add outline

Update linuxserver/code-server Docker tag to v4.22.0

.github/renovate.json

@@ -11,7 +11,6 @@
         "before 5pm every weekday"
     ],
     "labels": [
-        "outside-rule"
     ],
     "packageRules": [
         {
@@ -47,7 +46,8 @@
                 "linuxserver/calibre",
                 "homeassistant/home-assistant",
                 "ghcr.io/gethomepage/homepage",
-                "ghcr.io/cloudnative-pg/postgresql"
+                "ghcr.io/cloudnative-pg/postgresql",
+                "linuxserver/code-server"
             ],
             "matchDatasources": [
                 "docker",

.github/workflows/lint-test.yaml

@@ -12,7 +12,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@v4
         with:
           version: v3.13.3
 

charts/home-assistant/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: home-assistant
-version: 0.0.13
+version: 0.0.14
 description: Chart for Home Assistant
 keywords:
   - home-automation

charts/home-assistant/values.yaml

@@ -56,7 +56,7 @@ codeserver:
   enabled: true
   image:
     repository: linuxserver/code-server
-    tag: 4.21.1
+    tag: 4.22.0
     imagePullPolicy: IfNotPresent
   env:
     TZ: US/Mountain

charts/kubelet-serving-cert-approver/Chart.yaml

@@ -0,0 +1,13 @@
+apiVersion: v2
+name: kubelet-serving-cert-approver
+version: 0.0.3
+description: Kubelet Serving TLS Certificate Signing Request Approver
+keywords:
+  - kubernetes
+  - certificate
+sources:
+  - https://github.com/alex1989hu/kubelet-serving-cert-approver
+  - https://github.com/alexlebens/helm-charts/charts/homepage
+maintainers:
+  - name: alexlebens
+appVersion: 0.8.1

charts/kubelet-serving-cert-approver/README.md

@@ -0,0 +1,16 @@
+## Introduction
+
+[Kubelet Serving Certificate Approver](https://github.com/alex1989hu/kubelet-serving-cert-approver)
+
+Kubelet Serving Certificate Approver is a custom approving controller which approves kubernetes.io/kubelet-serving Certificate Signing Request that kubelet use to serve TLS endpoints.
+
+This chart bootstraps a [Kubelet Serving Certificate Approver](https://github.com/alex1989hu/kubelet-serving-cert-approver) deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
+
+## Prerequisites
+
+- Kubernetes
+- Helm
+
+## Parameters
+
+See the [values files](values.yaml).

charts/kubelet-serving-cert-approver/templates/cluster-role-binding.yaml

@@ -0,0 +1,20 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: server
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: "certificates:{{ .Release.Name }}"
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Release.Name }}
+    namespace: {{ .Release.Namespace }}

charts/kubelet-serving-cert-approver/templates/cluster-role.yaml

@@ -0,0 +1,63 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: "certificates:{{ .Release.Name }}"
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: server
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: helm
+rules:
+  - apiGroups:
+      - certificates.k8s.io
+    resources:
+      - certificatesigningrequests
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - certificates.k8s.io
+    resources:
+      - certificatesigningrequests/approval
+    verbs:
+      - update
+  - apiGroups:
+      - authorization.k8s.io
+    resources:
+      - subjectaccessreviews
+    verbs:
+      - create
+  - apiGroups:
+      - certificates.k8s.io
+    resourceNames:
+      - kubernetes.io/kubelet-serving
+    resources:
+      - signers
+    verbs:
+      - approve
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: "events:{{ .Release.Name }}"
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: server
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: helm
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+      - patch

