feat(hedgedoc): Move to separate k8s namespace

This commit is contained in:
Pim Kunis 2024-07-14 16:20:24 +02:00
parent 2fbc150912
commit cfb9f1bb12
7 changed files with 90 additions and 95 deletions

View file

@ -59,6 +59,7 @@ Currently, the applications being deployed like this are:
- `atuin` - `atuin`
- `blog` - `blog`
- `nextcloud` - `nextcloud`
- `hedgedoc`
## Known bugs ## Known bugs

View file

@ -78,4 +78,6 @@
"${self}/kubenix-modules/blog.nix" "blog" "static-websites"; "${self}/kubenix-modules/blog.nix" "blog" "static-websites";
kubenix.nextcloud = mkDeployScriptAndManifest kubenix.nextcloud = mkDeployScriptAndManifest
"${self}/kubenix-modules/nextcloud.nix" "nextcloud" "nextcloud"; "${self}/kubenix-modules/nextcloud.nix" "nextcloud" "nextcloud";
kubenix.hedgedoc = mkDeployScriptAndManifest
"${self}/kubenix-modules/hedgedoc.nix" "hedgedoc" "hedgedoc";
}) })

View file

@ -3,7 +3,6 @@ let
./inbucket.nix ./inbucket.nix
./syncthing.nix ./syncthing.nix
./pihole.nix ./pihole.nix
./hedgedoc.nix
./paperless.nix ./paperless.nix
./kitchenowl.nix ./kitchenowl.nix
./forgejo ./forgejo

View file

@ -67,6 +67,7 @@
kms = { }; kms = { };
atuin = { }; atuin = { };
nextcloud = { }; nextcloud = { };
hedgedoc = { };
}; };
nodes = nodes =

View file

@ -1,26 +1,7 @@
{ lib, ... }: { { lib, ... }: {
kubernetes.resources = { kubernetes.resources = {
configMaps = { configMaps.hedgedoc-config.data.config = lib.generators.toJSON { } {
hedgedoc-env.data = { useSSL = false;
CMD_DOMAIN = "md.kun.is";
CMD_PORT = "3000";
CMD_URL_ADDPORT = "false";
CMD_ALLOW_ANONYMOUS = "true";
CMD_ALLOW_EMAIL_REGISTER = "false";
CMD_PROTOCOL_USESSL = "true";
CMD_CSP_ENABLE = "false";
};
hedgedoc-config.data.config = lib.generators.toJSON { } {
useSSL = false;
};
hedgedoc-db-env.data = {
POSTGRES_DB = "hedgedoc";
POSTGRES_USER = "hedgedoc";
POSTGRES_PASSWORD = "ref+sops://secrets/kubernetes.yaml#/hedgedoc/databasePassword";
PGDATA = "/pgdata/data";
};
}; };
secrets.hedgedoc.stringData = { secrets.hedgedoc.stringData = {
@ -29,109 +10,108 @@
}; };
deployments = { deployments = {
hedgedoc = { server.spec = {
metadata.labels = { selector.matchLabels = {
app = "hedgedoc"; app = "hedgedoc";
component = "website"; component = "website";
}; };
spec = { template = {
selector.matchLabels = { metadata.labels = {
app = "hedgedoc"; app = "hedgedoc";
component = "website"; component = "website";
}; };
template = { spec = {
metadata.labels = { containers.hedgedoc = {
app = "hedgedoc"; image = "quay.io/hedgedoc/hedgedoc:1.9.9";
component = "website"; ports.web.containerPort = 3000;
};
spec = { env = {
containers.hedgedoc = { CMD_DOMAIN.value = "md.kun.is";
image = "quay.io/hedgedoc/hedgedoc:1.9.9"; CMD_PORT.value = "3000";
envFrom = [{ configMapRef.name = "hedgedoc-env"; }]; CMD_URL_ADDPORT.value = "false";
ports.web.containerPort = 3000; CMD_ALLOW_ANONYMOUS.value = "true";
CMD_ALLOW_EMAIL_REGISTER.value = "false";
CMD_PROTOCOL_USESSL.value = "true";
CMD_CSP_ENABLE.value = "false";
env = { CMD_DB_URL.valueFrom.secretKeyRef = {
