migrate
This commit is contained in:
6
clusters/cl01tl/helm/audiobookshelf/Chart.lock
Normal file
6
clusters/cl01tl/helm/audiobookshelf/Chart.lock
Normal file
@@ -0,0 +1,6 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
digest: sha256:f3a9990542f24965fadad0b5493059b78cdc3fae91c8214577fa6f41ca5f7de3
|
||||
generated: "2025-11-30T21:05:21.317114-06:00"
|
||||
23
clusters/cl01tl/helm/audiobookshelf/Chart.yaml
Normal file
23
clusters/cl01tl/helm/audiobookshelf/Chart.yaml
Normal file
@@ -0,0 +1,23 @@
|
||||
apiVersion: v2
|
||||
name: audiobookshelf
|
||||
version: 1.0.0
|
||||
description: Audiobookshelf
|
||||
keywords:
|
||||
- audiobookshelf
|
||||
- books
|
||||
- podcasts
|
||||
- audiobooks
|
||||
home: https://wiki.alexlebens.dev/s/d4d6719f-cd1c-4b6e-b78e-2d2d7a5097d7
|
||||
sources:
|
||||
- https://github.com/advplyr/audiobookshelf
|
||||
- https://github.com/advplyr/audiobookshelf/pkgs/container/audiobookshelf
|
||||
- https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
|
||||
maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: app-template
|
||||
alias: audiobookshelf
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/audiobookshelf.png
|
||||
appVersion: 2.21.0
|
||||
@@ -0,0 +1,135 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: audiobookshelf-apprise-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: audiobookshelf-apprise-config
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ntfy-url
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/audiobookshelf/apprise
|
||||
metadataPolicy: None
|
||||
property: ntfy-url
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: audiobookshelf-config-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: audiobookshelf-config-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/audiobookshelf/audiobookshelf-config"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: S3_BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: access_key
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: secret_key
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: audiobookshelf-metadata-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: audiobookshelf-metadata-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/audiobookshelf/audiobookshelf-metadata"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: S3_BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: access_key
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: secret_key
|
||||
@@ -0,0 +1,28 @@
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: http-route-audiobookshelf
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: http-route-audiobookshelf
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: traefik-gateway
|
||||
namespace: traefik
|
||||
hostnames:
|
||||
- audiobookshelf.alexlebens.net
|
||||
rules:
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
backendRefs:
|
||||
- group: ''
|
||||
kind: Service
|
||||
name: audiobookshelf
|
||||
port: 80
|
||||
weight: 100
|
||||
@@ -0,0 +1,36 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: audiobookshelf-nfs-storage-backup
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: audiobookshelf-nfs-storage-backup
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
volumeMode: Filesystem
|
||||
storageClassName: nfs-client
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: audiobookshelf-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: audiobookshelf-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
volumeName: audiobookshelf-nfs-storage
|
||||
storageClassName: nfs-client
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
@@ -0,0 +1,23 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: audiobookshelf-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: audiobookshelf-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: nfs-client
|
||||
capacity:
|
||||
storage: 1Gi
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
nfs:
|
||||
path: /volume2/Storage
|
||||
server: synologybond.alexlebens.net
|
||||
mountOptions:
|
||||
- vers=4
|
||||
- minorversion=1
|
||||
- noac
|
||||
@@ -0,0 +1,52 @@
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: audiobookshelf-config-backup-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: audiobookshelf-config-backup-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: audiobookshelf-config
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: audiobookshelf-config-backup-secret
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
|
||||
---
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: audiobookshelf-metadata-backup-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: audiobookshelf-metadata-backup-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: audiobookshelf-metadata
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: audiobookshelf-metadata-backup-secret
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
@@ -0,0 +1,19 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: audiobookshelf-apprise
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: audiobookshelf-apprise
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
endpoints:
|
||||
- port: apprise
|
||||
interval: 30s
|
||||
scrapeTimeout: 15s
|
||||
path: /metrics
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: audiobookshelf
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
94
clusters/cl01tl/helm/audiobookshelf/values.yaml
Normal file
94
clusters/cl01tl/helm/audiobookshelf/values.yaml
Normal file
@@ -0,0 +1,94 @@
|
||||
audiobookshelf:
|
||||
controllers:
|
||||
main:
|
||||
type: deployment
|
||||
replicas: 1
|
||||
strategy: Recreate
|
||||
revisionHistoryLimit: 3
|
||||
containers:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/advplyr/audiobookshelf
|
||||
tag: 2.30.0
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: TZ
|
||||
value: US/Central
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
apprise-api:
|
||||
image:
|
||||
repository: caronc/apprise
|
||||
tag: 1.2.6
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: TZ
|
||||
value: US/Central
|
||||
- name: PGID
|
||||
value: "1000"
|
||||
- name: PUID
|
||||
value: "1000"
|
||||
- name: APPRISE_STORAGE_MODE
|
||||
value: memory
|
||||
- name: APPRISE_STATEFUL_MODE
|
||||
value: disabled
|
||||
- name: APPRISE_WORKER_COUNT
|
||||
value: 1
|
||||
- name: APPRISE_STATELESS_URLS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: audiobookshelf-apprise-config
|
||||
key: ntfy-url
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
service:
|
||||
main:
|
||||
controller: main
|
||||
ports:
|
||||
http:
|
||||
port: 80
|
||||
targetPort: 80
|
||||
protocol: HTTP
|
||||
apprise:
|
||||
port: 8000
|
||||
targetPort: 8000
|
||||
protocol: HTTP
|
||||
persistence:
|
||||
config:
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 2Gi
|
||||
retain: true
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /config
|
||||
readOnly: false
|
||||
metadata:
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 10Gi
|
||||
retain: true
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /metadata
|
||||
readOnly: false
|
||||
backup:
|
||||
existingClaim: audiobookshelf-nfs-storage-backup
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /metadata/backups
|
||||
readOnly: false
|
||||
audiobooks:
|
||||
existingClaim: audiobookshelf-nfs-storage
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /mnt/store/
|
||||
readOnly: false
|
||||
9
clusters/cl01tl/helm/booklore/Chart.lock
Normal file
9
clusters/cl01tl/helm/booklore/Chart.lock
Normal file
@@ -0,0 +1,9 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: mariadb-cluster
|
||||
repository: https://helm.mariadb.com/mariadb-operator
|
||||
version: 25.10.2
|
||||
digest: sha256:264725306c1d1f38140293c0820abdc7e8aa4f39764b4d91e20200705ce2ec91
|
||||
generated: "2025-11-30T21:05:24.649316-06:00"
|
||||
24
clusters/cl01tl/helm/booklore/Chart.yaml
Normal file
24
clusters/cl01tl/helm/booklore/Chart.yaml
Normal file
@@ -0,0 +1,24 @@
|
||||
apiVersion: v2
|
||||
name: booklore
|
||||
version: 1.0.0
|
||||
description: booklore
|
||||
keywords:
|
||||
- booklore
|
||||
- books
|
||||
home: https://wiki.alexlebens.dev/
|
||||
sources:
|
||||
- https://github.com/booklore-app/BookLore
|
||||
- https://github.com/booklore-app/booklore/pkgs/container/booklore
|
||||
- https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
|
||||
maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: app-template
|
||||
alias: booklore
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: mariadb-cluster
|
||||
version: 25.10.2
|
||||
repository: https://helm.mariadb.com/mariadb-operator
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/booklore.png
|
||||
appVersion: v.1.10.0
|
||||
332
clusters/cl01tl/helm/booklore/templates/external-secret.yaml
Normal file
332
clusters/cl01tl/helm/booklore/templates/external-secret.yaml
Normal file
@@ -0,0 +1,332 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: booklore-database-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-database-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: password
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/booklore/database
|
||||
metadataPolicy: None
|
||||
property: password
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: booklore-data-replication-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-data-replication-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: psk.txt
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/booklore/replication
|
||||
metadataPolicy: None
|
||||
property: psk.txt
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: booklore-config-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-config-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/booklore/booklore-config"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /volsync/restic/digital-ocean
|
||||
metadataPolicy: None
|
||||
property: BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /volsync/restic/digital-ocean
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: AWS_ACCESS_KEY_ID
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: AWS_SECRET_ACCESS_KEY
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: booklore-data-backup-secret-local
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-data-backup-secret-local
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/booklore/booklore-data"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /volsync/restic/garage-local
|
||||
metadataPolicy: None
|
||||
property: BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /volsync/restic/garage-local
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_KEY_ID
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_SECRET_KEY
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: booklore-data-backup-secret-remote
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-data-backup-secret-remote
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/booklore/booklore-data"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /volsync/restic/garage-remote
|
||||
metadataPolicy: None
|
||||
property: BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /volsync/restic/garage-remote
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_KEY_ID
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_SECRET_KEY
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: booklore-data-backup-secret-external
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-data-backup-secret-external
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/booklore/booklore-data"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /volsync/restic/digital-ocean
|
||||
metadataPolicy: None
|
||||
property: BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /volsync/restic/digital-ocean
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: AWS_ACCESS_KEY_ID
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: AWS_SECRET_ACCESS_KEY
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: booklore-mariadb-cluster-backup-secret-external
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-mariadb-cluster-backup-secret-external
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: access
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/mariadb-backups
|
||||
metadataPolicy: None
|
||||
property: access
|
||||
- secretKey: secret
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/mariadb-backups
|
||||
metadataPolicy: None
|
||||
property: secret
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: booklore-mariadb-cluster-backup-secret-garage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-mariadb-cluster-backup-secret-garage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: access
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/mariadb-backups
|
||||
metadataPolicy: None
|
||||
property: access
|
||||
- secretKey: secret
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/mariadb-backups
|
||||
metadataPolicy: None
|
||||
property: secret
|
||||
28
clusters/cl01tl/helm/booklore/templates/http-route.yaml
Normal file
28
clusters/cl01tl/helm/booklore/templates/http-route.yaml
Normal file
@@ -0,0 +1,28 @@
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: http-route-booklore
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: http-route-booklore
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: traefik-gateway
|
||||
namespace: traefik
|
||||
hostnames:
|
||||
- booklore.alexlebens.net
|
||||
rules:
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
backendRefs:
|
||||
- group: ''
|
||||
kind: Service
|
||||
name: booklore
|
||||
port: 80
|
||||
weight: 100
|
||||
10
clusters/cl01tl/helm/booklore/templates/namespace.yaml
Normal file
10
clusters/cl01tl/helm/booklore/templates/namespace.yaml
Normal file
@@ -0,0 +1,10 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: booklore
|
||||
annotations:
|
||||
volsync.backube/privileged-movers: "true"
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
@@ -0,0 +1,36 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: booklore-books-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-books-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
volumeName: booklore-books-nfs-storage
|
||||
storageClassName: nfs-client
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: booklore-books-import-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-books-import-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
volumeName: booklore-books-import-nfs-storage
|
||||
storageClassName: nfs-client
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
@@ -0,0 +1,48 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: booklore-books-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-books-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: nfs-client
|
||||
capacity:
|
||||
storage: 1Gi
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
nfs:
|
||||
path: /volume2/Storage/Books
|
||||
server: synologybond.alexlebens.net
|
||||
mountOptions:
|
||||
- vers=4
|
||||
- minorversion=1
|
||||
- noac
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: booklore-books-import-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-books-import-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: nfs-client
|
||||
capacity:
|
||||
storage: 1Gi
