|
|
|
|
nameOverride: ""
|
|
fullnameOverride: ""
|
|
|
|
image:
|
|
repository: ghcr.io/git-pkgs/proxy
|
|
# An empty tag uses the chart appVersion.
|
|
tag: ""
|
|
# When set, digest takes precedence over tag.
|
|
digest: ""
|
|
pullPolicy: IfNotPresent
|
|
|
|
imagePullSecrets: []
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 8080
|
|
# Keep this aligned with config.data.listen (or the listen address in an
|
|
# existing ConfigMap).
|
|
containerPort: 8080
|
|
|
|
# The generated configuration is ignored when existingConfigMap is set.
|
|
config:
|
|
existingConfigMap: ""
|
|
existingConfigMapKey: config.yaml
|
|
data:
|
|
listen: ":8080"
|
|
# Set this to the URL package-manager clients use to reach the proxy.
|
|
base_url: "http://localhost:8080"
|
|
storage:
|
|
url: "file:///data/artifacts"
|
|
database:
|
|
driver: sqlite
|
|
path: "/data/proxy.db"
|
|
log:
|
|
level: info
|
|
format: json
|
|
|
|
# Environment variables override values from the configuration file. This is
|
|
# also the recommended way to supply secret values such as database passwords
|
|
# and object-storage credentials.
|
|
extraEnv: []
|
|
# - name: PROXY_DATABASE_URL
|
|
# valueFrom:
|
|
# secretKeyRef:
|
|
# name: proxy-database
|
|
# key: url
|
|
|
|
extraEnvFrom: []
|
|
# - secretRef:
|
|
# name: proxy-object-storage
|
|
|
|
# Additional volumes for the pod and mounts for the proxy container, for
|
|
# example a ConfigMap holding a private CA certificate. Go adds certificates
|
|
# from the directories in SSL_CERT_DIR to its trusted roots (set it with
|
|
# extraEnv); SSL_CERT_FILE replaces the system bundle instead. All upstream
|
|
# TLS, including Git fetches, goes through the proxy process.
|
|
extraVolumes: []
|
|
# - name: corp-ca
|
|
# configMap:
|
|
# name: corp-ca
|
|
|
|
extraVolumeMounts: []
|
|
# - name: corp-ca
|
|
# mountPath: /etc/proxy/ca
|
|
# readOnly: true
|
|
|
|
# Init containers run before the proxy starts. They can use extraVolumes, but
|
|
# extraVolumeMounts applies only to the proxy container, so each init container
|
|
# needs its own volumeMounts.
|
|
extraInitContainers: []
|
|
# - name: wait-for-db
|
|
# image: busybox:1.37
|
|
# command: ["sh", "-c", "until nc -z postgres 5432; do sleep 2; done"]
|
|
|
|
# With SQLite, the database file needs a local disk or block-backed volume,
|
|
# even with one replica. ReadWriteOnce doesn't guarantee that: pick a
|
|
# storageClass that isn't NFS or another network filesystem. If only network
|
|
# filesystem storage is available, set config.data.database to Postgres.
|
|
# Artifact storage can stay on NFS on a separate volume (extraVolumes and
|
|
# extraVolumeMounts, with config.data.storage.url pointing at it).
|
|
persistence:
|
|
enabled: true
|
|
# Keep this aligned with config.data.storage.url and config.data.database.path
|
|
# (or the equivalent paths in an existing ConfigMap).
|
|
mountPath: /data
|
|
existingClaim: ""
|
|
annotations: {}
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
size: 10Gi
|
|
storageClass: ""
|
|
|
|
deploymentStrategy:
|
|
type: Recreate
|
|
|
|
ingress:
|
|
enabled: false
|
|
className: ""
|
|
annotations: {}
|
|
hosts: []
|
|
# - host: proxy.example.com
|
|
# paths:
|
|
# - path: /
|
|
# pathType: Prefix
|
|
tls: []
|
|
# - secretName: proxy-tls
|
|
# hosts:
|
|
# - proxy.example.com
|
|
|
|
podAnnotations: {}
|
|
podLabels: {}
|
|
|
|
podSecurityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
containerSecurityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
|
|
# /tmp is an emptyDir, since the root filesystem is read-only.
|
|
tmpDir:
|
|
sizeLimit: ""
|
|
|
|
resources: {}
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
# limits:
|
|
# memory: 512Mi
|
|
|
|
startupProbe:
|
|
tcpSocket:
|
|
port: http
|
|
failureThreshold: 30
|
|
periodSeconds: 2
|
|
|
|
# /health checks both the database and storage backends and can take up to ten
|
|
# seconds. It is intentionally a readiness check rather than a liveness check.
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: http
|
|
timeoutSeconds: 11
|
|
periodSeconds: 15
|
|
failureThreshold: 2
|
|
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: http
|
|
periodSeconds: 20
|
|
failureThreshold: 3
|
|
|
|
terminationGracePeriodSeconds: 30
|
|
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|
|
topologySpreadConstraints: []
|