Date: 2026-02-06
Migrate gitea.app.lan (and gitea-private.app.lan) off the old docker container on kryptovisor onto Kubernetes on drg-k8s.auth.home.lan, preserving accounts/config/repos.
kryptovisor: gitea-gitea-private-1.gitea-private.app.lan in app.ini./mnt/fastdata/docker/apps/gitea/data/gitea-private was not writable from drg-k8s via NFS (even when owned by drgadmin).
/data to a Kubernetes-writable location: /mnt/fastdata/k8s-pvcs/gitea/data./mnt/fastdata/tmp/gitea-dumps/gitea-dump-20260206T141600Z.zip (created on kryptovisor).giteaDeployment/gitea (image gitea/gitea:1.24.6)Service/gitea-http (ClusterIP :3000)Ingress/gitea (hosts: gitea.app.lan, gitea-private.app.lan, class nginx)/data -> /mnt/fastdata/k8s-pvcs/gitea/data/data/git -> /mnt/bigdata/personal/projects/gitchown/chmod ... Operation not permitted for /data/git due to NFS restrictions, but Gitea still starts.docker stop gitea-gitea-private-1/data to Kubernetes-writable location:
rsync -a --delete /mnt/fastdata/docker/apps/gitea/data/gitea-private/ /mnt/fastdata/k8s-pvcs/gitea/data/chown -R 1240000012:1240000009 /mnt/fastdata/k8s-pvcs/gitea/dataapp.ini:
ROOT_URL, DOMAIN, SSH_DOMAIN set to gitea.app.lan./mnt/fastdata/docker/apps/traefik/config/docker/cert_conf.yml to add router/service.http://192.168.1.216:30331 (ingress-nginx NodePort :80).gitea.app.lan:222 behavior:
docker run --network host ... alpine/socat TCP-LISTEN:222 ... TCP:192.168.1.216:222ufw allow from 192.168.1.0/24 to any port 222 proto tcpdrg-k8s:
curl -H 'Host: gitea.app.lan' http://127.0.0.1:30331/ -> 200 OK (ingress-nginx routes to in-cluster Gitea)curl -k https://gitea.app.lan/ -> 200 (Traefik routes to Kubernetes ingress)192.168.1.216:222 OKgitea.app.lan:222 OK (after UFW allow)Exited).gitea.app.lan + gitea-private.app.lan to Kubernetes.:222 to drg-k8s :222.kubectl -n gitea scale deploy gitea --replicas=0.bak and restart Traefik.gitea-ssh-forward container.gitea-gitea-private-1.