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
nfs:
|
||||
path: /volume2/Storage/Books Import
|
||||
server: synologybond.alexlebens.net
|
||||
mountOptions:
|
||||
- vers=4
|
||||
- minorversion=1
|
||||
- noac
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationDestination
|
||||
metadata:
|
||||
name: booklore-data-replication-destination
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-data-replication-destination
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
rsyncTLS:
|
||||
copyMethod: Direct
|
||||
accessModes: ["ReadWriteMany"]
|
||||
destinationPVC: booklore-books-nfs-storage
|
||||
keySecret: booklore-data-replication-secret
|
||||
129
clusters/cl01tl/helm/booklore/templates/replication-source.yaml
Normal file
129
clusters/cl01tl/helm/booklore/templates/replication-source.yaml
Normal file
@@ -0,0 +1,129 @@
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: booklore-data-replication-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-data-replication-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: booklore-data
|
||||
trigger:
|
||||
schedule: "0 0 * * *"
|
||||
rsyncTLS:
|
||||
keySecret: booklore-data-replication-secret
|
||||
address: volsync-rsync-tls-dst-booklore-data-replication-destination
|
||||
copyMethod: Snapshot
|
||||
|
||||
---
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: booklore-config-backup-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-config-backup-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: booklore-config
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: booklore-config-backup-secret
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
cacheCapacity: 10Gi
|
||||
|
||||
---
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: booklore-data-backup-source-local
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-data-backup-source-local
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: booklore-data
|
||||
trigger:
|
||||
schedule: 0 2 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: booklore-data-backup-secret-local
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
cacheCapacity: 10Gi
|
||||
|
||||
---
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: booklore-data-backup-source-remote
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-data-backup-source-remote
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: booklore-data
|
||||
trigger:
|
||||
schedule: 0 3 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: booklore-data-backup-secret-remote
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
cacheCapacity: 10Gi
|
||||
|
||||
---
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: booklore-data-backup-source-external
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-data-backup-source-external
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: booklore-data
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: booklore-data-backup-secret-external
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
cacheCapacity: 10Gi
|
||||
14
clusters/cl01tl/helm/booklore/templates/service.yaml
Normal file
14
clusters/cl01tl/helm/booklore/templates/service.yaml
Normal file
@@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: garage-ps10rp
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: garage-ps10rp
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
annotations:
|
||||
tailscale.com/tailnet-fqdn: garage-ps10rp.boreal-beaufort.ts.net
|
||||
spec:
|
||||
externalName: placeholder
|
||||
type: ExternalName
|
||||
155
clusters/cl01tl/helm/booklore/values.yaml
Normal file
155
clusters/cl01tl/helm/booklore/values.yaml
Normal file
@@ -0,0 +1,155 @@
|
||||
booklore:
|
||||
controllers:
|
||||
main:
|
||||
type: deployment
|
||||
replicas: 1
|
||||
strategy: Recreate
|
||||
revisionHistoryLimit: 3
|
||||
containers:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/booklore-app/booklore
|
||||
tag: v1.12.0
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: TZ
|
||||
value: America/Chicago
|
||||
- name: DATABASE_URL
|
||||
value: jdbc:mariadb://booklore-mariadb-cluster-primary.booklore:3306/booklore
|
||||
- name: DATABASE_USERNAME
|
||||
value: booklore
|
||||
- name: DATABASE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: booklore-database-secret
|
||||
key: password
|
||||
- name: BOOKLORE_PORT
|
||||
value: 6060
|
||||
- name: SWAGGER_ENABLED
|
||||
value: false
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
service:
|
||||
main:
|
||||
controller: main
|
||||
ports:
|
||||
http:
|
||||
port: 80
|
||||
targetPort: 6060
|
||||
protocol: HTTP
|
||||
persistence:
|
||||
config:
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
retain: true
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /app/data
|
||||
readOnly: false
|
||||
data:
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 10Gi
|
||||
retain: true
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /data
|
||||
readOnly: false
|
||||
books-import:
|
||||
type: emptyDir
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /bookdrop
|
||||
readOnly: false
|
||||
ingest:
|
||||
existingClaim: booklore-books-import-nfs-storage
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /bookdrop/ingest
|
||||
readOnly: false
|
||||
mariadb-cluster:
|
||||
mariadb:
|
||||
rootPasswordSecretKeyRef:
|
||||
generate: false
|
||||
name: booklore-database-secret
|
||||
key: password
|
||||
storage:
|
||||
size: 5Gi
|
||||
replicas: 3
|
||||
galera:
|
||||
enabled: true
|
||||
databases:
|
||||
- name: booklore
|
||||
characterSet: utf8
|
||||
collate: utf8_general_ci
|
||||
cleanupPolicy: Delete
|
||||
requeueInterval: 10h
|
||||
users:
|
||||
- name: booklore
|
||||
passwordSecretKeyRef:
|
||||
name: booklore-database-secret
|
||||
key: password
|
||||
host: '%'
|
||||
cleanupPolicy: Delete
|
||||
requeueInterval: 10h
|
||||
retryInterval: 30s
|
||||
grants:
|
||||
- name: booklore
|
||||
privileges:
|
||||
- "ALL PRIVILEGES"
|
||||
database: "booklore"
|
||||
table: "*"
|
||||
username: booklore
|
||||
grantOption: true
|
||||
host: '%'
|
||||
cleanupPolicy: Delete
|
||||
requeueInterval: 10h
|
||||
retryInterval: 30s
|
||||
physicalBackups:
|
||||
- name: backup-external
|
||||
schedule:
|
||||
cron: "0 0 * * 0"
|
||||
suspend: false
|
||||
immediate: true
|
||||
compression: gzip
|
||||
maxRetention: 720h
|
||||
storage:
|
||||
s3:
|
||||
bucket: mariadb-backups-b230a2f5aecf080a4b372c08
|
||||
prefix: cl01tl/booklore
|
||||
endpoint: nyc3.digitaloceanspaces.com
|
||||
region: us-east-1
|
||||
accessKeyIdSecretKeyRef:
|
||||
name: booklore-mariadb-cluster-backup-secret-external
|
||||
key: access
|
||||
secretAccessKeySecretKeyRef:
|
||||
name: booklore-mariadb-cluster-backup-secret-external
|
||||
key: secret
|
||||
tls:
|
||||
enabled: true
|
||||
- name: backup-garage
|
||||
schedule:
|
||||
cron: "0 0 * * *"
|
||||
suspend: false
|
||||
immediate: true
|
||||
compression: gzip
|
||||
maxRetention: 360h
|
||||
storage:
|
||||
s3:
|
||||
bucket: mariadb-backups
|
||||
prefix: cl01tl/booklore
|
||||
endpoint: garage-main.garage:3900
|
||||
region: us-east-1
|
||||
accessKeyIdSecretKeyRef:
|
||||
name: booklore-mariadb-cluster-backup-secret-garage
|
||||
key: access
|
||||
secretAccessKeySecretKeyRef:
|
||||
name: booklore-mariadb-cluster-backup-secret-garage
|
||||
key: secret
|
||||
12
clusters/cl01tl/helm/directus/Chart.lock
Normal file
12
clusters/cl01tl/helm/directus/Chart.lock
Normal file
@@ -0,0 +1,12 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.0
|
||||
- name: postgres-cluster
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 6.16.0
|
||||
digest: sha256:2f3d9f7a8d8d71b19ff3292993647d22a89aa6c444a6f0819b82cd0a577f1ebc
|
||||
generated: "2025-11-30T21:05:28.43692-06:00"
|
||||
33
clusters/cl01tl/helm/directus/Chart.yaml
Normal file
33
clusters/cl01tl/helm/directus/Chart.yaml
Normal file
@@ -0,0 +1,33 @@
|
||||
apiVersion: v2
|
||||
name: directus
|
||||
version: 1.0.0
|
||||
description: Directus
|
||||
keywords:
|
||||
- directus
|
||||
- cms
|
||||
home: https://wiki.alexlebens.dev/s/c2d242de-dcaa-4801-86a2-c4761dc8bf9b
|
||||
sources:
|
||||
- https://github.com/directus/directus
|
||||
- https://github.com/cloudflare/cloudflared
|
||||
- https://github.com/cloudnative-pg/cloudnative-pg
|
||||
- https://hub.docker.com/r/directus/directus
|
||||
- https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
|
||||
- https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
|
||||
- https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
|
||||
maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: app-template
|
||||
alias: directus
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: cloudflared
|
||||
alias: cloudflared-directus
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.0
|
||||
- name: postgres-cluster
|
||||
alias: postgres-17-cluster
|
||||
version: 6.16.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/directus.png
|
||||
appVersion: 11.7.2
|
||||
245
clusters/cl01tl/helm/directus/templates/external-secret.yaml
Normal file
245
clusters/cl01tl/helm/directus/templates/external-secret.yaml
Normal file
@@ -0,0 +1,245 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: directus-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: directus-config
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: admin-email
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/directus/config
|
||||
metadataPolicy: None
|
||||
property: admin-email
|
||||
- secretKey: admin-password
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/directus/config
|
||||
metadataPolicy: None
|
||||
property: admin-password
|
||||
- secretKey: secret
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/directus/config
|
||||
metadataPolicy: None
|
||||
property: secret
|
||||
- secretKey: key
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/directus/config
|
||||
metadataPolicy: None
|
||||
property: key
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: directus-metric-token
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: directus-metric-token
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: metric-token
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/directus/metrics
|
||||
metadataPolicy: None
|
||||
property: metric-token
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: directus-redis-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: directus-redis-config
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: user
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/directus/redis
|
||||
metadataPolicy: None
|
||||
property: user
|
||||
- secretKey: password
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/directus/redis
|
||||
metadataPolicy: None
|
||||
property: password
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: directus-oidc-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: directus-oidc-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: OIDC_CLIENT_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /authentik/oidc/directus
|
||||
metadataPolicy: None
|
||||
property: client
|
||||
- secretKey: OIDC_CLIENT_SECRET
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /authentik/oidc/directus
|
||||
metadataPolicy: None
|
||||
property: secret
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: directus-cloudflared-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: directus-cloudflared-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: cf-tunnel-token
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cloudflare/tunnels/directus
|
||||
metadataPolicy: None
|
||||
property: token
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: directus-postgresql-17-cluster-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: directus-postgresql-17-cluster-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: access
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: secret
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: directus-postgresql-17-cluster-backup-secret-weekly
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: directus-postgresql-17-cluster-backup-secret-weekly
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_KEY_ID
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_SECRET_KEY
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: directus-postgresql-17-cluster-backup-secret-garage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: directus-postgresql-17-cluster-backup-secret-garage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_KEY_ID
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_SECRET_KEY
|
||||
- secretKey: ACCESS_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_REGION
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: objectbucket.io/v1alpha1
|
||||
kind: ObjectBucketClaim
|
||||
metadata:
|
||||
name: ceph-bucket-directus
|
||||
labels:
|
||||
app.kubernetes.io/name: ceph-bucket-directus
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
generateBucketName: bucket-directus
|
||||
storageClassName: ceph-bucket
|
||||
@@ -0,0 +1,35 @@
|
||||
apiVersion: redis.redis.opstreelabs.in/v1beta2
|
||||
kind: RedisReplication
|
||||
metadata:
|
||||
name: redis-replication-directus
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: redis-replication-directus
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
clusterSize: 3
|
||||
podSecurityContext:
|
||||
runAsUser: 1000
|
||||
fsGroup: 1000
|
||||
kubernetesConfig:
|
||||
image: quay.io/opstree/redis:v8.2.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
redisSecret:
|
||||
name: directus-redis-config
|
||||
key: password
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
storage:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
storageClassName: ceph-block
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
redisExporter:
|
||||
enabled: true
|
||||
image: quay.io/opstree/redis-exporter:v1.76.0
|
||||
30
clusters/cl01tl/helm/directus/templates/redis-sentinel.yaml
Normal file
30
clusters/cl01tl/helm/directus/templates/redis-sentinel.yaml
Normal file
@@ -0,0 +1,30 @@
|
||||
apiVersion: redis.redis.opstreelabs.in/v1beta2
|
||||
kind: RedisSentinel
|
||||
metadata:
|
||||
name: redis-sentinel-directus
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: redis-sentinel-directus
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
clusterSize: 3
|
||||
podSecurityContext:
|
||||
runAsUser: 1000
|
||||
fsGroup: 1000
|
||||
redisSentinelConfig:
|
||||
redisReplicationName: redis-replication-directus
|
||||
redisReplicationPassword:
|
||||
secretKeyRef:
|
||||
name: directus-redis-config
|
||||
key: password
|
||||
kubernetesConfig:
|
||||
image: quay.io/opstree/redis-sentinel:v7.0.15
|
||||
imagePullPolicy: IfNotPresent
|
||||
redisSecret:
|
||||
name: directus-redis-config
|
||||
key: password
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
43
clusters/cl01tl/helm/directus/templates/service-monitor.yaml
Normal file
43
clusters/cl01tl/helm/directus/templates/service-monitor.yaml
Normal file
@@ -0,0 +1,43 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: directus
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: directus
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: directus
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
