Compare commits
1 Commits
renovate/g
...
61fa4077db
| Author | SHA1 | Date | |
|---|---|---|---|
61fa4077db
|
86
.gitea/workflows/lint-test-docker-pull.yaml
Normal file
86
.gitea/workflows/lint-test-docker-pull.yaml
Normal file
@@ -0,0 +1,86 @@
|
||||
name: lint-test-docker
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'hosts/**'
|
||||
|
||||
jobs:
|
||||
docker-lint:
|
||||
runs-on: ubuntu-js
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Check Branch Exists
|
||||
id: check-branch-exists
|
||||
uses: GuillaumeFalourd/branch-exists@v1.1
|
||||
with:
|
||||
branch: "${{ github.base_ref }}"
|
||||
|
||||
- name: Branch Does Not Exist
|
||||
if: steps.check-branch-exists.outputs.exists == 'false'
|
||||
run: echo "Branch ${{ github.base_ref }} was not found, likely already merged"
|
||||
|
||||
- name: Set up Node.js
|
||||
if: steps.check-branch-exists.outputs.exists == 'true'
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version: '24'
|
||||
|
||||
- name: Lint Docker Compose
|
||||
if: steps.check-branch-exists.outputs.exists == 'true'
|
||||
run: |
|
||||
set -e # Exit immediately if a command exits with a non-zero status.
|
||||
|
||||
TARGET_BRANCH="origin/${{ github.base_ref }}"
|
||||
echo ">> Target branch for diff is: $TARGET_BRANCH"
|
||||
|
||||
CHANGED_FILES=$(git diff --name-only "$TARGET_BRANCH" -- 'hosts/**')
|
||||
|
||||
echo ">> Found changed files:"
|
||||
echo "$CHANGED_FILES"
|
||||
|
||||
# For each changed file, find its parent chart directory (the one with compose.yaml).
|
||||
# Then, create a unique list of those directories.
|
||||
CHANGED_COMPOSE=$(echo "$CHANGED_FILES" | while read -r file; do
|
||||
dir=$(dirname "$file")
|
||||
while [[ "$dir" != "." && ! -f "$dir/compose.yaml" ]]; do
|
||||
dir=$(dirname "$dir")
|
||||
done
|
||||
if [[ "$dir" != "." ]]; then
|
||||
echo "$dir"
|
||||
fi
|
||||
done | sort -u)
|
||||
|
||||
if [[ -z "$CHANGED_COMPOSE" ]]; then
|
||||
echo ">> Could not determine changed compose files. This will happen if only files outside a compose file were changed."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo ">> Running dclint on changed compose files:"
|
||||
echo "$CHANGED_COMPOSE"
|
||||
|
||||
echo "$CHANGED_COMPOSE" | while read -r compose; do
|
||||
echo ">> Linting $compose ..."
|
||||
npx dclint $compose
|
||||
done
|
||||
|
||||
- name: ntfy Failed
|
||||
uses: niniyas/ntfy-action@master
|
||||
if: failure()
|
||||
with:
|
||||
url: '${{ secrets.NTFY_URL }}'
|
||||
topic: '${{ secrets.NTFY_TOPIC }}'
|
||||
title: 'Test Failure - Infrastructure'
|
||||
priority: 3
|
||||
headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
|
||||
tags: action,failed
|
||||
details: 'Docker linting on Pull Request for Infrastructure has failed!'
|
||||
icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
|
||||
actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-docker-pull.yaml", "clear": true}]'
|
||||
image: true
|
||||
74
.gitea/workflows/lint-test-docker-push.yaml
Normal file
74
.gitea/workflows/lint-test-docker-push.yaml
Normal file
@@ -0,0 +1,74 @@
|
||||
name: lint-test-docker
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'hosts/**'
|
||||
|
||||
jobs:
|
||||
docker-lint:
|
||||
runs-on: ubuntu-js
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Set up Node.js
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version: '24'
|
||||
|
||||
- name: Lint Docker Compose
|
||||
run: |
|
||||
set -e # Exit immediately if a command exits with a non-zero status.
|
||||
|
||||
TARGET_BRANCH="origin/main"
|
||||
echo ">> Target branch for diff is: $TARGET_BRANCH"
|
||||
|
||||
CHANGED_FILES=$(git diff --name-only "$TARGET_BRANCH" -- 'hosts/**')
|
||||
|
||||
echo ">> Found changed files:"
|
||||
echo "$CHANGED_FILES"
|
||||
|
||||
# For each changed file, find its parent chart directory (the one with compose.yaml).
|
||||
# Then, create a unique list of those directories.
|
||||
CHANGED_COMPOSE=$(echo "$CHANGED_FILES" | while read -r file; do
|
||||
dir=$(dirname "$file")
|
||||
while [[ "$dir" != "." && ! -f "$dir/compose.yaml" ]]; do
|
||||
dir=$(dirname "$dir")
|
||||
done
|
||||
if [[ "$dir" != "." ]]; then
|
||||
echo "$dir"
|
||||
fi
|
||||
done | sort -u)
|
||||
|
||||
if [[ -z "$CHANGED_COMPOSE" ]]; then
|
||||
echo ">> Could not determine changed compose files. This will happen if only files outside a compose file were changed."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo ">> Running dclint on changed compose files:"
|
||||
echo "$CHANGED_COMPOSE"
|
||||
|
||||
echo "$CHANGED_COMPOSE" | while read -r compose; do
|
||||
echo ">> Linting $compose ..."
|
||||
npx dclint $compose
|
||||
done
|
||||
|
||||
- name: ntfy Failed
|
||||
uses: niniyas/ntfy-action@master
|
||||
if: failure()
|
||||
with:
|
||||
url: '${{ secrets.NTFY_URL }}'
|
||||
topic: '${{ secrets.NTFY_TOPIC }}'
|
||||
title: 'Test Failure - Infrastructure'
|
||||
priority: 4
|
||||
headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
|
||||
tags: action,failed
|
||||
details: 'Docker linting on Push for Infrastructure has failed!'
|
||||
icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
|
||||
actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-docker-push.yaml", "clear": true}]'
|
||||
image: true
|
||||
@@ -1,141 +0,0 @@
|
||||
name: lint-test-docker
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'hosts/**'
|
||||
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'hosts/**'
|
||||
|
||||
env:
|
||||
BASE_BRANCH: "origin/${{ gitea.base_ref }}"
|
||||
|
||||
jobs:
|
||||
lint-docker-compose:
|
||||
runs-on: ubuntu-js
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Check Branch Exists
|
||||
id: check-branch-exists
|
||||
if: github.event_name == 'pull_request'
|
||||
uses: GuillaumeFalourd/branch-exists@v1.1
|
||||
with:
|
||||
branch: "${{ github.base_ref }}"
|
||||
|
||||
- name: Report Branch Exists
|
||||
id: branch-exists
|
||||
if: github.event_name == 'push' || steps.check-branch-exists.outputs.exists == 'true' && github.event_name == 'pull_request'
|
||||
run: |
|
||||
if [ ${{ github.event_name == 'push' }} ]; then
|
||||
echo ">> Action is from a push event, will continue with linting"
|
||||
|
||||
else
|
||||
echo ">> Branch ${{ gitea.base_ref }} exists, will continue with linting"
|
||||
|
||||
fi
|
||||
|
||||
echo "----"
|
||||
|
||||
echo "exists=true" >> $GITEA_OUTPUT
|
||||
|
||||
- name: Set up Node.js
|
||||
if: steps.branch-exists.outputs.exists == 'true'
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version: '24'
|
||||
|
||||
- name: Check Directories for Changes
|
||||
id: check-dir-changes
|
||||
if: steps.branch-exists.outputs.exists == 'true'
|
||||
run: |
|
||||
CHANGED_COMPOSE=()
|
||||
|
||||
echo ">> Target branch for diff is: ${BASE_BRANCH}"
|
||||
|
||||
if [ "${{ github.event_name }}" == "pull_request" ]; then
|
||||
echo ""
|
||||
echo ">> Checking for changes in a pull request ..."
|
||||
GIT_DIFF=$(git diff --name-only "${BASE_BRANCH}" | xargs -I {} dirname {} | sort -u)
|
||||
else
|
||||
echo ""
|
||||
echo ">> Checking for changes from a push ..."
|
||||
GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u)
|
||||
fi
|
||||
|
||||
if [ -n "${GIT_DIFF}" ]; then
|
||||
echo ""
|
||||
echo ">> Changes detected:"
|
||||
echo "$GIT_DIFF"
|
||||
|
||||
for path in $GIT_DIFF; do
|
||||
if echo "$path" | grep -q -E "hosts/[^/]+/[^/]+"; then
|
||||
echo ""
|
||||
echo ">> Adding path: $path"
|
||||
CHANGED_COMPOSE+=$(echo "$path")
|
||||
CHANGED_COMPOSE+=$(echo " ")
|
||||
fi
|
||||
done
|
||||
|
||||
else
|
||||
echo ""
|
||||
echo ">> No changes detected"
|
||||
|
||||
fi
|
||||
|
||||
if [ -n "${CHANGED_COMPOSE}" ]; then
|
||||
echo ""
|
||||
echo ">> Compose to Lint:"
|
||||
echo "$(echo "${CHANGED_COMPOSE}" | sort -u)"
|
||||
|
||||
echo "----"
|
||||
|
||||
echo "changes-detected=true" >> $GITEA_OUTPUT
|
||||
echo "compose-dir<<EOF" >> $GITEA_OUTPUT
|
||||
echo "$(echo "${CHANGED_COMPOSE}" | sort -u)" >> $GITEA_OUTPUT
|
||||
echo "EOF" >> $GITEA_OUTPUT
|
||||
else
|
||||
echo ""
|
||||
echo ">> Did not find any docker compose files to lint"
|
||||
|
||||
echo "----"
|
||||
|
||||
echo "changes-detected=false" >> $GITEA_OUTPUT
|
||||
fi
|
||||
|
||||
- name: Lint Docker Compose
|
||||
if: steps.check-dir-changes.outputs.changes-detected == 'true'
|
||||
env:
|
||||
CHANGED_COMPOSE: ${{ steps.check-dir-changes.outputs.compose-dir }}
|
||||
run: |
|
||||
echo ">> Running dclint on changed compose files:"
|
||||
echo "$CHANGED_COMPOSE"
|
||||
|
||||
for compose in $CHANGED_COMPOSE; do
|
||||
echo ">> Linting $compose ..."
|
||||
npx dclint $compose
|
||||
done
|
||||
|
||||
- name: ntfy Failed
|
||||
uses: niniyas/ntfy-action@master
|
||||
if: failure()
|
||||
with:
|
||||
url: '${{ secrets.NTFY_URL }}'
|
||||
topic: '${{ secrets.NTFY_TOPIC }}'
|
||||
title: 'Test Failure - Infrastructure'
|
||||
priority: 3
|
||||
headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
|
||||
tags: action,failed
|
||||
details: 'Docker linting on Pull Request for Infrastructure has failed!'
|
||||
icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
|
||||
actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-docker-pull.yaml", "clear": true}]'
|
||||
image: true
|
||||
94
.gitea/workflows/lint-test-helm-pull.yaml
Normal file
94
.gitea/workflows/lint-test-helm-pull.yaml
Normal file
@@ -0,0 +1,94 @@
|
||||
name: lint-test-helm
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'clusters/**'
|
||||
|
||||
jobs:
|
||||
helm-lint:
|
||||
runs-on: ubuntu-js
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Check Branch Exists
|
||||
id: check-branch-exists
|
||||
uses: GuillaumeFalourd/branch-exists@v1.1
|
||||
with:
|
||||
branch: ${{ github.base_ref }}
|
||||
|
||||
- name: Branch Does Not Exist
|
||||
if: steps.check-branch-exists.outputs.exists == 'false'
|
||||
run: echo "Branch ${{ github.base_ref }} was not found, likely already merged"
|
||||
|
||||
- name: Set up Helm
|
||||
if: steps.check-branch-exists.outputs.exists == 'true'
|
||||
uses: azure/setup-helm@v4
|
||||
with:
|
||||
token: ${{ secrets.GITEA_TOKEN }}
|
||||
version: v3.19.2
|
||||
|
||||
- name: Lint Helm Chart
|
||||
if: steps.check-branch-exists.outputs.exists == 'true'
|
||||
run: |
|
||||
set -e # Exit immediately if a command exits with a non-zero status.
|
||||
|
||||
TARGET_BRANCH="origin/${{ github.base_ref }}"
|
||||
echo ">> Target branch for diff is: $TARGET_BRANCH"
|
||||
|
||||
CHANGED_FILES=$(git diff --name-only "$TARGET_BRANCH" -- 'clusters/**')
|
||||
|
||||
echo ">> Found changed files:"
|
||||
echo "$CHANGED_FILES"
|
||||
|
||||
# For each changed file, find its parent chart directory (the one with Chart.yaml).
|
||||
# Then, create a unique list of those directories.
|
||||
CHANGED_CHARTS=$(echo "$CHANGED_FILES" | while read -r file; do
|
||||
dir=$(dirname "$file")
|
||||
while [[ "$dir" != "." && ! -f "$dir/Chart.yaml" ]]; do
|
||||
dir=$(dirname "$dir")
|
||||
done
|
||||
if [[ "$dir" != "." ]]; then
|
||||
echo "$dir"
|
||||
fi
|
||||
done | sort -u)
|
||||
|
||||
if [[ -z "$CHANGED_CHARTS" ]]; then
|
||||
echo ">> Could not determine changed charts. This could happen if only files outside a chart were changed."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo ">> Running helm lint on changed charts:"
|
||||
echo "$CHANGED_CHARTS"
|
||||
|
||||
echo "$CHANGED_CHARTS" | while read -r chart; do
|
||||
helm dependency list --max-col-width 120 $chart 2> /dev/null \
|
||||
| tail +2 | head -n -1 \
|
||||
| awk '{ print "helm repo add " $1 " " $3 }' \
|
||||
| while read cmd; do echo "$cmd" | sh; done || true
|
||||
|
||||
echo ">> Building dependency for "$chart" ..."
|
||||
helm dependency build "$chart"
|
||||
echo ">> Linting $chart..."
|
||||
helm lint "$chart"
|
||||
done
|
||||
|
||||
- name: ntfy Failed
|
||||
uses: niniyas/ntfy-action@master
|
||||
if: failure()
|
||||
with:
|
||||
url: '${{ secrets.NTFY_URL }}'
|
||||
topic: '${{ secrets.NTFY_TOPIC }}'
|
||||
title: 'Test Failure - Infrastructure'
|
||||
priority: 3
|
||||
headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
|
||||
tags: action,failed
|
||||
details: 'Helm linting on Pull Request for Infrastructure has failed!'
|
||||
icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
|
||||
actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-helm-pull.yaml", "clear": true}]'
|
||||
image: true
|
||||
80
.gitea/workflows/lint-test-helm-push.yaml
Normal file
80
.gitea/workflows/lint-test-helm-push.yaml
Normal file
@@ -0,0 +1,80 @@
|
||||
name: lint-test-helm
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'clusters/**'
|
||||
|
||||
jobs:
|
||||
helm-lint:
|
||||
runs-on: ubuntu-js
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Set up Helm
|
||||
uses: azure/setup-helm@v4
|
||||
with:
|
||||
token: ${{ secrets.GITEA_TOKEN }}
|
||||
version: v3.19.2
|
||||
|
||||
- name: Lint Helm Chart
|
||||
run: |
|
||||
TARGET_BRANCH="origin/main"
|
||||
echo ">> Target branch for diff is: $TARGET_BRANCH"
|
||||
|
||||
CHANGED_FILES=$(git diff --name-only "$TARGET_BRANCH" -- 'clusters/**')
|
||||
|
||||
echo ">> Found changed files:"
|
||||
echo "$CHANGED_FILES"
|
||||
|
||||
# For each changed file, find its parent chart directory (the one with Chart.yaml).
|
||||
# Then, create a unique list of those directories.
|
||||
CHANGED_CHARTS=$(echo "$CHANGED_FILES" | while read -r file; do
|
||||
dir=$(dirname "$file")
|
||||
while [[ "$dir" != "." && ! -f "$dir/Chart.yaml" ]]; do
|
||||
dir=$(dirname "$dir")
|
||||
done
|
||||
if [[ "$dir" != "." ]]; then
|
||||
echo "$dir"
|
||||
fi
|
||||
done | sort -u)
|
||||
|
||||
if [[ -z "$CHANGED_CHARTS" ]]; then
|
||||
echo ">> Could not determine changed charts. This could happen if only files outside a chart were changed."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo ">> Running helm lint on changed charts:"
|
||||
echo "$CHANGED_CHARTS"
|
||||
|
||||
echo "$CHANGED_CHARTS" | while read -r chart; do
|
||||
helm dependency list --max-col-width 120 $chart 2> /dev/null \
|
||||
| tail +2 | head -n -1 \
|
||||
| awk '{ print "helm repo add " $1 " " $3 }' \
|
||||
| while read cmd; do echo "$cmd" | sh; done || true
|
||||
|
||||
echo ">> Building dependency for "$chart" ..."
|
||||
helm dependency build "$chart"
|
||||
echo ">> Linting $chart..."
|
||||
helm lint "$chart"
|
||||
done
|
||||
|
||||
- name: ntfy Failed
|
||||
uses: niniyas/ntfy-action@master
|
||||
if: failure()
|
||||
with:
|
||||
url: '${{ secrets.NTFY_URL }}'
|
||||
topic: '${{ secrets.NTFY_TOPIC }}'
|
||||
title: 'Test Failure - Infrastructure'
|
||||
priority: 4
|
||||
headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
|
||||
tags: action,failed
|
||||
details: 'Helm linting on Push for Infrastructure has failed!'
