Current snapshot of state with unused garbage.
This commit is contained in:
Aner Zakobar
@@ -0,0 +1,24 @@
|
||||
---
|
||||
{{- define "homey.auth.ingress.annotations" }}
|
||||
# nginx.ingress.kubernetes.io/auth-signin: "https://auth.zakobar.com"
|
||||
nginx.ingress.kubernetes.io/auth-url: "http://ldap-auth-internal.{{ .Release.Namespace }}.svc.cluster.local:80"
|
||||
nginx.ingress.kubernetes.io/auth-response-headers: Remote-User,Remote-Name,Remote-Email
|
||||
nginx.ingress.kubernetes.io/location-snippets: |-
|
||||
auth_request /auth
|
||||
nginx.ingress.kubernetes.io/configuration-snippet: |-
|
||||
location /auth {
|
||||
# proxy_pass http://ldap-auth-internal;
|
||||
proxy_pass_request_body off;
|
||||
#THIS NEEDS TO BE SET BY ACTUAL SOMETHING LOGIN SHIT
|
||||
# proxy_set_header X-Target http://ldap-auth-internal.{{ .Release.Namespace }}.svc.cluster.local:80;
|
||||
proxy_set_header X-Ldap-URL "ldap://openldap";
|
||||
proxy_set_header X-Ldap-BaseDN "ou=users,{{ .Values.homey.url | replace "." ",dc=" | printf "dc=%s " | trim }}";
|
||||
proxy_set_header X-Ldap-BindDN "cn=readonly,{{ .Values.homey.url | replace "." ",dc=" | printf "dc=%s " | trim }}";
|
||||
proxy_set_header X-Ldap-BindPass {{ (get (get (lookup "v1" "Secret" .Release.Namespace "openldap-ro") "data") "password") | b64dec | quote}};
|
||||
proxy_set_header X-CookieName "homey.auth.cookie";
|
||||
proxy_set_header Cookie $cookie_homey.auth.cookie;
|
||||
proxy_set_header X-Remote-User $remote_user;
|
||||
proxy_set_header X-Forwarded-Method $request_method;
|
||||
proxy_set_header X-Ldap-Template "(uid=%(username)s)";
|
||||
}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,117 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: baikal-data-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: baikal-config-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: baikal
|
||||
labels:
|
||||
app: baikal
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: baikal
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: baikal
|
||||
spec:
|
||||
containers:
|
||||
- name: baikal
|
||||
image: ckulka/baikal
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: dav
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /var/www/baikal/config
|
||||
subPath: config
|
||||
- name: data
|
||||
mountPath: /var/www/baikal/Specific
|
||||
subPath: Specific
|
||||
restartPolicy: Always
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: baikal-data-pvc
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: baikal-config-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: baikal
|
||||
spec:
|
||||
selector:
|
||||
app: baikal
|
||||
ports:
|
||||
- name: dav
|
||||
protocol: TCP
|
||||
port: 80
|
||||
targetPort: 80
|
||||
selector:
|
||||
app: baikal
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: baikal
|
||||
annotations:
|
||||
kubernetes.io/ingress.allow-http: "false"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/auth-method: GET
|
||||
nginx.ingress.kubernetes.io/auth-url: http://authelia.{{ .Release.Namespace }}.svc.cluster.local:9091/api/verify
|
||||
nginx.ingress.kubernetes.io/auth-signin: https://auth.{{ .Values.homey.url }}?rm=$request_method
|
||||
nginx.ingress.kubernetes.io/auth-response-headers: Remote-User,Remote-Name,Remote-Groups,Remote-Email
|
||||
nginx.ingress.kubernetes.io/auth-snippet: |
|
||||
proxy_set_header X-Forwarded-Method $request_method;
|
||||
auth_request_set $user $upstream_http_remote_user;
|
||||
auth_request_set $groups $upstream_http_remote_groups;
|
||||
auth_request_set $name $upstream_http_remote_name;
|
||||
auth_request_set $email $upstream_http_remote_email;
|
||||
proxy_set_header X-Remote-User $user;
|
||||
proxy_set_header X-Remote-Fullname $name;
|
||||
proxy_set_header X-Remote-Email $email;
|
||||
spec:
|
||||
ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
tls:
|
||||
- hosts:
|
||||
- dav.{{ .Values.homey.url }}
|
||||
secretName: {{ .Values.homey.certname }}
|
||||
rules:
|
||||
- host: dav.{{ .Values.homey.url }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: baikal
|
||||
port:
|
||||
number: 80
|
||||
---
|
||||
@@ -0,0 +1,71 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: baikal
|
||||
labels:
|
||||
app: baikal
