home/nixos-servers
home/nixos-servers
2
0
Fork 0
Code Issues 8 Pull requests Projects Releases Packages Wiki Activity Actions

refactor: Convert configmaps containing secrets to secrets

Browse source 
closes #85
This commit is contained in:
Pim Kunis 2024-08-04 14:59:11 +02:00
parent 2c0a60097a
commit 5432d93f85
4 changed files with 35 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
kubenix-modules/attic.nix
View file

@ -40,10 +40,12 @@
generatedConfig = (pkgs.formats.toml { }).generate "attic.toml" atticSettings; generatedConfig = (pkgs.formats.toml { }).generate "attic.toml" atticSettings;
in in
{ {
configMaps.config.data.config = builtins.readFile generatedConfig;
secrets = { secrets = {
server.stringData.token = "ref+sops://secrets/kubernetes.yaml#attic/jwtToken"; server.stringData = {
token = "ref+sops://secrets/kubernetes.yaml#attic/jwtToken";
config = builtins.readFile generatedConfig;
};
database.stringData.password = "ref+sops://secrets/kubernetes.yaml#/attic/databasePassword"; database.stringData.password = "ref+sops://secrets/kubernetes.yaml#/attic/databasePassword";
}; };
@ -54,6 +56,15 @@
component = "website"; component = "website";
}; };
strategy = {
type = "RollingUpdate";
rollingUpdate = {
maxSurge = 0;
maxUnavailable = 1;
};
};
template = { template = {
metadata.labels = { metadata.labels = {
app = "attic"; app = "attic";
@ -86,7 +97,7 @@
volumes = { volumes = {
data.persistentVolumeClaim.claimName = "data"; data.persistentVolumeClaim.claimName = "data";
config.configMap.name = "config"; config.secret.secretName = "server";
}; };
securityContext = { securityContext = {

8
kubenix-modules/forgejo/default.nix
View file

@ -1,10 +1,6 @@
{ lib, myLib, ... }: { { lib, myLib, ... }: {
kubernetes.resources = { kubernetes.resources = {
configMaps = { secrets.forgejo.stringData.config = lib.generators.toINI { } (import ./config.nix);
config.data = {
config = lib.generators.toINI { } (import ./config.nix);
};
};
deployments.server.spec = { deployments.server.spec = {
selector.matchLabels.app = "forgejo"; selector.matchLabels.app = "forgejo";
@ -55,7 +51,7 @@
volumes = { volumes = {
data.persistentVolumeClaim.claimName = "data"; data.persistentVolumeClaim.claimName = "data";
config.configMap.name = "config"; config.secret.secretName = "forgejo";
}; };
}; };
}; };

7
kubenix-modules/hedgedoc.nix
View file

@ -7,6 +7,7 @@
secrets.hedgedoc.stringData = { secrets.hedgedoc.stringData = {
databaseURL = "ref+sops://secrets/kubernetes.yaml#/hedgedoc/databaseURL"; databaseURL = "ref+sops://secrets/kubernetes.yaml#/hedgedoc/databaseURL";
sessionSecret = "ref+sops://secrets/kubernetes.yaml#/hedgedoc/sessionSecret"; sessionSecret = "ref+sops://secrets/kubernetes.yaml#/hedgedoc/sessionSecret";
databasePassword = "ref+sops://secrets/kubernetes.yaml#/hedgedoc/databasePassword";
}; };
deployments = { deployments = {
@ -94,8 +95,12 @@
env = { env = {
POSTGRES_DB.value = "hedgedoc"; POSTGRES_DB.value = "hedgedoc";
POSTGRES_USER.value = "hedgedoc"; POSTGRES_USER.value = "hedgedoc";
POSTGRES_PASSWORD.value = "ref+sops://secrets/kubernetes.yaml#/hedgedoc/databasePassword";
PGDATA.value = "/pgdata/data"; PGDATA.value = "/pgdata/data";
POSTGRES_PASSWORD.valueFrom.secretKeyRef = {
name = "hedgedoc";
key = "databasePassword";
};
}; };
volumeMounts = [{ volumeMounts = [{

14
kubenix-modules/immich.nix
View file

@ -1,5 +1,7 @@
{ myLib, ... }: { { myLib, ... }: {
kubernetes.resources = { kubernetes.resources = {
secrets.immich.stringData.databasePassword = "ref+sops://secrets/kubernetes.yaml#/immich/databasePassword";
deployments = { deployments = {
immich.spec = { immich.spec = {
selector.matchLabels = { selector.matchLabels = {
@ -37,9 +39,13 @@
REDIS_HOSTNAME.value = "redis.immich.svc.cluster.local"; REDIS_HOSTNAME.value = "redis.immich.svc.cluster.local";
DB_HOSTNAME.value = "postgres.immich.svc.cluster.local"; DB_HOSTNAME.value = "postgres.immich.svc.cluster.local";
DB_USERNAME.value = "postgres"; DB_USERNAME.value = "postgres";
DB_PASSWORD.value = "ref+sops://secrets/kubernetes.yaml#/immich/databasePassword";
DB_DATABASE_NAME.value = "immich"; DB_DATABASE_NAME.value = "immich";
IMMICH_MACHINE_LEARNING_URL.value = "http://ml.immich.svc.cluster.local"; IMMICH_MACHINE_LEARNING_URL.value = "http://ml.immich.svc.cluster.local";
DB_PASSWORD.valueFrom.secretKeyRef = {
name = "immich";
key = "databasePassword";
};
}; };
volumeMounts = [{ volumeMounts = [{
@ -155,11 +161,15 @@
securityContext.runAsGroup = 999; securityContext.runAsGroup = 999;
env = { env = {
POSTGRES_PASSWORD.value = "ref+sops://secrets/kubernetes.yaml#/immich/databasePassword";
POSTGRES_USER.value = "postgres"; POSTGRES_USER.value = "postgres";
POSTGRES_DB.value = "immich"; POSTGRES_DB.value = "immich";
POSTGRES_INITDB_ARGS.value = "--data-checksums"; POSTGRES_INITDB_ARGS.value = "--data-checksums";
PGDATA.value = "/pgdata/data"; PGDATA.value = "/pgdata/data";
POSTGRES_PASSWORD.valueFrom.secretKeyRef = {
name = "immich";
key = "databasePassword";
};
}; };
volumeMounts = [{ volumeMounts = [{