shpaq/auricom-home-cluster
1
0
Fork 0
mirror of https://github.com/auricom/home-cluster.git synced 2025-09-17 18:24:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

🚀 outline

Browse Source
This commit is contained in:
auricom
2022-09-13 01:04:44 +02:00
parent 1105dfa33a
commit be8f791495
9 changed files with 307 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
.github/linters/.markdownlint.yaml vendored
View File

@@ -8,28 +8,16 @@ MD013:
# Number of characters for headings # Number of characters for headings
heading_line_length: 80 heading_line_length: 80
# Number of characters for code blocks # Number of characters for code blocks
code_block_line_length: 80 code_block_line_length: 300
# Include code blocks # Include code blocks
code_blocks: true code_blocks: true
# Include tables # Include tables
tables: true tables: true
# Include headings # Include headings
headings: true headings: true
# Include headers # Include headings
headers: true headers: true
# Strict length checking # Strict length checking
strict: false strict: false
# Stern length checking # Stern length checking
stern: false stern: false
# MD026/no-trailing-punctuation - Trailing punctuation in heading
MD026:
# Punctuation characters
punctuation: "："
# MD033/no-inline-html - Inline HTML
MD033:
# Allowed elements
allowed_elements:
- br
- img

6
cluster/apps/documentation/kustomization.yaml Normal file
View File

@@ -0,0 +1,6 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: default
resources:
- outline

69
cluster/apps/documentation/outline/helm-release.yaml Normal file
View File

@@ -0,0 +1,69 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: &app outline
namespace: default
spec:
interval: 15m
chart:
spec:
chart: app-template
version: 0.1.1
sourceRef:
kind: HelmRepository
name: bjw-s-charts
namespace: flux-system
install:
createNamespace: true
remediation:
retries: 5
upgrade:
remediation:
retries: 5
dependsOn:
- name: redis
namespace: default
values:
controller:
replicas: 1
strategy: RollingUpdate
image:
repository: docker.io/outlinewiki/outline
tag: 0.66.0
envFrom:
- secretRef:
name: *app
command: ["/bin/sh", "-c", "yarn db:migrate && yarn start"]
service:
main:
ports:
http:
port: 80
ingress:
main:
enabled: true
ingressClassName: "nginx"
hosts:
- host: &host "docs.${SECRET_CLUSTER_DOMAIN}"
paths:
- path: /
pathType: Prefix
tls:
- hosts:
- *host
podAnnotations:
secret.reloader.stakater.com/reload: *app
topologySpreadConstraints:
- maxSkew: 1
topologyKey: kubernetes.io/hostname
whenUnsatisfiable: DoNotSchedule
labelSelector:
matchLabels:
app.kubernetes.io/name: *app
resources:
requests:
cpu: 10m
memory: 50Mi
limits:
memory: 500Mi

10
cluster/apps/documentation/outline/kustomization.yaml Normal file
View File

@@ -0,0 +1,10 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: default
resources:
- secret.sops.yaml
- helm-release.yaml
patchesStrategicMerge:
- patches/env.yaml
# - patches/postgres.yaml

33
cluster/apps/documentation/outline/patches/env.yaml Normal file
View File

@@ -0,0 +1,33 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: outline
namespace: default
spec:
values:
env:
AWS_REGION: us-east-1
AWS_S3_ACL: private
AWS_S3_FORCE_PATH_STYLE: "true"
AWS_S3_UPLOAD_BUCKET_NAME: outline
AWS_S3_UPLOAD_BUCKET_URL: "https://minio.${SECRET_DOMAIN}"
AWS_S3_UPLOAD_MAX_SIZE: "26214400"
ENABLE_UPDATES: "false"
# OIDC_AUTH_URI: "https://login.${SECRET_CLUSTER_DOMAIN}/api/oidc/authorization"
# OIDC_CLIENT_ID: outline
# OIDC_CLIENT_SECRET: "${SECRET_OUTLINE_OAUTH_CLIENT_SECRET}"
# OIDC_DISPLAY_NAME: Authelia
# OIDC_SCOPES: "openid profile email offline_access"
# OIDC_TOKEN_URI: "https://login.${SECRET_CLUSTER_DOMAIN}/api/oidc/token"
# OIDC_USERINFO_URI: "https://login.${SECRET_CLUSTER_DOMAIN}/api/oidc/userinfo"
# OIDC_USERNAME_CLAIM: email
PGSSLMODE: require
PORT: 80
REDIS_URL: ioredis://eyJkYiI6MTUsInNlbnRpbmVscyI6W3siaG9zdCI6InJlZGlzLW5vZGUtMC5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9LHsiaG9zdCI6InJlZGlzLW5vZGUtMS5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9LHsiaG9zdCI6InJlZGlzLW5vZGUtMi5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9XSwibmFtZSI6InJlZGlzLW1hc3RlciJ9
# SMTP_HOST: smtp-relay.default.svc.cluster.local
# SMTP_PORT: 2525
# SMTP_FROM_EMAIL: "outline@${SECRET_EMAIL_DOMAIN}"
# SMTP_SECURE: "false"
URL: "https://docs.${SECRET_CLUSTER_DOMAIN}"
WEB_CONCURRENCY: 10

