♻️ flux kustomizations

2025-09-17 18:24:14 +02:00 · 2022-12-26 15:24:33 +01:00
parent b4572bf19a
commit ca31e11491
730 changed files with 6825 additions and 3766 deletions
--- a/kubernetes/apps/default/outline/app/helmrelease.yaml
+++ b/kubernetes/apps/default/outline/app/helmrelease.yaml
@@ -0,0 +1,75 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app outline
+  namespace: default
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.2.0
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  dependsOn:
+    - name: cloudnative-pg
+    - name: redis
+  values:
+    controller:
+      replicas: 1
+      strategy: RollingUpdate
+      annotations:
+        reloader.stakater.com/auto: "true"
+    image:
+      repository: docker.io/outlinewiki/outline
+      tag: 0.66.3
+    envFrom:
+      - secretRef:
+          name: outline-secret
+    command:
+      [
+        "/bin/sh",
+        "-c",
+        "yarn db:migrate --env=production-ssl-disabled && yarn start --env=production-ssl-disabled",
+      ]
+    service:
+      main:
+        ports:
+          http:
+            port: 8080
+    ingress:
+      main:
+        enabled: true
+        ingressClassName: "nginx"
+        hosts:
+          - host: &host "docs.${SECRET_CLUSTER_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+    topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+        labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: *app
+    resources:
+      requests:
+        cpu: 10m
+        memory: 50Mi
+      limits:
+        memory: 500Mi
--- a/kubernetes/apps/default/outline/app/kustomization.yaml
+++ b/kubernetes/apps/default/outline/app/kustomization.yaml
@@ -0,0 +1,11 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: default
+resources:
+  - ./secret.sops.yaml
+  - ./helmrelease.yaml
+patchesStrategicMerge:
+  - ./patches/env.yaml
+  - ./patches/postgres.yaml
--- a/kubernetes/apps/default/outline/app/patches/env.yaml
+++ b/kubernetes/apps/default/outline/app/patches/env.yaml
@@ -0,0 +1,33 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: outline
+  namespace: default
+spec:
+  values:
+    env:
+      AWS_REGION: us-east-1
+      AWS_S3_ACL: private
+      AWS_S3_FORCE_PATH_STYLE: "true"
+      AWS_S3_UPLOAD_BUCKET_NAME: outline
+      AWS_S3_UPLOAD_BUCKET_URL: "https://truenas.${SECRET_DOMAIN}:51515"
+      AWS_S3_UPLOAD_MAX_SIZE: "26214400"
+      ENABLE_UPDATES: "false"
+      OIDC_AUTH_URI: "https://auth.${SECRET_CLUSTER_DOMAIN}/api/oidc/authorization"
+      OIDC_CLIENT_ID: outline
+      OIDC_CLIENT_SECRET: "${SECRET_OUTLINE_OAUTH_CLIENT_SECRET}"
+      OIDC_DISPLAY_NAME: Authelia
+      OIDC_SCOPES: "openid profile email offline_access"
+      OIDC_TOKEN_URI: "https://auth.${SECRET_CLUSTER_DOMAIN}/api/oidc/token"
+      OIDC_USERINFO_URI: "https://auth.${SECRET_CLUSTER_DOMAIN}/api/oidc/userinfo"
+      OIDC_USERNAME_CLAIM: email
+      PORT: 8080
+      REDIS_URL: ioredis://eyJkYiI6MTUsInNlbnRpbmVscyI6W3siaG9zdCI6InJlZGlzLW5vZGUtMC5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9LHsiaG9zdCI6InJlZGlzLW5vZGUtMS5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9LHsiaG9zdCI6InJlZGlzLW5vZGUtMi5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9XSwibmFtZSI6InJlZGlzLW1hc3RlciJ9
+      SMTP_HOST: smtp-relay.default.svc.cluster.local.
