diff --git a/apps.yaml b/apps.yaml
index 61e2342f51..d0604ab1b0 100644
--- a/apps.yaml
+++ b/apps.yaml
@@ -55,7 +55,7 @@ appsInfo:
     integration: ExternalDNS is used by App Platform to make public service domains accessible by registering them with App Platform's load balancer CNAME or IP address. When ExternalDNS is not enabled (default), then App Platform will rely on nip.io to create host names for all services.
   gitea:
     title: Gitea Self-hosted GIT
-    appVersion: 1.26.2
+    appVersion: 1.27.0
     repo: https://github.com/go-gitea/gitea
     maintainers: Gitea
     relatedLinks:
diff --git a/chart/chart-index/Chart.yaml b/chart/chart-index/Chart.yaml
index 4210fb2d2f..6e1778540c 100644
--- a/chart/chart-index/Chart.yaml
+++ b/chart/chart-index/Chart.yaml
@@ -35,7 +35,7 @@ dependencies:
     version: 2.7.0
     repository: https://charts.external-secrets.io
   - name: gitea
-    version: 12.6.0
+    version: 12.7.0
     repository: https://dl.gitea.io/charts
   - name: harbor
     version: 1.19.1
diff --git a/charts/gitea/.github/copilot-instructions.md b/charts/gitea/.github/copilot-instructions.md
new file mode 100644
index 0000000000..1b92c8c421
--- /dev/null
+++ b/charts/gitea/.github/copilot-instructions.md
@@ -0,0 +1,62 @@
+# Gitea Helm Chart — Copilot Instructions
+
+## Project Overview
+
+Kubernetes Helm chart for deploying [Gitea](https://gitea.com). Uses Go/Helm templating (`templates/`), YAML values (`values.yaml`), and includes sub-charts for PostgreSQL, PostgreSQL-HA, Valkey, and Valkey-cluster.
+
+## Build & Test
+
+```bash
+make readme            # Regenerate README.md parameter table + lint
+make unittests-helm    # Run Helm unit tests (helm-unittest plugin required)
+make unittests-bash    # Run bash/bats script tests (requires git submodule init)
+make unittests         # Both of the above
+```
+
+Always run `make readme` after changing `values.yaml` `@param` annotations.
+Always run `make unittests-helm` after changing templates or unit tests.
+
+## Conventions
+
+### values.yaml
+
+- Use `## @param path.to.key Description` annotations for every user-facing value. These drive the auto-generated README parameter table.
+- Property ordering within a resource block: `enabled`, `annotations`, `labels` first, then type-specific fields.
+- Top-level keys are sorted alphabetically within their section group.
+- Use [Helm Values](https://docs.renovatebot.com/modules/manager/helm-values/#additional-information) pattern from renovatebot. Ensure that the attributes `registry`, `repository` and `tag` are available as part of the dict `image`. For example:
+
+```yaml
+image:
+  registry: docker.io
+  repository: library/busybox
+  tag: 0.1.0
+```
+
+### Templates
+
+- Helm templates live in `templates/gitea/`. Helpers live in `templates/_helpers.tpl`.
+- Use camelCase for all files and variables (e.g `httpRoute`, `backendTLSPolicy`, `gatewayAPI`, `statefulSet`).
+- Use `include "gitea.fullname"` for naming resources.
+- Use `fail` for required-value validation with clear error messages referencing the full values path.
+- Ensure, that the attributes `annotations`, `labels`, `name` and `namespace` are alphabetically sorted.
+- Render all attributes, even if they are empty, to prevent drift in Argo CD. For example, `labels` must be rendered, while `annotations` are defined as `yaml:"annotations,omitempty"`.
+- Use plural for `*.tpl` files, because they may contain functions for multiple resources of the same kind (e.g. `_services.tpl` for `httpService.yaml` or `sshService.yaml`, `_backendTLSPolicies.tpl` for `backendTLSPolicy.yaml`).
+
+### Unit Tests
+
+- Helm unit tests live in `unittests/helm/` mirroring the template structure.
+- Test files are YAML using the [helm-unittest](https://github.com/helm-unittest/helm-unittest) format.
+- Each test must set all required values explicitly — do not rely on cross-test state.
+- The `values.yaml` file must pass `yamllint`. The configuration is in `.yamllint`. Use `make yamllint` to run the linter.
+
+### Commits & PRs
+
+- Follow [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) for PR titles and commit messages (e.g. `feat:`, `fix:`, `refactor:`, `docs:`, `style:`).
+- See `CONTRIBUTING.md` for full PR requirements.
+- Explain in detail why a change is needed, not just what the change is. Include links to relevant issues, PRs, or external references.
+- Add co-authors for any contributions that are not your own. Use the `Co-authored-by:` trailer in the commit message.
+
+### Documentation
+
+- `docs/` contains topic-specific guides (e.g. `gateway-api.md`, `ha-setup.md`).
+- `README.md` parameter tables are auto-generated — never edit them manually.
