home/nixos-servers
home/nixos-servers
2
0
Fork 0
Code Issues 8 Pull requests Projects Releases Packages Wiki Activity Actions

Migrate paperless database to kubernetes

Browse source
This commit is contained in:
Pim Kunis 2024-05-25 17:35:00 +02:00
parent 964f76af14
commit c56a17fc4f
7 changed files with 232 additions and 169 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
kubenix-modules/all.nix
View file

@ -9,7 +9,7 @@ let
./nextcloud.nix ./nextcloud.nix
./pihole.nix ./pihole.nix
./hedgedoc.nix ./hedgedoc.nix
./paperless-ngx.nix ./paperless.nix
./kitchenowl.nix ./kitchenowl.nix
./forgejo ./forgejo
./media.nix ./media.nix

155
kubenix-modules/paperless-ngx.nix
View file

@ -1,155 +0,0 @@
{
kubernetes.resources = {
configMaps.paperless-ngx.data = {
PAPERLESS_REDIS = "redis://paperless-ngx-redis.default.svc.cluster.local:6379";
PAPERLESS_DBENGINE = "postgresql";
PAPERLESS_DBHOST = "lewis.dmz";
PAPERLESS_DBNAME = "paperless";
PAPERLESS_DBUSER = "paperless";
PAPERLESS_DATA_DIR = "/data/";
PAPERLESS_MEDIA_ROOT = "/data/";
PAPERLESS_OCR_LANGUAGES = "nld eng";
PAPERLESS_URL = "https://paperless.kun.is";
PAPERLESS_TIME_ZONE = "Europe/Amsterdam";
PAPERLESS_OCR_LANGUAGE = "nld";
USERMAP_UID = "33";
USERMAP_GID = "33";
};
secrets.paperless-ngx.stringData = {
databasePassword = "ref+sops://secrets/sops.yaml#/paperless-ngx/databasePassword";
secretKey = "ref+sops://secrets/sops.yaml#/paperless-ngx/secretKey";
};
deployments = {
paperless-ngx-web = {
metadata.labels = {
app = "paperless-ngx";
component = "web";
};
spec = {
selector.matchLabels = {
app = "paperless-ngx";
component = "web";
};
template = {
metadata.labels = {
app = "paperless-ngx";
component = "web";
};
spec = {
volumes.data.persistentVolumeClaim.claimName = "paperless-data";
containers.paperless-ngx = {
image = "ghcr.io/paperless-ngx/paperless-ngx:2.3";
envFrom = [{ configMapRef.name = "paperless-ngx"; }];
ports.web.containerPort = 8000;
env = {
PAPERLESS_DBPASS.valueFrom.secretKeyRef = {
name = "paperless-ngx";
key = "databasePassword";
};
PAPERLESS_SECRET_KEY.valueFrom.secretKeyRef = {
name = "paperless-ngx";
key = "secretKey";
};
};
volumeMounts = [{
name = "data";
mountPath = "/data";
}];
};
securityContext = {
fsGroup = 33;
fsGroupChangePolicy = "OnRootMismatch";
};
};
};
};
};
paperless-ngx-redis = {
metadata.labels = {
app = "paperless-ngx";
component = "redis";
};
spec = {
selector.matchLabels = {
app = "paperless-ngx";
component = "redis";
};
template = {
metadata.labels = {
app = "paperless-ngx";
component = "redis";
};
spec = {
volumes.data.persistentVolumeClaim.claimName = "paperless-redisdata";
containers.redis = {
image = "docker.io/library/redis:7";
ports.redis.containerPort = 6379;
volumeMounts = [{
name = "data";
mountPath = "/data";
}];
};
securityContext = {
fsGroup = 999;
fsGroupChangePolicy = "OnRootMismatch";
};
};
};
};
};
};
services = {
paperless-ngx-web.spec = {
selector = {
app = "paperless-ngx";
component = "web";
};
ports.web = {
port = 80;
targetPort = "web";
};
};
paperless-ngx-redis.spec = {
selector = {
app = "paperless-ngx";
component = "redis";
};
ports.redis = {
port = 6379;
targetPort = "redis";
};
};
};
};
lab = {
ingresses.paperless-ngx = {
host = "paperless.kun.is";
service = {
name = "paperless-ngx-web";
portName = "web";
};
};
};
}

