https://home.robusta.dev/blog/stop-using-cpu-limits
Okay, it's actually more complex than that. Because on self managed nodes, kubernetes is not the only thing that's running, so it can make sense to set limits for other non kubernetes workloads hosted on those nodes. And memory is a bit different from CPU. You will have to do some testing and YMMV but just keep the difference between requests and limits in mind.
But my suggestion would be to try to see if you can get away with only setting requests, or with setting high very high limits. See: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/#if-you-do-not-specify-a-memory-limit
In order for them not to be OOM Killed, you have to set the memory requests for them above their highest spike, which means most of the time they’re only using like 25% or so of their memory allocation.
Are you sure? Only limits should limit the total memory usage of a pod? Requests should happily let pods use more memory than the request size.
One thing I am curious about is if your pods actually need that much memory. I have heard (horror) stories, where people had an application in Kubernetes with a memory leak, so what they did instead of fixing the memory leak, was to just regularly kill pods and restart new ones that weren't leaking yet. :/
To answer your actual question about memory optimization, no. Even google still "wastes" memory by having requests and limits higher than what pods usually use. It is very difficult to prune and be ultra efficient. If an outage due to OOM costs more than paying for more resources would, then people just resort to the latter.
For maintenance I would recommend a ticketing system instead of forgejo:
https://selfh.st/apps/?search=ticket
There are a few options and they probably all work better than a git issue tracker.
Another thing I would recommend is to have centralized accounts via an identity provider. People have one username and password they can use to log into all the services, and you can reset/signup them to all connected services by managing the identity provider app.
There are a few options for this as well but I'm on my phone some imma just list the three that I find most promising for your usecase: kanidm, voidauth, authentik.