Running Forgejo on a Hetzner Kubernetes cluster

Sun, 25 Oct 2026 13:00:29 +0100

I host my own git. Since May 2026 that has been a single Forgejo pod on a Talos cluster at Hetzner, deployed from Nix with kubenix and the upstream forgejo-helm chart.

The first deploy was Forgejo 14.0.4 on chart 16.2.2, SQLite, and a 20Gi volume. Five months later it runs on Postgres, has been knocked over by crawlers three times. Most of what changed in the deployment came from those outages.

tl;dr ¶

The chart is vendored and pinned in charts.toml; kubenix renders it with chart2json, so the Helm values are a Nix attrset and nix build .#test asserts on the output.
No OAuth client secret is in git. A Job generates it into Vault, and VSO renders it back.
A runner that registers on every pod start from an emptyDir leaves three offline rows per rollout. I have 29 of them.
A crawler walking every ref of one repository in every archive format put 16.2G of tarballs on a 20Gi volume. Source archives are now off.
A crawler on blame, commit, commits and src pages took the Actions API down, and three release runs were recorded as failures while their steps passed. An Envoy Gateway rate limit of 60 a minute on those paths fixed it.
Hetzner volumes only grow. Going from 40Gi to 10Gi was a new claim, a tar pipe, and a sha256 over all 3638 files.

The chart is a directory ¶

The chart is vendored with helm-vendor, a small CLI of mine that keeps a registry in charts.toml and unpacks each chart into charts/. Forgejo publishes its chart only as an OCI artifact:

nixos-anywhere on Hetzner

Fri, 20 Feb 2026 00:55:22 +0100

tl;dr: ¶

I installed NixOS using nixos-anywhere for the first time.
Along the way I also finally tried (and succeeded) to use disko and deploy-rs.
Deploying from MacBook’s aarch64-darwin to the VM’s x86-64 required a few tweaks.

Tonight I wanted to try and run OpenClaw. I thought I would give it a persistent VM and that it should run NixOS, of course. I already run several NixOS VMs in the cloud, but their deployment was made with nixos-infect, which I promised myself I wouldn’t do again.

Hetzner on Simon Shine

Running Forgejo on a Hetzner Kubernetes cluster

tl;dr ¶

The chart is a directory ¶

nixos-anywhere on Hetzner

tl;dr: ¶