|
||||
icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
|
||||
actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-helm-push.yaml", "clear": true}]'
|
||||
image: true
|
||||
@@ -1,187 +0,0 @@
|
||||
name: lint-test-helm
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'clusters/cl01tl/helm/**'
|
||||
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'clusters/cl01tl/helm/**'
|
||||
|
||||
env:
|
||||
CLUSTER: cl01tl
|
||||
BASE_BRANCH: "origin/${{ gitea.base_ref }}"
|
||||
|
||||
jobs:
|
||||
lint-helm:
|
||||
runs-on: ubuntu-js
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Check Branch Exists
|
||||
id: check-branch-exists
|
||||
if: github.event_name == 'pull_request'
|
||||
uses: GuillaumeFalourd/branch-exists@v1.1
|
||||
with:
|
||||
branch: ${{ gitea.base_ref }}
|
||||
|
||||
- name: Report Branch Exists
|
||||
id: branch-exists
|
||||
if: github.event_name == 'push' || steps.check-branch-exists.outputs.exists == 'true' && github.event_name == 'pull_request'
|
||||
run: |
|
||||
if [ ${{ github.event_name == 'push' }} ]; then
|
||||
echo ">> Action is from a push event, will continue with linting"
|
||||
|
||||
else
|
||||
echo ">> Branch ${{ gitea.base_ref }} exists, will continue with linting"
|
||||
|
||||
fi
|
||||
|
||||
echo "----"
|
||||
|
||||
echo "exists=true" >> $GITEA_OUTPUT
|
||||
|
||||
- name: Set up Helm
|
||||
if: steps.branch-exists.outputs.exists == 'true'
|
||||
uses: azure/setup-helm@v4
|
||||
with:
|
||||
token: ${{ secrets.GITEA_TOKEN }}
|
||||
version: v3.19.2
|
||||
|
||||
- name: Check Directories for Changes
|
||||
id: check-dir-changes
|
||||
if: steps.branch-exists.outputs.exists == 'true'
|
||||
run: |
|
||||
CHANGED_CHARTS=()
|
||||
|
||||
echo ">> Target branch for diff is: ${BASE_BRANCH}"
|
||||
|
||||
if [ "${{ github.event_name }}" == "pull_request" ]; then
|
||||
echo ""
|
||||
echo ">> Checking for changes in a pull request ..."
|
||||
GIT_DIFF=$(git diff --name-only "${BASE_BRANCH}" | xargs -I {} dirname {} | sort -u)
|
||||
else
|
||||
echo ""
|
||||
echo ">> Checking for changes from a push ..."
|
||||
GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u)
|
||||
fi
|
||||
|
||||
if [ -n "${GIT_DIFF}" ]; then
|
||||
echo ""
|
||||
echo ">> Changes detected:"
|
||||
echo "$GIT_DIFF"
|
||||
|
||||
for path in $GIT_DIFF; do
|
||||
if echo "$path" | grep -q -E "clusters/[^/]+/helm/[^/]+"; then
|
||||
echo ""
|
||||
echo ">> Adding path: $path"
|
||||
CHANGED_CHARTS+=$(echo "$path" | awk -F '/' '{print $4}')
|
||||
CHANGED_CHARTS+=$(echo "\n")
|
||||
fi
|
||||
done
|
||||
|
||||
else
|
||||
echo ""
|
||||
echo ">> No changes detected"
|
||||
|
||||
fi
|
||||
|
||||
if [ -n "${CHANGED_CHARTS}" ]; then
|
||||
echo ""
|
||||
echo ">> Chart to Lint:"
|
||||
echo "$(echo "${CHANGED_CHARTS}" | sort -u)"
|
||||
|
||||
echo "----"
|
||||
|
||||
echo "changes-detected=true" >> $GITEA_OUTPUT
|
||||
echo "chart-dir<<EOF" >> $GITEA_OUTPUT
|
||||
echo "$(echo "${CHANGED_CHARTS}" | sort -u)" >> $GITEA_OUTPUT
|
||||
echo "EOF" >> $GITEA_OUTPUT
|
||||
else
|
||||
echo ""
|
||||
echo ">> Did not find any helm charts files to lint"
|
||||
|
||||
echo "----"
|
||||
|
||||
echo "changes-detected=false" >> $GITEA_OUTPUT
|
||||
fi
|
||||
|
||||
- name: Add Repositories
|
||||
if: steps.check-dir-changes.outputs.changes-detected == 'true'
|
||||
env:
|
||||
CHANGED_CHARTS: ${{ steps.check-dir-changes.outputs.chart-dir }}
|
||||
run: |
|
||||
echo ">> Adding repositories for chart dependencies ..."
|
||||
for dir in ${CHANGED_CHARTS}; do
|
||||
helm dependency list --max-col-width 120 clusters/${CLUSTER}/helm/$dir 2> /dev/null \
|
||||
| tail +2 | head -n -1 \
|
||||
| awk '{ print "helm repo add " $1 " " $3 }' \
|
||||
| while read cmd; do
|
||||
if [[ "$cmd" == "*oci://*" ]]; then
|
||||
echo ">> Ignoring OCI repo"
|
||||
else
|
||||
echo ">> Command: $cmd"
|
||||
echo "$cmd" | sh;
|
||||
fi
|
||||
done || true
|
||||
done
|
||||
|
||||
if helm repo list | tail +2 | read -r; then
|
||||
echo ""
|
||||
echo ">> Update repository cache ..."
|
||||
helm repo update
|
||||
fi
|
||||
|
||||
echo "----"
|
||||
|
||||
- name: Lint Helm Chart
|
||||
if: steps.check-dir-changes.outputs.changes-detected == 'true'
|
||||
env:
|
||||
CHANGED_CHARTS: ${{ steps.check-dir-changes.outputs.chart-dir }}
|
||||
run: |
|
||||
echo ">> Running linting on changed charts ..."
|
||||
|
||||
for dir in ${CHANGED_CHARTS}; do
|
||||
chart_path=clusters/${CLUSTER}/helm/$dir
|
||||
chart_name=$(basename "$chart_path")
|
||||
|
||||
if [ -f "$chart_path/Chart.yaml" ]; then
|
||||
cd $chart_path
|
||||
|
||||
echo ""
|
||||
echo ">> Building helm dependency ..."
|
||||
helm dependency build --skip-refresh
|
||||
|
||||
echo ""
|
||||
echo ">> Linting helm ..."
|
||||
helm lint --namespace "$chart_name"
|
||||
|
||||
else
|
||||
echo ""
|
||||
echo ">> Directory $chart_path does not contain a Chart.yaml. Skipping ..."
|
||||
echo ""
|
||||
fi
|
||||
done
|
||||
|
||||
- name: ntfy Failed
|
||||
uses: niniyas/ntfy-action@master
|
||||
if: failure()
|
||||
with:
|
||||
url: '${{ secrets.NTFY_URL }}'
|
||||
topic: '${{ secrets.NTFY_TOPIC }}'
|
||||
title: 'Test Failure - Infrastructure'
|
||||
priority: 3
|
||||
headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
|
||||
tags: action,failed
|
||||
details: 'Helm linting on Pull Request for Infrastructure has failed!'
|
||||
icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
|
||||
actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-helm-pull.yaml", "clear": true}]'
|
||||
image: true
|
||||
@@ -65,14 +65,13 @@ jobs:
|
||||
RENDER_DIR=()
|
||||
|
||||
echo ">> Checking for changes from HEAD^..HEAD ..."
|
||||
GIT_DIFF=$(git diff --name-only HEAD^..HEAD | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
|
||||
GIT_DIFF=$(git diff --name-only HEAD^..HEAD | xargs -I {} dirname {} | sort -u | grep "clusters/cl01tl/helm/")
|
||||
|
||||
if [ -n "${GIT_DIFF}" ]; then
|
||||
echo ">> Changes detected:"
|
||||
echo "$GIT_DIFF"
|
||||
for path in $GIT_DIFF; do
|
||||
RENDER_DIR+=$(echo "$path" | awk -F '/' '{print $4}')
|
||||
RENDER_DIR+=$(echo " ")
|
||||
done
|
||||
|
||||
else
|
||||
@@ -82,13 +81,13 @@ jobs:
|
||||
|
||||
if [ -n "${RENDER_DIR}" ]; then
|
||||
echo ">> Directories to Render:"
|
||||
echo "$(echo "${RENDER_DIR}" | sort -u)"
|
||||
echo "$(printf "%s\n" "${RENDER_DIR[@]}" | sort -u)"
|
||||
|
||||
echo "----"
|
||||
|
||||
echo "changes-detected=true" >> $GITEA_OUTPUT
|
||||
echo "render-dir<<EOF" >> $GITEA_OUTPUT
|
||||
echo "$(echo "${RENDER_DIR}" | sort -u)" >> $GITEA_OUTPUT
|
||||
echo "$(printf "%s\n" "${RENDER_DIR[@]}" | sort -u)" >> $GITEA_OUTPUT
|
||||
echo "EOF" >> $GITEA_OUTPUT
|
||||
else
|
||||
echo "changes-detected=false" >> $GITEA_OUTPUT
|
||||
@@ -106,13 +105,7 @@ jobs:
|
||||
helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
|
||||
| tail +2 | head -n -1 \
|
||||
| awk '{ print "helm repo add " $1 " " $3 }' \
|
||||
| while read cmd; do
|
||||
if [[ "$cmd" == "*oci://*" ]]; then
|
||||
echo ">> Ignoring OCI repo"
|
||||
else
|
||||
echo "$cmd" | sh;
|
||||
fi
|
||||
done || true
|
||||
| while read cmd; do echo "$cmd" | sh; done || true
|
||||
done
|
||||
|
||||
if helm repo list | tail +2 | read -r; then
|
||||
@@ -154,23 +147,15 @@ jobs:
|
||||
chart_path=${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir
|
||||
chart_name=$(basename "$chart_path")
|
||||
|
||||
echo ""
|
||||
echo ""
|
||||
echo ">> Rendering chart: $chart_name"
|
||||
echo ">> Chart path $chart_path"
|
||||
|
||||
if [ -f "$chart_path/Chart.yaml" ]; then
|
||||
OUTPUT_FOLDER="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/"
|
||||
TEMPLATE=""
|
||||
|
||||
mkdir -p ${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name
|
||||
OUTPUT_FILE="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/$chart_name.yaml"
|
||||
|
||||
cd $chart_path
|
||||
|
||||
echo ""
|
||||
echo ">> Updating helm dependency ..."
|
||||
helm dependency update --skip-refresh
|
||||
|
||||
echo ""
|
||||
echo ">> Building helm dependency ..."
|
||||
helm dependency build --skip-refresh
|
||||
@@ -181,36 +166,36 @@ jobs:
|
||||
|
||||
echo ""
|
||||
echo ">> Rendering templates ..."
|
||||
|
||||
case "$chart_name" in
|
||||
"stack")
|
||||
echo ""
|
||||
echo ">> Special Rendering for stack into argocd namespace ..."
|
||||
TEMPLATE=$(helm template $chart_name ./ --namespace argocd --include-crds --dry-run)
|
||||
echo ">> Special Rendering for stack ..."
|
||||
helm template stack ./ --namespace argocd --include-crds > "$OUTPUT_FILE"
|
||||
;;
|
||||
"cilium" | "coredns" | "metrics-server" |"prometheus-operator-crds")
|
||||
echo ""
|
||||
echo ">> Special Rendering for $chart_name into kube-system namespace ..."
|
||||
TEMPLATE=$(helm template $chart_name ./ --namespace kube-system --include-crds --dry-run)
|
||||
"cilium")
|
||||
echo ">> Special Rendering for cilium ..."
|
||||
helm template cilium ./ --namespace kube-system --include-crds > "$OUTPUT_FILE"
|
||||
;;
|
||||
"coredns")
|
||||
echo ">> Special Rendering for coredns ..."
|
||||
helm template coredns ./ --namespace kube-system --include-crds > "$OUTPUT_FILE"
|
||||
;;
|
||||
"metrics-server")
|
||||
echo ">> Special Rendering for metrics-server ..."
|
||||
helm template metrics-server ./ --namespace kube-system --include-crds > "$OUTPUT_FILE"
|
||||
;;
|
||||
"prometheus-operator-crds")
|
||||
echo ">> Special Rendering for prometheus-operator-crds ..."
|
||||
helm template prometheus-operator-crds ./ --namespace kube-system --include-crds > "$OUTPUT_FILE"
|
||||
;;
|
||||
*)
|
||||
echo ""
|
||||
echo ">> Standard Rendering for $chart_name ..."
|
||||
TEMPLATE=$(helm template "$chart_name" ./ --namespace "$chart_name" --include-crds --dry-run)
|
||||
helm template "$chart_name" ./ --namespace "$chart_name" --include-crds > "$OUTPUT_FILE"
|
||||
;;
|
||||
esac
|
||||
|
||||
echo ""
|
||||
echo ">> Formating rendered template ..."
|
||||
echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
|
||||
|
||||
# Strip comments again to ensure formatting correctness
|
||||
for file in "$OUTPUT_FOLDER"/*; do
|
||||
yq -i '... comments=""' $file
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
|
||||
ls $OUTPUT_FOLDER
|
||||
echo ">> Manifests for $chart_name rendered to $OUTPUT_FILE"
|
||||
echo ""
|
||||
else
|
||||
echo ""
|
||||
@@ -227,16 +212,13 @@ jobs:
|
||||
run: |
|
||||
cd ${MANIFEST_DIR}
|
||||
|
||||
GIT_CHANGES=$(git status --porcelain)
|
||||
|
||||
if [ -n "$GIT_CHANGES" ]; then
|
||||
if git status --porcelain | grep -q .; then
|
||||
echo ">> Changes detected"
|
||||
git status --porcelain
|
||||
echo "changes-detected=true" >> $GITEA_OUTPUT
|
||||
|
||||
else
|
||||
echo ">> No changes detected, skipping PR creation"
|
||||
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "----"
|
||||
@@ -276,9 +258,9 @@ jobs:
|
||||
PAYLOAD=$( jq -n \
|
||||
--arg head "${BRANCH_NAME}" \
|
||||
--arg base "${BASE_BRANCH}" \
|
||||
--arg title "Automated Manifest Update - Automerge" \
|
||||
--arg title "Automated Manifest Update" \
|
||||
--arg body "This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow. This is expected to be automerged." \
|
||||
'{head: $head, base: $base, title: $title, body: $body}' )
|
||||
'{head: $head, base: $base, title: $title, body: $body'} )
|
||||
|
||||
echo ">> Creating PR from branch ${BRANCH_NAME} into ${BASE_BRANCH}"
|
||||
echo ">> With Endpoint of:"
|
||||
@@ -310,15 +292,10 @@ jobs:
|
||||
|
||||
if [ "$HTTP_STATUS" == "201" ]; then
|
||||
echo ">> Pull Request created successfully!"
|
||||
|
||||
PR_URL=$(cat response_body.json | jq -r .html_url)
|
||||
echo ">> Pull Request URL: $PR_URL"
|
||||
echo "pull-request-url=${PR_URL}" >> $GITEA_OUTPUT
|
||||
|
||||
PR_NUMBER=$(cat response_body.json | jq -r .number)
|
||||
echo ">> Pull Request Number: $PR_NUMBER"
|
||||
echo "pull-request-number=${PR_NUMBER}" >> $GITEA_OUTPUT
|
||||
|
||||
PR_ID=$(cat response_body.json | jq -r .id)
|
||||
echo "pull-request-id=${PR_ID}" >> $GITEA_OUTPUT
|
||||
echo "pull-request-operation=created" >> $GITEA_OUTPUT
|
||||
|
||||
elif [ "$HTTP_STATUS" == "422" ]; then
|
||||
@@ -341,17 +318,18 @@ jobs:
|
||||
GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
|
||||
GITEA_URL: ${{ secrets.REPO_URL }}
|
||||
BRANCH_NAME: ${{ steps.prepare-manifest-branch.outputs.BRANCH_NAME }}
|
||||
PR_NUMBER: ${{ steps.create-pull-request.outputs.pull-request-number }}
|
||||
PR_ID: ${{ steps.prepare-manifest-branch.outputs.pull-request-id }}
|
||||
run: |
|
||||
cd ${MANIFEST_DIR}
|
||||
|
||||
API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls/${PR_NUMBER}/merge"
|
||||
API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls/${PR_ID}/merge"
|
||||
|
||||
PAYLOAD=$( jq -n \
|
||||
--arg Do "merge" \
|
||||
'{Do: $Do}' )
|
||||
--arg delete_branch_after_merge "true" \
|
||||
'{Do: $Do, delete_branch_after_merge: $delete_branch_after_merge'} )
|
||||
|
||||
echo ">> Merging PR with ID: ${PR_NUMBER}"
|
||||
echo ">> Merging PR with ID: ${PR_ID}"
|
||||
echo ">> With Endpoint of:"
|
||||
echo "$API_ENDPOINT"
|
||||
echo ">> With Payload of:"
|
||||
@@ -416,6 +394,7 @@ jobs:
|
||||
details: "Automerge Manifest rendering for Infrastructure!"
|
||||
icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
|
||||
actions: '[{"action": "view", "label": "Open Gitea", "url": "${{ steps.create-pull-request.outputs.pull-request-url }}", "clear": true}]'
|
||||
image: true
|
||||
|
||||
- name: ntfy Failed
|
||||
uses: niniyas/ntfy-action@master
|
||||
|
||||
@@ -1,418 +0,0 @@
|
||||
name: render-manifests-merge
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'clusters/cl01tl/helm/**'
|
||||
types:
|
||||
- closed
|
||||
|
||||
env:
|
||||
CLUSTER: cl01tl
|
||||
BASE_BRANCH: manifests
|
||||
BRANCH_NAME: auto/update-manifests
|
||||
ASSIGNEE: alexlebens
|
||||
MAIN_DIR: /workspace/alexlebens/infrastructure/infrastructure
|
||||
MANIFEST_DIR: /workspace/alexlebens/infrastructure/infrastructure-manifests
|
||||
|
||||
jobs:
|
||||
render-manifests-merge:
|
||||
runs-on: ubuntu-js
|
||||
if: ${{ (github.event.pull_request.merged == true) && !(contains(github.event.pull_request.labels.*.name, 'automerge')) }}
|
||||
steps:
|
||||
- name: Checkout Main
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
path: infrastructure
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Checkout Manifests
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
ref: manifests
|
||||
path: infrastructure-manifests
|
||||
|
||||
- name: Set up Helm
|
||||
uses: azure/setup-helm@v4
|
||||
with:
|
||||
token: ${{ secrets.GITEA_TOKEN }}
|
||||
version: v3.17.2 # Pending https://github.com/helm/helm/pull/30743
|
||||
|
||||
- name: Prepare Manifest Branch
|
||||
run: |
|
||||
cd ${MANIFEST_DIR}
|
||||
|
||||
echo ">> Configure git to use gitea-bot as user ..."