213
kubenix-modules/paperless.nix Normal file
View file

@ -0,0 +1,213 @@
{
kubernetes.resources = {
configMaps = {
paperless.data = {
PAPERLESS_REDIS = "redis://paperless-redis.default.svc.cluster.local:6379";
PAPERLESS_DBENGINE = "postgresql";
PAPERLESS_DBHOST = "paperless-db.default.svc.cluster.local";
PAPERLESS_DBNAME = "paperless";
PAPERLESS_DBUSER = "paperless";
PAPERLESS_DATA_DIR = "/data/";
PAPERLESS_MEDIA_ROOT = "/data/";
PAPERLESS_OCR_LANGUAGES = "nld eng";
PAPERLESS_URL = "https://paperless.kun.is";
PAPERLESS_TIME_ZONE = "Europe/Amsterdam";
PAPERLESS_OCR_LANGUAGE = "nld";
USERMAP_UID = "33";
USERMAP_GID = "33";
};
paperless-db-env.data = {
POSTGRES_DB = "paperless";
POSTGRES_USER = "paperless";
POSTGRES_PASSWORD = "ref+sops://secrets/sops.yaml#/paperless/databasePassword";
PGDATA = "/pgdata/data";
};
};
secrets.paperless.stringData = {
databasePassword = "ref+sops://secrets/sops.yaml#/paperless/databasePassword";
secretKey = "ref+sops://secrets/sops.yaml#/paperless/secretKey";
};
deployments = {
paperless-web = {
metadata.labels = {
app = "paperless";
component = "web";
};
spec = {
selector.matchLabels = {
app = "paperless";
component = "web";
};
template = {
metadata.labels = {
app = "paperless";
component = "web";
};
spec = {
volumes.data.persistentVolumeClaim.claimName = "paperless-data";
containers.paperless = {
image = "ghcr.io/paperless-ngx/paperless-ngx:2.3";
envFrom = [{ configMapRef.name = "paperless"; }];
ports.web.containerPort = 8000;
env = {
PAPERLESS_DBPASS.valueFrom.secretKeyRef = {
name = "paperless";
key = "databasePassword";
};
PAPERLESS_SECRET_KEY.valueFrom.secretKeyRef = {
name = "paperless";
key = "secretKey";
};
};
volumeMounts = [{
name = "data";
mountPath = "/data";
}];
};
securityContext = {
fsGroup = 33;
fsGroupChangePolicy = "OnRootMismatch";
};
};
};
};
};
paperless-redis = {
metadata.labels = {
app = "paperless";
component = "redis";
};
spec = {
selector.matchLabels = {
app = "paperless";
component = "redis";
};
template = {
metadata.labels = {
app = "paperless";
component = "redis";
};
spec = {
volumes.data.persistentVolumeClaim.claimName = "paperless-redisdata";
containers.redis = {
image = "docker.io/library/redis:7";
ports.redis.containerPort = 6379;
volumeMounts = [{
name = "data";
mountPath = "/data";
}];
};
securityContext = {
fsGroup = 999;
fsGroupChangePolicy = "OnRootMismatch";
};
};
};
};
};
paperless-db = {
metadata.labels = {
app = "paperless";
component = "database";
};
spec = {
selector.matchLabels = {
app = "paperless";
component = "database";
};
template = {
metadata.labels = {
app = "paperless";
component = "database";
};
spec = {
containers.postgres = {
image = "postgres:15";
imagePullPolicy = "IfNotPresent";
ports.postgres.containerPort = 5432;
envFrom = [{ configMapRef.name = "paperless-db-env"; }];
volumeMounts = [{
name = "data";
mountPath = "/pgdata";
}];
};
volumes.data.persistentVolumeClaim.claimName = "paperless-db";
};
};
};
};
};
services = {
paperless-web.spec = {
selector = {
app = "paperless";
component = "web";
};
ports.web = {
port = 80;
targetPort = "web";
};
};
paperless-redis.spec = {
selector = {
app = "paperless";
component = "redis";
};
ports.redis = {
port = 6379;
targetPort = "redis";
};
};
paperless-db.spec = {
selector = {
app = "paperless";
component = "database";
};
ports.postgres = {
port = 5432;
targetPort = "postgres";
};
};
};
};
lab = {
ingresses.paperless = {
host = "paperless.kun.is";
service = {
name = "paperless-web";
portName = "web";
};
};
};
}

