mirror of
https://github.com/auricom/home-cluster.git
synced 2025-09-17 18:24:14 +02:00
fixup! ♻️ migration externalsecrets
This commit is contained in:
auricom
@@ -21,6 +21,7 @@ spec:
|
||||
HASS_SECRET_LONGITUDE: "{{ .HASS_LONGITUDE }}"
|
||||
HASS_SECRET_DB_URL: "postgresql://{{ .POSTGRES_USER }}:{{ .POSTGRES_PASS }}@postgres-rw.default.svc.cluster.local/home_assistant"
|
||||
HASS_SECRET_URL: "{{ .HASS_URL }}"
|
||||
PROMETHEUS_TOKEN: "{{ .PROMETHEUS_TOKEN }}"
|
||||
# Postgres Init
|
||||
INIT_POSTGRES_DBNAME: home_assistant
|
||||
INIT_POSTGRES_HOST: postgres-rw.default.svc.cluster.local
|
||||
|
||||
@@ -11,7 +11,7 @@ spec:
|
||||
port: http
|
||||
scrapeTimeout: 30s
|
||||
bearerTokenSecret:
|
||||
name: home-automation
|
||||
name: home-assistant-secret
|
||||
key: PROMETHEUS_TOKEN
|
||||
selector:
|
||||
matchLabels:
|
||||
|
||||
@@ -30,7 +30,7 @@ metadata:
|
||||
name: home-assistant
|
||||
namespace: default
|
||||
spec:
|
||||
sourcePVC: home-assistant-config
|
||||
sourcePVC: hass-config
|
||||
trigger:
|
||||
schedule: "0 7 * * *"
|
||||
restic:
|
||||
|
||||
@@ -32,6 +32,13 @@ spec:
|
||||
controller:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
initContainers:
|
||||
01-init-db:
|
||||
image: ghcr.io/onedr0p/postgres-init:14.8
|
||||
imagePullPolicy: IfNotPresent
|
||||
envFrom: &envFrom
|
||||
- secretRef:
|
||||
name: &secret joplin-secret
|
||||
image:
|
||||
repository: joplin/server
|
||||
tag: 2.11.2-beta
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./replicationsource.yaml
|
||||
- ./restic.sops.yaml
|
||||
@@ -1,25 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: lidarr
|
||||
namespace: default
|
||||
spec:
|
||||
sourcePVC: lidarr-config
|
||||
trigger:
|
||||
schedule: "0 0 * * *"
|
||||
restic:
|
||||
copyMethod: Snapshot
|
||||
pruneIntervalDays: 10
|
||||
repository: lidarr-restic
|
||||
cacheCapacity: 2Gi
|
||||
volumeSnapshotClassName: csi-ceph-blockpool
|
||||
storageClassName: rook-ceph-block
|
||||
moverSecurityContext:
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
retain:
|
||||
daily: 10
|
||||
within: 3d
|
||||
@@ -1,35 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: lidarr-restic
|
||||
namespace: default
|
||||
type: Opaque
|
||||
stringData:
|
||||
#ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment]
|
||||
RESTIC_REPOSITORY: ENC[AES256_GCM,data:9TU2gSIK5QV/xBdBBziqF7ajXzwH8F/ZssdBHwufbWVWcDvT+1bVrINVEiHWQf5XnqxOpphq9cI=,iv:l7+Sd+QhcRuq0d0AcBoeRaQCVFxjokRxwh4QQ+BFoxA=,tag:15dkxHK2dOYGiHYI1BZ9Yw==,type:str]
|
||||
#ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment]
|
||||
RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str]
|
||||
#ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment]
|
||||
#ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment]
|
||||
AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str]
|
||||
AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ
|
||||
THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB
|
||||
TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN
|
||||
dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4
|
||||
3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2022-12-28T15:33:10Z"
|
||||
mac: ENC[AES256_GCM,data:SqVBbFRJ1z/Jq6O5EbGsL20yLjMRf2UyQXmBUxwbLRK8WfBahgW0YYcXCnzWsSWAgAIxgn18INd61zMiH9eT6MIRi2N1avtwoHYIY8Z6lG/+qPf4fUXeXTALuhozwJ73ozYw9hPKh+nUYuSZHluEv8xRalu5Ml4uPY5EhER5l5Q=,iv:4Dja+GbOy986eYvlNSGH0rH/UuQr6sPBzEw8gQbQHsw=,tag:7R7lYosch5PSCZodb1uhdQ==,type:str]
|
||||
pgp: []
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
version: 3.7.3
|
||||
18
kubernetes/apps/default/lidarr/app/externalsecret.yaml
Normal file
18
kubernetes/apps/default/lidarr/app/externalsecret.yaml
Normal file
@@ -0,0 +1,18 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: lidarr
|
||||
namespace: default
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: onepassword-connect
|
||||
target:
|
||||
name: lidarr-secret
|
||||
creationPolicy: Owner
|
||||
dataFrom:
|
||||
- extract:
|
||||
# LIDARR__API_KEY
|