endpoints:
|
||||
- port: http
|
||||
interval: 30s
|
||||
scrapeTimeout: 15s
|
||||
path: /metrics
|
||||
bearerTokenSecret:
|
||||
name: directus-metric-token
|
||||
key: metric-token
|
||||
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: redis-replication-directus
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: redis-replication-directus
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
redis-operator: "true"
|
||||
env: production
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
redis_setup_type: replication
|
||||
endpoints:
|
||||
- port: redis-exporter
|
||||
interval: 30s
|
||||
scrapeTimeout: 10s
|
||||
214
clusters/cl01tl/helm/directus/values.yaml
Normal file
214
clusters/cl01tl/helm/directus/values.yaml
Normal file
@@ -0,0 +1,214 @@
|
||||
directus:
|
||||
controllers:
|
||||
main:
|
||||
type: deployment
|
||||
replicas: 1
|
||||
strategy: Recreate
|
||||
revisionHistoryLimit: 3
|
||||
containers:
|
||||
main:
|
||||
image:
|
||||
repository: directus/directus
|
||||
tag: 11.13.4
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: PUBLIC_URL
|
||||
value: https://directus.alexlebens.dev
|
||||
- name: WEBSOCKETS_ENABLED
|
||||
value: true
|
||||
- name: ADMIN_EMAIL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-config
|
||||
key: admin-email
|
||||
- name: ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-config
|
||||
key: admin-password
|
||||
- name: SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-config
|
||||
key: secret
|
||||
- name: KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-config
|
||||
key: key
|
||||
- name: DB_CLIENT
|
||||
value: postgres
|
||||
- name: DB_HOST
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-postgresql-17-cluster-app
|
||||
key: host
|
||||
- name: DB_DATABASE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-postgresql-17-cluster-app
|
||||
key: dbname
|
||||
- name: DB_PORT
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-postgresql-17-cluster-app
|
||||
key: port
|
||||
- name: DB_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-postgresql-17-cluster-app
|
||||
key: user
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-postgresql-17-cluster-app
|
||||
key: password
|
||||
- name: SYNCHRONIZATION_STORE
|
||||
value: redis
|
||||
- name: CACHE_ENABLED
|
||||
value: true
|
||||
- name: CACHE_STORE
|
||||
value: redis
|
||||
- name: REDIS_ENABLED
|
||||
value: true
|
||||
- name: REDIS_HOST
|
||||
value: redis-replication-directus-master
|
||||
- name: REDIS_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-redis-config
|
||||
key: user
|
||||
- name: REDIS_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-redis-config
|
||||
key: password
|
||||
- name: STORAGE_LOCATIONS
|
||||
value: s3
|
||||
- name: STORAGE_S3_DRIVER
|
||||
value: s3
|
||||
- name: STORAGE_S3_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: ceph-bucket-directus
|
||||
key: AWS_ACCESS_KEY_ID
|
||||
- name: STORAGE_S3_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: ceph-bucket-directus
|
||||
key: AWS_SECRET_ACCESS_KEY
|
||||
- name: STORAGE_S3_BUCKET
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: ceph-bucket-directus
|
||||
key: BUCKET_NAME
|
||||
- name: STORAGE_S3_REGION
|
||||
value: us-east-1
|
||||
- name: STORAGE_S3_ENDPOINT
|
||||
value: http://rook-ceph-rgw-ceph-objectstore.rook-ceph.svc:80
|
||||
- name: STORAGE_S3_FORCE_PATH_STYLE
|
||||
value: true
|
||||
- name: AUTH_PROVIDERS
|
||||
value: AUTHENTIK
|
||||
- name: AUTH_AUTHENTIK_DRIVER
|
||||
value: openid
|
||||
- name: AUTH_AUTHENTIK_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-oidc-secret
|
||||
key: OIDC_CLIENT_ID
|
||||
- name: AUTH_AUTHENTIK_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-oidc-secret
|
||||
key: OIDC_CLIENT_SECRET
|
||||
- name: AUTH_AUTHENTIK_SCOPE
|
||||
value: openid profile email
|
||||
- name: AUTH_AUTHENTIK_ISSUER_URL
|
||||
value: https://auth.alexlebens.dev/application/o/directus/.well-known/openid-configuration
|
||||
- name: AUTH_AUTHENTIK_IDENTIFIER_KEY
|
||||
value: email
|
||||
- name: AUTH_AUTHENTIK_ALLOW_PUBLIC_REGISTRATION
|
||||
value: true
|
||||
- name: AUTH_AUTHENTIK_LABEL
|
||||
value: Authentik
|
||||
- name: TELEMETRY
|
||||
value: false
|
||||
- name: METRICS_ENABLED
|
||||
value: true
|
||||
- name: METRICS_TOKENS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-metric-token
|
||||
key: metric-token
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 256Mi
|
||||
service:
|
||||
main:
|
||||
controller: main
|
||||
ports:
|
||||
http:
|
||||
port: 80
|
||||
targetPort: 8055
|
||||
protocol: TCP
|
||||
cloudflared-directus:
|
||||
name: cloudflared-directus
|
||||
existingSecretName: directus-cloudflared-secret
|
||||
postgres-17-cluster:
|
||||
mode: recovery
|
||||
cluster:
|
||||
storage:
|
||||
storageClass: local-path
|
||||
walStorage:
|
||||
storageClass: local-path
|
||||
monitoring:
|
||||
enabled: true
|
||||
prometheusRule:
|
||||
enabled: true
|
||||
recovery:
|
||||
method: objectStore
|
||||
objectStore:
|
||||
destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-17-cluster
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
index: 1
|
||||
endpointCredentials: directus-postgresql-17-cluster-backup-secret-garage
|
||||
backup:
|
||||
objectStore:
|
||||
- name: external
|
||||
destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/directus/directus-postgresql-17-cluster
|
||||
index: 1
|
||||
retentionPolicy: "30d"
|
||||
isWALArchiver: false
|
||||
- name: garage-local
|
||||
destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-17-cluster
|
||||
index: 1
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
endpointCredentials: directus-postgresql-17-cluster-backup-secret-garage
|
||||
endpointCredentialsIncludeRegion: true
|
||||
retentionPolicy: "3d"
|
||||
isWALArchiver: true
|
||||
# - name: garage-remote
|
||||
# destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-17-cluster
|
||||
# index: 1
|
||||
# endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
|
||||
# endpointCredentials: directus-postgresql-17-cluster-backup-secret-garage
|
||||
# retentionPolicy: "30d"
|
||||
# data:
|
||||
# compression: bzip2
|
||||
# jobs: 2
|
||||
scheduledBackups:
|
||||
- name: daily-backup
|
||||
suspend: false
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: external
|
||||
- name: live-backup
|
||||
suspend: false
|
||||
immediate: true
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: garage-local
|
||||
# - name: weekly-backup
|
||||
# suspend: false
|
||||
# schedule: "0 0 4 * * SAT"
|
||||
# backupName: garage-remote
|
||||
12
clusters/cl01tl/helm/freshrss/Chart.lock
Normal file
12
clusters/cl01tl/helm/freshrss/Chart.lock
Normal file
@@ -0,0 +1,12 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.0
|
||||
- name: postgres-cluster
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 6.16.0
|
||||
digest: sha256:1c1355c247383bb5aef029eaadaf0c6bbcc23c0e42868178c1ea9a9ab21cc704
|
||||
generated: "2025-11-30T21:05:34.030606-06:00"
|
||||
33
clusters/cl01tl/helm/freshrss/Chart.yaml
Normal file
33
clusters/cl01tl/helm/freshrss/Chart.yaml
Normal file
@@ -0,0 +1,33 @@
|
||||
apiVersion: v2
|
||||
name: freshrss
|
||||
version: 1.0.0
|
||||
description: FreshRSS
|
||||
keywords:
|
||||
- freshrss
|
||||
- rss
|
||||
home: https://wiki.alexlebens.dev/s/251cb7cb-2797-4bbb-8597-32757aa96391
|
||||
sources:
|
||||
- https://github.com/FreshRSS/FreshRSS
|
||||
- https://github.com/cloudflare/cloudflared
|
||||
- https://github.com/cloudnative-pg/cloudnative-pg
|
||||
- https://hub.docker.com/r/freshrss/freshrss
|
||||
- https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
|
||||
- https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
|
||||
- https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
|
||||
maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: app-template
|
||||
alias: freshrss
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: cloudflared
|
||||
alias: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.0
|
||||
- name: postgres-cluster
|
||||
alias: postgres-17-cluster
|
||||
version: 6.16.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/freshrss.png
|
||||
appVersion: 1.26.2
|
||||
219
clusters/cl01tl/helm/freshrss/templates/external-secret.yaml
Normal file
219
clusters/cl01tl/helm/freshrss/templates/external-secret.yaml
Normal file
@@ -0,0 +1,219 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: freshrss-install-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: freshrss-install-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ADMIN_EMAIL
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/freshrss/config
|
||||
metadataPolicy: None
|
||||
property: ADMIN_EMAIL
|
||||
- secretKey: ADMIN_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/freshrss/config
|
||||
metadataPolicy: None
|
||||
property: ADMIN_PASSWORD
|
||||
- secretKey: ADMIN_API_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/freshrss/config
|
||||
metadataPolicy: None
|
||||
property: ADMIN_API_PASSWORD
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: freshrss-oidc-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: freshrss-oidc-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: OIDC_CLIENT_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /authentik/oidc/freshrss
|
||||
metadataPolicy: None
|
||||
property: client
|
||||
- secretKey: OIDC_CLIENT_SECRET
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /authentik/oidc/freshrss
|
||||
metadataPolicy: None
|
||||
property: secret
|
||||
- secretKey: OIDC_CLIENT_CRYPTO_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /authentik/oidc/freshrss
|
||||
metadataPolicy: None
|
||||
property: crypto-key
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: freshrss-cloudflared-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: freshrss-cloudflared-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: cf-tunnel-token
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cloudflare/tunnels/freshrss
|
||||
metadataPolicy: None
|
||||
property: token
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: freshrss-data-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: freshrss-data-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/freshrss/freshrss-data"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: S3_BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: access_key
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: secret_key
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: freshrss-postgresql-17-cluster-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: freshrss-postgresql-17-cluster-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: access
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: secret
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: freshrss-postgresql-17-cluster-backup-secret-garage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: freshrss-postgresql-17-cluster-backup-secret-garage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_KEY_ID
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_SECRET_KEY
|
||||
- secretKey: ACCESS_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_REGION
|
||||
@@ -0,0 +1,35 @@
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: freshrss-data-backup-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: freshrss-data-backup-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: freshrss-data
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: freshrss-data-backup-secret
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
moverSecurityContext:
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
supplementalGroups:
|
||||
- 44
|
||||
- 100
|
||||
- 109
|
||||
- 65539
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
251
clusters/cl01tl/helm/freshrss/values.yaml
Normal file
251
clusters/cl01tl/helm/freshrss/values.yaml
Normal file
@@ -0,0 +1,251 @@
|
||||
freshrss:
|
||||
controllers:
|
||||
main:
|
||||
type: deployment
|
||||
replicas: 1
|
||||
strategy: Recreate
|
||||
revisionHistoryLimit: 3
|
||||
initContainers:
|
||||
init-download-extension-1:
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
image:
|
||||
repository: alpine
|
||||
tag: 3.22.2
|
||||
pullPolicy: IfNotPresent
|
||||
command:
|
||||
- /bin/sh
|
||||
- -ec
|
||||
- |
|
||||
apk add --no-cache git;
|
||||
cd /tmp;
|
||||
git clone -n --depth=1 --filter=tree:0 https://github.com/cn-tools/cntools_FreshRssExtensions.git;
|
||||
cd cntools_FreshRssExtensions;
|
||||
git sparse-checkout set --no-cone /xExtension-YouTubeChannel2RssFeed;
|
||||
git checkout;
|
||||
rm -rf /var/www/FreshRSS/extensions/xExtension-YouTubeChannel2RssFeed
|
||||
cp -r xExtension-YouTubeChannel2RssFeed /var/www/FreshRSS/extensions
|
||||
chown -R 568:568 /var/www/FreshRSS/extensions/xExtension-YouTubeChannel2RssFeed
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
init-download-extension-2:
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
image:
|
||||
repository: alpine
|
||||
tag: 3.22.2
|
||||
pullPolicy: IfNotPresent
|
||||
command:
|
||||
- /bin/sh
|
||||
- -ec
|
||||
- |
|
||||
apk add --no-cache git;
|
||||
cd /tmp;
|
||||
git clone -n --depth=1 --filter=tree:0 https://github.com/FreshRSS/Extensions.git;
|
||||
cd Extensions;
|
||||
git sparse-checkout set --no-cone /xExtension-ImageProxy;
|
||||
git checkout;
|
||||
rm -rf /var/www/FreshRSS/extensions/xExtension-ImageProxy
|
||||
cp -r xExtension-ImageProxy /var/www/FreshRSS/extensions
|
||||
chown -R 568:568 /var/www/FreshRSS/extensions/xExtension-ImageProxy
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
init-download-extension-3:
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
image:
|
||||
repository: alpine
|
||||
tag: 3.22.2
|
||||
pullPolicy: IfNotPresent
|
||||
command:
|
||||
- /bin/sh
|
||||
- -ec
|
||||
- |
|
||||
cd /tmp;
|
||||
wget https://github.com/zimmra/xExtension-karakeep-button/archive/refs/tags/v1.1.tar.gz;
|
||||
tar -xvzf *.tar.gz;
|
||||
rm -rf /var/www/FreshRSS/extensions/xExtension-karakeep-button
|
||||
mkdir /var/www/FreshRSS/extensions/xExtension-karakeep-button
|
||||
cp -r /tmp/xExtension-karakeep-button-*/* /var/www/FreshRSS/extensions/xExtension-karakeep-button
|
||||
chown -R 568:568 /var/www/FreshRSS/extensions/xExtension-karakeep-button
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
containers:
|
||||
main:
|
||||
image:
|
||||
repository: freshrss/freshrss
|
||||
tag: 1.27.1
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: PGID
|
||||
value: "568"
|
||||
- name: PUID
|
||||
value: "568"
|
||||
- name: TZ
|
||||
value: US/Central
|
||||
- name: FRESHRSS_ENV
|
||||
value: production
|
||||
- name: CRON_MIN
|
||||
value: 13,43
|
||||
- name: BASE_URL
|
||||
value: https://rss.alexlebens.dev
|
||||
- name: DB_HOST
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: freshrss-postgresql-17-cluster-app
|
||||
key: host
|
||||
- name: DB_BASE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: freshrss-postgresql-17-cluster-app
|
||||
key: dbname
|
||||
- name: DB_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: freshrss-postgresql-17-cluster-app
|
||||
key: user
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: freshrss-postgresql-17-cluster-app
