Migrate attic database to kubernetes

This commit is contained in:
Pim Kunis 2024-05-25 17:02:35 +02:00
parent 93f0aa7fde
commit 964f76af14
4 changed files with 122 additions and 49 deletions

View file

@ -1,8 +1,8 @@
{ pkgs, ... }: { { pkgs, ... }: {
kubernetes.resources = kubernetes.resources =
let let
atticdSettings = { atticSettings = {
database.url = "ref+sops://secrets/sops.yaml#atticd/databaseURL"; database.url = "ref+sops://secrets/sops.yaml#attic/databaseURL";
storage = { storage = {
type = "local"; type = "local";
@ -34,74 +34,146 @@
max-size = 256 * 1024; # 256 KiB max-size = 256 * 1024; # 256 KiB
}; };
}; };
generatedConfig = (pkgs.formats.toml { }).generate "atticd.toml" atticdSettings; generatedConfig = (pkgs.formats.toml { }).generate "attic.toml" atticSettings;
in in
{ {
configMaps = { configMaps = {
atticd-env.data.ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64 = "ref+sops://secrets/sops.yaml#atticd/jwtToken"; attic-env.data.ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64 = "ref+sops://secrets/sops.yaml#attic/jwtToken";
atticd-config.data.config = builtins.readFile generatedConfig; attic-config.data.config = builtins.readFile generatedConfig;
attic-db-env.data = {
POSTGRES_DB = "attic";
POSTGRES_USER = "attic";
POSTGRES_PASSWORD = "ref+sops://secrets/sops.yaml#/attic/databasePassword";
PGDATA = "/pgdata/data";
};
}; };
deployments.atticd = { deployments = {
metadata.labels.app = "atticd"; attic = {
metadata.labels = {
app = "attic";
component = "website";
};
spec = { spec = {
selector.matchLabels.app = "atticd"; selector.matchLabels = {
app = "attic";
component = "website";
};
template = { template = {
metadata.labels.app = "atticd"; metadata.labels = {
app = "attic";
component = "website";
};
spec = { spec = {
containers.atticd = { containers.attic = {
image = "git.kun.is/home/atticd:fd910d91c2143295e959d2c903e9ea25cf94ba27"; image = "git.kun.is/home/atticd:fd910d91c2143295e959d2c903e9ea25cf94ba27";
envFrom = [{ configMapRef.name = "atticd-env"; }]; envFrom = [{ configMapRef.name = "attic-env"; }];
ports.web.containerPort = 8080; ports.web.containerPort = 8080;
args = [ "-f" "/etc/atticd/config.toml" ]; args = [ "-f" "/etc/atticd/config.toml" ];
volumeMounts = [ volumeMounts = [
{ {
name = "data";
mountPath = "/var/lib/atticd/storage";
}
{
name = "config";
mountPath = "/etc/atticd/config.toml";
subPath = "config";
}
];
};
volumes = {
data.persistentVolumeClaim.claimName = "attic";
config.configMap.name = "attic-config";
};
securityContext = {
fsGroup = 0;
fsGroupChangePolicy = "OnRootMismatch";
};
};
};
};
};
attic-db = {
metadata.labels = {
app = "attic";
component = "database";
};
spec = {
selector.matchLabels = {
app = "attic";
component = "database";
};
template = {
metadata.labels = {
app = "attic";
component = "database";
};
spec = {
containers.postgres = {
image = "postgres:15";
imagePullPolicy = "IfNotPresent";
ports.postgres.containerPort = 5432;
envFrom = [{ configMapRef.name = "attic-db-env"; }];
volumeMounts = [{
name = "data"; name = "data";
mountPath = "/var/lib/atticd/storage"; mountPath = "/pgdata";
} }];
{ };
name = "config";
mountPath = "/etc/atticd/config.toml";
subPath = "config";
}
];
};
volumes = { volumes.data.persistentVolumeClaim.claimName = "attic-db";
data.persistentVolumeClaim.claimName = "attic";
config.configMap.name = "atticd-config";
};
securityContext = {
fsGroup = 0;
fsGroupChangePolicy = "OnRootMismatch";
}; };
}; };
}; };
}; };
}; };
services.atticd.spec = { services = {
selector.app = "atticd"; attic.spec = {
selector = {
app = "attic";
component = "website";
};
ports.web = { ports.web = {
port = 80; port = 80;
targetPort = "web"; targetPort = "web";
};
};
attic-db.spec = {
selector = {
app = "attic";
component = "database";
};
ports.postgres = {
port = 5432;
targetPort = "postgres";
};
}; };
}; };
}; };
lab = { lab = {
ingresses.atticd = { ingresses.attic = {
host = "attic.kun.is"; host = "attic.kun.is";
entrypoint = "localsecure"; entrypoint = "localsecure";
service = { service = {
name = "atticd"; name = "attic";
portName = "web"; portName = "web";
}; };
}; };