13
kubenix-modules/volumes.nix
View file

@ -1,4 +1,16 @@
{ {
# kubernetes.resources.pods.testje.spec = {
# containers.testje = {
# image = "nginx";
# volumeMounts = [{
# name = "stuff";
# mountPath = "/stuff";
# }];
# };
# volumes.stuff.persistentVolumeClaim.claimName = "paperless-db";
# };
lab = { lab = {
longhornVolumes = { longhornVolumes = {
hedgedoc-uploads.storage = "50Mi"; hedgedoc-uploads.storage = "50Mi";
@ -14,6 +26,7 @@
syncthing.storage = "400Mi"; syncthing.storage = "400Mi";
paperless-data.storage = "10Gi"; paperless-data.storage = "10Gi";
paperless-redisdata.storage = "20Mi"; paperless-redisdata.storage = "20Mi";
paperless-db.storage = "150Mi";
jellyfin.storage = "5Gi"; jellyfin.storage = "5Gi";
transmission.storage = "25Mi"; transmission.storage = "25Mi";
jellyseerr.storage = "75Mi"; jellyseerr.storage = "75Mi";

7
nixos-modules/backups.nix
View file

@ -43,13 +43,6 @@ let
password = "\${NEXTCLOUD_DATABASE_PASSWORD}"; password = "\${NEXTCLOUD_DATABASE_PASSWORD}";
format = "tar"; format = "tar";
} }
{
name = "paperless";
hostname = "lewis.dmz";
username = "paperless";
password = "\${PAPERLESS_DATABASE_PASSWORD}";
format = "tar";
}
]; ];
}; };
}; };

1
nixos-modules/data-sharing.nix
View file

@ -69,7 +69,6 @@ in
authentication = '' authentication = ''
host nextcloud nextcloud all md5 host nextcloud nextcloud all md5
host paperless paperless all md5
''; '';
}; };
}; };

