✨ firefly-iii

2025-09-17 18:24:14 +02:00 · 2023-04-17 17:42:46 +02:00
parent 8b5f68c9b5
commit 3c6fe82646
13 changed files with 368 additions and 1 deletions
--- a/kubernetes/apps/default/firefly-iii/app/backups/kustomization.yaml
+++ b/kubernetes/apps/default/firefly-iii/app/backups/kustomization.yaml
@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./replicationsource.yaml
+  - ./restic.sops.yaml
--- a/kubernetes/apps/default/firefly-iii/app/backups/replicationsource.yaml
+++ b/kubernetes/apps/default/firefly-iii/app/backups/replicationsource.yaml
@@ -0,0 +1,21 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: firefly-iii
+  namespace: default
+spec:
+  sourcePVC: firefly-iii-config
+  trigger:
+    schedule: "0 0 * * *"
+  restic:
+    copyMethod: Snapshot
+    pruneIntervalDays: 10
+    repository: firefly-iii-restic
+    cacheCapacity: 2Gi
+    volumeSnapshotClassName: csi-ceph-blockpool
+    storageClassName: rook-ceph-block
+    retain:
+      daily: 10
+      within: 3d
--- a/kubernetes/apps/default/firefly-iii/app/backups/restic.sops.yaml
+++ b/kubernetes/apps/default/firefly-iii/app/backups/restic.sops.yaml
@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: firefly-iii-restic
+    namespace: default
+type: Opaque
+stringData:
+    #ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment]
+    RESTIC_REPOSITORY: ENC[AES256_GCM,data:6LyAyrcpadw4k54eIuZXmwA/VUpEhu0vdiv9A3PmKON+c+NJapQS2SkkJZ5ZRzvxzhAl3QRqrh2W23waUg==,iv:afDeELcTvPXp06kjm7xtNt6Z6DNBhCY6AHpPcsGD5s8=,tag:+SZzGfvonhiYgbpwl+5Rwg==,type:str]
+    #ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment]
+    RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str]
+    #ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment]
+    #ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment]
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ
+            THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB
+            TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN
+            dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4
+            3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-04-17T15:41:24Z"
+    mac: ENC[AES256_GCM,data:4Mdw4S0kLhuVvmmgiSmDvSRge27vzXHLMgHeZ889D4CogVwBOZVlOhHfR4PRY9ETO/7YC9iCWmK47e3Gu3cJId1Fxy0R46vOtk9ymySqn6yydJ+N3zjgaJIgCqnzsx9OoXjqX9NCdpuwWgyzM7R2jk/VbMXISV9DWSRiqP2Dc5c=,iv:xmg69s0AeXXAZMA8YvuMlea5PAPsyVkWBfaMhoccYZA=,tag:sXe233lgl15DspA3gfgR/g==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3
--- a/kubernetes/apps/default/firefly-iii/app/helmrelease.yaml
+++ b/kubernetes/apps/default/firefly-iii/app/helmrelease.yaml
@@ -0,0 +1,78 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app firefly-iii
+  namespace: default
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.4.0
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  maxHistory: 3
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    controller:
+      annotations:
+        reloader.stakater.com/auto: "true"
+    image:
+      repository: fireflyiii/core
+      tag: version-6.0.8
+    service:
+      main:
+        ports:
+          http:
+            port: 8080
+    env:
+      TZ: ${TIMEZONE}
+      APP_URL: "https://cash.${SECRET_DOMAIN}"
+      DB_CONNECTION: "pgsql"
+      DB_HOST: "${POSTGRES_HOST}"
+      DB_PORT: "5432"
+      DB_DATABASE: *app
+      MAIL_MAILER: log
+      TRUSTED_PROXIES: "**"
+      SEND_REGISTRATION_MAIL: false
+      SEND_ERROR_MESSAGE: false