|
||||
key: password
|
||||
- name: FRESHRSS_INSTALL
|
||||
value: |
|
||||
--api-enabled
|
||||
--base-url $(BASE_URL)
|
||||
--db-base $(DB_BASE)
|
||||
--db-host $(DB_HOST)
|
||||
--db-password $(DB_PASSWORD)
|
||||
--db-type pgsql
|
||||
--db-user $(DB_USER)
|
||||
--auth-type http_auth
|
||||
--default-user admin
|
||||
--language en
|
||||
- name: FRESHRSS_USER
|
||||
value: |
|
||||
--api-password $(ADMIN_API_PASSWORD)
|
||||
--email $(ADMIN_EMAIL)
|
||||
--language en
|
||||
--password $(ADMIN_PASSWORD)
|
||||
--user admin
|
||||
- name: OIDC_ENABLED
|
||||
value: 1
|
||||
- name: OIDC_PROVIDER_METADATA_URL
|
||||
value: https://auth.alexlebens.dev/application/o/freshrss/.well-known/openid-configuration
|
||||
- name: OIDC_X_FORWARDED_HEADERS
|
||||
value: X-Forwarded-Port X-Forwarded-Proto X-Forwarded-Host
|
||||
- name: OIDC_SCOPES
|
||||
value: openid email profile
|
||||
- name: OIDC_REMOTE_USER_CLAIM
|
||||
value: preferred_username
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: freshrss-oidc-secret
|
||||
- secretRef:
|
||||
name: freshrss-install-secret
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
service:
|
||||
main:
|
||||
controller: main
|
||||
ports:
|
||||
http:
|
||||
port: 80
|
||||
targetPort: 80
|
||||
protocol: HTTP
|
||||
persistence:
|
||||
data:
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
retain: true
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /var/www/FreshRSS/data
|
||||
readOnly: false
|
||||
extensions:
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 1Gi
|
||||
retain: true
|
||||
advancedMounts:
|
||||
main:
|
||||
init-download-extension-1:
|
||||
- path: /var/www/FreshRSS/extensions
|
||||
readOnly: false
|
||||
init-download-extension-2:
|
||||
- path: /var/www/FreshRSS/extensions
|
||||
readOnly: false
|
||||
init-download-extension-3:
|
||||
- path: /var/www/FreshRSS/extensions
|
||||
readOnly: false
|
||||
main:
|
||||
- path: /var/www/FreshRSS/extensions
|
||||
readOnly: false
|
||||
cloudflared:
|
||||
existingSecretName: freshrss-cloudflared-secret
|
||||
postgres-17-cluster:
|
||||
mode: recovery
|
||||
cluster:
|
||||
storage:
|
||||
storageClass: local-path
|
||||
walStorage:
|
||||
storageClass: local-path
|
||||
monitoring:
|
||||
enabled: true
|
||||
prometheusRule:
|
||||
enabled: true
|
||||
recovery:
|
||||
method: objectStore
|
||||
objectStore:
|
||||
destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-17-cluster
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
index: 1
|
||||
endpointCredentials: freshrss-postgresql-17-cluster-backup-secret-garage
|
||||
backup:
|
||||
objectStore:
|
||||
- name: external
|
||||
destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/freshrss/freshrss-postgresql-17-cluster
|
||||
index: 1
|
||||
retentionPolicy: "30d"
|
||||
isWALArchiver: false
|
||||
- name: garage-local
|
||||
destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-17-cluster
|
||||
index: 1
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
endpointCredentials: freshrss-postgresql-17-cluster-backup-secret-garage
|
||||
endpointCredentialsIncludeRegion: true
|
||||
retentionPolicy: "3d"
|
||||
isWALArchiver: true
|
||||
# - name: garage-remote
|
||||
# destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-17-cluster
|
||||
# index: 1
|
||||
# endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
|
||||
# endpointCredentials: freshrss-postgresql-17-cluster-backup-secret-garage
|
||||
# retentionPolicy: "30d"
|
||||
# data:
|
||||
# compression: bzip2
|
||||
# jobs: 2
|
||||
scheduledBackups:
|
||||
- name: daily-backup
|
||||
suspend: false
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: external
|
||||
- name: live-backup
|
||||
suspend: false
|
||||
immediate: true
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: garage-local
|
||||
# - name: weekly-backup
|
||||
# suspend: false
|
||||
# schedule: "0 2 4 * * SAT"
|
||||
# backupName: garage-remote
|
||||
9
clusters/cl01tl/helm/immich/Chart.lock
Normal file
9
clusters/cl01tl/helm/immich/Chart.lock
Normal file
@@ -0,0 +1,9 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: postgres-cluster
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 6.16.0
|
||||
digest: sha256:6c1412459bf39357f20db21735f64dc4f5fe2a0a746d19a78ddff43801610991
|
||||
generated: "2025-11-30T21:07:10.484678-06:00"
|
||||
26
clusters/cl01tl/helm/immich/Chart.yaml
Normal file
26
clusters/cl01tl/helm/immich/Chart.yaml
Normal file
@@ -0,0 +1,26 @@
|
||||
apiVersion: v2
|
||||
name: immich
|
||||
version: 1.0.0
|
||||
description: Immich
|
||||
keywords:
|
||||
- immich
|
||||
- photos
|
||||
home: https://wiki.alexlebens.dev/s/9377ae08-2041-4b6d-bc2b-61a4f5e8faae
|
||||
sources:
|
||||
- https://github.com/immich-app/immich
|
||||
- https://github.com/cloudnative-pg/cloudnative-pg
|
||||
- https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
|
||||
- https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
|
||||
maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: app-template
|
||||
alias: immich
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: postgres-cluster
|
||||
alias: postgres-17-cluster
|
||||
version: 6.16.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/immich.png
|
||||
appVersion: v2.0.1
|
||||
88
clusters/cl01tl/helm/immich/templates/external-secrets.yaml
Normal file
88
clusters/cl01tl/helm/immich/templates/external-secrets.yaml
Normal file
@@ -0,0 +1,88 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: immich-config-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: immich-config-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: immich.json
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/immich/config
|
||||
metadataPolicy: None
|
||||
property: immich.json
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: immich-postgresql-17-cluster-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: immich-postgresql-17-cluster-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: access
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: secret
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: immich-postgresql-17-cluster-backup-secret-garage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: immich-postgresql-17-cluster-backup-secret-garage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_KEY_ID
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_SECRET_KEY
|
||||
- secretKey: ACCESS_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_REGION
|
||||
28
clusters/cl01tl/helm/immich/templates/http-route.yaml
Normal file
28
clusters/cl01tl/helm/immich/templates/http-route.yaml
Normal file
@@ -0,0 +1,28 @@
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: http-route-immich
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: http-route-immich
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: traefik-gateway
|
||||
namespace: traefik
|
||||
hostnames:
|
||||
- immich.alexlebens.net
|
||||
rules:
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
backendRefs:
|
||||
- group: ''
|
||||
kind: Service
|
||||
name: immich-main
|
||||
port: 2283
|
||||
weight: 100
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: immich-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: immich-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
volumeName: immich-nfs-storage
|
||||
storageClassName: nfs-client
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
23
clusters/cl01tl/helm/immich/templates/persistent-volume.yaml
Normal file
23
clusters/cl01tl/helm/immich/templates/persistent-volume.yaml
Normal file
@@ -0,0 +1,23 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: immich-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: immich-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: nfs-client
|
||||
capacity:
|
||||
storage: 1Gi
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
nfs:
|
||||
path: /volume2/Storage/Immich
|
||||
server: synologybond.alexlebens.net
|
||||
mountOptions:
|
||||
- vers=4
|
||||
- minorversion=1
|
||||
- noac
|
||||
32
clusters/cl01tl/helm/immich/templates/redis-replication.yaml
Normal file
32
clusters/cl01tl/helm/immich/templates/redis-replication.yaml
Normal file
@@ -0,0 +1,32 @@
|
||||
apiVersion: redis.redis.opstreelabs.in/v1beta2
|
||||
kind: RedisReplication
|
||||
metadata:
|
||||
name: redis-replication-immich
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: redis-replication-immich
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
clusterSize: 3
|
||||
podSecurityContext:
|
||||
runAsUser: 1000
|
||||
fsGroup: 1000
|
||||
kubernetesConfig:
|
||||
image: quay.io/opstree/redis:v8.0.3
|
||||
imagePullPolicy: IfNotPresent
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
storage:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
storageClassName: ceph-block
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
redisExporter:
|
||||
enabled: true
|
||||
image: quay.io/opstree/redis-exporter:v1.48.0
|
||||
44
clusters/cl01tl/helm/immich/templates/service-monitor.yaml
Normal file
44
clusters/cl01tl/helm/immich/templates/service-monitor.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: immich
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: immich
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: immich
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
endpoints:
|
||||
- port: metrics-api
|
||||
interval: 3m
|
||||
scrapeTimeout: 1m
|
||||
path: /metrics
|
||||
- port: metrics-ms
|
||||
interval: 3m
|
||||
scrapeTimeout: 1m
|
||||
path: /metrics
|
||||
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: redis-replication-immich
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: redis-replication-immich
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
redis-operator: "true"
|
||||
env: production
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
redis_setup_type: replication
|
||||
endpoints:
|
||||
- port: redis-exporter
|
||||
interval: 30s
|
||||
scrapeTimeout: 10s
|
||||
260
clusters/cl01tl/helm/immich/values.yaml
Normal file
260
clusters/cl01tl/helm/immich/values.yaml
Normal file
@@ -0,0 +1,260 @@
|
||||
immich:
|
||||
controllers:
|
||||
main:
|
||||
type: deployment
|
||||
replicas: 1
|
||||
strategy: Recreate
|
||||
revisionHistoryLimit: 3
|
||||
containers:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/immich-app/immich-server
|
||||
tag: v2.3.1
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: TZ
|
||||
value: US/Central
|
||||
- name: IMMICH_TELEMETRY_INCLUDE
|
||||
value: all
|
||||
- name: IMMICH_CONFIG_FILE
|
||||
value: /config/immich.json
|
||||
- name: IMMICH_MACHINE_LEARNING_URL
|
||||
value: http://immich-machine-learning.immich:3003
|
||||
- name: REDIS_HOSTNAME
|
||||
value: redis-replication-immich-master
|
||||
- name: DB_VECTOR_EXTENSION
|
||||
value: vectorchord
|
||||
- name: DB_HOSTNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: immich-postgresql-17-cluster-app
|
||||
key: host
|
||||
- name: DB_DATABASE_NAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: immich-postgresql-17-cluster-app
|
||||
key: dbname
|
||||
- name: DB_PORT
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: immich-postgresql-17-cluster-app
|
||||
key: port
|
||||
- name: DB_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: immich-postgresql-17-cluster-app
|
||||
key: user
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: immich-postgresql-17-cluster-app
|
||||
key: password
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /api/server/ping
|
||||
port: 2283
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
readiness:
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /api/server/ping
|
||||
port: 2283
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
startup:
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /api/server/ping
|
||||
port: 2283
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 30
|
||||
resources:
|
||||
limits:
|
||||
gpu.intel.com/i915: 1
|
||||
requests:
|
||||
gpu.intel.com/i915: 1
|
||||
cpu: 10m
|
||||
memory: 512Mi
|
||||
machine-learning:
|
||||
type: deployment
|
||||
replicas: 1
|
||||
strategy: Recreate
|
||||
revisionHistoryLimit: 3
|
||||
containers:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/immich-app/immich-machine-learning
|
||||
tag: v2.3.1
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: TRANSFORMERS_CACHE
|
||||
value: /cache
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: 3003
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
readiness:
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: 3003
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
startup:
|
||||
enabled: false
|
||||
resources:
|
||||
limits:
|
||||
gpu.intel.com/i915: 1
|
||||
requests:
|
||||
gpu.intel.com/i915: 1
|
||||
cpu: 10m
|
||||
memory: 256Mi
|
||||
service:
|
||||
main:
|
||||
controller: main
|
||||
ports:
|
||||
http:
|
||||
port: 2283
|
||||
targetPort: 2283
|
||||
protocol: TCP
|
||||
metrics-api:
|
||||
port: 8081
|
||||
targetPort: 8081
|
||||
protocol: TCP
|
||||
metrics-ms:
|
||||
port: 8082
|
||||
targetPort: 8082
|
||||
protocol: TCP
|
||||
machine-learning:
|
||||
controller: machine-learning
|
||||
ports:
|
||||
http:
|
||||
port: 3003
|
||||
targetPort: 3003
|
||||
protocol: TCP
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
type: secret
|
||||
name: immich-config-secret
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /config/immich.json
|
||||
readOnly: true
|
||||
mountPropagation: None
|
||||
subPath: immich.json
|
||||
cache:
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 10Gi
|
||||
retain: true
|
||||
advancedMounts:
|
||||
machine-learning:
|
||||
main:
|
||||
- path: /cache
|
||||
readOnly: false
|
||||
media:
|
||||
existingClaim: immich-nfs-storage
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /usr/src/app/upload
|
||||
readOnly: false
|
||||
postgres-17-cluster:
|
||||
mode: recovery
|
||||
cluster:
|
||||
image:
|
||||
repository: ghcr.io/tensorchord/cloudnative-vectorchord
|
||||
tag: 17.5-0.4.3
|
||||
storage:
|
||||
storageClass: local-path
|
||||
walStorage:
|
||||
storageClass: local-path
|
||||
monitoring:
|
||||
enabled: true
|
||||
prometheusRule:
|
||||
enabled: true
|
||||
postgresql:
|
||||
parameters:
|
||||
shared_buffers: 256MB
|
||||
shared_preload_libraries:
|
||||
- "vchord.so"
|
||||
initdb:
|
||||
postInitSQL:
|
||||
- CREATE EXTENSION IF NOT EXISTS "vector";
|
||||
- CREATE EXTENSION IF NOT EXISTS "vchord" CASCADE;
|
||||
- CREATE EXTENSION IF NOT EXISTS "cube" CASCADE;
|
||||
- CREATE EXTENSION IF NOT EXISTS "earthdistance" CASCADE;
|
||||
recovery:
|
||||
method: objectStore
|
||||
objectStore:
|
||||
destinationPath: s3://postgres-backups/cl01tl/immich/immich-postgresql-17-cluster
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
index: 1
|
||||
endpointCredentials: immich-postgresql-17-cluster-backup-secret-garage
|
||||
backup:
|
||||
objectStore:
|
||||
- name: external
|
||||
destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/immich/immich-postgresql-17-cluster
|
||||
index: 2
|
||||
retentionPolicy: "30d"
|
||||
isWALArchiver: false
|
||||
- name: garage-local
|
||||
destinationPath: s3://postgres-backups/cl01tl/immich/immich-postgresql-17-cluster
|
||||
