feat(forgejo): self-hosted forge with ArgoCD-Dex OIDC

bootstrap/argocd-config.yaml

@@ -124,6 +124,13 @@ spec:
             secret: $dex.grafana.clientSecret
             redirectURIs:
               - https://grafana.makeitwork.cloud/login/generic_oauth
+          # Forgejo uses Dex as its OIDC provider via the `dex` auth source
+          # configured at install time (see operators/forgejo/application.yaml).
+          - id: forgejo
+            name: Forgejo
+            secret: $dex.forgejo.clientSecret
+            redirectURIs:
+              - https://forgejo.makeitwork.cloud/user/oauth2/dex/callback
   # RBAC with GitHub team mapping
   rbac:
     defaultPolicy: ''

bootstrap/secrets/github-oauth-secret.yaml

@@ -16,6 +16,7 @@ stringData:
     dex.github.clientSecret: ENC[AES256_GCM,data:g53ok+zuNccR47ngruY9HsXRO0JbGazW32MMduvfaim2QBKs03ATCg==,iv:QqaXEDFwKpaEC1Evdaj4j1jmJzbXpevMcYXxqLF1o8U=,tag:sAQU431fwCQH3vAYOm9O1Q==,type:str]
     dex.headlamp.clientSecret: ENC[AES256_GCM,data:iO6N04zWyzvaHcs8Bd2fIaYayDAHPonQM/0CI8wXynrH0nklrQpTBuFgCarJ5/iUbGKWKQsECEAH/yzTmqCNIg==,iv:eDlO8C0OJFSnp0d90Qgj2hJqCaa74Fw58dB/VNhFvZg=,tag:GcZdcjnSOab+LWfXgGb3lw==,type:str]
     dex.grafana.clientSecret: ENC[AES256_GCM,data:W83Zy4wsbNIUza47swtVAYjYbMiVSbLiPyBjEAj3cBHafRv4LMDtXCe/U9UWvyqMnsVdcXqsmE2FflDGQLBDcQ==,iv:nmsgCR7D35Tya0DRJZUMPtPEkElRJeqInzk4N2yMgP8=,tag:srmM2rscemUDOUjaz/fqhQ==,type:str]
+    dex.forgejo.clientSecret: ENC[AES256_GCM,data:E1Fs089ssIsMc5vnrjPbEFjsbAQQq82obeNsS7be4vklXVs37BdedTnOWiAWCrahyPoc3MqqEE3W5Rgutd63OQ==,iv:Ael18r8WxOvZSZ5wktGYQqPyege9Ybs54e2yLU7YSG0=,tag:tRkzxr2qZOwonBUMR+c7Kg==,type:str]
 sops:
     age:
         - recipient: age152ek83tm4fj5u70r3fecytn4kg7c5xca24erjchxexx4pfqg6das7q763l
@@ -27,7 +28,7 @@ sops:
             T2dvNlRjNE1lNFVHWnJWNTA2Z2M5STgKUX9gEItGx811Wsq/GjUwe+pxyi9lt5gY
             uqKM/eXkZyz9S3HqinAhw5xiPEBokqmNcpaOHtHNgpgkhJY9YFCllQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-30T04:26:32Z"
-    mac: ENC[AES256_GCM,data:NJvT2fUOM2YXni/Di/DJv0hnKOO65sqRnU2jfI1Dur4M2HWjnJTRJTehb4UVbc1GvkLwVCi80inWmheoW3eWjfwDRR74VHKWXQBEG50fDk6AfZMrugH1c71FjbhEzkk33VYIwMn0B2OOyeH06TceXQ6pRAzVfv6nG5zZ9hpo5d4=,iv:DH9adVlZBl99Oj2KGjkEUUfPCmyohyIJ5t6OTnWNQD8=,tag:PqDm8YllKQHS7utXKLI/Iw==,type:str]
+    lastmodified: "2026-04-30T05:14:39Z"
+    mac: ENC[AES256_GCM,data:Ya/DL6Nl+L2LvDT6X/ysesBSY3C2TQpYsHd8vYcfgQPRvUx6z2hBPt7stTgMyALmMaItcxb7OJdYjgs5Hg3VlTYjH84iXyLgLcQX8DcM3Cscq4LJQWTsDmYxx/u8ebaaCXoCSEYFv1Qg8gdw4LlZCAvixmOuxgpJpevjNDgU5Fw=,iv:czbb86e4QoUwZVaY+nyImM3VYmwtADmycINhOjD0rno=,tag:Z+wqDbfOLF082SuQrntCXQ==,type:str]
     encrypted_regex: ^(token|api-token|apiToken|clientID|clientSecret|client_id|client_secret|password|secret|github_token|CLOUDFLARE_API_TOKEN|credentials\.json|.*_SERVICE_KEY|GF_AUTH_GITHUB_CLIENT_SECRET|GF_SECURITY_ADMIN_PASSWORD|dex\.[a-z]+\.clientID|dex\.[a-z]+\.clientSecret)$
     version: 3.12.2

