feat(paperless-ngx): Move to separate k8s namespace

README.md

@@ -62,6 +62,7 @@ Currently, the applications being deployed like this are:
 - `hedgedoc`
 - `kitchenowl`
 - `forgejo`
+- `paperless-ngx`
 
 ## Known bugs
 

flake-parts/kubenix.nix

@@ -84,4 +84,6 @@
       "${self}/kubenix-modules/kitchenowl.nix" "kitchenowl" "kitchenowl";
     kubenix.forgejo = mkDeployScriptAndManifest
       "${self}/kubenix-modules/forgejo" "forgejo" "forgejo";
+    kubenix.paperless = mkDeployScriptAndManifest
+      "${self}/kubenix-modules/paperless.nix" "paperless" "paperless";
   })

kubenix-modules/all.nix

@@ -3,7 +3,6 @@ let
     ./inbucket.nix
     ./syncthing.nix
     ./pihole.nix
-    ./paperless.nix
     ./media.nix
     ./bind9
     ./dnsmasq.nix

kubenix-modules/base.nix

@@ -70,6 +70,7 @@
           hedgedoc = { };
           kitchenowl = { };
           forgejo = { };
+          paperless = { };
         };
 
         nodes =

kubenix-modules/paperless.nix

@@ -1,46 +1,24 @@
 {
   kubernetes.resources = {
-    configMaps = {
+    secrets = {
-      paperless.data = {
+      database.stringData.password = "ref+sops://secrets/kubernetes.yaml#/paperless/databasePassword";
-        PAPERLESS_REDIS = "redis://paperless-redis.default.svc.cluster.local:6379";
+      server.stringData.secretKey = "ref+sops://secrets/kubernetes.yaml#/paperless/secretKey";
-        PAPERLESS_DBENGINE = "postgresql";
-        PAPERLESS_DBHOST = "paperless-db.default.svc.cluster.local";
-        PAPERLESS_DBNAME = "paperless";
-        PAPERLESS_DBUSER = "paperless";
-        PAPERLESS_DATA_DIR = "/data/";
-        PAPERLESS_MEDIA_ROOT = "/data/";
-        PAPERLESS_OCR_LANGUAGES = "nld eng";
-        PAPERLESS_URL = "https://paperless.kun.is";
-        PAPERLESS_TIME_ZONE = "Europe/Amsterdam";
-        PAPERLESS_OCR_LANGUAGE = "nld";
-        USERMAP_UID = "33";
-        USERMAP_GID = "33";
-      };
-
-      paperless-db-env.data = {
-        POSTGRES_DB = "paperless";
-        POSTGRES_USER = "paperless";
-        POSTGRES_PASSWORD = "ref+sops://secrets/kubernetes.yaml#/paperless/databasePassword";
-        PGDATA = "/pgdata/data";
-      };
-    };
-
-    secrets.paperless.stringData = {
-      databasePassword = "ref+sops://secrets/kubernetes.yaml#/paperless/databasePassword";
-      secretKey = "ref+sops://secrets/kubernetes.yaml#/paperless/secretKey";
     };
 
     deployments = {
-      paperless-web = {
+      server.spec = {
-        metadata.labels = {
+        selector.matchLabels = {
           app = "paperless";
           component = "web";
         };
 
-        spec = {
+        strategy = {
-          selector.matchLabels = {
+          type = "RollingUpdate";
-            app = "paperless";
+
-            component = "web";
+          rollingUpdate = {
+            maxSurge = 0;
+            maxUnavailable = 1;
+          };
         };
 
         template = {
@@ -50,20 +28,35 @@
           };
 
           spec = {
-              volumes.data.persistentVolumeClaim.claimName = "paperless-data";
+            volumes.data.persistentVolumeClaim.claimName = "data";
 
             containers.paperless = {
               image = "ghcr.io/paperless-ngx/paperless-ngx:2.3";
-                envFrom = [{ configMapRef.name = "paperless"; }];
+              imagePullPolicy = "Always";
               ports.web.containerPort = 8000;
 
               env = {
+                PAPERLESS_REDIS.value = "redis://redis.paperless.svc.cluster.local:6379";
+                PAPERLESS_DBENGINE.value = "postgresql";
+                PAPERLESS_DBHOST.value = "database.paperless.svc.cluster.local";
+                PAPERLESS_DBNAME.value = "paperless";
+                PAPERLESS_DBUSER.value = "paperless";
+                PAPERLESS_DATA_DIR.value = "/data/";
+                PAPERLESS_MEDIA_ROOT.value = "/data/";
+                PAPERLESS_OCR_LANGUAGES.value = "nld eng";
+                PAPERLESS_URL.value = "https://paperless.kun.is";
+                PAPERLESS_TIME_ZONE.value = "Europe/Amsterdam";
+                PAPERLESS_OCR_LANGUAGE.value = "nld";
+                USERMAP_UID.value = "33";
+                USERMAP_GID.value = "33";
+
                 PAPERLESS_DBPASS.valueFrom.secretKeyRef = {
-                    name = "paperless";
+                  name = "database";
-                    key = "databasePassword";
+                  key = "password";
                 };
+
                 PAPERLESS_SECRET_KEY.valueFrom.secretKeyRef = {
-                    name = "paperless";
+                  name = "server";
                   key = "secretKey";
                 };
               };
@@ -81,20 +74,22 @@
           };
         };
       };
-      };
 
