From 59dfd7233f3fd02a0ac1b8bce28e68c9259b1b8b Mon Sep 17 00:00:00 2001 From: alexlebens Date: Mon, 19 Aug 2024 19:24:09 -0500 Subject: [PATCH] add directus --- .../cl01tl/applications/homepage/values.yaml | 6 + .../applications/site-profile/Chart.yaml | 11 ++ .../templates/external-secret.yaml | 171 +++++++++++++++++- .../templates/replication-source.yaml | 27 +++ .../applications/site-profile/values.yaml | 170 +++++++++++++++++ 5 files changed, 384 insertions(+), 1 deletion(-) create mode 100644 clusters/cl01tl/applications/site-profile/templates/replication-source.yaml diff --git a/clusters/cl01tl/applications/homepage/values.yaml b/clusters/cl01tl/applications/homepage/values.yaml index e8377f819..7099f38ac 100644 --- a/clusters/cl01tl/applications/homepage/values.yaml +++ b/clusters/cl01tl/applications/homepage/values.yaml @@ -221,6 +221,12 @@ homepage: href: https://home-assistant-cl01tl.boreal-beaufort.ts.net siteMonitor: http://home-assistant.home-assistant:8123 statusStyle: dot + - Content Management: + icon: directus.png + description: Directus + href: https://directus-site-profile-cl01tl.boreal-beaufort.ts.net + siteMonitor: http://directus.site-profile:80 + statusStyle: dot - Email: icon: roundcube.svg description: Roundcube diff --git a/clusters/cl01tl/applications/site-profile/Chart.yaml b/clusters/cl01tl/applications/site-profile/Chart.yaml index ea820f3f6..c90b4a9cc 100644 --- a/clusters/cl01tl/applications/site-profile/Chart.yaml +++ b/clusters/cl01tl/applications/site-profile/Chart.yaml @@ -18,9 +18,20 @@ dependencies: alias: site-profile repository: https://bjw-s.github.io/helm-charts/ version: 3.3.2 + - name: app-template + alias: directus + repository: https://bjw-s.github.io/helm-charts/ + version: 3.3.2 + - name: valkey + version: 0.3.13 + repository: https://charts.bitnami.com/bitnami - name: cloudflared alias: cloudflared repository: http://alexlebens.github.io/helm-charts version: 1.6.0 + - name: postgres-cluster + alias: postgres-16-cluster + version: 3.8.4 + repository: http://alexlebens.github.io/helm-charts icon: https://d21zlbwtcn424f.cloudfront.net/icon_white.png appVersion: 0.1.5 diff --git a/clusters/cl01tl/applications/site-profile/templates/external-secret.yaml b/clusters/cl01tl/applications/site-profile/templates/external-secret.yaml index d682c7b54..e588017a7 100644 --- a/clusters/cl01tl/applications/site-profile/templates/external-secret.yaml +++ b/clusters/cl01tl/applications/site-profile/templates/external-secret.yaml @@ -1,5 +1,83 @@ apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret +metadata: + name: directus-config + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: directus-config + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: web + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + data: + - secretKey: admin-email + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/site-profile/directus/config + metadataPolicy: None + property: admin-email + - secretKey: admin-password + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/site-profile/directus/config + metadataPolicy: None + property: admin-password + - secretKey: secret + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/site-profile/directus/config + metadataPolicy: None + property: secret + - secretKey: key + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/site-profile/directus/config + metadataPolicy: None + property: key + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: directus-oidc-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: directus-oidc-secret + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: web + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + data: + - secretKey: OIDC_CLIENT_ID + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /authentik/oidc/directus + metadataPolicy: None + property: client + - secretKey: OIDC_CLIENT_SECRET + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /authentik/oidc/directus + metadataPolicy: None + property: secret + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret metadata: name: site-profile-cloudflared-api-secret namespace: {{ .Release.Namespace }} @@ -20,4 +98,95 @@ spec: decodingStrategy: None key: /cloudflare/tunnels/site-profile metadataPolicy: None - property: token \ No newline at end of file + property: token + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: directus-config-backup-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: directus-config-backup-secret + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: backup + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + target: + template: + mergePolicy: Merge + engineVersion: v2 + data: + RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/directus/directus-data" + data: + - secretKey: BUCKET_ENDPOINT + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/volsync/restic/config + metadataPolicy: None + property: S3_BUCKET_ENDPOINT + - secretKey: RESTIC_PASSWORD + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/volsync/restic/config + metadataPolicy: None + property: RESTIC_PASSWORD + - secretKey: AWS_DEFAULT_REGION + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/volsync/restic/config + metadataPolicy: None + property: AWS_DEFAULT_REGION + - secretKey: AWS_ACCESS_KEY_ID + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /aws/keys/cl01tl-volsync-backups + metadataPolicy: None + property: access_key + - secretKey: AWS_SECRET_ACCESS_KEY + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /aws/keys/cl01tl-volsync-backups + metadataPolicy: None + property: secret_key + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: directus-postgresql-16-cluster-backup-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: directus-postgresql-16-cluster-backup-secret + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: database + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + data: + - secretKey: ACCESS_KEY_ID + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /aws/keys/cl01tl-directus-postgresql + metadataPolicy: None + property: access_key + - secretKey: ACCESS_SECRET_KEY + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /aws/keys/cl01tl-directus-postgresql + metadataPolicy: None + property: secret_key diff --git a/clusters/cl01tl/applications/site-profile/templates/replication-source.yaml b/clusters/cl01tl/applications/site-profile/templates/replication-source.yaml new file mode 100644 index 000000000..34817deca --- /dev/null +++ b/clusters/cl01tl/applications/site-profile/templates/replication-source.yaml @@ -0,0 +1,27 @@ +apiVersion: volsync.backube/v1alpha1 +kind: ReplicationSource +metadata: + name: directus-data-backup-source + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: directus-data-backup-source + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: backup + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + sourcePVC: directus-data + trigger: + schedule: 0 0 * * * + restic: + pruneIntervalDays: 7 + repository: directus-data-backup-secret + retain: + hourly: 1 + daily: 1 + weekly: 3 + monthly: 2 + yearly: 4 + copyMethod: Snapshot + storageClassName: ceph-block-delete + volumeSnapshotClassName: ceph-blockpool-snapshot diff --git a/clusters/cl01tl/applications/site-profile/values.yaml b/clusters/cl01tl/applications/site-profile/values.yaml index a6bc9e052..71a3b724c 100644 --- a/clusters/cl01tl/applications/site-profile/values.yaml +++ b/clusters/cl01tl/applications/site-profile/values.yaml @@ -25,6 +25,176 @@ site-profile: port: 80 targetPort: 4321 protocol: HTTP +directus: + controllers: + main: + type: deployment + replicas: 1 + strategy: Recreate + revisionHistoryLimit: 3 + containers: + main: + image: + repository: ghcr.io/alexlebens/site-profile + tag: 0.1.5 + pullPolicy: IfNotPresent + env: + - name: PUBLIC_URL + value: https://directus-site-profile-cl01tl.boreal-beaufort.ts.net + - name: ADMIN_EMAIL + valueFrom: + secretKeyRef: + name: directus-config + key: admin-email + - name: ADMIN_PASSWORD + valueFrom: + secretKeyRef: + name: directus-config + key: admin-password + - name: SECRET + valueFrom: + secretKeyRef: + name: directus-config + key: secret + - name: KEY + valueFrom: + secretKeyRef: + name: directus-config + key: key + - name: DB_CLIENT + value: postgres + - name: DB_HOST + valueFrom: + secretKeyRef: + name: directus-postgresql-16-cluster-app + key: host + - name: DB_DATABASE + valueFrom: + secretKeyRef: + name: directus-postgresql-16-cluster-app + key: dbname + - name: DB_PORT + valueFrom: + secretKeyRef: + name: directus-postgresql-16-cluster-app + key: port + - name: DB_USER + valueFrom: + secretKeyRef: + name: directus-postgresql-16-cluster-app + key: user + - name: DB_PASSWORD + valueFrom: + secretKeyRef: + name: directus-postgresql-16-cluster-app + key: password + - name: REDIS_ENABLED + value: true + - name: REDIS_HOST + value: site-profile-valkey-master + - name: REDIS_PORT + value: 6379 + - name: STORAGE_LOCATIONS + value: LOCAL + - name: STORAGE_LOCAL_DRIVER + value: local + - name: STORAGE_LOCAL_ROOT + value: /mnt/store + - name: AUTH_PROVIDERS + value: AUTHENTIK + - name: AUTH_AUTHENTIK_DRIVER + value: openid + - name: AUTH_AUTHENTIK_CLIENT_ID + valueFrom: + secretKeyRef: + name: directus-oidc-secret + key: client + - name: AUTH_AUTHENTIK_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: directus-oidc-secret + key: secret + - name: AUTH_AUTHENTIK_SCOPE + value: openid profile email + - name: AUTH_AUTHENTIK_AUTHORIZE_URL + value: https://auth-cl01tl.boreal-beaufort.ts.net/application/o/authorize/ + - name: AUTH_AUTHENTIK_ACCESS_URL + value: https://auth-cl01tl.boreal-beaufort.ts.net/application/o/ + - name: AUTH_AUTHENTIK_PROFILE_URL + value: https://auth-cl01tl.boreal-beaufort.ts.net/application/o/userinfo/ + - name: AUTH_AUTHENTIK_IDENTIFIER_KEY + value: prefered_username + - name: AUTH_AUTHENTIK_ALLOW_PUBLIC_REGISTRATION + value: true + - name: AUTH_AUTHENTIK_ICON + value: https://goauthentik.io/img/icon.png + - name: AUTH_AUTHENTIK_LABEL + value: SSO Login + - name: TELEMETRY + value: false + resources: + requests: + cpu: 100m + memory: 256Mi + serviceAccount: + create: true + service: + main: + controller: main + ports: + http: + port: 80 + targetPort: 8055 + protocol: TCP + ingress: + tailscale: + enabled: true + className: tailscale + hosts: + - host: directus-site-profile-cl01tl + paths: + - path: / + pathType: Prefix + service: + name: directus + port: 80 + tls: + - hosts: + - directus-site-profile-cl01tl + persistence: + data: + storageClass: ceph-block + accessMode: ReadWriteOnce + size: 10Gi + retain: true + advancedMounts: + main: + main: + - path: /mnt/store + readOnly: false +valkey: + architecture: standalone + auth: + enabled: true cloudflared: name: cloudflared existingSecretName: site-profile-cloudflared-api-secret +postgres-16-cluster: + nameOverride: directus + mode: standalone + cluster: + walStorage: + storageClass: local-path + storage: + storageClass: local-path + monitoring: + enabled: true + prometheusRule: + enabled: false + backup: + enabled: true + endpointURL: https://s3.us-east-2.amazonaws.com + destinationPath: s3://cl01tl-postgresql-backups/directus + endpointCredentials: directus-postgresql-16-cluster-backup-secret + backupIndex: 1 + retentionPolicy: 14d