diff --git a/charts/gitea/Chart.yaml b/charts/gitea/Chart.yaml
index 4065601341..f29f279b14 100644
--- a/charts/gitea/Chart.yaml
+++ b/charts/gitea/Chart.yaml
@@ -1,22 +1,32 @@
 annotations:
   artifacthub.io/changes: |
+    - kind: added
+      description: add Gateway API support (#1073)
     - kind: changed
-      description: update lockfiles (#1079)
+      description: update alpine/helm docker tag to v3.21.3 (#1096)
     - kind: changed
-      description: upgrade to 1.26 and replace environment_to_ini_call with gitea config edit-ini (#1070)
+      description: update to 1.27.0 (#1095)
     - kind: changed
-      description: update lockfiles (#1075)
+      description: update workflow dependencies (minor & patch) (#1094)
     - kind: changed
-      description: update commitlint/commitlint docker tag to v20.5.3 (#1074)
+      description: update gitea version to 1.26.4 (#1093)
     - kind: changed
-      description: update workflow dependencies (minor & patch) (#1072)
+      description: update workflow dependencies (minor & patch) (#1092)
     - kind: changed
-      description: update dependency go-gitea/gitea to v1.26.1 (#1071)
+      description: update dependency helm-unittest/helm-unittest to v1.1.1 (#1090)
+    - kind: changed
+      description: update lockfiles (#1087)
+    - kind: changed
+      description: update dependency go-gitea/gitea to v1.26.2 (#1084)
+    - kind: changed
+      description: update lockfiles (#1082)
+    - kind: changed
+      description: update workflow dependencies (minor & patch) (#1080)
   artifacthub.io/links: |
     - name: support
       url: https://gitea.com/gitea/helm-gitea/issues
 apiVersion: v2
-appVersion: 1.26.2
+appVersion: 1.27.0
 dependencies:
 - condition: postgresql.enabled
   name: postgresql
@@ -56,4 +66,4 @@ sources:
 - https://github.com/go-gitea/gitea
 - https://docker.gitea.com/gitea
 type: application
-version: 12.6.0
+version: 12.7.0
diff --git a/charts/gitea/README.md b/charts/gitea/README.md
index 7bce676e48..afa4adfc70 100644
--- a/charts/gitea/README.md
+++ b/charts/gitea/README.md
@@ -43,6 +43,8 @@
   - [Security](#security)
   - [Service](#service)
   - [Ingress](#ingress)
+  - [Route](#route)
+  - [Gateway API](#gateway-api)
   - [deployment](#deployment)
   - [ServiceAccount](#serviceaccount)
   - [Persistence](#persistence-1)
@@ -311,6 +313,11 @@ route:
 
 When `route.host` is set, the chart uses it for `DOMAIN`, `SSH_DOMAIN`, and `ROOT_URL`. Setting `route.tls.termination` also switches the default `ROOT_URL` scheme to `https`.
 
+#### Gateway API
+
+The chart can also expose Gitea through Gateway API resources (`HTTPRoute`, `TCPRoute`, `BackendTLSPolicy`, and optionally `Gateway`).
+See [docs/gateway-api.md](docs/gateway-api.md) for the full guide, including how routes interact with `ROOT_URL`/`DOMAIN` resolution and recommended topologies.
+
 #### Session, Cache and Queue
 
 The session, cache and queue settings are set to use the built-in Valkey Cluster sub-chart dependency.
@@ -1075,6 +1082,36 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 | `route.tls.caCertificate`                 | Route TLS CA certificate                                                                                       | `nil`   |
 | `route.tls.destinationCACertificate`      | Route destination CA certificate                                                                               | `nil`   |
 
+### Gateway API
+
+| Name                                                            | Description                                                                                                                                                                | Value   |
+| --------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
+| `gatewayAPI.enabled`                                            | Enable deployment of Gateway API resources                                                                                                                                 | `false` |
+| `gatewayAPI.core.backendTLSPolicy.enabled`                      | Render a BackendTLSPolicy resource for encrypted backend traffic                                                                                                           | `false` |
+| `gatewayAPI.core.backendTLSPolicy.annotations`                  | Annotations applied to the BackendTLSPolicy                                                                                                                                | `{}`    |
+| `gatewayAPI.core.backendTLSPolicy.labels`                       | Additional labels applied to the BackendTLSPolicy                                                                                                                          | `{}`    |
+| `gatewayAPI.core.backendTLSPolicy.targetRefs`                   | Target references for the BackendTLSPolicy. Defaults to the HTTP service.                                                                                                  | `[]`    |
+| `gatewayAPI.core.backendTLSPolicy.validation`                   | Validation configuration (required when enabled). See `docs/gateway-api.md`.                                                                                               | `{}`    |
+| `gatewayAPI.core.backendTLSPolicy.validation.caCertificateRefs` | CA certificate references for the BackendTLSPolicy validation. See `docs/gateway-api.md`.                                                                                  |         |
+| `gatewayAPI.core.backendTLSPolicy.validation.hostname`          | Hostname for the BackendTLSPolicy validation. Must be the Common Name (CN) or a Subject Alternative Name (SAN) of the Gitea server certificate. See `docs/gateway-api.md`. |         |
+| `gatewayAPI.core.httpRoute.enabled`                             | Render an HTTPRoute resource                                                                                                                                               | `false` |
+| `gatewayAPI.core.httpRoute.annotations`                         | Annotations applied to the HTTPRoute                                                                                                                                       | `{}`    |
+| `gatewayAPI.core.httpRoute.labels`                              | Additional labels applied to the HTTPRoute                                                                                                                                 | `{}`    |
+| `gatewayAPI.core.httpRoute.tls`                                 | When true, treat the upstream Gateway as terminating TLS so `ROOT_URL` uses `https`.                                                                                       | `false` |
+| `gatewayAPI.core.httpRoute.parentRefs`                          | Parent gateway references (required when enabled).                                                                                                                         | `[]`    |
+| `gatewayAPI.core.httpRoute.hostnames`                           | List of hostnames for the HTTPRoute.                                                                                                                                       | `[]`    |
