help

templates/cert-grafana.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: grafana
+  labels:
+    app: grafana
+spec:
+  type: ClusterIP
+  selector:
+    app: grafana
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: grafana
+spec:
+  secretName: grafana-tls
+  dnsNames:
+    - grafana-sala.ee-lte-1.codemowers.io
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: grafana
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: grafana-sala.ee-lte-1.codemowers.io
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: grafana
+                port:
+                  number: 3000
+  tls:
+    - secretName: grafana-tls

templates/cert.yaml

@@ -0,0 +1,47 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: memelord
+spec:
+  type: ClusterIP
+  selector:
+    app: memelord
+  ports:
+    - name: http
+      port: 80
+      targetPort: 8000
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: memelord-sala
+spec:
+  secretName: memelord-sala-tls
+  dnsNames:
+    - {{ .Values.hostname }}
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: memelord-sala
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: {{ .Values.hostname }}
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: memelord
+                port:
+                  number: 80
+  tls:
+    - secretName: memelord-sala-tls

templates/grafana.yaml

@@ -0,0 +1,440 @@
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: grafana
+  labels:
+    app: grafana
+spec:
+  serviceName: grafana
+  replicas: 1
+  selector:
+    matchLabels:
+      app: grafana
+  template:
+    metadata:
+      labels:
+        app: grafana
+    spec:
+      volumes:
+        - name: data
+          emptyDir: {}
+        - name: tmp
+          emptyDir: {}
+        - name: config
+          configMap:
+            name: grafana-config
+        - name: config-datasources
+          configMap:
+            name: grafana-config-datasources
+        - name: config-dashboards
+          configMap:
+            name: grafana-config-dashboards
+        - name: dashboards
+          configMap:
+            name: grafana-dashboards
+      containers:
+        - name: grafana
+          image: grafana/grafana:latest
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 3000
+              name: http
+          env:
+            - name: GF_DATABASE_TYPE
+              value: sqlite3
+            - name: GF_DATABASE_PATH
+              value: /var/lib/grafana/grafana.db
+            - name: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-client-grafana-owner-secrets
+                  key: OIDC_CLIENT_ID
+            - name: GF_AUTH_GENERIC_OAUTH_SCOPES
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-client-grafana-owner-secrets
+                  key: OIDC_AVAILABLE_SCOPES
+            - name: GF_AUTH_GENERIC_OAUTH_AUTH_URL
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-client-grafana-owner-secrets
+                  key: OIDC_IDP_AUTH_URI
+            - name: GF_AUTH_GENERIC_OAUTH_TOKEN_URL
+              value: "https://auth.ee-lte-1.codemowers.io/token"
+            - name: GF_AUTH_GENERIC_OAUTH_API_URL
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-client-grafana-owner-secrets
+                  key: OIDC_IDP_URI
+            - name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-client-grafana-owner-secrets
+                  key: OIDC_CLIENT_SECRET
+            - name: GF_AUTH_GENERIC_OAUTH_USE_ID_TOKEN
+              value: "false"
+            - name: GF_SERVER_DOMAIN
+              value: grafana-sala.ee-lte-1.codemowers.io
+            - name: GF_SERVER_ROOT_URL
+              value: "https://%(domain)s/"
+            - name: GF_AUTH_OAUTH_ALLOW_INSECURE_EMAIL_LOOKUP
+              value: "true"
+            - name: GF_AUTH_BASIC_ENABLED
+              value: "false"
+            - name: GF_AUTH_GENERIC_OAUTH_ENABLED
+              value: "true"
+            - name: GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP
+              value: "true"
+            - name: GF_AUTH_GENERIC_OAUTH_USE_PKCE
+              value: "true"
+            - name: GF_AUTH_GENERIC_OAUTH_ALLOW_ASSIGN_GRAFANA_ADMIN
+              value: "true"
+            - name: GF_SECURITY_DISABLE_INITIAL_ADMIN_CREATION
+              value: "true"
+            - name: GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH
+              value: "contains(groups[*], 'github.com:codemowers:admins') && 'Admin' || 'Viewer'"
+          volumeMounts:
+            - name: grafana-storage
+              mountPath: /var/lib/grafana
+            - name: config-datasources
+              mountPath: /etc/grafana/provisioning/datasources
+            - name: config-dashboards
+              mountPath: /etc/grafana/provisioning/dashboards
+            - name: dashboards
+              mountPath: /var/lib/grafana/dashboards/
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: 3000
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: 3000
+            initialDelaySeconds: 30
+            periodSeconds: 10
+  volumeClaimTemplates:
+    - metadata:
+        name: grafana-storage
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        storageClassName: sqlite
+        resources:
+          requests:
+            storage: 5Gi
+---
+apiVersion: codemowers.cloud/v1beta1
+kind: OIDCClient
+metadata:
+  name: grafana
+  namespace: memelord-sala
+spec:
+  displayName: Grafana sala
+  uri: https://grafana-sala.ee-lte-1.codemowers.io/login/generic_oauth
+  redirectUris:
+    - https://grafana-sala.ee-lte-1.codemowers.io/login/generic_oauth
+  grantTypes:
+    - authorization_code
+    - refresh_token
+  responseTypes:
+    - code
+  availableScopes:
+    - openid
+    - profile
+    - groups
+  pkce: true
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana-config-datasources
+data:
+  prometheus.yaml: |
+    apiVersion: 1
+    prune: true
+    datasources:
+      - name: Prometheus
+        type: prometheus
+        orgId: 1
+        url: http://prometheus-operated.monitoring.svc.cluster.local:9090
+        version: 1
+        editable: false
+      - name: Thanos
+        type: prometheus
+        orgId: 1
+        url: http://thanos-query.monitoring.svc.cluster.local:10902
