feat(paperless-ngx): Move to separate k8s namespace

README.md

@@ -62,6 +62,7 @@ Currently, the applications being deployed like this are:
 - `hedgedoc`
 - `kitchenowl`
 - `forgejo`
+- `paperless-ngx`
 
 ## Known bugs
 

flake-parts/kubenix.nix

@@ -84,4 +84,6 @@
       "${self}/kubenix-modules/kitchenowl.nix" "kitchenowl" "kitchenowl";
     kubenix.forgejo = mkDeployScriptAndManifest
       "${self}/kubenix-modules/forgejo" "forgejo" "forgejo";
+    kubenix.paperless = mkDeployScriptAndManifest
+      "${self}/kubenix-modules/paperless.nix" "paperless" "paperless";
   })

kubenix-modules/all.nix

@@ -3,7 +3,6 @@ let
     ./inbucket.nix
     ./syncthing.nix
     ./pihole.nix
-    ./paperless.nix
     ./media.nix
     ./bind9
     ./dnsmasq.nix

kubenix-modules/base.nix

@@ -70,6 +70,7 @@
           hedgedoc = { };
           kitchenowl = { };
           forgejo = { };
+          paperless = { };
         };
 
         nodes =

kubenix-modules/paperless.nix

@@ -1,168 +1,175 @@
 {
   kubernetes.resources = {
-    configMaps = {
+    secrets = {
-      paperless.data = {
+      database.stringData.password = "ref+sops://secrets/kubernetes.yaml#/paperless/databasePassword";
-        PAPERLESS_REDIS = "redis://paperless-redis.default.svc.cluster.local:6379";
+      server.stringData.secretKey = "ref+sops://secrets/kubernetes.yaml#/paperless/secretKey";
-        PAPERLESS_DBENGINE = "postgresql";
-        PAPERLESS_DBHOST = "paperless-db.default.svc.cluster.local";
-        PAPERLESS_DBNAME = "paperless";
-        PAPERLESS_DBUSER = "paperless";
-        PAPERLESS_DATA_DIR = "/data/";
-        PAPERLESS_MEDIA_ROOT = "/data/";
-        PAPERLESS_OCR_LANGUAGES = "nld eng";
-        PAPERLESS_URL = "https://paperless.kun.is";
-        PAPERLESS_TIME_ZONE = "Europe/Amsterdam";
-        PAPERLESS_OCR_LANGUAGE = "nld";
-        USERMAP_UID = "33";
-        USERMAP_GID = "33";
-      };
-
-      paperless-db-env.data = {
-        POSTGRES_DB = "paperless";
-        POSTGRES_USER = "paperless";
-        POSTGRES_PASSWORD = "ref+sops://secrets/kubernetes.yaml#/paperless/databasePassword";
-        PGDATA = "/pgdata/data";
-      };
-    };
-
-    secrets.paperless.stringData = {
-      databasePassword = "ref+sops://secrets/kubernetes.yaml#/paperless/databasePassword";
-      secretKey = "ref+sops://secrets/kubernetes.yaml#/paperless/secretKey";
     };
 
     deployments = {
-      paperless-web = {
+      server.spec = {
-        metadata.labels = {
+        selector.matchLabels = {
           app = "paperless";
           component = "web";
         };
 
-        spec = {
+        strategy = {
-          selector.matchLabels = {
+          type = "RollingUpdate";
+
+          rollingUpdate = {
+            maxSurge = 0;
+            maxUnavailable = 1;
+          };
+        };
+
+        template = {
+          metadata.labels = {
             app = "paperless";
             component = "web";
           };
 
-          template = {
+          spec = {
-            metadata.labels = {
+            volumes.data.persistentVolumeClaim.claimName = "data";
-              app = "paperless";
-              component = "web";
-            };
 