+      SMTP_PORT: 2525
+      SMTP_FROM_EMAIL: "outline@${SECRET_DOMAIN}"
+      SMTP_SECURE: "false"
+      URL: "https://docs.${SECRET_CLUSTER_DOMAIN}"
+      WEB_CONCURRENCY: 10
--- a/kubernetes/apps/default/outline/app/patches/postgres.yaml
+++ b/kubernetes/apps/default/outline/app/patches/postgres.yaml
@@ -0,0 +1,25 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app outline
+  namespace: default
+spec:
+  values:
+    initContainers:
+      init-db:
+        image: ghcr.io/onedr0p/postgres-initdb:14.6
+        env:
+          - name: POSTGRES_HOST
+            value: ${POSTGRES_HOST}
+          - name: POSTGRES_DB
+            value: *app
+          - name: POSTGRES_SUPER_PASS
+            valueFrom:
+              secretKeyRef:
+                name: postgres-superuser
+                key: password
+        envFrom:
+          - secretRef:
+              name: outline-secret
--- a/kubernetes/apps/default/outline/app/secret.sops.yaml
+++ b/kubernetes/apps/default/outline/app/secret.sops.yaml
@@ -0,0 +1,35 @@
+# yamllint disable
+apiVersion: v1
+kind: Secret
+metadata:
+    name: outline-secret
+    namespace: default
+type: Opaque
+stringData:
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:ZJ6v/Kyxxy5mu2XrA003uRVHRzI=,iv:0tBr1HSrUNMQMxFi+RzgfKV7x/Ee99dL5DFXMSFjJtw=,tag:v7AVhxXjVV3cvpAANGVLeg==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:2GGPneKPmFEtq3A9X7fskiv/FnKv5deoyzNx0/euYrTOJKrRiTgj8g==,iv:u1LLrjxP1GwWcM1FJLjB9OpUFTPI0D9IZEX86IHGpmU=,tag:7vq4QeQagU2B9+WShheDKg==,type:str]
+    SECRET_KEY: ENC[AES256_GCM,data:RUjf4wghv9PnDdSNWeytoDRzH+A7wa8RNYDP+MYIf8KHjOGyVNzZwEuS8ah8wy8tvBWAE9kykOC1KhP+wFofIA==,iv:3z7NZ87ILlyrkx4YMWQ9uFL2W31bTmwZFkJxOHgSVvo=,tag:umplfrhjvCZX9Ucneo7Q+Q==,type:str]
+    UTILS_SECRET: ENC[AES256_GCM,data:r5DADkQbM5fEBsWs7ddUx2PXnt+ePiQcJZgKMmHYpkddmPFeS5xpJGgbhun7v409aKJLQRm/tUIysBlxHlnSbA==,iv:cP2KQeUmgjoXuY7UnQ57M4tBUeO0hELGe+HrSB5RJ3Q=,tag:HD4lccnbZXjllmOLyEHY3Q==,type:str]
+    DATABASE_URL: ENC[AES256_GCM,data:Q/lDi+O65wYIH4dBve0WBy4tHGbwgMfzzoz1N8VTu0kl5Myxjk36bCUFzfP62RYicdXEJpffUigtlwKQxnFT5Atu8xvpeqmsZ0Gq6IXfE3+NWCeNXkD1BkqD,iv:hhX+hW7fuuUbKrvhTd0j9wPpZzbZxbJulfYhrH3S304=,tag:COskqvtXUxqOuv92QL3hXw==,type:str]
+    POSTGRES_USER: ENC[AES256_GCM,data:4FlwiUkmmQ==,iv:f/mOMCV34bvseHAJ37AaUIZUYcBobtdIAYN/5ONhGbg=,tag:HFvPkQh2i/BtnynAjP0uhg==,type:str]
+    POSTGRES_PASS: ENC[AES256_GCM,data:DrO0C2kyUu9irfd3I4Ii/2QZcIA=,iv:44crBneaLpsyp9POZqNVQfh2JYIsJD4Yoq1YrvyANGc=,tag:V84EYlBMZzVj9bs8k4dV8g==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFYUFSaFFVbVgyTXkzbmFR
+            NHllQjdJcEUxdlloWC9sSGtJNnBoL0xIM1VjCmk4NFpEM0ZFOEJKWCtyNkRTVkdw
+            SFVBY1J4c1VUdnQxZnVOWHFWbmYzRlUKLS0tIDE0L3VybUhnSkJlYStxR0k4dzZ6
+            eGsyL3NhNS8xdUp0VlNQbWRYbHFLYW8KeMc82BlegMJMtAF/WGMbXhpf2MVvUP5q
+            ehHCSwpe3a8WwXEBNu1u5IPcnMO4Fo5HhjLbMx6H1Ynd6KdyDXUKEg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-12-01T22:25:43Z"
+    mac: ENC[AES256_GCM,data:/zmgGjJRYcDt4iXpLyDN2MA0FWxuQmmZNRggw0UX+IPgUrvGKmLpLsC3+0zhHUAwjANgWtQ5pJWHMuz1R39lOOBEcUBM4Re/ZTnyClDZIkxVC0WUrmTsj4spz719v9iwORYmTQujPW6bO9a/1KFNL5KjKqz/7Qx8Iu9MsCNfIfE=,iv:iUD51jsCdT4uBnWiAS20DITCdN1lov0Ibz3EacXNQOs=,tag:46LubofEdvYErTrgsgUGxg==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3
--- a/kubernetes/apps/default/outline/ks.yaml
+++ b/kubernetes/apps/default/outline/ks.yaml
@@ -0,0 +1,25 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/kustomization_v1beta2.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: cluster-apps-outline