+| `gatewayAPI.core.httpRoute.rules`                               | Custom routing rules. Defaults to a PathPrefix `/` rule targeting the HTTP service.                                                                                        | `[]`    |
+| `gatewayAPI.core.tcpRoute.enabled`                              | Render a TCPRoute resource (typically for SSH)                                                                                                                             | `false` |
+| `gatewayAPI.core.tcpRoute.annotations`                          | Annotations applied to the TCPRoute                                                                                                                                        | `{}`    |
+| `gatewayAPI.core.tcpRoute.labels`                               | Additional labels applied to the TCPRoute                                                                                                                                  | `{}`    |
+| `gatewayAPI.core.tcpRoute.parentRefs`                           | Parent gateway references (required when enabled).                                                                                                                         | `[]`    |
+| `gatewayAPI.core.tcpRoute.rules`                                | Custom routing rules. Defaults to a rule targeting the SSH service.                                                                                                        | `[]`    |
+| `gatewayAPI.nginx.clientSettingsPolicies.enabled`               | Render a ClientSettingsPolicy (NGINX Gateway Fabric) to raise the client request body limit                                                                                | `false` |
+| `gatewayAPI.nginx.clientSettingsPolicies.annotations`           | Annotations applied to the ClientSettingsPolicy                                                                                                                            | `{}`    |
+| `gatewayAPI.nginx.clientSettingsPolicies.labels`                | Additional labels applied to the ClientSettingsPolicy                                                                                                                      | `{}`    |
+| `gatewayAPI.nginx.clientSettingsPolicies.targetRef`             | Target reference for the ClientSettingsPolicy. Defaults to the chart's HTTPRoute.                                                                                          | `{}`    |
+| `gatewayAPI.nginx.clientSettingsPolicies.body`                  | Client body settings (required when enabled), e.g. `maxSize`. See `docs/gateway-api.md`.                                                                                   | `{}`    |
+
 ### deployment
 
 | Name                                       | Description                                            | Value |
diff --git a/charts/gitea/docs/gateway-api.md b/charts/gitea/docs/gateway-api.md
new file mode 100644
index 0000000000..0f3f806052
--- /dev/null
+++ b/charts/gitea/docs/gateway-api.md
@@ -0,0 +1,267 @@
+# Gateway API
+
+This chart can expose Gitea through [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/) resources
+alongside (or instead of) the existing `Ingress` and OpenShift `Route` support. The following resources
+are rendered:
+
+- `HTTPRoute` — required for HTTP traffic
+- `TCPRoute` — optional, typically for SSH (port 22)
+- `BackendTLSPolicy` — optional, for encrypted backend traffic
+- `ClientSettingsPolicy` — optional, **NGINX Gateway Fabric only**, to raise the client request body size limit
+
+All resources are disabled by default. Enabling them requires Gateway API CRDs (and an implementation that supports them) to already be installed in the cluster.
+
+The chart does **not** render a `Gateway` resource — provisioning and managing the Gateway is the responsibility of the cluster / platform administrator.
+
+## Prerequisites
+
+| Resource               | API version                          | Status (as of writing) |
+| ---------------------- | ------------------------------------ | ---------------------- |
+| `HTTPRoute`            | `gateway.networking.k8s.io/v1`       | GA                     |
+| `TCPRoute`             | `gateway.networking.k8s.io/v1alpha2` | Experimental           |
+| `BackendTLSPolicy`     | `gateway.networking.k8s.io/v1`       | GA (v1.2+)             |
+| `ClientSettingsPolicy` | `gateway.nginx.org/v1alpha1`         | NGINX Gateway Fabric   |
+
+## Common topology
+
+Most users should attach to a pre-existing, shared `Gateway` managed by the cluster administrator:
+
+```yaml
+gatewayAPI:
+  core:
+    httpRoute:
+      enabled: true
+      tls: true            # the shared Gateway terminates TLS
+      hostnames:
+        - git.example.com
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: shared-gateway
+          namespace: gateway-system
+          sectionName: https-gitea   # pin to a specific listener (see below)
+    tcpRoute:
+      enabled: true
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: shared-gateway
+          namespace: gateway-system
+          sectionName: ssh
+```
+
+With this configuration:
+
+- `ROOT_URL`, `DOMAIN`, and `SSH_DOMAIN` resolve to the first HTTPRoute hostname.
+- Setting `gatewayAPI.core.httpRoute.tls: true` switches `ROOT_URL` to `https://`.
+- The default HTTPRoute rule forwards `/` to the Gitea HTTP `Service`. The default TCPRoute rule forwards to the SSH `Service`.
+- Custom `rules` and `hostnames` are rendered through `tpl`, so Helm template expressions work inside them.
+
+### Why `sectionName` matters
+
+Omitting `sectionName` attaches the route to **every** matching listener on the Gateway. On implementations
+that use per-host HTTPS listeners (Envoy Gateway, Cilium Gateway), that means Gitea's HTTPRoute will try
+to bind to every HTTPS listener — usually not what you want. Always pin to a named listener
+(e.g. `https-gitea`, `ssh`) when the Gateway has more than one. The corresponding listener on the Gateway
+side typically looks like:
+
+```yaml
+listeners:
+  - name: https-gitea
+    port: 443
+    protocol: HTTPS
+    hostname: git.example.com
+    tls:
+      certificateRefs:
+        - name: git-example-com-tls
+    allowedRoutes:
+      kinds:
+        - kind: HTTPRoute
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: gitea
+  - name: ssh
+    port: 22
+    protocol: TCP
+    allowedRoutes:
+      kinds:
+        - kind: TCPRoute
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: gitea
+```
+
+### Sharing a hostname between HTTP and SSH
+
+HTTP (443) and SSH (22) are different ports, so a single hostname like `git.example.com` can serve both —
+clients disambiguate by port. This is the recommended pattern: one DNS record, `ssh git@git.example.com`
+and `https://git.example.com` both work, and `SSH_DOMAIN` / `DOMAIN` resolve to the same value with no
+extra configuration.
+
+If you want SSH on a **different** hostname (e.g. `gitea-ssh.example.com`), set it explicitly — the chart
+cannot infer it from TCPRoute config because TCPRoutes don't carry hostnames:
+
+```yaml
+gitea:
+  config:
+    server:
+      SSH_DOMAIN: gitea-ssh.example.com
+```
+
+## BackendTLSPolicy
+
+Use this when the Gitea HTTP backend is terminating TLS itself (for example, when running Gitea with
+`PROTOCOL=https`, or when fronting another HTTPS service from the same chart) and the Gateway needs to
+verify the backend certificate before forwarding the request.