|
||||
git config user.name "gitea-bot"
|
||||
git config user.email "gitea-bot@alexlebens.net"
|
||||
|
||||
echo ">> Checking if PR branch exists ..."
|
||||
if [[ $(git ls-remote --heads origin "${BRANCH_NAME}" | wc -l) -gt 0 ]]; then
|
||||
echo ">> Branch '${BRANCH_NAME}' exists, pulling changes ..."
|
||||
git fetch origin "${BRANCH_NAME}"
|
||||
git checkout "${BRANCH_NAME}"
|
||||
git pull --rebase
|
||||
|
||||
else
|
||||
echo ">> Branch '${BRANCH_NAME}' does not exist, creating ..."
|
||||
git checkout -b $BRANCH_NAME
|
||||
fi
|
||||
|
||||
echo "----"
|
||||
|
||||
- name: Check which Directories have Changes
|
||||
id: check-dir-changes
|
||||
run: |
|
||||
cd ${MAIN_DIR}
|
||||
|
||||
RENDER_DIR=()
|
||||
|
||||
echo ">> Checking for changes from HEAD^..HEAD ..."
|
||||
GIT_DIFF=$(git diff --name-only HEAD^..HEAD | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
|
||||
|
||||
if [ -n "${GIT_DIFF}" ]; then
|
||||
echo ">> Changes detected:"
|
||||
echo "$GIT_DIFF"
|
||||
for path in $GIT_DIFF; do
|
||||
RENDER_DIR+=$(echo "$path" | awk -F '/' '{print $4}')
|
||||
RENDER_DIR+=$(echo " ")
|
||||
done
|
||||
|
||||
else
|
||||
echo ">> No changes detected"
|
||||
|
||||
fi
|
||||
|
||||
if [ -n "${RENDER_DIR}" ]; then
|
||||
echo ">> Directories to Render:"
|
||||
echo "$(echo "${RENDER_DIR}" | sort -u)"
|
||||
|
||||
echo "----"
|
||||
|
||||
echo "changes-detected=true" >> $GITEA_OUTPUT
|
||||
echo "render-dir<<EOF" >> $GITEA_OUTPUT
|
||||
echo "$(echo "${RENDER_DIR}" | sort -u)" >> $GITEA_OUTPUT
|
||||
echo "EOF" >> $GITEA_OUTPUT
|
||||
else
|
||||
echo "changes-detected=false" >> $GITEA_OUTPUT
|
||||
fi
|
||||
|
||||
- name: Add Repositories
|
||||
if: steps.check-dir-changes.outputs.changes-detected == 'true'
|
||||
env:
|
||||
RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
|
||||
run: |
|
||||
cd ${MAIN_DIR}
|
||||
|
||||
echo ">> Adding repositories for chart dependencies ..."
|
||||
for dir in ${RENDER_DIR}; do
|
||||
helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
|
||||
| tail +2 | head -n -1 \
|
||||
| awk '{ print "helm repo add " $1 " " $3 }' \
|
||||
| while read cmd; do
|
||||
if [[ "$cmd" == "*oci://*" ]]; then
|
||||
echo ">> Ignoring OCI repo"
|
||||
else
|
||||
echo "$cmd" | sh;
|
||||
fi
|
||||
done || true
|
||||
done
|
||||
|
||||
if helm repo list | tail +2 | read -r; then
|
||||
echo ">> Update repository cache ..."
|
||||
helm repo update
|
||||
fi
|
||||
|
||||
echo "----"
|
||||
|
||||
- name: Remove Changed Manifest Files
|
||||
if: steps.check-dir-changes.outputs.changes-detected == 'true'
|
||||
env:
|
||||
RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
|
||||
run: |
|
||||
cd ${MANIFEST_DIR}
|
||||
|
||||
echo ">> Remove manfiest files and rebuild from source ..."
|
||||
|
||||
for dir in ${RENDER_DIR}; do
|
||||
chart_path=${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$dir
|
||||
|
||||
echo "$chart_path"
|
||||
rm -rf $chart_path/*
|
||||
done
|
||||
|
||||
echo "----"
|
||||
|
||||
- name: Render Helm Manifests
|
||||
id: render-manifests
|
||||
if: steps.check-dir-changes.outputs.changes-detected == 'true'
|
||||
env:
|
||||
RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
|
||||
run: |
|
||||
cd ${MAIN_DIR}
|
||||
|
||||
echo ">> Rendering Manifests ..."
|
||||
|
||||
for dir in ${RENDER_DIR}; do
|
||||
chart_path=${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir
|
||||
chart_name=$(basename "$chart_path")
|
||||
|
||||
echo ""
|
||||
echo ""
|
||||
echo ">> Rendering chart: $chart_name"
|
||||
echo ">> Chart path $chart_path"
|
||||
|
||||
if [ -f "$chart_path/Chart.yaml" ]; then
|
||||
OUTPUT_FOLDER="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/"
|
||||
TEMPLATE=""
|
||||
|
||||
mkdir -p ${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name
|
||||
|
||||
cd $chart_path
|
||||
|
||||
echo ""
|
||||
echo ">> Updating helm dependency ..."
|
||||
helm dependency update --skip-refresh
|
||||
|
||||
echo ""
|
||||
echo ">> Building helm dependency ..."
|
||||
helm dependency build --skip-refresh
|
||||
|
||||
echo ""
|
||||
echo ">> Linting helm ..."
|
||||
helm lint --namespace "$chart_name"
|
||||
|
||||
echo ""
|
||||
echo ">> Rendering templates ..."
|
||||
case "$chart_name" in
|
||||
"stack")
|
||||
echo ""
|
||||
echo ">> Special Rendering for stack into argocd namespace ..."
|
||||
TEMPLATE=$(helm template $chart_name ./ --namespace argocd --include-crds --dry-run)
|
||||
;;
|
||||
"cilium" | "coredns" | "metrics-server" |"prometheus-operator-crds")
|
||||
echo ""
|
||||
echo ">> Special Rendering for $chart_name into kube-system namespace ..."
|
||||
TEMPLATE=$(helm template $chart_name ./ --namespace kube-system --include-crds --dry-run)
|
||||
;;
|
||||
*)
|
||||
echo ""
|
||||
echo ">> Standard Rendering for $chart_name ..."
|
||||
TEMPLATE=$(helm template "$chart_name" ./ --namespace "$chart_name" --include-crds --dry-run)
|
||||
;;
|
||||
esac
|
||||
|
||||
echo ""
|
||||
echo ">> Formating rendered template ..."
|
||||
echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
|
||||
|
||||
# Strip comments again to ensure formatting correctness
|
||||
for file in "$OUTPUT_FOLDER"/*; do
|
||||
yq -i '... comments=""' $file
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
|
||||
ls $OUTPUT_FOLDER
|
||||
echo ""
|
||||
else
|
||||
echo ""
|
||||
echo ">> Directory $chart_path does not contain a Chart.yaml. Skipping ..."
|
||||
echo ""
|
||||
fi
|
||||
done
|
||||
|
||||
echo "----"
|
||||
|
||||
- name: Check for Changes
|
||||
id: check-changes
|
||||
if: steps.check-dir-changes.outputs.changes-detected == 'true'
|
||||
run: |
|
||||
cd ${MANIFEST_DIR}
|
||||
|
||||
GIT_CHANGES=$(git status --porcelain)
|
||||
|
||||
if [ -n "$GIT_CHANGES" ]; then
|
||||
echo ">> Changes detected"
|
||||
git status --porcelain
|
||||
echo "changes-detected=true" >> $GITEA_OUTPUT
|
||||
|
||||
else
|
||||
echo ">> No changes detected, skipping PR creation"
|
||||
|
||||
fi
|
||||
|
||||
echo "----"
|
||||
|
||||
- name: Commit and Push Changes
|
||||
id: commit-push
|
||||
if: steps.check-changes.outputs.changes-detected == 'true'
|
||||
run: |
|
||||
cd ${MANIFEST_DIR}
|
||||
|
||||
echo ">> Commiting changes to ${BRANCH_NAME} ..."
|
||||
git add .
|
||||
git commit -m "chore: Update manifests after change"
|
||||
|
||||
REPO_URL="${{ secrets.REPO_URL }}/${{ gitea.repository }}"
|
||||
echo ">> Pushing changes to $REPO_URL ..."
|
||||
git push -u "https://oauth2:${{ secrets.BOT_TOKEN }}@$(echo $REPO_URL | sed -e 's|https://||')" ${BRANCH_NAME}
|
||||
|
||||
echo "----"
|
||||
|
||||
echo "HEAD_BRANCH=${BRANCH_NAME}" >> $GITEA_OUTPUT
|
||||
echo "push=true" >> $GITEA_OUTPUT
|
||||
|
||||
- name: Check for Pull Request
|
||||
id: check-for-pull-requst
|
||||
if: steps.commit-push.outputs.push == 'true'
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
|
||||
GITEA_URL: ${{ secrets.REPO_URL }}
|
||||
HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
|
||||
run: |
|
||||
cd ${MANIFEST_DIR}
|
||||
|
||||
API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls?base_branch=${BASE_BRANCH}&state=open&page=1"
|
||||
|
||||
echo ">> Checking if PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
|
||||
echo ">> With Endpoint of:"
|
||||
echo "$API_ENDPOINT"
|
||||
|
||||
HTTP_STATUS=$(
|
||||
curl -X GET \
|
||||
--silent \
|
||||
--write-out '%{http_code}' \
|
||||
--output response_body.json \
|
||||
--dump-header response_headers.txt \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
"$API_ENDPOINT" 2> response_errors.txt
|
||||
)
|
||||
|
||||
echo ">> HTTP Status Code: $HTTP_STATUS"
|
||||
echo ">> Response Output ..."
|
||||
echo "----"
|
||||
cat response_body.json
|
||||
echo "----"
|
||||
cat response_headers.txt
|
||||
echo "----"
|
||||
cat response_errors.txt
|
||||
echo "----"
|
||||
|
||||
if [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "open" ]; then
|
||||
echo ">> Pull Request has been found open, will update"
|
||||
PR_INDEX=$(cat response_body.json | jq -r .[0].number)
|
||||
echo "pull-request-exists=${PR_INDEX}" >> $GITEA_OUTPUT
|
||||
echo "pull-request-index=true" >> $GITEA_OUTPUT
|
||||
|
||||
elif [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "closed" ]; then
|
||||
echo ">> Pull Request found, but was closed"
|
||||
echo "pull-request-exists=false" >> $GITEA_OUTPUT
|
||||
|
||||
else
|
||||
echo ">> Pull Request not found"
|
||||
echo "pull-request-exists=false" >> $GITEA_OUTPUT
|
||||
fi
|
||||
|
||||
echo "----"
|
||||
|
||||
- name: Create Pull Request
|
||||
id: create-pull-request
|
||||
if: steps.commit-push.outputs.push == 'true' && steps.check-for-pull-requst.outputs.pull-request-exists == 'false'
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
|
||||
GITEA_URL: ${{ secrets.REPO_URL }}
|
||||
HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
|
||||
run: |
|
||||
cd ${MANIFEST_DIR}
|
||||
|
||||
API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls"
|
||||
|
||||
PAYLOAD=$( jq -n \
|
||||
--arg head "${HEAD_BRANCH}" \
|
||||
--arg base "${BASE_BRANCH}" \
|
||||
--arg assignee "${ASSIGNEE}" \
|
||||
--arg title "Automated Manifest Update" \
|
||||
--arg body "This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow." \
|
||||
'{head: $head, base: $base, assignee: $assignee, title: $title, body: $body}' )
|
||||
|
||||
echo ">> Creating PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
|
||||
echo ">> With Endpoint of:"
|
||||
echo "$API_ENDPOINT"
|
||||
echo ">> With Payload of:"
|
||||
echo "$PAYLOAD"
|
||||
|
||||
HTTP_STATUS=$(
|
||||
curl -X POST \
|
||||
--silent \
|
||||
--write-out '%{http_code}' \
|
||||
--output response_body.json \
|
||||
--dump-header response_headers.txt \
|
||||
--data "$PAYLOAD" \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
"$API_ENDPOINT" 2> response_errors.txt
|
||||
)
|
||||
|
||||
echo ">> HTTP Status Code: $HTTP_STATUS"
|
||||
echo ">> Response Output ..."
|
||||
echo "----"
|
||||
cat response_body.json
|
||||
echo "----"
|
||||
cat response_headers.txt
|
||||
echo "----"
|
||||
cat response_errors.txt
|
||||
echo "----"
|
||||
|
||||
if [ "$HTTP_STATUS" == "201" ]; then
|
||||
echo ">> Pull Request created successfully!"
|
||||
PR_URL=$(cat response_body.json | jq -r .html_url)
|
||||
echo "pull-request-url=${PR_URL}" >> $GITEA_OUTPUT
|
||||
PR_ID=$(cat response_body.json | jq -r .id)
|
||||
echo "pull-request-id=${PR_ID}" >> $GITEA_OUTPUT
|
||||
echo "pull-request-operation=created" >> $GITEA_OUTPUT
|
||||
|
||||
elif [ "$HTTP_STATUS" == "422" ]; then
|
||||
echo ">> Failed to create PR (HTTP 422: Unprocessable Entity), PR may already exist"
|
||||
|
||||
elif [ "$HTTP_STATUS" == "409" ]; then
|
||||
echo ">> Failed to create PR (HTTP 409: Conflict), PR already exists"
|
||||
|
||||
else
|
||||
echo ">> Failed to create PR, HTTP status code: $HTTP_STATUS"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "----"
|
||||
|
||||
- name: ntfy Created
|
||||
uses: niniyas/ntfy-action@master
|
||||
if: steps.create-pull-request.outputs.pull-request-operation == 'created'
|
||||
with:
|
||||
url: "${{ secrets.NTFY_URL }}"
|
||||
topic: "${{ secrets.NTFY_TOPIC }}"
|
||||
title: "Manifest Render PR Created - Infrastructure"
|
||||
priority: 3
|
||||
headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
|
||||
tags: action,successfully,completed
|
||||
details: "Manifest rendering for Infrastructure has created a new Pull Request with ID: ${{ steps.create-pull-request.outputs.pull-request-id }}!"
|
||||
icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
|
||||
actions: '[{"action": "view", "label": "Open Gitea", "url": "${{ steps.create-pull-request.outputs.pull-request-url }}", "clear": true}]'
|
||||
|
||||
- name: ntfy Failed
|
||||
uses: niniyas/ntfy-action@master
|
||||
if: failure()
|
||||
with:
|
||||
url: "${{ secrets.NTFY_URL }}"
|
||||
topic: "${{ secrets.NTFY_TOPIC }}"
|
||||
title: "Manifest Render Failure - Infrastructure"
|
||||
priority: 4
|
||||
headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
|
||||
tags: action,failed
|
||||
details: "Manifest rendering for Infrastructure has failed!"
|
||||
icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
|
||||
actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=render-manifests.yaml", "clear": true}]'
|
||||
image: true
|
||||
@@ -1,416 +0,0 @@
|
||||
name: render-manifests-push
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'clusters/cl01tl/helm/**'
|
||||
|
||||
env:
|
||||
CLUSTER: cl01tl
|
||||
BASE_BRANCH: manifests
|
||||
BRANCH_NAME: auto/update-manifests
|
||||
ASSIGNEE: alexlebens
|
||||
MAIN_DIR: /workspace/alexlebens/infrastructure/infrastructure
|
||||
MANIFEST_DIR: /workspace/alexlebens/infrastructure/infrastructure-manifests
|
||||
|
||||
jobs:
|
||||
render-manifests-push:
|
||||
runs-on: ubuntu-js
|
||||
if: gitea.event.commits[0].author.username != 'renovate-bot'
|
||||
steps:
|
||||
- name: Checkout Main
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
path: infrastructure
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Checkout Manifests
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
ref: manifests
|
||||
path: infrastructure-manifests
|
||||
|
||||
- name: Set up Helm
|
||||
uses: azure/setup-helm@v4
|
||||
with:
|
||||
token: ${{ secrets.GITEA_TOKEN }}
|
||||
version: v3.17.2 # Pending https://github.com/helm/helm/pull/30743
|
||||
|
||||
- name: Prepare Manifest Branch
|
||||
run: |
|
||||
cd ${MANIFEST_DIR}
|
||||
|
||||
echo ">> Configure git to use gitea-bot as user ..."
|
||||
git config user.name "gitea-bot"
|
||||
git config user.email "gitea-bot@alexlebens.net"
|
||||
|
||||
echo ">> Checking if PR branch exists ..."
|
||||
if [[ $(git ls-remote --heads origin "${BRANCH_NAME}" | wc -l) -gt 0 ]]; then
|
||||
echo ">> Branch '${BRANCH_NAME}' exists, pulling changes ..."
|
||||
git fetch origin "${BRANCH_NAME}"
|
||||
git checkout "${BRANCH_NAME}"
|
||||
git pull --rebase
|
||||
|
||||
else
|
||||
echo ">> Branch '${BRANCH_NAME}' does not exist, creating ..."
|
||||
git checkout -b $BRANCH_NAME
|
||||
fi
|
||||
|
||||
echo "----"
|
||||
|
||||
- name: Check which Directories have Changes
|
||||
id: check-dir-changes
|
||||
run: |
|
||||
cd ${MAIN_DIR}
|
||||
|
||||
RENDER_DIR=()
|
||||
|
||||
echo ">> Checking for changes ..."
|
||||
GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
|
||||
|
||||
if [ -n "${GIT_DIFF}" ]; then
|
||||
echo ">> Changes detected:"
|
||||
echo "$GIT_DIFF"
|
||||
for path in $GIT_DIFF; do
|
||||
RENDER_DIR+=$(echo "$path" | awk -F '/' '{print $4}')
|
||||
RENDER_DIR+=$(echo " ")
|
||||
done
|
||||
|
||||
else
|
||||
echo ">> No changes detected"
|
||||
|
||||
fi
|
||||
|
||||
if [ -n "${RENDER_DIR}" ]; then
|
||||
echo ">> Directories to Render:"
|
||||
echo "$(echo "${RENDER_DIR}" | sort -u)"
|
||||
|
||||
echo "----"
|
||||
|
||||
echo "changes-detected=true" >> $GITEA_OUTPUT
|
||||
echo "render-dir<<EOF" >> $GITEA_OUTPUT
|
||||
echo "$(echo "${RENDER_DIR}" | sort -u)" >> $GITEA_OUTPUT
|
||||
echo "EOF" >> $GITEA_OUTPUT
|
||||
else
|
||||
echo "changes-detected=false" >> $GITEA_OUTPUT
|
||||
fi
|
||||
|
||||
- name: Add Repositories
|
||||
if: steps.check-dir-changes.outputs.changes-detected == 'true'
|
||||
env:
|
||||
RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
|
||||
run: |
|
||||
cd ${MAIN_DIR}
|
||||
|
||||
echo ">> Adding repositories for chart dependencies ..."