index: 1
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
endpointCredentials: immich-postgresql-17-cluster-backup-secret-garage
|
||||
endpointCredentialsIncludeRegion: true
|
||||
retentionPolicy: "3d"
|
||||
isWALArchiver: true
|
||||
# - name: garage-remote
|
||||
# destinationPath: s3://postgres-backups/cl01tl/immich/immich-postgresql-17-cluster
|
||||
# index: 1
|
||||
# endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
|
||||
# endpointCredentials: immich-postgresql-17-cluster-backup-secret-garage
|
||||
# retentionPolicy: "30d"
|
||||
# data:
|
||||
# compression: bzip2
|
||||
# jobs: 2
|
||||
scheduledBackups:
|
||||
- name: daily-backup
|
||||
suspend: false
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: external
|
||||
- name: live-backup
|
||||
suspend: false
|
||||
immediate: true
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: garage-local
|
||||
# - name: weekly-backup
|
||||
# suspend: false
|
||||
# schedule: "0 4 4 * * SAT"
|
||||
# backupName: garage-remote
|
||||
6
clusters/cl01tl/helm/jellyfin/Chart.lock
Normal file
6
clusters/cl01tl/helm/jellyfin/Chart.lock
Normal file
@@ -0,0 +1,6 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
digest: sha256:5394000890e1bcc83f94b138c148c591f6a091850e734acbd6e1e7d053469f38
|
||||
generated: "2025-11-30T21:07:11.924605-06:00"
|
||||
25
clusters/cl01tl/helm/jellyfin/Chart.yaml
Normal file
25
clusters/cl01tl/helm/jellyfin/Chart.yaml
Normal file
@@ -0,0 +1,25 @@
|
||||
apiVersion: v2
|
||||
name: jellyfin
|
||||
version: 1.0.0
|
||||
description: Jellyfin
|
||||
keywords:
|
||||
- jellyfin
|
||||
- media
|
||||
- movies
|
||||
- tv shows
|
||||
- books
|
||||
- music
|
||||
home: https://wiki.alexlebens.dev/s/a58be5b0-7935-458a-b990-b45223e39d68
|
||||
sources:
|
||||
- https://github.com/jellyfin/jellyfin
|
||||
- https://hub.docker.com/r/jellyfin/jellyfin
|
||||
- https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
|
||||
maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: app-template
|
||||
alias: jellyfin
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/jellyfin.png
|
||||
appVersion: 10.10.7
|
||||
55
clusters/cl01tl/helm/jellyfin/templates/external-secret.yaml
Normal file
55
clusters/cl01tl/helm/jellyfin/templates/external-secret.yaml
Normal file
@@ -0,0 +1,55 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: jellyfin-config-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: jellyfin-config-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/jellyfin/jellyfin-config"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: S3_BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: access_key
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: secret_key
|
||||
28
clusters/cl01tl/helm/jellyfin/templates/http-route.yaml
Normal file
28
clusters/cl01tl/helm/jellyfin/templates/http-route.yaml
Normal file
@@ -0,0 +1,28 @@
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: http-route-jellyfin
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: http-route-jellyfin
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: traefik-gateway
|
||||
namespace: traefik
|
||||
hostnames:
|
||||
- jellyfin.alexlebens.net
|
||||
rules:
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
backendRefs:
|
||||
- group: ''
|
||||
kind: Service
|
||||
name: jellyfin
|
||||
port: 80
|
||||
weight: 100
|
||||
@@ -0,0 +1,36 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: jellyfin-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: jellyfin-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
volumeName: jellyfin-nfs-storage
|
||||
storageClassName: nfs-client
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: jellyfin-youtube-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: jellyfin-youtube-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
volumeName: jellyfin-youtube-nfs-storage
|
||||
storageClassName: nfs-client
|
||||
accessModes:
|
||||
- ReadOnlyMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
@@ -0,0 +1,48 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: jellyfin-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: jellyfin-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: nfs-client
|
||||
capacity:
|
||||
storage: 1Gi
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
nfs:
|
||||
path: /volume2/Storage
|
||||
server: synologybond.alexlebens.net
|
||||
mountOptions:
|
||||
- vers=4
|
||||
- minorversion=1
|
||||
- noac
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: jellyfin-youtube-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: jellyfin-youtube-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: nfs-client
|
||||
capacity:
|
||||
storage: 1Gi
|
||||
accessModes:
|
||||
- ReadOnlyMany
|
||||
nfs:
|
||||
path: /volume2/Storage/YouTube
|
||||
server: synologybond.alexlebens.net
|
||||
mountOptions:
|
||||
- vers=4
|
||||
- minorversion=1
|
||||
- noac
|
||||
@@ -0,0 +1,26 @@
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: jellyfin-config-backup-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: jellyfin-config-backup-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: jellyfin-config
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: jellyfin-config-backup-secret
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
cacheCapacity: 10Gi
|
||||
68
clusters/cl01tl/helm/jellyfin/values.yaml
Normal file
68
clusters/cl01tl/helm/jellyfin/values.yaml
Normal file
@@ -0,0 +1,68 @@
|
||||
jellyfin:
|
||||
controllers:
|
||||
main:
|
||||
type: deployment
|
||||
replicas: 1
|
||||
strategy: Recreate
|
||||
revisionHistoryLimit: 3
|
||||
containers:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/jellyfin/jellyfin
|
||||
tag: 10.11.3
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: TZ
|
||||
value: US/Central
|
||||
- name: JELLYFIN_hostwebclient
|
||||
value: true
|
||||
- name: JELLYFIN_PublishedServerUrl
|
||||
value: https://jellyfin.alexlebens.net/
|
||||
resources:
|
||||
limits:
|
||||
gpu.intel.com/i915: 1
|
||||
requests:
|
||||
gpu.intel.com/i915: 1
|
||||
cpu: 1
|
||||
memory: 2Gi
|
||||
service:
|
||||
main:
|
||||
controller: main
|
||||
ports:
|
||||
http:
|
||||
port: 80
|
||||
targetPort: 8096
|
||||
protocol: HTTP
|
||||
persistence:
|
||||
config:
|
||||
forceRename: jellyfin-config
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 100Gi
|
||||
retain: true
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /config
|
||||
readOnly: false
|
||||
cache:
|
||||
type: emptyDir
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /cache
|
||||
readOnly: false
|
||||
media:
|
||||
existingClaim: jellyfin-nfs-storage
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /mnt/store
|
||||
readOnly: false
|
||||
youtube:
|
||||
existingClaim: jellyfin-youtube-nfs-storage
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /mnt/youtube
|
||||
readOnly: true
|
||||
12
clusters/cl01tl/helm/karakeep/Chart.lock
Normal file
12
clusters/cl01tl/helm/karakeep/Chart.lock
Normal file
@@ -0,0 +1,12 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: meilisearch
|
||||
repository: https://meilisearch.github.io/meilisearch-kubernetes
|
||||
version: 0.17.1
|
||||
- name: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.0
|
||||
digest: sha256:87a67950901f8a047f790ed21e8fc1cbfd076e05a3a55377b1cb0aa081f10f8d
|
||||
generated: "2025-11-30T21:07:14.824697-06:00"
|
||||
32
clusters/cl01tl/helm/karakeep/Chart.yaml
Normal file
32
clusters/cl01tl/helm/karakeep/Chart.yaml
Normal file
@@ -0,0 +1,32 @@
|
||||
apiVersion: v2
|
||||
name: karakeep
|
||||
version: 1.0.0
|
||||
description: Karakeep
|
||||
keywords:
|
||||
- karakeep
|
||||
- bookmarks
|
||||
home: https://wiki.alexlebens.dev/s/f8177591-8253-4e21-82d5-a556f0aeafad
|
||||
sources:
|
||||
- https://github.com/karakeep-app/karakeep
|
||||
- https://github.com/cloudflare/cloudflared
|
||||
- https://github.com/meilisearch/meilisearch
|
||||
- https://github.com/karakeep-app/karakeep/pkgs/container/karakeep
|
||||
- https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
|
||||
- https://github.com/meilisearch/meilisearch-kubernetes/tree/main/charts/meilisearch
|
||||
- https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
|
||||
maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: app-template
|
||||
alias: karakeep
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: meilisearch
|
||||
version: 0.17.1
|
||||
repository: https://meilisearch.github.io/meilisearch-kubernetes
|
||||
- name: cloudflared
|
||||
alias: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.0
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/webp/karakeep.webp
|
||||
appVersion: 0.26.0
|
||||
161
clusters/cl01tl/helm/karakeep/templates/external-secret.yaml
Normal file
161
clusters/cl01tl/helm/karakeep/templates/external-secret.yaml
Normal file
@@ -0,0 +1,161 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: karakeep-key-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: karakeep-key-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: key
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/karakeep/key
|
||||
metadataPolicy: None
|
||||
property: key
|
||||
- secretKey: prometheus-token
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/karakeep/key
|
||||
metadataPolicy: None
|
||||
property: prometheus-token
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: karakeep-oidc-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: karakeep-oidc-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: AUTHENTIK_CLIENT_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /authentik/oidc/karakeep
|
||||
metadataPolicy: None
|
||||
property: client
|
||||
- secretKey: AUTHENTIK_CLIENT_SECRET
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /authentik/oidc/karakeep
|
||||
metadataPolicy: None
|
||||
property: secret
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: karakeep-meilisearch-master-key-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: karakeep-meilisearch-master-key-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: MEILI_MASTER_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/karakeep/meilisearch
|
||||
metadataPolicy: None
|
||||
property: MEILI_MASTER_KEY
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: karakeep-cloudflared-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: karakeep-cloudflared-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: cf-tunnel-token
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cloudflare/tunnels/karakeep
|
||||
metadataPolicy: None
|
||||
property: token
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: karakeep-data-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: karakeep-data-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/karakeep/karakeep-data"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: S3_BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: access_key
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: secret_key
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: objectbucket.io/v1alpha1
|
||||
kind: ObjectBucketClaim
|
||||
metadata:
|
||||
name: ceph-bucket-karakeep
|
||||
labels:
|
||||
app.kubernetes.io/name: ceph-bucket-karakeep
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
generateBucketName: bucket-karakeep
|
||||
storageClassName: ceph-bucket
|
||||
@@ -0,0 +1,25 @@
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: karakeep-data-backup-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: karakeep-data-backup-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: karakeep-data
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: karakeep-data-backup-secret
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
23
clusters/cl01tl/helm/karakeep/templates/service-monitor.yaml
Normal file
23
clusters/cl01tl/helm/karakeep/templates/service-monitor.yaml
Normal file
@@ -0,0 +1,23 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: karakeep
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: karakeep
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
endpoints:
|
||||
- port: http
|
||||
interval: 30s
|
||||
scrapeTimeout: 15s
|
||||
path: /api/metrics
|
||||
authorization:
|
||||
credentials:
|
||||
key: prometheus-token
|
||||
name: karakeep-key-secret
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: karakeep
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
155
clusters/cl01tl/helm/karakeep/values.yaml
Normal file
155
clusters/cl01tl/helm/karakeep/values.yaml
Normal file
@@ -0,0 +1,155 @@
|
||||
karakeep:
|
||||
controllers:
|
||||
main:
|
||||
type: deployment
|
||||
replicas: 1
|
||||
strategy: Recreate
|
||||
revisionHistoryLimit: 3
|
||||
containers:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/karakeep-app/karakeep
|
||||
tag: 0.28.0
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: DATA_DIR
|
||||
value: /data
|
||||
- name: DB_WAL_MODE
|
||||
value: true
|
||||
- name: NEXTAUTH_URL
|
||||
value: https://karakeep.alexlebens.dev/
|
||||
- name: NEXTAUTH_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: karakeep-key-secret
|
||||
key: key
|
||||
- name: PROMETHEUS_AUTH_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: karakeep-key-secret
|
||||
key: prometheus-token
|
||||
- name: ASSET_STORE_S3_ENDPOINT
|
||||
value: http://rook-ceph-rgw-ceph-objectstore.rook-ceph.svc:80
|
||||
- name: ASSET_STORE_S3_REGION
|
||||
value: us-east-1
|
||||
- name: ASSET_STORE_S3_BUCKET
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: ceph-bucket-karakeep
|
||||
key: BUCKET_NAME
|
||||
- name: ASSET_STORE_S3_ACCESS_KEY_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: ceph-bucket-karakeep
|
||||
key: AWS_ACCESS_KEY_ID
|
||||
- name: ASSET_STORE_S3_SECRET_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: ceph-bucket-karakeep
|
||||
key: AWS_SECRET_ACCESS_KEY
|
||||
- name: ASSET_STORE_S3_FORCE_PATH_STYLE
|
||||
value: true
|
||||
- name: MEILI_ADDR
|
||||
value: http://karakeep-meilisearch.karakeep:7700
|
||||
- name: MEILI_MASTER_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: karakeep-meilisearch-master-key-secret
|
||||
key: MEILI_MASTER_KEY
|
||||
- name: BROWSER_WEB_URL
|
||||
value: http://karakeep.karakeep:9222
|
||||
- name: DISABLE_SIGNUPS
|
||||
value: false
|
||||
- name: OAUTH_PROVIDER_NAME
|
||||
value: "Authentik"
|
||||
- name: OAUTH_WELLKNOWN_URL
|
||||
value: https://auth.alexlebens.dev/application/o/karakeep/.well-known/openid-configuration
|
||||
- name: OAUTH_SCOPE
|
||||
value: "openid email profile"
|
||||
- name: OAUTH_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: karakeep-oidc-secret
|
||||
key: AUTHENTIK_CLIENT_ID
|
||||
- name: OAUTH_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: karakeep-oidc-secret
|
||||
key: AUTHENTIK_CLIENT_SECRET
|
||||
- name: OLLAMA_BASE_URL
|
||||
value: http://ollama-server-3.ollama:11434
|
||||
- name: OLLAMA_KEEP_ALIVE
|
||||
value: 5m
|
||||
- name: INFERENCE_TEXT_MODEL
|
||||
value: gemma3:4b
|
||||
- name: INFERENCE_IMAGE_MODEL
|
||||
value: granite3.2-vision:2b
|
||||
- name: EMBEDDING_TEXT_MODEL
|
||||
value: mxbai-embed-large
|
||||
- name: INFERENCE_JOB_TIMEOUT_SEC
|
||||
value: 720
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 256Mi
|
||||
chrome:
|
||||
image:
|
||||
