Gitea
LiveGit server with repos, issues, pull requests and Actions. Sign in as abhishek.
Oracle Cloud · Mumbai · Ampere A1
A single always-on ARM box running a DevOps track end to end — own git server, own CI/CD, GitOps, monitoring, infrastructure as code and a secrets store. Everything on it is configured from one git repo, never by hand.
Git server with repos, issues, pull requests and Actions. Sign in as abhishek.
Served by nginx from /var/www/ridgeserve. Later services get their own subdomain.
Two pods in the demo namespace on NodePort 30080, fronted by nginx.
Watches the gitops repo and makes the cluster match it. Prune and self-heal are on.
29 dashboards over Prometheus metrics and Loki logs. Sign in as admin.
vault namespace · standalone
Real seal lifecycle, not dev mode. Needs unsealing by hand after any restart.
ridgeserve-runner · arm64 · 2 jobs
Labels ubuntu-latest and node-22. Builds run in containers on the host daemon.
127.0.0.1:5432 · db ecomersehub
Reached through a tunnel that reopens itself at Windows login. TLS is configured on the server, but the port stays closed.
devops/compose/hello
Four containers — nginx, python, postgres, redis — for poking at Compose.
~/.local/bin/oci
Authenticated with your own API key, so cloud resources can be managed straight from the box.
| Tool | Version | Notes |
|---|---|---|
| Go | 1.27.0 | The language most of this stack is written in |
| Node.js | 22.23.2 | npm 10.9 |
| Python | 3.12.3 | pip, venv, uv 0.12 |
| Java | 21.0.12 | OpenJDK |
| Docker | 29.7.2 | Compose v5.5.0, buildx |
| k3s | 1.36.3 | Single node, Traefik disabled |
| Helm | 3.21.4 | — |
| k9s | 0.51.0 | Terminal UI for the cluster |
| ArgoCD | stable | Auto sync, prune, self-heal |
| Prometheus | 7d retention | 13 targets scraped |
| Grafana | 29 dashboards | Prometheus + Loki datasources |
| Loki | single binary | 7 day log retention |
| OpenTofu | 1.12.6 | Manages real OCI resources |
| Ansible | 2.16.3 | Describes this server |
| Vault | standalone | kv-v2 at path lab/ |
| Trivy | 0.74.0 | Blocks HIGH/CRITICAL in CI |
| PostgreSQL | 16.15 | TLS on, localhost only |
| nginx | 1.24.0 | Holds port 80 and 443 |
| SQLite | 3.45.1 | — |
| Certbot | 2.9.0 | Renewal timer active |
oracle-big. Key based, no password.~/devops/compose./etc.Always Free allows 2 OCPU and 12 GB of Ampere. This box is 4 and 24, which counts as paid, so it is reclaimed around 22 October unless you either upgrade to Pay As You Go — where the same 4 and 24 is free — or shrink it to 2 and 12. Your card is never charged without you pressing upgrade.
An OCI Security List rule and an iptables rule. Miss either one and traffic just disappears. A Security List block times out; a host with nothing listening refuses instantly — that difference tells you which layer to fix.
Overriding ListenStream drops the IPv4 listener while ss still looks
healthy. That locked this box out for an hour and needed a boot-volume rescue.
They live in different image stores — Docker's and containerd's. A locally built tag
that works with docker run will fail to pull in a pod. The fix is a registry both
sides can reach, which is what Gitea's built-in one is for.
k3s was installed with Traefik disabled so nginx stays the front door and keeps the certificate. Cluster services are reached through NodePorts that nginx proxies to.
.env files and .pg-*.creds are ignored, so the repo alone cannot
rebuild the server. Phase 7 fixes that properly with Vault.