21
cluster/apps/documentation/outline/patches/postgres.yaml Normal file
View File

@@ -0,0 +1,21 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: &app outline
namespace: default
spec:
values:
initContainers:
init-db:
image: ghcr.io/onedr0p/postgres-initdb:14.5
env:
- name: POSTGRES_HOST
value: postgres.${SECRET_DOMAIN}
- name: POSTGRES_DB
value: *app
- name: POSTGRES_SUPER_PASS
value: ${SECRET_POSTGRESQL_POSTGRES_PASSWORD}
envFrom:
- secretRef:
name: *app

35
cluster/apps/documentation/outline/secret.sops.yaml Normal file
View File

@@ -0,0 +1,35 @@
# yamllint disable
apiVersion: v1
kind: Secret
metadata:
name: outline
namespace: default
type: Opaque
stringData:
AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:ZJ6v/Kyxxy5mu2XrA003uRVHRzI=,iv:0tBr1HSrUNMQMxFi+RzgfKV7x/Ee99dL5DFXMSFjJtw=,tag:v7AVhxXjVV3cvpAANGVLeg==,type:str]
AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:2GGPneKPmFEtq3A9X7fskiv/FnKv5deoyzNx0/euYrTOJKrRiTgj8g==,iv:u1LLrjxP1GwWcM1FJLjB9OpUFTPI0D9IZEX86IHGpmU=,tag:7vq4QeQagU2B9+WShheDKg==,type:str]
SECRET_KEY: ENC[AES256_GCM,data:RUjf4wghv9PnDdSNWeytoDRzH+A7wa8RNYDP+MYIf8KHjOGyVNzZwEuS8ah8wy8tvBWAE9kykOC1KhP+wFofIA==,iv:3z7NZ87ILlyrkx4YMWQ9uFL2W31bTmwZFkJxOHgSVvo=,tag:umplfrhjvCZX9Ucneo7Q+Q==,type:str]
UTILS_SECRET: ENC[AES256_GCM,data:r5DADkQbM5fEBsWs7ddUx2PXnt+ePiQcJZgKMmHYpkddmPFeS5xpJGgbhun7v409aKJLQRm/tUIysBlxHlnSbA==,iv:cP2KQeUmgjoXuY7UnQ57M4tBUeO0hELGe+HrSB5RJ3Q=,tag:HD4lccnbZXjllmOLyEHY3Q==,type:str]
DATABASE_URL: ENC[AES256_GCM,data:AUz6cKjfad72wYR1usNxTayRJiUP6Q9N4dASz4A2siHwA6Whw4Rzg5uS22EvHLtq5Oy4m6b5tLn5XmowiDiEV8dOSOhqRyC62w==,iv:/2sOo0we0MpzCqmr57zFEQh9Uj5X1xP1BR/rNKO2sVo=,tag:ArT+VVdfnWt7MAJliG6AyQ==,type:str]
POSTGRES_USER: ENC[AES256_GCM,data:4FlwiUkmmQ==,iv:f/mOMCV34bvseHAJ37AaUIZUYcBobtdIAYN/5ONhGbg=,tag:HFvPkQh2i/BtnynAjP0uhg==,type:str]
POSTGRES_PASS: ENC[AES256_GCM,data:HTbSg+yj1iKqlGmPPwql+GD+psM=,iv:fMHU+AYZ/NfgtCstuQIfnBmKRD2n3hMmFKSqC5akB/c=,tag:v16K+iZZVQZ9gpBIBWgyfQ==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFYUFSaFFVbVgyTXkzbmFR
NHllQjdJcEUxdlloWC9sSGtJNnBoL0xIM1VjCmk4NFpEM0ZFOEJKWCtyNkRTVkdw
SFVBY1J4c1VUdnQxZnVOWHFWbmYzRlUKLS0tIDE0L3VybUhnSkJlYStxR0k4dzZ6
eGsyL3NhNS8xdUp0VlNQbWRYbHFLYW8KeMc82BlegMJMtAF/WGMbXhpf2MVvUP5q
ehHCSwpe3a8WwXEBNu1u5IPcnMO4Fo5HhjLbMx6H1Ynd6KdyDXUKEg==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2022-09-12T23:37:43Z"
mac: ENC[AES256_GCM,data:c2zSv11F3d5uO9tgxnWe0hj7N9rcd1MLpiXjwwi0PR6T3waarThCrdpf5EPy5jv/kKc+4DiyxDZRbj7sM7OzU+puDa4SV10uB33XRKzW5ktx9VPt0ykVsSc1/L9akrk2DLxzOTDwHwBj+2aEpzPef0a/w0t49vy+SULiudvB7iM=,iv:5ZMobXcA3ErqpuvFiT8xA1MJjdzpylAD0t8+eX+6jGI=,tag:ffE4iRg7w2/l5CgKZKfhsg==,type:str]
pgp: []
encrypted_regex: ^(data|stringData)$
version: 3.7.3