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: baikal
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: baikal
|
||||
spec:
|
||||
containers:
|
||||
- name: baikal
|
||||
image: ckulka/baikal
|
||||
ports:
|
||||
- name: dav
|
||||
containerPort: 80
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: baikal-volume
|
||||
mountPath: /var/www/baikal/Specific
|
||||
subPath: baikal/data
|
||||
- name: baikal-volume
|
||||
mountPath: /var/www/baikal/config
|
||||
subPath: baikal/config
|
||||
restartPolicy: Always
|
||||
volumes:
|
||||
- name: baikal-volume
|
||||
persistentVolumeClaim:
|
||||
claimName: homey-pvc-longhorn
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: baikal
|
||||
spec:
|
||||
ports:
|
||||
- name: dav
|
||||
targetPort: 80
|
||||
port: 80
|
||||
selector:
|
||||
app: baikal
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: baikal
|
||||
spec:
|
||||
ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
tls:
|
||||
- hosts:
|
||||
- dav.{{ .Values.homey.url }}
|
||||
secretName: {{ .Values.homey.certname }}
|
||||
rules:
|
||||
- host: dav.{{ .Values.homey.url }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: baikal
|
||||
port:
|
||||
name: dav
|
||||
---
|
||||
@@ -0,0 +1,213 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: davical-postgres-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
storageClassName: longhorn
|
||||
|
||||
---
|
||||
{{- $_ := set $ "homey_davical_postgres_pass" (include "homey.lookuporgensecret" (merge (dict "secretname" "davical-postgres-pass") $))}}
|
||||
{{ include "homey.randomsecret" (merge (dict "secretname" "davical-postgres-pass" "secretval" .homey_davical_postgres_pass) $) }}
|
||||
---
|
||||
# apiVersion: extensions/v1beta1
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: davical-postgres-config
|
||||
labels:
|
||||
app: davical-postgres
|
||||
data:
|
||||
POSTGRES_DB: postgres
|
||||
POSTGRES_USER: postgres
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: davical-postgres
|
||||
labels:
|
||||
app: davical-postgres
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: davical-postgres
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: davical-postgres
|
||||
name: davical-postgres
|
||||
spec:
|
||||
containers:
|
||||
- name: davical-postgres
|
||||
image: postgres
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: davical-postgres-config
|
||||
env:
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: davical-postgres-pass
|
||||
key: password
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/postgresql/data
|
||||
subPath: data
|
||||
name: davical-postgredb
|
||||
volumes:
|
||||
- name: davical-postgredb
|
||||
persistentVolumeClaim:
|
||||
claimName: davical-postgres-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: davical-postgres
|
||||
labels:
|
||||
app: davical-postgres
|
||||
spec:
|
||||
ports:
|
||||
- port: 5432
|
||||
selector:
|
||||
app: davical-postgres
|
||||
---
|
||||
{{- $_ := set $ "homey_davical_admin_pass" (include "homey.lookuporgensecret" (merge (dict "secretname" "davical-admin-pass") $))}}
|
||||
{{ include "homey.randomsecret" (merge (dict "secretname" "davical-admin-pass" "secretval" .homey_davical_admin_pass) $) }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: davical-conf
|
||||
data:
|
||||
config.php: |-
|
||||
{{ tpl (.Files.Get "files/davical-config.php" | indent 4) . }}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: davical
|
||||
labels:
|
||||
app: davical
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: davical
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: davical
|
||||
spec:
|
||||
containers:
|
||||
- name: davical
|
||||
image: anerisgreat/davical-multiarch-docker:latest
|
||||
imagePullPolicy: "Always"
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: dav
|
||||
env:
|
||||
- name: PGHOST
|
||||
value: "davical-postgres"
|
||||
- name: PGUSER
|
||||
value: "postgres"
|
||||
- name: PGPASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: davical-postgres-pass
|
||||
key: password
|
||||
- name: PGDATABASE
|
||||
value: "davical"
|
||||
- name: PGPORT
|
||||
value: "5432"
|
||||
- name: HOST_NAME
|
||||
value:
|
||||
"dav.{{ .Values.homey.url }}"
|
||||