-      paperless-redis = {
+      redis.spec = {
-        metadata.labels = {
-          app = "paperless";
-          component = "redis";
-        };
-
-        spec = {
         selector.matchLabels = {
           app = "paperless";
           component = "redis";
         };
 
+        strategy = {
+          type = "RollingUpdate";
+
+          rollingUpdate = {
+            maxSurge = 0;
+            maxUnavailable = 1;
+          };
+        };
+
         template = {
           metadata.labels = {
             app = "paperless";
@@ -102,11 +97,12 @@
           };
 
           spec = {
-              volumes.data.persistentVolumeClaim.claimName = "paperless-redisdata";
+            volumes.data.persistentVolumeClaim.claimName = "redisdata";
 
             containers.redis = {
               image = "docker.io/library/redis:7";
               ports.redis.containerPort = 6379;
+              imagePullPolicy = "Always";
 
               volumeMounts = [{
                 name = "data";
@@ -121,20 +117,22 @@
           };
         };
       };
-      };
 
-      paperless-db = {
+      database.spec = {
-        metadata.labels = {
-          app = "paperless";
-          component = "database";
-        };
-
-        spec = {
         selector.matchLabels = {
           app = "paperless";
           component = "database";
         };
 
+        strategy = {
+          type = "RollingUpdate";
+
+          rollingUpdate = {
+            maxSurge = 0;
+            maxUnavailable = 1;
+          };
+        };
+
         template = {
           metadata.labels = {
             app = "paperless";
@@ -144,9 +142,19 @@
           spec = {
             containers.postgres = {
               image = "postgres:15";
-                imagePullPolicy = "IfNotPresent";
               ports.postgres.containerPort = 5432;
-                envFrom = [{ configMapRef.name = "paperless-db-env"; }];
+              imagePullPolicy = "Always";
+
+              env = {
+                POSTGRES_DB.value = "paperless";
+                POSTGRES_USER.value = "paperless";
+                PGDATA.value = "/pgdata/data";
+
+                POSTGRES_PASSWORD.valueFrom.secretKeyRef = {
+                  name = "database";
+                  key = "password";
+                };
+              };
 
               volumeMounts = [{
                 name = "data";
@@ -154,15 +162,14 @@
               }];
             };
 
-              volumes.data.persistentVolumeClaim.claimName = "paperless-db";
+            volumes.data.persistentVolumeClaim.claimName = "database";
-            };
           };
         };
       };
     };
 
     services = {
-      paperless-web.spec = {
+      web.spec = {
         selector = {
           app = "paperless";
           component = "web";
@@ -174,7 +181,7 @@
         };
       };
 
-      paperless-redis.spec = {
+      redis.spec = {
         selector = {
           app = "paperless";
           component = "redis";
@@ -186,7 +193,7 @@
         };
       };
 
-      paperless-db.spec = {
+      database.spec = {
         selector = {
           app = "paperless";
           component = "database";
@@ -201,13 +208,30 @@
   };
 
   lab = {
-    ingresses.paperless = {
+    ingresses.web = {
       host = "paperless.kun.is";
 
       service = {
-        name = "paperless-web";
+        name = "web";
         portName = "web";
       };
     };
+
+    longhorn.persistentVolumeClaim = {
+      data = {
+        volumeName = "paperless-data";
+        storage = "10Gi";
+      };
+
+      redisdata = {
+        volumeName = "paperless-redisdata";
+        storage = "20Mi";
+      };
+
+      database = {
+        volumeName = "paperless-db";
+        storage = "150Mi";
+      };
+    };
   };
 }

kubenix-modules/volumes.nix

@@ -18,9 +18,6 @@
       pihole-data.storage = "750Mi";
       pihole-dnsmasq.storage = "16Mi";
       syncthing.storage = "400Mi";
-      paperless-data.storage = "10Gi";
-      paperless-redisdata.storage = "20Mi";
-      paperless-db.storage = "150Mi";
       jellyfin.storage = "5Gi";
       transmission.storage = "25Mi";
       jellyseerr.storage = "75Mi";
@@ -45,6 +42,9 @@
       hedgedoc-db.storage = "100Mi";
       kitchenowl.storage = "100Mi";
       forgejo.storage = "20Gi";
+      paperless-data.storage = "10Gi";
+      paperless-redisdata.storage = "20Mi";
+      paperless-db.storage = "150Mi";
     };
 
     nfsVolumes = {