+        version: 1
+        editable: false
+      - name: Loki
+        type: loki
+        orgId: 1
+        url: http://loki.monitoring.svc.cluster.local:3100
+        version: 1
+        editable: false
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana-config-dashboards
+data:
+  dashboards.yaml: |
+    apiVersion: 1
+    providers:
+      - name: dashboards
+        orgId: 1
+        folder: Dashboards
+        type: file
+        options:
+          path: /var/lib/grafana/dashboards/
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana-dashboards
+data:
+  LogAggregator.json: |
+    {
+      "annotations": {
+        "list": [
+          {
+            "builtIn": 1,
+            "datasource": {
+              "type": "grafana",
+              "uid": "-- Grafana --"
+            },
+            "enable": true,
+            "hide": true,
+            "iconColor": "rgba(0, 211, 255, 1)",
+            "name": "Annotations & Alerts",
+            "type": "dashboard"
+          }
+        ]
+      },
+      "editable": true,
+      "fiscalYearStartMonth": 0,
+      "graphTooltip": 0,
+      "id": 1,
+      "links": [],
+      "panels": [
+        {
+          "datasource": {
+            "type": "loki",
+            "uid": "P8E80F9AEF21F6940"
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "barWidthFactor": 0.6,
+                "drawStyle": "line",
+                "fillOpacity": 0,
+                "gradientMode": "opacity",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 5,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "auto",
+                "showValues": false,
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "normal"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": 0
+                  },
+                  {
+                    "color": "red",
+                    "value": 80
+                  }
+                ]
+              },
+              "unit": "msg/s"
+            },
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 8,
+            "w": 24,
+            "x": 0,
+            "y": 0
+          },
+          "id": 2,
+          "options": {
+            "legend": {
+              "calcs": [],
+              "displayMode": "list",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "hideZeros": false,
+              "mode": "single",
+              "sort": "none"
+            }
+          },
+          "pluginVersion": "12.2.1",
+          "targets": [
+            {
+              "datasource": {
+                "type": "loki",
+                "uid": "P8E80F9AEF21F6940"
+              },
+              "direction": "backward",
+              "editorMode": "code",
+              "expr": "sum by (detected_level) (count_over_time ({app=~\"$app\",namespace=~\"$namespace\"}[1m]))",
+              "legendFormat": "{{detected_level}}",
+              "queryType": "range",
+              "refId": "A"
+            }
+          ],
+          "title": "Log records",
+          "type": "timeseries"
+        },
+        {
+          "datasource": {
+            "type": "loki",
+            "uid": "P8E80F9AEF21F6940"
+          },
+          "fieldConfig": {
+            "defaults": {},
+            "overrides": []
+          },
+          "gridPos": {
+            "h": 20,
+            "w": 24,
+            "x": 0,
+            "y": 8
+          },
+          "id": 1,
+          "options": {
+            "dedupStrategy": "none",
+            "enableInfiniteScrolling": false,
+            "enableLogDetails": true,
+            "prettifyLogMessage": true,
+            "showCommonLabels": true,
+            "showLabels": true,
+            "showTime": true,
+            "sortOrder": "Descending",
+            "wrapLogMessage": true
+          },
+          "pluginVersion": "12.2.1",
+          "targets": [
+            {
+              "datasource": {
+                "type": "loki",
+                "uid": "P8E80F9AEF21F6940"
+              },
+              "direction": "backward",
+              "editorMode": "code",
+              "expr": "{app=~\"$app\",namespace=~\"$namespace\"}",
+              "queryType": "range",
+              "refId": "A"
+            }
+          ],
+          "title": "Loki",
+          "type": "logs"
+        }
+      ],
+      "preload": false,
+      "refresh": "30s",
+      "schemaVersion": 42,
+      "tags": [],
+      "templating": {
+        "list": [
+          {
+            "allValue": ".*",
+            "current": {
+              "text": "All",
+              "value": [
+                "$__all"
+              ]
+            },
+            "datasource": {
+              "type": "loki",
+              "uid": "P8E80F9AEF21F6940"
+            },
+            "definition": "",
+            "includeAll": true,
+            "multi": true,
+            "name": "app",
+            "options": [],
+            "query": {
+              "label": "app",
+              "refId": "LokiVariableQueryEditor-VariableQuery",
+              "stream": "",
+              "type": 1
+            },
+            "refresh": 1,
+            "regex": "",
+            "sort": 5,
+            "type": "query"
+          },
+          {
+            "allValue": ".+",
+            "current": {
+              "text": "All",
+              "value": [
+                "$__all"
+              ]
+            },
+            "datasource": {
+              "type": "loki",
+              "uid": "P8E80F9AEF21F6940"
+            },
+            "definition": "",
+            "includeAll": true,
+            "label": "namespace",
+            "multi": true,
+            "name": "namespace",
+            "options": [],
+            "query": {
+              "label": "namespace",
+              "refId": "LokiVariableQueryEditor-VariableQuery",
+              "stream": "",
+              "type": 1
+            },
+            "refresh": 1,
+            "regex": "",
+            "type": "query"
+          }
+        ]
+      },
+      "time": {
+        "from": "now-5m",
+        "to": "now"
+      },
+      "timepicker": {},
+      "timezone": "browser",
+      "title": "Log Aggregator",
+      "uid": "lawf6g2",
+      "version": 1
+    }