+      SEND_LOGIN_NEW_IP_WARNING: false
+    envFrom:
+      - secretRef:
+          name: firefly-iii-secret
+    persistence:
+      config:
+        enabled: true
+        existingClaim: firefly-iii-config
+        mountPath: /var/www/html/firefly-iii/storage/upload
+    ingress:
+      main:
+        enabled: true
+        ingressClassName: "nginx"
+        annotations:
+          hajimari.io/icon: mdi:cash
+        hosts:
+          - host: &host "cash.${SECRET_CLUSTER_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
--- a/kubernetes/apps/default/firefly-iii/app/importer/helmrelease.yaml
+++ b/kubernetes/apps/default/firefly-iii/app/importer/helmrelease.yaml
@@ -0,0 +1,70 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app firefly-iii-data-importer
+  namespace: default
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.4.0
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  maxHistory: 3
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    controller:
+      annotations:
+        reloader.stakater.com/auto: "true"
+    image:
+      repository: fireflyiii/data-importer
+      tag: version-1.2.2
+    service:
+      main:
+        ports:
+          http:
+            port: 8080
+    env:
+      TRUSTED_PROXIES: "**"
+      FIREFLY_III_URL: "http://firefly-iii.default.svc.cluster.local:8080"
+      VANITY_URL: "https://cash.${SECRET_DOMAIN}"
+    envFrom:
+      - secretRef:
+          name: firefly-iii-secret
+    persistence:
+      config:
+        enabled: true
+        existingClaim: firefly-iii-config
+        mountPath: /var/www/html/firefly-iii/storage/upload
+    ingress:
+      main:
+        enabled: true
+        ingressClassName: "nginx"
+        annotations:
+          hajimari.io/icon: foundation:page-export-csv
+        hosts:
+          - host: &host "firefly-data-importer.${SECRET_CLUSTER_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
--- a/kubernetes/apps/default/firefly-iii/app/importer/kustomization.yaml
+++ b/kubernetes/apps/default/firefly-iii/app/importer/kustomization.yaml
@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: default
+resources:
+  - ./helmrelease.yaml
--- a/kubernetes/apps/default/firefly-iii/app/kustomization.yaml
+++ b/kubernetes/apps/default/firefly-iii/app/kustomization.yaml
@@ -0,0 +1,12 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: default
+resources:
+  - ./backups
+  - ./helmrelease.yaml
+  - ./secret.sops.yaml
+  - ./volume.yaml
+patchesStrategicMerge:
+  - ./patches/postgres.yaml
--- a/kubernetes/apps/default/firefly-iii/app/patches/postgres.yaml
+++ b/kubernetes/apps/default/firefly-iii/app/patches/postgres.yaml
@@ -0,0 +1,32 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: firefly-iii
+  namespace: default
+spec:
+  values:
+    initContainers:
+      init-db:
+        image: ghcr.io/onedr0p/postgres-initdb:14.7
+        env:
+          - name: POSTGRES_HOST
+            value: ${POSTGRES_HOST}
+          - name: POSTGRES_DB
+            value: firefly-iii
+          - name: POSTGRES_SUPER_PASS
+            valueFrom:
+              secretKeyRef:
+                name: postgres-superuser
+                key: password
+          - name: POSTGRES_USER
+            valueFrom:
+              secretKeyRef:
+                name: firefly-iii-secret
+                key: DB_USERNAME
+          - name: POSTGRES_PASS
+            valueFrom:
+              secretKeyRef:
+                name: firefly-iii-secret