||||
key: lidarr
|
||||
@@ -6,7 +6,7 @@ metadata:
|
||||
name: &app lidarr
|
||||
namespace: default
|
||||
spec:
|
||||
interval: 15m
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
@@ -15,7 +15,7 @@ spec:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
maxHistory: 3
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
@@ -27,6 +27,9 @@ spec:
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
controller:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
image:
|
||||
repository: ghcr.io/onedr0p/lidarr-develop
|
||||
tag: 1.2.6.3313@sha256:495d884e08bb476ad16f5428c87e143efbf1be5556c9a6e0525ecaafc777e407
|
||||
@@ -37,7 +40,7 @@ spec:
|
||||
LIDARR__LOG_LEVEL: info
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: *app
|
||||
name: lidarr-secret
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
|
||||
@@ -4,7 +4,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: default
|
||||
resources:
|
||||
- ./backups
|
||||
- ./externalsecret.yaml
|
||||
- ./helmrelease.yaml
|
||||
- ./secret.sops.yaml
|
||||
- ./volsync.yaml
|
||||
- ./volume.yaml
|
||||
|
||||
@@ -1,29 +0,0 @@
|
||||
# yamllint disable
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: lidarr
|
||||
namespace: default
|
||||
type: Opaque
|
||||
stringData:
|
||||
LIDARR__API_KEY: ENC[AES256_GCM,data:GSu/jivdFANYsUrPwRM5bwrWLX/7nwKn9AOLium0m6Y=,iv:xn+wD7ZyJfL80UpAVy/XIiubtifwIrBuU876Uy8vrgU=,tag:H8lV7wJeV2m2XDLVMx6p/Q==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaU16anJNV2pBZmxPR3h2
|
||||
bWREUnpjcTFvd05ZQ2E4VVBDdm1FL2k4WEYwCkdQSStTNWtpdjNkUW51WS9MekdC
|
||||
VkpTUUFjSjY2a1JMOUtqOVh5M0JRR2sKLS0tIDRmcWpJSEVvaUp4U1lsaTZYZGNw
|
||||
OGVKWU0zNUZJSFh4aFJxQWFsYm1VeFkKaDeI/hl7z0Qh8t5W39Kxu9ert1dt4xo+
|
||||
LX+MjpVqxiZNcfwROD4bkWeQSN+VsxoGOOyj4L15BlggNnlg+L7Hww==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2022-12-28T15:32:56Z"
|
||||
mac: ENC[AES256_GCM,data:qYD7LQtuhERFaWAhakfOrX8kRtB9gVa4e3ePf8X61edHBzJAInvUceBCOUDZahnyCSg6pzBIfFp5uOgPbYTs8wfc4Aq/vvgWt4b7LIRdWbpo3EoYDfL/fKKZFGzOoX42y9Krd8dtndD0YYRvRt4pQkBwEkAluSOWbNOG1rWBnHw=,iv:3EZYLcxGsS9YyaITAKw9AG8TWCZrbm80pv7ohQXSZvU=,tag:eQNjWtRicx0b++n28qK7wQ==,type:str]
|
||||
pgp: []
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
version: 3.7.3
|
||||
49
kubernetes/apps/default/lidarr/app/volsync.yaml
Normal file
49
kubernetes/apps/default/lidarr/app/volsync.yaml
Normal file
@@ -0,0 +1,49 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: lidarr-restic
|
||||
namespace: default
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: onepassword-connect
|
||||
target:
|
||||
name: lidarr-restic-secret
|
||||
creationPolicy: Owner
|
||||
template:
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: '{{ .REPOSITORY_TEMPLATE }}/lidarr'
|
||||
RESTIC_PASSWORD: '{{ .RESTIC_PASSWORD }}'
|
||||
AWS_ACCESS_KEY_ID: '{{ .AWS_ACCESS_KEY_ID }}'
|
||||
AWS_SECRET_ACCESS_KEY: '{{ .AWS_SECRET_ACCESS_KEY }}'
|
||||
dataFrom:
|
||||
- extract:
|
||||
key: volsync-restic-template
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/volsync.backube/replicationsource_v1alpha1.json
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: lidarr
|
||||
namespace: default
|
||||
spec:
|
||||
sourcePVC: lidarr-config
|
||||
trigger:
|
||||
schedule: "0 7 * * *"
|
||||
restic:
|
||||
copyMethod: Snapshot
|
||||
pruneIntervalDays: 7
|
||||
repository: lidarr-restic-secret
|
||||
cacheCapacity: 10Gi
|
||||
volumeSnapshotClassName: csi-ceph-blockpool
|
||||
storageClassName: rook-ceph-block
|
||||
moverSecurityContext:
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
retain:
|
||||
daily: 7
|
||||
within: 3d
|
||||
@@ -9,6 +9,7 @@ metadata:
|
||||
substitution.flux.home.arpa/enabled: "true"
|
||||
spec:
|
||||
dependsOn:
|
||||
- name: cluster-apps-external-secrets-stores
|
||||
- name: cluster-apps-rook-ceph-cluster
|
||||
- name: cluster-apps-volsync-app
|
||||
path: ./kubernetes/apps/default/lidarr/app
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./replicationsource.yaml
|
||||
- ./restic.sops.yaml
|
||||
