Git Ollama Tools

Git Ollama Tools

Purpose

A custom webhook service that runs Ollama-backed automation agents against Gitea pushes — secret scanning and changelog generation on every commit, plus lint / test-coverage / docstring agents gated by file type and language. Agents open PRs or issues back on the source repo.

Deployment

Item	Value
Image	gitea.prod.iot-proxmox.net/bjones/git_ollama_tools:latest (private registry)
Namespace	default
Replicas	1 — the app runs a single in-process background worker thread (JobQueue), so extra replicas wouldn’t parallelize agent runs and risk concurrent writes to the same audit log
Node pinning	nodeSelector: kubernetes.io/hostname: cm4-right
Service type	LoadBalancer (MetalLB, 192.168.1.39), port 8020
Storage	git-ollama-tools-data PVC, 1Gi, longhorn storage class

reloader.stakater.com/auto: "true" is set on the Deployment.

Configuration

Non-secret config (gitea.url, ollama.url/model, the repo allowlist, work-dir paths) comes from a mounted ConfigMap at /config/config.yaml. The Gitea bot token and webhook secret are injected as env vars (GITEA_BOT_TOKEN, WEBHOOK_SECRET) from a Secret — never stored in the ConfigMap.

Agents only touch repos explicitly listed in the ConfigMap’s allowlist. Updating the allowlist requires both re-applying the ConfigMap and a manual kubectl rollout restart — this Deployment has no Reloader annotation wired for the ConfigMap specifically, and the app only reads its config file once at startup.

Probes

No HTTP health endpoint exists (the app only exposes POST /webhook), so both liveness and readiness probes are plain TCP checks against port 8020 rather than an HTTP path.

Networking

Ollama backend: https://ollama.intel.iot-proxmox.net, model qwen2.5-coder:7b.

Exposed via a LoadBalancer Service (MetalLB pool first-pool, 192.168.1.30–192.168.1.40) rather than an Ingress — Gitea’s system webhook targets the MetalLB-assigned IP directly on port 8020.

Resources

	Requests	Limits
CPU	100m	1
Memory	256Mi	1Gi