View file

@ -22,6 +22,7 @@
sonarr.storage = "150Mi"; sonarr.storage = "150Mi";
bazarr.storage = "25Mi"; bazarr.storage = "25Mi";
attic.storage = "15Gi"; attic.storage = "15Gi";
attic-db.storage = "150Mi";
}; };
nfsVolumes = { nfsVolumes = {

View file

@ -70,7 +70,6 @@ in
authentication = '' authentication = ''
host nextcloud nextcloud all md5 host nextcloud nextcloud all md5
host paperless paperless all md5 host paperless paperless all md5
host attic attic all md5
''; '';
}; };
}; };

View file

@ -16,9 +16,10 @@ kitchenowl:
forgejo: forgejo:
lfsJwtSecret: ENC[AES256_GCM,data:TZaptdiX/3HT2Q5lHqAOEQBkT3gV49dD6+RIludIcJVA6AevijgDonuVQA==,iv:hwU0K4JjFs8LaSNe5Dqmsj5Vz/w3sOWgSrnEW22bM/M=,tag:RJTDtYqRQdGVQ6PO2V+31g==,type:str] lfsJwtSecret: ENC[AES256_GCM,data:TZaptdiX/3HT2Q5lHqAOEQBkT3gV49dD6+RIludIcJVA6AevijgDonuVQA==,iv:hwU0K4JjFs8LaSNe5Dqmsj5Vz/w3sOWgSrnEW22bM/M=,tag:RJTDtYqRQdGVQ6PO2V+31g==,type:str]
internalToken: ENC[AES256_GCM,data:28sIm0OW2G48ZECjCf5WM9/O5kbo54S96aD20MYfGrK0pbxgAwLjL8jXO/dNobSQ+26vet2WKfLbC9MPdBjhsQ5zC/keGHUFw6TPqnuhFchTLnP+JvMoqNZzcRo2kHi/EM93luG6xQvy,iv:Iy+1EVS7lvLust4MPkxyFonna/q1NVzRyMcTSJ3F5oM=,tag:v075jl/jtqcjSkEhRZVO2g==,type:str] internalToken: ENC[AES256_GCM,data:28sIm0OW2G48ZECjCf5WM9/O5kbo54S96aD20MYfGrK0pbxgAwLjL8jXO/dNobSQ+26vet2WKfLbC9MPdBjhsQ5zC/keGHUFw6TPqnuhFchTLnP+JvMoqNZzcRo2kHi/EM93luG6xQvy,iv:Iy+1EVS7lvLust4MPkxyFonna/q1NVzRyMcTSJ3F5oM=,tag:v075jl/jtqcjSkEhRZVO2g==,type:str]
atticd: attic:
jwtToken: ENC[AES256_GCM,data:DTiREnIdZxsewzLXeZgERBJKorUuqI71TgmUyKyc8iH6ioJLciU/9wfLiO+ltUA+3eEnuyuJHTpFwtLS0Wrjh5G4kYNkiX6Mw1bEJZnR+x2xJAJmfa4sJw==,iv:8jJfPosy02vezJOA0oKSphUItWqQ0Pr1cc8rBSuSawE=,tag:p+dZBP5+EYHjtTH9EkdYsw==,type:str] jwtToken: ENC[AES256_GCM,data:bEf5v8KhIgyKqyjYOzBmJrZ71GagXqOTH+I3J0Iu+Q3X6XUbGxjwW5/RT3AuJAJ+Owp1Uyk26FmEuurYChG13rBWZ0R85MeMBb2sZ/Q22TXeBxRwzq4Izg==,iv:VlIhxGE8I8W+UFyDLnhUxDzf/us95H86V2FLbsKMSGw=,tag:ynz5eNuxkAl35qzcDNzoAw==,type:str]