@@ -1,25 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: lychee
|
||||
namespace: default
|
||||
spec:
|
||||
sourcePVC: lychee-files
|
||||
trigger:
|
||||
schedule: "0 0 * * *"
|
||||
restic:
|
||||
copyMethod: Snapshot
|
||||
pruneIntervalDays: 10
|
||||
repository: lychee-restic
|
||||
cacheCapacity: 20Gi
|
||||
volumeSnapshotClassName: csi-ceph-blockpool
|
||||
storageClassName: rook-ceph-block
|
||||
moverSecurityContext:
|
||||
runAsUser: 33
|
||||
runAsGroup: 33
|
||||
fsGroup: 33
|
||||
retain:
|
||||
daily: 10
|
||||
within: 3d
|
||||
@@ -1,35 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: lychee-restic
|
||||
namespace: default
|
||||
type: Opaque
|
||||
stringData:
|
||||
#ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment]
|
||||
RESTIC_REPOSITORY: ENC[AES256_GCM,data:indKdyrRptk2rKJFrtaNjufG4asKcjTb9mvQjW9t00iJuR1mNLafazViyBcEjIoSm4MN4B9WAI4=,iv:E16uoSrAJQ+CF/uu1dP5ZJ9l0uT5DyTbWa50j3pGk1I=,tag:TPpmObERt9fz8tgWA1P81g==,type:str]
|
||||
#ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment]
|
||||
RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str]
|
||||
#ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment]
|
||||
#ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment]
|
||||
AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str]
|
||||
AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ
|
||||
THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB
|
||||
TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN
|
||||
dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4
|
||||
3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2022-12-28T15:00:37Z"
|
||||
mac: ENC[AES256_GCM,data:rl+tYaE6BAR0IFy4Jz2mZ6MZKBDmjZ8R0WCxrpV9jgWWGKKnIfduRoiErXFTSX3BojqSMnOowzi3Y7W0YgZTHPJXfymTHx4UfbRyNJkZHOc4P6S4tyZLxj5n/F9uO/i4GSt+x0By2PLuVJUR5oY2siLezSCDevtiSs6MEIlLRAw=,iv:1tvzLaymrwk3u6pv8Y9wbh7Xz8gbUZZ5C3meLFNDB1E=,tag:kDU4NvGtullPjHe0Fw+JVg==,type:str]
|
||||
pgp: []
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
version: 3.7.3
|
||||
34
kubernetes/apps/default/lychee/app/externalsecret.yaml
Normal file
34
kubernetes/apps/default/lychee/app/externalsecret.yaml
Normal file
@@ -0,0 +1,34 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: lychee
|
||||
namespace: default
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: onepassword-connect
|
||||
target:
|
||||
name: lychee-secret
|
||||
creationPolicy: Owner
|
||||
template:
|
||||
engineVersion: v2
|
||||
data:
|
||||
# App
|
||||
DB_HOST: &dbHost postgres-rw.default.svc.cluster.local
|
||||
DB_PORT: "5432"
|
||||
DB_DATABASE: &dbName lychee
|
||||
DB_USERNAME: &dbUser "{{ .POSTGRES_USERNAME }}"
|
||||
DB_PASSWORD: &dbPass "{{ .POSTGRES_PASSWORD }}"
|
||||
# Postgres Init
|
||||
INIT_POSTGRES_DBNAME: *dbName
|
||||
INIT_POSTGRES_HOST: *dbHost
|
||||
INIT_POSTGRES_USER: *dbUser
|
||||
INIT_POSTGRES_PASS: *dbPass
|
||||
INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_SUPER_PASS }}"
|
||||
dataFrom:
|
||||
- extract:
|
||||
key: cloudnative-pg
|
||||
- extract:
|
||||
key: lychee
|
||||
@@ -6,7 +6,7 @@ metadata:
|
||||
name: &app lychee
|
||||
namespace: default
|
||||
spec:
|
||||
interval: 15m
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
@@ -15,7 +15,7 @@ spec:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
maxHistory: 3
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
@@ -27,6 +27,16 @@ spec:
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
initContainers:
|
||||
01-init-db:
|
||||
image: ghcr.io/onedr0p/postgres-init:14.8
|
||||
imagePullPolicy: IfNotPresent
|
||||
envFrom: &envFrom
|
||||
- secretRef:
|
||||
name: &secret lychee-secret
|
||||
controller:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
image:
|
||||
repository: lycheeorg/lychee-laravel
|
||||
tag: v4.9.4
|
||||
@@ -34,14 +44,11 @@ spec:
|
||||
TIMEZONE: ${TIMEZONE}
|
||||
APP_NAME: Lychee
|
||||
DB_CONNECTION: pgsql
|
||||
DB_HOST: ${POSTGRES_HOST}
|
||||
DB_PORT: ${POSTGRES_PORT}
|
||||
DB_DATABASE: lychee
|
||||
REDIS_HOST: redis.default.svc.cluster.local.