- name: DAVICAL_ADMIN_PASS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: davical-admin-pass
|
||||
key: password
|
||||
- name: ROOT_PGUSER
|
||||
value: "postgres"
|
||||
- name: ROOT_PGPASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: davical-postgres-pass
|
||||
key: password
|
||||
- name: RUN_MIGRATIONS_AT_STARTUP
|
||||
value: "true"
|
||||
volumeMounts:
|
||||
- name: davical-conf
|
||||
mountPath: /etc/davical/config.php
|
||||
subPath: config.php
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: davical-conf
|
||||
configMap:
|
||||
name: davical-conf
|
||||
items:
|
||||
- key: config.php
|
||||
path: config.php
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: davical
|
||||
spec:
|
||||
selector:
|
||||
app: davical
|
||||
ports:
|
||||
- name: dav
|
||||
protocol: TCP
|
||||
port: 80
|
||||
targetPort: 80
|
||||
selector:
|
||||
app: davical
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: davical
|
||||
annotations:
|
||||
kubernetes.io/ingress.allow-http: "false"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/auth-method: GET
|
||||
nginx.ingress.kubernetes.io/auth-url: http://authelia.{{ .Release.Namespace }}.svc.cluster.local:9091/api/verify
|
||||
nginx.ingress.kubernetes.io/auth-signin: https://auth.{{ .Values.homey.url }}?rm=$request_method
|
||||
nginx.ingress.kubernetes.io/auth-response-headers: Remote-User,Remote-Name,Remote-Groups,Remote-Email
|
||||
nginx.ingress.kubernetes.io/auth-snippet: |
|
||||
proxy_set_header X-Forwarded-Method $request_method;
|
||||
auth_request_set $user $upstream_http_remote_user;
|
||||
auth_request_set $groups $upstream_http_remote_groups;
|
||||
auth_request_set $name $upstream_http_remote_name;
|
||||
auth_request_set $email $upstream_http_remote_email;
|
||||
proxy_set_header Remote-User $user;
|
||||
proxy_set_header Remote-Fullname $name;
|
||||
proxy_set_header Remote-Email $email;
|
||||
proxy_set_header Redirect-Remote-User $user;
|
||||
proxy_set_header Redirect-Remote-Fullname $name;
|
||||
proxy_set_header Redirect-Remote-Email $email;
|
||||
spec:
|
||||
ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
tls:
|
||||
- hosts:
|
||||
- dav.{{ .Values.homey.url }}
|
||||
secretName: {{ .Values.homey.certname }}
|
||||
rules:
|
||||
- host: dav.{{ .Values.homey.url }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: davical
|
||||
port:
|
||||
number: 80
|
||||
@@ -0,0 +1,131 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: gitea-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
{{- $_ := set $ "homey_gitea_admin_pass" (include "homey.lookuporgensecret" (merge (dict "secretname" "gitea-admin-pass") $))}}
|
||||
{{ include "homey.randomsecret" (merge (dict "secretname" "gitea-admin-pass" "secretval" .homey_gitea_admin_pass) $) }}
|
||||
---
|
||||
{{- $_ := set $ "homey_gitea_lfs_jwt_secret" (include "homey.lookuporgensecret" (merge (dict "secretname" "gitea-lfs-jwt-secret") $))}}
|
||||
{{ include "homey.randomsecret" (merge (dict "secretname" "gitea-lfs-jwt-secret" "secretval" .homey_gitea_lfs_jwt_secret) $) }}
|
||||
---
|
||||
{{- $_ := set $ "homey_gitea_oauth2_jwt_secret" (include "homey.lookuporgensecret" (merge (dict "secretname" "gitea-oauth2-jwt-secret") $))}}
|
||||
{{ include "homey.randomsecret" (merge (dict "secretname" "gitea-oauth2-jwt-secret" "secretval" .homey_gitea_oauth2_jwt_secret) $) }}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: gitea-random-internal-token
|
||||
annotations:
|
||||
"helm.sh/resource-policy": "keep"
|
||||
type: Opaque
|
||||
data:
|
||||
{{- $secretObj := (lookup "v1" "Secret" .Release.Namespace "gitea-random-internal-token") | default dict -}}
|
||||
{{- $secretData := (get $secretObj "data") | default dict -}}
|
||||
{{- $pass := (get $secretData "password") | default (randAlphaNum 100 | b64enc) -}}
|
||||
{{- $_ := set $ "homey_gitea_random_internal_token" ($pass | b64dec) }}
|
||||
password: {{ $pass | quote }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: gitea-conf
|
||||
data:
|
||||
app.ini: |-
|
||||
{{ tpl (.Files.Get "files/gitea-app.ini" | indent 4) . }}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: gitea
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: gitea
