feat: overhaul

kubernetes/apps/default/lychee/app/externalsecret.yaml

@@ -4,30 +4,20 @@ apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: lychee
-  namespace: default
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: crunchy-pgo-secrets
   target:
     name: lychee-secret
     template:
       engineVersion: v2
       data:
-        # App
-        DB_HOST: &dbHost postgres16-rw.database.svc.cluster.local
-        DB_PORT: "5432"
-        DB_DATABASE: &dbName lychee
-        DB_USERNAME: &dbUser "{{ .POSTGRES_USERNAME }}"
-        DB_PASSWORD: &dbPass "{{ .POSTGRES_PASSWORD }}"
-        # Postgres Init
-        INIT_POSTGRES_DBNAME: *dbName
-        INIT_POSTGRES_HOST: *dbHost
-        INIT_POSTGRES_USER: *dbUser
-        INIT_POSTGRES_PASS: *dbPass
-        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_SUPER_PASS }}"
+        DB_HOST: '{{ index . "host" }}'
+        DB_PORT: '{{ index . "port" }}'
+        DB_DATABASE: '{{ index . "dbname" }}'
+        DB_USERNAME: '{{ index . "user" }}'
+        DB_PASSWORD: '{{ index . "password" }}'
   dataFrom:
     - extract:
-        key: cloudnative-pg
-    - extract:
-        key: lychee
+        key: postgres-pguser-lychee

kubernetes/apps/default/lychee/app/helmrelease.yaml

@@ -4,7 +4,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: &app lychee
-  namespace: default
 spec:
   interval: 30m
   chart:
@@ -32,14 +31,7 @@ spec:
       lychee:
         annotations:
           reloader.stakater.com/auto: "true"
-        initContainers:
-          init-db:
-            image:
-              repository: ghcr.io/onedr0p/postgres-init
-              tag: 16
-            envFrom: &envFrom
-              - secretRef:
-                  name: lychee-secret
+          secret.reloader.stakater.com/reload: lychee-db-secret
         containers:
           app:
             image:
@@ -54,24 +46,46 @@ spec:
               REDIS_HOST: dragonfly.database.svc.cluster.local.
               REDIS_PORT: 6379
               TRUSTED_PROXIES: "*"
-            envFrom: *envFrom
+            envFrom:
+              - secretRef:
+                  name: lychee-secret
             resources:
               requests:
                 cpu: 100m
                 memory: 256Mi
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet: &probeHttpGet
+                    path: /
+                    port: &port 80
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+              startup:
+                enabled: true
+                custom: true
+                spec:
+                  initialDelaySeconds: 0
+                  timeoutSeconds: 1
+                  periodSeconds: 10
+                  failureThreshold: 30
+                  httpGet: *probeHttpGet
     service:
       app:
         controller: *app
         ports:
           http:
-            port: 80
+            port: *port
     ingress:
       app:
         enabled: true
-        className: nginx
+        className: external
         annotations:
-          external-dns.alpha.kubernetes.io/enabled: "true"
-          external-dns.alpha.kubernetes.io/target: services.${SECRET_DOMAIN}.
           hajimari.io/icon: mdi:camera
           gethomepage.dev/enabled: "true"
           gethomepage.dev/name: Lychee

kubernetes/apps/default/lychee/app/kustomization.yaml

@@ -2,7 +2,6 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/kustomization.json
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: default
 resources:
   - ./externalsecret.yaml
   - ./helmrelease.yaml

kubernetes/apps/default/lychee/app/sync/helmrelease.yaml

@@ -4,7 +4,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: &app lychee-sync
-  namespace: default
 spec:
   interval: 30m
   chart:

kubernetes/apps/default/lychee/ks.yaml

@@ -1,11 +1,12 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: &app lychee
   namespace: flux-system
 spec:
+  targetNamespace: default
   commonMetadata:
     labels:
       app.kubernetes.io/name: *app
@@ -15,6 +16,7 @@ spec:
     kind: GitRepository
     name: home-ops-kubernetes
   dependsOn:
+    - name: crunchy-postgres-operator-cluster
     - name: dragonfly-cluster
     - name: external-secrets-stores
     - name: rook-ceph-cluster