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  path: ./kubernetes/apps/default/outline/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-ops-kubernetes
+  dependsOn:
+    - name: cluster-apps-cloudnative-pg-cluster
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2beta1
+      kind: HelmRelease
+      name: outline
+      namespace: default
+  interval: 30m
+  retryInterval: 1m
+  timeout: 3m
--- a/kubernetes/apps/default/outline/readme.md
+++ b/kubernetes/apps/default/outline/readme.md
@@ -0,0 +1,130 @@
+# Documentation
+
+## Outline
+
+### Redis Sentinel Configuration
+
+1. Create base64 encoded Redis configuation
+
+   ```sh
+    echo -n '{"db":15,"sentinels":[{"host":"redis-node-0.redis-headless.default.svc.cluster.local","port":26379},{"host":"redis-node-1.redis-headless.default.svc.cluster.local","port":26379},{"host":"redis-node-2.redis-headless.default.svc.cluster.local","port":26379}],"name":"redis-master"}' \
+       | base64 -w 0
+   ```
+
+2. Use this base64 encoded string in the Kubernetes secret
+
+   ```yaml
+   REDIS_URL: ioredis://eyJkYiI6MTUsInNlbnRpbmVscyI6W3siaG9zdCI6InJlZGlzLW5vZGUtMC5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9LHsiaG9zdCI6InJlZGlzLW5vZGUtMS5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9LHsiaG9zdCI6InJlZGlzLW5vZGUtMi5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9XSwibmFtZSI6InJlZGlzLW1hc3RlciJ9
+   ```
+
+## S3 Configuration
+
+1. Create `~/.mc/config.json`
+
+   ```json
+   {
+     "version": "10",
+     "aliases": {
+       "minio": {
+         "url": "https://s3.<domain>",
+         "accessKey": "<access-key>",
+         "secretKey": "<secret-key>",
+         "api": "S3v4",
+         "path": "auto"
+       }
+     }
+   }
+   ```
+
+2. Create the outline user and password
+
+   ```sh
+   mc admin user add minio outline <super-secret-password>
+   ```
+
+3. Create the outline bucket
+
+   ```sh
+   mc mb minio/outline
+   ```
+
+4. Create `outline-user-policy.json`
+
+   ```json
+   {
+     "Version": "2012-10-17",
+     "Statement": [
+       {
+         "Action": [
+           "s3:ListBucket",
+           "s3:PutObject",
+           "s3:GetObject",
+           "s3:DeleteObject"
+         ],
+         "Effect": "Allow",
+         "Resource": ["arn:aws:s3:::outline/*", "arn:aws:s3:::outline"],
+         "Sid": ""
+       }
+     ]
+   }
+   ```
+
+5. Create `bucket-policy.json`
+
+   ```json
+   {
+     "Version": "2012-10-17",
+     "Statement": [
+       {
+         "Effect": "Allow",
+         "Principal": {
+           "AWS": ["*"]
+         },
+         "Action": ["s3:GetBucketLocation"],
+         "Resource": ["arn:aws:s3:::outline"]
+       },
+       {
+         "Effect": "Allow",
+         "Principal": {
+           "AWS": ["*"]
+         },
+         "Action": ["s3:ListBucket"],
+         "Resource": ["arn:aws:s3:::outline"],
+         "Condition": {
+           "StringEquals": {
+             "s3:prefix": ["avatars", "public"]
+           }
+         }
+       },
+       {
+         "Effect": "Allow",
+         "Principal": {
+           "AWS": ["*"]
+         },
+         "Action": ["s3:GetObject"],
+         "Resource": [
+           "arn:aws:s3:::outline/avatars*",
+           "arn:aws:s3:::outline/public*"
+         ]
+       }
+     ]
+   }
+   ```
+
+6. Apply the bucket policies
+
+   ```sh
+   mc admin policy add minio outline-private outline-user-policy.json
+   ```
+
+7. Associate private policy with the user
+
+   ```sh
+   mc admin policy set minio outline-private user=outline
+   ```
+
+8. Associate public policy with the bucket
+
+   ```sh
+   mc anonymous set-json bucket-policy.json minio/outline
+   ```