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: gitea
|
||||
spec:
|
||||
containers:
|
||||
- name: gitea
|
||||
image: gitea/gitea:latest
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
volumeMounts:
|
||||
- name: gitea-persistent-storage
|
||||
mountPath: /data
|
||||
subPath: gitea/gitea/data
|
||||
- name: gitea-conf
|
||||
mountPath: /data/gitea/conf/app.ini
|
||||
subPath: app.ini
|
||||
readOnly: true
|
||||
# startProbe:
|
||||
# httpGet:
|
||||
# path: /
|
||||
# port: 3000
|
||||
# initialDelaySeconds: 15
|
||||
# lifecycle:
|
||||
# postStart:
|
||||
# exec:
|
||||
# {{- set $gitea-cmd (printf "gitea admin auth add-ldap --name ldap --security-protocol unencrypted --host ldap --port 389 --user-search-base ou=users,%s --user-filter \\\"(&(objectClass=inetOrgPerson)(|(uid=\%[1]s)(mail=\%[1]s)))\\\" --email-attribute mail --bind-dn=\\\"cn=readonly,%s\\\" --bind-password=\\\"%s\\\"" ( .Values.homey.url | replace "." ",dc=" | printf "dc=%s " | trim) () (.homey_openldap_ro | replace "\"" ""))}}
|
||||
# command: ["/bin/sh", "-c", "{{cmd}}"]
|
||||
volumes:
|
||||
- name: gitea-persistent-storage
|
||||
persistentVolumeClaim:
|
||||
claimName: gitea-pvc
|
||||
- name: gitea-conf
|
||||
configMap:
|
||||
name: gitea-conf
|
||||
items:
|
||||
- key: app.ini
|
||||
path: app.ini
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: gitea-svc
|
||||
spec:
|
||||
selector:
|
||||
app: gitea
|
||||
ports:
|
||||
- name: http-port
|
||||
protocol: TCP
|
||||
port: 3000
|
||||
targetPort: http
|
||||
selector:
|
||||
app: gitea
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: gitea-ingress
|
||||
spec:
|
||||
ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
tls:
|
||||
- hosts:
|
||||
- git.{{ .Values.homey.url }}
|
||||
secretName: {{ .Values.homey.certname }}
|
||||
rules:
|
||||
- host: git.{{ .Values.homey.url }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: gitea-svc
|
||||
port:
|
||||
number: 3000
|
||||
---
|
||||
@@ -0,0 +1,92 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: jellyfin-config-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 100Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: jellyfin-data-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 700Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: jellyfin
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: jellyfin
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: jellyfin
|
||||
spec:
|
||||
containers:
|
||||
- name: jellyfin
|
||||
image: docker.io/jellyfin/jellyfin
|
||||
volumeMounts:
|
||||
- name: jellyfin-volume-config
|
||||
mountPath: "/config"
|
||||
subPath: jellyfin/config
|
||||
- name: jellyfin-volume-data
|
||||
mountPath: "/data/movies"
|
||||
subPath: downloads/movies
|
||||
- name: jellyfin-volume-data
|
||||
mountPath: "/data/tvshows"
|
||||
subPath: downloads/tvshows
|
||||
- env:
|
||||
- name: JELLYFIN_PublishedServerUrl
|
||||
value: jellyfin.{{ .Values.homey.url }}
|
||||
volumes:
|
||||
- name: jellyfin-volume-config
|
||||
persistentVolumeClaim:
|
||||
claimName: jellyfin-config-pvc
|
||||
- name: jellyfin-volume-data
|
||||
persistentVolumeClaim:
|
||||
claimName: jellyfin-data-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: jellyfin-web
|
||||
namespace: homecenter
|
||||
spec:
|
||||
selector:
|
||||
app: jellyfin
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 8096
|
||||
name: jellyfin-web
|
||||
---
|
||||
ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
tls:
|
||||
- hosts:
|
||||
- jellyfin.{{ .Values.homey.url }}
|
||||
secretName: {{ .Values.homey.certname }}
|
||||
rules:
|
||||
- host: jellyfin.{{ .Values.homey.url }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: jellyfin-web
|
||||
port:
|
||||
number: 80
|
||||
---
|
||||
@@ -0,0 +1,70 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: ldap-auth
|
||||
labels:
|
||||
app: ldap-auth
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ldap-auth
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: ldap-auth
|
||||
name: ldap-auth
|
||||
spec:
|
||||
containers:
|
||||
- name: ldap-auth
|
||||
image: linuxserver/ldap-auth
|
||||
imagePullPolicy: Always
|
||||
---
|
||||
#https://stackoverflow.com/questions/51149921/how-to-authenticate-nginx-with-ldap