|
||||
for dir in ${RENDER_DIR}; do
|
||||
helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
|
||||
| tail +2 | head -n -1 \
|
||||
| awk '{ print "helm repo add " $1 " " $3 }' \
|
||||
| while read cmd; do
|
||||
if [[ "$cmd" == "*oci://*" ]]; then
|
||||
echo ">> Ignoring OCI repo"
|
||||
else
|
||||
echo "$cmd" | sh;
|
||||
fi
|
||||
done || true
|
||||
done
|
||||
|
||||
if helm repo list | tail +2 | read -r; then
|
||||
echo ">> Update repository cache ..."
|
||||
helm repo update
|
||||
fi
|
||||
|
||||
echo "----"
|
||||
|
||||
- name: Remove Changed Manifest Files
|
||||
if: steps.check-dir-changes.outputs.changes-detected == 'true'
|
||||
env:
|
||||
RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
|
||||
run: |
|
||||
cd ${MANIFEST_DIR}
|
||||
|
||||
echo ">> Remove manfiest files and rebuild from source ..."
|
||||
|
||||
for dir in ${RENDER_DIR}; do
|
||||
chart_path=${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$dir
|
||||
|
||||
echo "$chart_path"
|
||||
rm -rf $chart_path/*
|
||||
done
|
||||
|
||||
echo "----"
|
||||
|
||||
- name: Render Helm Manifests
|
||||
id: render-manifests
|
||||
if: steps.check-dir-changes.outputs.changes-detected == 'true'
|
||||
env:
|
||||
RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
|
||||
run: |
|
||||
cd ${MAIN_DIR}
|
||||
|
||||
echo ">> Rendering Manifests ..."
|
||||
|
||||
for dir in ${RENDER_DIR}; do
|
||||
chart_path=${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir
|
||||
chart_name=$(basename "$chart_path")
|
||||
|
||||
echo ""
|
||||
echo ""
|
||||
echo ">> Rendering chart: $chart_name"
|
||||
echo ">> Chart path $chart_path"
|
||||
|
||||
if [ -f "$chart_path/Chart.yaml" ]; then
|
||||
OUTPUT_FOLDER="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/"
|
||||
TEMPLATE=""
|
||||
|
||||
mkdir -p ${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name
|
||||
|
||||
cd $chart_path
|
||||
|
||||
echo ""
|
||||
echo ">> Updating helm dependency ..."
|
||||
helm dependency update --skip-refresh
|
||||
|
||||
echo ""
|
||||
echo ">> Building helm dependency ..."
|
||||
helm dependency build --skip-refresh
|
||||
|
||||
echo ""
|
||||
echo ">> Linting helm ..."
|
||||
helm lint --namespace "$chart_name"
|
||||
|
||||
echo ""
|
||||
echo ">> Rendering templates ..."
|
||||
case "$chart_name" in
|
||||
"stack")
|
||||
echo ""
|
||||
echo ">> Special Rendering for stack into argocd namespace ..."
|
||||
TEMPLATE=$(helm template $chart_name ./ --namespace argocd --include-crds --dry-run)
|
||||
;;
|
||||
"cilium" | "coredns" | "metrics-server" |"prometheus-operator-crds")
|
||||
echo ""
|
||||
echo ">> Special Rendering for $chart_name into kube-system namespace ..."
|
||||
TEMPLATE=$(helm template $chart_name ./ --namespace kube-system --include-crds --dry-run)
|
||||
;;
|
||||
*)
|
||||
echo ""
|
||||
echo ">> Standard Rendering for $chart_name ..."
|
||||
TEMPLATE=$(helm template "$chart_name" ./ --namespace "$chart_name" --include-crds --dry-run)
|
||||
;;
|
||||
esac
|
||||
|
||||
echo ""
|
||||
echo ">> Formating rendered template ..."
|
||||
echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
|
||||
|
||||
# Strip comments again to ensure formatting correctness
|
||||
for file in "$OUTPUT_FOLDER"/*; do
|
||||
yq -i '... comments=""' $file
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
|
||||
ls $OUTPUT_FOLDER
|
||||
echo ""
|
||||
else
|
||||
echo ""
|
||||
echo ">> Directory $chart_path does not contain a Chart.yaml. Skipping ..."
|
||||
echo ""
|
||||
fi
|
||||
done
|
||||
|
||||
echo "----"
|
||||
|
||||
- name: Check for Changes
|
||||
id: check-changes
|
||||
if: steps.check-dir-changes.outputs.changes-detected == 'true'
|
||||
run: |
|
||||
cd ${MANIFEST_DIR}
|
||||
|
||||
GIT_CHANGES=$(git status --porcelain)
|
||||
|
||||
if [ -n "$GIT_CHANGES" ]; then
|
||||
echo ">> Changes detected"
|
||||
git status --porcelain
|
||||
echo "changes-detected=true" >> $GITEA_OUTPUT
|
||||
|
||||
else
|
||||
echo ">> No changes detected, skipping PR creation"
|
||||
|
||||
fi
|
||||
|
||||
echo "----"
|
||||
|
||||
- name: Commit and Push Changes
|
||||
id: commit-push
|
||||
if: steps.check-changes.outputs.changes-detected == 'true'
|
||||
run: |
|
||||
cd ${MANIFEST_DIR}
|
||||
|
||||
echo ">> Commiting changes to ${BRANCH_NAME} ..."
|
||||
git add .
|
||||
git commit -m "chore: Update manifests after change"
|
||||
|
||||
REPO_URL="${{ secrets.REPO_URL }}/${{ gitea.repository }}"
|
||||
echo ">> Pushing changes to $REPO_URL ..."
|
||||
git push -u "https://oauth2:${{ secrets.BOT_TOKEN }}@$(echo $REPO_URL | sed -e 's|https://||')" ${BRANCH_NAME}
|
||||
|
||||
echo "----"
|
||||
|
||||
echo "HEAD_BRANCH=${BRANCH_NAME}" >> $GITEA_OUTPUT
|
||||
echo "push=true" >> $GITEA_OUTPUT
|
||||
|
||||
- name: Check for Pull Request
|
||||
id: check-for-pull-requst
|
||||
if: steps.commit-push.outputs.push == 'true'
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
|
||||
GITEA_URL: ${{ secrets.REPO_URL }}
|
||||
HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
|
||||
run: |
|
||||
cd ${MANIFEST_DIR}
|
||||
|
||||
API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls?base_branch=${BASE_BRANCH}&state=open&page=1"
|
||||
|
||||
echo ">> Checking if PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
|
||||
echo ">> With Endpoint of:"
|
||||
echo "$API_ENDPOINT"
|
||||
|
||||
HTTP_STATUS=$(
|
||||
curl -X GET \
|
||||
--silent \
|
||||
--write-out '%{http_code}' \
|
||||
--output response_body.json \
|
||||
--dump-header response_headers.txt \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
"$API_ENDPOINT" 2> response_errors.txt
|
||||
)
|
||||
|
||||
echo ">> HTTP Status Code: $HTTP_STATUS"
|
||||
echo ">> Response Output ..."
|
||||
echo "----"
|
||||
cat response_body.json
|
||||
echo "----"
|
||||
cat response_headers.txt
|
||||
echo "----"
|
||||
cat response_errors.txt
|
||||
echo "----"
|
||||
|
||||
if [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "open" ]; then
|
||||
echo ">> Pull Request has been found open, will update"
|
||||
PR_INDEX=$(cat response_body.json | jq -r .[0].number)
|
||||
echo "pull-request-exists=${PR_INDEX}" >> $GITEA_OUTPUT
|
||||
echo "pull-request-index=true" >> $GITEA_OUTPUT
|
||||
|
||||
elif [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "closed" ]; then
|
||||
echo ">> Pull Request found, but was closed"
|
||||
echo "pull-request-exists=false" >> $GITEA_OUTPUT
|
||||
|
||||
else
|
||||
echo ">> Pull Request not found"
|
||||
echo "pull-request-exists=false" >> $GITEA_OUTPUT
|
||||
fi
|
||||
|
||||
echo "----"
|
||||
|
||||
- name: Create Pull Request
|
||||
id: create-pull-request
|
||||
if: steps.commit-push.outputs.push == 'true' && steps.check-for-pull-requst.outputs.pull-request-exists == 'false'
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
|
||||
GITEA_URL: ${{ secrets.REPO_URL }}
|
||||
HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
|
||||
run: |
|
||||
cd ${MANIFEST_DIR}
|
||||
|
||||
API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls"
|
||||
|
||||
PAYLOAD=$( jq -n \
|
||||
--arg head "${HEAD_BRANCH}" \
|
||||
--arg base "${BASE_BRANCH}" \
|
||||
--arg assignee "${ASSIGNEE}" \
|
||||
--arg title "Automated Manifest Update" \
|
||||
--arg body "This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow." \
|
||||
'{head: $head, base: $base, assignee: $assignee, title: $title, body: $body}' )
|
||||
|
||||
echo ">> Creating PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
|
||||
echo ">> With Endpoint of:"
|
||||
echo "$API_ENDPOINT"
|
||||
echo ">> With Payload of:"
|
||||
echo "$PAYLOAD"
|
||||
|
||||
HTTP_STATUS=$(
|
||||
curl -X POST \
|
||||
--silent \
|
||||
--write-out '%{http_code}' \
|
||||
--output response_body.json \
|
||||
--dump-header response_headers.txt \
|
||||
--data "$PAYLOAD" \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
"$API_ENDPOINT" 2> response_errors.txt
|
||||
)
|
||||
|
||||
echo ">> HTTP Status Code: $HTTP_STATUS"
|
||||
echo ">> Response Output ..."
|
||||
echo "----"
|
||||
cat response_body.json
|
||||
echo "----"
|
||||
cat response_headers.txt
|
||||
echo "----"
|
||||
cat response_errors.txt
|
||||
echo "----"
|
||||
|
||||
if [ "$HTTP_STATUS" == "201" ]; then
|
||||
echo ">> Pull Request created successfully!"
|
||||
PR_URL=$(cat response_body.json | jq -r .html_url)
|
||||
echo "pull-request-url=${PR_URL}" >> $GITEA_OUTPUT
|
||||
PR_ID=$(cat response_body.json | jq -r .id)
|
||||
echo "pull-request-id=${PR_ID}" >> $GITEA_OUTPUT
|
||||
echo "pull-request-operation=created" >> $GITEA_OUTPUT
|
||||
|
||||
elif [ "$HTTP_STATUS" == "422" ]; then
|
||||
echo ">> Failed to create PR (HTTP 422: Unprocessable Entity), PR may already exist"
|
||||
|
||||
elif [ "$HTTP_STATUS" == "409" ]; then
|
||||
echo ">> Failed to create PR (HTTP 409: Conflict), PR already exists"
|
||||
|
||||
else
|
||||
echo ">> Failed to create PR, HTTP status code: $HTTP_STATUS"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "----"
|
||||
|
||||
- name: ntfy Created
|
||||
uses: niniyas/ntfy-action@master
|
||||
if: steps.create-pull-request.outputs.pull-request-operation == 'created'
|
||||
with:
|
||||
url: "${{ secrets.NTFY_URL }}"
|
||||
topic: "${{ secrets.NTFY_TOPIC }}"
|
||||
title: "Manifest Render PR Created - Infrastructure"
|
||||
priority: 3
|
||||
headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
|
||||
tags: action,successfully,completed
|
||||
details: "Manifest rendering for Infrastructure has created a new Pull Request with ID: ${{ steps.create-pull-request.outputs.pull-request-id }}!"
|
||||
icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
|
||||
actions: '[{"action": "view", "label": "Open Gitea", "url": "${{ steps.create-pull-request.outputs.pull-request-url }}", "clear": true}]'
|
||||
|
||||
- name: ntfy Failed
|
||||
uses: niniyas/ntfy-action@master
|
||||
if: failure()
|
||||
with:
|
||||
url: "${{ secrets.NTFY_URL }}"
|
||||
topic: "${{ secrets.NTFY_TOPIC }}"
|
||||
title: "Manifest Render Failure - Infrastructure"
|
||||
priority: 4
|
||||
headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
|
||||
tags: action,failed
|
||||
details: "Manifest rendering for Infrastructure has failed!"
|
||||
icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
|
||||
actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=render-manifests.yaml", "clear": true}]'
|
||||
image: true
|
||||
@@ -1,6 +1,12 @@
|
||||
name: render-manifests-dispatch
|
||||
name: render-manifests
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- 'clusters/cl01tl/helm/**'
|
||||
|
||||
workflow_dispatch:
|
||||
|
||||
env:
|
||||
@@ -12,7 +18,7 @@ env:
|
||||
MANIFEST_DIR: /workspace/alexlebens/infrastructure/infrastructure-manifests
|
||||
|
||||
jobs:
|
||||
render-manifests-dispatch:
|
||||
render-manifests:
|
||||
runs-on: ubuntu-js
|
||||
steps:
|
||||
- name: Checkout Main
|
||||
@@ -62,18 +68,36 @@ jobs:
|
||||
|
||||
RENDER_DIR=()
|
||||
|
||||
echo ">> Triggered on dispatch, will check all paths ..."
|
||||
RENDER_DIR+=$(ls clusters/cl01tl/helm/)
|
||||
if [ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]; then
|
||||
echo ">> Triggered on dispatch, will check all paths ..."
|
||||
RENDER_DIR+=$(ls clusters/cl01tl/helm/)
|
||||
|
||||
else
|
||||
echo ">> Checking for changes ..."
|
||||
GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u | grep "clusters/cl01tl/helm/")
|
||||
|
||||
if [ -n "${GIT_DIFF}" ]; then
|
||||
echo ">> Changes detected:"
|
||||
echo "$GIT_DIFF"
|
||||
for path in $GIT_DIFF; do
|
||||
RENDER_DIR+=$(echo "$path" | awk -F '/' '{print $4}')
|
||||
done
|
||||
|
||||
else
|
||||
echo ">> No changes detected"
|
||||
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -n "${RENDER_DIR}" ]; then
|
||||
echo ">> Directories to Render:"
|
||||
echo "$(echo "${RENDER_DIR}" | sort -u)"
|
||||
echo "$(printf "%s\n" "${RENDER_DIR[@]}" | sort -u)"
|
||||
|
||||
echo "----"
|
||||
|
||||
echo "changes-detected=true" >> $GITEA_OUTPUT
|
||||
echo "render-dir<<EOF" >> $GITEA_OUTPUT
|
||||
echo "$(echo "${RENDER_DIR}" | sort -u)" >> $GITEA_OUTPUT
|
||||
echo "$(printf "%s\n" "${RENDER_DIR[@]}" | sort -u)" >> $GITEA_OUTPUT
|
||||
echo "EOF" >> $GITEA_OUTPUT
|
||||
else
|
||||
echo "changes-detected=false" >> $GITEA_OUTPUT
|
||||
@@ -91,13 +115,7 @@ jobs:
|
||||
helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
|
||||
| tail +2 | head -n -1 \
|
||||
| awk '{ print "helm repo add " $1 " " $3 }' \
|
||||
| while read cmd; do
|
||||
if [[ "$cmd" == "*oci://*" ]]; then
|
||||
echo ">> Ignoring OCI repo"
|
||||
else
|
||||
echo "$cmd" | sh;
|
||||
fi
|
||||
done || true
|
||||
| while read cmd; do echo "$cmd" | sh; done || true
|
||||
done
|
||||
|
||||
if helm repo list | tail +2 | read -r; then
|
||||
@@ -139,23 +157,15 @@ jobs:
|
||||
chart_path=${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir
|
||||
chart_name=$(basename "$chart_path")
|
||||
|
||||
echo ""
|
||||
echo ""
|
||||
echo ">> Rendering chart: $chart_name"
|
||||
echo ">> Chart path $chart_path"
|
||||
|
||||
if [ -f "$chart_path/Chart.yaml" ]; then
|
||||
OUTPUT_FOLDER="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/"
|
||||
TEMPLATE=""
|
||||
|
||||
mkdir -p ${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name
|
||||
OUTPUT_FILE="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/$chart_name.yaml"
|
||||
|
||||
cd $chart_path
|
||||
|
||||
echo ""
|
||||
echo ">> Updating helm dependency ..."
|
||||
helm dependency update --skip-refresh
|
||||
|
||||
echo ""
|
||||
echo ">> Building helm dependency ..."
|
||||
helm dependency build --skip-refresh
|
||||
@@ -166,36 +176,36 @@ jobs:
|
||||
|
||||
echo ""
|
||||
echo ">> Rendering templates ..."
|
||||
|
||||
case "$chart_name" in
|
||||
"stack")
|
||||
echo ""
|
||||
echo ">> Special Rendering for stack into argocd namespace ..."
|
||||
TEMPLATE=$(helm template $chart_name ./ --namespace argocd --include-crds --dry-run)
|
||||
echo ">> Special Rendering for stack ..."
|
||||
helm template stack ./ --namespace argocd --include-crds > "$OUTPUT_FILE"
|
||||
;;
|
||||
"cilium" | "coredns" | "metrics-server" |"prometheus-operator-crds")
|
||||
echo ""
|
||||
echo ">> Special Rendering for $chart_name into kube-system namespace ..."
|
||||
TEMPLATE=$(helm template $chart_name ./ --namespace kube-system --include-crds --dry-run)
|
||||
"cilium")
|
||||
echo ">> Special Rendering for cilium ..."
|
||||
helm template cilium ./ --namespace kube-system --include-crds > "$OUTPUT_FILE"
|
||||
;;
|
||||
"coredns")
|
||||
echo ">> Special Rendering for coredns ..."
|
||||
helm template coredns ./ --namespace kube-system --include-crds > "$OUTPUT_FILE"
|
||||
;;
|
||||
"metrics-server")
|
||||
echo ">> Special Rendering for metrics-server ..."