operators/forgejo/application.yaml

@@ -0,0 +1,66 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: forgejo
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: default
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: forgejo
+  source:
+    chart: forgejo
+    repoURL: code.forgejo.org/forgejo-helm
+    targetRevision: 13.1.0
+    helm:
+      releaseName: forgejo
+      valuesObject:
+        # Enough for a single-user instance with some repos.
+        persistence:
+          enabled: true
+          size: 20Gi
+        # Single-replica is the only mode SQLite supports anyway.
+        replicaCount: 1
+        strategy:
+          type: Recreate
+        gitea:
+          # OIDC sign-in via ArgoCD's embedded Dex (`dex` auth source).
+          # The chart's init container runs `gitea admin auth add-oauth`
+          # using values pulled from the forgejo-oidc Secret (key/secret).
+          oauth:
+            - name: dex
+              provider: openidConnect
+              autoDiscoverUrl: https://argocd.makeitwork.cloud/api/dex/.well-known/openid-configuration
+              scopes: openid profile email groups
+              existingSecret: forgejo-oidc
+          config:
+            server:
+              ROOT_URL: https://forgejo.makeitwork.cloud/
+              DOMAIN: forgejo.makeitwork.cloud
+              # No SSH over the public tunnel; HTTPS git only.
+              DISABLE_SSH: true
+              START_SSH_SERVER: false
+            service:
+              # Local password auth disabled — OIDC primary.
+              ALLOW_ONLY_EXTERNAL_REGISTRATION: true
+              ENABLE_OPENID_SIGNIN: true
+              ENABLE_OPENID_SIGNUP: true
+            openid:
+              ENABLE_OPENID_SIGNIN: true
+              ENABLE_OPENID_SIGNUP: true
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            memory: 1Gi
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - ServerSideApply=true
+      - CreateNamespace=true

operators/forgejo/ksops-forgejo-secrets.yaml

@@ -0,0 +1,10 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: ksops-forgejo-secrets
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: ksops
+files:
+  - oidc-secret.yaml

operators/forgejo/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - application.yaml
+  - tunnel-binding.yaml
+generators:
+  - ksops-forgejo-secrets.yaml

operators/forgejo/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: forgejo
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"

operators/forgejo/oidc-secret.yaml

@@ -0,0 +1,29 @@
+# Consumed by the Forgejo Helm chart's gitea.oauth[].existingSecret hook,
+# which expects two stringData keys: "key" (clientID) and "secret"
+# (clientSecret). Matches dex.forgejo.clientSecret in argocd-secret.
+apiVersion: v1
+kind: Secret
+metadata:
+    name: forgejo-oidc
+    namespace: forgejo
+    annotations:
+        argocd.argoproj.io/sync-wave: "0"
+type: Opaque
+stringData:
+    key: forgejo
+    secret: ENC[AES256_GCM,data:zH1yX3Qw5j55knU468o4DOiiJaqNpLLUNLuCtbN17Q92NCjAxNoyl8N9+EXhYj3i2fQ2wWv7CThO4hFs81dpsg==,iv:YsP+RSBfTRo64AjA8zDMHBYFu61lmMYJ0B8hFWSPwo0=,tag:lbL92JdQaMNjB3hUO5Qn4g==,type:str]
+sops:
+    age:
+        - recipient: age152ek83tm4fj5u70r3fecytn4kg7c5xca24erjchxexx4pfqg6das7q763l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrcUw2U1gvbWphaUVEMTA5
+            VS8wbHdVY1VtKzQ5cjJkSFJ4WEFVUVc5TEMwClhBN3dlajhvRHdnS1J2VWN4ZTZu
+            WkdLeCtoZmNTRDVTQVpOdHlzOXN2cFUKLS0tIFo2S09vUXVkanBkYXpvSVIyNHFu
+            cE9CVkR6bnR1Ly9uMEQ2dmFMUUdmK0kKhjJw7mJlSY2Zm2RNTK3hPQEOeoYp5+2G
+            E53MJEvft81m3bZC5HUpVmXslA5/6DaKIr7U3ULDt184+iYRh/dJ/A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-30T05:15:38Z"
+    mac: ENC[AES256_GCM,data:n8gRWK542eUHTIvWIUUa2FD5UzgO3ikuyrGSmgAei1B34JeMW3VQ0PrsoFjOXZf94+pp6TGqDkt+SAZn9Hji80H7gYPZpuTYS8Twov8RDZUswkyRUKWgG1+UwkLGJeml5eFx3lnyFu0Xu69rFNl/7V7lVKyFB/t1Ewttu056PqA=,iv:Xjxoa1xzr38xz4HI3K2jXBA5a6tY2SEZBoF2RUiA0fU=,tag:ptr63wITVkxwTDSqv9mFWA==,type:str]
+    encrypted_regex: ^(token|api-token|apiToken|clientID|clientSecret|client_id|client_secret|password|secret|github_token|CLOUDFLARE_API_TOKEN|credentials\.json|.*_SERVICE_KEY|GF_AUTH_(GITHUB|GENERIC_OAUTH)_CLIENT_SECRET|GF_SECURITY_ADMIN_PASSWORD|dex\.[a-z]+\.clientID|dex\.[a-z]+\.clientSecret|OIDC_CLIENT_(ID|SECRET))$
+    version: 3.12.2

operators/forgejo/tunnel-binding.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: networking.cfargotunnel.com/v1alpha1
+kind: TunnelBinding
+metadata:
+  name: forgejo
+  namespace: forgejo
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+subjects:
+  - name: forgejo-http
+    spec:
+      fqdn: forgejo.makeitwork.cloud
+      target: http://forgejo-http.forgejo.svc:3000
+tunnelRef:
+  kind: ClusterTunnel
+  name: cluster-apps

operators/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
   - arc
   - cert-manager
   - cloudflare
+  - forgejo
   - grafana
   - headlamp
   - kube-prometheus-stack