push

templates/deployment.yaml

@@ -2,176 +2,140 @@
 apiVersion: secretgenerator.mittwald.de/v1alpha1
 kind: StringSecret
 metadata:
-  name: memelord-raiko-redis
+  name: {{ .Release.Name }}-cookie
 spec:
   fields:
-    - fieldName: redis-password
+    - fieldName: secret-key
       length: "32"
       encoding: hex
 ---
-apiVersion: dragonflydb.io/v1alpha1
-kind: Dragonfly
+apiVersion: apps/v1
+kind: Deployment
 metadata:
-  name: memelord-raiko-redis
+  name: {{ .Release.Name }}
 spec:
-  authentication:
-    passwordFromSecret:
-      name: memelord-raiko-redis
-      key: redis-password
-  replicas: 1
-  resources:
-    requests:
-      cpu: 500m
-      memory: 500Mi
-    limits:
-      cpu: 600m
-      memory: 750Mi
----
-apiVersion: secretgenerator.mittwald.de/v1alpha1
-kind: StringSecret
-metadata:
-  name: memelord-raiko-database
-  labels:
-    cnpg.io/reload: "true"
-spec:
-  data:
-    username: memelord-raiko
-  fields:
-    - fieldName: password
-      length: "32"
-      encoding: hex
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: memelord-raiko-database
-spec:
-  instances: 1
-  imageName: ghcr.io/cloudnative-pg/postgresql:17
-  storage:
-    size: 1Gi
-    storageClass: postgres
-  affinity:
-    podAntiAffinityType: required
-    nodeSelector:
-      codemowers.io/lvm-ubuntu-vg: enterprise-ssd
-  resources:
-    requests:
-      cpu: "100m"
-      memory: "1Gi"
-    limits:
-      cpu: "1"
-      memory: "4Gi"
-  postgresql:
-    parameters:
-      max_connections: "300"
-      shared_buffers: "512MB"
-      effective_cache_size: "2GB"
-  managed:
-    roles:
-    - name: memelord-raiko
-      ensure: present
-      login: true
-      passwordSecret:
-        name: memelord-raiko-database
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: memelord-raiko
-spec:
-  name: memelord-raiko
-  owner: memelord-raiko
-  cluster:
-    name: memelord-raiko-database
----
-apiVersion: s3.onyxia.sh/v1alpha1
-kind: Policy
-metadata:
-  name: memelord-raiko-policy
-spec:
-  name: memelord-raiko-policy
-  s3InstanceRef: minio/default
-  policyContent: >-
-    {
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Effect": "Allow",
-          "Action": [
-            "s3:*"
-          ],
-          "Resource": [
-            "arn:aws:s3:::memelord-raiko",
-            "arn:aws:s3:::memelord-raiko/*"
-          ]
-        }
-      ]
-    }
----
-apiVersion: s3.onyxia.sh/v1alpha1
-kind: S3User
-metadata:
-  name: memelord-raiko-bucket
-spec:
-  accessKey: memelord-raiko-bucket
-  policies:
-    - memelord-raiko-policy
-  s3InstanceRef: minio/default
----
-apiVersion: s3.onyxia.sh/v1alpha1
-kind: Bucket
-metadata:
-  name: memelord-raiko
-spec:
-  name: memelord-raiko
-  s3InstanceRef: minio/default
-  quota:
-    default: 100000000
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: memelord
-spec:
-  type: ClusterIP
+  replicas: 3
   selector:
-    app: memelord
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8000
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: memelord-raiko
-spec:
-  secretName: memelord-raiko-tls
-  dnsNames:
-    - {{ .Values.hostname }}
-  issuerRef:
-    name: letsencrypt
-    kind: ClusterIssuer
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: memelord-raiko
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-spec:
-  ingressClassName: traefik
-  rules:
-    - host: {{ .Values.hostname }}
-      http:
-        paths:
-          - pathType: Prefix
-            path: "/"
-            backend:
-              service:
-                name: memelord
-                port:
-                  number: 80
-  tls:
-    - secretName: memelord-raiko-tls
+    matchLabels:
+      app: memelord
+  template:
+    metadata:
+      labels:
+        app: memelord
+    spec:
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: topology.kubernetes.io/zone
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              app: memelord
+      containers:
+        - name: memelord
+          image: ghcr.io/l4rm4nd/memelord:latest
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 8000
+          env:
+            - name: DOMAIN
+              value: {{ .Values.hostname }}
+            - name: DB_ENGINE
+              value: postgres
+            - name: POSTGRES_HOST
+              value: {{ .Release.Name }}-database-rw
+            - name: POSTGRES_PORT
+              value: '5432'
+            - name: POSTGRES_DB
+              value: {{ .Release.Name }}
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-database
+                  key: username
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-database
+                  key: password
+            - name: REDIS_HOST
+              value: {{ .Release.Name }}-redis
+            - name: REDIS_PORT
+              value: '6379'
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-redis
+                  key: redis-password
+            - name: STORAGE_BACKEND
+              value: s3
+            - name: CSP_IMG_SRC_EXTRA
+              value: https://minio.ee-lte-1.codemowers.io
+            - name: AWS_QUERYSTRING_AUTH
+              value: "true"
+            # S3/MinIO Storage Configuration
+            - name: STORAGE_BACKEND
+              value: "s3"
+            - name: AWS_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-bucket
+                  key: accessKey
+            - name: AWS_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-bucket
+                  key: secretKey
+            - name: AWS_STORAGE_BUCKET_NAME
+              value: "{{ .Release.Name }}"
+            - name: AWS_S3_REGION_NAME
+              value: "ee-lte-1"
+            - name: AWS_S3_ENDPOINT_URL
+              value: "https://minio.ee-lte-1.codemowers.io"
+            - name: AWS_LOCATION
+              value: "" # why is this set to 'media' in original?
+            - name: AWS_S3_ADDRESSING_STYLE
+              value: path
+            - name: DEBUG
+              value: "True"
+            - name: SECURE_COOKIES
+              value: "True"
+            - name: OIDC_ENABLED
+              value: "True"
+            - name: OIDC_RP_SIGN_ALGO
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-client-{{ .Release.Name }}-owner-secrets
+                  key: OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG
+            - name: OIDC_OP_JWKS_ENDPOINT
+              value: https://auth.ee-lte-1.codemowers.io/jwks
+            - name: OIDC_RP_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-client-{{ .Release.Name }}-owner-secrets
+                  key: OIDC_CLIENT_ID
+            - name: OIDC_RP_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-client-{{ .Release.Name }}-owner-secrets
+                  key: OIDC_CLIENT_SECRET
+            - name: OIDC_OP_AUTHORIZATION_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-client-{{ .Release.Name }}-owner-secrets
+                  key: OIDC_IDP_AUTH_URI
+            - name: OIDC_OP_TOKEN_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-client-{{ .Release.Name }}-owner-secrets
+                  key: OIDC_IDP_TOKEN_URI
+            - name: OIDC_OP_USER_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-client-{{ .Release.Name }}-owner-secrets
+                  key: OIDC_IDP_USERINFO_URI
+            - name: SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-cookie
+                  key: secret-key