charts/kubelet-serving-cert-approver/templates/deployment.yaml

@@ -0,0 +1,88 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: server
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: helm
+spec:
+  revisionHistoryLimit: 3
+  replicas: {{ .Values.deployment.replicas }}
+  strategy:
+    type: {{ .Values.deployment.strategy }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: {{ .Release.Name }}
+      app.kubernetes.io/name: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/name: {{ .Release.Name }}
+    spec:
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - preference:
+                matchExpressions:
+                  - key: node-role.kubernetes.io/master
+                    operator: DoesNotExist
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: DoesNotExist
+              weight: 100
+      containers:
+        - name: {{ .Release.Name }}
+          image: "{{ .Values.deployment.image.repository }}:{{ .Values.deployment.image.tag }}"
+          imagePullPolicy: {{ .Values.deployment.image.imagePullPolicy }}
+          ports:
+            - containerPort: 8080
+              name: health
+            - containerPort: 9090
+              name: metrics          
+          args:
+            - serve
+          env:
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+          resources:
+            {{- toYaml .Values.deployment.resources | nindent 12 }}                  
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: health
+            initialDelaySeconds: 6
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: health
+            initialDelaySeconds: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+      priorityClassName: {{ .Values.deployment.priorityClassName }}
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65534
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: {{ .Release.Name }}
+      tolerations:
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/master
+          operator: Exists
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/control-plane
+          operator: Exists

charts/kubelet-serving-cert-approver/templates/namespace.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ .Release.Name }}
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/warn: restricted

charts/kubelet-serving-cert-approver/templates/role-binding.yaml

@@ -0,0 +1,20 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "events:{{ .Release.Name }}"
+  namespace: default
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: server
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: "events:{{ .Release.Name }}"
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Release.Name }}
+    namespace: {{ .Release.Name }}

charts/kubelet-serving-cert-approver/templates/service-account.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: server
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: helm

charts/kubelet-serving-cert-approver/templates/service.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: server
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: helm
+spec:
+  ports:
+    - name: metrics
+      port: 9090
+      protocol: TCP
+      targetPort: metrics
+  selector:
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ .Release.Name }}

charts/kubelet-serving-cert-approver/values.yaml

@@ -0,0 +1,15 @@
+deployment:
+  replicas: 1
+  strategy: Recreate
+  priorityClassName: system-cluster-critical
+  image:
+    repository: ghcr.io/alex1989hu/kubelet-serving-cert-approver
+    tag: main
+    imagePullPolicy: Always
+  resources:
+    limits:
+      cpu: 250m
+      memory: 32Mi
+    requests:
+      cpu: 10m
+      memory: 16Mi

charts/libation/Chart.yaml

@@ -0,0 +1,13 @@
+apiVersion: v2
+name: libation
+version: 0.0.4
+description: Import library from audible
+keywords:
+  - audiobooks
+  - job
+sources:
+  - https://github.com/rmcrackan/Libation
+maintainers:
+  - name: alexlebens
+icon: https://getlibation.com/images/libation-logo.png
+appVersion: "11.1.0"

charts/libation/README.md

@@ -0,0 +1,18 @@
+## Introduction
+
+[Libation](https://github.com/rmcrackan/Libation)
+
+Libation: Liberate your Library. Import library from audible, including cover art
+
+
+This chart bootstraps a [Libation](https://github.com/benphelps/homepage) CronJob on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
+
+## Prerequisites
+
+- Kubernetes
+- Helm
+- CronJob
+
+## Parameters
+
+See the [values files](values.yaml).

charts/libation/templates/job.yaml

@@ -0,0 +1,39 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: libation
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: libation
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: job
+    app.kubernetes.io/part-of: libation
+spec:
+  schedule: {{ .Values.libation.job.schedule }}
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: libation
+              image: "{{ .Values.libation.image.repository }}:{{ .Values.libation.image.tag }}"
+              imagePullPolicy: {{ .Values.libation.image.pullPolicy }}
+              env:
+                - name: SLEEP_TIME
+                  value: "-1"
+              volumeMounts:
+                - name: libation-config
+                  mountPath: /config
+                - name: libation-books
+                  mountPath: /data
+          volumes:
+            - name: libation-config
+              persistentVolumeClaim:
+                claimName: libation-config
+            - name: libation-books
+              persistentVolumeClaim:
+                claimName: {{ .Values.persistence.books.claimName }}

charts/libation/templates/persistent-volume-claim.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: libation-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: libation
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: storage
+    app.kubernetes.io/part-of: libation
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.persistence.config.storageSize }}
+  storageClassName: {{ .Values.persistence.config.storageClassName }}
+  volumeMode: {{ .Values.persistence.config.volumeMode }}

