.drone.yml

@@ -102,6 +102,7 @@ steps:
         helm upgrade --install gitdata deploy/ \
           --namespace gitdataai \
           -f deploy/values.yaml \
+          -f deploy/secrets.yaml \
           --set image.registry=${REGISTRY} \
           --set app.image.tag=${TAG} \
           --set gitserver.image.tag=${TAG} \

deploy/templates/configmap.yaml

@@ -0,0 +1,51 @@
+{{- /* Application configuration - non-sensitive values */ -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "gitdata.fullname" . }}-config
+  namespace: {{ include "gitdata.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ .Chart.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+data:
+  APP_NAME: {{ .Values.app.name | default "gitdata" | quote }}
+  APP_VERSION: {{ .Chart.AppVersion | quote }}
+  APP_STATIC_DOMAIN: {{ .Values.config.staticDomain | default "" | quote }}
+  APP_MEDIA_DOMAIN: {{ .Values.config.mediaDomain | default "" | quote }}
+  APP_GIT_HTTP_DOMAIN: {{ .Values.config.gitHttpDomain | default "" | quote }}
+  APP_AVATAR_PATH: {{ .Values.config.avatarPath | default "/data/avatar" | quote }}
+  APP_REPOS_ROOT: {{ .Values.config.reposRoot | default "/data/repos" | quote }}
+  APP_LOG_LEVEL: {{ .Values.config.logLevel | default "info" | quote }}
+  APP_LOG_FORMAT: {{ .Values.config.logFormat | default "json" | quote }}
+  APP_LOG_FILE_ENABLED: {{ .Values.config.logFileEnabled | default "false" | quote }}
+  APP_LOG_FILE_PATH: {{ .Values.config.logFilePath | default "/var/log/gitdata/app.log" | quote }}
+  APP_LOG_FILE_ROTATION: {{ .Values.config.logFileRotation | default "daily" | quote }}
+  APP_LOG_FILE_MAX_FILES: {{ .Values.config.logFileMaxFiles | default "7" | quote }}
+  APP_LOG_FILE_MAX_SIZE: {{ .Values.config.logFileMaxSize | default "100" | quote }}
+  APP_OTEL_ENABLED: {{ .Values.config.otelEnabled | default "false" | quote }}
+  APP_OTEL_ENDPOINT: {{ .Values.config.otelEndpoint | default "" | quote }}
+  APP_OTEL_SERVICE_NAME: {{ .Values.config.otelServiceName | default "gitdata" | quote }}
+  APP_OTEL_SERVICE_VERSION: {{ .Chart.AppVersion | quote }}
+  APP_DATABASE_MAX_CONNECTIONS: {{ .Values.config.databaseMaxConnections | default "100" | quote }}
+  APP_DATABASE_MIN_CONNECTIONS: {{ .Values.config.databaseMinConnections | default "5" | quote }}
+  APP_DATABASE_IDLE_TIMEOUT: {{ .Values.config.databaseIdleTimeout | default "600" | quote }}
+  APP_DATABASE_MAX_LIFETIME: {{ .Values.config.databaseMaxLifetime | default "3600" | quote }}
+  APP_DATABASE_CONNECTION_TIMEOUT: {{ .Values.config.databaseConnectionTimeout | default "30" | quote }}
+  APP_DATABASE_SCHEMA_SEARCH_PATH: {{ .Values.config.databaseSchemaSearchPath | default "public" | quote }}
+  APP_DATABASE_HEALTH_CHECK_INTERVAL: {{ .Values.config.databaseHealthCheckInterval | default "30" | quote }}
+  APP_DATABASE_RETRY_ATTEMPTS: {{ .Values.config.databaseRetryAttempts | default "3" | quote }}
+  APP_DATABASE_RETRY_DELAY: {{ .Values.config.databaseRetryDelay | default "1" | quote }}
+  APP_REDIS_POOL_SIZE: {{ .Values.config.redisPoolSize | default "16" | quote }}
+  APP_REDIS_CONNECT_TIMEOUT: {{ .Values.config.redisConnectTimeout | default "5" | quote }}
+  APP_REDIS_ACQUIRE_TIMEOUT: {{ .Values.config.redisAcquireTimeout | default "1" | quote }}
+  HOOK_POOL_MAX_CONCURRENT: {{ .Values.config.hookPoolMaxConcurrent | default "100" | quote }}
+  HOOK_POOL_CPU_THRESHOLD: {{ .Values.config.hookPoolCpuThreshold | default "80" | quote }}
+  HOOK_POOL_REDIS_LIST_PREFIX: {{ .Values.config.hookPoolRedisListPrefix | default "{hook}" | quote }}
+  HOOK_POOL_REDIS_LOG_CHANNEL: {{ .Values.config.hookPoolRedisLogChannel | default "hook:logs" | quote }}
+  HOOK_POOL_REDIS_BLOCK_TIMEOUT: {{ .Values.config.hookPoolRedisBlockTimeout | default "5" | quote }}
+  HOOK_POOL_REDIS_MAX_RETRIES: {{ .Values.config.hookPoolRedisMaxRetries | default "3" | quote }}
+  APP_SMTP_PORT: {{ .Values.config.smtpPort | default "587" | quote }}
+  APP_SMTP_TLS: {{ .Values.config.smtpTls | default "true" | quote }}
+  APP_SMTP_TIMEOUT: {{ .Values.config.smtpTimeout | default "30" | quote }}
+  APP_SSH_PORT: {{ .Values.config.sshPort | default "22" | quote }}

