push

templates/deployment.yaml

@@ -2,140 +2,176 @@
 apiVersion: secretgenerator.mittwald.de/v1alpha1
 kind: StringSecret
 metadata:
-  name: {{ .Release.Name }}-cookie
+  name: memelord-raiko-redis
 spec:
   fields:
-    - fieldName: secret-key
+    - fieldName: redis-password
       length: "32"
       encoding: hex
 ---
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: dragonflydb.io/v1alpha1
+kind: Dragonfly
 metadata:
-  name: {{ .Release.Name }}
+  name: memelord-raiko-redis
 spec:
-  replicas: 3
+  authentication:
+    passwordFromSecret:
+      name: memelord-raiko-redis
+      key: redis-password
+  replicas: 1
+  resources:
+    requests:
+      cpu: 500m
+      memory: 500Mi
+    limits:
+      cpu: 600m
+      memory: 750Mi
+---
+apiVersion: secretgenerator.mittwald.de/v1alpha1
+kind: StringSecret
+metadata:
+  name: memelord-raiko-database
+  labels:
+    cnpg.io/reload: "true"
+spec:
+  data:
+    username: memelord-raiko
+  fields:
+    - fieldName: password
+      length: "32"
+      encoding: hex
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: memelord-raiko-database
+spec:
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgresql:17
+  storage:
+    size: 1Gi
+    storageClass: postgres
+  affinity:
+    podAntiAffinityType: required
+    nodeSelector:
+      codemowers.io/lvm-ubuntu-vg: enterprise-ssd
+  resources:
+    requests:
+      cpu: "100m"
+      memory: "1Gi"
+    limits:
+      cpu: "1"
+      memory: "4Gi"
+  postgresql:
+    parameters:
+      max_connections: "300"
+      shared_buffers: "512MB"
+      effective_cache_size: "2GB"
+  managed:
+    roles:
+    - name: memelord-raiko
+      ensure: present
+      login: true
+      passwordSecret:
+        name: memelord-raiko-database
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: memelord-raiko
+spec:
+  name: memelord-raiko
+  owner: memelord-raiko
+  cluster:
+    name: memelord-raiko-database
+---
+apiVersion: s3.onyxia.sh/v1alpha1
+kind: Policy
+metadata:
+  name: memelord-raiko-policy
+spec:
+  name: memelord-raiko-policy
+  s3InstanceRef: minio/default
+  policyContent: >-
+    {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:*"
+          ],
+          "Resource": [
+            "arn:aws:s3:::memelord-raiko",
+            "arn:aws:s3:::memelord-raiko/*"
+          ]
+        }
+      ]
+    }
+---
+apiVersion: s3.onyxia.sh/v1alpha1
+kind: S3User
+metadata:
+  name: memelord-raiko-bucket
+spec:
+  accessKey: memelord-raiko-bucket
+  policies:
+    - memelord-raiko-policy
+  s3InstanceRef: minio/default
+---
+apiVersion: s3.onyxia.sh/v1alpha1
+kind: Bucket
+metadata:
+  name: memelord-raiko
+spec:
+  name: memelord-raiko
+  s3InstanceRef: minio/default
+  quota:
+    default: 100000000
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: memelord
+spec:
+  type: ClusterIP
   selector:
-    matchLabels:
-      app: memelord
-  template:
-    metadata:
-      labels:
-        app: memelord
-    spec:
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: topology.kubernetes.io/zone
-          whenUnsatisfiable: ScheduleAnyway
-          labelSelector:
-            matchLabels:
-              app: memelord
-      containers:
-        - name: memelord
-          image: ghcr.io/l4rm4nd/memelord:latest
-          imagePullPolicy: Always
-          ports:
-            - name: http
-              containerPort: 8000
-          env:
-            - name: DOMAIN
-              value: {{ .Values.hostname }}
-            - name: DB_ENGINE
-              value: postgres
-            - name: POSTGRES_HOST
-              value: {{ .Release.Name }}-database-rw
-            - name: POSTGRES_PORT
-              value: '5432'
-            - name: POSTGRES_DB
-              value: {{ .Release.Name }}
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Release.Name }}-database
-                  key: username
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Release.Name }}-database
-                  key: password
-            - name: REDIS_HOST
-              value: {{ .Release.Name }}-redis
-            - name: REDIS_PORT
-              value: '6379'
-            - name: REDIS_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Release.Name }}-redis
-                  key: redis-password
-            - name: STORAGE_BACKEND
-              value: s3
-            - name: CSP_IMG_SRC_EXTRA
-              value: https://minio.ee-lte-1.codemowers.io
-            - name: AWS_QUERYSTRING_AUTH
-              value: "true"
-            # S3/MinIO Storage Configuration
-            - name: STORAGE_BACKEND
-              value: "s3"
-            - name: AWS_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Release.Name }}-bucket
-                  key: accessKey
-            - name: AWS_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Release.Name }}-bucket
-                  key: secretKey
-            - name: AWS_STORAGE_BUCKET_NAME
-              value: "{{ .Release.Name }}"
-            - name: AWS_S3_REGION_NAME
-              value: "ee-lte-1"
-            - name: AWS_S3_ENDPOINT_URL
-              value: "https://minio.ee-lte-1.codemowers.io"
-            - name: AWS_LOCATION
-              value: "" # why is this set to 'media' in original?
-            - name: AWS_S3_ADDRESSING_STYLE
-              value: path
-            - name: DEBUG
-              value: "True"
-            - name: SECURE_COOKIES
-              value: "True"
-            - name: OIDC_ENABLED
-              value: "True"
-            - name: OIDC_RP_SIGN_ALGO
-              valueFrom:
-                secretKeyRef:
-                  name: oidc-client-{{ .Release.Name }}-owner-secrets
-                  key: OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG
-            - name: OIDC_OP_JWKS_ENDPOINT
-              value: https://auth.ee-lte-1.codemowers.io/jwks
-            - name: OIDC_RP_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: oidc-client-{{ .Release.Name }}-owner-secrets
-                  key: OIDC_CLIENT_ID
-            - name: OIDC_RP_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: oidc-client-{{ .Release.Name }}-owner-secrets
-                  key: OIDC_CLIENT_SECRET
-            - name: OIDC_OP_AUTHORIZATION_ENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: oidc-client-{{ .Release.Name }}-owner-secrets
-                  key: OIDC_IDP_AUTH_URI
-            - name: OIDC_OP_TOKEN_ENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: oidc-client-{{ .Release.Name }}-owner-secrets
-                  key: OIDC_IDP_TOKEN_URI
-            - name: OIDC_OP_USER_ENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: oidc-client-{{ .Release.Name }}-owner-secrets
-                  key: OIDC_IDP_USERINFO_URI
-            - name: SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Release.Name }}-cookie
-                  key: secret-key
+    app: memelord
+  ports:
+    - name: http
+      port: 80
+      targetPort: 8000
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: memelord-raiko
+spec:
+  secretName: memelord-raiko-tls
+  dnsNames:
+    - memelord-raiko.ee-lte-1.codemowers.io
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: memelord-raiko
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: memelord-raiko.ee-lte-1.codemowers.io
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: memelord
+                port:
+                  number: 80
+  tls:
+    - secretName: memelord-raiko-tls