Snapshot date: 2026-03-22
Gitea runs in the Kubernetes cluster whose control-plane host is drg-k8s.auth.home.lan and is exposed internally through ingress-nginx. The service pod's node is not a statement of runner placement.
For AutoCoder CI/build execution, use the worker host drg-k8s-worker-01.auth.home.lan; see AutoCoder worker placement. The service configuration below remains a dated snapshot; verify live placement before operating.
giteadeployment.apps/gitea
gitea/gitea:1.24.6Recreateservice/gitea-http (ClusterIP, port 3000)ingress.networking.k8s.io/gitea
nginxgitea.app.lan, gitea-private.app.lanHTTP:
http://gitea.app.lan/ (internally routed via ingress)SSH:
gitea.app.lan:222ssh://git@gitea.app.lan:222/<owner>/<repo>.gitCurrent implementation:
gitea-ssh-portforward.service on drg-k8s.auth.home.lan
kubectl port-forward --address 0.0.0.0 deploy/gitea 2222:22gitea-ssh-reverse-tunnel.service on drg-k8s.auth.home.lan
ssh -R 2299:127.0.0.1:2222 ax_julian@kryptovisorgitea-ssh-forward container on kryptovisor
0.0.0.0:222127.0.0.1:2299Effective SSH flow:
client -> kryptovisor:222 -> gitea-ssh-forward container -> kryptovisor localhost:2299 -> reverse SSH tunnel -> drg-k8s localhost:2222 -> kubectl port-forward -> gitea pod:22
This deployment uses hostPath volumes into NFS-mounted directories (no PVCs in the gitea namespace).
Mounted into the pod:
/data -> /mnt/fastdata/k8s-pvcs/gitea/data
gitea/conf/app.ini (contains configuration; may contain secrets)gitea/gitea.db (SQLite database file)/data/git -> /mnt/bigdata/personal/projects/git
repositories/lfs/Related storage docs:
server-documentations/drg-k8s/storage/mnt-fastdata.mdserver-documentations/drg-k8s/storage/mnt-bigdata.md/mnt/fastdata and /mnt/bigdata must be accessible (NFS) for Gitea to start correctly./mnt/fastdata/k8s-pvcs/gitea/data/gitea/gitea.db/mnt/fastdata/k8s-pvcs/gitea/data/gitea/conf/app.ini (handle as sensitive; do not copy into documentation)/mnt/bigdata/personal/projects/git/repositories/ and /mnt/bigdata/personal/projects/git/lfs/systemctl status gitea-ssh-portforward.servicesystemctl status gitea-ssh-reverse-tunnel.servicedocker ps --filter name=gitea-ssh-forwarddocker logs gitea-ssh-forward on kryptovisorchanges/2026-03-22-gitea-ssh-relay-fixchanges/2026-02-06-gitea-migration-k8s.mdprocedures/autocoder-engine/gitea-migration/Migrated from host instructions; the older service snapshot above has not been revalidated by this documentation change.
https://gitea.app.lan/api/v1./home/ax_julian/.local/bin/gitea-mcp; non-root MCP configuration: /home/ax_julian/.codex/config.toml./home/ax_julian/.codex/secrets/gitea.env and /home/ax_julian/.codex/secrets/gitea.mcp.env. Never publish their values./usr/local/share/ca-certificates/kryptovisor-local-ca.crt. The former instructions recorded OS trust registration using update-ca-certificates and Node trust through NODE_EXTRA_CA_CERTS in the MCP environment file./home/ax_julian/ops-tools/mcp/gitea-mcp-smoke.js; inspect its current behavior before running it.The former instructions recorded successful MCP access after CA trust setup on 2026-02-07; do not infer current availability from that date. The wrapper, certificate file, and smoke-test script exist as of 2026-09-11; this migration did not reinstall trust or test Gitea connectivity. For a current TLS failure, inspect the certificate chain, hostname and wrapper environment. Repair trust only within an authorized administrative task; never disable TLS verification. Verify with a current read-only API request. Issue mutations still require the specific user authorization defined in host instructions.