charts/libation/values.yaml

@@ -0,0 +1,13 @@
+job:
+  schedule: "0 * * * *"
+image:
+  repository: rmcrackan/libation
+  tag: "11.1.0"
+  pullPolicy: IfNotPresent
+persistence:
+  config:
+    storageClassName: nfs-client
+    storageSize: 1Gi
+    volumeMode: Filesystem
+  books:
+    claimName: libation-nfs-storage

charts/outline/Chart.yaml

@@ -0,0 +1,18 @@
+apiVersion: v2
+name: outline
+version: 0.0.1
+description: Chart for Outline wiki
+keywords:
+  - wiki
+  - documentation
+sources:
+  - https://github.com/outline/outline
+  - https://github.com/bitnami/charts/tree/main/bitnami/redis
+maintainers:
+  - name: alexlebens
+icon: https://avatars.githubusercontent.com/u/1765001?s=48&v=4  
+dependencies:
+  - name: redis
+    repository: https://charts.bitnami.com/bitnami
+    version: 18.x.x
+appVersion: v0.75.2

charts/outline/README.md

@@ -0,0 +1,17 @@
+## Introduction
+
+[Outline](https://github.com/outline/outline)
+
+The fastest knowledge base for growing teams. Beautiful, realtime collaborative, feature packed, and markdown compatible.
+
+This chart bootstraps an [Outline](https://github.com/outline/outline) deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
+
+## Prerequisites
+
+- Kubernetes
+- Helm
+- Bitnami Redis Chart
+
+## Parameters
+
+See the [values files](values.yaml).

