diff --git a/kubernetes/apps/default/cloudnative-pg/cluster/backups/external-backup.yaml b/kubernetes/apps/default/cloudnative-pg/cluster/backups/external-backup.yaml index 2f650aa86..d93168286 100644 --- a/kubernetes/apps/default/cloudnative-pg/cluster/backups/external-backup.yaml +++ b/kubernetes/apps/default/cloudnative-pg/cluster/backups/external-backup.yaml @@ -20,7 +20,7 @@ spec: - name: POSTGRES_HOST value: ${POSTGRES_HOST} - name: POSTGRES_DB - value: "authelia,drone,freshrss,gitea,invidious,joplin,lychee,paperless,semaphore,sharry,tandoor,outline,vaultwarden,vikunja,wallabag" + value: "authelia,drone,firefly-iii,freshrss,gitea,invidious,joplin,lychee,paperless,semaphore,sharry,tandoor,outline,vaultwarden,vikunja,wallabag" - name: POSTGRES_USER valueFrom: secretKeyRef: diff --git a/kubernetes/apps/default/firefly-iii/app/backups/kustomization.yaml b/kubernetes/apps/default/firefly-iii/app/backups/kustomization.yaml new file mode 100644 index 000000000..57bca902d --- /dev/null +++ b/kubernetes/apps/default/firefly-iii/app/backups/kustomization.yaml @@ -0,0 +1,7 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./replicationsource.yaml + - ./restic.sops.yaml diff --git a/kubernetes/apps/default/firefly-iii/app/backups/replicationsource.yaml b/kubernetes/apps/default/firefly-iii/app/backups/replicationsource.yaml new file mode 100644 index 000000000..6538c50b0 --- /dev/null +++ b/kubernetes/apps/default/firefly-iii/app/backups/replicationsource.yaml @@ -0,0 +1,21 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json +apiVersion: volsync.backube/v1alpha1 +kind: ReplicationSource +metadata: + name: firefly-iii + namespace: default +spec: + sourcePVC: firefly-iii-config + trigger: + schedule: "0 0 * * *" + restic: + copyMethod: Snapshot + pruneIntervalDays: 10 + repository: firefly-iii-restic + cacheCapacity: 2Gi + volumeSnapshotClassName: csi-ceph-blockpool + storageClassName: rook-ceph-block + retain: + daily: 10 + within: 3d diff --git a/kubernetes/apps/default/firefly-iii/app/backups/restic.sops.yaml b/kubernetes/apps/default/firefly-iii/app/backups/restic.sops.yaml new file mode 100644 index 000000000..b37dc7dd0 --- /dev/null +++ b/kubernetes/apps/default/firefly-iii/app/backups/restic.sops.yaml @@ -0,0 +1,35 @@ +apiVersion: v1 +kind: Secret +metadata: + name: firefly-iii-restic + namespace: default +type: Opaque +stringData: + #ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment] + RESTIC_REPOSITORY: ENC[AES256_GCM,data:6LyAyrcpadw4k54eIuZXmwA/VUpEhu0vdiv9A3PmKON+c+NJapQS2SkkJZ5ZRzvxzhAl3QRqrh2W23waUg==,iv:afDeELcTvPXp06kjm7xtNt6Z6DNBhCY6AHpPcsGD5s8=,tag:+SZzGfvonhiYgbpwl+5Rwg==,type:str] + #ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment] + RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str] + #ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment] + #ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment] + AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str] + AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ + THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB + TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN + dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4 + 3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2023-04-17T15:41:24Z" + mac: ENC[AES256_GCM,data:4Mdw4S0kLhuVvmmgiSmDvSRge27vzXHLMgHeZ889D4CogVwBOZVlOhHfR4PRY9ETO/7YC9iCWmK47e3Gu3cJId1Fxy0R46vOtk9ymySqn6yydJ+N3zjgaJIgCqnzsx9OoXjqX9NCdpuwWgyzM7R2jk/VbMXISV9DWSRiqP2Dc5c=,iv:xmg69s0AeXXAZMA8YvuMlea5PAPsyVkWBfaMhoccYZA=,tag:sXe233lgl15DspA3gfgR/g==,type:str] + pgp: [] + encrypted_regex: ^(data|stringData)$ + version: 3.7.3 diff --git a/kubernetes/apps/default/firefly-iii/app/helmrelease.yaml b/kubernetes/apps/default/firefly-iii/app/helmrelease.yaml new file mode 100644 index 000000000..e543612be --- /dev/null +++ b/kubernetes/apps/default/firefly-iii/app/helmrelease.yaml @@ -0,0 +1,78 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helmrelease_v2beta1.json +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: &app firefly-iii + namespace: default +spec: + interval: 15m + chart: + spec: + chart: app-template + version: 1.4.0 + sourceRef: + kind: HelmRepository + name: bjw-s + namespace: flux-system + maxHistory: 3 + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: + controller: + annotations: + reloader.stakater.com/auto: "true" + image: + repository: fireflyiii/core + tag: version-6.0.8 + service: + main: + ports: + http: + port: 8080 + env: + TZ: ${TIMEZONE} + APP_URL: "https://cash.${SECRET_DOMAIN}" + DB_CONNECTION: "pgsql" + DB_HOST: "${POSTGRES_HOST}" + DB_PORT: "5432" + DB_DATABASE: *app + MAIL_MAILER: log + TRUSTED_PROXIES: "**" + SEND_REGISTRATION_MAIL: false + SEND_ERROR_MESSAGE: false + SEND_LOGIN_NEW_IP_WARNING: false + envFrom: + - secretRef: + name: firefly-iii-secret + persistence: + config: + enabled: true + existingClaim: firefly-iii-config + mountPath: /var/www/html/firefly-iii/storage/upload + ingress: + main: + enabled: true + ingressClassName: "nginx" + annotations: + hajimari.io/icon: mdi:cash + hosts: + - host: &host "cash.${SECRET_CLUSTER_DOMAIN}" + paths: + - path: / + pathType: Prefix + tls: + - hosts: + - *host + resources: + requests: + cpu: 100m + memory: 256Mi diff --git a/kubernetes/apps/default/firefly-iii/app/importer/helmrelease.yaml b/kubernetes/apps/default/firefly-iii/app/importer/helmrelease.yaml new file mode 100644 index 000000000..c780a0cde --- /dev/null +++ b/kubernetes/apps/default/firefly-iii/app/importer/helmrelease.yaml @@ -0,0 +1,70 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helmrelease_v2beta1.json +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: &app firefly-iii-data-importer + namespace: default +spec: + interval: 15m + chart: + spec: + chart: app-template + version: 1.4.0 + sourceRef: + kind: HelmRepository + name: bjw-s + namespace: flux-system + maxHistory: 3 + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: + controller: + annotations: + reloader.stakater.com/auto: "true" + image: + repository: fireflyiii/data-importer + tag: version-1.2.2 + service: + main: + ports: + http: + port: 8080 + env: + TRUSTED_PROXIES: "**" + FIREFLY_III_URL: "http://firefly-iii.default.svc.cluster.local:8080" + VANITY_URL: "https://cash.${SECRET_DOMAIN}" + envFrom: + - secretRef: + name: firefly-iii-secret + persistence: + config: + enabled: true + existingClaim: firefly-iii-config + mountPath: /var/www/html/firefly-iii/storage/upload + ingress: + main: + enabled: true + ingressClassName: "nginx" + annotations: + hajimari.io/icon: foundation:page-export-csv + hosts: + - host: &host "firefly-data-importer.