+
+### Configuring Gitea to serve HTTPS directly
+
+Gitea serves HTTPS via three `[server]` app.ini options
+([cheat sheet](https://docs.gitea.com/administration/config-cheat-sheet#server-server)). Mount the
+cert/key with `extraVolumes` + `extraContainerVolumeMounts` and point Gitea at them with absolute paths:
+
+```yaml
+gitea:
+  config:
+    server:
+      PROTOCOL: https
+      CERT_FILE: /etc/gitea-tls/tls.crt
+      KEY_FILE: /etc/gitea-tls/tls.key
+
+extraVolumes:
+  - name: gitea-tls
+    secret:
+      secretName: gitea-backend-tls   # cert-manager-issued Secret, etc.
+extraContainerVolumeMounts:
+  - name: gitea-tls
+    mountPath: /etc/gitea-tls
+    readOnly: true
+```
+
+- Relative `CERT_FILE`/`KEY_FILE` values resolve against Gitea's `CustomPath` (`/data/gitea` in the
+  official image); absolute paths are clearer.
+- Both options are ignored when `gitea.config.server.ENABLE_ACME` is `true`.
+- For chained certs, the server cert comes first, intermediates after.
+- The Service still forwards raw TCP — no `service.http.*` changes needed. The pod's container port
+  (3000 by default) is now speaking HTTPS instead of HTTP.
+
+### BackendTLSPolicy example
+
+Verify the backend with a CA bundle stored in a `ConfigMap`:
+
+```yaml
+gatewayAPI:
+  core:
+    backendTLSPolicy:
+      enabled: true
+      validation:
+        hostname: gitea.svc.cluster.local
+        caCertificateRefs:
+          - name: gitea-backend-ca
+            group: ""
+            kind: ConfigMap
+```
+
+This renders a single `BackendTLSPolicy` whose `targetRefs` defaults to the chart's HTTP `Service`
+(`<fullname>-http`), and whose `validation` is passed through verbatim. `validation` is required by the
+API; the template fails fast if omitted.
+
+### System CA trust and explicit targetRefs
+
+To trust the system CA store (Gateway API v1.1+) or target a different Service, use `wellKnownCACertificates`
+and `targetRefs`:
+
+```yaml
+gatewayAPI:
+  core:
+    backendTLSPolicy:
+      enabled: true
+      targetRefs:
+        - group: ""
+          kind: Service
+          name: gitea-sidecar
+      validation:
+        hostname: sidecar.gitea.svc.cluster.local
+        wellKnownCACertificates: System
+```
+
+Notes:
+
+- `targetRefs[].kind` is almost always `Service`; `group: ""` is the core API group.
+- `wellKnownCACertificates: System` requires Gateway API v1.1 and an implementation that supports it
+  (otherwise stick with `caCertificateRefs`).
+- The corresponding HTTPRoute must reference the backend by the same `Service` (and, if used,
+  `sectionName`/`port`) — `BackendTLSPolicy` attaches to the Service-side reference, not to the route.
+
+## Raising the request body size limit (NGINX Gateway Fabric)
+
+NGINX defaults `client_max_body_size` to `1m`. Requests exceeding it are rejected with `413 Request
+Entity Too Large`. This blocks uploading larger artifacts to Gitea's package/container registry (container
+images, DEB/RPM packages, etc.). With the NGINX **Ingress** controller you raised this via the
+`nginx.ingress.kubernetes.io/proxy-body-size` annotation — that annotation does **not** apply to Gateway
+API. NGINX Gateway Fabric instead reads the limit from a
+[`ClientSettingsPolicy`](https://docs.nginx.com/nginx-gateway-fabric/reference/api/) (`spec.body.maxSize`).
+
+This is specific to **NGINX Gateway Fabric**. Other implementations (Envoy Gateway, Cilium, Istio, …) do
+**not** impose a default request body size limit, so large uploads work without any extra configuration —
+leave `gatewayAPI.nginx.clientSettingsPolicies` disabled.
+
+```yaml
+gatewayAPI:
+  enabled: true
+  nginx:
+    clientSettingsPolicies:
+      enabled: true
+      body:
+        maxSize: 100m   # bytes, or with a k / m / g suffix; 0 disables the limit
+```
+
+This renders a single `ClientSettingsPolicy` whose `targetRef` defaults to the chart's `HTTPRoute`
+(`<fullname>`), so the limit applies to all traffic routed to Gitea. `body` is required when enabled; the
+template fails fast if omitted. `spec.body` is passed through verbatim, so other fields (e.g. `timeout`)
+are supported too.
+
+To attach the policy elsewhere — for example the whole `Gateway` so the limit is inherited by every route —
+override `targetRef`:
+
+```yaml
+gatewayAPI:
+  nginx:
+    clientSettingsPolicies:
+      enabled: true
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: shared-gateway
+      body:
+        maxSize: 100m
+```
+
+Notes:
+
+- `ClientSettingsPolicy` is an inherited policy: attaching it to a `Gateway` cascades to its routes, while
+  attaching it to an `HTTPRoute` scopes it to that route only.
+- The policy must live in the same namespace as its `targetRef`.
+- Gitea also enforces its own upload limits independently (`gitea.config` `[repository.upload]` and
+  `[packages]` sections) — raising the proxy limit alone is not always sufficient.
+
+## Interaction with `ingress` and `route`
+
+The three exposure mechanisms are independent and can coexist, but `ROOT_URL` / `DOMAIN` / `SSH_DOMAIN` resolution uses the first defined source in this order:
+
+1. `route.host` (when `route.enabled`)
+2. `httpRoute.hostnames[0]` (when `gatewayAPI.core.httpRoute.enabled`)
+3. First `ingress.hosts[0].host`
+4. The in-cluster Service DNS name
+
+Likewise, `ROOT_URL` becomes `https://` if any of these terminate TLS: `route.tls.termination`, `ingress.tls`, or `gatewayAPI.core.httpRoute.tls`.
+
+## SSH considerations
+
+- `TCPRoute` is still experimental. Many production-grade implementations support it (Envoy Gateway, Istio, Kgateway, NGINX Gateway Fabric), but you should verify before relying on it.