|
||||
REDIS_PORT: 6379
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: *app
|
||||
name: lychee-secret
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
|
||||
@@ -4,9 +4,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: default
|
||||
resources:
|
||||
- ./backups
|
||||
- ./externalsecret.yaml
|
||||
- ./helmrelease.yaml
|
||||
- ./secret.sops.yaml
|
||||
- ./volsync.yaml
|
||||
- ./volume.yaml
|
||||
patchesStrategicMerge:
|
||||
- ./patches/postgres.yaml
|
||||
|
||||
@@ -1,32 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: lychee
|
||||
namespace: default
|
||||
spec:
|
||||
values:
|
||||
initContainers:
|
||||
init-db:
|
||||
image: ghcr.io/onedr0p/postgres-initdb:14.8
|
||||
env:
|
||||
- name: POSTGRES_HOST
|
||||
value: ${POSTGRES_HOST}
|
||||
- name: POSTGRES_DB
|
||||
value: lychee
|
||||
- name: POSTGRES_SUPER_PASS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: postgres-superuser
|
||||
key: password
|
||||
- name: POSTGRES_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: lychee
|
||||
key: DB_USERNAME
|
||||
- name: POSTGRES_PASS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: lychee
|
||||
key: DB_PASSWORD
|
||||
@@ -1,30 +0,0 @@
|
||||
# yamllint disable
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: lychee
|
||||
namespace: default
|
||||
type: Opaque
|
||||
stringData:
|
||||
DB_USERNAME: ENC[AES256_GCM,data:aEFa7HU4,iv:fS7dJjHGB/Qd0lLKKOG1MJ18WA6L3YxyBWbo8gZvmXc=,tag:FRTCcKgAy9oqUw/qz8MSwg==,type:str]
|
||||
DB_PASSWORD: ENC[AES256_GCM,data:sc3ekmCLFNk+Oy9fAF4=,iv:Jr8XwbB5wO0rGbozPODZIijg9BbBiqnoV34YDOEJHc8=,tag:M/3L2WbfHkRUvfP95GLcMQ==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaU16anJNV2pBZmxPR3h2
|
||||
bWREUnpjcTFvd05ZQ2E4VVBDdm1FL2k4WEYwCkdQSStTNWtpdjNkUW51WS9MekdC
|
||||
VkpTUUFjSjY2a1JMOUtqOVh5M0JRR2sKLS0tIDRmcWpJSEVvaUp4U1lsaTZYZGNw
|
||||
OGVKWU0zNUZJSFh4aFJxQWFsYm1VeFkKaDeI/hl7z0Qh8t5W39Kxu9ert1dt4xo+
|
||||
LX+MjpVqxiZNcfwROD4bkWeQSN+VsxoGOOyj4L15BlggNnlg+L7Hww==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2022-12-28T15:01:21Z"
|
||||
mac: ENC[AES256_GCM,data:k1UsbtS868JoU28Y1vi+Pdbe5TlHKuH8HFMUrh8V6JA2Kak0TvS+3Mi7aAhXQJnWZRegeyrV4A2Z9rfuS55uKztFDQHdTmk0o00I9rq0G42EdsaynIM2ToR61/1cBHvwUuopxEJ8S+sM18/W0IQIJ2qH4hZsdQBVI75KtehSlT8=,iv:Il7gSuAItFi1k2UF3Y1qPpq+rjDQQx/qtl1Vt0+Th6M=,tag:5vTTFYYzuvDoRORuOsR7aQ==,type:str]
|
||||
pgp: []
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
version: 3.7.3
|
||||
49
kubernetes/apps/default/lychee/app/volsync.yaml
Normal file
49
kubernetes/apps/default/lychee/app/volsync.yaml
Normal file
@@ -0,0 +1,49 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: lychee-restic
|
||||
namespace: default
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: onepassword-connect
|
||||
target:
|
||||
name: lychee-restic-secret
|
||||
creationPolicy: Owner
|
||||
template:
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: '{{ .REPOSITORY_TEMPLATE }}/lychee'
|
||||
RESTIC_PASSWORD: '{{ .RESTIC_PASSWORD }}'
|
||||
AWS_ACCESS_KEY_ID: '{{ .AWS_ACCESS_KEY_ID }}'
|
||||
AWS_SECRET_ACCESS_KEY: '{{ .AWS_SECRET_ACCESS_KEY }}'
|
||||
dataFrom:
|
||||
- extract:
|
||||
key: volsync-restic-template
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/volsync.backube/replicationsource_v1alpha1.json
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: lychee
|
||||
namespace: default
|
||||
spec:
|
||||
sourcePVC: lychee-files
|
||||
trigger:
|
||||
schedule: "0 7 * * *"
|
||||
restic:
|
||||
copyMethod: Snapshot
|
||||
pruneIntervalDays: 7
|
||||
repository: lychee-restic-secret
|
||||
cacheCapacity: 20Gi
|
||||
volumeSnapshotClassName: csi-ceph-blockpool
|
||||
storageClassName: rook-ceph-block
|
||||
moverSecurityContext:
|
||||
runAsUser: 33
|
||||
runAsGroup: 33
|
||||
fsGroup: 33
|
||||
retain:
|
||||
daily: 7
|
||||
within: 3d
|
||||
@@ -15,6 +15,7 @@ spec:
|
||||
name: home-ops-kubernetes
|
||||
dependsOn:
|
||||
- name: cluster-apps-cloudnative-pg-cluster
|
||||
- name: cluster-apps-external-secrets-stores
|
||||
- name: cluster-apps-rook-ceph-cluster
|
||||
- name: cluster-apps-volsync-app
|
||||
healthChecks:
|
||||
|
||||
18
kubernetes/apps/default/mailrise/app/externalsecret.yaml
Normal file
18
kubernetes/apps/default/mailrise/app/externalsecret.yaml
Normal file
@@ -0,0 +1,18 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: mailrise
|
||||
namespace: default
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: onepassword-connect
|
||||
target:
|
||||
name: mailrise-secret
|
||||
creationPolicy: Owner
|
||||
dataFrom:
|
||||
- extract:
|
||||
# PUSHOVER_TRUENAS
|
||||
key: mailrise
|
||||
@@ -6,7 +6,7 @@ metadata:
|
||||
name: &app mailrise
|
||||
namespace: default
|
||||
spec:
|
||||
interval: 15m
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
@@ -15,7 +15,7 @@ spec:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
maxHistory: 3
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
@@ -39,7 +39,7 @@ spec:
|
||||
TZ: ${TIMEZONE}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: *app
|
||||
name: mailrise-secret
|
||||
service:
|
||||
main:
|
||||
type: LoadBalancer
|
||||
@@ -77,8 +77,6 @@ spec:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: *app
|
||||
podAnnotations:
|
||||
secret.reloader.stakater.com/reload: *app
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
|
||||
@@ -4,8 +4,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: default
|
||||
resources:
|
||||
- ./externalsecret.yaml
|
||||
- ./helmrelease.yaml
|
||||
- ./secret.sops.yaml
|
||||
configMapGenerator:
|
||||
- name: mailrise-configmap
|
||||
files:
|
||||
|
||||
@@ -1,29 +0,0 @@
|
||||
# yamllint disable
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: mailrise
|
||||
namespace: default
|
||||
type: Opaque
|
||||
stringData:
|
||||
PUSHOVER_TRUENAS: ENC[AES256_GCM,data:0sViJTQ7VNLccJLzJpwYQGbX0wP3oMCdMng/OFMW85Vfkejag0EEIP6HBCo/rOetq6VAtjvDoUNIx7I2HlHmm0uE7+oM,iv:bz43yn8QOG2/oWnxISTd5Y/JHVdhVfemcNWi62OGD2Q=,tag:YckZYWnKnhXB+0vUO9T5Tg==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaU16anJNV2pBZmxPR3h2
|
||||
bWREUnpjcTFvd05ZQ2E4VVBDdm1FL2k4WEYwCkdQSStTNWtpdjNkUW51WS9MekdC
|
||||
VkpTUUFjSjY2a1JMOUtqOVh5M0JRR2sKLS0tIDRmcWpJSEVvaUp4U1lsaTZYZGNw
|
||||
OGVKWU0zNUZJSFh4aFJxQWFsYm1VeFkKaDeI/hl7z0Qh8t5W39Kxu9ert1dt4xo+
|
||||
LX+MjpVqxiZNcfwROD4bkWeQSN+VsxoGOOyj4L15BlggNnlg+L7Hww==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2022-12-29T15:53:20Z"
|
||||
mac: ENC[AES256_GCM,data:NwSRgt+Qr/suY+xca7c9hAAivYTPr9Uo9dJ5bzJzN8F1Tj4jxQcD/NHYvn+8OiPg9PCOlVDLzwcuuwUBwDc01diUMmkH5VTz50nQIO+CNlESJrVCDLEId8qgw3qU9AlBg9ik1lmNtggwl5X8NLduzrmYqS3mi+/jgt/3spZuLOA=,iv:FDe5+AEFs+76sP4PkwLIoofKcg0AbEqITp7nZKfab7o=,tag:zwcklTcIo4qeGxFLasidEw==,type:str]
|
||||
pgp: []
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
version: 3.7.3
|
||||
@@ -13,6 +13,8 @@ spec:
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-ops-kubernetes
|
||||
dependsOn:
|
||||
- name: cluster-apps-external-secrets-stores
|
||||
healthChecks:
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./replicationsource.yaml
|
||||
- ./restic.sops.yaml
|
||||
@@ -1,21 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: media-browser
|
||||
namespace: default
|
||||
spec:
|
||||
sourcePVC: media-browser-config
|
||||
trigger:
|
||||
schedule: "0 0 * * *"
|
||||
restic:
|
||||
copyMethod: Snapshot
|
||||
pruneIntervalDays: 10
|
||||
repository: media-browser-restic
|
||||
cacheCapacity: 2Gi
|
||||
volumeSnapshotClassName: csi-ceph-blockpool
|
||||
storageClassName: rook-ceph-block
|
||||
retain:
|
||||
daily: 10
|
||||
within: 3d
|
||||
@@ -1,34 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: media-browser-restic
|
||||
type: Opaque
|
||||
stringData:
|
||||
#ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment]
|
||||
RESTIC_REPOSITORY: ENC[AES256_GCM,data:0yTdf+xoL8IPuWqVGPSWDpJ9/mDomP9QR5NCkDHrFDoY30nsvyDSChBWa3gCtrBjQOvyoXsfPg2N2eCCvSIR,iv:Ky3NuiDgw9w4isHBNcaWx1EQX5893GgaCPyhCNgmcLM=,tag:TnMn/2adBvA6emxeSRayxA==,type:str]
|
||||
#ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment]
|
||||
RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str]
|
||||
#ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment]
|
||||
#ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment]
|
||||
AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str]
|
||||
AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ
|
||||
THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB
|
||||
TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN
|
||||
dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4
|
||||
3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2022-12-28T14:47:51Z"
|
||||
mac: ENC[AES256_GCM,data:glyXcw3UgFAceT3sfX1YsO1pZBQg29fK8iXGiaIfx+AlHD/AerUOSoFGYHhlun3lRbXxv1jH8Q4Jkd4afpcQmA9fpXEEP/OIrWF0ORSrPG8jAOCGYHyFoMv4MevTUZqSfY2g8vVfYQt++5TBPDTZe/JNdoPO0v9ENGjWTnPnq3g=,iv:oynyyDwR0yLE5+ZtyZY1Ynhm5xbD8pQ05Hbz/tJROrY=,tag:ULMrr+hXq/Ga2vsf8hHcwg==,type:str]
|
||||
pgp: []
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
version: 3.7.3
|
||||
@@ -6,7 +6,7 @@ metadata:
|
||||
name: &app media-browser
|
||||
namespace: default
|
||||
spec:
|
||||
interval: 15m
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
@@ -15,7 +15,7 @@ spec:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
maxHistory: 3
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
@@ -27,6 +27,9 @@ spec:
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
controller:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
image:
|
||||
repository: docker.io/filebrowser/filebrowser
|
||||
tag: v2.23.0
|
||||
@@ -61,6 +64,7 @@ spec:
|
||||
enabled: true
|
||||
ingressClassName: "nginx"
|
||||
annotations:
|
||||
auth.home.arpa/enabled: "true"
|
||||
hajimari.io/icon: mdi:folder-play-outline
|
||||
hosts:
|
||||
- host: &host "{{ .Release.Name }}.${SECRET_CLUSTER_DOMAIN}"
|
||||
|
||||
@@ -4,6 +4,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: default
|
||||
resources:
|
||||
- ./backups
|
||||
- ./helmrelease.yaml
|
||||
- ./volsync.yaml
|
||||
- ./volume.yaml
|
||||
|
||||
49
kubernetes/apps/default/media-browser/app/volsync.yaml
Normal file
49
kubernetes/apps/default/media-browser/app/volsync.yaml
Normal file
@@ -0,0 +1,49 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: lychee-restic
|
||||
namespace: default
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: onepassword-connect
|
||||
target:
|
||||
name: lychee-restic-secret
|
||||
creationPolicy: Owner
|
||||
template:
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: '{{ .REPOSITORY_TEMPLATE }}/lychee'
|
||||
RESTIC_PASSWORD: '{{ .RESTIC_PASSWORD }}'
|
||||
AWS_ACCESS_KEY_ID: '{{ .AWS_ACCESS_KEY_ID }}'
|
||||
AWS_SECRET_ACCESS_KEY: '{{ .AWS_SECRET_ACCESS_KEY }}'
|
||||
dataFrom:
|
||||
- extract:
|
||||
key: volsync-restic-template
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/volsync.backube/replicationsource_v1alpha1.json
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: lychee
|
||||
namespace: default
|
||||
spec:
|
||||
sourcePVC: lychee-files
|
||||
trigger:
|
||||
schedule: "0 7 * * *"
|
||||
restic:
|
||||
copyMethod: Snapshot
|
||||
pruneIntervalDays: 7
|
||||
repository: lychee-restic-secret
|
||||
cacheCapacity: 20Gi
|
||||
volumeSnapshotClassName: csi-ceph-blockpool
|
||||
storageClassName: rook-ceph-block
|
||||
moverSecurityContext:
|
||||
runAsUser: 33
|
||||
runAsGroup: 33
|
||||
fsGroup: 33
|
||||
retain:
|
||||
daily: 7
|
||||
within: 3d
|
||||
@@ -9,6 +9,7 @@ metadata:
|
||||
substitution.flux.home.arpa/enabled: "true"
|
||||
spec:
|
||||
dependsOn:
|
||||
- name: cluster-apps-external-secrets-stores
|
||||
- name: cluster-apps-rook-ceph-cluster
|
||||
- name: cluster-apps-volsync-app
|
||||
path: ./kubernetes/apps/default/media-browser/app
|
||||
|
||||
@@ -6,7 +6,7 @@ metadata:
|
||||
name: music-transcode
|
||||
namespace: default
|
||||
spec:
|
||||
interval: 15m
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
@@ -15,7 +15,7 @@ spec:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
maxHistory: 3
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./replicationsource.yaml
|
||||
- ./restic.sops.yaml
|
||||
@@ -1,25 +0,0 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: navidrome
|
||||
namespace: default
|
||||
spec:
|
||||
sourcePVC: navidrome-config
|
||||
trigger:
|
||||