|
||||
helm template metrics-server ./ --namespace kube-system --include-crds > "$OUTPUT_FILE"
|
||||
;;
|
||||
"prometheus-operator-crds")
|
||||
echo ">> Special Rendering for prometheus-operator-crds ..."
|
||||
helm template prometheus-operator-crds ./ --namespace kube-system --include-crds > "$OUTPUT_FILE"
|
||||
;;
|
||||
*)
|
||||
echo ""
|
||||
echo ">> Standard Rendering for $chart_name ..."
|
||||
TEMPLATE=$(helm template "$chart_name" ./ --namespace "$chart_name" --include-crds --dry-run)
|
||||
helm template "$chart_name" ./ --namespace "$chart_name" --include-crds > "$OUTPUT_FILE"
|
||||
;;
|
||||
esac
|
||||
|
||||
echo ""
|
||||
echo ">> Formating rendered template ..."
|
||||
echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
|
||||
|
||||
# Strip comments again to ensure formatting correctness
|
||||
for file in "$OUTPUT_FOLDER"/*; do
|
||||
yq -i '... comments=""' $file
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
|
||||
ls $OUTPUT_FOLDER
|
||||
echo ">> Manifests for $chart_name rendered to $OUTPUT_FILE"
|
||||
echo ""
|
||||
else
|
||||
echo ""
|
||||
@@ -212,16 +222,13 @@ jobs:
|
||||
run: |
|
||||
cd ${MANIFEST_DIR}
|
||||
|
||||
GIT_CHANGES=$(git status --porcelain)
|
||||
|
||||
if [ -n "$GIT_CHANGES" ]; then
|
||||
if git status --porcelain | grep -q .; then
|
||||
echo ">> Changes detected"
|
||||
git status --porcelain
|
||||
echo "changes-detected=true" >> $GITEA_OUTPUT
|
||||
|
||||
else
|
||||
echo ">> No changes detected, skipping PR creation"
|
||||
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "----"
|
||||
@@ -317,7 +324,7 @@ jobs:
|
||||
--arg assignee "${ASSIGNEE}" \
|
||||
--arg title "Automated Manifest Update" \
|
||||
--arg body "This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow." \
|
||||
'{head: $head, base: $base, assignee: $assignee, title: $title, body: $body}' )
|
||||
'{head: $head, base: $base, assignee: $assignee, title: $title, body: $body'} )
|
||||
|
||||
echo ">> Creating PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
|
||||
echo ">> With Endpoint of:"
|
||||
@@ -378,9 +385,10 @@ jobs:
|
||||
priority: 3
|
||||
headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
|
||||
tags: action,successfully,completed
|
||||
details: "Manifest rendering for Infrastructure has created a new Pull Request with ID: ${{ steps.create-pull-request.outputs.pull-request-id }}!"
|
||||
details: "Manifest rendering for Infrastructure has created a new Pull Request!"
|
||||
icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
|
||||
actions: '[{"action": "view", "label": "Open Gitea", "url": "${{ steps.create-pull-request.outputs.pull-request-url }}", "clear": true}]'
|
||||
image: true
|
||||
|
||||
- name: ntfy Failed
|
||||
uses: niniyas/ntfy-action@master
|
||||
@@ -2,12 +2,6 @@
|
||||
|
||||
GitOps definied infrastrucutre for the alexlebens.net domain.
|
||||
|
||||
## Stack-cl01tl
|
||||
|
||||
https://argocd.alexlebens.net/api/badge?name=stack-cl01tl&revision=true&showAppName=true
|
||||
|
||||
App-of-Apps Application for cl01tl
|
||||
|
||||
## License
|
||||
|
||||
This project is licensed under the terms of the Apache 2.0 License license.
|
||||
|
||||
@@ -1,9 +1,6 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.3.0
|
||||
digest: sha256:3763d6c5c0b45219235229aa1d72bfa426abd29aa8d92c1b1ca958b6afb3bfc8
|
||||
generated: "2025-12-15T17:43:51.908308-06:00"
|
||||
version: 4.4.0
|
||||
digest: sha256:b5d823171e1b4dc1d3856f782f0c67cbb5d49e4fa170df2f21b06303c7aff7f5
|
||||
generated: "2025-11-30T21:05:19.732832-06:00"
|
||||
|
||||
@@ -16,10 +16,6 @@ dependencies:
|
||||
- name: app-template
|
||||
alias: actual
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
- name: volsync-target
|
||||
alias: volsync-target-data
|
||||
version: 0.3.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 4.4.0
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/actual-budget.png
|
||||
appVersion: 25.12.0
|
||||
appVersion: 25.11.0
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: seerr-config-backup-secret
|
||||
name: actual-data-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: seerr-config-backup-secret
|
||||
app.kubernetes.io/name: actual-data-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
@@ -16,7 +16,7 @@ spec:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/seerr/seerr-config"
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/actual/actual-data"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
@@ -0,0 +1,25 @@
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: actual-data-backup-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: actual-data-backup-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: actual-data
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: actual-data-backup-secret
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
@@ -9,7 +9,7 @@ actual:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/actualbudget/actual
|
||||
tag: 25.12.0
|
||||
tag: 25.11.0
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: TZ
|
||||
@@ -54,5 +54,3 @@ actual:
|
||||
main:
|
||||
- path: /data
|
||||
readOnly: false
|
||||
volsync-target-data:
|
||||
pvcTarget: actual-data
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
dependencies:
|
||||
- name: argo-workflows
|
||||
repository: https://argoproj.github.io/argo-helm
|
||||
version: 0.46.2
|
||||
version: 0.45.28
|
||||
- name: argo-events
|
||||
repository: https://argoproj.github.io/argo-helm
|
||||
version: 2.4.19
|
||||
version: 2.4.17
|
||||
- name: postgres-cluster
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 7.1.3
|
||||
digest: sha256:fb51f9312fd003df7f9beced8e3583eb66c74a57820effab510bd80ce3a91558
|
||||
generated: "2025-12-17T16:08:51.370582257Z"
|
||||
version: 6.16.0
|
||||
digest: sha256:b00fd479a9d9e606661b3799182c8e24395b4f531f8d2bda87bdc5db16a8d66c
|
||||
generated: "2025-12-01T19:55:40.18149-06:00"
|
||||
|
||||
@@ -18,14 +18,14 @@ maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: argo-workflows
|
||||
version: 0.46.2
|
||||
version: 0.45.28
|
||||
repository: https://argoproj.github.io/argo-helm
|
||||
- name: argo-events
|
||||
version: 2.4.19
|
||||
version: 2.4.17
|
||||
repository: https://argoproj.github.io/argo-helm
|
||||
- name: postgres-cluster
|
||||
alias: postgres-18-cluster
|
||||
version: 7.1.3
|
||||
alias: postgres-17-cluster
|
||||
version: 6.16.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
|
||||
appVersion: v3.7.6
|
||||
appVersion: v3.6.7
|
||||
|
||||
@@ -31,10 +31,10 @@ spec:
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: argo-workflows-postgresql-18-cluster-backup-secret
|
||||
name: argo-workflows-postgresql-17-cluster-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: argo-workflows-postgresql-18-cluster-backup-secret
|
||||
app.kubernetes.io/name: argo-workflows-postgresql-17-cluster-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
@@ -61,10 +61,10 @@ spec:
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: argo-workflows-postgresql-18-cluster-backup-secret-garage
|
||||
name: argo-workflows-postgresql-17-cluster-backup-secret-garage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: argo-workflows-postgresql-18-cluster-backup-secret-garage
|
||||
app.kubernetes.io/name: argo-workflows-postgresql-17-cluster-backup-secret-garage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
|
||||
@@ -9,15 +9,15 @@ argo-workflows:
|
||||
nodeStatusOffLoad: true
|
||||
archive: true
|
||||
postgresql:
|
||||
host: argo-workflows-postgresql-18-cluster-rw
|
||||
host: argo-workflows-postgresql-17-cluster-rw
|
||||
port: 5432
|
||||
database: app
|
||||
tableName: app
|
||||
userNameSecret:
|
||||
name: argo-workflows-postgresql-18-cluster-app
|
||||
name: argo-workflows-postgresql-17-cluster-app
|
||||
key: username
|
||||
passwordSecret:
|
||||
name: argo-workflows-postgresql-18-cluster-app
|
||||
name: argo-workflows-postgresql-17-cluster-app
|
||||
key: password
|
||||
ssl: false
|
||||
sslMode: disable
|
||||
@@ -59,6 +59,20 @@ argo-workflows:
|
||||
useStaticCredentials: true
|
||||
artifactRepository:
|
||||
archiveLogs: false
|
||||
s3: {}
|
||||
# accessKeySecret:
|
||||
# name: "{{ .Release.Name }}-minio"
|
||||
# key: accesskey
|
||||
# secretKeySecret:
|
||||
# name: "{{ .Release.Name }}-minio"
|
||||
# key: secretkey
|
||||
# insecure: true
|
||||
# bucket:
|
||||
# endpoint:
|
||||
# region:
|
||||
# encryptionOptions:
|
||||
# enableEncryption: true
|
||||
|
||||
argo-events:
|
||||
controller:
|
||||
resources:
|
||||
@@ -75,57 +89,59 @@ argo-events:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
postgres-18-cluster:
|
||||
postgres-17-cluster:
|
||||
mode: recovery
|
||||
cluster:
|
||||
storage:
|
||||
storageClass: local-path
|
||||
walStorage:
|
||||
storageClass: local-path
|
||||
monitoring:
|
||||
enabled: true
|
||||
prometheusRule:
|
||||
enabled: true
|
||||
recovery:
|
||||
method: objectStore
|
||||
objectStore:
|
||||
destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
|
||||
destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
index: 1
|
||||
endpointCredentials: argo-workflows-postgresql-18-cluster-backup-secret-garage
|
||||
endpointCredentials: argo-workflows-postgresql-17-cluster-backup-secret-garage
|
||||
backup:
|
||||
objectStore:
|
||||
- name: external
|
||||
destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster
|
||||
index: 1
|
||||
retentionPolicy: "30d"
|
||||
isWALArchiver: false
|
||||
- name: garage-local
|
||||
destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
|
||||
destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster
|
||||
index: 1
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
endpointCredentials: argo-workflows-postgresql-18-cluster-backup-secret-garage
|
||||
endpointCredentials: argo-workflows-postgresql-17-cluster-backup-secret-garage
|
||||
endpointCredentialsIncludeRegion: true
|
||||
retentionPolicy: "3d"
|
||||
isWALArchiver: true
|
||||
# - name: external
|
||||
# destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
|
||||
# index: 1
|
||||
# retentionPolicy: "30d"
|
||||
# isWALArchiver: false
|
||||
# - name: garage-remote
|
||||
# destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
|
||||
# destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster
|
||||
# index: 1
|
||||
# endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
|
||||
# endpointCredentials: argo-workflows-postgresql-18-cluster-backup-secret-garage
|
||||
# endpointCredentials: argo-workflows-postgresql-17-cluster-backup-secret-garage
|
||||
# endpointCredentialsIncludeRegion: true
|
||||
# retentionPolicy: "30d"
|
||||
# data:
|
||||
# compression: bzip2
|
||||
scheduledBackups:
|
||||
- name: daily-backup
|
||||
suspend: false
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: external
|
||||
- name: live-backup
|
||||
suspend: false
|
||||
immediate: true
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: garage-local
|
||||
# - name: daily-backup
|
||||
# suspend: false
|
||||
# immediate: true
|
||||
# schedule: "0 0 0 * * *"
|
||||
# backupName: external
|
||||
# - name: weekly-backup
|
||||
# suspend: true
|
||||
# immediate: true
|
||||
# schedule: "0 0 4 * * SAT"
|
||||
# backupName: garage-remote
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
dependencies:
|
||||
- name: argo-cd
|
||||
repository: https://argoproj.github.io/argo-helm
|
||||
version: 9.1.8
|
||||
digest: sha256:4d2089dba47c25af1126a5397f001bb114f6c464b20493c382c4c7b315e42c24
|
||||
generated: "2025-12-17T01:21:10.460753309Z"
|
||||
version: 9.1.5
|
||||
digest: sha256:07f7f6d369af426cdd213ddbc58373a4e5b4f54724efd4612662d7da0315232d
|
||||
generated: "2025-12-02T21:27:41.876154-06:00"
|
||||
|
||||
@@ -15,7 +15,7 @@ maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: argo-cd
|
||||
version: 9.1.8
|
||||
version: 9.1.5
|
||||
repository: https://argoproj.github.io/argo-helm
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
|
||||
appVersion: v3.2.1
|
||||
appVersion: 3.0.0
|
||||
|
||||
@@ -25,7 +25,6 @@ argo-cd:
|
||||
id: authentik
|
||||
params:
|
||||
server.insecure: true
|
||||
controller.diff.server.side: true
|
||||
rbac:
|
||||
policy.csv: |
|
||||
g, ArgoCD Admins, role:admin
|
||||
@@ -61,7 +60,7 @@ argo-cd:
|
||||
enabled: true
|
||||
auth: false
|
||||
redisSecretInit:
|
||||
enabled: false
|
||||
enabled: true
|
||||
server:
|
||||
replicas: 2
|
||||
extensions:
|
||||
@@ -280,7 +279,7 @@ argo-cd:
|
||||
- description: Application has degraded
|
||||
send:
|
||||
- app-health-degraded
|
||||
when: app.status.health.status == 'Degraded'
|
||||
when: app.status.health.status == 'Degraded' and time.Now().Sub(time.Parse(app.status.health.lastTransitionTime).Minutes() >= 15
|
||||
trigger.on-sync-failed: |
|
||||
- description: Application syncing has failed
|
||||
send:
|
||||
|
||||
@@ -1,12 +1,6 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.3.0
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.3.0
|
||||
digest: sha256:88e0d8008795451a64f3a2e4fa4fc120d48cef4badb4305e8e60afbb494352c5
|
||||
generated: "2025-12-15T18:19:02.989735-06:00"
|
||||
version: 4.4.0
|
||||
digest: sha256:f3a9990542f24965fadad0b5493059b78cdc3fae91c8214577fa6f41ca5f7de3
|
||||
generated: "2025-11-30T21:05:21.317114-06:00"
|
||||
|
||||
@@ -18,14 +18,6 @@ dependencies:
|
||||
- name: app-template
|
||||
alias: audiobookshelf
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
- name: volsync-target
|
||||
alias: volsync-target-config
|
||||
version: 0.3.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: volsync-target
|
||||
alias: volsync-target-metadata
|
||||
version: 0.3.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 4.4.0
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/audiobookshelf.png
|
||||
appVersion: 2.31.0
|
||||
appVersion: 2.21.0
|
||||
|
||||
@@ -19,3 +19,117 @@ spec:
|
||||
key: /cl01tl/audiobookshelf/apprise
|
||||
metadataPolicy: None
|
||||
property: ntfy-url
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: audiobookshelf-config-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: audiobookshelf-config-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/audiobookshelf/audiobookshelf-config"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: S3_BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: access_key
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: secret_key
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: audiobookshelf-metadata-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: audiobookshelf-metadata-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/audiobookshelf/audiobookshelf-metadata"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: S3_BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: access_key
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: secret_key
|
||||
|
||||
@@ -1,5 +1,24 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: audiobookshelf-nfs-storage-backup
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: audiobookshelf-nfs-storage-backup
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
volumeMode: Filesystem
|
||||
storageClassName: nfs-client
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: audiobookshelf-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
|
||||
@@ -0,0 +1,52 @@
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: audiobookshelf-config-backup-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: audiobookshelf-config-backup-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: audiobookshelf-config
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: audiobookshelf-config-backup-secret
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
|
||||
---
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: audiobookshelf-metadata-backup-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: audiobookshelf-metadata-backup-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: audiobookshelf-metadata
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: audiobookshelf-metadata-backup-secret
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
@@ -21,7 +21,7 @@ audiobookshelf:
|
||||
apprise-api:
|
||||
image:
|
||||
repository: caronc/apprise
|
||||
tag: 1.3.0
|
||||
tag: 1.2.6
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: TZ
|
||||
@@ -59,7 +59,6 @@ audiobookshelf:
|
||||
protocol: HTTP
|
||||
persistence:
|
||||
config:
|
||||
forceRename: audiobookshelf-config
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 2Gi
|
||||
@@ -70,7 +69,6 @@ audiobookshelf:
|
||||
- path: /config
|
||||
readOnly: false
|
||||
metadata:
|
||||
forceRename: audiobookshelf-metadata
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 10Gi
|
||||
@@ -80,6 +78,13 @@ audiobookshelf:
|
||||
main:
|
||||
- path: /metadata
|
||||
readOnly: false
|
||||
backup:
|
||||
existingClaim: audiobookshelf-nfs-storage-backup
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
- path: /metadata/backups
|
||||
readOnly: false
|
||||
audiobooks:
|
||||
existingClaim: audiobookshelf-nfs-storage
|
||||
advancedMounts:
|
||||
@@ -87,7 +92,3 @@ audiobookshelf:
|
||||
main:
|
||||
- path: /mnt/store/
|
||||
readOnly: false
|
||||
volsync-target-config:
|
||||
pvcTarget: audiobookshelf-config
|
||||
volsync-target-metadata:
|
||||
pvcTarget: audiobookshelf-metadata
|
||||
|
||||
@@ -1,15 +1,12 @@
|
||||
dependencies:
|
||||
- name: authentik
|
||||
repository: https://charts.goauthentik.io/
|
||||
version: 2025.10.3
|
||||
version: 2025.10.2
|
||||
- name: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.2
|
||||
version: 1.23.1
|
||||
- name: postgres-cluster
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 7.1.3
|
||||
- name: redis-replication
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.5.0
|
||||
digest: sha256:529f2ddaef6ef3584461ae31e4e3ffcc1146f19ece74ef054a7ddbc7eb36a0d8
|
||||
generated: "2025-12-17T16:09:03.696627571Z"
|
||||
version: 6.16.0
|
||||
digest: sha256:2c3f84ecf3c8cabb7aa7e7e8a1b38cced65156c1e1db9b984154f514c33c9f69
|
||||
generated: "2025-12-03T06:02:07.501444093Z"
|
||||
|
||||
@@ -21,18 +21,15 @@ maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: authentik
|
||||
version: 2025.10.3
|
||||
