From a39e90abffeb61612b6c8550b16c521c142634ba Mon Sep 17 00:00:00 2001 From: Alex Lebens Date: Sun, 11 May 2025 09:25:32 -0500 Subject: [PATCH] add postiz --- .../cl01tl/applications/homepage/values.yaml | 12 +- .../cl01tl/applications/postiz/Chart.yaml | 37 +++ .../postiz/templates/external-secret.yaml | 269 ++++++++++++++++++ .../postiz/templates/http-route.yaml | 30 ++ .../postiz/templates/replication-source.yaml | 56 ++++ .../cl01tl/applications/postiz/values.yaml | 139 +++++++++ 6 files changed, 537 insertions(+), 6 deletions(-) create mode 100644 clusters/cl01tl/applications/postiz/Chart.yaml create mode 100644 clusters/cl01tl/applications/postiz/templates/external-secret.yaml create mode 100644 clusters/cl01tl/applications/postiz/templates/http-route.yaml create mode 100644 clusters/cl01tl/applications/postiz/templates/replication-source.yaml create mode 100644 clusters/cl01tl/applications/postiz/values.yaml diff --git a/clusters/cl01tl/applications/homepage/values.yaml b/clusters/cl01tl/applications/homepage/values.yaml index 9fd7e6b28..b6b8e2519 100644 --- a/clusters/cl01tl/applications/homepage/values.yaml +++ b/clusters/cl01tl/applications/homepage/values.yaml @@ -148,6 +148,12 @@ homepage: href: https://immich.alexlebens.net siteMonitor: http://immich-main.immich:2283 statusStyle: dot + - Pictures: + icon: sh-photoview.webp + description: Photoview + href: https://photoview.alexlebens.net + siteMonitor: http://photoview.photoview:80 + statusStyle: dot - Podcasts and Audiobooks: icon: sh-audiobookshelf.webp description: Audiobookshelf @@ -258,12 +264,6 @@ homepage: href: https://kiwix.alexlebens.net siteMonitor: http://kiwix.kiwix:80 statusStyle: dot - - Pictures: - icon: sh-photoview.webp - description: Photoview - href: https://photoview.alexlebens.net - siteMonitor: http://photoview.photoview:80 - statusStyle: dot - Code: - Code (Public): icon: sh-gitea.webp diff --git a/clusters/cl01tl/applications/postiz/Chart.yaml b/clusters/cl01tl/applications/postiz/Chart.yaml new file mode 100644 index 000000000..86541f3fb --- /dev/null +++ b/clusters/cl01tl/applications/postiz/Chart.yaml @@ -0,0 +1,37 @@ +apiVersion: v2 +name: postiz +version: 1.0.0 +description: Postiz +keywords: + - postiz + - social-media +home: https://wiki.alexlebens.dev/s/f483a06b-860b-423c-8d51-a1ce82e0fd43 +sources: + - https://github.com/gitroomhq/postiz-app + - https://github.com/valkey-io/valkey + - https://github.com/cloudflare/cloudflared + - https://github.com/cloudnative-pg/cloudnative-pg + - https://github.com/gitroomhq/postiz-app/pkgs/container/postiz-app + - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template + - https://github.com/bitnami/charts/tree/main/bitnami/valkey + - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared + - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster +maintainers: + - name: alexlebens +dependencies: + - name: app-template + alias: postiz + repository: https://bjw-s-labs.github.io/helm-charts/ + version: 3.7.3 + - name: valkey + version: 3.0.4 + repository: oci://harbor.alexlebens.net/proxy-registry-1.docker.io/bitnamicharts + - name: cloudflared + repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm + version: 1.14.7 + - name: postgres-cluster + alias: postgres-17-cluster + version: 4.2.1 + repository: https://gitea.alexlebens.dev/api/packages/alexlebens/helm +icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/postiz.png +appVersion: v1.43.1 diff --git a/clusters/cl01tl/applications/postiz/templates/external-secret.yaml b/clusters/cl01tl/applications/postiz/templates/external-secret.yaml new file mode 100644 index 000000000..c399c6ac5 --- /dev/null +++ b/clusters/cl01tl/applications/postiz/templates/external-secret.yaml @@ -0,0 +1,269 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: postiz-config-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: postiz-config-secret + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: web + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + data: + - secretKey: JWT_SECRET + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/postiz/config + metadataPolicy: None + property: JWT_SECRET + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: postiz-valkey-config + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: postiz-valkey-config + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: web + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + data: + - secretKey: user + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/postiz/valkey + metadataPolicy: None + property: user + - secretKey: password + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/postiz/valkey + metadataPolicy: None + property: password + - secretKey: REDIS_URL + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/postiz/valkey + metadataPolicy: None + property: REDIS_URL + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: postiz-oidc-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: postiz-oidc-secret + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: web + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + data: + - secretKey: client + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /authentik/oidc/postiz + metadataPolicy: None + property: client + - secretKey: secret + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /authentik/oidc/postiz + metadataPolicy: None + property: secret + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: postiz-config-backup-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: postiz-config-backup-secret + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: backup + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + target: + template: + mergePolicy: Merge + engineVersion: v2 + data: + RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/postiz/postiz-config" + data: + - secretKey: BUCKET_ENDPOINT + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/volsync/restic/config + metadataPolicy: None + property: S3_BUCKET_ENDPOINT + - secretKey: RESTIC_PASSWORD + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/volsync/restic/config + metadataPolicy: None + property: RESTIC_PASSWORD + - secretKey: AWS_DEFAULT_REGION + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/volsync/restic/config + metadataPolicy: None + property: AWS_DEFAULT_REGION + - secretKey: AWS_ACCESS_KEY_ID + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /digital-ocean/home-infra/volsync-backups + metadataPolicy: None + property: access_key + - secretKey: AWS_SECRET_ACCESS_KEY + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /digital-ocean/home-infra/volsync-backups + metadataPolicy: None + property: secret_key + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: postiz-uploads-backup-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: postiz-uploads-backup-secret + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: backup + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + target: + template: + mergePolicy: Merge + engineVersion: v2 + data: + RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/postiz/postiz-uploads" + data: + - secretKey: BUCKET_ENDPOINT + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/volsync/restic/config + metadataPolicy: None + property: S3_BUCKET_ENDPOINT + - secretKey: RESTIC_PASSWORD + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/volsync/restic/config + metadataPolicy: None + property: RESTIC_PASSWORD + - secretKey: AWS_DEFAULT_REGION + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cl01tl/volsync/restic/config + metadataPolicy: None + property: AWS_DEFAULT_REGION + - secretKey: AWS_ACCESS_KEY_ID + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /digital-ocean/home-infra/volsync-backups + metadataPolicy: None + property: access_key + - secretKey: AWS_SECRET_ACCESS_KEY + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /digital-ocean/home-infra/volsync-backups + metadataPolicy: None + property: secret_key + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: postiz-cloudflared-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: postiz-cloudflared-secret + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: web + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + data: + - secretKey: cf-tunnel-token + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /cloudflare/tunnels/postiz + metadataPolicy: None + property: token + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: postiz-postgresql-17-cluster-backup-secret + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: postiz-postgresql-17-cluster-backup-secret + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: database + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + secretStoreRef: + kind: ClusterSecretStore + name: vault + data: + - secretKey: ACCESS_KEY_ID + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /digital-ocean/home-infra/postgres-backups + metadataPolicy: None + property: access + - secretKey: ACCESS_SECRET_KEY + remoteRef: + conversionStrategy: Default + decodingStrategy: None + key: /digital-ocean/home-infra/postgres-backups + metadataPolicy: None + property: secret diff --git a/clusters/cl01tl/applications/postiz/templates/http-route.yaml b/clusters/cl01tl/applications/postiz/templates/http-route.yaml new file mode 100644 index 000000000..4fd96cdd7 --- /dev/null +++ b/clusters/cl01tl/applications/postiz/templates/http-route.yaml @@ -0,0 +1,30 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: http-route-postiz + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: http-route-postiz + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: web + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: traefik-gateway + namespace: traefik + hostnames: + - postiz.alexlebens.net + rules: + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - group: '' + kind: Service + name: postiz + port: 80 + weight: 100 diff --git a/clusters/cl01tl/applications/postiz/templates/replication-source.yaml