-            spec = {
+            containers.paperless = {
-              volumes.data.persistentVolumeClaim.claimName = "paperless-data";
+              image = "ghcr.io/paperless-ngx/paperless-ngx:2.3";
+              imagePullPolicy = "Always";
+              ports.web.containerPort = 8000;
 
-              containers.paperless = {
+              env = {
-                image = "ghcr.io/paperless-ngx/paperless-ngx:2.3";
+                PAPERLESS_REDIS.value = "redis://redis.paperless.svc.cluster.local:6379";
-                envFrom = [{ configMapRef.name = "paperless"; }];
+                PAPERLESS_DBENGINE.value = "postgresql";
-                ports.web.containerPort = 8000;
+                PAPERLESS_DBHOST.value = "database.paperless.svc.cluster.local";
+                PAPERLESS_DBNAME.value = "paperless";
+                PAPERLESS_DBUSER.value = "paperless";
+                PAPERLESS_DATA_DIR.value = "/data/";
+                PAPERLESS_MEDIA_ROOT.value = "/data/";
+                PAPERLESS_OCR_LANGUAGES.value = "nld eng";
+                PAPERLESS_URL.value = "https://paperless.kun.is";
+                PAPERLESS_TIME_ZONE.value = "Europe/Amsterdam";
+                PAPERLESS_OCR_LANGUAGE.value = "nld";
+                USERMAP_UID.value = "33";
+                USERMAP_GID.value = "33";
 
-                env = {
+                PAPERLESS_DBPASS.valueFrom.secretKeyRef = {
-                  PAPERLESS_DBPASS.valueFrom.secretKeyRef = {
+                  name = "database";
-                    name = "paperless";
+                  key = "password";
-                    key = "databasePassword";
-                  };
-                  PAPERLESS_SECRET_KEY.valueFrom.secretKeyRef = {
-                    name = "paperless";
-                    key = "secretKey";
-                  };
                 };
 
-                volumeMounts = [{
+                PAPERLESS_SECRET_KEY.valueFrom.secretKeyRef = {
-                  name = "data";
+                  name = "server";
-                  mountPath = "/data";
+                  key = "secretKey";
-                }];
+                };
               };
 
-              securityContext = {
+              volumeMounts = [{
-                fsGroup = 33;
+                name = "data";
-                fsGroupChangePolicy = "OnRootMismatch";
+                mountPath = "/data";
-              };
+              }];
+            };
+
+            securityContext = {
+              fsGroup = 33;
+              fsGroupChangePolicy = "OnRootMismatch";
             };
           };
         };
       };
 
-      paperless-redis = {
+      redis.spec = {
-        metadata.labels = {
+        selector.matchLabels = {
           app = "paperless";
           component = "redis";
         };
 
-        spec = {
+        strategy = {
-          selector.matchLabels = {
+          type = "RollingUpdate";
+
+          rollingUpdate = {
+            maxSurge = 0;
+            maxUnavailable = 1;
+          };
+        };
+
+        template = {
+          metadata.labels = {
             app = "paperless";
             component = "redis";
           };
 
-          template = {
+          spec = {
-            metadata.labels = {
+            volumes.data.persistentVolumeClaim.claimName = "redisdata";
-              app = "paperless";
+
-              component = "redis";
+            containers.redis = {
+              image = "docker.io/library/redis:7";
+              ports.redis.containerPort = 6379;
+              imagePullPolicy = "Always";
+
+              volumeMounts = [{
+                name = "data";
+                mountPath = "/data";
+              }];
             };
 
-            spec = {
+            securityContext = {
-              volumes.data.persistentVolumeClaim.claimName = "paperless-redisdata";
+              fsGroup = 999;
-
+              fsGroupChangePolicy = "OnRootMismatch";
-              containers.redis = {
-                image = "docker.io/library/redis:7";
-                ports.redis.containerPort = 6379;
-
-                volumeMounts = [{
-                  name = "data";
-                  mountPath = "/data";
-                }];
-              };
-
-              securityContext = {
-                fsGroup = 999;
-                fsGroupChangePolicy = "OnRootMismatch";
-              };
             };
           };
         };
       };
 