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ldap-auth
|
||||
spec:
|
||||
selector:
|
||||
app: ldap-auth
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 9000
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ldap-auth-internal
|
||||
spec:
|
||||
selector:
|
||||
app: ldap-auth
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 8888
|
||||
---
|
||||
# apiVersion: networking.k8s.io/v1
|
||||
# kind: Ingress
|
||||
# metadata:
|
||||
# name: ldap-auth-ingress
|
||||
# annotations:
|
||||
# spec:
|
||||
# ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
# tls:
|
||||
# - hosts:
|
||||
# - auth.{{ .Values.homey.url }}
|
||||
# secretName: {{ .Values.homey.certname }}
|
||||
# rules:
|
||||
# - host: auth.{{ .Values.homey.url }}
|
||||
# http:
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
# backend:
|
||||
# service:
|
||||
# name: ldap-auth
|
||||
# port:
|
||||
# number: 80
|
||||
# ---
|
||||
|
||||
@@ -0,0 +1,206 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: nextcloud-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 30Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: nextcloud-postgres-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: nextcloud-data-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 30Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: nextcloud-postgres-pass
|
||||
annotations:
|
||||
"helm.sh/resource-policy": "keep"
|
||||
type: Opaque
|
||||
data:
|
||||
{{- $secretObj := (lookup "v1" "Secret" .Release.Namespace "nextcloud-postgres-pass") | default dict }}
|
||||
{{- $secretData := (get $secretObj "data") | default dict }}
|
||||
{{- $pass := (get $secretData "password") | default (randAlphaNum 32 | b64enc) }}
|
||||
password: {{ $pass | quote }}
|
||||
---
|
||||
# apiVersion: extensions/v1beta1
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: nextcloud-postgres-config
|
||||
labels:
|
||||
app: nextcloud-postgres
|
||||
data:
|
||||
POSTGRES_DB: nextcloud_db
|
||||
POSTGRES_USER: postgres
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: nextcloud-postgres
|
||||
labels:
|
||||
app: nextcloud-postgres
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: nextcloud-postgres
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: nextcloud-postgres
|
||||
name: nextcloud-postgres
|
||||
spec:
|
||||
containers:
|
||||
- name: nextcloud-postgres
|
||||
image: postgres
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: nextcloud-postgres-config
|
||||
env:
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: nextcloud-postgres-pass
|
||||
key: password
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/postgresql/data
|
||||
subPath: nextcloud/db
|
||||
name: nextcloud-postgredb
|
||||
volumes:
|
||||
- name: nextcloud-postgredb
|
||||
persistentVolumeClaim:
|
||||
claimName: nextcloud-postgres-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: nextcloud-postgres
|
||||
labels:
|
||||
app: nextcloud-postgres
|
||||
spec:
|
||||
ports:
|
||||
- port: 5432
|
||||
selector:
|
||||
app: nextcloud-postgres
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: nextcloud
|
||||
labels:
|
||||
app: nextcloud
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: nextcloud
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: nextcloud
|
||||
name: nextcloud
|
||||
spec:
|
||||
containers:
|
||||
- name: nextcloud
|
||||
image: nextcloud
|
||||
imagePullPolicy: Always
|
||||
volumeMounts:
|
||||
- name: nextcloud-volume
|
||||
mountPath: "/var/www/html"
|
||||
subPath: nextcloud/html
|
||||
- name: nextcloud-media
|
||||
mountPath: "/var/www/html/data"
|
||||
subPath: nextcloud/html/data
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: nextcloud-postgres-config
|
||||
env:
|
||||
- name: POSTGRES_HOST
|
||||
value: "nextcloud-postgres"
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: nextcloud-postgres-pass
|
||||
key: password
|
||||
- name: OVERWRITEPROTOCOL
|
||||
value: "https"
|
||||
volumes:
|
||||
- name: nextcloud-volume
|
||||
persistentVolumeClaim:
|
||||
claimName: nextcloud-pvc
|
||||
- name: nextcloud-media
|
||||
persistentVolumeClaim:
|
||||
claimName: nextcloud-data-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: nextcloud
|
||||
spec:
|
||||
selector:
|
||||
app: nextcloud
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 80
|
||||
name: nextcloud
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: nextcloud-ingress
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: 5g
|
||||
nginx.ingress.kubernetes.io/server-snippet: |
|
||||
# Make a regex exception for `/.well-known` so that clients can still
|
||||
# access it despite the existence of the regex rule
|
||||
# `location ~ /(\.|autotest|...)` which would otherwise handle requests
|
||||
# for `/.well-known`.
|
||||
location = /.well-known/carddav { return 301 https://nextcloud.zakobar.com/remote.php/dav/; }
|
||||
location = /.well-known/caldav { return 301 https://nextcloud.zakobar.com/remote.php/dav/; }
|
||||
spec:
|
||||
ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
tls:
|
||||
- hosts:
|
||||
- nextcloud.{{ .Values.homey.url }}
|
||||
secretName: {{ .Values.homey.certname }}
|
||||
rules:
|
||||
- host: nextcloud.{{ .Values.homey.url }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: nextcloud
|
||||
port:
|
||||
number: 80
|
||||
---
|
||||
@@ -0,0 +1,230 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: paperless-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 50Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: paperless-redis
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: paperless-redis
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: paperless-redis
|
||||
spec:
|
||||
containers:
|
||||
- name: paperless
|
||||
image: redis
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
ports:
|
||||
- containerPort: 6379
|
||||
name: redis
|
||||
volumeMounts:
|
||||
- name: paperless-volume
|
||||
mountPath: "/data"
|
||||
subPath: paperless/redis-data
|
||||
volumes:
|
||||
- name: paperless-volume
|
||||
persistentVolumeClaim:
|
||||
claimName: paperless-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: paperless-redis
|
||||
spec:
|
||||
selector:
|
||||
app: paperless-redis
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 8000
|
||||
name: paperless-web
|
||||
|
||||
---
|
||||
{{- $_ := set $ "homey_paperless_postgres_pass" (include "homey.lookuporgensecret" (merge (dict "secretname" "paperless-postgres-pass") $))}}
|
||||
{{ include "homey.randomsecret" (merge (dict "secretname" "paperless-postgres-pass" "secretval" .homey_paperless_postgres_pass) $) }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: paperless-postgres-config
|
||||
labels:
|
||||
app: paperless-postgres
|
||||
data:
|
||||
POSTGRES_DB: paperless
|
||||
POSTGRES_USER: paperless
|
||||
POSTGRES_PASSWORD: paperless
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: paperless-postgres
|
||||
labels:
|
||||
app: paperless-postgres
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: paperless-postgres
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: paperless-postgres
|
||||
name: paperless-postgres
|
||||
spec:
|
||||
containers:
|
||||
- name: paperless-postgres
|
||||
image: postgres
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: paperless-postgres-config
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/postgresql/data
|
||||
subPath: paperless/db
|
||||
name: paperless-volume
|
||||
volumes:
|
||||
- name: paperless-volume
|
||||
persistentVolumeClaim:
|
||||
claimName: paperless-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: paperless-postgres
|
||||
labels:
|
||||
app: paperless-postgres
|
||||
spec:
|
||||
ports:
|
||||
- port: 5432
|
||||
selector:
|
||||
app: paperless-postgres
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: paperless
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: paperless
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: paperless
|
||||
spec:
|
||||
containers:
|
||||
- name: paperless
|
||||
image: ghcr.io/paperless-ngx/paperless-ngx:latest
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
name: paperless-web
|
||||
volumeMounts:
|
||||
- name: paperless-volume
|
||||
mountPath: "/usr/src/paperless/data"
|
||||
subPath: paperless/data
|
||||
- name: paperless-volume
|
||||
mountPath: "/usr/src/paperless/media"
|
||||
subPath: paperless/media
|
||||
- name: paperless-volume
|
||||
mountPath: "/usr/src/paperless/export"
|
||||
subPath: paperless/export
|
||||
- name: paperless-volume
|
||||
mountPath: "/usr/src/paperless/consume"
|
||||
subPath: paperless/consume
|
||||
env:
|
||||
- name: PAPERLESS_REDIS
|
||||
value: redis://paperless-redis:6379
|
||||
- name: PAPERLESS_DBHOST
|
||||
value: paperless-postgres
|
||||
- name: PAPERLESS_DEBUG
|
||||
value: "true"
|
||||
- name: PAPERLESS_ENABLE_HTTP_REMOTE_USER
|
||||
value: "true"
|
||||
- name: PAPERLESS_ENABLE_HTTP_REMOTE_USER_API
|
||||
value: "true"
|
||||
- name: PAPERLESS_DISABLE_REGULAR_LOGIN
|
||||
value: "true"
|
||||
- name: PAPERLESS_LOGOUT_REDIRECT_URL
|
||||
value: "https://auth.{{ .Values.homey.url }}/logout"
|
||||
- name: PAPERLESS_URL
|
||||
value: "https://paperless.{{ .Values.homey.url }}"
|
||||
- name: PAPERLESS_DBPASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: paperless-postgres-pass
|
||||
key: password
|
||||
volumes:
|
||||
- name: paperless-volume