b/clusters/cl01tl/applications/postiz/templates/replication-source.yaml new file mode 100644 index 000000000..df0cd9859 --- /dev/null +++ b/clusters/cl01tl/applications/postiz/templates/replication-source.yaml @@ -0,0 +1,56 @@ +apiVersion: volsync.backube/v1alpha1 +kind: ReplicationSource +metadata: + name: postiz-config-backup-source + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: postiz-config-backup-source + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: backup + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + sourcePVC: postiz-config + trigger: + schedule: 0 4 * * * + restic: + pruneIntervalDays: 7 + repository: postiz-config-backup-secret + retain: + hourly: 1 + daily: 3 + weekly: 2 + monthly: 2 + yearly: 4 + copyMethod: Snapshot + storageClassName: ceph-block + volumeSnapshotClassName: ceph-blockpool-snapshot + +--- +apiVersion: volsync.backube/v1alpha1 +kind: ReplicationSource +metadata: + name: postiz-uploads-backup-source + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/name: postiz-uploads-backup-source + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + app.kubernetes.io/component: backup + app.kubernetes.io/part-of: {{ .Release.Name }} +spec: + sourcePVC: postiz-uploads + trigger: + schedule: 0 4 * * * + restic: + pruneIntervalDays: 7 + repository: postiz-uploads-backup-secret + retain: + hourly: 1 + daily: 3 + weekly: 2 + monthly: 2 + yearly: 4 + copyMethod: Snapshot + storageClassName: ceph-block + volumeSnapshotClassName: ceph-blockpool-snapshot diff --git a/clusters/cl01tl/applications/postiz/values.yaml b/clusters/cl01tl/applications/postiz/values.yaml new file mode 100644 index 000000000..c2cb9aa6c --- /dev/null +++ b/clusters/cl01tl/applications/postiz/values.yaml @@ -0,0 +1,139 @@ +postiz: + controllers: + main: + type: deployment + replicas: 1 + strategy: Recreate + revisionHistoryLimit: 3 + containers: + main: + image: + repository: ghcr.io/gitroomhq/postiz-app + tag: v1.43.1 + pullPolicy: IfNotPresent + env: + - name: MAIN_URL + value: https://postiz.alexlebens.dev + - name: FRONTEND_URL + value: https://postiz.alexlebens.dev + - name: NEXT_PUBLIC_BACKEND_URL + value: https://postiz.alexlebens.dev/api + - name: JWT_SECRET + valueFrom: + secretKeyRef: + name: postiz-config-secret + key: JWT_SECRET + - name: DATABASE_URL + valueFrom: + secretKeyRef: + name: postiz-postgresql-17-cluster-app + key: uri + - name: REDIS_URL + valueFrom: + secretKeyRef: + name: postiz-valkey-config + key: REDIS_URL + - name: BACKEND_INTERNAL_URL + value: http://localhost:3000 + - name: IS_GENERAL + value: true + - name: DISABLE_REGISTRATION + value: false + - name: STORAGE_PROVIDER + value: local + - name: UPLOAD_DIRECTORY + value: /uploads + - name: NEXT_PUBLIC_UPLOAD_DIRECTORY + value: /uploads + - name: NEXT_PUBLIC_POSTIZ_OAUTH_DISPLAY_NAME + value: Authentik + - name: NEXT_PUBLIC_POSTIZ_OAUTH_LOGO_URL + value: https://cdn.jsdelivr.net/gh/selfhst/icons/png/authentik.png + - name: POSTIZ_GENERIC_OAUTH + value: falseß + - name: POSTIZ_OAUTH_URL + value: https://auth.alexlebens.dev + - name: POSTIZ_OAUTH_AUTH_URL + value: https://auth.alexlebens.dev/application/o/postiz/.well-known/openid-configuration + - name: POSTIZ_OAUTH_TOKEN_URL + value: https://auth.alexlebens.dev/application/o/postiz/.well-known/openid-configuration + - name: POSTIZ_OAUTH_USERINFO_URL + value: https://auth.alexlebens.dev/application/o/postiz/.well-known/openid-configuration + - name: POSTIZ_OAUTH_CLIENT_ID + valueFrom: + secretKeyRef: + name: postiz-oidc-secret + key: client + - name: POSTIZ_OAUTH_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: postiz-oidc-secret + key: secret + - name: POSTIZ_OAUTH_SCOPE + value: openid profile email + resources: + requests: + cpu: 10m + memory: 128Mi + serviceAccount: + create: true + service: + main: + controller: main + ports: + http: + port: 80 + targetPort: 5000 + protocol: HTTP + persistence: + config: + storageClass: ceph-block + accessMode: ReadWriteOnce + size: 2Gi + retain: true + advancedMounts: + main: + main: + - path: /config + readOnly: false + uploads: + storageClass: ceph-block + accessMode: ReadWriteOnce + size: 10Gi + retain: true + advancedMounts: + main: + main: + - path: /uploads + readOnly: false +valkey: + architecture: standalone + auth: + enabled: true + existingSecret: postiz-valkey-config + existingSecretPasswordKey: password + usePasswordFiles: false + primary: + persistence: + enabled: false + replica: + persistence: + enabled: false +cloudflared: + name: cloudflared-postiz + existingSecretName: postiz-cloudflared-secret +postgres-17-cluster: + mode: standalone + cluster: + walStorage: + storageClass: local-path + storage: + storageClass: local-path + monitoring: + enabled: true + backup: + enabled: false + endpointURL: https://nyc3.digitaloceanspaces.com + destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/postiz/postiz-postgresql-17-cluster + endpointCredentials: postiz-postgresql-17-cluster-backup-secret + backupIndex: 1