Files

T

Erki AasandClaude Opus 4.8 910f2c56d0 Rotate gitea SECRET_KEY into its own claim, drop gitea-random

Completes the post-breach (CVE-2026-59774) secret split. SECRET_KEY moves
from the shared gitea-random claim to a dedicated gitea-secret-key claim
with a fresh value, and the now-unused gitea-random claim is removed
(ArgoCD prunes it).

The earlier concern that rotating SECRET_KEY breaks the 2 push mirrors was
wrong: their gitlab.com credentials live in each repo's on-disk git config,
not in SECRET_KEY-encrypted storage. Blast radius here is negligible: 0 TOTP
2FA, 0 Actions secrets, 0 runner tokens, pull mirrors are public. SECRET_KEY
has no length constraint (Gitea hashes it to derive the AES key), so unlike
JWT_SECRET size 32 is fine and is not regenerated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-09-15 23:01:54 +03:00

application.yaml

Rotate gitea SECRET_KEY into its own claim, drop gitea-random

2026-09-15 23:01:54 +03:00

kustomization.yaml

gitea to minimal kustomize

2026-01-05 06:26:23 +02:00

mariadb.yaml

gitea to minimal kustomize

2026-01-05 06:26:23 +02:00

README.md

gitea to minimal kustomize

2026-01-05 06:26:23 +02:00

README.md

Gitea

This application is managed by ArgoCD

Should ArgoCD be down manifests here can be applied with:

kustomize build . | kubectl apply -f -

Gitea DOES NOT go through Traefik. It has its own IP because ssh :22 would conflict with kube worker ssh. On its own IP, at the moment it doesn't flirt with Traefik — also has its own certificate.