version: 2025.10.2
|
||||
repository: https://charts.goauthentik.io/
|
||||
- name: cloudflared
|
||||
alias: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.2
|
||||
version: 1.23.1
|
||||
- name: postgres-cluster
|
||||
alias: postgres-18-cluster
|
||||
version: 7.1.3
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: redis-replication
|
||||
version: 0.5.0
|
||||
alias: postgres-17-cluster
|
||||
version: 6.16.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/authentik.png
|
||||
appVersion: 2025.10.2
|
||||
appVersion: 2025.4.1
|
||||
|
||||
@@ -47,10 +47,10 @@ spec:
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: authentik-postgresql-18-cluster-backup-secret
|
||||
name: authentik-postgresql-17-cluster-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: authentik-postgresql-18-cluster-backup-secret
|
||||
app.kubernetes.io/name: authentik-postgresql-17-cluster-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
@@ -77,10 +77,10 @@ spec:
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: authentik-postgresql-18-cluster-backup-secret-garage
|
||||
name: authentik-postgresql-17-cluster-backup-secret-garage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: authentik-postgresql-18-cluster-backup-secret-garage
|
||||
app.kubernetes.io/name: authentik-postgresql-17-cluster-backup-secret-garage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
apiVersion: redis.redis.opstreelabs.in/v1beta2
|
||||
kind: RedisReplication
|
||||
metadata:
|
||||
name: redis-replication-authentik
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: redis-replication-authentik
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
clusterSize: 3
|
||||
podSecurityContext:
|
||||
runAsUser: 1000
|
||||
fsGroup: 1000
|
||||
kubernetesConfig:
|
||||
image: quay.io/opstree/redis:v8.0.3
|
||||
imagePullPolicy: IfNotPresent
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
storage:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
storageClassName: ceph-block
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
redisExporter:
|
||||
enabled: true
|
||||
image: quay.io/opstree/redis-exporter:v1.48.0
|
||||
@@ -0,0 +1,19 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: redis-replication-authentik
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: redis-replication-authentik
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
redis-operator: "true"
|
||||
env: production
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
redis_setup_type: replication
|
||||
endpoints:
|
||||
- port: redis-exporter
|
||||
interval: 30s
|
||||
scrapeTimeout: 10s
|
||||
@@ -9,22 +9,22 @@ authentik:
|
||||
- name: AUTHENTIK_POSTGRESQL__HOST
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: authentik-postgresql-18-cluster-app
|
||||
name: authentik-postgresql-17-cluster-app
|
||||
key: host
|
||||
- name: AUTHENTIK_POSTGRESQL__NAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: authentik-postgresql-18-cluster-app
|
||||
name: authentik-postgresql-17-cluster-app
|
||||
key: dbname
|
||||
- name: AUTHENTIK_POSTGRESQL__USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: authentik-postgresql-18-cluster-app
|
||||
name: authentik-postgresql-17-cluster-app
|
||||
key: user
|
||||
- name: AUTHENTIK_POSTGRESQL__PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: authentik-postgresql-18-cluster-app
|
||||
name: authentik-postgresql-17-cluster-app
|
||||
key: password
|
||||
authentik:
|
||||
redis:
|
||||
@@ -50,65 +50,59 @@ authentik:
|
||||
enabled: false
|
||||
cloudflared:
|
||||
existingSecretName: authentik-cloudflared-secret
|
||||
postgres-18-cluster:
|
||||
postgres-17-cluster:
|
||||
mode: recovery
|
||||
cluster:
|
||||
storage:
|
||||
storageClass: local-path
|
||||
walStorage:
|
||||
storageClass: local-path
|
||||
monitoring:
|
||||
enabled: true
|
||||
prometheusRule:
|
||||
enabled: true
|
||||
recovery:
|
||||
method: objectStore
|
||||
objectStore:
|
||||
destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-18-cluster
|
||||
destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-17-cluster
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
index: 1
|
||||
endpointCredentials: authentik-postgresql-18-cluster-backup-secret-garage
|
||||
endpointCredentials: authentik-postgresql-17-cluster-backup-secret-garage
|
||||
backup:
|
||||
objectStore:
|
||||
- name: external
|
||||
destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/authentik/authentik-postgresql-17-cluster
|
||||
index: 1
|
||||
retentionPolicy: "30d"
|
||||
isWALArchiver: false
|
||||
- name: garage-local
|
||||
destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-18-cluster
|
||||
destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-17-cluster
|
||||
index: 1
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
endpointCredentials: authentik-postgresql-18-cluster-backup-secret-garage
|
||||
endpointCredentials: authentik-postgresql-17-cluster-backup-secret-garage
|
||||
endpointCredentialsIncludeRegion: true
|
||||
retentionPolicy: "3d"
|
||||
isWALArchiver: true
|
||||
# - name: external
|
||||
# destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/authentik/authentik-postgresql-18-cluster
|
||||
# index: 1
|
||||
# retentionPolicy: "30d"
|
||||
# isWALArchiver: false
|
||||
# - name: garage-remote
|
||||
# destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-18-cluster
|
||||
# destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-17-cluster
|
||||
# index: 1
|
||||
# endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
|
||||
# endpointCredentials: authentik-postgresql-18-cluster-backup-secret-garage
|
||||
# endpointCredentials: authentik-postgresql-17-cluster-backup-secret-garage
|
||||
# retentionPolicy: "30d"
|
||||
# data:
|
||||
# compression: bzip2
|
||||
# jobs: 2
|
||||
scheduledBackups:
|
||||
- name: daily-backup
|
||||
suspend: false
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: external
|
||||
- name: live-backup
|
||||
suspend: false
|
||||
immediate: true
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: garage-local
|
||||
# - name: daily-backup
|
||||
# suspend: false
|
||||
# immediate: true
|
||||
# schedule: "0 0 0 * * *"
|
||||
# backupName: external
|
||||
# - name: weekly-backup
|
||||
# suspend: false
|
||||
# immediate: true
|
||||
# schedule: "0 0 4 * * SAT"
|
||||
# backupName: garage-remote
|
||||
redis-replication:
|
||||
existingSecret:
|
||||
enabled: false
|
||||
redisReplication:
|
||||
clusterSize: 3
|
||||
redisSentinel:
|
||||
enabled: true
|
||||
clusterSize: 3
|
||||
|
||||
@@ -1,12 +1,6 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.3.0
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.3.0
|
||||
digest: sha256:13c950ad5cd6accd192e6768557c0df74af2cd767d2372dc38c1cdb7e1563399
|
||||
generated: "2025-12-15T18:33:59.961957-06:00"
|
||||
version: 4.4.0
|
||||
digest: sha256:aa797b99d6d8b7aafe142811938408b7f234df6d429a7e076196337cc63876cb
|
||||
generated: "2025-12-01T20:25:09.888407-06:00"
|
||||
|
||||
@@ -16,14 +16,6 @@ dependencies:
|
||||
- name: app-template
|
||||
alias: backrest
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
- name: volsync-target
|
||||
alias: volsync-target-config
|
||||
version: 0.3.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: volsync-target
|
||||
alias: volsync-target-data
|
||||
version: 0.3.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 4.4.0
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/backrest.png
|
||||
appVersion: v1.10.1
|
||||
|
||||
@@ -35,7 +35,6 @@ backrest:
|
||||
protocol: TCP
|
||||
persistence:
|
||||
data:
|
||||
forceRename: backrest-data
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 10Gi
|
||||
@@ -46,7 +45,6 @@ backrest:
|
||||
- path: /data
|
||||
readOnly: false
|
||||
config:
|
||||
forceRename: backrest-config
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 1Gi
|
||||
@@ -84,7 +82,3 @@ backrest:
|
||||
main:
|
||||
- path: /mnt/share
|
||||
readOnly: true
|
||||
volsync-target-data:
|
||||
pvcTarget: backrest-data
|
||||
volsync-target-config:
|
||||
pvcTarget: backrest-config
|
||||
|
||||
@@ -1,9 +1,6 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.5.0
|
||||
digest: sha256:cb702f316026bdb487ace1abec56cc3c505376cf14a45528e3e593e4cc7effab
|
||||
generated: "2025-12-15T19:04:05.574701-06:00"
|
||||
version: 4.4.0
|
||||
digest: sha256:c6f6d1f2fb9fedf54094920737a6f0bd1a2ab89f0a4122966ca98f6c9d3f11fa
|
||||
generated: "2025-11-30T21:05:22.694344-06:00"
|
||||
|
||||
@@ -18,10 +18,6 @@ dependencies:
|
||||
- name: app-template
|
||||
alias: bazarr
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
- name: volsync-target
|
||||
alias: volsync-target-config
|
||||
version: 0.5.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 4.4.0
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/bazarr.png
|
||||
appVersion: 1.5.3
|
||||
appVersion: 1.5.2
|
||||
|
||||
55
clusters/cl01tl/helm/bazarr/templates/external-secret.yaml
Normal file
55
clusters/cl01tl/helm/bazarr/templates/external-secret.yaml
Normal file
@@ -0,0 +1,55 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: bazarr-config-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: bazarr-config-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/bazarr/bazarr-config"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: S3_BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: access_key
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: secret_key
|
||||
@@ -0,0 +1,30 @@
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: bazarr-config-backup-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: bazarr-config-backup-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: bazarr-config
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: bazarr-config-backup-secret
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
moverSecurityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
@@ -15,7 +15,7 @@ bazarr:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/linuxserver/bazarr
|
||||
tag: 1.5.3@sha256:648f694532a3a53d8cf78bc888919ef538659bad41af4c680b0427ad1047d171
|
||||
tag: 1.5.3@sha256:ec11e988e8e13411c994a4d9f43ed9b97409aa92c1da54d9f23926c3da7c2032
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: TZ
|
||||
@@ -55,10 +55,3 @@ bazarr:
|
||||
main:
|
||||
- path: /mnt/store
|
||||
readOnly: false
|
||||
volsync-target-config:
|
||||
pvcTarget: bazarr-config
|
||||
moverSecurityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
|
||||
@@ -1,9 +1,6 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
- name: redis-replication
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.5.0
|
||||
digest: sha256:a7840240d52d7c66aa2e542132e32907dd0c48d3051eb15190a209215cbd4dce
|
||||
generated: "2025-12-15T20:06:31.995318697Z"
|
||||
version: 4.4.0
|
||||
digest: sha256:0009729bcf7f1941401b767fd4ae952b7a8d44f80053090b4a9224de912a14ef
|
||||
generated: "2025-12-01T20:25:13.511406-06:00"
|
||||
|
||||
@@ -16,9 +16,6 @@ dependencies:
|
||||
- name: app-template
|
||||
alias: blocky
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
- name: redis-replication
|
||||
version: 0.5.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 4.4.0
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/blocky.png
|
||||
appVersion: v0.28.2
|
||||
appVersion: v0.25
|
||||
|
||||
32
clusters/cl01tl/helm/blocky/templates/redis-replication.yaml
Normal file
32
clusters/cl01tl/helm/blocky/templates/redis-replication.yaml
Normal file
@@ -0,0 +1,32 @@
|
||||
apiVersion: redis.redis.opstreelabs.in/v1beta2
|
||||
kind: RedisReplication
|
||||
metadata:
|
||||
name: redis-replication-blocky
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: redis-replication-blocky
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
clusterSize: 3
|
||||
podSecurityContext:
|
||||
runAsUser: 1000
|
||||
fsGroup: 1000
|
||||
kubernetesConfig:
|
||||
image: quay.io/opstree/redis:v8.0.3
|
||||
imagePullPolicy: IfNotPresent
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
storage:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
storageClassName: ceph-block
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
redisExporter:
|
||||
enabled: true
|
||||
image: quay.io/opstree/redis-exporter:v1.48.0
|
||||
@@ -17,3 +17,24 @@ spec:
|
||||
interval: 30s
|
||||
scrapeTimeout: 10s
|
||||
path: /metrics
|
||||
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: redis-replication-blocky
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: redis-replication-blocky
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
redis-operator: "true"
|
||||
env: production
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
redis_setup_type: replication
|
||||
endpoints:
|
||||
- port: redis-exporter
|
||||
interval: 30s
|
||||
scrapeTimeout: 10s
|
||||
|
||||
@@ -129,10 +129,10 @@ blocky:
|
||||
huntarr IN CNAME traefik-cl01tl
|
||||
immich IN CNAME traefik-cl01tl
|
||||
jellyfin IN CNAME traefik-cl01tl
|
||||
jellyfin-vue IN CNAME traefik-cl01tl
|
||||
jellystat IN CNAME traefik-cl01tl
|
||||
kiwix IN CNAME traefik-cl01tl
|
||||
komodo IN CNAME traefik-cl01tl
|
||||
kronic IN CNAME traefik-cl01tl
|
||||
lidarr IN CNAME traefik-cl01tl
|
||||
lidatube IN CNAME traefik-cl01tl
|
||||
listenarr IN CNAME traefik-cl01tl
|
||||
@@ -143,6 +143,7 @@ blocky:
|
||||
ollama IN CNAME traefik-cl01tl
|
||||
omni-tools IN CNAME traefik-cl01tl
|
||||
overseerr IN CNAME traefik-cl01tl
|
||||
pgadmin IN CNAME traefik-cl01tl
|
||||
photoview IN CNAME traefik-cl01tl
|
||||
plex IN CNAME traefik-cl01tl
|
||||
postiz IN CNAME traefik-cl01tl
|
||||
@@ -155,7 +156,6 @@ blocky:
|
||||
radarr-anime IN CNAME traefik-cl01tl
|
||||
radarr-standup IN CNAME traefik-cl01tl
|
||||
searxng IN CNAME traefik-cl01tl
|
||||
seerr IN CNAME traefik-cl01tl
|
||||
slskd IN CNAME traefik-cl01tl
|
||||
sonarr IN CNAME traefik-cl01tl
|
||||
sonarr-4k IN CNAME traefik-cl01tl
|
||||
@@ -301,10 +301,3 @@ blocky:
|
||||
readOnly: true
|
||||
mountPropagation: None
|
||||
subPath: config.yml
|
||||
redis-replication:
|
||||
existingSecret:
|
||||
enabled: false
|
||||
redisReplication:
|
||||
clusterSize: 3
|
||||
redisSentinel:
|
||||
enabled: false
|
||||
|
||||
@@ -1,15 +1,9 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
version: 4.4.0
|
||||
- name: mariadb-cluster
|
||||
repository: https://helm.mariadb.com/mariadb-operator
|
||||
version: 25.10.2
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.5.0
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.5.0
|
||||
digest: sha256:6981b2c060c19bac6517578bd9b5b11a300a4deb431110bf90da317237a4a252
|
||||
generated: "2025-12-15T19:15:49.886575-06:00"
|
||||
digest: sha256:264725306c1d1f38140293c0820abdc7e8aa4f39764b4d91e20200705ce2ec91
|
||||
generated: "2025-11-30T21:05:24.649316-06:00"
|
||||
|
||||
@@ -16,17 +16,9 @@ dependencies:
|
||||
- name: app-template
|
||||
alias: booklore
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
version: 4.4.0
|
||||
- name: mariadb-cluster
|
||||
version: 25.10.2
|
||||
repository: https://helm.mariadb.com/mariadb-operator
|
||||
- name: volsync-target
|
||||
alias: volsync-target-config
|
||||
version: 0.5.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: volsync-target
|
||||
alias: volsync-target-data
|
||||
version: 0.5.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/booklore.png
|
||||
appVersion: v1.13.2
|
||||
appVersion: v.1.10.0
|
||||
|
||||
@@ -43,6 +43,234 @@ spec:
|
||||
metadataPolicy: None
|
||||
property: psk.txt
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: booklore-config-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-config-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/booklore/booklore-config"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /volsync/restic/digital-ocean
|
||||
metadataPolicy: None
|
||||
property: BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /volsync/restic/digital-ocean
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: AWS_ACCESS_KEY_ID
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: AWS_SECRET_ACCESS_KEY
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: booklore-data-backup-secret-local
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-data-backup-secret-local
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/booklore/booklore-data"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /volsync/restic/garage-local
|
||||
metadataPolicy: None
|
||||
property: BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /volsync/restic/garage-local
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_KEY_ID
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_SECRET_KEY
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: booklore-data-backup-secret-remote
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-data-backup-secret-remote
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/booklore/booklore-data"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /volsync/restic/garage-remote
|
||||
metadataPolicy: None
|
||||
property: BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /volsync/restic/garage-remote
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_KEY_ID
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_SECRET_KEY
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: booklore-data-backup-secret-external
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-data-backup-secret-external
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/booklore/booklore-data"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /volsync/restic/digital-ocean
|
||||
metadataPolicy: None
|
||||
property: BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /volsync/restic/digital-ocean
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: AWS_ACCESS_KEY_ID
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: AWS_SECRET_ACCESS_KEY
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
|
||||
@@ -8,6 +8,3 @@ metadata:
|
||||
app.kubernetes.io/name: booklore
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
pod-security.kubernetes.io/audit: privileged
|
||||
pod-security.kubernetes.io/enforce: privileged
|
||||
pod-security.kubernetes.io/warn: privileged
|
||||
|
||||
@@ -15,3 +15,115 @@ spec:
|
||||
keySecret: booklore-data-replication-secret
