feat: overhaul

kubernetes/apps/default/tandoor/app/externalsecret.yaml

@@ -4,7 +4,6 @@ apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: tandoor
-  namespace: default
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
@@ -13,23 +12,33 @@ spec:
     name: tandoor-secret
     template:
       data:
-        # App
-        DB_ENGINE: django.db.backends.postgresql_psycopg2
-        # DB_OPTIONS: '{"sslmode":"require"}'
         SECRET_KEY: "{{ .TANDOOR_SECRET_KEY }}"
-        POSTGRES_HOST: &dbHost postgres16-rw.database.svc.cluster.local
-        POSTGRES_PORT: "5432"
-        POSTGRES_DB: &dbName tandoor
-        POSTGRES_USER: &dbUser "{{ .TANDOOR_POSTGRES_USER }}"
-        POSTGRES_PASSWORD:  &dbPass "{{ .TANDOOR_POSTGRES_PASS }}"
-        # Postgres Init
-        INIT_POSTGRES_DBNAME: *dbName
-        INIT_POSTGRES_HOST: *dbHost
-        INIT_POSTGRES_USER: *dbUser
-        INIT_POSTGRES_PASS: *dbPass
-        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_SUPER_PASS }}"
   dataFrom:
     - extract:
         key: cloudnative-pg
     - extract:
         key: tandoor
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: tandoor-db
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: crunchy-pgo-secrets
+  target:
+    name: tandoor-db-secret
+    template:
+      engineVersion: v2
+      data:
+        DB_ENGINE: django.db.backends.postgresql_psycopg2
+        POSTGRES_HOST: '{{ index . "host" }}'
+        POSTGRES_PORT: '{{ index . "port" }}'
+        POSTGRES_DB: '{{ index . "dbname" }}'
+        POSTGRES_USER: '{{ index . "user" }}'
+        POSTGRES_PASSWORD:  '{{ index . "password" }}'
+  dataFrom:
+    - extract:
+        key: postgres-pguser-tandoor

kubernetes/apps/default/tandoor/app/helmrelease.yaml

@@ -4,7 +4,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: &app tandoor
-  namespace: &ns default
 spec:
   interval: 30m
   chart:
@@ -36,19 +35,17 @@ spec:
       tandoor:
         annotations:
           reloader.stakater.com/auto: "true"
+          secret.reloader.stakater.com/reload: lychee-db-secret
         initContainers:
-          init-db:
-            image:
-              repository: ghcr.io/onedr0p/postgres-init
-              tag: 16
-            envFrom: &envFrom
-              - secretRef:
-                  name: tandoor-secret
           migrations:
             image:
               repository: vabene1111/recipes
               tag: 1.5.26@sha256:2de2de6c1ad5e4ea85f605112985d70079dad7b4118bd13e4087cde2dd411457
-            envFrom: *envFrom
+            envFrom: &envFrom
+              - secretRef:
+                  name: tandoor-secret
+              - secretRef:
+                  name: tandoor-db-secret
             command:
             - sh
             - -c
@@ -106,7 +103,7 @@ spec:
     ingress:
       app:
         enabled: true
-        className: nginx
+        className: internal
         annotations:
           hajimari.io/icon: mdi:chef-hat
           gethomepage.dev/enabled: "true"