feat: migrate to Gitea, productize Helm chart, unify version

- CI: replace GitLab pipeline with Gitea Actions (.gitea/workflows/release.yaml);
  publish .deb/image/hosted/chart to Gitea registries; gate image+hosted on .deb
  (needs + registry pre-check)
- drop connectone/Nexus; apt now from the Gitea Debian registry
- single version source (/VERSION=3.2.8); CI enforces .env/Chart consistency
- restructure: build/->packaging/deb, root Dockerfile->packaging/image,
  hosted/->packaging/hosted, .kube/->charts/freeradius
- Helm chart: documented values, DB password via Secret/$ENV, configurable
  scheduling/persistence; remove plaintext creds and hostPath PV
- gitignore *.env_cnf; docs for hosted (RU)/helm/root + agent KB sync

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packaging/hosted/install.sh

@@ -0,0 +1,95 @@
+#!/bin/bash
+
+set -e
+
+if [ "$EUID" -ne 0 ]; then
+  echo "Please run as root"
+  exit
+fi
+
+source .env
+source .env_cnf
+
+out_dir=/etc/freeradius
+
+echo "Installing packages..."
+apt-get update
+apt-get install -y apt-transport-https ca-certificates curl
+
+echo "Registering Gitea Debian registry..."
+DEB_REGISTRY="${DEB_REGISTRY:-https://git.ahax86.ru/api/packages/pub/debian}"
+DEB_DISTRIBUTION="${DEB_DISTRIBUTION:-noble}"
+DEB_COMPONENT="${DEB_COMPONENT:-main}"
+
+install -d /etc/apt/keyrings
+curl -fsSL "${DEB_REGISTRY}/repository.key" -o /etc/apt/keyrings/gitea-pub.asc
+
+apt_list=/etc/apt/sources.list.d/gitea-freeradius.list
+if [ -n "${DEB_AUTH:-}" ]; then
+  # Private registry: embed "user:token" in the source URL (file kept root-only).
+  apt_uri="${DEB_REGISTRY%%://*}://${DEB_AUTH}@${DEB_REGISTRY#*://}"
+  echo "deb [signed-by=/etc/apt/keyrings/gitea-pub.asc] ${apt_uri} ${DEB_DISTRIBUTION} ${DEB_COMPONENT}" >"$apt_list"
+  chmod 600 "$apt_list"
+else
+  echo "deb [signed-by=/etc/apt/keyrings/gitea-pub.asc] ${DEB_REGISTRY} ${DEB_DISTRIBUTION} ${DEB_COMPONENT}" >"$apt_list"
+fi
+
+echo "Installing freeradius ${FREERADIUS_TAG}..."
+apt-get update && apt-get install -y libfreeradius3=${FREERADIUS_TAG}+git freeradius-common=${FREERADIUS_TAG}+git \
+    freeradius-postgresql=${FREERADIUS_TAG}+git freeradius-rest=${FREERADIUS_TAG}+git \
+    freeradius-utils=${FREERADIUS_TAG}+git freeradius=${FREERADIUS_TAG}+git
+apt-mark hold libfreeradius3 freeradius-common freeradius-postgresql freeradius-rest freeradius-utils freeradius
+
+echo "Stopping service..."
+service freeradius stop
+
+echo "Chowning..."
+chown -R freerad:root /etc/freeradius
+
+## write configs
+sed -e "s/#MAIN_PORT#/${FR_MAIN_PORT}/" -e "s/#ACC_PORT#/${FR_ACC_PORT}/" config/sites-enabled/default >$out_dir/sites-enabled/default
+sed -e "s/#API_HOST#/${FR_API_HOST}/" -e "s/#API_PORT#/${FR_API_PORT}/" config/mods-enabled/rest >$out_dir/mods-enabled/rest
+sed -e "s/#PG_HOST#/${FR_PG_HOST}/" -e "s/#PG_PORT#/${FR_PG_PORT}/" -e "s/#PG_USER#/${FR_PG_USER}/" -e "s/#PG_PASS#/${FR_PG_PASS}/" -e "s/#PG_DB#/${FR_PG_DB}/" config/mods-enabled/sql >$out_dir/mods-enabled/sql
+
+## copy dict
+echo "Copy unmodified configs"
+cp config/radiusd.conf $out_dir/radiusd.conf
+cp config/dictionary $out_dir/dictionary
+cp config/clients.conf $out_dir/clients.conf
+cp config/mods-enabled/raw $out_dir/mods-enabled/raw
+cp config/sites-enabled/dynamic-clients $out_dir/sites-enabled/dynamic-clients
+rm -f /etc/freeradius/sites-enabled/inner-tunnel
+rm -f /etc/freeradius/mods-enabled/eap
+rm -f /etc/freeradius/mods-enabled/proxy_rate_limit
+
+## Enable delay_Reject
+echo "Enable delay_reject"
+rm -f /etc/freeradius/mods-enabled/delay
+ln -s $out_dir/mods-available/delay $out_dir/mods-enabled/delay
+
+## fix permissions
+echo "Fixing permissions..."
+chmod -R 750 $out_dir && chown -R freerad:root $out_dir
+
+## Update systemd service
+if [[ -d /run/systemd/system ]]; then
+  echo "Updating systemd service"
+  cp config/systemd/freeradius.service /lib/systemd/system/freeradius.service && chmod u+rw-x,go+r-wx /lib/systemd/system/freeradius.service && chown root: /lib/systemd/system/freeradius.service
+  systemctl daemon-reload
+
+  echo "Restarting server..."
+  service freeradius restart
+else
+  echo "Skipping systemd modify..."
+fi
+
+## add crontab
+if ! grep -q radius-renew.sh "/etc/crontab"; then
+  echo "Add crontab renew"
+  cp cron/radius-renew.sh /opt && chmod a+x /opt/radius-renew.sh && chown root: /opt/radius-renew.sh
+  echo "0 1 1 */1 * root bash /opt/radius-renew.sh" >> /etc/crontab
+else
+  echo "Crontab already set"
+fi
+
+echo "Freeradius installed!"