charts/outline/templates/deployment.yaml

@@ -0,0 +1,170 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: outline
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: outline
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: outline
+spec:
+  revisionHistoryLimit: 3
+  replicas: {{ .Values.deployment.replicas }}
+  strategy:
+    type: {{ .Values.deployment.strategy }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: outline
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: outline
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      serviceAccountName: outline
+      automountServiceAccountToken: true
+      containers:
+        - name: {{ .Release.Name }}
+          image: "{{ .Values.deployment.image.repository }}:{{ .Values.deployment.image.tag }}"
+          imagePullPolicy: {{ .Values.deployment.image.imagePullPolicy }}
+          ports:
+            - name: web
+              containerPort: {{ .Values.service.web.port }}
+              protocol: TCP
+          env:
+            - name: NODE_ENV
+              value: "{{ .Values.outline.nodeEnv }}"
+            - name: URL
+              value: "{{ .Values.outline.url }}"
+            - name: PORT
+              value: "{{ .Values.service.web.port }}"
+            - name: SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.outline.secretKey.existingSecretName }}"
+                  key: "{{ .Values.outline.secretKey.existingSecretKey }}"
+            - name: UTILS_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.outline.utilsSecret.existingSecretName }}"
+                  key: "{{ .Values.outline.secretKey.existingSecretKey }}"
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.outline.database.passwordSecret.existingSecretName }}"
+                  key: "{{ .Values.outline.database.passwordSecret.existingSecretKey }}"
+            - name: POSTGRES_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.outline.database.usernameSecret.existingSecretName }}"
+                  key: "{{ .Values.outline.database.usernameSecret.existingSecretKey }}"
+            - name: POSTGRES_DATABASE_NAME
+              value: {{ .Values.outline.database.databaseName }}
+            - name: POSTGRES_DATABASE_HOST
+              value: {{ .Values.outline.database.databaseHost }}
+            - name: DATABASE_URL
+              value: "postgres://$(POSTGRES_USERNAME):$(POSTGRES_PASSWORD)@postgresql-{{ .Release.Name }}-cluster-rw:5432/$(POSTGRES_DATABASE_NAME)"
+            - name: DATABASE_URL_TEST
+              value: "postgres://$(POSTGRES_USERNAME):$(POSTGRES_PASSWORD)@postgresql-{{ .Release.Name }}-cluster-rw:5432/$(POSTGRES_DATABASE_NAME)-test"
+            - name: DATABASE_CONNECTION_POOL_MIN
+              value: "{{ .Values.outline.database.connectionPoolMin }}"
+            - name: DATABASE_CONNECTION_POOL_MAX
+              value: "{{ .Values.outline.database.connectionPoolMax }}"
+            - name: PGSSLMODE
+              value: "{{ .Values.outline.database.sslMode }}"
+            - name: REDIS_URL
+              value: "redis://{{ .Release.Name }}-redis-master:6379"
+            - name: FILE_STORAGE
+              value: "{{ .Values.persistence.type }}"
+
+          {{- if eq .Values.persistence.type "s3" }}
+            - name: AWS_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.persistence.s3.credentialsSecret }}"
+                  key: AWS_ACCESS_KEY_ID
+            - name: AWS_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.persistence.s3.credentialsSecret }}"
+                  key: AWS_SECRET_ACCESS_KEY
+            - name: AWS_REGION
+              value: "{{ .Values.persistence.s3.region }}"
+            - name: AWS_S3_UPLOAD_BUCKET_NAME
+              value: "{{ .Values.persistence.s3.bucketName }}"
+            - name: AWS_S3_UPLOAD_BUCKET_URL
+              value: "{{ .Values.persistence.s3.endpoint }}"
+            - name: AWS_S3_FORCE_PATH_STYLE
+              value: "{{ .Values.persistence.s3.forcePathStyle }}"
+            - name: AWS_S3_ACL
+              value: "{{ .Values.persistence.s3.acl }}"
+            - name: FILE_STORAGE_UPLOAD_MAX_SIZE
+              value: "{{ .Values.persistence.s3.uploadMaxSize }}"
+          {{- else if eq .Values.persistence.type "local" }}
+            - name: FILE_STORAGE_LOCAL_ROOT_DIR
+              value: "{{ .Values.persistence.local.localRootDir }}"
+            - name: FILE_STORAGE_UPLOAD_MAX_SIZE
+              value: "{{ .Values.persistence.local.uploadMaxSize }}"
+          {{- end }}
+
+            - name: FORCE_HTTPS
+              value: "{{ .Values.outline.optional.forceHttps }}"
+            - name: ENABLE_UPDATES
+              value: "{{ .Values.outline.optional.enableUpdates }}"
+            - name: WEB_CONCURRENCY
+              value: "{{ .Values.outline.optional.webConcurrency }}"
+            - name: MAXIMUM_IMPORT_SIZE
+              value: "{{ .Values.outline.optional.maximumImportSize }}"
+            - name: LOG_LEVEL
+              value: "{{ .Values.outline.optional.logLevel }}"
+            - name: DEFAULT_LANGUAGE
+              value: "{{ .Values.outline.optional.defaultLanguage }}"
+            - name: RATE_LIMITER_ENABLED
+              value: "{{ .Values.outline.optional.rateLimiter.enabled }}"
+            - name: RATE_LIMITER_REQUESTS
+              value: "{{ .Values.outline.optional.rateLimiter.requests }}"
+            - name: RATE_LIMITER_DURATION_WINDOW
+              value: "{{ .Values.outline.optional.rateLimiter.durationWindow }}"
+            - name: DEVELOPMENT_UNSAFE_INLINE_CSP
+              value: "{{ .Values.outline.optional.developmentUnsafeInlineCsp }}"
+
+          {{- if .Values.outline.auth.oidc.enabled }}
+            - name: OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.outline.auth.oidc.clientId.existingSecretName }}"
+                  key: "{{ .Values.outline.auth.oidc.clientId.existingSecretKey }}"
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Values.outline.auth.oidc.clientSecret.existingSecretName }}"
+                  key: "{{ .Values.outline.auth.oidc.clientSecret.existingSecretKey }}"
+            - name: OIDC_AUTH_URI
+              value: "{{ .Values.outline.auth.oidc.authUri }}"
+            - name: OIDC_TOKEN_URI
+              value: "{{ .Values.outline.auth.oidc.tokenUri }}"
+            - name: OIDC_USERINFO_URI
+              value: "{{ .Values.outline.auth.oidc.userinfoUri }}"
+            - name: OIDC_USERNAME_CLAIM
+              value: "{{ .Values.outline.auth.oidc.usernameClaim }}"
+            - name: OIDC_DISPLAY_NAME
+              value: "{{ .Values.outline.auth.oidc.displayName }}"
+            - name: OIDC_SCOPES
+              value: "{{ .Values.outline.auth.oidc.scopes }}"
+          {{- end }}
+
+          resources:
+            {{- toYaml .Values.deployment.resources | nindent 12 }}
+
+      {{- if eq .Values.persistence.type "local" }}
+          volumeMounts:
+          - name: "{{ .Release.Name }}-volume-claim"
+            mountPath: {{ .Values.persistence.local.localRootDir }}
+      volumes:
+      - name: "{{ .Release.Name }}-volume-claim"
+        persistentVolumeClaim:
+          claimName: "{{ .Release.Name }}-volume-claim"
+      {{- end }}