|
||||
address: volsync-rsync-tls-dst-booklore-data-replication-destination
|
||||
copyMethod: Snapshot
|
||||
|
||||
---
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: booklore-config-backup-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-config-backup-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: booklore-config
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: booklore-config-backup-secret
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
cacheCapacity: 10Gi
|
||||
|
||||
---
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: booklore-data-backup-source-local
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-data-backup-source-local
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: booklore-data
|
||||
trigger:
|
||||
schedule: 0 2 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: booklore-data-backup-secret-local
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
cacheCapacity: 10Gi
|
||||
|
||||
---
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: booklore-data-backup-source-remote
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-data-backup-source-remote
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: booklore-data
|
||||
trigger:
|
||||
schedule: 0 3 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: booklore-data-backup-secret-remote
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
cacheCapacity: 10Gi
|
||||
|
||||
---
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: booklore-data-backup-source-external
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: booklore-data-backup-source-external
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: booklore-data
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: booklore-data-backup-secret-external
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
cacheCapacity: 10Gi
|
||||
|
||||
@@ -9,7 +9,7 @@ booklore:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/booklore-app/booklore
|
||||
tag: v1.13.2
|
||||
tag: v1.12.0
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: TZ
|
||||
@@ -41,7 +41,6 @@ booklore:
|
||||
protocol: HTTP
|
||||
persistence:
|
||||
config:
|
||||
forceRename: booklore-config
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
@@ -52,7 +51,6 @@ booklore:
|
||||
- path: /app/data
|
||||
readOnly: false
|
||||
data:
|
||||
forceRename: booklore-data
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 10Gi
|
||||
@@ -121,8 +119,7 @@ mariadb-cluster:
|
||||
suspend: false
|
||||
immediate: true
|
||||
compression: gzip
|
||||
maxRetention: 2160h
|
||||
successfulJobsHistoryLimit: 1
|
||||
maxRetention: 720h
|
||||
storage:
|
||||
s3:
|
||||
bucket: mariadb-backups-b230a2f5aecf080a4b372c08
|
||||
@@ -137,28 +134,6 @@ mariadb-cluster:
|
||||
key: secret
|
||||
tls:
|
||||
enabled: true
|
||||
- name: backup-remote
|
||||
schedule:
|
||||
cron: "0 0 * * 0"
|
||||
suspend: false
|
||||
immediate: true
|
||||
compression: gzip
|
||||
maxRetention: 2160h
|
||||
successfulJobsHistoryLimit: 1
|
||||
storage:
|
||||
s3:
|
||||
bucket: mariadb-backups
|
||||
prefix: cl01tl/booklore
|
||||
endpoint: garage-ps10rp.boreal-beaufort.ts.net:3900
|
||||
region: us-east-1
|
||||
accessKeyIdSecretKeyRef:
|
||||
name: booklore-mariadb-cluster-backup-secret-garage
|
||||
key: access
|
||||
secretAccessKeySecretKeyRef:
|
||||
name: booklore-mariadb-cluster-backup-secret-garage
|
||||
key: secret
|
||||
tls:
|
||||
enabled: true
|
||||
- name: backup-garage
|
||||
schedule:
|
||||
cron: "0 0 * * *"
|
||||
@@ -166,7 +141,6 @@ mariadb-cluster:
|
||||
immediate: true
|
||||
compression: gzip
|
||||
maxRetention: 360h
|
||||
successfulJobsHistoryLimit: 1
|
||||
storage:
|
||||
s3:
|
||||
bucket: mariadb-backups
|
||||
@@ -179,16 +153,3 @@ mariadb-cluster:
|
||||
secretAccessKeySecretKeyRef:
|
||||
name: booklore-mariadb-cluster-backup-secret-garage
|
||||
key: secret
|
||||
volsync-target-config:
|
||||
pvcTarget: booklore-config
|
||||
volsync-target-data:
|
||||
pvcTarget: booklore-data
|
||||
local:
|
||||
restic:
|
||||
cacheCapacity: 10Gi
|
||||
remote:
|
||||
restic:
|
||||
cacheCapacity: 10Gi
|
||||
external:
|
||||
restic:
|
||||
cacheCapacity: 10Gi
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
dependencies:
|
||||
- name: cert-manager
|
||||
repository: https://charts.jetstack.io
|
||||
version: v1.19.2
|
||||
digest: sha256:b02bda9b9f2fc886af11d017a27a5761513defee603f9e3aa1d7add2749b925c
|
||||
generated: "2025-12-10T15:01:57.196895547Z"
|
||||
version: v1.19.1
|
||||
digest: sha256:0b1238a5552bc6d457d4b1a2a1f387a3e7f2c19f820ecb64e14d20481a1ed1ce
|
||||
generated: "2025-12-01T20:25:17.762628-06:00"
|
||||
|
||||
@@ -14,7 +14,7 @@ maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: cert-manager
|
||||
version: v1.19.2
|
||||
version: v1.19.1
|
||||
repository: https://charts.jetstack.io
|
||||
icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/cert-manager.png
|
||||
appVersion: v1.19.2
|
||||
appVersion: v1.17.2
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
dependencies:
|
||||
- name: cilium
|
||||
repository: https://helm.cilium.io/
|
||||
version: 1.18.5
|
||||
digest: sha256:b997853961dca1ed43d32b58b17e6e592581eb555db0b1457b168251cf3aaa45
|
||||
generated: "2025-12-17T16:05:05.870297681Z"
|
||||
version: 1.18.4
|
||||
digest: sha256:e38eb92ee87c9a52b0f45a2451142ade02bac7d484b246d32379eacce3800bc8
|
||||
generated: "2025-12-02T17:17:49.043599-06:00"
|
||||
|
||||
@@ -15,7 +15,7 @@ maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: cilium
|
||||
version: 1.18.5
|
||||
version: 1.18.4
|
||||
repository: https://helm.cilium.io/
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/cilium.png
|
||||
appVersion: 1.18.4
|
||||
appVersion: 1.17.3
|
||||
|
||||
@@ -55,9 +55,6 @@ cilium:
|
||||
metrics:
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
tls:
|
||||
auto:
|
||||
method: cronJob
|
||||
relay:
|
||||
enabled: true
|
||||
metrics:
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
dependencies:
|
||||
- name: cloudnative-pg
|
||||
repository: https://cloudnative-pg.io/charts/
|
||||
version: 0.27.0
|
||||
version: 0.26.1
|
||||
- name: plugin-barman-cloud
|
||||
repository: https://cloudnative-pg.io/charts/
|
||||
version: 0.3.1
|
||||
digest: sha256:14aa30b7bf75571b03bda19af68cd50c1e7908b883351b196a260609a5b85551
|
||||
generated: "2025-12-10T19:25:17.952954019Z"
|
||||
digest: sha256:b38e5104d77ab1737a27a2542eda958e82038443940f07b7c2cbe3b0a477e1e6
|
||||
generated: "2025-12-01T20:25:20.341325-06:00"
|
||||
|
||||
@@ -16,10 +16,10 @@ maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: cloudnative-pg
|
||||
version: 0.27.0
|
||||
version: 0.26.1
|
||||
repository: https://cloudnative-pg.io/charts/
|
||||
- name: plugin-barman-cloud
|
||||
version: 0.3.1
|
||||
repository: https://cloudnative-pg.io/charts/
|
||||
icon: https://avatars.githubusercontent.com/u/100373852?s=200&v=4
|
||||
appVersion: 1.28.0
|
||||
appVersion: 1.26.0
|
||||
|
||||
@@ -1,12 +1,9 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
version: 4.4.0
|
||||
- name: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.2
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.5.0
|
||||
digest: sha256:bd1cbd66ccb360978a342ee218bfb01006a486fb85c5714acd593b9e1389b151
|
||||
generated: "2025-12-15T21:50:58.968382-06:00"
|
||||
version: 1.23.1
|
||||
digest: sha256:dd687a71edc2f7f03cba6d5f3e3221e2bb5172ed4c00659e327c79da5c01e89f
|
||||
generated: "2025-12-03T06:02:20.44367742Z"
|
||||
|
||||
@@ -19,14 +19,10 @@ dependencies:
|
||||
- name: app-template
|
||||
alias: code-server
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
version: 4.4.0
|
||||
- name: cloudflared
|
||||
alias: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.2
|
||||
- name: volsync-target
|
||||
alias: volsync-target-config
|
||||
version: 0.5.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.1
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/visual-studio-code.png
|
||||
appVersion: 4.106.3
|
||||
appVersion: 4.100.2
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: code-server-nfs-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: code-server-nfs-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
volumeMode: Filesystem
|
||||
storageClassName: nfs-client
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
@@ -9,7 +9,7 @@ code-server:
|
||||
main:
|
||||
image:
|
||||
repository: ghcr.io/linuxserver/code-server
|
||||
tag: 4.106.3@sha256:83793e4460090d6c46f4842ff6ab8aa26ad8a567885112bbe754b45c61935055
|
||||
tag: 4.106.3@sha256:aab9520fe923b2d93dccc2c806f3dc60649c2f4a2847fcd40c942227d0f1ae8f
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: TZ
|
||||
@@ -37,11 +37,7 @@ code-server:
|
||||
protocol: HTTP
|
||||
persistence:
|
||||
config:
|
||||
forceRename: code-server-config
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 2Gi
|
||||
retain: true
|
||||
existingClaim: code-server-nfs-storage
|
||||
advancedMounts:
|
||||
main:
|
||||
main:
|
||||
@@ -49,10 +45,3 @@ code-server:
|
||||
readOnly: false
|
||||
cloudflared:
|
||||
existingSecretName: code-server-cloudflared-secret
|
||||
volsync-target-config:
|
||||
pvcTarget: code-server-config
|
||||
moverSecurityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
|
||||
@@ -18,4 +18,4 @@ dependencies:
|
||||
version: 1.45.0
|
||||
repository: https://coredns.github.io/helm
|
||||
icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/coredns.png
|
||||
appVersion: v1.13.2
|
||||
appVersion: v1.12.1
|
||||
|
||||
@@ -17,4 +17,4 @@ dependencies:
|
||||
version: 0.34.0
|
||||
repository: https://kubernetes-sigs.github.io/descheduler/
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
|
||||
appVersion: 0.34.0
|
||||
appVersion: 0.33.0
|
||||
|
||||
@@ -39,27 +39,16 @@ descheduler:
|
||||
- name: RemovePodsViolatingNodeTaints
|
||||
- name: RemovePodsViolatingInterPodAntiAffinity
|
||||
- name: RemovePodsViolatingTopologySpreadConstraint
|
||||
- name: "HighNodeUtilization"
|
||||
args:
|
||||
thresholds:
|
||||
cpu : 80
|
||||
memory: 80
|
||||
pods: 90
|
||||
evictableNamespaces:
|
||||
exclude:
|
||||
- "kube-system"
|
||||
evictionModes:
|
||||
- "OnlyThresholdingResources"
|
||||
- name: LowNodeUtilization
|
||||
args:
|
||||
thresholds:
|
||||
cpu: 30
|
||||
memory: 30
|
||||
pods: 50
|
||||
cpu: 20
|
||||
memory: 20
|
||||
pods: 20
|
||||
targetThresholds:
|
||||
cpu: 60
|
||||
memory: 40
|
||||
pods: 80
|
||||
memory: 60
|
||||
pods: 60
|
||||
plugins:
|
||||
balance:
|
||||
enabled:
|
||||
|
||||
@@ -1,15 +1,12 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
version: 4.4.0
|
||||
- name: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.2
|
||||
version: 1.23.1
|
||||
- name: postgres-cluster
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 7.1.3
|
||||
- name: redis-replication
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.5.0
|
||||
digest: sha256:984cd51b50663cda85c4861949d2dc724de730a415344936a4fe39745aca31d3
|
||||
generated: "2025-12-17T16:09:15.230017239Z"
|
||||
version: 6.16.0
|
||||
digest: sha256:2291640ab25754ded07da90a6cb617df92262a9b33635e8a9c80adda00034937
|
||||
generated: "2025-12-03T06:02:33.2806347Z"
|
||||
|
||||
@@ -20,17 +20,14 @@ dependencies:
|
||||
- name: app-template
|
||||
alias: directus
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
version: 4.4.0
|
||||
- name: cloudflared
|
||||
alias: cloudflared-directus
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.2
|
||||
version: 1.23.1
|
||||
- name: postgres-cluster
|
||||
alias: postgres-18-cluster
|
||||
version: 7.1.3
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: redis-replication
|
||||
version: 0.5.0
|
||||
alias: postgres-17-cluster
|
||||
version: 6.16.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/directus.png
|
||||
appVersion: 11.14.0
|
||||
appVersion: 11.7.2
|
||||
|
||||
@@ -151,10 +151,10 @@ spec:
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: directus-postgresql-18-cluster-backup-secret
|
||||
name: directus-postgresql-17-cluster-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: directus-postgresql-18-cluster-backup-secret
|
||||
app.kubernetes.io/name: directus-postgresql-17-cluster-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
@@ -181,10 +181,40 @@ spec:
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: directus-postgresql-18-cluster-backup-secret-garage
|
||||
name: directus-postgresql-17-cluster-backup-secret-weekly
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: directus-postgresql-18-cluster-backup-secret-garage
|
||||
app.kubernetes.io/name: directus-postgresql-17-cluster-backup-secret-weekly
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_KEY_ID
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_SECRET_KEY
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: directus-postgresql-17-cluster-backup-secret-garage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: directus-postgresql-17-cluster-backup-secret-garage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
apiVersion: redis.redis.opstreelabs.in/v1beta2
|
||||
kind: RedisReplication
|
||||
metadata:
|
||||
name: redis-replication-directus
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: redis-replication-directus
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
clusterSize: 3
|
||||
podSecurityContext:
|
||||
runAsUser: 1000
|
||||
fsGroup: 1000
|
||||
kubernetesConfig:
|
||||
image: quay.io/opstree/redis:v8.2.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
redisSecret:
|
||||
name: directus-redis-config
|
||||
key: password
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
storage:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
storageClassName: ceph-block
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
redisExporter:
|
||||
enabled: true
|
||||
image: quay.io/opstree/redis-exporter:v1.76.0
|
||||
30
clusters/cl01tl/helm/directus/templates/redis-sentinel.yaml
Normal file
30
clusters/cl01tl/helm/directus/templates/redis-sentinel.yaml
Normal file
@@ -0,0 +1,30 @@
|
||||
apiVersion: redis.redis.opstreelabs.in/v1beta2
|
||||
kind: RedisSentinel
|
||||
metadata:
|
||||
name: redis-sentinel-directus
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: redis-sentinel-directus
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
clusterSize: 3
|
||||
podSecurityContext:
|
||||
runAsUser: 1000
|
||||
fsGroup: 1000
|
||||
redisSentinelConfig:
|
||||
redisReplicationName: redis-replication-directus
|
||||
redisReplicationPassword:
|
||||
secretKeyRef:
|
||||
name: directus-redis-config
|
||||
key: password
|
||||
kubernetesConfig:
|
||||
image: quay.io/opstree/redis-sentinel:v7.0.15
|
||||
imagePullPolicy: IfNotPresent
|
||||
redisSecret:
|
||||
name: directus-redis-config
|
||||
key: password
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
@@ -20,3 +20,24 @@ spec:
|
||||
bearerTokenSecret:
|
||||
name: directus-metric-token
|
||||
key: metric-token
|
||||
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: redis-replication-directus
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: redis-replication-directus
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
redis-operator: "true"
|
||||
env: production
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
redis_setup_type: replication
|
||||
endpoints:
|
||||
- port: redis-exporter
|
||||
interval: 30s
|
||||
scrapeTimeout: 10s
|
||||
|
||||
@@ -9,7 +9,7 @@ directus:
|
||||
main:
|
||||
image:
|
||||
repository: directus/directus
|
||||
tag: 11.14.0
|
||||
tag: 11.13.4
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: PUBLIC_URL
|
||||
@@ -41,27 +41,27 @@ directus:
|
||||
- name: DB_HOST
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-postgresql-18-cluster-app
|
||||
name: directus-postgresql-17-cluster-app
|
||||
key: host
|
||||
- name: DB_DATABASE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-postgresql-18-cluster-app
|
||||
name: directus-postgresql-17-cluster-app
|
||||
key: dbname
|
||||
- name: DB_PORT
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-postgresql-18-cluster-app
|
||||
name: directus-postgresql-17-cluster-app
|
||||
key: port
|
||||
- name: DB_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-postgresql-18-cluster-app
|
||||
name: directus-postgresql-17-cluster-app
|
||||
key: user
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: directus-postgresql-18-cluster-app
|
||||
name: directus-postgresql-17-cluster-app
|
||||
key: password
|
||||
- name: SYNCHRONIZATION_STORE
|
||||
value: redis
|
||||
@@ -156,67 +156,59 @@ directus:
|
||||
cloudflared-directus:
|
||||
name: cloudflared-directus
|
||||
existingSecretName: directus-cloudflared-secret
|
||||
postgres-18-cluster:
|
||||
postgres-17-cluster:
|
||||
mode: recovery
|
||||
cluster:
|
||||
storage:
|
||||
storageClass: local-path
|
||||
walStorage:
|
||||
storageClass: local-path
|
||||
monitoring:
|
||||
enabled: true
|
||||
prometheusRule:
|
||||
enabled: true
|
||||
recovery:
|
||||
method: objectStore
|
||||
objectStore:
|
||||
destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-18-cluster
|
||||
destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-17-cluster
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
index: 1
|
||||
endpointCredentials: directus-postgresql-18-cluster-backup-secret-garage
|
||||
endpointCredentials: directus-postgresql-17-cluster-backup-secret-garage
|
||||
backup:
|
||||
objectStore:
|
||||
- name: external
|
||||
destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/directus/directus-postgresql-17-cluster
|
||||
index: 1
|
||||
retentionPolicy: "30d"
|
||||
isWALArchiver: false
|
||||
- name: garage-local
|
||||
destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-18-cluster
|
||||
destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-17-cluster
|
||||
index: 1
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
endpointCredentials: directus-postgresql-18-cluster-backup-secret-garage
|
||||
endpointCredentials: directus-postgresql-17-cluster-backup-secret-garage
|
||||
endpointCredentialsIncludeRegion: true
|
||||
retentionPolicy: "3d"
|
||||
isWALArchiver: true
|
||||
# - name: external
|
||||
# destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/directus/directus-postgresql-18-cluster
|