10
secrets/sops.yaml
View file

@ -8,9 +8,9 @@ hedgedoc:
databasePassword: ENC[AES256_GCM,data:h3xt+libyQVvG51ttyYF6Lhq3QmYptu7Vx7/lZBytw5I8I1/zLMB6g==,iv:DuWMA82HyuupALguemWJmZ0hUA9oPyXB6tTcy3VFGKk=,tag:4ExOslyo8Kjyn7STpjqYAg==,type:str] databasePassword: ENC[AES256_GCM,data:h3xt+libyQVvG51ttyYF6Lhq3QmYptu7Vx7/lZBytw5I8I1/zLMB6g==,iv:DuWMA82HyuupALguemWJmZ0hUA9oPyXB6tTcy3VFGKk=,tag:4ExOslyo8Kjyn7STpjqYAg==,type:str]
nextcloud: nextcloud:
databasePassword: ENC[AES256_GCM,data:9mkwB4uKUlt1E20n7Wxr9PnKc1bxkYVO5Ph/dFfcuGA=,iv:U3IUz+7izoaeQi03xghDM1dZK01ICi3+r6r3mvNh8u0=,tag:aGKQyzZX210SNTRlvoHUig==,type:str] databasePassword: ENC[AES256_GCM,data:9mkwB4uKUlt1E20n7Wxr9PnKc1bxkYVO5Ph/dFfcuGA=,iv:U3IUz+7izoaeQi03xghDM1dZK01ICi3+r6r3mvNh8u0=,tag:aGKQyzZX210SNTRlvoHUig==,type:str]
paperless-ngx: paperless:
databasePassword: ENC[AES256_GCM,data:tQcxQbp5WT3AmR6qqdSmfeIGu40=,iv:xSq5kXp8RqOUXR9kK3hr38YjATWoAxmKqPO59B1sdlg=,tag:pft3KrmLgIbSebAY2DBtPQ==,type:str] databasePassword: ENC[AES256_GCM,data:K1cBEqSnccLriGWjj5CTkggZbo0=,iv:NFOZvPuzE8vdP2BzHR7iUrvnMRqvbtcwkKAWk4ckEws=,tag:5SL+nnJSuVaceGMCAAf5nQ==,type:str]
secretKey: ENC[AES256_GCM,data:Ue409vICe/ULoEM15mh9hOdIFl4=,iv:QU3NmPknqeNxUqJi44mGVtL0yiyNOu9pVW08jHYuVec=,tag:zjUO2s4BoMMJrEttq7Cd/w==,type:str] secretKey: ENC[AES256_GCM,data:g2tDbmy8SdkYrwrF/pkzmr5cG1A=,iv:Zzg/oUvJfPku66TWf0TgmQRERRegVxtJdFDShxb56ng=,tag:f4LIe74n4m/SlmDOntkLQg==,type:str]
kitchenowl: kitchenowl:
jwtSecretKey: ENC[AES256_GCM,data:XAfrvGbfVA1AZJyT0Nq0V0Om+1U=,iv:3kuWHfx5/Wk08z4/rou49s1wSxzisZUP0HLefYk9vXs=,tag:kormdXTJ7u5ar4+VY/IfvQ==,type:str] jwtSecretKey: ENC[AES256_GCM,data:XAfrvGbfVA1AZJyT0Nq0V0Om+1U=,iv:3kuWHfx5/Wk08z4/rou49s1wSxzisZUP0HLefYk9vXs=,tag:kormdXTJ7u5ar4+VY/IfvQ==,type:str]
forgejo: forgejo:
@ -44,8 +44,8 @@ sops:
cHJRZWpDdWZlSnh3Qm1GZ28vZ0p0ZjAK7+BS6YQ2cUD21XCISBeNLSUNgNFQfSKI cHJRZWpDdWZlSnh3Qm1GZ28vZ0p0ZjAK7+BS6YQ2cUD21XCISBeNLSUNgNFQfSKI
zL/AAqsVoBTrEs7s9fxmWmVm21/M3ZTYfU6Z6gIr6YEWe1pehRd6ZQ== zL/AAqsVoBTrEs7s9fxmWmVm21/M3ZTYfU6Z6gIr6YEWe1pehRd6ZQ==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2024-05-25T14:56:33Z" lastmodified: "2024-05-25T15:16:16Z"
mac: ENC[AES256_GCM,data:372x93C9PcSp1Snz0zXSwyeOd74wgvoSYClWq4IF7CskFrNgFOl3zDbHtpp2i510LSuzxaPhFuJJm0LXFmHnRJUIgC3D9MyDLxP5Wp0rvfICNmsww9iSNplMN1i3jqHncYtB2rRYN30y5Bo+AJSWto237hcd7fIUgWHGw5Jdk2o=,iv:hzOzgoDQzghTlzKAocnFPPXoBjiZ6VWoJUNbXhdH/OA=,tag:AvyPVMGySMoBQVoNkTdFFQ==,type:str] mac: ENC[AES256_GCM,data:YMLsRN83mAm+nwi4tgEXHb2TPOel35/q3wLaxhv8lk+yPBiYra+oyGs/dlr6IgTtAGvjN9DM7Uvxng14Ya3l/NHx8ZpmArsnInAqmc4NRfowgB6ITuL4q4eU/XJjfuQNGl3xrrwgAZQJo8UGNc+mEmQMaykAvl03N5WMVaqFyQ0=,iv:SseCh1H76cwjvYD+Mqg/eMt9vJq0BLAhvMftoa8a+mc=,tag:Ochp8CYbtuSJCjdHvhoY3A==,type:str]
pgp: [] pgp: []
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.8.1 version: 3.8.1