repository: gcr.io/zenika-hub/alpine-chrome
|
||||
tag: 124
|
||||
pullPolicy: IfNotPresent
|
||||
args:
|
||||
- --no-sandbox
|
||||
- --disable-gpu
|
||||
- --disable-dev-shm-usage
|
||||
- --remote-debugging-address=0.0.0.0
|
||||
- --remote-debugging-port=9222
|
||||
- --hide-scrollbars
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
service:
|
||||
main:
|
||||
controller: main
|
||||
ports:
|
||||
http:
|
||||
port: 3000
|
||||
targetPort: 3000
|
||||
protocol: HTTP
|
||||
chrome:
|
||||
port: 9222
|
||||
targetPort: 9222
|
||||
protocol: HTTP
|
||||
persistence:
|
||||
data:
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 10Gi
|
||||
retain: true
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /data
|
||||
readOnly: false
|
||||
meilisearch:
|
||||
environment:
|
||||
MEILI_NO_ANALYTICS: true
|
||||
MEILI_ENV: production
|
||||
MEILI_EXPERIMENTAL_DUMPLESS_UPGRADE: true
|
||||
auth:
|
||||
existingMasterKeySecret: karakeep-meilisearch-master-key-secret
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 7700
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClass: ceph-block
|
||||
size: 10Gi
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
cloudflared:
|
||||
existingSecretName: karakeep-cloudflared-secret
|
||||
9
clusters/cl01tl/helm/lidarr/Chart.lock
Normal file
9
clusters/cl01tl/helm/lidarr/Chart.lock
Normal file
@@ -0,0 +1,9 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: postgres-cluster
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 6.16.0
|
||||
digest: sha256:e2c50f16d20f551ea2e05f75239eba37af5b5cf7f64dbc208870b063e7135d03
|
||||
generated: "2025-11-30T21:07:19.863423-06:00"
|
||||
30
clusters/cl01tl/helm/lidarr/Chart.yaml
Normal file
30
clusters/cl01tl/helm/lidarr/Chart.yaml
Normal file
@@ -0,0 +1,30 @@
|
||||
apiVersion: v2
|
||||
name: lidarr
|
||||
version: 1.0.0
|
||||
description: Lidarr
|
||||
keywords:
|
||||
- lidarr
|
||||
- servarr
|
||||
- music
|
||||
- metrics
|
||||
home: https://wiki.alexlebens.dev/s/f7c4e892-aa3b-435f-b220-317dc53137ac
|
||||
sources:
|
||||
- https://github.com/Lidarr/Lidarr
|
||||
- https://github.com/linuxserver/docker-lidarr
|
||||
- https://github.com/cloudnative-pg/cloudnative-pg
|
||||
- https://github.com/onedr0p/exportarr/pkgs/container/exportarr
|
||||
- https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
|
||||
- https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
|
||||
maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: app-template
|
||||
alias: lidarr
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: postgres-cluster
|
||||
alias: postgres-17-cluster
|
||||
version: 6.16.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/lidarr.png
|
||||
appVersion: 2.13.3
|
||||
122
clusters/cl01tl/helm/lidarr/templates/external-secret.yaml
Normal file
122
clusters/cl01tl/helm/lidarr/templates/external-secret.yaml
Normal file
@@ -0,0 +1,122 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: lidarr-config-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: lidarr-config-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/lidarr2/lidarr2-config"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: S3_BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: access_key
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: secret_key
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: lidarr-postgresql-17-cluster-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: lidarr-postgresql-17-cluster-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: access
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: secret
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: lidarr-postgresql-17-cluster-backup-secret-garage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: lidarr-postgresql-17-cluster-backup-secret-garage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_KEY_ID
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_SECRET_KEY
|
||||
- secretKey: ACCESS_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_REGION
|
||||
28
clusters/cl01tl/helm/lidarr/templates/http-route.yaml
Normal file
28
clusters/cl01tl/helm/lidarr/templates/http-route.yaml
Normal file
@@ -0,0 +1,28 @@
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: http-route-lidarr
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: http-route-lidarr
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: traefik-gateway
|
||||
namespace: traefik
|
||||
hostnames:
|
||||
- lidarr.alexlebens.net
|
||||
rules:
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
backendRefs:
|
||||
- group: ''
|
||||
kind: Service
|
||||
name: lidarr
|
||||
port: 80
|
||||
weight: 100
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: lidarr-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: lidarr-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
volumeName: lidarr-nfs-storage
|
||||
storageClassName: nfs-client
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
23
clusters/cl01tl/helm/lidarr/templates/persistent-volume.yaml
Normal file
23
clusters/cl01tl/helm/lidarr/templates/persistent-volume.yaml
Normal file
@@ -0,0 +1,23 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: lidarr-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: lidarr-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: nfs-client
|
||||
capacity:
|
||||
storage: 1Gi
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
nfs:
|
||||
path: /volume2/Storage
|
||||
server: synologybond.alexlebens.net
|
||||
mountOptions:
|
||||
- vers=4
|
||||
- minorversion=1
|
||||
- noac
|
||||
32
clusters/cl01tl/helm/lidarr/templates/prometheus-rule.yaml
Normal file
32
clusters/cl01tl/helm/lidarr/templates/prometheus-rule.yaml
Normal file
@@ -0,0 +1,32 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: lidarr
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: lidarr
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
groups:
|
||||
- name: lidarr
|
||||
rules:
|
||||
- alert: ExportarrAbsent
|
||||
annotations:
|
||||
description: Lidarr Exportarr has disappeared from Prometheus
|
||||
service discovery.
|
||||
summary: Exportarr is down.
|
||||
expr: |
|
||||
absent(up{job=~".*lidarr.*"} == 1)
|
||||
for: 5m
|
||||
labels:
|
||||
severity: critical
|
||||
- alert: LidarrDown
|
||||
annotations:
|
||||
description: Lidarr service is down.
|
||||
summary: Lidarr is down.
|
||||
expr: |
|
||||
lidarr_system_status{job=~".*lidarr.*"} == 0
|
||||
for: 5m
|
||||
labels:
|
||||
severity: critical
|
||||
@@ -0,0 +1,28 @@
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: lidarr-config-backup-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: lidarr-config-backup-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: lidarr-config
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: lidarr-config-backup-secret
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
moverSecurityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
19
clusters/cl01tl/helm/lidarr/templates/service-monitor.yaml
Normal file
19
clusters/cl01tl/helm/lidarr/templates/service-monitor.yaml
Normal file
@@ -0,0 +1,19 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: lidarr
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: lidarr
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: lidarr
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
endpoints:
|
||||
- port: metrics
|
||||
interval: 3m
|
||||
scrapeTimeout: 1m
|
||||
path: /metrics
|
||||
151
clusters/cl01tl/helm/lidarr/values.yaml
Normal file
151
clusters/cl01tl/helm/lidarr/values.yaml
Normal file
@@ -0,0 +1,151 @@
|
||||
lidarr:
|
||||
controllers:
|
||||
main:
|
||||
type: deployment
|
||||
replicas: 1
|
||||
strategy: Recreate
|
||||
revisionHistoryLimit: 3
|
||||
pod:
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
containers:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/linuxserver/lidarr
|
||||
tag: 2.14.5@sha256:5e1235d00b5d1c1f60ca0d472e554a6611aef41aa7b5b6d88260214bf4809af0
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: TZ
|
||||
value: US/Central
|
||||
- name: PUID
|
||||
value: 1000
|
||||
- name: PGID
|
||||
value: 1000
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
metrics:
|
||||
image:
|
||||
repository: ghcr.io/onedr0p/exportarr
|
||||
tag: v2.3.0
|
||||
pullPolicy: IfNotPresent
|
||||
args: ["lidarr"]
|
||||
env:
|
||||
- name: URL
|
||||
value: http://localhost
|
||||
- name: CONFIG
|
||||
value: /config/config.xml
|
||||
- name: PORT
|
||||
value: 9792
|
||||
- name: ENABLE_ADDITIONAL_METRICS
|
||||
value: false
|
||||
- name: ENABLE_UNKNOWN_QUEUE_ITEMS
|
||||
value: false
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
service:
|
||||
main:
|
||||
controller: main
|
||||
ports:
|
||||
http:
|
||||
port: 80
|
||||
targetPort: 8686
|
||||
protocol: HTTP
|
||||
metrics:
|
||||
port: 9792
|
||||
targetPort: 9792
|
||||
protocol: TCP
|
||||
persistence:
|
||||
config:
|
||||
forceRename: lidarr-config
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 10Gi
|
||||
retain: true
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /config
|
||||
readOnly: false
|
||||
metrics:
|
||||
- path: /config
|
||||
readOnly: true
|
||||
media:
|
||||
existingClaim: lidarr-nfs-storage
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /mnt/store
|
||||
readOnly: false
|
||||
postgres-17-cluster:
|
||||
nameOverride: lidarr2-postgresql-17
|
||||
mode: recovery
|
||||
cluster:
|
||||
storage:
|
||||
storageClass: local-path
|
||||
walStorage:
|
||||
storageClass: local-path
|
||||
monitoring:
|
||||
enabled: true
|
||||
prometheusRule:
|
||||
enabled: true
|
||||
resources:
|
||||
requests:
|
||||
memory: 1Gi
|
||||
cpu: 200m
|
||||
initdb:
|
||||
postInitSQL:
|
||||
- CREATE DATABASE "lidarr-main" OWNER "app";
|
||||
- CREATE DATABASE "lidarr-log" OWNER "app";
|
||||
recovery:
|
||||
method: objectStore
|
||||
objectStore:
|
||||
destinationPath: s3://postgres-backups/cl01tl/lidarr/lidarr2-postgresql-17-cluster
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
index: 1
|
||||
endpointCredentials: lidarr-postgresql-17-cluster-backup-secret
|
||||
backup:
|
||||
objectStore:
|
||||
- name: external
|
||||
destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/lidarr2/lidarr2-postgresql-17-cluster
|
||||
index: 1
|
||||
endpointCredentials: lidarr-postgresql-17-cluster-backup-secret
|
||||
retentionPolicy: "30d"
|
||||
isWALArchiver: false
|
||||
- name: garage-local
|
||||
destinationPath: s3://postgres-backups/cl01tl/lidarr/lidarr2-postgresql-17-cluster
|
||||
index: 1
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
endpointCredentials: lidarr-postgresql-17-cluster-backup-secret-garage
|
||||
endpointCredentialsIncludeRegion: true
|
||||
retentionPolicy: "3d"
|
||||
isWALArchiver: true
|
||||
# - name: garage-remote
|
||||
# destinationPath: s3://postgres-backups/cl01tl/lidarr/lidarr2-postgresql-17-cluster
|
||||
# index: 1
|
||||
# endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
|
||||
# endpointCredentials: lidarr-postgresql-17-cluster-backup-secret-garage
|
||||
# retentionPolicy: "30d"
|
||||
# data:
|
||||
# compression: bzip2
|
||||
# jobs: 2
|
||||
scheduledBackups:
|
||||
- name: daily-backup
|
||||
suspend: false
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: external
|
||||
- name: live-backup
|
||||
suspend: false
|
||||
immediate: true
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: garage-local
|
||||
# - name: weekly-backup
|
||||
# suspend: false
|
||||
# schedule: "0 8 4 * * SAT"
|
||||
# backupName: garage-remote
|
||||
6
clusters/cl01tl/helm/prowlarr/Chart.lock
Normal file
6
clusters/cl01tl/helm/prowlarr/Chart.lock
Normal file
@@ -0,0 +1,6 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
digest: sha256:2d8a83056d70c4124c19ae30358095407a6cc2332b8a06759dfb792a1fab1534
|
||||
generated: "2025-11-30T21:07:33.730578-06:00"
|
||||
23
clusters/cl01tl/helm/prowlarr/Chart.yaml
Normal file
23
clusters/cl01tl/helm/prowlarr/Chart.yaml
Normal file
@@ -0,0 +1,23 @@
|
||||
apiVersion: v2
|
||||
name: prowlarr
|
||||
version: 1.0.0
|
||||
description: Prowlarr
|
||||
keywords:
|
||||
- prowlarr
|
||||
- servarr
|
||||
- trackers
|
||||
home: https://wiki.alexlebens.dev/s/7f963158-15fd-4eb5-b3ac-8a3aeb79613a
|
||||
sources:
|
||||
- https://github.com/Prowlarr/Prowlarr
|
||||
- https://github.com/linuxserver/docker-prowlarr
|
||||
- https://github.com/linuxserver/docker-prowlarr/pkgs/container/prowlarr
|
||||
- https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
|
||||
maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: app-template
|
||||
alias: prowlarr
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/prowlarr.png
|
||||
appVersion: 1.35.1
|
||||
55
clusters/cl01tl/helm/prowlarr/templates/external-secret.yaml
Normal file
55
clusters/cl01tl/helm/prowlarr/templates/external-secret.yaml
Normal file
@@ -0,0 +1,55 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: prowlarr-config-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: prowlarr-config-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/prowlarr/prowlarr-config"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: S3_BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: access_key
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: secret_key
|
||||
28
clusters/cl01tl/helm/prowlarr/templates/http-route.yaml
Normal file
28
clusters/cl01tl/helm/prowlarr/templates/http-route.yaml
Normal file
@@ -0,0 +1,28 @@
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: http-route-prowlarr
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: http-route-prowlarr
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: traefik-gateway
|
||||
namespace: traefik
|
||||
hostnames:
|
||||
- prowlarr.alexlebens.net
|
||||
rules:
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
backendRefs:
|
||||
- group: ''
|
||||
kind: Service
|
||||
name: prowlarr
|
||||
port: 80
|
||||
weight: 100
|
||||
@@ -0,0 +1,35 @@
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: prowlarr-config-backup-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: prowlarr-config-backup-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: prowlarr-config
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: prowlarr-config-backup-secret
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
moverSecurityContext:
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
supplementalGroups:
|
||||
- 44
|
||||
- 100
|
||||
- 109
|
||||
- 65539
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
51
clusters/cl01tl/helm/prowlarr/values.yaml
Normal file
51
clusters/cl01tl/helm/prowlarr/values.yaml
Normal file
@@ -0,0 +1,51 @@
|
||||
prowlarr:
|
||||
controllers:
|
||||
main:
|
||||
type: deployment
|
||||
replicas: 1
|
||||
strategy: Recreate
|
||||
revisionHistoryLimit: 3
|
||||
pod:
|
||||
securityContext:
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
supplementalGroups:
|
||||
- 44
|
||||
- 100
|
||||
- 109
|
||||
- 65539
|
||||
containers:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/linuxserver/prowlarr
|
||||
tag: 2.3.0@sha256:475853535de3de8441b87c1457c30f2e695f4831228b12b6b7274e9da409d874
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: TZ
|
||||
value: US/Central
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 256Mi
|
||||