+- If your Gateway implementation does not support `TCPRoute`, keep using `service.ssh.type: LoadBalancer` (or `NodePort`) and only enable `httpRoute` for HTTP traffic.
+- The default TCPRoute rule points at the Gitea SSH `Service` on `service.ssh.port` (typically 22), which itself proxies to `gitea.config.server.SSH_LISTEN_PORT` inside the pod.
diff --git a/charts/gitea/templates/_helpers.tpl b/charts/gitea/templates/_helpers.tpl
index 07ca70d400..f2cb3c28ab 100644
--- a/charts/gitea/templates/_helpers.tpl
+++ b/charts/gitea/templates/_helpers.tpl
@@ -247,6 +247,8 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- define "gitea.public_hostname" -}}
 {{- if and .Values.route.enabled .Values.route.host -}}
 {{ tpl .Values.route.host . }}
+{{- else if and .Values.gatewayAPI.enabled .Values.gatewayAPI.core.httpRoute.enabled (gt (len .Values.gatewayAPI.core.httpRoute.hostnames) 0) -}}
+{{ tpl (index .Values.gatewayAPI.core.httpRoute.hostnames 0) $ }}
 {{- else if gt (len .Values.ingress.hosts) 0 -}}
 {{ tpl (index .Values.ingress.hosts 0).host $ }}
 {{- else -}}
@@ -308,6 +310,8 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 https
 {{- else if and .Values.ingress.enabled (gt (len .Values.ingress.tls) 0) -}}
 https
+{{- else if and .Values.gatewayAPI.enabled .Values.gatewayAPI.core.httpRoute.enabled .Values.gatewayAPI.core.httpRoute.tls -}}
+https
 {{- else -}}
 {{ .Values.gitea.config.server.PROTOCOL }}
 {{- end -}}
diff --git a/charts/gitea/templates/gitea/_backendTLSPolicies.tpl b/charts/gitea/templates/gitea/_backendTLSPolicies.tpl
new file mode 100644
index 0000000000..a6d8c3b960
--- /dev/null
+++ b/charts/gitea/templates/gitea/_backendTLSPolicies.tpl
@@ -0,0 +1,30 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "gitea.backendTLSPolicy.annotations" -}}
+{{- with .Values.gatewayAPI.core.backendTLSPolicy.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{/* enabled */}}
+
+{{- define "gitea.backendTLSPolicy.enabled" -}}
+{{- if and .Values.gatewayAPI.enabled
+          .Values.gatewayAPI.core.backendTLSPolicy.enabled
+-}}
+true
+{{- else -}}
+false
+{{- end -}}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "gitea.backendTLSPolicy.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.gatewayAPI.core.backendTLSPolicy.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
diff --git a/charts/gitea/templates/gitea/_clientSettingsPolicies.tpl b/charts/gitea/templates/gitea/_clientSettingsPolicies.tpl
new file mode 100644
index 0000000000..3c00ad514e
--- /dev/null
+++ b/charts/gitea/templates/gitea/_clientSettingsPolicies.tpl
@@ -0,0 +1,30 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "gitea.clientSettingsPolicies.annotations" -}}
+{{- with .Values.gatewayAPI.nginx.clientSettingsPolicies.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{/* enabled */}}
+
+{{- define "gitea.clientSettingsPolicies.enabled" -}}
+{{- if and .Values.gatewayAPI.enabled
+          .Values.gatewayAPI.nginx.clientSettingsPolicies.enabled
+-}}
+true
+{{- else -}}
+false
+{{- end -}}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "gitea.clientSettingsPolicies.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.gatewayAPI.nginx.clientSettingsPolicies.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
diff --git a/charts/gitea/templates/gitea/_httpRoutes.tpl b/charts/gitea/templates/gitea/_httpRoutes.tpl
new file mode 100644
index 0000000000..d27cb28813
--- /dev/null
+++ b/charts/gitea/templates/gitea/_httpRoutes.tpl
@@ -0,0 +1,30 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "gitea.httpRoute.annotations" -}}
+{{- with .Values.gatewayAPI.core.httpRoute.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{/* enabled */}}
+
+{{- define "gitea.httpRoute.enabled" -}}
+{{- if and .Values.gatewayAPI.enabled
+          .Values.gatewayAPI.core.httpRoute.enabled
+-}}
+true
+{{- else -}}
+false
+{{- end -}}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "gitea.httpRoute.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.gatewayAPI.core.httpRoute.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
diff --git a/charts/gitea/templates/gitea/_services.tpl b/charts/gitea/templates/gitea/_services.tpl
new file mode 100644
index 0000000000..69ecf5cdd0
--- /dev/null
+++ b/charts/gitea/templates/gitea/_services.tpl
@@ -0,0 +1,11 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* names */}}
+
+{{- define "gitea.service.http.name" -}}
+{{ include "gitea.fullname" . }}-http
+{{- end }}
+
+{{- define "gitea.service.ssh.name" -}}
+{{ include "gitea.fullname" . }}-ssh
+{{- end }}
diff --git a/charts/gitea/templates/gitea/_tcpRoutes.tpl b/charts/gitea/templates/gitea/_tcpRoutes.tpl
new file mode 100644
index 0000000000..92a2356fa0
--- /dev/null
+++ b/charts/gitea/templates/gitea/_tcpRoutes.tpl
@@ -0,0 +1,30 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "gitea.tcpRoute.annotations" -}}
+{{- with .Values.gatewayAPI.core.tcpRoute.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{/* enabled */}}
+
+{{- define "gitea.tcpRoute.enabled" -}}
+{{- if and .Values.gatewayAPI.enabled
+           .Values.gatewayAPI.core.tcpRoute.enabled
+-}}
+true
+{{- else -}}
+false
+{{- end -}}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "gitea.tcpRoute.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.gatewayAPI.core.tcpRoute.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
