feat(hedgedoc): Move to separate k8s namespace

README.md

@@ -59,6 +59,7 @@ Currently, the applications being deployed like this are:
 - `atuin`
 - `blog`
 - `nextcloud`
+- `hedgedoc`
 
 ## Known bugs
 

flake-parts/kubenix.nix

@@ -78,4 +78,6 @@
       "${self}/kubenix-modules/blog.nix" "blog" "static-websites";
     kubenix.nextcloud = mkDeployScriptAndManifest
       "${self}/kubenix-modules/nextcloud.nix" "nextcloud" "nextcloud";
+    kubenix.hedgedoc = mkDeployScriptAndManifest
+      "${self}/kubenix-modules/hedgedoc.nix" "hedgedoc" "hedgedoc";
   })

kubenix-modules/all.nix

@@ -3,7 +3,6 @@ let
     ./inbucket.nix
     ./syncthing.nix
     ./pihole.nix
-    ./hedgedoc.nix
     ./paperless.nix
     ./kitchenowl.nix
     ./forgejo

kubenix-modules/base.nix

@@ -67,6 +67,7 @@
           kms = { };
           atuin = { };
           nextcloud = { };
+          hedgedoc = { };
         };
 
         nodes =

kubenix-modules/hedgedoc.nix

@@ -1,26 +1,7 @@
 { lib, ... }: {
   kubernetes.resources = {
-    configMaps = {
+    configMaps.hedgedoc-config.data.config = lib.generators.toJSON { } {
-      hedgedoc-env.data = {
+      useSSL = false;
-        CMD_DOMAIN = "md.kun.is";
-        CMD_PORT = "3000";
-        CMD_URL_ADDPORT = "false";
-        CMD_ALLOW_ANONYMOUS = "true";
-        CMD_ALLOW_EMAIL_REGISTER = "false";
-        CMD_PROTOCOL_USESSL = "true";
-        CMD_CSP_ENABLE = "false";
-      };
-
-      hedgedoc-config.data.config = lib.generators.toJSON { } {
-        useSSL = false;
-      };
-
-      hedgedoc-db-env.data = {
-        POSTGRES_DB = "hedgedoc";
-        POSTGRES_USER = "hedgedoc";
-        POSTGRES_PASSWORD = "ref+sops://secrets/kubernetes.yaml#/hedgedoc/databasePassword";
-        PGDATA = "/pgdata/data";
-      };
     };
 
     secrets.hedgedoc.stringData = {
@@ -29,109 +10,108 @@
     };
 
     deployments = {
-      hedgedoc = {
+      server.spec = {
-        metadata.labels = {
+        selector.matchLabels = {
           app = "hedgedoc";
           component = "website";
         };
 
-        spec = {
+        template = {
-          selector.matchLabels = {
+          metadata.labels = {
             app = "hedgedoc";
             component = "website";
           };
 
-          template = {
+          spec = {
-            metadata.labels = {
+            containers.hedgedoc = {
-              app = "hedgedoc";
+              image = "quay.io/hedgedoc/hedgedoc:1.9.9";
-              component = "website";
+              ports.web.containerPort = 3000;
-            };
 
-            spec = {
+              env = {
-              containers.hedgedoc = {
+                CMD_DOMAIN.value = "md.kun.is";
-                image = "quay.io/hedgedoc/hedgedoc:1.9.9";
+                CMD_PORT.value = "3000";
-                envFrom = [{ configMapRef.name = "hedgedoc-env"; }];
+                CMD_URL_ADDPORT.value = "false";
-                ports.web.containerPort = 3000;
+                CMD_ALLOW_ANONYMOUS.value = "true";
+                CMD_ALLOW_EMAIL_REGISTER.value = "false";
+                CMD_PROTOCOL_USESSL.value = "true";
+                CMD_CSP_ENABLE.value = "false";
 
-                env = {
+                CMD_DB_URL.valueFrom.secretKeyRef = {
-                  CMD_DB_URL.valueFrom.secretKeyRef = {
+                  name = "hedgedoc";
-                    name = "hedgedoc";
+                  key = "databaseURL";
-                    key = "databaseURL";
-                  };
-
-                  CMD_SESSION_SECRET.valueFrom.secretKeyRef = {
-                    name = "hedgedoc";
-                    key = "sessionSecret";
-                  };
                 };
 