templates/memelord.yaml

@@ -0,0 +1,150 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: memelord
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: memelord
+  template:
+    metadata:
+      labels:
+        app: memelord
+    spec:
+      volumes:
+        - name: logs
+          emptyDir: {}
+        - name: admin
+          emptyDir: {}
+
+      containers:
+        - name: memelord
+          image: ghcr.io/l4rm4nd/memelord:latest
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            runAsUser: 33
+            runAsGroup: 33
+          volumeMounts:
+            - name: logs
+              mountPath: /opt/app/logs
+            - name: admin
+              mountPath: /opt/app/myapp/static/admin
+
+          ports:
+            - containerPort: 8000
+          env:
+            # PostgreSQL credentials from secret
+            - name: DB_ENGINE
+              value: postgres
+            - name: DOMAIN
+              value: {{ .Values.hostname }} 
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: memelord-sala-database
+                  key: username
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: memelord-sala-database
+                  key: password
+            - name: POSTGRES_DB
+              value: memelord-sala
+            - name: POSTGRES_HOST
+              value: memelord-sala-database-rw.memelord-sala.svc.cluster.local
+            - name: POSTGRES_PORT
+              value: "5432"
+
+            # Redis password
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: memelord-sala-redis
+                  key: redis-password
+
+            - name: STORAGE_BACKEND
+              value: s3
+            - name: AWS_S3_ENDPOINT_URL
+              value: https://minio.ee-lte-1.codemowers.io/
+            - name: AWS_S3_REGION_NAME
+              value: ee-lte-1
+            - name: AWS_S3_ADDRESSING_STYLE
+              value: path 
+            - name: AWS_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: memelord-sala-bucket
+                  key: accessKey
+            - name: AWS_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: memelord-sala-bucket
+                  key: secretKey
+            - name: AWS_STORAGE_BUCKET_NAME
+              value: memelord-sala
+            - name: ENABLE_PUBLIC_FEED
+              value: "True"
+            - name: OIDC_ENABLED
+              value: "True"
+            - name: OIDC_RP_SIGN_ALGO
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-client-memelord-sala-owner-secrets
+                  key: OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG
+            - name: OIDC_OP_JWKS_ENDPOINT
+              value: https://auth.ee-lte-1.codemowers.io/jwks
+            - name: OIDC_RP_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-client-memelord-sala-owner-secrets
+                  key: OIDC_CLIENT_ID
+            - name: OIDC_RP_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-client-memelord-sala-owner-secrets
+                  key: OIDC_CLIENT_SECRET
+            - name: OIDC_OP_AUTHORIZATION_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-client-memelord-sala-owner-secrets
+                  key: OIDC_IDP_AUTH_URI
+            - name: OIDC_OP_TOKEN_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-client-memelord-sala-owner-secrets
+                  key: OIDC_IDP_TOKEN_URI
+            - name: OIDC_OP_USER_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: oidc-client-memelord-sala-owner-secrets
+                  key: OIDC_IDP_USERINFO_URI
+            - name: SESSION_COOKIE_AGE
+              value: "30"
+            - name: SESSION_EXPIRE_AT_BROWSER_CLOSE
+              value: "False"
+            - name: TZ
+              value: "Europe/Berlin"
+
+---
+apiVersion: codemowers.cloud/v1beta1
+kind: OIDCClient
+metadata:
+  name: memelord-sala
+spec:
+  displayName: Memelord sala
+  uri: https://{{ .Values.hostname }}/
+  redirectUris:
+    - https://{{ .Values.hostname }}/oidc/callback/
+  grantTypes:
+    - authorization_code
+    - refresh_token
+  responseTypes:
+    - code
+  availableScopes:
+    - openid
+    - profile
+  pkce: false
+