diff --git a/charts/gitea/templates/gitea/backendTLSPolicy.yaml b/charts/gitea/templates/gitea/backendTLSPolicy.yaml
new file mode 100644
index 0000000000..fef760eec9
--- /dev/null
+++ b/charts/gitea/templates/gitea/backendTLSPolicy.yaml
@@ -0,0 +1,30 @@
+{{- if eq (include "gitea.backendTLSPolicy.enabled" .) "true" -}}
+{{- if not (keys .Values.gatewayAPI.core.backendTLSPolicy.validation) }}
+{{- fail "gatewayAPI.core.backendTLSPolicy.validation is required" }}
+{{- end }}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: BackendTLSPolicy
+metadata:
+  {{- with (include "gitea.backendTLSPolicy.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with (include "gitea.backendTLSPolicy.labels" .) }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
+  name: {{ include "gitea.fullname" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+spec:
+  targetRefs:
+    {{- if .Values.gatewayAPI.core.backendTLSPolicy.targetRefs }}
+    {{- toYaml .Values.gatewayAPI.core.backendTLSPolicy.targetRefs | nindent 4 }}
+    {{- else }}
+    - group: ""
+      kind: Service
+      name: {{ include "gitea.service.http.name" . }}
+    {{- end }}
+  validation:
+    {{- toYaml .Values.gatewayAPI.core.backendTLSPolicy.validation | nindent 4 }}
+{{- end }}
diff --git a/charts/gitea/templates/gitea/clientSettingsPolicy.yaml b/charts/gitea/templates/gitea/clientSettingsPolicy.yaml
new file mode 100644
index 0000000000..00685d5169
--- /dev/null
+++ b/charts/gitea/templates/gitea/clientSettingsPolicy.yaml
@@ -0,0 +1,30 @@
+{{- if eq (include "gitea.clientSettingsPolicies.enabled" .) "true" -}}
+{{- if not (keys .Values.gatewayAPI.nginx.clientSettingsPolicies.body) }}
+{{- fail "gatewayAPI.nginx.clientSettingsPolicies.body is required" }}
+{{- end }}
+---
+apiVersion: gateway.nginx.org/v1alpha1
+kind: ClientSettingsPolicy
+metadata:
+  {{- with (include "gitea.clientSettingsPolicies.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with (include "gitea.clientSettingsPolicies.labels" .) }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
+  name: {{ include "gitea.fullname" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+spec:
+  targetRef:
+    {{- if .Values.gatewayAPI.nginx.clientSettingsPolicies.targetRef }}
+    {{- toYaml .Values.gatewayAPI.nginx.clientSettingsPolicies.targetRef | nindent 4 }}
+    {{- else }}
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: {{ include "gitea.fullname" . }}
+    {{- end }}
+  body:
+    {{- toYaml .Values.gatewayAPI.nginx.clientSettingsPolicies.body | nindent 4 }}
+{{- end }}
diff --git a/charts/gitea/templates/gitea/httpRoute.yaml b/charts/gitea/templates/gitea/httpRoute.yaml
new file mode 100644
index 0000000000..017cff9eac
--- /dev/null
+++ b/charts/gitea/templates/gitea/httpRoute.yaml
@@ -0,0 +1,42 @@
+{{- if eq (include "gitea.httpRoute.enabled" .) "true" -}}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  {{- with (include "gitea.httpRoute.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with (include "gitea.httpRoute.labels" .) }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
+  name: {{ include "gitea.fullname" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+spec:
+  parentRefs:
+    {{- if .Values.gatewayAPI.core.httpRoute.parentRefs }}
+    {{- toYaml .Values.gatewayAPI.core.httpRoute.parentRefs | nindent 4 }}
+    {{- else }}
+    {{- fail "gatewayAPI.core.httpRoute.parentRefs is required" }}
+    {{- end }}
+  {{- with .Values.gatewayAPI.core.httpRoute.hostnames }}
+  hostnames:
+    {{- tpl (toYaml .) $ | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- if .Values.gatewayAPI.core.httpRoute.rules }}
+    {{- tpl (toYaml .Values.gatewayAPI.core.httpRoute.rules) $ | nindent 4 }}
+    {{- else }}
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - group: ""
+          kind: Service
+          name: {{ include "gitea.service.http.name" . }}
+          port: {{ .Values.service.http.port }}
+          weight: 1
+    {{- end }}
+{{- end }}
diff --git a/charts/gitea/templates/gitea/http-svc.yaml b/charts/gitea/templates/gitea/httpService.yaml
similarity index 97%
rename from charts/gitea/templates/gitea/http-svc.yaml
rename to charts/gitea/templates/gitea/httpService.yaml
index 28bd21820f..60460fba5c 100644
--- a/charts/gitea/templates/gitea/http-svc.yaml
+++ b/charts/gitea/templates/gitea/httpService.yaml
@@ -1,15 +1,15 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "gitea.fullname" . }}-http
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  annotations:
+    {{- toYaml .Values.service.http.annotations | nindent 4 }}
   labels:
     {{- include "gitea.labels" . | nindent 4 }}
     {{- if .Values.service.http.labels }}
     {{- toYaml .Values.service.http.labels  | nindent 4 }}
     {{- end }}
-  annotations:
-    {{- toYaml .Values.service.http.annotations | nindent 4 }}
+  name: {{ include "gitea.service.http.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
 spec:
   type: {{ .Values.service.http.type }}
   {{- if eq .Values.service.http.type "LoadBalancer" }}
diff --git a/charts/gitea/templates/gitea/ingress.yaml b/charts/gitea/templates/gitea/ingress.yaml
index 9312ffb1a9..408cba6d54 100644
--- a/charts/gitea/templates/gitea/ingress.yaml
+++ b/charts/gitea/templates/gitea/ingress.yaml
@@ -36,7 +36,7 @@ spec:
             pathType: {{ default "Prefix" $.Values.ingress.pathType }}
             backend:
               service:
-                name: {{ $fullName }}-http
+                name: {{ include "gitea.service.http.name" $ }}
                 port:
                   number: {{ $httpPort }}
           {{- else }}
@@ -44,7 +44,7 @@ spec:
             pathType: {{ .pathType | default "Prefix" }}
             backend:
               service:
-                name: {{ $fullName }}-http
+                name: {{ include "gitea.service.http.name" $ }}
                 port:
                   number: {{ $httpPort }}
           {{- end }}
@@ -54,7 +54,7 @@ spec:
             pathType: "Prefix"
             backend:
               service:
-                name: {{ $fullName }}-http
+                name: {{ include "gitea.service.http.name" $ }}
                 port:
                   number: {{ $httpPort }}
           {{- end }}
diff --git a/charts/gitea/templates/gitea/route.yaml b/charts/gitea/templates/gitea/route.yaml
index 7d44ef6272..37981f37e6 100644
--- a/charts/gitea/templates/gitea/route.yaml
+++ b/charts/gitea/templates/gitea/route.yaml
@@ -20,7 +20,7 @@ spec:
   {{- end }}
   to:
     kind: Service
-    name: {{ $fullName }}-http
+    name: {{ include "gitea.service.http.name" . }}
   port:
     targetPort: http
   wildcardPolicy: {{ .Values.route.wildcardPolicy }}
diff --git a/charts/gitea/templates/gitea/ssh-svc.yaml b/charts/gitea/templates/gitea/sshService.yaml
similarity index 97%
rename from charts/gitea/templates/gitea/ssh-svc.yaml
rename to charts/gitea/templates/gitea/sshService.yaml
index b2046fe1d2..affa70de86 100644
--- a/charts/gitea/templates/gitea/ssh-svc.yaml
+++ b/charts/gitea/templates/gitea/sshService.yaml
@@ -1,15 +1,15 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "gitea.fullname" . }}-ssh
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  annotations:
+    {{- toYaml .Values.service.ssh.annotations | nindent 4 }}
   labels:
     {{- include "gitea.labels" . | nindent 4 }}
     {{- if .Values.service.ssh.labels }}
     {{- toYaml .Values.service.ssh.labels  | nindent 4 }}
     {{- end }}
-  annotations:
-    {{- toYaml .Values.service.ssh.annotations | nindent 4 }}
+  name: {{ include "gitea.service.ssh.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
 spec:
   type: {{ .Values.service.ssh.type }}
   {{- if eq .Values.service.ssh.type "LoadBalancer" }}
diff --git a/charts/gitea/templates/gitea/tcpRoute.yaml b/charts/gitea/templates/gitea/tcpRoute.yaml
new file mode 100644
index 0000000000..26c2cace1a
--- /dev/null
+++ b/charts/gitea/templates/gitea/tcpRoute.yaml
@@ -0,0 +1,34 @@
+{{- if eq (include "gitea.tcpRoute.enabled" .) "true" -}}
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TCPRoute
+metadata:
+  {{- with (include "gitea.tcpRoute.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with (include "gitea.tcpRoute.labels" .) }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
+  name: {{ include "gitea.fullname" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+spec:
+  parentRefs:
+    {{- if .Values.gatewayAPI.core.tcpRoute.parentRefs }}
+    {{- toYaml .Values.gatewayAPI.core.tcpRoute.parentRefs | nindent 4 }}
+    {{- else }}
+    {{- fail "gatewayAPI.core.tcpRoute.parentRefs is required" }}
+    {{- end }}
+  rules:
+    {{- if .Values.gatewayAPI.core.tcpRoute.rules }}
+    {{- tpl (toYaml .Values.gatewayAPI.core.tcpRoute.rules) $ | nindent 4 }}
+    {{- else }}
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: {{ include "gitea.service.ssh.name" . }}
+          port: {{ .Values.service.ssh.port }}
+          weight: 1
+    {{- end }}
+{{- end }}
diff --git a/charts/gitea/templates/tests/test-http-connection.yaml b/charts/gitea/templates/tests/test-http-connection.yaml
index c47d2d4ab9..7abb934eb7 100644
--- a/charts/gitea/templates/tests/test-http-connection.yaml
+++ b/charts/gitea/templates/tests/test-http-connection.yaml
@@ -22,6 +22,6 @@ spec:
         {{- $testContainerSecurityContext | nindent 8 }}
       {{- end }}
       command: ['wget']
-      args:  ['{{ include "gitea.fullname" . }}-http:{{ .Values.service.http.port }}']
+      args: ['{{ include "gitea.service.http.name" . }}:{{ .Values.service.http.port }}']
   restartPolicy: Never
 {{- end }}
diff --git a/charts/gitea/values.yaml b/charts/gitea/values.yaml
index e695c28e1a..8ab15bf849 100644
--- a/charts/gitea/values.yaml
+++ b/charts/gitea/values.yaml
@@ -208,11 +208,94 @@ route:
     caCertificate:
     destinationCACertificate:
 
+## @section Gateway API
+## See docs/gateway-api.md for full guidance.
+gatewayAPI:
+  ## @param gatewayAPI.enabled Enable deployment of Gateway API resources
+  enabled: false
+
+  core:
+    ## @param gatewayAPI.core.backendTLSPolicy.enabled Render a BackendTLSPolicy resource for encrypted backend traffic
+    ## @param gatewayAPI.core.backendTLSPolicy.annotations Annotations applied to the BackendTLSPolicy
+    ## @param gatewayAPI.core.backendTLSPolicy.labels Additional labels applied to the BackendTLSPolicy
+    ## @param gatewayAPI.core.backendTLSPolicy.targetRefs Target references for the BackendTLSPolicy. Defaults to the HTTP service.
+    ## @param gatewayAPI.core.backendTLSPolicy.validation Validation configuration (required when enabled). See `docs/gateway-api.md`.
+    ## @extra gatewayAPI.core.backendTLSPolicy.validation.caCertificateRefs CA certificate references for the BackendTLSPolicy validation. See `docs/gateway-api.md`.
