use gitea nightly rootless image

cluster/apps/default/gitea/helm-release.yaml

@@ -17,15 +17,15 @@ spec:
   values:
     image:
       repository: gitea/gitea
-      tag: 1.19.0
+      tag: latest-rootless
 
     podLabels:
       needsDatabase: "yes"
       needsAuthentik: "yes"
 
     env:
-      USER_UID: 1000
-      USER_GID: 1000
+      USER_UID: 10000
+      USER_GID: 10000
 
     envFrom:
       - secretRef:
@@ -82,3 +82,17 @@ spec:
         type: hostPath
         hostPath: /mnt/MainPool/Kubernetes/gitea
         mountPath: /data
+
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+      fsGroupChangePolicy: OnRootMismatch
+
+    resources:
+      requests:
+        cpu: 1m
+        memory: 340Mi
+      limits:
+        memory: 1Gi