merge: move Gitea public exposure to NC01

config/platform-infra/gitea.yaml

@@ -13,7 +13,7 @@ metadata:
     - 1560
 
 defaults:
-  targetId: JD01
+  targetId: NC01
 
 migration:
   role: gitea-pac-cicd-source-authority
@@ -247,6 +247,8 @@ targets:
     enabled: true
     createNamespace: true
     storageClassName: local-path
+    publicExposure:
+      enabled: false
   - id: NC01
     route: NC01:k3s
     namespace: devops-infra
@@ -255,7 +257,7 @@ targets:
     createNamespace: true
     storageClassName: local-path
     publicExposure:
-      enabled: false
+      enabled: true
     webhookSync:
       publicPath: /_unidesk/github-to-gitea/nc01
       frpc:
@@ -296,7 +298,7 @@ app:
       image: fatedier/frpc:v0.68.1
       serverAddr: 82.156.23.220
       serverPort: 22000
-      proxyName: platform-infra-gitea-jd01-web
+      proxyName: platform-infra-gitea-nc01-web
       remotePort: 22080
       localIP: gitea-http.devops-infra.svc.cluster.local
       localPort: 3000

scripts/src/platform-infra-gitea-remote.sh

@@ -109,6 +109,27 @@ run_apply() {
       printf '%s\n' "frpc disabled" >"$tmp/frpc-rollout.err"
     fi
   fi
+  if [ "$UNIDESK_GITEA_FRPC_ENABLED" = "0" ] && [ "$UNIDESK_GITEA_DRY_RUN" != "1" ]; then
+    kubectl -n "$UNIDESK_GITEA_NAMESPACE" delete deployment "$UNIDESK_GITEA_FRPC_DEPLOYMENT_NAME" --ignore-not-found >"$tmp/frpc-cleanup.out" 2>"$tmp/frpc-cleanup.err"
+    frpc_cleanup_deploy_rc=$?
+    kubectl -n "$UNIDESK_GITEA_NAMESPACE" delete secret "$UNIDESK_GITEA_FRPC_SECRET_NAME" --ignore-not-found >>"$tmp/frpc-cleanup.out" 2>>"$tmp/frpc-cleanup.err"
+    frpc_cleanup_secret_rc=$?
+    if [ "$frpc_cleanup_deploy_rc" -eq 0 ] && [ "$frpc_cleanup_secret_rc" -eq 0 ]; then
+      frpc_cleanup_rc=0
+    else
+      frpc_cleanup_rc=1
+    fi
+  else
+    frpc_cleanup_rc=0
+    : >"$tmp/frpc-cleanup.out"
+    if [ "$UNIDESK_GITEA_DRY_RUN" = "1" ]; then
+      printf '%s\n' "dry-run: frpc cleanup skipped" >"$tmp/frpc-cleanup.err"
+    elif [ "$UNIDESK_GITEA_FRPC_ENABLED" = "1" ]; then
+      printf '%s\n' "frpc enabled" >"$tmp/frpc-cleanup.err"
+    else
+      printf '%s\n' "frpc cleanup skipped" >"$tmp/frpc-cleanup.err"
+    fi
+  fi
   if [ "$apply_rc" -eq 0 ] && [ "$UNIDESK_GITEA_WEBHOOK_SYNC_ENABLED" = "1" ] && [ "$UNIDESK_GITEA_DRY_RUN" != "1" ]; then
     kubectl -n "$UNIDESK_GITEA_NAMESPACE" rollout restart "deployment/$UNIDESK_GITEA_WEBHOOK_DEPLOYMENT" >"$tmp/webhook-rollout.out" 2>"$tmp/webhook-rollout.err"
     webhook_rollout_rc=$?
@@ -127,9 +148,9 @@ run_apply() {
       printf '%s\n' "webhook sync disabled" >"$tmp/webhook-rollout.err"
     fi
   fi
-  python3 - "$frpc_rc" "$webhook_secret_rc" "$apply_rc" "$rollout_rc" "$frpc_rollout_rc" "$webhook_rollout_rc" "$tmp/frpc-secret.out" "$tmp/frpc-secret.err" "$tmp/webhook-secret.out" "$tmp/webhook-secret.err" "$tmp/apply.out" "$tmp/apply.err" "$tmp/rollout.out" "$tmp/rollout.err" "$tmp/frpc-rollout.out" "$tmp/frpc-rollout.err" "$tmp/webhook-rollout.out" "$tmp/webhook-rollout.err" <<'PY'
