9f819df4d9
Establish the design foundation for the heleosv2 multi-tenant hosting platform before any implementation code: - Monorepo skeleton: docs/, platform-infra/, site-templates/, deployments/, control-panel/ with orientation READMEs. - docs/: roadmap index, architecture + threat model, naming conventions, site profiles, provisioning workflow, backup & DR runbook, repo/GitOps layout, and the approved architecture plan. - docs/adr/: 9 ADRs recording the rationale for single-host Compose, Traefik edge, nginx+fpm split, shared MariaDB, ZFS-per-customer, decoupled backup streams, Forgejo, CLI-first, and SFTP-only. - Secrets hygiene: .gitignore (only *.enc.* committed) and .gitattributes (LF for scripts/Dockerfiles/YAML run on the Linux host). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
23 lines
1.1 KiB
Markdown
23 lines
1.1 KiB
Markdown
# ADR 0007 — Forgejo over GitLab
|
|
|
|
**Status:** Accepted
|
|
|
|
## Context
|
|
The platform needs Git hosting, a container registry, and CI. GitLab CE bundles
|
|
all of this plus scanning but wants 4 GB+ RAM just for itself — heavy on a
|
|
single shared host. Forgejo (community fork of Gitea) is lightweight and ships a
|
|
built-in package/container registry and GitHub-Actions-compatible CI.
|
|
|
|
## Decision
|
|
Use **Forgejo** for Git + built-in **container registry**, with **Forgejo
|
|
Actions** (or Woodpecker CI) for pipelines. Security scanning via **Trivy** and
|
|
secret scanning via **gitleaks** run inside CI. No Harbor, no GitLab, no Jenkins.
|
|
|
|
## Consequences
|
|
- ✅ Low RAM footprint leaves resources for customer sites.
|
|
- ✅ One tool covers repos + registry; scanning is added as CI steps.
|
|
- ✅ Actions are GitHub-compatible, so pipelines are portable and familiar.
|
|
- ❌ Less batteries-included than GitLab (no built-in RBAC-heavy registry,
|
|
vulnerability dashboards, etc.) — acceptable at this scale.
|
|
- ↔️ If serious registry RBAC/signing/scanning is later needed, adopt **Harbor**
|
|
as a superseding ADR rather than migrating to GitLab.
|