Merge pull request 'feat: move rclone to chart and namespace' (#6277) from tmp/karakeep-1 into main

Reviewed-on: #6277

clusters/cl01tl/helm/karakeep/Chart.yaml

@@ -15,6 +15,7 @@ sources:
   - https://github.com/meilisearch/meilisearch-kubernetes/tree/main/charts/meilisearch
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
   - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/volsync-target
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/rclone-bucket
 maintainers:
   - name: alexlebens
 dependencies:
@@ -32,6 +33,10 @@ dependencies:
     alias: volsync-target-data
     version: 1.0.0
     repository: oci://harbor.alexlebens.net/helm-charts
+  - name: rclone-bucket
+    alias: rclone-karakeep-assets-remote
+    repository: oci://harbor.alexlebens.net/helm-charts
+    version: 0.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/karakeep.png
 # renovate: datasource=github-releases depName=karakeep-app/karakeep
 appVersion: 0.31.0

clusters/cl01tl/helm/karakeep/values.yaml

@@ -172,3 +172,24 @@ volsync-target-data:
   external:
     enabled: true
     schedule: 30 10 * * *
+rclone-karakeep-assets-remote:
+  cronJob:
+    suspend: false
+    schedule: 10 0 * * *
+  rclone:
+    source:
+      bucketName: karakeep-assets
+    destination:
+      bucketName: karakeep-assets
+  secret:
+    externalSecret:
+      source:
+        credentials:
+          path: /garage/home-infra/karakeep-assets
+        config:
+          path: /garage/config
+      destination:
+        credentials:
+          path: /garage/home-infra/karakeep-assets
+        config:
+          path: /garage/config

clusters/cl01tl/helm/ntfy/Chart.yaml

@@ -21,6 +21,10 @@ dependencies:
     alias: postgres-18-cluster
     version: 7.12.1
     repository: oci://harbor.alexlebens.net/helm-charts
+  - name: rclone-bucket
+    alias: rclone-ntfy-attachments-remote
+    repository: oci://harbor.alexlebens.net/helm-charts
+    version: 0.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ntfy.png
 # renovate: datasource=github-releases depName=binwiederhier/ntfy
 appVersion: 2.22.0

clusters/cl01tl/helm/ntfy/values.yaml

@@ -124,3 +124,24 @@ postgres-18-cluster:
         immediate: true
         schedule: "0 15 14 * * *"
         backupName: garage-local
+rclone-ntfy-attachments-remote:
+  cronJob:
+    suspend: false
+    schedule: 50 0 * * *
+  rclone:
+    source:
+      bucketName: ntfy-attachments
+    destination:
+      bucketName: ntfy-attachments
+  secret:
+    externalSecret:
+      source:
+        credentials:
+          path: /garage/home-infra/ntfy-attachments
+        config:
+          path: /garage/config
+      destination:
+        credentials:
+          path: /garage/home-infra/ntfy-attachments
+        config:
+          path: /garage/config

clusters/cl01tl/helm/rclone/Chart.yaml

@@ -11,6 +11,7 @@ sources:
   - https://github.com/rclone/rclone
   - https://hub.docker.com/r/rclone/rclone
   - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/rclone-bucket
 maintainers:
   - name: alexlebens
 dependencies:
@@ -18,6 +19,10 @@ dependencies:
     alias: rclone
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
+  - name: rclone-bucket
+    alias: rclone-web-assets-remote
+    repository: oci://harbor.alexlebens.net/helm-charts
+    version: 0.2.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/rclone.png
 # renovate: datasource=github-releases depName=rclone/rclone
 appVersion: v1.73.5

clusters/cl01tl/helm/rclone/templates/external-secret.yaml

@@ -1,40 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: garage-karakeep-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: garage-karakeep-secret
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        key: /garage/home-infra/karakeep-assets
-        property: ACCESS_KEY_ID
-    - secretKey: ACCESS_REGION
-      remoteRef:
-        key: /garage/home-infra/karakeep-assets
-        property: ACCESS_REGION
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        key: /garage/home-infra/karakeep-assets
-        property: ACCESS_SECRET_KEY
-    - secretKey: SRC_ENDPOINT
-      remoteRef:
-        key: /garage/config
-        property: ENDPOINT_LOCAL
-    - secretKey: DEST_ENDPOINT
-      remoteRef:
-        key: /garage/config
-        property: ENDPOINT_REMOTE
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
   name: garage-talos-backups-secret
   namespace: {{ .Release.Namespace }}
@@ -67,41 +32,6 @@ spec:
         key: /garage/config
         property: ENDPOINT_REMOTE
 
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: garage-web-assets-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: garage-web-assets-secret
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        key: /garage/home-infra/web-assets
-        property: ACCESS_KEY_ID
-    - secretKey: ACCESS_REGION
-      remoteRef:
-        key: /garage/home-infra/web-assets
-        property: ACCESS_REGION
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        key: /garage/home-infra/web-assets
-        property: ACCESS_SECRET_KEY
-    - secretKey: SRC_ENDPOINT
-      remoteRef:
-        key: /garage/config
-        property: ENDPOINT_LOCAL
-    - secretKey: DEST_ENDPOINT
-      remoteRef:
-        key: /garage/config
-        property: ENDPOINT_REMOTE
-
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
@@ -137,41 +67,6 @@ spec:
         key: /garage/config
         property: ENDPOINT_REMOTE
 