CMD_DB_URL.valueFrom.secretKeyRef = { name = "hedgedoc";
name = "hedgedoc"; key = "databaseURL";
key = "databaseURL";
};
CMD_SESSION_SECRET.valueFrom.secretKeyRef = {
name = "hedgedoc";
key = "sessionSecret";
};
}; };
volumeMounts = [ CMD_SESSION_SECRET.valueFrom.secretKeyRef = {
{ name = "hedgedoc";
name = "uploads"; key = "sessionSecret";
mountPath = "/hedgedoc/public/uploads"; };
}
{
name = "config";
mountPath = "/hedgedoc/config.json";
subPath = "config";
}
];
}; };
volumes = { volumeMounts = [
uploads.persistentVolumeClaim.claimName = "hedgedoc-uploads"; {
config.configMap.name = "hedgedoc-config"; name = "uploads";
}; mountPath = "/hedgedoc/public/uploads";
}
{
name = "config";
mountPath = "/hedgedoc/config.json";
subPath = "config";
}
];
};
securityContext = { volumes = {
fsGroup = 65534; uploads.persistentVolumeClaim.claimName = "uploads";
fsGroupChangePolicy = "OnRootMismatch"; config.configMap.name = "hedgedoc-config";
}; };
securityContext = {
fsGroup = 65534;
fsGroupChangePolicy = "OnRootMismatch";
}; };
}; };
}; };
}; };
hedgedoc-db = { database.spec = {
metadata.labels = { selector.matchLabels = {
app = "hedgedoc"; app = "hedgedoc";
component = "database"; component = "database";
}; };
spec = { template = {
selector.matchLabels = { metadata.labels = {
app = "hedgedoc"; app = "hedgedoc";
component = "database"; component = "database";
}; };
template = { spec = {
metadata.labels = { containers.postgres = {
app = "hedgedoc"; image = "postgres:15";
component = "database"; imagePullPolicy = "IfNotPresent";
}; ports.postgres.containerPort = 5432;
spec = { env = {
containers.postgres = { POSTGRES_DB.value = "hedgedoc";
image = "postgres:15"; POSTGRES_USER.value = "hedgedoc";
imagePullPolicy = "IfNotPresent"; POSTGRES_PASSWORD.value = "ref+sops://secrets/kubernetes.yaml#/hedgedoc/databasePassword";
ports.postgres.containerPort = 5432; PGDATA.value = "/pgdata/data";
envFrom = [{ configMapRef.name = "hedgedoc-db-env"; }];
volumeMounts = [{
name = "data";
mountPath = "/pgdata";
}];
}; };
volumes.data.persistentVolumeClaim.claimName = "hedgedoc-db"; volumeMounts = [{
name = "database";
mountPath = "/pgdata";
}];
}; };
volumes.database.persistentVolumeClaim.claimName = "database";
}; };
}; };
}; };
}; };
services = { services = {
hedgedoc.spec = { server.spec = {
selector = { selector = {
app = "hedgedoc"; app = "hedgedoc";
component = "website"; component = "website";
@ -143,7 +123,7 @@
}; };
}; };
hedgedoc-db.spec = { database.spec = {
selector = { selector = {
app = "hedgedoc"; app = "hedgedoc";
component = "database"; component = "database";
@ -158,13 +138,25 @@
}; };
lab = { lab = {
ingresses.hedgedoc = { ingresses.web = {
host = "md.kun.is"; host = "md.kun.is";
service = { service = {
name = "hedgedoc"; name = "server";
portName = "web"; portName = "web";
}; };
}; };
longhorn.persistentVolumeClaim = {
uploads = {
volumeName = "hedgedoc-uploads";
storage = "50Mi";
};
database = {
volumeName = "hedgedoc-db";
storage = "100Mi";
};
};
}; };
} }