service:
|
||||
main:
|
||||
controller: main
|
||||
ports:
|
||||
http:
|
||||
port: 80
|
||||
targetPort: 9696
|
||||
protocol: HTTP
|
||||
persistence:
|
||||
config:
|
||||
forceRename: prowlarr-config
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
retain: true
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /config
|
||||
readOnly: false
|
||||
9
clusters/cl01tl/helm/radarr-4k/Chart.lock
Normal file
9
clusters/cl01tl/helm/radarr-4k/Chart.lock
Normal file
@@ -0,0 +1,9 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: postgres-cluster
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 6.16.0
|
||||
digest: sha256:d42d3c3a011e9e6252da987e7f86712eb1bccde7721ec067881192182c3ac709
|
||||
generated: "2025-11-30T21:07:36.660188-06:00"
|
||||
33
clusters/cl01tl/helm/radarr-4k/Chart.yaml
Normal file
33
clusters/cl01tl/helm/radarr-4k/Chart.yaml
Normal file
@@ -0,0 +1,33 @@
|
||||
apiVersion: v2
|
||||
name: radarr-4k
|
||||
version: 1.0.0
|
||||
description: Radarr 4K
|
||||
keywords:
|
||||
- radarr
|
||||
- servarr
|
||||
- movies
|
||||
- 4k
|
||||
- metrics
|
||||
home: https://wiki.alexlebens.dev/s/b5687ceb-11db-49b3-9c77-bf27bc322c99
|
||||
sources:
|
||||
- https://github.com/Radarr/Radarr
|
||||
- https://github.com/linuxserver/docker-radarr
|
||||
- https://github.com/onedr0p/exportarr
|
||||
- https://github.com/cloudnative-pg/cloudnative-pg
|
||||
- https://github.com/linuxserver/docker-radarr/pkgs/container/radarr
|
||||
- https://github.com/onedr0p/exportarr/pkgs/container/exportarr
|
||||
- https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
|
||||
- https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
|
||||
maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: app-template
|
||||
alias: radarr-4k
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: postgres-cluster
|
||||
alias: postgres-17-cluster
|
||||
version: 6.16.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/radarr-4k.png
|
||||
appVersion: 5.22.4
|
||||
122
clusters/cl01tl/helm/radarr-4k/templates/external-secret.yaml
Normal file
122
clusters/cl01tl/helm/radarr-4k/templates/external-secret.yaml
Normal file
@@ -0,0 +1,122 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: radarr-4k-config-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-4k-config-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/radarr5-4k/radarr5-4k-config"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: S3_BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: access_key
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: secret_key
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: radarr-4k-postgresql-17-cluster-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-4k-postgresql-17-cluster-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: access
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: secret
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: radarr-4k-postgresql-17-cluster-backup-secret-garage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-4k-postgresql-17-cluster-backup-secret-garage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_KEY_ID
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_SECRET_KEY
|
||||
- secretKey: ACCESS_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_REGION
|
||||
28
clusters/cl01tl/helm/radarr-4k/templates/http-route.yaml
Normal file
28
clusters/cl01tl/helm/radarr-4k/templates/http-route.yaml
Normal file
@@ -0,0 +1,28 @@
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: http-route-radarr-4k
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: http-route-radarr-4k
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: traefik-gateway
|
||||
namespace: traefik
|
||||
hostnames:
|
||||
- radarr-4k.alexlebens.net
|
||||
rules:
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
backendRefs:
|
||||
- group: ''
|
||||
kind: Service
|
||||
name: radarr-4k
|
||||
port: 80
|
||||
weight: 100
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: radarr-4k-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-4k-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
volumeName: radarr-4k-nfs-storage
|
||||
storageClassName: nfs-client
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
@@ -0,0 +1,23 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: radarr-4k-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-4k-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: nfs-client
|
||||
capacity:
|
||||
storage: 1Gi
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
nfs:
|
||||
path: /volume2/Storage
|
||||
server: synologybond.alexlebens.net
|
||||
mountOptions:
|
||||
- vers=4
|
||||
- minorversion=1
|
||||
- noac
|
||||
@@ -0,0 +1,32 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: radarr-4k
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-4k
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
groups:
|
||||
- name: radarr-4k
|
||||
rules:
|
||||
- alert: ExportarrAbsent
|
||||
annotations:
|
||||
description: Radarr 4K Exportarr has disappeared from Prometheus
|
||||
service discovery.
|
||||
summary: Exportarr is down.
|
||||
expr: |
|
||||
absent(up{job=~".*radarr-4k.*"} == 1)
|
||||
for: 5m
|
||||
labels:
|
||||
severity: critical
|
||||
- alert: Radarr4kDown
|
||||
annotations:
|
||||
description: Radarr 4K service is down.
|
||||
summary: Radarr 4K is down.
|
||||
expr: |
|
||||
radarr_4k_system_status{job=~".*radarr-4k.*"} == 0
|
||||
for: 5m
|
||||
labels:
|
||||
severity: critical
|
||||
@@ -0,0 +1,30 @@
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: radarr-4k-config-backup-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-4k-config-backup-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: radarr-4k-config
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: radarr-4k-config-backup-secret
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
moverSecurityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
@@ -0,0 +1,19 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: radarr-4k
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-4k
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: radarr-4k
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
endpoints:
|
||||
- port: metrics
|
||||
interval: 3m
|
||||
scrapeTimeout: 1m
|
||||
path: /metrics
|
||||
151
clusters/cl01tl/helm/radarr-4k/values.yaml
Normal file
151
clusters/cl01tl/helm/radarr-4k/values.yaml
Normal file
@@ -0,0 +1,151 @@
|
||||
radarr-4k:
|
||||
controllers:
|
||||
main:
|
||||
type: deployment
|
||||
replicas: 1
|
||||
strategy: Recreate
|
||||
revisionHistoryLimit: 3
|
||||
pod:
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
containers:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/linuxserver/radarr
|
||||
tag: 6.0.4@sha256:06ac318ecb95a34c7b229568dcb4271f02cb5007bb189a0dd67a2032864187ca
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: TZ
|
||||
value: US/Central
|
||||
- name: PUID
|
||||
value: 1000
|
||||
- name: PGID
|
||||
value: 1000
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
metrics:
|
||||
image:
|
||||
repository: ghcr.io/onedr0p/exportarr
|
||||
tag: v2.3.0
|
||||
pullPolicy: IfNotPresent
|
||||
args: ["radarr"]
|
||||
env:
|
||||
- name: URL
|
||||
value: http://localhost
|
||||
- name: CONFIG
|
||||
value: /config/config.xml
|
||||
- name: PORT
|
||||
value: 9793
|
||||
- name: ENABLE_ADDITIONAL_METRICS
|
||||
value: false
|
||||
- name: ENABLE_UNKNOWN_QUEUE_ITEMS
|
||||
value: false
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
service:
|
||||
main:
|
||||
controller: main
|
||||
ports:
|
||||
http:
|
||||
port: 80
|
||||
targetPort: 7878
|
||||
protocol: HTTP
|
||||
metrics:
|
||||
port: 9793
|
||||
targetPort: 9793
|
||||
protocol: TCP
|
||||
persistence:
|
||||
config:
|
||||
forceRename: radarr-4k-config
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 20Gi
|
||||
retain: true
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /config
|
||||
readOnly: false
|
||||
metrics:
|
||||
- path: /config
|
||||
readOnly: true
|
||||
media:
|
||||
existingClaim: radarr-4k-nfs-storage
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /mnt/store
|
||||
readOnly: false
|
||||
postgres-17-cluster:
|
||||
nameOverride: radarr5-4k-postgresql-17
|
||||
mode: recovery
|
||||
cluster:
|
||||
storage:
|
||||
storageClass: local-path
|
||||
walStorage:
|
||||
storageClass: local-path
|
||||
monitoring:
|
||||
enabled: true
|
||||
prometheusRule:
|
||||
enabled: true
|
||||
resources:
|
||||
requests:
|
||||
memory: 1Gi
|
||||
cpu: 200m
|
||||
initdb:
|
||||
postInitSQL:
|
||||
- CREATE DATABASE "radarr-main" OWNER "app";
|
||||
- CREATE DATABASE "radarr-log" OWNER "app";
|
||||
recovery:
|
||||
method: objectStore
|
||||
objectStore:
|
||||
destinationPath: s3://postgres-backups/cl01tl/radarr5-4k/radarr5-4k-postgresql-17-cluster
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
index: 1
|
||||
endpointCredentials: radarr-4k-postgresql-17-cluster-backup-secret-garage
|
||||
backup:
|
||||
objectStore:
|
||||
- name: external
|
||||
destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/radarr5-4k/radarr5-4k-postgresql-17-cluster
|
||||
index: 1
|
||||
endpointCredentials: radarr-4k-postgresql-17-cluster-backup-secret
|
||||
retentionPolicy: "30d"
|
||||
isWALArchiver: false
|
||||
- name: garage-local
|
||||
destinationPath: s3://postgres-backups/cl01tl/radarr-4k/radarr5-4k-postgresql-17-cluster
|
||||
index: 1
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
endpointCredentials: radarr-4k-postgresql-17-cluster-backup-secret-garage
|
||||
endpointCredentialsIncludeRegion: true
|
||||
retentionPolicy: "3d"
|
||||
isWALArchiver: true
|
||||
# - name: garage-remote
|
||||
# destinationPath: s3://postgres-backups/cl01tl/radarr-4k/radarr5-4k-postgresql-17-cluster
|
||||
# index: 1
|
||||
# endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
|
||||
# endpointCredentials: radarr-4k-postgresql-17-cluster-backup-secret-garage
|
||||
# retentionPolicy: "30d"
|
||||
# data:
|
||||
# compression: bzip2
|
||||
# jobs: 2
|
||||
scheduledBackups:
|
||||
- name: daily-backup
|
||||
suspend: false
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: external
|
||||
- name: live-backup
|
||||
suspend: false
|
||||
immediate: true
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: garage-local
|
||||
# - name: weekly-backup
|
||||
# suspend: false
|
||||
# schedule: "0 18 4 * * SAT"
|
||||
# backupName: garage-remote
|
||||
9
clusters/cl01tl/helm/radarr-anime/Chart.lock
Normal file
9
clusters/cl01tl/helm/radarr-anime/Chart.lock
Normal file
@@ -0,0 +1,9 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: postgres-cluster
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 6.16.0
|
||||
digest: sha256:f21d624fcafe0fc8e4f8d1c140f1fbefc40a74bdc29d6267a4d71e95ac81b95a
|
||||
generated: "2025-11-30T21:07:38.187061-06:00"
|
||||
33
clusters/cl01tl/helm/radarr-anime/Chart.yaml
Normal file
33
clusters/cl01tl/helm/radarr-anime/Chart.yaml
Normal file
@@ -0,0 +1,33 @@
|
||||
apiVersion: v2
|
||||
name: radarr-anime
|
||||
version: 1.0.0
|
||||
description: Radarr Anime
|
||||
keywords:
|
||||
- radarr
|
||||
- servarr
|
||||
- movies
|
||||
- anime
|
||||
- metrics
|
||||
home: https://wiki.alexlebens.dev/s/b5687ceb-11db-49b3-9c77-bf27bc322c99
|
||||
sources:
|
||||
- https://github.com/Radarr/Radarr
|
||||
- https://github.com/linuxserver/docker-radarr
|
||||
- https://github.com/onedr0p/exportarr
|
||||
- https://github.com/cloudnative-pg/cloudnative-pg
|
||||
- https://github.com/linuxserver/docker-radarr/pkgs/container/radarr
|
||||
- https://github.com/onedr0p/exportarr/pkgs/container/exportarr
|
||||
- https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
|
||||
- https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
|
||||
maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: app-template
|
||||
alias: radarr-anime
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: postgres-cluster
|
||||
alias: postgres-17-cluster
|
||||
version: 6.16.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/radarr-anime.png
|
||||
appVersion: 5.22.4
|
||||
122
clusters/cl01tl/helm/radarr-anime/templates/external-secret.yaml
Normal file
122
clusters/cl01tl/helm/radarr-anime/templates/external-secret.yaml
Normal file
@@ -0,0 +1,122 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: radarr-anime-config-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-anime-config-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/radarr5-anime/radarr5-anime-config"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: S3_BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: access_key
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: secret_key
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: radarr-anime-postgresql-17-cluster-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-anime-postgresql-17-cluster-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: access
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: secret
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: radarr-anime-postgresql-17-cluster-backup-secret-garage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-anime-postgresql-17-cluster-backup-secret-garage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_KEY_ID
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_SECRET_KEY
|
||||
- secretKey: ACCESS_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_REGION
|
||||
28
clusters/cl01tl/helm/radarr-anime/templates/http-route.yaml
Normal file
28
clusters/cl01tl/helm/radarr-anime/templates/http-route.yaml
Normal file
@@ -0,0 +1,28 @@
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: http-route-radarr-anime
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: http-route-radarr-anime
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: traefik-gateway
|
||||
namespace: traefik
|
||||
hostnames:
|
||||
- radarr-anime.alexlebens.net
|
||||
rules:
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
backendRefs:
|
||||
- group: ''
|
||||
kind: Service
|
||||
name: radarr-anime
|
||||
port: 80
|
||||
weight: 100
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: radarr-anime-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-anime-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
volumeName: radarr-anime-nfs-storage
|
||||
storageClassName: nfs-client
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
@@ -0,0 +1,23 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: radarr-anime-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-anime-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: nfs-client
|
||||
capacity:
|
||||
storage: 1Gi
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
nfs:
|
||||
path: /volume2/Storage
|
||||
server: synologybond.alexlebens.net
|
||||
mountOptions:
|
||||
- vers=4
|
||||
- minorversion=1
|
||||
- noac
|
||||
@@ -0,0 +1,32 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: radarr-anime
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-anime
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
groups:
|
||||
- name: radarr-anime
|
||||
rules:
|
||||
- alert: ExportarrAbsent
|
||||
annotations:
|
||||
description: Radarr Anime Exportarr has disappeared from Prometheus
|
||||
service discovery.