|
||||
persistentVolumeClaim:
|
||||
claimName: paperless-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: paperless-web
|
||||
labels:
|
||||
app: paperless-web
|
||||
spec:
|
||||
selector:
|
||||
app: paperless
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 8000
|
||||
name: paperless-web
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: paperless-ingress
|
||||
annotations:
|
||||
kubernetes.io/ingress.allow-http: "false"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/auth-method: GET
|
||||
nginx.ingress.kubernetes.io/auth-url: http://authelia.{{ .Release.Namespace }}.svc.cluster.local:9091/api/verify
|
||||
nginx.ingress.kubernetes.io/auth-signin: https://auth.{{ .Values.homey.url }}?rm=$request_method
|
||||
nginx.ingress.kubernetes.io/auth-response-headers: Remote-User,Remote-Name,Remote-Groups,Remote-Email
|
||||
nginx.ingress.kubernetes.io/auth-snippet: |
|
||||
proxy_set_header X-Forwarded-Method $request_method;
|
||||
auth_request_set $user $upstream_http_remote_user;
|
||||
auth_request_set $groups $upstream_http_remote_groups;
|
||||
auth_request_set $name $upstream_http_remote_name;
|
||||
auth_request_set $email $upstream_http_remote_email;
|
||||
proxy_set_header REMOTE_USER $remote_user;
|
||||
proxy_set_header REMOTE_EMAIL $email;
|
||||
proxy_set_header REMOTE_NAME $name;
|
||||
spec:
|
||||
ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
tls:
|
||||
- hosts:
|
||||
- paperless.{{ .Values.homey.url }}
|
||||
secretName: {{ .Values.homey.certname }}
|
||||
rules:
|
||||
- host: paperless.{{ .Values.homey.url }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: paperless-web
|
||||
port:
|
||||
number: 80
|
||||
---
|
||||
@@ -0,0 +1,122 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: radicale-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: radicale-conf
|
||||
labels:
|
||||
app: radicale
|
||||
data:
|
||||
config: |-
|
||||
{{ tpl (.Files.Get "files/radicale-configmap.ini" | indent 4) . }}
|
||||
---
|
||||
{{- $_ := set $ "homey_radicale_basic_auth" (include "homey.lookuporgensecret" (merge (dict "secretname" "radicale-basic-auth") $))}}
|
||||
{{ include "homey.randomsecret" (merge (dict "secretname" "radicale-basic-auth" "secretval" .homey_radicale_basic_auth) $) }}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: radicale
|
||||
labels:
|
||||
app: radicale
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: radicale
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: radicale
|
||||
spec:
|
||||
containers:
|
||||
- name: radicale
|
||||
image: tomsquest/docker-radicale
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: dav
|
||||
containerPort: 5232
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: collections
|
||||
mountPath: /data/collections
|
||||
- name: config
|
||||
mountPath: /config/config
|
||||
subPath: config
|
||||
readOnly: true
|
||||
restartPolicy: Always
|
||||
volumes:
|
||||
- name: collections
|
||||
persistentVolumeClaim:
|
||||
claimName: radicale-pvc
|
||||
- name: config
|
||||
configMap:
|
||||
name: radicale-conf
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: radicale
|
||||
labels:
|
||||
app.kubernetes.io/name: radicale
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: dav
|
||||
port: 5232
|
||||
targetPort: 5232
|
||||
- name: http
|
||||
port:80
|
||||
targetPort: 80
|
||||
selector:
|
||||
app.kubernetes.io/name: radicale
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: radicale
|
||||
annotations:
|
||||
kubernetes.io/ingress.allow-http: "false"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/auth-method: GET
|
||||
nginx.ingress.kubernetes.io/auth-url: http://authelia.{{ .Release.Namespace }}.svc.cluster.local:9091/api/verify
|
||||
nginx.ingress.kubernetes.io/auth-signin: https://auth.{{ .Values.homey.url }}?rm=$request_method
|
||||
nginx.ingress.kubernetes.io/auth-response-headers: Remote-User,Remote-Name,Remote-Groups,Remote-Email
|
||||
nginx.ingress.kubernetes.io/auth-snippet: |
|
||||
proxy_set_header X-Forwarded-Method $request_method;
|
||||
auth_request_set $user $upstream_http_remote_user;
|
||||
auth_request_set $groups $upstream_http_remote_groups;
|
||||
auth_request_set $name $upstream_http_remote_name;
|
||||
auth_request_set $email $upstream_http_remote_email;
|
||||
proxy_set_header X-Remote-User $user;
|
||||
proxy_set_header X-Remote-Fullname $name;
|
||||
proxy_set_header X-Remote-Email $email;
|
||||
spec:
|
||||
ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
tls:
|
||||
- hosts:
|
||||
- dav.{{ .Values.homey.url }}
|
||||
secretName: {{ .Values.homey.certname }}
|
||||
rules:
|
||||
- host: dav.{{ .Values.homey.url }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: radicale
|
||||
port:
|
||||
number: 5232
|
||||
---
|
||||
@@ -0,0 +1,118 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: baikal-data-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: baikal-config-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: baikal
|
||||
labels:
|
||||
app: baikal
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: baikal
