mypersonalgit-deploy

Background

I've wanted my own git server for a long time, so I found the MyPerosnalGit project by chrisdfennell.

Purpose of repository

The repository serves ad a guide for deploying MyPersonalGit application using yaml scripts and k3s. (It's a poor guide, as I'm just learning how to deploy applications myself)

Why k3s?

Because k3s consumes fewer hardware resources, which is important if you rent a weak virtual server from a hosting provider. Addionally, I intended to use the git server only for myself and a couple of friends, for which k3s would be enough.

Why yaml scrips?

To better understand how everything works.

Resources' description

Deployment --- manages a set of Pods to run an application workload, usually one that doesn't maintain state. git-dep.yaml descripe Deployment, which:

• run fennch/mypersonalgit:latest
• exposes 8080 (for http) and 2222 (for ssh) ports
• mounts volumes: /data (for default db) and /repos (for repositary's data)
• connects volumeMounts to persistent volumes claims
• sets maxSurge for rollingUpdate strategy, which is the maximum number of additional pods can be created over desired

Service (ClusterIP) --- exposes the Service on a cluster-internal IP and provide access to the application on http through Ingress.

Service(LoadBalancer) --- exposes the Service externally using an external load balancer (ServiceLB in k3s) and provide ssh access.

Ingress --- map traffic to different backends based on rules you defined, may provide load balancing, SSL termination and name-based virtual hosting. This Ingress does the following:

• translate traffic for devgit.net/ to git-svc
• enables middleware and enctyprion

Middleware --- is the custom resource definition of a traefik middleware. This middleware redirect http requests to https.

Persistent Volume Claim (for repositories and configurations) --- is a user's request for and claim to a persistent volume (1 GiB for configs and 20 GiB for repos).

SSL setup

After deploting all the resources mentioned above, your application should already be running, but you should secure the connection.

Installing cert-manager

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.4/cert-manager.crds.yaml

Create cluster-issuer for production

# cluster-issuer-production.yaml

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-production
  namespace: default
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: <YOUR_EMAIL> # replace for your valid email
    privateKeySecretRef:
      name: letsencrypt-production
    solvers:
    - selector: {}
      http01:
        ingress:
          class: traefik

Apply for cluster

kubectl apply -f cluster-issuer-production.yaml

Add ClusterIssuer to ingress annotations

metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-production

After that and setuping the middleware, connection to the app will be automatically secured.

Disadvantages of the project

I have deployed the mypersonalgit project personally and tried to forbid registration, but no matter how i change the settings (admin dashboard or appsettings.json) registration page and registration itself was still available. Then I found claude in the contribitors of the project and realized it was better to find another opensource git server.