+  python3 - "$frpc_rc" "$webhook_secret_rc" "$apply_rc" "$rollout_rc" "$frpc_rollout_rc" "$webhook_rollout_rc" "$frpc_cleanup_rc" "$tmp/frpc-secret.out" "$tmp/frpc-secret.err" "$tmp/frpc-cleanup.out" "$tmp/frpc-cleanup.err" "$tmp/webhook-secret.out" "$tmp/webhook-secret.err" "$tmp/apply.out" "$tmp/apply.err" "$tmp/rollout.out" "$tmp/rollout.err" "$tmp/frpc-rollout.out" "$tmp/frpc-rollout.err" "$tmp/webhook-rollout.out" "$tmp/webhook-rollout.err" <<'PY'
 import json, os, sys
-frpc_rc, webhook_secret_rc, apply_rc, rollout_rc, frpc_rollout_rc, webhook_rollout_rc = [int(value) for value in sys.argv[1:7]]
+frpc_rc, webhook_secret_rc, apply_rc, rollout_rc, frpc_rollout_rc, webhook_rollout_rc, frpc_cleanup_rc = [int(value) for value in sys.argv[1:8]]
 def text(path, limit=3000):
     try:
         return open(path, encoding="utf-8", errors="replace").read()[-limit:]
@@ -137,7 +158,7 @@ def text(path, limit=3000):
         return ""
 dry = os.environ.get("UNIDESK_GITEA_DRY_RUN") == "1"
 payload = {
-    "ok": all(value == 0 for value in [frpc_rc, webhook_secret_rc, apply_rc, rollout_rc, frpc_rollout_rc, webhook_rollout_rc]),
+    "ok": all(value == 0 for value in [frpc_rc, webhook_secret_rc, apply_rc, rollout_rc, frpc_rollout_rc, webhook_rollout_rc, frpc_cleanup_rc]),
     "target": os.environ.get("UNIDESK_GITEA_TARGET_ID"),
     "route": os.environ.get("UNIDESK_GITEA_ROUTE"),
     "namespace": os.environ.get("UNIDESK_GITEA_NAMESPACE"),
@@ -150,12 +171,13 @@ payload = {
         "networkPolicy": "allow-all",
     },
     "steps": {
-        "frpcSecret": {"exitCode": frpc_rc, "stdoutTail": text(sys.argv[7]), "stderrTail": text(sys.argv[8])},
+        "frpcSecret": {"exitCode": frpc_rc, "stdoutTail": text(sys.argv[8]), "stderrTail": text(sys.argv[9])},
-        "webhookSyncSecret": {"exitCode": webhook_secret_rc, "stdoutTail": text(sys.argv[9]), "stderrTail": text(sys.argv[10])},
+        "frpcCleanup": {"exitCode": frpc_cleanup_rc, "stdoutTail": text(sys.argv[10]), "stderrTail": text(sys.argv[11])},
-        "apply": {"exitCode": apply_rc, "stdoutTail": text(sys.argv[11]), "stderrTail": text(sys.argv[12])},
+        "webhookSyncSecret": {"exitCode": webhook_secret_rc, "stdoutTail": text(sys.argv[12]), "stderrTail": text(sys.argv[13])},
-        "rollout": {"exitCode": rollout_rc, "stdoutTail": text(sys.argv[13]), "stderrTail": text(sys.argv[14])},
+        "apply": {"exitCode": apply_rc, "stdoutTail": text(sys.argv[14]), "stderrTail": text(sys.argv[15])},
-        "frpcRollout": {"exitCode": frpc_rollout_rc, "stdoutTail": text(sys.argv[15]), "stderrTail": text(sys.argv[16])},
+        "rollout": {"exitCode": rollout_rc, "stdoutTail": text(sys.argv[16]), "stderrTail": text(sys.argv[17])},
-        "webhookSyncRollout": {"exitCode": webhook_rollout_rc, "stdoutTail": text(sys.argv[17]), "stderrTail": text(sys.argv[18])},
+        "frpcRollout": {"exitCode": frpc_rollout_rc, "stdoutTail": text(sys.argv[18]), "stderrTail": text(sys.argv[19])},
+        "webhookSyncRollout": {"exitCode": webhook_rollout_rc, "stdoutTail": text(sys.argv[20]), "stderrTail": text(sys.argv[21])},
     },
     "valuesPrinted": False,
 }