${SECRET_CLUSTER_DOMAIN}" + paths: + - path: / + pathType: Prefix + tls: + - hosts: + - *host + resources: + requests: + cpu: 100m + memory: 256Mi diff --git a/kubernetes/apps/default/firefly-iii/app/importer/kustomization.yaml b/kubernetes/apps/default/firefly-iii/app/importer/kustomization.yaml new file mode 100644 index 000000000..5b48b4e26 --- /dev/null +++ b/kubernetes/apps/default/firefly-iii/app/importer/kustomization.yaml @@ -0,0 +1,7 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: default +resources: + - ./helmrelease.yaml diff --git a/kubernetes/apps/default/firefly-iii/app/kustomization.yaml b/kubernetes/apps/default/firefly-iii/app/kustomization.yaml new file mode 100644 index 000000000..ec111867e --- /dev/null +++ b/kubernetes/apps/default/firefly-iii/app/kustomization.yaml @@ -0,0 +1,12 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: default +resources: + - ./backups + - ./helmrelease.yaml + - ./secret.sops.yaml + - ./volume.yaml +patchesStrategicMerge: + - ./patches/postgres.yaml diff --git a/kubernetes/apps/default/firefly-iii/app/patches/postgres.yaml b/kubernetes/apps/default/firefly-iii/app/patches/postgres.yaml new file mode 100644 index 000000000..993b66625 --- /dev/null +++ b/kubernetes/apps/default/firefly-iii/app/patches/postgres.yaml @@ -0,0 +1,32 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helmrelease_v2beta1.json +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: firefly-iii + namespace: default +spec: + values: + initContainers: + init-db: + image: ghcr.io/onedr0p/postgres-initdb:14.7 + env: + - name: POSTGRES_HOST + value: ${POSTGRES_HOST} + - name: POSTGRES_DB + value: firefly-iii + - name: POSTGRES_SUPER_PASS + valueFrom: + secretKeyRef: + name: postgres-superuser + key: password + - name: POSTGRES_USER + valueFrom: + secretKeyRef: + name: firefly-iii-secret + key: DB_USERNAME + - name: POSTGRES_PASS + valueFrom: + secretKeyRef: + name: firefly-iii-secret + key: DB_PASSWORD diff --git a/kubernetes/apps/default/firefly-iii/app/secret.sops.yaml b/kubernetes/apps/default/firefly-iii/app/secret.sops.yaml new file mode 100644 index 000000000..55807f23d --- /dev/null +++ b/kubernetes/apps/default/firefly-iii/app/secret.sops.yaml @@ -0,0 +1,32 @@ +# yamllint disable +apiVersion: v1 +kind: Secret +metadata: + name: firefly-iii-secret + namespace: default +type: Opaque +stringData: + APP_KEY: ENC[AES256_GCM,data:NLGN6FyBlsnIJQJlfu/hGPTE1WPPs1Vw2oUE71MwXmc=,iv:TCwaM/NH+1TOU76fKc6tyV9mxieUcI3IAxeumv+e2wo=,tag:MWPaCl39dEyt6UXOvKLiuQ==,type:str] + DB_USERNAME: ENC[AES256_GCM,data:K/HOy/nGdg==,iv:1bmBakA39Z9I19wvbDf9pdEnoeLfyyp6H3LBPMD/VjU=,tag:1bOb34XHnxFZqTnzMAXs0A==,type:str] + DB_PASSWORD: ENC[AES256_GCM,data:TCMJIdYJUda28KeoPNLOotbrFy8=,iv:IkXyzoKKlSrWUEog/KsiJeidnpFQbbaZDCcFlfys0zU=,tag:9on2I0Xzk5eB61/FDl+06Q==,type:str] + FIREFLY_III_ACCESS_TOKEN: ENC[AES256_GCM,data:1wvSr8l8YPaewwM/MFPYCDEuNv9thV49bSwLfchbPilio911qjriTVu7YWLnVe6UgXbdiQYMTmN91GgT1ss64ByyNHhqT59voQ4noT69Otbb7T/KPF7IAgLC9vKfs6/T+fcJwMzkP+tHbITCRzdwv+T8sjfX8qmLwWgVjLrF8f8TemF8z08K6uOqQiEWnV5zqotEnbnW22bEhTcNPbS0bayETpy0/39mN4OvLET+KGcO8LPNIWzObgq80pat8wsUNyfNp9h/I+8IRWwh9X1OCsJe8dJ6O3wynaqwyaccu0D2009DUW1i3+5sixz0l9eKVc9nmOuiFa3ghLCEjqZTvEP4NFlFdD6qeVQ9e+3hXAV8ufkDF3Cf98gvvkKjIWbxjSsjCHLHXFfQpHDAjYsKFBOGJjZv0kxdqavF7av1GE0SbMGfatviyEwFqJh38RG9Gj1KoK8jOdG+kQU7PGA0HbhPI6QM7nU1kJzKgwUlfZd7bduCdBBPYaU5GkuCmygD2cbUG3xmaI+F8Rchut85j8kseIkQn7SzxekpXaIWpZ0nBFF3xB2S+2xfkzTAtxrjvp2Ej16r515Q8wE1mbk0S+1zA45BaMhpUsZsXUOvdclIoa7kg9Vfa+bhHaqpnW52sp0fTd2vj+dl/HLlVeMOpAyPpe6A82BxkrgoPA+rfZwBLd9v1AwaFIuSBc4D4d2b8lCJnbM7iuDuZZRNPBC4T2R27RjXiqbbtXYD1MalkpS+M2PwTYwS/s5T0oc10OmIh0QPGqtxb7lgQsN2Sgg2oFjGywb1P3SV9GIQBDK4SDgMSLKuVnJO6WdcYuHTBIuxSzjfVyQ0BuH3NhxQECwO5DYuXwx/7Dc4IeNuagX7Hl7vKua4JRjdF8XWdePBz9LdZ/CraWhX5bXfOypCpNWIuVLRk3pd7Dpf/Fq5dTJo774plPnPG/RHUNOK2ws2Y4S81i2qSDLw3tdKlGO3jTz6uEd67SwQ27Uw9XR5MaPaM7vuS7wvuOyeDTuJ2SwNWazQlUANw9WUlRiB75uOqjcu9dLVwbldZJpZ/lIb/2iQYMrzxodS3G9Dbqbwm0hCzCQQIlWvYjAEpotmZPA7CTsdxRIc7Uwy3GUIxcb0GZ0uCl2t+PwdDSjRXuuhWj7dzZg0WgJV/v+H+1TIomvjRPmgXru0dd7mUz4JU2Mloi/tVXcqAZpmEo5i9pqgRQfXyFcXV+2M+E/xUcPN1YVoQMuhCr/Dy5cg7c29pbLBfDpZsPmu3c3ER2Q3a1U0YPHFo0Gy8KEfejhyCkHsrX1Htq4MjcteLco=,iv:4Li737+2osPRFNOlrGhjXiw1nMUYHAt3MCraJhafl1Y=,tag:7kgrpub9cwQ2D4W+KQw9HA==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaU16anJNV2pBZmxPR3h2 + bWREUnpjcTFvd05ZQ2E4VVBDdm1FL2k4WEYwCkdQSStTNWtpdjNkUW51WS9MekdC + VkpTUUFjSjY2a1JMOUtqOVh5M0JRR2sKLS0tIDRmcWpJSEVvaUp4U1lsaTZYZGNw + OGVKWU0zNUZJSFh4aFJxQWFsYm1VeFkKaDeI/hl7z0Qh8t5W39Kxu9ert1dt4xo+ + LX+MjpVqxiZNcfwROD4bkWeQSN+VsxoGOOyj4L15BlggNnlg+L7Hww== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2023-04-17T16:49:46Z" + mac: ENC[AES256_GCM,data:PhQy1ewerdHDAcSGw8EYXSpocB/fVZr38cUGGdFSIlaMK2o0NVOTutValrpgQhAnZWN5hPzcfDlqtMWCxNThsZSgoKSVmU8eZQ9bhlQzzlaoctUQQ+ZVSrP5l2AHuUK2a50i3bWpijms+2i6HDhmCi8xSWhZ49eYoM2jcJjH03s=,iv:CTQI3E25UOXmMHfpYcNKbk7NAIzYPuXmtDEUvjkWJgo=,tag:dSb6cTEnYVBJiEVxmtxP3g==,type:str] + pgp: [] + encrypted_regex: ^(data|stringData)$ + version: 3.7.3 diff --git a/kubernetes/apps/default/firefly-iii/app/volume.yaml b/kubernetes/apps/default/firefly-iii/app/volume.yaml new file mode 100644 index 000000000..085d25087 --- /dev/null +++ b/kubernetes/apps/default/firefly-iii/app/volume.yaml @@ -0,0 +1,17 @@ +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: firefly-iii-config + namespace: default + labels: + app.kubernetes.io/name: &name firefly-iii + app.kubernetes.io/instance: *name + snapshot.home.arpa/enabled: "true" +spec: + accessModes: + - ReadWriteOnce + storageClassName: rook-ceph-block + resources: + requests: + storage: 1Gi diff --git a/kubernetes/apps/default/firefly-iii/ks.yaml b/kubernetes/apps/default/firefly-iii/ks.yaml new file mode 100644 index 000000000..3a38af9b9 --- /dev/null +++ b/kubernetes/apps/default/firefly-iii/ks.yaml @@ -0,0 +1,55 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/kustomization_v1beta2.json +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-firefly-iii + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + path: ./kubernetes/apps/default/firefly-iii/app + prune: true + sourceRef: + kind: GitRepository + name: home-ops-kubernetes + dependsOn: + - name: cluster-apps-cloudnative-pg-cluster + - name: cluster-apps-rook-ceph-cluster + - name: cluster-apps-volsync-app + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2beta1 + kind: HelmRelease + name: firefly-iii + namespace: default + interval: 30m + retryInterval: 1m + timeout: 3m +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/kustomization_v1beta2.json +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-firefly-iii-data-importer + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + path: ./kubernetes/apps/default/firefly-iii/app/importer + prune: true + sourceRef: + kind: GitRepository + name: home-ops-kubernetes + dependsOn: + - name: cluster-apps-cloudnative-pg-cluster + - name: cluster-apps-firefly-iii + - name: cluster-apps-rook-ceph-cluster + - name: cluster-apps-volsync-app + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2beta1 + kind: HelmRelease + name: firefly-iii + namespace: default + interval: 30m + retryInterval: 1m + timeout: 3m diff --git a/kubernetes/apps/default/kustomization.yaml b/kubernetes/apps/default/kustomization.yaml index 79ab5390d..7e95d0712 100644 --- a/kubernetes/apps/default/kustomization.yaml +++ b/kubernetes/apps/default/kustomization.yaml @@ -14,6 +14,7 @@ resources: - ./cloudnative-pg/ks.yaml - ./drone/ks.yaml - ./emqx/ks.yaml + - ./firefly-iii/ks.yaml - ./flood/ks.yaml - ./freshrss/ks.yaml - ./gitea/ks.yaml