+    ## @extra gatewayAPI.core.backendTLSPolicy.validation.hostname Hostname for the BackendTLSPolicy validation. Must be the Common Name (CN) or a Subject Alternative Name (SAN) of the gitea server certificate. See `docs/gateway-api.md`.
+    backendTLSPolicy:
+      enabled: false
+      annotations: {}
+      labels: {}
+      targetRefs: []
+      validation: {}
+      #  caCertificateRefs:
+      #    - name: gitea-ca
+      #      group: ""
+      #      kind: ConfigMap
+      #  hostname: gitea-http
+
+    ## @param gatewayAPI.core.httpRoute.enabled Render an HTTPRoute resource
+    ## @param gatewayAPI.core.httpRoute.annotations Annotations applied to the HTTPRoute
+    ## @param gatewayAPI.core.httpRoute.labels Additional labels applied to the HTTPRoute
+    ## @param gatewayAPI.core.httpRoute.tls When true, treat the upstream Gateway as terminating TLS so `ROOT_URL` uses `https`.
+    ## @param gatewayAPI.core.httpRoute.parentRefs Parent gateway references (required when enabled).
+    ## @param gatewayAPI.core.httpRoute.hostnames List of hostnames for the HTTPRoute.
+    ## @param gatewayAPI.core.httpRoute.rules Custom routing rules. Defaults to a PathPrefix `/` rule targeting the HTTP service.
+    httpRoute:
+      enabled: false
+      annotations: {}
+      labels: {}
+      tls: false
+      parentRefs: []
+      # - group: gateway.networking.k8s.io
+      #   kind: Gateway
+      #   name: shared-gateway
+      #   namespace: gateway-system
+      #   sectionName: http
+      hostnames: []
+      # - git.example.com
+      rules: []
+
+
+    ## @param gatewayAPI.core.tcpRoute.enabled Render a TCPRoute resource (typically for SSH)
+    ## @param gatewayAPI.core.tcpRoute.annotations Annotations applied to the TCPRoute
+    ## @param gatewayAPI.core.tcpRoute.labels Additional labels applied to the TCPRoute
+    ## @param gatewayAPI.core.tcpRoute.parentRefs Parent gateway references (required when enabled).
+    ## @param gatewayAPI.core.tcpRoute.rules Custom routing rules. Defaults to a rule targeting the SSH service.
+    tcpRoute:
+      enabled: false
+      annotations: {}
+      labels: {}
+      parentRefs: []
+      # - group: gateway.networking.k8s.io
+      #   kind: Gateway
+      #   name: shared-gateway
+      #   namespace: gateway-system
+      #   sectionName: ssh
+      rules: []
+
+
+  ## NGINX Gateway Fabric specific resources. Only relevant when the upstream
+  ## Gateway is backed by NGINX Gateway Fabric (nginx.org). Other implementations
+  ## (Envoy Gateway, Cilium, ...) do not impose a default request body size limit.
+  nginx:
+    ## @param gatewayAPI.nginx.clientSettingsPolicies.enabled Render a ClientSettingsPolicy (NGINX Gateway Fabric) to raise the client request body limit
+    ## @param gatewayAPI.nginx.clientSettingsPolicies.annotations Annotations applied to the ClientSettingsPolicy
+    ## @param gatewayAPI.nginx.clientSettingsPolicies.labels Additional labels applied to the ClientSettingsPolicy
+    ## @param gatewayAPI.nginx.clientSettingsPolicies.targetRef Target reference for the ClientSettingsPolicy. Defaults to the chart's HTTPRoute.
+    ## @param gatewayAPI.nginx.clientSettingsPolicies.body Client body settings (required when enabled), e.g. `maxSize`. See `docs/gateway-api.md`.
+    clientSettingsPolicies:
+      enabled: false
+      annotations: {}
+      labels: {}
+      targetRef: {}
+      body: {}
+      #   maxSize: 100m
+
 ## @section deployment
 #
 ## @param resources Kubernetes resources
-resources:
-  {}
+resources: {}
   # We usually recommend not to specify default resources and to leave this as a conscious
   # choice for the user. This also increases chances charts run on environments with little
   # resources, such as Minikube. If you do want to specify resources, uncomment the following
@@ -253,10 +336,9 @@ priorityClassName: ""
 ## @param deployment.labels Labels for the deployment
 ## @param deployment.annotations Annotations for the Gitea deployment to be created
 deployment:
-  env:
-    []
-    # - name: VARIABLE
-    #   value: my-value
+  env: []
+  # - name: VARIABLE
+  #   value: my-value
   terminationGracePeriodSeconds: 60
   labels: {}
   annotations: {}
@@ -423,8 +505,7 @@ gitea:
       tlsConfig: {}
 
   ## @param gitea.ldap LDAP configuration
-  ldap:
-    []
+  ldap: []
     # - name: "LDAP 1"
     #  existingSecret:
     #  securityProtocol:
@@ -441,8 +522,7 @@ gitea:
 
   # Either specify inline `key` and `secret` or refer to them via `existingSecret`
   ## @param gitea.oauth OAuth configuration
-  oauth:
-    []
+  oauth: []
     # - name: 'OAuth 1'
     #   provider:
     #   key:
@@ -659,9 +739,9 @@ valkey:
       repository: bitnamilegacy/redis-exporter
 
   primary:
-  ## @param valkey.primary.persistence.enabled Enable persistence on Valkey replicas nodes using Persistent Volume Claims.
-  ## @param valkey.primary.persistence.storageClass Persistent Volume storage class.
-  ## @param valkey.primary.persistence.size Persistent Volume size.
+    ## @param valkey.primary.persistence.enabled Enable persistence on Valkey replicas nodes using Persistent Volume Claims.
+    ## @param valkey.primary.persistence.storageClass Persistent Volume storage class.
+    ## @param valkey.primary.persistence.size Persistent Volume size.
     persistence:
       enabled: true
       storageClass: ""