From f588c0f0bf15aa9d5d7bc4fa6dc2bcd6bdafe46c Mon Sep 17 00:00:00 2001 From: JJGadgets Date: Sat, 1 Mar 2025 03:05:35 +0800 Subject: [PATCH] feat: add maloja --- .../biohazard/flux/kustomization.yaml | 1 + kube/deploy/apps/maloja/app/es.yaml | 23 ++++ kube/deploy/apps/maloja/app/hr.yaml | 116 ++++++++++++++++++ kube/deploy/apps/maloja/app/ns.yaml | 10 ++ kube/deploy/apps/maloja/app/pvc.yaml | 16 +++ kube/deploy/apps/maloja/ks.yaml | 30 +++++ kube/deploy/apps/maloja/kustomization.yaml | 6 + 7 files changed, 202 insertions(+) create mode 100644 kube/deploy/apps/maloja/app/es.yaml create mode 100644 kube/deploy/apps/maloja/app/hr.yaml create mode 100644 kube/deploy/apps/maloja/app/ns.yaml create mode 100644 kube/deploy/apps/maloja/app/pvc.yaml create mode 100644 kube/deploy/apps/maloja/ks.yaml create mode 100644 kube/deploy/apps/maloja/kustomization.yaml diff --git a/kube/clusters/biohazard/flux/kustomization.yaml b/kube/clusters/biohazard/flux/kustomization.yaml index 8f97903b..a2c7591c 100644 --- a/kube/clusters/biohazard/flux/kustomization.yaml +++ b/kube/clusters/biohazard/flux/kustomization.yaml @@ -149,6 +149,7 @@ resources: - ../../../deploy/apps/stirling-pdf/ - ../../../deploy/apps/fortidynasync/ - ../../../deploy/apps/fava/ + - ../../../deploy/apps/maloja/ - ../../../deploy/vm/_kubevirt/ #- ../../../deploy/vm/_base/ - ../../../deploy/vm/ad/ diff --git a/kube/deploy/apps/maloja/app/es.yaml b/kube/deploy/apps/maloja/app/es.yaml new file mode 100644 index 00000000..3953569a --- /dev/null +++ b/kube/deploy/apps/maloja/app/es.yaml @@ -0,0 +1,23 @@ +--- +# yaml-language-server: $schema=https://crds.jank.ing/external-secrets.io/externalsecret_v1beta1.json +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: &name maloja-secrets + namespace: maloja +spec: + refreshInterval: 1m + secretStoreRef: + kind: ClusterSecretStore + name: 1p + dataFrom: + - extract: + key: "Maloja - ${CLUSTER_NAME}" + target: + creationPolicy: Owner + deletionPolicy: Retain + name: *name + # template: + # type: Opaque + # data: + # age.agekey: '{{ .agekey }}' diff --git a/kube/deploy/apps/maloja/app/hr.yaml b/kube/deploy/apps/maloja/app/hr.yaml new file mode 100644 index 00000000..d58203d2 --- /dev/null +++ b/kube/deploy/apps/maloja/app/hr.yaml @@ -0,0 +1,116 @@ +--- +# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/app-template-3.7.1/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: &app maloja + namespace: *app +spec: + interval: 5m + chart: + spec: + chart: app-template + version: 3.7.1 + sourceRef: + name: bjw-s + kind: HelmRepository + namespace: flux-system + values: + controllers: + maloja: + type: deployment + replicas: 1 + pod: + labels: + ingress.home.arpa/nginx-internal: allow + # egress.home.arpa/internet: allow + containers: + main: + image: &img + repository: docker.io/krateng/maloja + tag: 3.2.4@sha256:4ecea26058d2ca5168a8d53820279942d28f0606664cea6425f42371d5d88f95 + env: &env + TZ: &tz "${CONFIG_TZ}" + MALOJA_LOCATION_TIMEZONE: *tz + MALOJA_PORT: &http 8080 + # MALOJA_DATA_DIRECTORY: &pvc /data + MALOJA_DIRECTORY_CONFIG: &config /data/config + MALOJA_DIRECTORY_STATE: &state /data/config + MALOJA_DIRECTORY_CACHE: &cache /misc/cache + MALOJA_LOGGING: "false" # only for file logging + envFrom: &envFrom + - secretRef: + name: maloja-secrets + securityContext: &sc + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + resources: + requests: + cpu: 10m + requests: 128Mi + limits: + cpu: "1" + memory: 512Mi + probes: + liveness: + enabled: true + readiness: + enabled: true + service: + maloja: + controller: maloja + ports: + http: + port: *http + protocol: HTTP + appProtocol: http + ingress: + main: + className: nginx-internal + annotations: + nginx.ingress.kubernetes.io/whitelist-source-range: "${IP_JJ_V4:=127.0.0.1/32}" + hosts: + - host: &host "${APP_DNS_MALOJA:=maloja}" + paths: &paths + - path: / + pathType: Prefix + service: + identifier: maloja + port: http + tls: + - hosts: [*host] + persistence: + data: + existingClaim: maloja-data + globalMounts: + - subPath: data + path: *pvc + misc: + existingClaim: maloja-data + defaultPodOptions: + automountServiceAccountToken: false + enableServiceLinks: false + hostAliases: + - ip: "${APP_IP_AUTHENTIK:=127.0.0.1}" + hostnames: ["${APP_DNS_AUTHENTIK:=authentik}"] + dnsConfig: + options: + - name: ndots + value: "1" + hostUsers: false + securityContext: + runAsNonRoot: true + runAsUser: &uid 1000 + runAsGroup: *uid + fsGroup: *uid + fsGroupChangePolicy: Always + seccompProfile: { type: "RuntimeDefault" } + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: fuckoff.home.arpa/maloja + operator: DoesNotExist diff --git a/kube/deploy/apps/maloja/app/ns.yaml b/kube/deploy/apps/maloja/app/ns.yaml new file mode 100644 index 00000000..070c055d --- /dev/null +++ b/kube/deploy/apps/maloja/app/ns.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: maloja + labels: + kustomize.toolkit.fluxcd.io/prune: disabled + pod-security.kubernetes.io/enforce: &ps restricted + pod-security.kubernetes.io/audit: *ps + pod-security.kubernetes.io/warn: *ps diff --git a/kube/deploy/apps/maloja/app/pvc.yaml b/kube/deploy/apps/maloja/app/pvc.yaml new file mode 100644 index 00000000..f2f690dd --- /dev/null +++ b/kube/deploy/apps/maloja/app/pvc.yaml @@ -0,0 +1,16 @@ +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: "maloja-misc" + namespace: &app "maloja" + annotations: + description: "PVC for Maloja cache and others" + labels: + app.kubernetes.io/name: *app +spec: + storageClassName: "file-ec-2-1" + accessModes: ["ReadWriteMany"] + resources: + requests: + storage: "10Gi" diff --git a/kube/deploy/apps/maloja/ks.yaml b/kube/deploy/apps/maloja/ks.yaml new file mode 100644 index 00000000..8bf4486d --- /dev/null +++ b/kube/deploy/apps/maloja/ks.yaml @@ -0,0 +1,30 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: maloja-app + namespace: flux-system + labels: &l + app.kubernetes.io/name: "maloja" +spec: + targetNamespace: "maloja" + commonMetadata: + labels: *l + path: ./kube/deploy/apps/maloja/app + components: + - ../../../core/storage/volsync/component/ + - ../../../core/flux-system/alerts/template/ + dependsOn: + - name: crds + namespace: flux-system + postBuild: + substitute: + PVC: "maloja-data" + SIZE: "10Gi" + SC: &sc "file" + SNAP: *sc + ACCESSMODE: "ReadWriteMany" + SNAP_ACCESSMODE: "ReadOnlyMany" + RUID: &uid "1000" + RGID: *uid + RFSG: *uid diff --git a/kube/deploy/apps/maloja/kustomization.yaml b/kube/deploy/apps/maloja/kustomization.yaml new file mode 100644 index 00000000..45bc3673 --- /dev/null +++ b/kube/deploy/apps/maloja/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + # - ns.yaml + - ks.yaml