databaseURL: ENC[AES256_GCM,data:beyFNmbapw9asGHZN52taNx6klO3IQJ7wXbYTvo1NMaFyvo5qk2osocrwkeVv3w8bUWGgbQ/LKLuvg==,iv:qGFwhuLj0ApY9EpclM0x1nVBqXjv8XZC58cy6AE3AtQ=,tag:an+slq4Wlh7/sunX44yxOQ==,type:str] databaseURL: ENC[AES256_GCM,data:GZcr8hRVIDwhKKwzHygydXAuJpQjKjN95GK+oqb33QgS5HW647+J5wGXxYan9II6iC0N3oSi36cJIkwIjLr9SJhRcjCkdsCZfNrGmT+F9SqUIi8=,iv:HerbEz1oPCE1F1etWHpFkSvulGRU97KPTcrZauIZQNM=,tag:/UXgWvnmCexvxwQONnmATg==,type:str]
databasePassword: ENC[AES256_GCM,data:AZXZyNJ6tGG3OU9CgC+bj43471Q=,iv:DoTSTIMLFi1+U7lvkix+QM8tP1tR0TtxuZRKlBneYek=,tag:+zk8TJRUzk9tNYXGLWIN2w==,type:str]
sops: sops:
kms: [] kms: []
gcp_kms: [] gcp_kms: []
@ -43,8 +44,8 @@ sops:
cHJRZWpDdWZlSnh3Qm1GZ28vZ0p0ZjAK7+BS6YQ2cUD21XCISBeNLSUNgNFQfSKI cHJRZWpDdWZlSnh3Qm1GZ28vZ0p0ZjAK7+BS6YQ2cUD21XCISBeNLSUNgNFQfSKI
zL/AAqsVoBTrEs7s9fxmWmVm21/M3ZTYfU6Z6gIr6YEWe1pehRd6ZQ== zL/AAqsVoBTrEs7s9fxmWmVm21/M3ZTYfU6Z6gIr6YEWe1pehRd6ZQ==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2024-05-25T14:05:10Z" lastmodified: "2024-05-25T14:56:33Z"
mac: ENC[AES256_GCM,data:x0PAMb5EtfuOSzfBv0chWBQUz4+grZEZbzRpXp0xKgMX72jFV+RmmJGL4jfaVXFKnNyFRecQn92UhBNHx1JOVmDMdnEY50CNe3+H6oTTNJpgXRjebIs82NtwbQM/0wUB7PPSFjC0cKAONx5djAnXEs9pRUmRyWMI5I0Uhxz9FCA=,iv:H0JuHLcP0P83e4kaY0mPQRFbMRr6uUcTdRquWSD/VbQ=,tag:k72CmvwU5doNldpFlUy/TQ==,type:str] mac: ENC[AES256_GCM,data:372x93C9PcSp1Snz0zXSwyeOd74wgvoSYClWq4IF7CskFrNgFOl3zDbHtpp2i510LSuzxaPhFuJJm0LXFmHnRJUIgC3D9MyDLxP5Wp0rvfICNmsww9iSNplMN1i3jqHncYtB2rRYN30y5Bo+AJSWto237hcd7fIUgWHGw5Jdk2o=,iv:hzOzgoDQzghTlzKAocnFPPXoBjiZ6VWoJUNbXhdH/OA=,tag:AvyPVMGySMoBQVoNkTdFFQ==,type:str]
pgp: [] pgp: []
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.8.1 version: 3.8.1