deploy/templates/migrate-job.yaml

@@ -0,0 +1,42 @@
+{{- if .Values.migrate.enabled -}}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "gitdata.fullname" . }}-migrate
+  namespace: {{ include "gitdata.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "gitdata.fullname" . }}-migrate
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+spec:
+  backoffLimit: {{ .Values.migrate.backoffLimit }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "gitdata.fullname" . }}-migrate
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      restartPolicy: OnFailure
+      containers:
+        - name: migrate
+          image: "{{ .Values.image.registry }}/{{ .Values.migrate.image.repository }}:{{ .Values.migrate.image.tag }}"
+          imagePullPolicy: {{ .Values.migrate.image.pullPolicy | default .Values.image.pullPolicy }}
+          command:
+            {{- if .Values.migrate.command }}
+            - {{ .Values.migrate.command }}
+            {{- else }}
+            - up
+            {{- end }}
+          env:
+            - name: APP_DATABASE_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "gitdata.fullname" . }}-config
+                  key: APP_DATABASE_URL
+            {{- range .Values.migrate.env }}
+            - name: {{ .name }}
+              value: {{ .value | quote }}
+            {{- end }}
+{{- end }}

deploy/templates/namespace.yaml

@@ -0,0 +1,10 @@
+{{- /* Unified namespace declaration */ -}}
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ include "gitdata.namespace" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "gitdata.fullname" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  annotations:
+    helm.sh/resource-policy: keep

deploy/values.yaml

@@ -150,6 +150,9 @@ frontend:
     requests:
       cpu: 50m
       memory: 64Mi
+    limits:
+      cpu: 200m
+      memory: 256Mi
 
   livenessProbe:
     initialDelaySeconds: 5
@@ -200,6 +203,9 @@ app:
     requests:
       cpu: 100m
       memory: 256Mi
+    limits:
+      cpu: 1000m
+      memory: 1Gi
 
   livenessProbe:
     path: /health
@@ -254,6 +260,14 @@ static:
   cors: true
   logLevel: info
 
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      cpu: 200m
+      memory: 256Mi
+
   livenessProbe:
     path: /health
     port: 8081
@@ -301,6 +315,9 @@ gitserver:
     requests:
       cpu: 100m
       memory: 128Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
 
   livenessProbe:
     tcpSocket:
@@ -377,6 +394,9 @@ emailWorker:
     requests:
       cpu: 50m
       memory: 64Mi
+    limits:
+      cpu: 200m
+      memory: 256Mi
 
   env: []
 
@@ -426,6 +446,9 @@ gitHook:
     requests:
       cpu: 50m
       memory: 64Mi
+    limits:
+      cpu: 200m
+      memory: 256Mi
 
   env: []
 
@@ -465,6 +488,9 @@ operator:
     requests:
       cpu: 50m
       memory: 64Mi
+    limits:
+      cpu: 200m
+      memory: 256Mi
 
   nodeSelector: {}
   tolerations: []

scripts/build.js

@@ -20,7 +20,7 @@ const { execSync } = require('child_process');
 const path = require('path');
 
 const REGISTRY = process.env.REGISTRY || 'harbor.gitdata.me/gta_team';
-const TAG = process.env.TAG || new Date().toISOString().slice(0, 13).replace('T', '-');
+const TAG = process.env.TAG || 'latest';
 const BUILD_TARGET = process.env.TARGET || 'x86_64-unknown-linux-gnu';
 
 const RUST_SERVICES = ['app', 'gitserver', 'email-worker', 'git-hook', 'operator', 'static'];

scripts/push.js

@@ -16,7 +16,7 @@
 const { execSync } = require('child_process');
 
 const REGISTRY = process.env.REGISTRY || 'harbor.gitdata.me/gta_team';
-const TAG = process.env.TAG || new Date().toISOString().slice(0, 13).replace('T', '-');
+const TAG = process.env.TAG || process.env.GITHUB_SHA?.substring(0, 8) || 'latest';
 const DOCKER_USER = process.env.DOCKER_USER || process.env.HARBOR_USERNAME;
 const DOCKER_PASS = process.env.DOCKER_PASS || process.env.HARBOR_PASSWORD;
 
@@ -58,7 +58,7 @@ for (const service of targets) {
   console.log(`\n==> Pushing ${image}`);
 
   try {
-    execSync(`docker push "${image}"`, { stdio: 'inherit' });
+    execSync(`docker push "${image}" --all-tags`, { stdio: 'inherit' });
     console.log(`    [OK] ${image}`);
   } catch (error) {
     console.error(`    [FAIL] ${service}`);