|
||||
summary: Exportarr is down.
|
||||
expr: |
|
||||
absent(up{job=~".*radarr-anime.*"} == 1)
|
||||
for: 5m
|
||||
labels:
|
||||
severity: critical
|
||||
- alert: RadarrAnimeDown
|
||||
annotations:
|
||||
description: Radarr Anime service is down.
|
||||
summary: Radarr Anime is down.
|
||||
expr: |
|
||||
radarr_anime_system_status{job=~".*radarr-anime.*"} == 0
|
||||
for: 5m
|
||||
labels:
|
||||
severity: critical
|
||||
@@ -0,0 +1,30 @@
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: radarr-anime-config-backup-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-anime-config-backup-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: radarr-anime-config
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: radarr-anime-config-backup-secret
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
moverSecurityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
@@ -0,0 +1,19 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: radarr-anime
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-anime
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: radarr-anime
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
endpoints:
|
||||
- port: metrics
|
||||
interval: 3m
|
||||
scrapeTimeout: 1m
|
||||
path: /metrics
|
||||
145
clusters/cl01tl/helm/radarr-anime/values.yaml
Normal file
145
clusters/cl01tl/helm/radarr-anime/values.yaml
Normal file
@@ -0,0 +1,145 @@
|
||||
radarr-anime:
|
||||
controllers:
|
||||
main:
|
||||
type: deployment
|
||||
replicas: 1
|
||||
strategy: Recreate
|
||||
revisionHistoryLimit: 3
|
||||
pod:
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
containers:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/linuxserver/radarr
|
||||
tag: 6.0.4@sha256:06ac318ecb95a34c7b229568dcb4271f02cb5007bb189a0dd67a2032864187ca
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: TZ
|
||||
value: US/Central
|
||||
- name: PUID
|
||||
value: 1000
|
||||
- name: PGID
|
||||
value: 1000
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 256Mi
|
||||
metrics:
|
||||
image:
|
||||
repository: ghcr.io/onedr0p/exportarr
|
||||
tag: v2.3.0
|
||||
pullPolicy: IfNotPresent
|
||||
args: ["radarr"]
|
||||
env:
|
||||
- name: URL
|
||||
value: http://localhost
|
||||
- name: CONFIG
|
||||
value: /config/config.xml
|
||||
- name: PORT
|
||||
value: 9793
|
||||
- name: ENABLE_ADDITIONAL_METRICS
|
||||
value: false
|
||||
- name: ENABLE_UNKNOWN_QUEUE_ITEMS
|
||||
value: false
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
service:
|
||||
main:
|
||||
controller: main
|
||||
ports:
|
||||
http:
|
||||
port: 80
|
||||
targetPort: 7878
|
||||
protocol: HTTP
|
||||
metrics:
|
||||
port: 9793
|
||||
targetPort: 9793
|
||||
protocol: TCP
|
||||
persistence:
|
||||
config:
|
||||
forceRename: radarr-anime-config
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 20Gi
|
||||
retain: true
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /config
|
||||
readOnly: false
|
||||
metrics:
|
||||
- path: /config
|
||||
readOnly: true
|
||||
media:
|
||||
existingClaim: radarr-anime-nfs-storage
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /mnt/store
|
||||
readOnly: false
|
||||
postgres-17-cluster:
|
||||
nameOverride: radarr5-anime-postgresql-17
|
||||
mode: recovery
|
||||
cluster:
|
||||
storage:
|
||||
storageClass: local-path
|
||||
walStorage:
|
||||
storageClass: local-path
|
||||
monitoring:
|
||||
enabled: true
|
||||
prometheusRule:
|
||||
enabled: true
|
||||
initdb:
|
||||
postInitSQL:
|
||||
- CREATE DATABASE "radarr-main" OWNER "app";
|
||||
- CREATE DATABASE "radarr-log" OWNER "app";
|
||||
recovery:
|
||||
method: objectStore
|
||||
objectStore:
|
||||
destinationPath: s3://postgres-backups/cl01tl/radarr5-anime/radarr5-anime-postgresql-17-cluster
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
index: 1
|
||||
endpointCredentials: radarr-anime-postgresql-17-cluster-backup-secret-garage
|
||||
backup:
|
||||
objectStore:
|
||||
- name: external
|
||||
destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/radarr5-anime/radarr5-anime-postgresql-17-cluster
|
||||
index: 1
|
||||
endpointCredentials: radarr-anime-postgresql-17-cluster-backup-secret
|
||||
retentionPolicy: "30d"
|
||||
isWALArchiver: false
|
||||
- name: garage-local
|
||||
destinationPath: s3://postgres-backups/cl01tl/radarr-anime/radarr5-anime-postgresql-17-cluster
|
||||
index: 1
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
endpointCredentials: radarr-anime-postgresql-17-cluster-backup-secret-garage
|
||||
endpointCredentialsIncludeRegion: true
|
||||
retentionPolicy: "3d"
|
||||
isWALArchiver: true
|
||||
# - name: garage-remote
|
||||
# destinationPath: s3://postgres-backups/cl01tl/radarr-anime/radarr5-anime-postgresql-17-cluster
|
||||
# index: 1
|
||||
# endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
|
||||
# endpointCredentials: radarr-anime-postgresql-17-cluster-backup-secret-garage
|
||||
# retentionPolicy: "30d"
|
||||
# data:
|
||||
# compression: bzip2
|
||||
# jobs: 2
|
||||
scheduledBackups:
|
||||
- name: daily-backup
|
||||
suspend: false
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: external
|
||||
- name: live-backup
|
||||
suspend: false
|
||||
immediate: true
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: garage-local
|
||||
# - name: weekly-backup
|
||||
# suspend: false
|
||||
# schedule: "0 20 4 * * SAT"
|
||||
# backupName: garage-remote
|
||||
9
clusters/cl01tl/helm/radarr-standup/Chart.lock
Normal file
9
clusters/cl01tl/helm/radarr-standup/Chart.lock
Normal file
@@ -0,0 +1,9 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: postgres-cluster
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 6.16.0
|
||||
digest: sha256:caaa532c1be0452935259f03f992836b060ee212434abc5b1d81f939c6e33a2b
|
||||
generated: "2025-11-30T21:07:39.820192-06:00"
|
||||
32
clusters/cl01tl/helm/radarr-standup/Chart.yaml
Normal file
32
clusters/cl01tl/helm/radarr-standup/Chart.yaml
Normal file
@@ -0,0 +1,32 @@
|
||||
apiVersion: v2
|
||||
name: radarr-standup
|
||||
version: 1.0.0
|
||||
description: Radarr Stand Up
|
||||
keywords:
|
||||
- radarr
|
||||
- servarr
|
||||
- standup
|
||||
- metrics
|
||||
home: https://wiki.alexlebens.dev/s/b5687ceb-11db-49b3-9c77-bf27bc322c99
|
||||
sources:
|
||||
- https://github.com/Radarr/Radarr
|
||||
- https://github.com/linuxserver/docker-radarr
|
||||
- https://github.com/onedr0p/exportarr
|
||||
- https://github.com/cloudnative-pg/cloudnative-pg
|
||||
- https://github.com/linuxserver/docker-radarr/pkgs/container/radarr
|
||||
- https://github.com/onedr0p/exportarr/pkgs/container/exportarr
|
||||
- https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
|
||||
- https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
|
||||
maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: app-template
|
||||
alias: radarr-standup
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: postgres-cluster
|
||||
alias: postgres-17-cluster
|
||||
version: 6.16.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/radarr.png
|
||||
appVersion: 5.22.4
|
||||
@@ -0,0 +1,122 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: radarr-standup-config-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-standup-config-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/radarr5-standup/radarr5-standup-config"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: S3_BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: access_key
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: secret_key
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: radarr-standup-postgresql-17-cluster-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-standup-postgresql-17-cluster-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: access
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: secret
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: radarr-standup-postgresql-17-cluster-backup-secret-garage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-standup-postgresql-17-cluster-backup-secret-garage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_KEY_ID
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_SECRET_KEY
|
||||
- secretKey: ACCESS_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_REGION
|
||||
@@ -0,0 +1,28 @@
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: http-route-radarr-standup
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: http-route-radarr-standup
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: traefik-gateway
|
||||
namespace: traefik
|
||||
hostnames:
|
||||
- radarr-standup.alexlebens.net
|
||||
rules:
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
backendRefs:
|
||||
- group: ''
|
||||
kind: Service
|
||||
name: radarr-standup
|
||||
port: 80
|
||||
weight: 100
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: radarr-standup-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-standup-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
volumeName: radarr-standup-nfs-storage
|
||||
storageClassName: nfs-client
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
@@ -0,0 +1,23 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: radarr-standup-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-standup-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: nfs-client
|
||||
capacity:
|
||||
storage: 1Gi
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
nfs:
|
||||
path: /volume2/Storage
|
||||
server: synologybond.alexlebens.net
|
||||
mountOptions:
|
||||
- vers=4
|
||||
- minorversion=1
|
||||
- noac
|
||||
@@ -0,0 +1,32 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: radarr-standup
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: radarr-standup
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
groups:
|
||||
- name: radarr-standup
|
||||
rules:
|
||||
- alert: ExportarrAbsent
|
||||
annotations:
|
||||
description: Radarr Stand Up Exportarr has disappeared from Prometheus
|
||||
service discovery.
|
||||
summary: Exportarr is down.
|
||||
expr: |
|
||||
absent(up{job=~".*radarr-standup.*"} == 1)
|
||||
for: 5m
|
||||
labels:
|
||||
severity: critical
|
||||
- alert: RadarrStandUpDown
|
||||
annotations:
|
||||
description: Radarr Stand Up service is down.
|
||||
summary: Radarr Stand Up is down.
|
||||
expr: |
|
||||
radarr_standup_system_status{job=~".*radarr-standup.*"} == 0
|
||||
for: 5m
|
||||
labels:
|
||||
severity: critical
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user