schedule: "0 0 * * *"
|
||||
restic:
|
||||
copyMethod: Snapshot
|
||||
pruneIntervalDays: 10
|
||||
repository: navidrome-restic
|
||||
cacheCapacity: 2Gi
|
||||
volumeSnapshotClassName: csi-ceph-blockpool
|
||||
storageClassName: rook-ceph-block
|
||||
moverSecurityContext:
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
retain:
|
||||
daily: 10
|
||||
within: 3d
|
||||
@@ -1,34 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: navidrome-restic
|
||||
type: Opaque
|
||||
stringData:
|
||||
#ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment]
|
||||
RESTIC_REPOSITORY: ENC[AES256_GCM,data:/DJM9W9fInB4vj+epdSzoZ6qLJbtgNATZXW34AZ2gStf57gF8QB2z+kiKKEv4bYdcMmg2Q06ejPMvxc=,iv:3gMbOnVt7DZjiMVy3h9FkXDWBdyw1uLmPtwKvApqKyQ=,tag:jFRup6tGA8pfvOOPGlkfow==,type:str]
|
||||
#ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment]
|
||||
RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str]
|
||||
#ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment]
|
||||
#ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment]
|
||||
AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str]
|
||||
AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ
|
||||
THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB
|
||||
TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN
|
||||
dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4
|
||||
3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2022-12-28T14:46:17Z"
|
||||
mac: ENC[AES256_GCM,data:NWdJiyeL7eqshNhdWXQNHYOEFRbJ38hlz6p2K1RW+poJaSdFwk8sPIcou/h2xbU2Dxf3I7om0nZEeLgFtL1RZ7uTk5fpE6eOvtFerQx+uhHOfm03Ti2kofDLf/RgufPtw9ztq73a/lFBlAYAIFzn9PM95fkvjdRfrHs05PuNFAc=,iv:L7+N//Mh32T9gT5AQ9Nq433odU2lxEot1KaJkEbjOLQ=,tag:Fn4B2an5C0+H48rSc5aQnA==,type:str]
|
||||
pgp: []
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
version: 3.7.3
|
||||
@@ -6,7 +6,7 @@ metadata:
|
||||
name: &app navidrome
|
||||
namespace: default
|
||||
spec:
|
||||
interval: 15m
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
@@ -15,7 +15,7 @@ spec:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
maxHistory: 3
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
|
||||
@@ -4,6 +4,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: default
|
||||
resources:
|
||||
- ./backups
|
||||
- ./helmrelease.yaml
|
||||
- ./volsync.yaml
|
||||
- ./volume.yaml
|
||||
|
||||
49
kubernetes/apps/default/navidrome/app/volsync.yaml
Normal file
49
kubernetes/apps/default/navidrome/app/volsync.yaml
Normal file
@@ -0,0 +1,49 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: navidrome-restic
|
||||
namespace: default
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: onepassword-connect
|
||||
target:
|
||||
name: navidrome-restic-secret
|
||||
creationPolicy: Owner
|
||||
template:
|
||||
engineVersion: v2
|
||||
data:
|
||||
RESTIC_REPOSITORY: '{{ .REPOSITORY_TEMPLATE }}/navidrome'
|
||||
RESTIC_PASSWORD: '{{ .RESTIC_PASSWORD }}'
|
||||
AWS_ACCESS_KEY_ID: '{{ .AWS_ACCESS_KEY_ID }}'
|
||||
AWS_SECRET_ACCESS_KEY: '{{ .AWS_SECRET_ACCESS_KEY }}'
|
||||
dataFrom:
|
||||
- extract:
|
||||
key: volsync-restic-template
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/volsync.backube/replicationsource_v1alpha1.json
|
||||
apiVersion: volsync.backube/v1alpha1
|
||||
kind: ReplicationSource
|
||||
metadata:
|
||||
name: navidrome
|
||||
namespace: default
|
||||
spec:
|
||||
sourcePVC: navidrome-config
|
||||
trigger:
|
||||
schedule: "0 7 * * *"
|
||||
restic:
|
||||
copyMethod: Snapshot
|
||||
pruneIntervalDays: 7
|
||||
repository: navidrome-restic-secret
|
||||
cacheCapacity: 20Gi
|
||||
volumeSnapshotClassName: csi-ceph-blockpool
|
||||
storageClassName: rook-ceph-block
|
||||
moverSecurityContext:
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
fsGroup: 568
|
||||
retain:
|
||||
daily: 7
|
||||
within: 3d
|
||||
@@ -9,6 +9,7 @@ metadata:
|
||||
substitution.flux.home.arpa/enabled: "true"
|
||||
spec:
|
||||
dependsOn:
|
||||
- name: cluster-apps-external-secrets-stores
|
||||
- name: cluster-apps-rook-ceph-cluster
|
||||
- name: cluster-apps-volsync-app
|
||||
path: ./kubernetes/apps/default/navidrome/app