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: baikal
|
||||
spec:
|
||||
containers:
|
||||
- name: baikal
|
||||
image: ckulka/baikal-docker
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: dav
|
||||
containerPort: 80
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /var/www/baikal/config
|
||||
subPath: config
|
||||
- name: data
|
||||
mountPath: /var/www/baikal/Specific
|
||||
subPath: Specific
|
||||
restartPolicy: Always
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: baikal-data-pvc
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: baikal-config-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: baikal
|
||||
labels:
|
||||
app.kubernetes.io/name: baikal
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: dav
|
||||
port: 80
|
||||
targetPort: 80
|
||||
selector:
|
||||
app.kubernetes.io/name: baikal
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: baikal
|
||||
annotations:
|
||||
kubernetes.io/ingress.allow-http: "false"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/auth-method: GET
|
||||
nginx.ingress.kubernetes.io/auth-url: http://authelia.{{ .Release.Namespace }}.svc.cluster.local:9091/api/verify
|
||||
nginx.ingress.kubernetes.io/auth-signin: https://auth.{{ .Values.homey.url }}?rm=$request_method
|
||||
nginx.ingress.kubernetes.io/auth-response-headers: Remote-User,Remote-Name,Remote-Groups,Remote-Email
|
||||
nginx.ingress.kubernetes.io/auth-snippet: |
|
||||
proxy_set_header X-Forwarded-Method $request_method;
|
||||
auth_request_set $user $upstream_http_remote_user;
|
||||
auth_request_set $groups $upstream_http_remote_groups;
|
||||
auth_request_set $name $upstream_http_remote_name;
|
||||
auth_request_set $email $upstream_http_remote_email;
|
||||
proxy_set_header X-Remote-User $user;
|
||||
proxy_set_header X-Remote-Fullname $name;
|
||||
proxy_set_header X-Remote-Email $email;
|
||||
spec:
|
||||
ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
tls:
|
||||
- hosts:
|
||||
- dav.{{ .Values.homey.url }}
|
||||
secretName: {{ .Values.homey.certname }}
|
||||
rules:
|
||||
- host: dav.{{ .Values.homey.url }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: baikal
|
||||
port:
|
||||
number: 80
|
||||
---
|
||||
@@ -0,0 +1,162 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: sogo-postgres-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: sogo-db-pass
|
||||
type: Opaque
|
||||
data:
|
||||
password: sogo
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: sogo-postgres-config
|
||||
labels:
|
||||
app: sogo-postgres
|
||||
data:
|
||||
POSTGRES_DB: sogo
|
||||
POSTGRES_USER: sogo
|
||||
POSTGRES_PASSWORD: sogo
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: sogo-postgres
|
||||
labels:
|
||||
app: sogo-postgres
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: sogo-postgres
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: sogo-postgres
|
||||
name: sogo-postgres
|
||||
spec:
|
||||
containers:
|
||||
- name: postgres
|
||||
image: postgres
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: sogo-postgres-config
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/postgresql/data
|
||||
subPath: sogo/db/data
|
||||
name: sogo-postgresdb
|
||||
volumes:
|
||||
- name: sogo-postgresdb
|
||||
persistentVolumeClaim:
|
||||
claimName: sogo-postgres-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: sogo-postgres
|
||||
labels:
|
||||
app: sogo-postgres
|
||||
spec:
|
||||
ports:
|
||||
- port: 5432
|
||||
selector:
|
||||
app: sogo-postgres
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: sogo-conf
|
||||
data:
|
||||
sogo.conf: |-
|
||||
{{ tpl (.Files.Get "files/sogo.conf" | indent 4) . }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: sogo
|
||||
labels:
|
||||
app: sogo
|
||||
spec:
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 80
|
||||
selector:
|
||||
app: sogo
|
||||
---
|
||||
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: sogo
|
||||
spec:
|
||||
# Stop old container before starting new one.
|
||||
# No known upgrade policy know. Save to stop and start a new one.
|
||||
strategy:
|
||||
type: Recreate
|
||||
rollingUpdate: null
|
||||
selector:
|
||||
matchLabels:
|
||||
app: sogo
|
||||
replicas: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: sogo
|
||||
spec:
|
||||
containers:
|
||||
- name: sogo
|
||||
image: mailcow/sogo:nightly-1.119
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 400Mi
|
||||
ports:
|
||||
- containerPort: 80
|
||||
volumeMounts:
|
||||
- mountPath: /etc/sogo/sogo.conf
|
||||
name: sogo-conf
|
||||
subPath: sogo.conf
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: sogo-conf
|
||||
configMap:
|
||||
name: sogo-conf
|
||||
optional: false
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: sogo-ingress
|
||||
spec:
|
||||
ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
tls:
|
||||
- hosts:
|
||||
- git.{{ .Values.homey.url }}
|
||||
secretName: {{ .Values.homey.certname }}
|
||||
rules:
|
||||
- host: sogo.{{ .Values.homey.url }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: soo
|
||||
port:
|
||||
number: 80
|
||||
|
||||
---
|
||||
Reference in New Issue
Block a user