130
cluster/apps/documentation/readme.md Normal file
View File

@@ -0,0 +1,130 @@
# Documentation
## Outline
### Redis Sentinel Configuration
1. Create base64 encoded Redis configuation
```sh
echo -n '{"db":15,"sentinels":[{"host":"redis-node-0.redis-headless.default.svc.cluster.local","port":26379},{"host":"redis-node-1.redis-headless.default.svc.cluster.local","port":26379},{"host":"redis-node-2.redis-headless.default.svc.cluster.local","port":26379}],"name":"redis-master"}' \
| base64 -w 0
```
2. Use this base64 encoded string in the Kubernetes secret
```yaml
REDIS_URL: ioredis://eyJkYiI6MTUsInNlbnRpbmVscyI6W3siaG9zdCI6InJlZGlzLW5vZGUtMC5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9LHsiaG9zdCI6InJlZGlzLW5vZGUtMS5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9LHsiaG9zdCI6InJlZGlzLW5vZGUtMi5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9XSwibmFtZSI6InJlZGlzLW1hc3RlciJ9
```
## S3 Configuration
1. Create `~/.mc/config.json`
```json
{
"version": "10",
"aliases": {
"minio": {
"url": "https://s3.<domain>",
"accessKey": "<access-key>",
"secretKey": "<secret-key>",
"api": "S3v4",
"path": "auto"
}
}
}
```
2. Create the outline user and password
```sh
mc admin user add minio outline <super-secret-password>
```
3. Create the outline bucket
```sh
mc mb minio/outline
```
4. Create `outline-user-policy.json`
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:ListBucket",
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject"
],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::outline/*", "arn:aws:s3:::outline"],
"Sid": ""
}
]
}
```
5. Create `bucket-policy.json`
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": ["*"]
},
"Action": ["s3:GetBucketLocation"],
"Resource": ["arn:aws:s3:::outline"]
},
{
"Effect": "Allow",
"Principal": {
"AWS": ["*"]
},
"Action": ["s3:ListBucket"],
"Resource": ["arn:aws:s3:::outline"],
"Condition": {
"StringEquals": {
"s3:prefix": ["avatars", "public"]
}
}
},
{
"Effect": "Allow",
"Principal": {
"AWS": ["*"]
},
"Action": ["s3:GetObject"],
"Resource": [
"arn:aws:s3:::outline/avatars*",
"arn:aws:s3:::outline/public*"
]
}
]
}
```
6. Apply the bucket policies
```sh
mc admin policy add minio outline-private outline-user-policy.json
```
7. Associate private policy with the user
```sh
mc admin policy set minio outline-private user=outline
```
8. Associate public policy with the bucket
```sh
mc anonymous set-json bucket-policy.json minio/outline
```

1
cluster/apps/kustomization.yaml
View File

@@ -4,6 +4,7 @@ resources:
- data - data
- databases - databases
- development - development
- documentation
- home-automation - home-automation
- kasten-io - kasten-io
- media - media