templates/pornhub.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: Probe
+metadata:
+  name: raivo-probe
+spec:
+  module: http_2xx
+  prober:
+    url: blackbox-exporter.monitoring.svc.cluster.local
+  targets:
+    staticConfig:
+      static:
+        - raivo.ooo

templates/postgre.yaml

@@ -0,0 +1,58 @@
+---
+apiVersion: secretgenerator.mittwald.de/v1alpha1
+kind: StringSecret
+metadata:
+  name: memelord-sala-database
+  labels:
+    cnpg.io/reload: "true"
+spec:
+  data:
+    username: memelord-sala
+  fields:
+    - fieldName: password
+      length: "32"
+      encoding: hex
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: memelord-sala-database
+spec:
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgresql:17
+  storage:
+    size: 1Gi
+    storageClass: postgres
+  affinity:
+    podAntiAffinityType: required
+    nodeSelector:
+      codemowers.io/lvm-ubuntu-vg: enterprise-ssd
+  resources:
+    requests:
+      cpu: "100m"
+      memory: "1Gi"
+    limits:
+      cpu: "1"
+      memory: "4Gi"
+  postgresql:
+    parameters:
+      max_connections: "300"
+      shared_buffers: "512MB"
+      effective_cache_size: "2GB"
+  managed:
+    roles:
+    - name: memelord-sala
+      ensure: present
+      login: true
+      passwordSecret:
+        name: memelord-sala-database
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: memelord-sala
+spec:
+  name: memelord-sala
+  owner: memelord-sala
+  cluster:
+    name: memelord-sala-database

templates/redis.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: secretgenerator.mittwald.de/v1alpha1
+kind: StringSecret
+metadata:
+  name: memelord-sala-redis
+spec:
+  fields:
+    - fieldName: redis-password
+      length: "32"
+      encoding: hex
+---
+apiVersion: dragonflydb.io/v1alpha1
+kind: Dragonfly
+metadata:
+  name: memelord-sala-redis
+spec:
+  authentication:
+    passwordFromSecret:
+      name: memelord-sala-redis
+      key: redis-password
+  replicas: 1
+  resources:
+    requests:
+      cpu: 500m
+      memory: 500Mi
+    limits:
+      cpu: 600m
+      memory: 750Mi

templates/s3.yaml

@@ -0,0 +1,48 @@
+---
+apiVersion: s3.onyxia.sh/v1alpha1
+kind: Policy
+metadata:
+  name: memelord-sala-policy
+spec:
+  name: memelord-sala-policy
+  s3InstanceRef: minio/default
+  policyContent: >-
+    {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "s3:ListBucket",
+            "s3:GetObject",
+            "s3:PutObject"
+          ],
+          "Resource": [
+            "arn:aws:s3:::memelord-sala",
+            "arn:aws:s3:::memelord-sala/*"
+          ]
+        }
+      ]
+    }
+---
+apiVersion: s3.onyxia.sh/v1alpha1
+kind: S3User
+metadata:
+  name: memelord-sala-bucket
+spec:
+  accessKey: memelord-sala-bucket # This is automatically created
+  policies:
+    - memelord-sala-policy
+  s3InstanceRef: minio/default
+---
+apiVersion: s3.onyxia.sh/v1alpha1
+kind: Bucket
+metadata:
+  name: memelord-sala
+spec:
+  name: memelord-sala
+  s3InstanceRef: minio/default
+  quota:
+    default: 100000000
+
+