+                key: DB_PASSWORD
--- a/kubernetes/apps/default/firefly-iii/app/secret.sops.yaml
+++ b/kubernetes/apps/default/firefly-iii/app/secret.sops.yaml
@@ -0,0 +1,32 @@
+# yamllint disable
+apiVersion: v1
+kind: Secret
+metadata:
+    name: firefly-iii-secret
+    namespace: default
+type: Opaque
+stringData:
+    APP_KEY: ENC[AES256_GCM,data:NLGN6FyBlsnIJQJlfu/hGPTE1WPPs1Vw2oUE71MwXmc=,iv:TCwaM/NH+1TOU76fKc6tyV9mxieUcI3IAxeumv+e2wo=,tag:MWPaCl39dEyt6UXOvKLiuQ==,type:str]
+    DB_USERNAME: ENC[AES256_GCM,data:K/HOy/nGdg==,iv:1bmBakA39Z9I19wvbDf9pdEnoeLfyyp6H3LBPMD/VjU=,tag:1bOb34XHnxFZqTnzMAXs0A==,type:str]
+    DB_PASSWORD: ENC[AES256_GCM,data:TCMJIdYJUda28KeoPNLOotbrFy8=,iv:IkXyzoKKlSrWUEog/KsiJeidnpFQbbaZDCcFlfys0zU=,tag:9on2I0Xzk5eB61/FDl+06Q==,type:str]
+    FIREFLY_III_ACCESS_TOKEN: ENC[AES256_GCM,data:1wvSr8l8YPaewwM/MFPYCDEuNv9thV49bSwLfchbPilio911qjriTVu7YWLnVe6UgXbdiQYMTmN91GgT1ss64ByyNHhqT59voQ4noT69Otbb7T/KPF7IAgLC9vKfs6/T+fcJwMzkP+tHbITCRzdwv+T8sjfX8qmLwWgVjLrF8f8TemF8z08K6uOqQiEWnV5zqotEnbnW22bEhTcNPbS0bayETpy0/39mN4OvLET+KGcO8LPNIWzObgq80pat8wsUNyfNp9h/I+8IRWwh9X1OCsJe8dJ6O3wynaqwyaccu0D2009DUW1i3+5sixz0l9eKVc9nmOuiFa3ghLCEjqZTvEP4NFlFdD6qeVQ9e+3hXAV8ufkDF3Cf98gvvkKjIWbxjSsjCHLHXFfQpHDAjYsKFBOGJjZv0kxdqavF7av1GE0SbMGfatviyEwFqJh38RG9Gj1KoK8jOdG+kQU7PGA0HbhPI6QM7nU1kJzKgwUlfZd7bduCdBBPYaU5GkuCmygD2cbUG3xmaI+F8Rchut85j8kseIkQn7SzxekpXaIWpZ0nBFF3xB2S+2xfkzTAtxrjvp2Ej16r515Q8wE1mbk0S+1zA45BaMhpUsZsXUOvdclIoa7kg9Vfa+bhHaqpnW52sp0fTd2vj+dl/HLlVeMOpAyPpe6A82BxkrgoPA+rfZwBLd9v1AwaFIuSBc4D4d2b8lCJnbM7iuDuZZRNPBC4T2R27RjXiqbbtXYD1MalkpS+M2PwTYwS/s5T0oc10OmIh0QPGqtxb7lgQsN2Sgg2oFjGywb1P3SV9GIQBDK4SDgMSLKuVnJO6WdcYuHTBIuxSzjfVyQ0BuH3NhxQECwO5DYuXwx/7Dc4IeNuagX7Hl7vKua4JRjdF8XWdePBz9LdZ/CraWhX5bXfOypCpNWIuVLRk3pd7Dpf/Fq5dTJo774plPnPG/RHUNOK2ws2Y4S81i2qSDLw3tdKlGO3jTz6uEd67SwQ27Uw9XR5MaPaM7vuS7wvuOyeDTuJ2SwNWazQlUANw9WUlRiB75uOqjcu9dLVwbldZJpZ/lIb/2iQYMrzxodS3G9Dbqbwm0hCzCQQIlWvYjAEpotmZPA7CTsdxRIc7Uwy3GUIxcb0GZ0uCl2t+PwdDSjRXuuhWj7dzZg0WgJV/v+H+1TIomvjRPmgXru0dd7mUz4JU2Mloi/tVXcqAZpmEo5i9pqgRQfXyFcXV+2M+E/xUcPN1YVoQMuhCr/Dy5cg7c29pbLBfDpZsPmu3c3ER2Q3a1U0YPHFo0Gy8KEfejhyCkHsrX1Htq4MjcteLco=,iv:4Li737+2osPRFNOlrGhjXiw1nMUYHAt3MCraJhafl1Y=,tag:7kgrpub9cwQ2D4W+KQw9HA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaU16anJNV2pBZmxPR3h2
+            bWREUnpjcTFvd05ZQ2E4VVBDdm1FL2k4WEYwCkdQSStTNWtpdjNkUW51WS9MekdC
+            VkpTUUFjSjY2a1JMOUtqOVh5M0JRR2sKLS0tIDRmcWpJSEVvaUp4U1lsaTZYZGNw
+            OGVKWU0zNUZJSFh4aFJxQWFsYm1VeFkKaDeI/hl7z0Qh8t5W39Kxu9ert1dt4xo+
+            LX+MjpVqxiZNcfwROD4bkWeQSN+VsxoGOOyj4L15BlggNnlg+L7Hww==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-04-17T16:49:46Z"
+    mac: ENC[AES256_GCM,data:PhQy1ewerdHDAcSGw8EYXSpocB/fVZr38cUGGdFSIlaMK2o0NVOTutValrpgQhAnZWN5hPzcfDlqtMWCxNThsZSgoKSVmU8eZQ9bhlQzzlaoctUQQ+ZVSrP5l2AHuUK2a50i3bWpijms+2i6HDhmCi8xSWhZ49eYoM2jcJjH03s=,iv:CTQI3E25UOXmMHfpYcNKbk7NAIzYPuXmtDEUvjkWJgo=,tag:dSb6cTEnYVBJiEVxmtxP3g==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3
--- a/kubernetes/apps/default/firefly-iii/app/volume.yaml
+++ b/kubernetes/apps/default/firefly-iii/app/volume.yaml
@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: firefly-iii-config
+  namespace: default
+  labels:
+    app.kubernetes.io/name: &name firefly-iii
+    app.kubernetes.io/instance: *name
+    snapshot.home.arpa/enabled: "true"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: rook-ceph-block
+  resources:
+    requests:
+      storage: 1Gi