||||
# index: 1
|
||||
# retentionPolicy: "30d"
|
||||
# isWALArchiver: false
|
||||
# - name: garage-remote
|
||||
# destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-18-cluster
|
||||
# destinationPath: s3://postgres-backups/cl01tl/directus/directus-postgresql-17-cluster
|
||||
# index: 1
|
||||
# endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
|
||||
# endpointCredentials: directus-postgresql-18-cluster-backup-secret-garage
|
||||
# endpointCredentials: directus-postgresql-17-cluster-backup-secret-garage
|
||||
# retentionPolicy: "30d"
|
||||
# data:
|
||||
# compression: bzip2
|
||||
# jobs: 2
|
||||
scheduledBackups:
|
||||
- name: daily-backup
|
||||
suspend: false
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: external
|
||||
- name: live-backup
|
||||
suspend: false
|
||||
immediate: true
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: garage-local
|
||||
# - name: daily-backup
|
||||
# suspend: false
|
||||
# immediate: true
|
||||
# schedule: "0 0 0 * * *"
|
||||
# backupName: external
|
||||
# - name: weekly-backup
|
||||
# suspend: false
|
||||
# immediate: true
|
||||
# schedule: "0 0 4 * * SAT"
|
||||
# backupName: garage-remote
|
||||
redis-replication:
|
||||
existingSecret:
|
||||
enabled: true
|
||||
name: directus-redis-config
|
||||
key: password
|
||||
redisReplication:
|
||||
clusterSize: 3
|
||||
redisSentinel:
|
||||
enabled: true
|
||||
clusterSize: 3
|
||||
|
||||
@@ -18,4 +18,4 @@ dependencies:
|
||||
version: 3.2.0
|
||||
repository: https://helm.elastic.co
|
||||
icon: https://helm.elastic.co/icons/eck.png
|
||||
appVersion: v3.2.0
|
||||
appVersion: 1.26.0
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
dependencies:
|
||||
- name: element-web
|
||||
repository: https://ananace.gitlab.io/charts
|
||||
version: 1.4.26
|
||||
version: 1.4.25
|
||||
- name: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.2
|
||||
digest: sha256:f9196cbede894c6da6ecedd9ae05d3f1fd0e20304eca8ca38c18334a923b2235
|
||||
generated: "2025-12-07T02:54:29.895481505Z"
|
||||
version: 1.23.1
|
||||
digest: sha256:06208f8ba47fc2e2c0e56ea2e08b3539cb4c5d3ac5eeaf22936e84925b7add90
|
||||
generated: "2025-12-03T17:03:58.859116734Z"
|
||||
|
||||
@@ -17,11 +17,11 @@ maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: element-web
|
||||
version: 1.4.26
|
||||
version: 1.4.25
|
||||
repository: https://ananace.gitlab.io/charts
|
||||
- name: cloudflared
|
||||
alias: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.2
|
||||
version: 1.23.1
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/element.png
|
||||
appVersion: v1.12.6
|
||||
appVersion: v1.11.100
|
||||
|
||||
@@ -2,7 +2,7 @@ element-web:
|
||||
replicaCount: 1
|
||||
image:
|
||||
repository: vectorim/element-web
|
||||
tag: v1.12.7
|
||||
tag: v1.12.5
|
||||
pullPolicy: IfNotPresent
|
||||
defaultServer:
|
||||
url: https://matrix.alexlebens.dev
|
||||
|
||||
@@ -1,9 +1,6 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.3.0
|
||||
digest: sha256:476021b852fbbd829570bcb88309eea92bd096cb4ec79efe2d895ee0c46f1c49
|
||||
generated: "2025-12-15T21:43:24.262051-06:00"
|
||||
version: 4.4.0
|
||||
digest: sha256:9900009eb6415344d8c5387371a0052259092d92f34c21774f6a6abe9f11f43e
|
||||
generated: "2025-11-30T21:05:32.524168-06:00"
|
||||
|
||||
@@ -18,10 +18,6 @@ dependencies:
|
||||
- name: app-template
|
||||
alias: ephemera
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
- name: volsync-target
|
||||
alias: volsync-target-config
|
||||
version: 0.3.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 4.4.0
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/ephemera.png
|
||||
appVersion: 1.3.1
|
||||
|
||||
@@ -42,3 +42,60 @@ spec:
|
||||
key: /cl01tl/ephemera/config
|
||||
metadataPolicy: None
|
||||
property: ntfy-url
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: ephemera-config-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: ephemera-config-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/ephemera/ephemera-config"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: S3_BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: access_key
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: secret_key
|
||||
|
||||
@@ -1,19 +1,19 @@
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: seerr-config-backup-source
|
||||
name: ephemera-config-backup-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: seerr-config-backup-source
|
||||
app.kubernetes.io/name: ephemera-config-backup-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: seerr-seerr-chart-config
|
||||
sourcePVC: ephemera-config
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: seerr-config-backup-secret
|
||||
repository: ephemera-config-backup-secret
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
@@ -52,7 +52,7 @@ ephemera:
|
||||
apprise-api:
|
||||
image:
|
||||
repository: caronc/apprise
|
||||
tag: 1.3.0
|
||||
tag: 1.2.6
|
||||
pullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: TZ
|
||||
@@ -82,7 +82,6 @@ ephemera:
|
||||
protocol: HTTP
|
||||
persistence:
|
||||
config:
|
||||
forceRename: ephemera
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
@@ -106,5 +105,3 @@ ephemera:
|
||||
main:
|
||||
- path: /app/ingest
|
||||
readOnly: false
|
||||
volsync-target-config:
|
||||
pvcTarget: ephemera
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
dependencies:
|
||||
- name: eraser
|
||||
repository: https://eraser-dev.github.io/eraser/charts
|
||||
version: 1.4.1
|
||||
digest: sha256:da828de684b0cd82e99994586f3db4f55c43c01607c4d8d0e70e204c7bbbbf5b
|
||||
generated: "2025-12-03T22:53:20.200917773Z"
|
||||
version: 1.3.1
|
||||
digest: sha256:17b561a00acc809810dccd226e7b6d757db39b34a6095dee879da761098125f9
|
||||
generated: "2025-12-01T20:25:36.491841-06:00"
|
||||
|
||||
@@ -14,7 +14,7 @@ maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: eraser
|
||||
version: 1.4.1
|
||||
version: v1.3.1
|
||||
repository: https://eraser-dev.github.io/eraser/charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
|
||||
appVersion: v1.4.1
|
||||
appVersion: v1.3.1
|
||||
|
||||
@@ -19,4 +19,4 @@ dependencies:
|
||||
version: 1.19.0
|
||||
repository: https://kubernetes-sigs.github.io/external-dns/
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
|
||||
appVersion: v0.20.0
|
||||
appVersion: 1.16.1
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
dependencies:
|
||||
- name: external-secrets
|
||||
repository: https://charts.external-secrets.io
|
||||
version: 1.1.1
|
||||
digest: sha256:d346563864c95c4ca3fe5f04f6b292e417069d171f5866b5af0fe84277481493
|
||||
generated: "2025-12-06T18:01:23.564488208Z"
|
||||
version: 1.1.0
|
||||
digest: sha256:543c98c4f4014f91b05c823444d87990dcdcd9710a0e5ccd953c5dc4e70006ee
|
||||
generated: "2025-12-01T20:25:40.642486-06:00"
|
||||
|
||||
@@ -12,7 +12,7 @@ sources:
|
||||
- https://github.com/external-secrets/external-secrets/tree/main/deploy/charts/external-secrets
|
||||
dependencies:
|
||||
- name: external-secrets
|
||||
version: 1.1.1
|
||||
version: 1.1.0
|
||||
repository: https://charts.external-secrets.io
|
||||
icon: https://avatars.githubusercontent.com/u/68335991?s=48&v=4
|
||||
appVersion: v1.1.1
|
||||
appVersion: 0.17.0
|
||||
|
||||
@@ -1,15 +1,12 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
version: 4.4.0
|
||||
- name: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.2
|
||||
version: 1.23.1
|
||||
- name: postgres-cluster
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 7.1.3
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.5.0
|
||||
digest: sha256:5900e87dbe27e52b72edc6dd34e36aeb89c491ac8729b3be499cbd6e09ce88ff
|
||||
generated: "2025-12-17T16:09:27.525526677Z"
|
||||
version: 6.16.0
|
||||
digest: sha256:f6a701b51fe03506e02c754e02549982d5d8d27d558d8ec329c86b4f5ae24142
|
||||
generated: "2025-12-03T06:02:59.168313662Z"
|
||||
|
||||
@@ -20,18 +20,14 @@ dependencies:
|
||||
- name: app-template
|
||||
alias: freshrss
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
version: 4.4.0
|
||||
- name: cloudflared
|
||||
alias: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.2
|
||||
version: 1.23.1
|
||||
- name: postgres-cluster
|
||||
alias: postgres-18-cluster
|
||||
version: 7.1.3
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: volsync-target
|
||||
alias: volsync-target-data
|
||||
version: 0.5.0
|
||||
alias: postgres-17-cluster
|
||||
version: 6.16.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/freshrss.png
|
||||
appVersion: 1.27.1
|
||||
appVersion: 1.26.2
|
||||
|
||||
@@ -98,10 +98,67 @@ spec:
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: freshrss-postgresql-18-cluster-backup-secret
|
||||
name: freshrss-data-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: freshrss-postgresql-18-cluster-backup-secret
|
||||
app.kubernetes.io/name: freshrss-data-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/freshrss/freshrss-data"
|
||||
data:
|
||||
- secretKey: BUCKET_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: S3_BUCKET_ENDPOINT
|
||||
- secretKey: RESTIC_PASSWORD
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: RESTIC_PASSWORD
|
||||
- secretKey: AWS_DEFAULT_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/volsync/restic/config
|
||||
metadataPolicy: None
|
||||
property: AWS_DEFAULT_REGION
|
||||
- secretKey: AWS_ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: access_key
|
||||
- secretKey: AWS_SECRET_ACCESS_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/volsync-backups
|
||||
metadataPolicy: None
|
||||
property: secret_key
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: freshrss-postgresql-17-cluster-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: freshrss-postgresql-17-cluster-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
@@ -128,10 +185,10 @@ spec:
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: freshrss-postgresql-18-cluster-backup-secret-garage
|
||||
name: freshrss-postgresql-17-cluster-backup-secret-garage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: freshrss-postgresql-18-cluster-backup-secret-garage
|
||||
app.kubernetes.io/name: freshrss-postgresql-17-cluster-backup-secret-garage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: freshrss-data-backup-source
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: freshrss-data-backup-source
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
sourcePVC: freshrss-data
|
||||
trigger:
|
||||
schedule: 0 4 * * *
|
||||
restic:
|
||||
pruneIntervalDays: 7
|
||||
repository: freshrss-data-backup-secret
|
||||
retain:
|
||||
hourly: 1
|
||||
daily: 3
|
||||
weekly: 2
|
||||
monthly: 2
|
||||
yearly: 4
|
||||
moverSecurityContext:
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
supplementalGroups:
|
||||
- 44
|
||||
- 100
|
||||
- 109
|
||||
- 65539
|
||||
copyMethod: Snapshot
|
||||
storageClassName: ceph-block
|
||||
volumeSnapshotClassName: ceph-blockpool-snapshot
|
||||
@@ -11,7 +11,7 @@ freshrss:
|
||||
runAsUser: 0
|
||||
image:
|
||||
repository: alpine
|
||||
tag: 3.23.0
|
||||
tag: 3.22.2
|
||||
pullPolicy: IfNotPresent
|
||||
command:
|
||||
- /bin/sh
|
||||
@@ -35,7 +35,7 @@ freshrss:
|
||||
runAsUser: 0
|
||||
image:
|
||||
repository: alpine
|
||||
tag: 3.23.0
|
||||
tag: 3.22.2
|
||||
pullPolicy: IfNotPresent
|
||||
command:
|
||||
- /bin/sh
|
||||
@@ -59,7 +59,7 @@ freshrss:
|
||||
runAsUser: 0
|
||||
image:
|
||||
repository: alpine
|
||||
tag: 3.23.0
|
||||
tag: 3.22.2
|
||||
pullPolicy: IfNotPresent
|
||||
command:
|
||||
- /bin/sh
|
||||
@@ -98,22 +98,22 @@ freshrss:
|
||||
- name: DB_HOST
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: freshrss-postgresql-18-cluster-app
|
||||
name: freshrss-postgresql-17-cluster-app
|
||||
key: host
|
||||
- name: DB_BASE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: freshrss-postgresql-18-cluster-app
|
||||
name: freshrss-postgresql-17-cluster-app
|
||||
key: dbname
|
||||
- name: DB_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: freshrss-postgresql-18-cluster-app
|
||||
name: freshrss-postgresql-17-cluster-app
|
||||
key: user
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: freshrss-postgresql-18-cluster-app
|
||||
name: freshrss-postgresql-17-cluster-app
|
||||
key: password
|
||||
- name: FRESHRSS_INSTALL
|
||||
value: |
|
||||
@@ -163,7 +163,6 @@ freshrss:
|
||||
protocol: HTTP
|
||||
persistence:
|
||||
data:
|
||||
forceRename: freshrss-data
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
@@ -194,69 +193,59 @@ freshrss:
|
||||
readOnly: false
|
||||
cloudflared:
|
||||
existingSecretName: freshrss-cloudflared-secret
|
||||
postgres-18-cluster:
|
||||
postgres-17-cluster:
|
||||
mode: recovery
|
||||
cluster:
|
||||
storage:
|
||||
storageClass: local-path
|
||||
walStorage:
|
||||
storageClass: local-path
|
||||
monitoring:
|
||||
enabled: true
|
||||
prometheusRule:
|
||||
enabled: true
|
||||
recovery:
|
||||
method: objectStore
|
||||
objectStore:
|
||||
destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-18-cluster
|
||||
destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-17-cluster
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
index: 1
|
||||
endpointCredentials: freshrss-postgresql-18-cluster-backup-secret-garage
|
||||
endpointCredentials: freshrss-postgresql-17-cluster-backup-secret-garage
|
||||
backup:
|
||||
objectStore:
|
||||
- name: external
|
||||
destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/freshrss/freshrss-postgresql-17-cluster
|
||||
index: 1
|
||||
retentionPolicy: "30d"
|
||||
isWALArchiver: false
|
||||
- name: garage-local
|
||||
destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-18-cluster
|
||||
destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-17-cluster
|
||||
index: 1
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
endpointCredentials: freshrss-postgresql-18-cluster-backup-secret-garage
|
||||
endpointCredentials: freshrss-postgresql-17-cluster-backup-secret-garage
|
||||
endpointCredentialsIncludeRegion: true
|
||||
retentionPolicy: "3d"
|
||||
isWALArchiver: true
|
||||
# - name: external
|
||||
# destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/freshrss/freshrss-postgresql-18-cluster
|
||||
# index: 1
|
||||
# retentionPolicy: "30d"
|
||||
# isWALArchiver: false
|
||||
# - name: garage-remote
|
||||
# destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-18-cluster
|
||||
# destinationPath: s3://postgres-backups/cl01tl/freshrss/freshrss-postgresql-17-cluster
|
||||
# index: 1
|
||||
# endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
|
||||
# endpointCredentials: freshrss-postgresql-18-cluster-backup-secret-garage
|
||||
# endpointCredentials: freshrss-postgresql-17-cluster-backup-secret-garage
|
||||
# retentionPolicy: "30d"
|
||||
# data:
|
||||
# compression: bzip2
|
||||
# jobs: 2
|
||||
scheduledBackups:
|
||||
- name: daily-backup
|
||||
suspend: false
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: external
|
||||
- name: live-backup
|
||||
suspend: false
|
||||
immediate: true
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: garage-local
|
||||
# - name: daily-backup
|
||||
# suspend: false
|
||||
# immediate: true
|
||||
# schedule: "0 0 0 * * *"
|
||||
# backupName: external
|
||||
# - name: weekly-backup
|
||||
# suspend: true
|
||||
# immediate: true
|
||||
# schedule: "0 0 4 * * SAT"
|
||||
# suspend: false
|
||||
# schedule: "0 2 4 * * SAT"
|
||||
# backupName: garage-remote
|
||||
volsync-target-data:
|
||||
pvcTarget: freshrss-data
|
||||
moverSecurityContext:
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
supplementalGroups:
|
||||
- 44
|
||||
- 100
|
||||
- 109
|
||||
- 65539
|
||||
|
||||
@@ -1,9 +1,6 @@
|
||||
dependencies:
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.5.0
|
||||
digest: sha256:3d3469c5177b9501cbb34a5faf376fbe4d9b98bd033ad51ee51487a1c2f28d4e
|
||||
generated: "2025-12-15T22:10:00.495878-06:00"
|
||||
version: 4.4.0
|
||||
digest: sha256:7977708d7681e8d5cbc066bcda4241144b0c8b5b590be89a394740df167c90da
|
||||
generated: "2025-12-01T20:25:44.910074-06:00"
|
||||
|
||||
@@ -17,10 +17,6 @@ dependencies:
|
||||
- name: app-template
|
||||
alias: garage
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.5.0
|
||||
- name: volsync-target
|
||||
alias: volsync-target-db
|
||||
version: 0.5.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 4.4.0
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/kubernetes.png
|
||||
appVersion: v2.1.0
|
||||
|
||||
@@ -123,10 +123,9 @@ garage:
|
||||
mountPropagation: None
|
||||
subPath: garage.toml
|
||||
db:
|
||||
forceRename: garage-db
|
||||
storageClass: ceph-block
|
||||
accessMode: ReadWriteOnce
|
||||
size: 50Gi
|
||||
size: 10Gi
|
||||
retain: true
|
||||
advancedMounts:
|
||||
main:
|
||||
@@ -153,12 +152,3 @@ garage:
|
||||
main:
|
||||
- path: /var/lib/garage/snapshots
|
||||
readOnly: false
|
||||
volsync-target-db:
|
||||
pvcTarget: garage-db
|
||||
local:
|
||||
enabled: false
|
||||
remote:
|
||||
restic:
|
||||
cacheCapacity: 10Gi
|
||||
external:
|
||||
enabled: false
|
||||
|
||||
@@ -4,9 +4,6 @@ dependencies:
|
||||
version: 1.4.4
|
||||
- name: postgres-cluster
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 7.1.3
|
||||
- name: volsync-target
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.5.0
|
||||
digest: sha256:0d3204d714f085b6b4fd407dd50c7592980641486ce8dfe50d0aa1928a3f4c3f
|
||||
generated: "2025-12-17T16:09:38.535099581Z"
|
||||
version: 6.16.0
|
||||
digest: sha256:9424c70bc46b5582f19b695196586546c69862ccca8950b906d5532cf03c7792
|
||||
generated: "2025-12-01T19:55:44.159963-06:00"
|
||||
|
||||
@@ -21,12 +21,8 @@ dependencies:
|
||||
repository: https://twin.github.io/helm-charts
|
||||
version: 1.4.4
|
||||
- name: postgres-cluster
|
||||
alias: postgres-18-cluster
|
||||
version: 7.1.3
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
- name: volsync-target
|
||||
alias: volsync-target-data
|
||||
version: 0.5.0
|
||||
alias: postgres-17-cluster
|
||||
version: 6.16.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/gatus.png
|
||||
appVersion: v5.33.0
|
||||
appVersion: v5.12.0
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user