View file

@ -14,8 +14,6 @@
lab = { lab = {
longhornVolumes = { longhornVolumes = {
hedgedoc-uploads.storage = "50Mi";
hedgedoc-db.storage = "100Mi";
minecraft.storage = "1Gi"; minecraft.storage = "1Gi";
pihole-data.storage = "750Mi"; pihole-data.storage = "750Mi";
pihole-dnsmasq.storage = "16Mi"; pihole-dnsmasq.storage = "16Mi";
@ -45,6 +43,8 @@
atuin-db.storage = "300Mi"; atuin-db.storage = "300Mi";
nextcloud.storage = "50Gi"; nextcloud.storage = "50Gi";
nextcloud-db.storage = "400Mi"; nextcloud-db.storage = "400Mi";
hedgedoc-uploads.storage = "50Mi";
hedgedoc-db.storage = "100Mi";
}; };
nfsVolumes = { nfsVolumes = {

View file

@ -3,7 +3,7 @@ freshrss:
pihole: pihole:
password: ENC[AES256_GCM,data:yqPpovQKmP7NgUMI3w1p8t7RjbxNsMMHZbsNEaleyLJTqnDzNqONsQ==,iv:i+ys/EZelT4a4Sr0RpDto8udk/9yYC6pzl3FiUZQxrQ=,tag:FlvbMN6fuo+VV50YyuMeGg==,type:str] password: ENC[AES256_GCM,data:yqPpovQKmP7NgUMI3w1p8t7RjbxNsMMHZbsNEaleyLJTqnDzNqONsQ==,iv:i+ys/EZelT4a4Sr0RpDto8udk/9yYC6pzl3FiUZQxrQ=,tag:FlvbMN6fuo+VV50YyuMeGg==,type:str]
hedgedoc: hedgedoc:
databaseURL: ENC[AES256_GCM,data:dmaXh8wnECBOeEtM00Nc6kpVc3NiJbP5gepToAxLrpmpEEH1vs5SdE90Z3+T3qeXrsTQVr/Q6EOocNKMsTe1pcZoEirECk0dwZ3k6s/bUmUJdZgOf0ir6Iy5J8RZYvJz3AnwuFIsIJ79x0+WfEfACQ==,iv:C7D1zY/vu4zc687XA2mwuYEOFtSFDV+/po4tyNw3ks8=,tag:GQGj4TbP7Mcrm+auuaplnw==,type:str] databaseURL: ENC[AES256_GCM,data:VVz5meJM/SWC9+gWvorSj4ymLRux0vQPbI0kQLFrUGz2bocaRFzDqHAKbF4sd5iSzc6y5LQqwUfOgNoVrKhIROzKxStOmaQAWTLAJvfdReAqQoEaLVuLcZeML9QIhqvdAvPV5kVMznJ1u5YczSA=,iv:wU/GrAYSF2y0JWl0Nz6UuYmII0kCPIZ+UfAGI/1mUsE=,tag:xVOUwd5T6VHZ7vrpj9FMxg==,type:str]
sessionSecret: ENC[AES256_GCM,data:FhYr4rFNHmtk9jUcjM4UthepS/5Z4x7WPAE5lTB94WmHrALbzZl2M3JcmibR6/z1FtAJhCsaPZ7Xeg8nOZtU2g==,iv:7soqcd8A+yNfXEZg0qDjOZgfsUIFHfflxByuf7nZk3Y=,tag:x/rmaXo4nTdA080Zl/0MiQ==,type:str] sessionSecret: ENC[AES256_GCM,data:FhYr4rFNHmtk9jUcjM4UthepS/5Z4x7WPAE5lTB94WmHrALbzZl2M3JcmibR6/z1FtAJhCsaPZ7Xeg8nOZtU2g==,iv:7soqcd8A+yNfXEZg0qDjOZgfsUIFHfflxByuf7nZk3Y=,tag:x/rmaXo4nTdA080Zl/0MiQ==,type:str]
databasePassword: ENC[AES256_GCM,data:Fv1qeGvXZ93KvdFCCz9t9Dzhe7wKGOfR0lj64lzRM3s48E5FYdrH0w==,iv:cqhIOUKiSSkBpf95Eza9C9l8PX6YmTBpvBAR4+ibgeA=,tag:r8ZvF6l8oNeOt3d5UCA7Ww==,type:str] databasePassword: ENC[AES256_GCM,data:Fv1qeGvXZ93KvdFCCz9t9Dzhe7wKGOfR0lj64lzRM3s48E5FYdrH0w==,iv:cqhIOUKiSSkBpf95Eza9C9l8PX6YmTBpvBAR4+ibgeA=,tag:r8ZvF6l8oNeOt3d5UCA7Ww==,type:str]
nextcloud: nextcloud:
@ -50,8 +50,8 @@ sops:
aHpYZ2VtdVBVTkxZbGFOYzRpbGltZHMKJs4E+CsthuzQZqA0Yip4G/1XK4SuoiRP aHpYZ2VtdVBVTkxZbGFOYzRpbGltZHMKJs4E+CsthuzQZqA0Yip4G/1XK4SuoiRP
Lo65L33lfNibdSOeIygqnyo6GBwjD52TcNQpvzkVbr3M3hWlJs8wCA== Lo65L33lfNibdSOeIygqnyo6GBwjD52TcNQpvzkVbr3M3hWlJs8wCA==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2024-07-12T11:55:18Z" lastmodified: "2024-07-14T14:19:35Z"
mac: ENC[AES256_GCM,data:X2uCQfFmVkRq2OSClVlLO9zzmY/jj/B8Qo4dln93KJLRr4g2wdTQVbJWBtLDUMotlHs6b27nJc8T1wTR9/4Q1xqh92DjGeWZQmA5VbBgWuOmCB1xOE8eAFY1rVCT7e2uAFuHknxKhOS2KfOxZyGc4AJ7weXs9bLJWe5i0PSesvA=,iv:KWii9fvWUECng8Nb82nV87HR+BPIyYEfJKZHOrGPjiw=,tag:89xRQre8WahRSt1I6AweYg==,type:str] mac: ENC[AES256_GCM,data:JDlXC7OACi6h78yEMOrJa8Nt/yOlV5es/vhq53UfjlCWEW3Q7haf9eeeTtfRbZ5fubp41M31zkW8fX0vBs7ynq78/3ZY4NDvQqkm6uw4OjDhebfpjqDt4FimUijZM+6GooR12ejWULCLm5oIfR7jsOJKaD7xWTQf+585MBQSIIk=,iv:lTz1X4Dr3B052mjtKaAA/UPJ7myd571INxn6j3oII7I=,tag:AfKcTAY+wPvQUwQrfSNsxA==,type:str]
pgp: [] pgp: []
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.8.1 version: 3.8.1