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: garage-ntfy-attachments-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: garage-ntfy-attachments-secret
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        key: /garage/home-infra/ntfy-attachments
-        property: ACCESS_KEY_ID
-    - secretKey: ACCESS_REGION
-      remoteRef:
-        key: /garage/home-infra/ntfy-attachments
-        property: ACCESS_REGION
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        key: /garage/home-infra/ntfy-attachments
-        property: ACCESS_SECRET_KEY
-    - secretKey: SRC_ENDPOINT
-      remoteRef:
-        key: /garage/config
-        property: ENDPOINT_LOCAL
-    - secretKey: DEST_ENDPOINT
-      remoteRef:
-        key: /garage/config
-        property: ENDPOINT_REMOTE
-
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret

clusters/cl01tl/helm/rclone/values.yaml

@@ -1,83 +1,5 @@
 rclone:
   controllers:
-    karakeep-assets:
-      type: cronjob
-      cronjob:
-        suspend: false
-        timeZone: America/Chicago
-        schedule: 10 0 * * *
-        backoffLimit: 3
-        parallelism: 1
-      containers:
-        sync:
-          image:
-            repository: rclone/rclone
-            tag: 1.73.5@sha256:1619a625f845e169c34b952cf40c483c0392965b821c5155cde8cbfd35254a96
-          args:
-            - sync
-            - src:karakeep-assets
-            - dest:karakeep-assets
-            - --s3-no-check-bucket
-            - --verbose
-          env:
-            - name: RCLONE_S3_PROVIDER
-              value: Other
-            - name: RCLONE_CONFIG_SRC_TYPE
-              value: s3
-            - name: RCLONE_CONFIG_SRC_PROVIDER
-              value: Other
-            - name: RCLONE_CONFIG_SRC_ENV_AUTH
-              value: false
-            - name: RCLONE_CONFIG_SRC_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: garage-karakeep-secret
-                  key: ACCESS_KEY_ID
-            - name: RCLONE_CONFIG_SRC_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: garage-karakeep-secret
-                  key: ACCESS_SECRET_KEY
-            - name: RCLONE_CONFIG_SRC_REGION
-              valueFrom:
-                secretKeyRef:
-                  name: garage-karakeep-secret
-                  key: ACCESS_REGION
-            - name: RCLONE_CONFIG_SRC_ENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: garage-karakeep-secret
-                  key: SRC_ENDPOINT
-            - name: RCLONE_CONFIG_SRC_S3_FORCE_PATH_STYLE
-              value: true
-            - name: RCLONE_CONFIG_DEST_TYPE
-              value: s3
-            - name: RCLONE_CONFIG_DEST_PROVIDER
-              value: Other
-            - name: RCLONE_CONFIG_DEST_ENV_AUTH
-              value: false
-            - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: garage-karakeep-secret
-                  key: ACCESS_KEY_ID
-            - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: garage-karakeep-secret
-                  key: ACCESS_SECRET_KEY
-            - name: RCLONE_CONFIG_DEST_REGION
-              valueFrom:
-                secretKeyRef:
-                  name: garage-karakeep-secret
-                  key: ACCESS_REGION
-            - name: RCLONE_CONFIG_DEST_ENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: garage-karakeep-secret
-                  key: DEST_ENDPOINT
-            - name: RCLONE_CONFIG_SRC_DEST_FORCE_PATH_STYLE
-              value: true
     talos-backups:
       type: cronjob
       cronjob:
@@ -197,84 +119,7 @@ rclone:
                   key: DEST_ENDPOINT
             - name: RCLONE_CONFIG_SRC_S3_FORCE_PATH_STYLE
               value: true
-    web-assets:
+
-      type: cronjob
-      cronjob:
-        suspend: false
-        timeZone: America/Chicago
-        schedule: 30 0 * * *
-        backoffLimit: 3
-        parallelism: 1
-      containers:
-        sync:
-          image:
-            repository: rclone/rclone
-            tag: 1.73.5@sha256:1619a625f845e169c34b952cf40c483c0392965b821c5155cde8cbfd35254a96
-          args:
-            - sync
-            - src:web-assets
-            - dest:web-assets
-            - --s3-no-check-bucket
-            - --verbose
-          env:
-            - name: RCLONE_S3_PROVIDER
-              value: Other
-            - name: RCLONE_CONFIG_SRC_TYPE
-              value: s3
-            - name: RCLONE_CONFIG_SRC_PROVIDER
-              value: Other
-            - name: RCLONE_CONFIG_SRC_ENV_AUTH
-              value: false
-            - name: RCLONE_CONFIG_SRC_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: garage-web-assets-secret
-                  key: ACCESS_KEY_ID
-            - name: RCLONE_CONFIG_SRC_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: garage-web-assets-secret
-                  key: ACCESS_SECRET_KEY
-            - name: RCLONE_CONFIG_SRC_REGION
