feat(forgejo): self-hosted forge with ArgoCD-Dex OIDC

[xnoto]

Summary

Self-hosted Forgejo via the upstream Helm chart. Auth delegated to ArgoCD's embedded Dex (one IdP, one GitHub OAuth app) — same pattern as Headlamp / Grafana. SSH-over-tunnel deferred; HTTPS-only git for now.

Defaults chosen (per the sketch)

• HTTPS-only git push (no SSH tunnel) — `gitea.config.server.DISABLE_SSH=true`
• SQLite (chart default) — fine for solo
• OIDC primary auth — `ALLOW_ONLY_EXTERNAL_REGISTRATION=true`, no local sign-ups
• 20 GiB PVC, 1 GiB memory limit

Layout

• bootstrap/argocd-config.yaml — register `forgejo` Dex static client. Callback URL: `https://forgejo.makeitwork.cloud/user/oauth2/dex/callback\`.
• bootstrap/secrets/github-oauth-secret.yaml — sops-encrypted `dex.forgejo.clientSecret` added to argocd-secret.
• operators/forgejo/ —
  • `oidc-secret.yaml` — Secret `forgejo-oidc` with the `key` and `secret` stringData fields the chart's `existingSecret` hook reads.
  • `application.yaml` — Helm Application installing chart `forgejo` v13.1.0 from `code.forgejo.org/forgejo-helm`. Includes the `gitea.oauth[]` entry pointing at Dex's well-known URL with our existingSecret, and OIDC-only sign-up config.
  • `tunnel-binding.yaml` — fronts `forgejo-http` Service on `forgejo.makeitwork.cloud`.
  • `namespace.yaml` + `kustomization.yaml` + `ksops-forgejo-secrets.yaml`.
• operators/kustomization.yaml — add `forgejo`.

Pairs with

• tfroot-cloudflare fix(cloudflare): rename tunnel to cluster-apps-k3s #8 — `forgejo.makeitwork.cloud` CNAME (must apply first, then this).

Test plan

• After merge: `kubectl -n forgejo get pods` shows `forgejo-0` Running 1/1
• After merge: `https://forgejo.makeitwork.cloud\` loads the home page
• After merge: clicking "Sign in via Dex" redirects to GitHub OAuth via Dex; after consent lands on the dashboard with an OIDC-linked account
• After merge: try a basic clone / push over HTTPS using a generated personal access token

Follow-ups

• SSH-over-tunnel pattern (cloudflared access ssh + Dex-issued ssh certs?) if HTTPS git proves limiting
• Wire Forgejo metrics into Prometheus (chart's `gitea.metrics.enabled`)

🤖 Generated with Claude Code