-      paperless-db = {
+      database.spec = {
-        metadata.labels = {
+        selector.matchLabels = {
           app = "paperless";
           component = "database";
         };
 
-        spec = {
+        strategy = {
-          selector.matchLabels = {
+          type = "RollingUpdate";
+
+          rollingUpdate = {
+            maxSurge = 0;
+            maxUnavailable = 1;
+          };
+        };
+
+        template = {
+          metadata.labels = {
             app = "paperless";
             component = "database";
           };
 
-          template = {
+          spec = {
-            metadata.labels = {
+            containers.postgres = {
-              app = "paperless";
+              image = "postgres:15";
-              component = "database";
+              ports.postgres.containerPort = 5432;
-            };
+              imagePullPolicy = "Always";
 
-            spec = {
+              env = {
-              containers.postgres = {
+                POSTGRES_DB.value = "paperless";
-                image = "postgres:15";
+                POSTGRES_USER.value = "paperless";
-                imagePullPolicy = "IfNotPresent";
+                PGDATA.value = "/pgdata/data";
-                ports.postgres.containerPort = 5432;
-                envFrom = [{ configMapRef.name = "paperless-db-env"; }];
 
-                volumeMounts = [{
+                POSTGRES_PASSWORD.valueFrom.secretKeyRef = {
-                  name = "data";
+                  name = "database";
-                  mountPath = "/pgdata";
+                  key = "password";
-                }];
+                };
               };
 
-              volumes.data.persistentVolumeClaim.claimName = "paperless-db";
+              volumeMounts = [{
+                name = "data";
+                mountPath = "/pgdata";
+              }];
             };
+
+            volumes.data.persistentVolumeClaim.claimName = "database";
           };
         };
       };
     };
 
     services = {
-      paperless-web.spec = {
+      web.spec = {
         selector = {
           app = "paperless";
           component = "web";
@@ -174,7 +181,7 @@
         };
       };
 
-      paperless-redis.spec = {
+      redis.spec = {
         selector = {
           app = "paperless";
           component = "redis";
@@ -186,7 +193,7 @@
         };
       };
 
-      paperless-db.spec = {
+      database.spec = {
         selector = {
           app = "paperless";
           component = "database";
@@ -201,13 +208,30 @@
   };
 
   lab = {
-    ingresses.paperless = {
+    ingresses.web = {
       host = "paperless.kun.is";
 
       service = {
-        name = "paperless-web";
+        name = "web";
         portName = "web";
       };
     };
+
+    longhorn.persistentVolumeClaim = {
+      data = {
+        volumeName = "paperless-data";
+        storage = "10Gi";
+      };
+
+      redisdata = {
+        volumeName = "paperless-redisdata";
+        storage = "20Mi";
+      };
+
+      database = {
+        volumeName = "paperless-db";
+        storage = "150Mi";
+      };
+    };
   };
 }

kubenix-modules/volumes.nix

@@ -18,9 +18,6 @@
       pihole-data.storage = "750Mi";
       pihole-dnsmasq.storage = "16Mi";
       syncthing.storage = "400Mi";
-      paperless-data.storage = "10Gi";
-      paperless-redisdata.storage = "20Mi";
-      paperless-db.storage = "150Mi";
       jellyfin.storage = "5Gi";
       transmission.storage = "25Mi";
       jellyseerr.storage = "75Mi";
@@ -45,6 +42,9 @@
       hedgedoc-db.storage = "100Mi";
       kitchenowl.storage = "100Mi";
       forgejo.storage = "20Gi";
+      paperless-data.storage = "10Gi";
+      paperless-redisdata.storage = "20Mi";
+      paperless-db.storage = "150Mi";
     };
 
     nfsVolumes = {