-                volumeMounts = [
+                CMD_SESSION_SECRET.valueFrom.secretKeyRef = {
-                  {
+                  name = "hedgedoc";
-                    name = "uploads";
+                  key = "sessionSecret";
-                    mountPath = "/hedgedoc/public/uploads";
+                };
-                  }
-                  {
-                    name = "config";
-                    mountPath = "/hedgedoc/config.json";
-                    subPath = "config";
-                  }
-                ];
               };
 
-              volumes = {
+              volumeMounts = [
-                uploads.persistentVolumeClaim.claimName = "hedgedoc-uploads";
+                {
-                config.configMap.name = "hedgedoc-config";
+                  name = "uploads";
-              };
+                  mountPath = "/hedgedoc/public/uploads";
+                }
+                {
+                  name = "config";
+                  mountPath = "/hedgedoc/config.json";
+                  subPath = "config";
+                }
+              ];
+            };
 
-              securityContext = {
+            volumes = {
-                fsGroup = 65534;
+              uploads.persistentVolumeClaim.claimName = "uploads";
-                fsGroupChangePolicy = "OnRootMismatch";
+              config.configMap.name = "hedgedoc-config";
-              };
+            };
+
+            securityContext = {
+              fsGroup = 65534;
+              fsGroupChangePolicy = "OnRootMismatch";
             };
           };
         };
       };
 
-      hedgedoc-db = {
+      database.spec = {
-        metadata.labels = {
+        selector.matchLabels = {
           app = "hedgedoc";
           component = "database";
         };
 
-        spec = {
+        template = {
-          selector.matchLabels = {
+          metadata.labels = {
             app = "hedgedoc";
             component = "database";
           };
 
-          template = {
+          spec = {
-            metadata.labels = {
+            containers.postgres = {
-              app = "hedgedoc";
+              image = "postgres:15";
-              component = "database";
+              imagePullPolicy = "IfNotPresent";
-            };
+              ports.postgres.containerPort = 5432;
 
-            spec = {
+              env = {
-              containers.postgres = {
+                POSTGRES_DB.value = "hedgedoc";
-                image = "postgres:15";
+                POSTGRES_USER.value = "hedgedoc";
-                imagePullPolicy = "IfNotPresent";
+                POSTGRES_PASSWORD.value = "ref+sops://secrets/kubernetes.yaml#/hedgedoc/databasePassword";
-                ports.postgres.containerPort = 5432;
+                PGDATA.value = "/pgdata/data";
-                envFrom = [{ configMapRef.name = "hedgedoc-db-env"; }];
-
-                volumeMounts = [{
-                  name = "data";
-                  mountPath = "/pgdata";
-                }];
               };
 
-              volumes.data.persistentVolumeClaim.claimName = "hedgedoc-db";
+              volumeMounts = [{
+                name = "database";
+                mountPath = "/pgdata";
+              }];
             };
+
+            volumes.database.persistentVolumeClaim.claimName = "database";
           };
         };
       };
     };
 
     services = {
-      hedgedoc.spec = {
+      server.spec = {
         selector = {
           app = "hedgedoc";
           component = "website";
@@ -143,7 +123,7 @@
         };
       };
 
-      hedgedoc-db.spec = {
+      database.spec = {
         selector = {
           app = "hedgedoc";
           component = "database";
@@ -158,13 +138,25 @@
   };
 
   lab = {
-    ingresses.hedgedoc = {
+    ingresses.web = {
       host = "md.kun.is";
 
       service = {
-        name = "hedgedoc";
+        name = "server";
         portName = "web";
       };
     };
+
+    longhorn.persistentVolumeClaim = {
+      uploads = {
+        volumeName = "hedgedoc-uploads";
+        storage = "50Mi";
+      };
+
+      database = {
+        volumeName = "hedgedoc-db";
+        storage = "100Mi";
+      };
+    };
   };
 }

kubenix-modules/volumes.nix

@@ -14,8 +14,6 @@
 
   lab = {
     longhornVolumes = {
-      hedgedoc-uploads.storage = "50Mi";
-      hedgedoc-db.storage = "100Mi";
       minecraft.storage = "1Gi";
       pihole-data.storage = "750Mi";
       pihole-dnsmasq.storage = "16Mi";
@@ -45,6 +43,8 @@
       atuin-db.storage = "300Mi";
       nextcloud.storage = "50Gi";
       nextcloud-db.storage = "400Mi";
+      hedgedoc-uploads.storage = "50Mi";
+      hedgedoc-db.storage = "100Mi";
     };
 