scripts/src/platform-infra-gitea.ts

@@ -1336,6 +1336,8 @@ function remoteScript(action: "apply" | "status" | "validate" | "mirror-bootstra
     UNIDESK_GITEA_NO_PROXY: gitea.sourceAuthority.githubProxy.noProxy.join(","),
     UNIDESK_GITEA_FRPC_ENABLED: frpcExposure === null ? "0" : "1",
     UNIDESK_GITEA_FRPC_DEPLOYMENT_NAME: frpcExposure?.frpc.deploymentName ?? gitea.app.publicExposure.frpc.deploymentName,
+    UNIDESK_GITEA_FRPC_SECRET_NAME: frpcExposure?.frpc.secretName ?? gitea.app.publicExposure.frpc.secretName,
+    UNIDESK_GITEA_FRPC_SECRET_KEY: frpcExposure?.frpc.secretKey ?? gitea.app.publicExposure.frpc.secretKey,
     UNIDESK_GITEA_WEBHOOK_SYNC_ENABLED: gitea.sourceAuthority.webhookSync.enabled ? "1" : "0",
     UNIDESK_GITEA_WEBHOOK_PUBLIC_URL: githubWebhookPublicUrl(gitea, target),
     UNIDESK_GITEA_WEBHOOK_PATH: sync.publicPath,
@@ -2039,6 +2041,7 @@ function renderApply(result: Record<string, unknown>): RenderedCliResult {
   const remote = record(result.remote);
   const steps = record(remote.steps);
   const frpcStep = record(steps.frpcSecret);
+  const frpcCleanupStep = record(steps.frpcCleanup);
   const webhookSecretStep = record(steps.webhookSyncSecret);
   const applyStep = record(steps.apply);
   const rolloutStep = record(steps.rollout);
@@ -2052,6 +2055,7 @@ function renderApply(result: Record<string, unknown>): RenderedCliResult {
     "STEPS",
     ...table(["STEP", "EXIT", "DETAIL"], [
       ["frpc-secret", stringValue(frpcStep.exitCode), compactLine(stringValue(frpcStep.stderrTail, stringValue(frpcStep.stdoutTail)))],
+      ["frpc-cleanup", stringValue(frpcCleanupStep.exitCode), compactLine(stringValue(frpcCleanupStep.stderrTail, stringValue(frpcCleanupStep.stdoutTail)))],
       ["webhook-secret", stringValue(webhookSecretStep.exitCode), compactLine(stringValue(webhookSecretStep.stderrTail, stringValue(webhookSecretStep.stdoutTail)))],
       ["apply", stringValue(applyStep.exitCode), compactLine(stringValue(applyStep.stderrTail, stringValue(applyStep.stdoutTail)))],
       ["rollout", stringValue(rolloutStep.exitCode), compactLine(stringValue(rolloutStep.stderrTail, stringValue(rolloutStep.stdoutTail)))],