charts/outline/templates/ingress.yaml

@@ -0,0 +1,32 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: outline-web
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: outline-web
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: outline
+  annotations:
+    {{- toYaml .Values.ingress.annotations | nindent 4 }}
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  tls:
+    - hosts:
+      - {{ .Values.ingress.host }}
+      secretName: {{ .Release.Name }}-tls-secret
+  rules:
+    - host: {{ .Values.ingress.host }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: outline-web
+                port:
+                  name: web
+{{- end }}

charts/outline/templates/persistent-volume-claim.yaml

@@ -0,0 +1,20 @@
+{{- if eq .Values.persistence.type "local" }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}-volume-claim
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: outline
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: storage
+    app.kubernetes.io/part-of: outline
+spec:
+  storageClassName: {{ .Values.persistence.local.storageClassName }}
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.persistence.local.storageSize }}
+{{- end }}

charts/outline/templates/service-account.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: outline
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: outline
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: outline

charts/outline/templates/service.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: outline-web
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: outline-web
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: outline
+spec:
+  type: ClusterIP
+  ports:
+    - port: {{ .Values.service.web.port }}
+      targetPort: web
+      protocol: TCP
+      name: web
+  selector:
+    app.kubernetes.io/name: outline-web
+    app.kubernetes.io/instance: {{ .Release.Name }}

charts/outline/values.yaml

@@ -0,0 +1,89 @@
+deployment:
+  replicas: 1
+  strategy: Recreate
+  image:
+    repository: outlinewiki/outline
+    tag: "0.75.2"
+    imagePullPolicy: IfNotPresent
+  resources:
+    requests:
+      memory: 256Mi
+      cpu: 50m
+    limits:
+      memory: 1Gi
+      cpu: 500m
+service:
+  web:
+    port: 3000
+ingress:
+  enabled: true
+  className: traefik
+  annotations:
+  host: outline.alexlebens.net
+persistence:
+  type: s3
+  s3:
+    credentialsSecret: outline-s3-secret
+    region: us-east-1
+    bucketName: outline
+    endpoint:
+    uploadMaxSize: "26214400"
+    forcePathStyle: false
+    acl: private
+  local:
+    storageClassName: default
+    storageSize: 50Gi
+    localRootDir: /var/lib/outline/data
+    uploadMaxSize: 26214400
+redis:
+  architecture: standalone
+  auth:
+    enabled: false
+outline:
+  nodeEnv: production
+  url: https://outline.alexlebens.net
+  secretKey:
+    existingSecretName: outline-key-secret
+    existingSecretKey: secret-key
+  utilsSecret:
+    existingSecretName: outline-key-secret
+    existingSecretKey: utils-key
+  database:
+    passwordSecret:
+      existingSecretName: postgresql-outline-cluster-app
+      existingSecretKey: password
+    usernameSecret:
+      existingSecretName: postgresql-outline-cluster-app
+      existingSecretKey: username
+    databaseName: app
+    databaseHost: postgresql-outline-cluster-rw
+    connectionPoolMin: ""
+    connectionPoolMax: "20"
+    sslMode: disable
+  optional:
+    forceHttps: false
+    enableUpdates: false
+    webConcurrency: 1
+    maximumImportSize: 5120000
+    logLevel: info
+    defaultLanguage: en_US
+    rateLimiter:
+      enabled: false
+      requests: 1000
+      durationWindow: 60
+    developmentUnsafeInlineCsp: false
+  auth:
+    oidc:
+      enabled: true
+      clientId:
+        existingSecretName: outline-auth-secret
+        existingSecretKey: oidc-client-id
+      clientSecret:
+        existingSecretName: outline-auth-secret
+        existingSecretKey: oidc-client-secret
+      authUri:
+      tokenUri:
+      userinfoUri:
+      usernameClaim:
+      displayName:
+      scopes: openid profile email