     nfsVolumes = {

secrets/kubernetes.yaml

@@ -3,7 +3,7 @@ freshrss:
 pihole:
     password: ENC[AES256_GCM,data:yqPpovQKmP7NgUMI3w1p8t7RjbxNsMMHZbsNEaleyLJTqnDzNqONsQ==,iv:i+ys/EZelT4a4Sr0RpDto8udk/9yYC6pzl3FiUZQxrQ=,tag:FlvbMN6fuo+VV50YyuMeGg==,type:str]
 hedgedoc:
-    databaseURL: ENC[AES256_GCM,data:dmaXh8wnECBOeEtM00Nc6kpVc3NiJbP5gepToAxLrpmpEEH1vs5SdE90Z3+T3qeXrsTQVr/Q6EOocNKMsTe1pcZoEirECk0dwZ3k6s/bUmUJdZgOf0ir6Iy5J8RZYvJz3AnwuFIsIJ79x0+WfEfACQ==,iv:C7D1zY/vu4zc687XA2mwuYEOFtSFDV+/po4tyNw3ks8=,tag:GQGj4TbP7Mcrm+auuaplnw==,type:str]
+    databaseURL: ENC[AES256_GCM,data:VVz5meJM/SWC9+gWvorSj4ymLRux0vQPbI0kQLFrUGz2bocaRFzDqHAKbF4sd5iSzc6y5LQqwUfOgNoVrKhIROzKxStOmaQAWTLAJvfdReAqQoEaLVuLcZeML9QIhqvdAvPV5kVMznJ1u5YczSA=,iv:wU/GrAYSF2y0JWl0Nz6UuYmII0kCPIZ+UfAGI/1mUsE=,tag:xVOUwd5T6VHZ7vrpj9FMxg==,type:str]
     sessionSecret: ENC[AES256_GCM,data:FhYr4rFNHmtk9jUcjM4UthepS/5Z4x7WPAE5lTB94WmHrALbzZl2M3JcmibR6/z1FtAJhCsaPZ7Xeg8nOZtU2g==,iv:7soqcd8A+yNfXEZg0qDjOZgfsUIFHfflxByuf7nZk3Y=,tag:x/rmaXo4nTdA080Zl/0MiQ==,type:str]
     databasePassword: ENC[AES256_GCM,data:Fv1qeGvXZ93KvdFCCz9t9Dzhe7wKGOfR0lj64lzRM3s48E5FYdrH0w==,iv:cqhIOUKiSSkBpf95Eza9C9l8PX6YmTBpvBAR4+ibgeA=,tag:r8ZvF6l8oNeOt3d5UCA7Ww==,type:str]
 nextcloud:
@@ -50,8 +50,8 @@ sops:
             aHpYZ2VtdVBVTkxZbGFOYzRpbGltZHMKJs4E+CsthuzQZqA0Yip4G/1XK4SuoiRP
             Lo65L33lfNibdSOeIygqnyo6GBwjD52TcNQpvzkVbr3M3hWlJs8wCA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-07-12T11:55:18Z"
+    lastmodified: "2024-07-14T14:19:35Z"
-    mac: ENC[AES256_GCM,data:X2uCQfFmVkRq2OSClVlLO9zzmY/jj/B8Qo4dln93KJLRr4g2wdTQVbJWBtLDUMotlHs6b27nJc8T1wTR9/4Q1xqh92DjGeWZQmA5VbBgWuOmCB1xOE8eAFY1rVCT7e2uAFuHknxKhOS2KfOxZyGc4AJ7weXs9bLJWe5i0PSesvA=,iv:KWii9fvWUECng8Nb82nV87HR+BPIyYEfJKZHOrGPjiw=,tag:89xRQre8WahRSt1I6AweYg==,type:str]
+    mac: ENC[AES256_GCM,data:JDlXC7OACi6h78yEMOrJa8Nt/yOlV5es/vhq53UfjlCWEW3Q7haf9eeeTtfRbZ5fubp41M31zkW8fX0vBs7ynq78/3ZY4NDvQqkm6uw4OjDhebfpjqDt4FimUijZM+6GooR12ejWULCLm5oIfR7jsOJKaD7xWTQf+585MBQSIIk=,iv:lTz1X4Dr3B052mjtKaAA/UPJ7myd571INxn6j3oII7I=,tag:AfKcTAY+wPvQUwQrfSNsxA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1