|
||||
|
||||
@@ -6,7 +6,7 @@ metadata:
|
||||
name: &app nitter
|
||||
namespace: default
|
||||
spec:
|
||||
interval: 15m
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
@@ -15,7 +15,7 @@ spec:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
maxHistory: 3
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
@@ -27,6 +27,9 @@ spec:
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
controller:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
image:
|
||||
repository: docker.io/zedeus/nitter
|
||||
tag: latest@sha256:db0674e7426309b0ae41ad36fa0bbd1d52ab7abe20823b27a49017116a2c0b34
|
||||
@@ -74,8 +77,6 @@ spec:
|
||||
subPath: config.yml
|
||||
mountPath: /src/nitter.conf
|
||||
readOnly: false
|
||||
podAnnotations:
|
||||
secret.reloader.stakater.com/reload: *app
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
|
||||
18
kubernetes/apps/default/opnsense/app/externalsecret.yaml
Normal file
18
kubernetes/apps/default/opnsense/app/externalsecret.yaml
Normal file
@@ -0,0 +1,18 @@
|
||||
---
|
||||
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: opnsense-backup
|
||||
namespace: default
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: onepassword-connect
|
||||
target:
|
||||
name: opnsense-backup-secret
|
||||
creationPolicy: Owner
|
||||
dataFrom:
|
||||
- extract:
|
||||
# OPNSENSE_KEY, OPNSENSE_SECRET, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
|
||||
key: opnsense-backup
|
||||
@@ -6,7 +6,7 @@ metadata:
|
||||
name: opnsense-backup
|
||||
namespace: default
|
||||
spec:
|
||||
interval: 15m
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
@@ -15,13 +15,17 @@ spec:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
controller:
|
||||
type: cronjob
|
||||
|
||||
@@ -4,7 +4,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: default
|
||||
resources:
|
||||
- ./secret.sops.yaml
|
||||
- ./externalsecret.yaml
|
||||
- ./helmrelease.yaml
|
||||
configMapGenerator:
|
||||
- name: opnsense-backup-configmap
|
||||
|
||||
@@ -1,31 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: opnsense-backup-secret
|
||||
namespace: default
|
||||
type: Opaque
|
||||
stringData:
|
||||
OPNSENSE_KEY: ENC[AES256_GCM,data:o2RT80AbQJg1EOFbX3iMIyC8eRIVx0YcL7/+H51SpDdcs0ynisIaKgycxOTg6t65VTApnVhyZaWgVbQxfSsH2zKuGT9dFYfUHbcFjve3isc=,iv:l/qvdOFBZhA2LFV7Q6vIBuVkNSJmEWEqiAUU9vXsSuo=,tag:Itiz/H7S4F+TktGyT7WX2A==,type:str]
|
||||
OPNSENSE_SECRET: ENC[AES256_GCM,data:ITYxDGhq7rxU2w3BSa3t+ka/TbPipP1tJzoUuWkvNyXxBlNV277oNRWxMUta210+xq9C8m7BD7ay6lVrbvev4Rf8YNdgTGXl6tFmfVnSqmo=,iv:MbrRhgGoRz2cu9H0y+pYBZrX2CikDfplOGH0h8e6GDo=,tag:pVqki2c534KKZ8GLSF3BlQ==,type:str]
|
||||
AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:bi/0BL4yJo64Ya4tFmyjjfxcSgM=,iv:WfaYaVCMvq4MlUY3AHyyd5UyVngLX8qjC4WDJyStGhg=,tag:6Rk/Qsf5cfSbZm0be4V1wA==,type:str]
|
||||
AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:jfCGidFYWH45ilkGvViGLQ8ZXDTMCKaH93DtbtEwITGlEUuMYNZIxA==,iv:2kNo+aj7m9rCaovgXoIbiTQFgUux9L4LsQLH+GHGLaA=,tag:m+qNg1DHuNfaakYdMB4QpQ==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmMEhOUTJMcUYvNFozRDNr
|
||||
WnhJTEYzVWN4V1VXemhtWWU1SmMvUmljNFFNCk91aHhXRVBDSzhhcjIzalQ5SEpN
|
||||
cTJIOGVVYWNYRGdtMm5nZUZ5Q0EzTE0KLS0tIFRMYnNGakdrSktjT2ZoNk1sN21C
|
||||
YlhlTVhRdDFJUVZiMTdtVXlveWNDWE0KG7MKLp5tUCm7KpuhpmsvAWDrreBuHSEp
|
||||
zyH6hY1i7jgjh020qZI32zNDHeTIJhi+mHur/jvBJhEGLMz6JYUPrg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2022-12-29T07:38:56Z"
|
||||
mac: ENC[AES256_GCM,data:1tbBSKSUY1PFKcoQshI/6mv1KUV3b/K/BGALgNNDunjc4PRVBOMbZI6Aa4MWk0ElN7NB9Y6nO+Gv+i6sTet4peRMEBnfoWTSRjImYMiyt+aQ2XjMfI/ZEtOBgv8VFmSQr68Mkgp1zDLiD8lCwewE1nqoUg82jQNzy/bFUYcvIfY=,iv:IKd7yXgBfZBJX7yKH6HzlETA7WBvJrmsWNpO+ZZsElA=,tag:5R05VsD8CPHu8PX+MLXuJw==,type:str]
|
||||
pgp: []
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
version: 3.7.3
|
||||
@@ -13,6 +13,8 @@ spec:
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-ops-kubernetes
|
||||
dependsOn:
|
||||
- name: cluster-apps-external-secrets-stores
|
||||
healthChecks:
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
|
||||
Reference in New Issue
Block a user