charts/postgres-cluster/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: postgres-cluster
-version: 0.1.1
+version: 0.2.1
 description: Chart for cloudnative-pg cluster
 keywords:
   - database

charts/postgres-cluster/templates/postgresql-cluster.yaml

@@ -42,12 +42,12 @@ spec:
   {{- if .Values.backup.recoveryEnabled }}
   bootstrap:
     recovery:
-      source: "postgresql-{{ .Release.Name }}-cluster-backup-index-{{ .Values.backup.recoveryIndex }}"
+      source: "postgresql-{{ .Release.Name }}-cluster-backup-index-{{ .Values.bootstrap.recoveryIndex }}"
   externalClusters:
-    - name: "postgresql-{{ .Release.Name }}-cluster-backup-index-{{ .Values.backup.recoveryIndex }}"
+    - name: "postgresql-{{ .Release.Name }}-cluster-backup-index-{{ .Values.bootstrap.recoveryIndex }}"
       barmanObjectStore:
-        endpointURL: {{ .Values.backup.endpointURL }}
-        destinationPath: "s3://{{ .Values.backup.bucket }}/{{ .Values.cluster.name }}/postgresql/{{ .Release.Name }}-cluster"
+        endpointURL: {{ .Values.bootstrap.endpointURL }}
+        destinationPath: "s3://{{ .Values.bootstrap.bucket }}/{{ .Values.cluster.name }}/postgresql/{{ .Release.Name }}-cluster"
         s3Credentials:
           accessKeyId:
             name: "postgresql-{{ .Release.Name }}-cluster-backup-secret"
@@ -56,9 +56,9 @@ spec:
             name: "postgresql-{{ .Release.Name }}-cluster-backup-secret"
             key: ACCESS_SECRET_KEY
         data:
-          compression: {{ .Values.backup.compression }}
+          compression: {{ .Values.cluster.compression }}
         wal:
-          compression: {{ .Values.backup.compression }}
+          compression: {{ .Values.cluster.compression }}
   {{- end }}
 
   {{- if .Values.backup.backupEnabled }}
@@ -76,7 +76,7 @@ spec:
           name: "postgresql-{{ .Release.Name }}-cluster-backup-secret"
           key: ACCESS_SECRET_KEY
       data:
-        compression: {{ .Values.backup.compression }}
+        compression: {{ .Values.cluster.compression }}
       wal:
-        compression: {{ .Values.backup.compression }}
+        compression: {{ .Values.cluster.compression }}
   {{- end }}

charts/postgres-cluster/templates/scheduled-backup.yaml

@@ -9,7 +9,6 @@ metadata:
     app.kubernetes.io/version: {{ .Chart.AppVersion }}
     app.kubernetes.io/component: database
     app.kubernetes.io/part-of: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: helm
 spec:
   schedule: {{ .Values.backup.schedule }}
   backupOwnerReference: self

charts/postgres-cluster/values.yaml

@@ -8,6 +8,7 @@ cluster:
     shared_buffers: 128MB
     max_slot_wal_keep_size: 2000MB
     hot_standby_feedback: "on"
+  compression: snappy
   resources:
     requests:
       memory: 512Mi
@@ -24,17 +25,18 @@ cluster:
       storageClass: ceph-block
       size: 2Gi
 bootstrap:
+  recoveryEnabled: false
+  recoveryIndex: 1
+  endpointURL: https://nyc3.digitaloceanspaces.com
+  bucket: alexlebens.net
   initdbEnabled: false
   initdb:
     database: app
     owner: app
 backup:
   backupEnabled: true
-  recoveryEnabled: false  
   schedule: "0 0 0 * * *"
   retentionPolicy: 14d
   backupIndex: 1
-  recoveryIndex: 1
   endpointURL: https://nyc3.digitaloceanspaces.com
-  bucket: net-infra
-  compression: snappy
+  bucket: alexlebens.net