Forgejo on DevOps von UCLAB

Hugo Blog — Hardening the Pipeline

Wed, 04 Mar 2026 19:06:41 +0000

Securing the CI/CD Chain

In the previous post we built a full GitOps pipeline: push to Forgejo, build a Hugo image, ship it to k3s via Flux. It worked. But it was naive in a few ways — running nginx as root, no image scanning, no signing, and deploying by mutable tag.

This post covers the fixes. Three independent improvements, each worth doing on its own:

Unprivileged nginx — drop root from the container entirely
Trivy — scan the image for HIGH/CRITICAL CVEs before it ever touches the registry
Cosign — sign the image so the cluster can verify it came from CI

The full updated files are at the bottom. Here is the reasoning behind each change.

Forgejo on K3S

Sun, 01 Mar 2026 19:30:11 +0000

Forgejo is a lightweight, self-hosted Git service — a community fork of Gitea. In this post I’ll walk through how I deployed it on my home k3s cluster backed by a CloudNativePG (CNPG) PostgreSQL database, MinIO S3-compatible object storage for backups, and exposed it via Cilium’s Gateway API with automatic TLS through cert-manager.

Architecture Overview

The setup involves three main layers:

App layer — the Forgejo deployment, services, and ingress (Gateway + HTTPRoute)
Database layer — a CloudNativePG PostgreSQL cluster with WAL archiving to MinIO
Secrets layer — External Secrets Operator pulling credentials from Vault

Here’s the directory structure I’m using in my GitOps repo:

Hugo Blog — Full CI/CD GitOps

Sun, 01 Mar 2026 07:39:04 +0000

Forgejo → k3s with Flux

Overview

Stack: Hugo + Risotto theme (git submodule) → Forgejo Actions → Forgejo Container Registry → k3s → Flux

Flow:

git push 
→ Forgejo Actions builds Hugo image 
→ pushes to Forgejo registry
→ updates image tag in k8s manifest 
→ commits back to repo
→ Flux detects commit 
→ applies Deployment 
→ k3s rolls out new image

No Bitnami charts. No Flux image automation controllers. No runtime git cloning. Just a plain nginx Deployment running your pre-built static site.