-              valueFrom:
-                secretKeyRef:
-                  name: garage-web-assets-secret
-                  key: ACCESS_REGION
-            - name: RCLONE_CONFIG_SRC_ENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: garage-web-assets-secret
-                  key: SRC_ENDPOINT
-            - name: RCLONE_CONFIG_SRC_S3_FORCE_PATH_STYLE
-              value: true
-            - name: RCLONE_CONFIG_DEST_TYPE
-              value: s3
-            - name: RCLONE_CONFIG_DEST_PROVIDER
-              value: Other
-            - name: RCLONE_CONFIG_DEST_ENV_AUTH
-              value: false
-            - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: garage-web-assets-secret
-                  key: ACCESS_KEY_ID
-            - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: garage-web-assets-secret
-                  key: ACCESS_SECRET_KEY
-            - name: RCLONE_CONFIG_DEST_REGION
-              valueFrom:
-                secretKeyRef:
-                  name: garage-web-assets-secret
-                  key: ACCESS_REGION
-            - name: RCLONE_CONFIG_DEST_ENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: garage-web-assets-secret
-                  key: DEST_ENDPOINT
-            - name: RCLONE_CONFIG_DEST_S3_FORCE_PATH_STYLE
-              value: true
     postgres-backups:
       type: cronjob
       cronjob:
@@ -398,84 +243,6 @@ rclone:
                   key: DEST_ENDPOINT
             - name: RCLONE_CONFIG_SRC_S3_FORCE_PATH_STYLE
               value: true
-    ntfy-attachments:
-      type: cronjob
-      cronjob:
-        suspend: false
-        timeZone: America/Chicago
-        schedule: 50 0 * * *
-        backoffLimit: 3
-        parallelism: 1
-      containers:
-        sync:
-          image:
-            repository: rclone/rclone
-            tag: 1.73.5@sha256:1619a625f845e169c34b952cf40c483c0392965b821c5155cde8cbfd35254a96
-          args:
-            - sync
-            - src:ntfy-attachments
-            - dest:ntfy-attachments
-            - --s3-no-check-bucket
-            - --verbose
-          env:
-            - name: RCLONE_S3_PROVIDER
-              value: Other
-            - name: RCLONE_CONFIG_SRC_TYPE
-              value: s3
-            - name: RCLONE_CONFIG_SRC_PROVIDER
-              value: Other
-            - name: RCLONE_CONFIG_SRC_ENV_AUTH
-              value: false
-            - name: RCLONE_CONFIG_SRC_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: garage-ntfy-attachments-secret
-                  key: ACCESS_KEY_ID
-            - name: RCLONE_CONFIG_SRC_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: garage-ntfy-attachments-secret
-                  key: ACCESS_SECRET_KEY
-            - name: RCLONE_CONFIG_SRC_REGION
-              valueFrom:
-                secretKeyRef:
-                  name: garage-ntfy-attachments-secret
-                  key: ACCESS_REGION
-            - name: RCLONE_CONFIG_SRC_ENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: garage-ntfy-attachments-secret
-                  key: SRC_ENDPOINT
-            - name: RCLONE_CONFIG_SRC_S3_FORCE_PATH_STYLE
-              value: true
-            - name: RCLONE_CONFIG_DEST_TYPE
-              value: s3
-            - name: RCLONE_CONFIG_DEST_PROVIDER
-              value: Other
-            - name: RCLONE_CONFIG_DEST_ENV_AUTH
-              value: false
-            - name: RCLONE_CONFIG_DEST_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: garage-ntfy-attachments-secret
-                  key: ACCESS_KEY_ID
-            - name: RCLONE_CONFIG_DEST_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: garage-ntfy-attachments-secret
-                  key: ACCESS_SECRET_KEY
-            - name: RCLONE_CONFIG_DEST_REGION
-              valueFrom:
-                secretKeyRef:
-                  name: garage-ntfy-attachments-secret
-                  key: ACCESS_REGION
-            - name: RCLONE_CONFIG_DEST_ENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: garage-ntfy-attachments-secret
-                  key: DEST_ENDPOINT
-            - name: RCLONE_CONFIG_SRC_DEST_FORCE_PATH_STYLE
-              value: true
     openbao-backups-remote:
       type: cronjob
       cronjob:
@@ -708,3 +475,24 @@ rclone:
               value: https://nyc3.digitaloceanspaces.com
             - name: RCLONE_CONFIG_DEST_S3_FORCE_PATH_STYLE
               value: true
+rclone-web-assets-remote:
+  cronJob:
+    suspend: false
+    schedule: 30 0 * * *
+  rclone:
+    source:
+      bucketName: web-assets
+    destination:
+      bucketName: web-assets
+  secret:
+    externalSecret:
+      source:
+        credentials:
+          path: /garage/home-infra/web-assets
+        config:
+          path: /garage/config
+      destination:
+        credentials:
+          path: /garage/home-infra/web-assets
+        config:
+          path: /garage/config