commit 2a75138aaec81be896067f6e259fbe8adaf09728
parent e5862468586fc0974e5c9441f6aa9eed090cf022
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Mon, 5 Jan 2026 19:08:00 +0100
deploy clickstack
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
7 files changed, 77 insertions(+), 2 deletions(-)
diff --git a/apps/talos_cluster/clickstack/kustomization.yaml b/apps/talos_cluster/clickstack/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: clickstack
+resources:
+ - repository.yaml
+ - release.yaml
diff --git a/apps/talos_cluster/clickstack/release.yaml b/apps/talos_cluster/clickstack/release.yaml
@@ -0,0 +1,55 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+ name: clickstack
+ namespace: clickstack
+spec:
+ releaseName: clickstack
+ chart:
+ spec:
+ chart: clickstack
+ sourceRef:
+ kind: HelmRepository
+ name: clickstack
+ interval: 60m
+ values:
+ global:
+ storageClassName: longhorn
+ hyperdx:
+ apiKey: ENC[AES256_GCM,data:+g6PcA1paJZqEVPxbthxPr73McP8Dt7cZ+M73b/5v04+uyLx,iv:Sc6Hfr6EcqUg+AfcRjDL/bxYf4FaBWPudUR6J/DijhE=,tag:awGSxadb6NlWoQHMtbH4cA==,type:str]
+ appUrl: https://clickstack.midnightthoughts.space
+ frontendUrl: https://clickstack.midnightthoughts.space
+ mongodb:
+ persistence:
+ enabled: true
+ size: 10Gi
+ clickhouse:
+ persistence:
+ enabled: true
+ dataSize: 10Gi
+ logSize: 5Gi
+ config:
+ users:
+ appUserPassword: ENC[AES256_GCM,data:Bx60mOE4V4Hv9WPsWh7YW7cHMS9pibNdoSsCdNtDh0S/5S+P5kFODdmx2ftHhyktK/EhcFKcYmjhx/olcm92,iv:8xpM3586zfPYdin1gAO3Tu+x7NlR7Ji7obuTsjwM+3o=,tag:DSqe10ujUKL29yQYmm54Ow==,type:str]
+ otelUserPassword: ENC[AES256_GCM,data:ub5gWcNlrj1V1PD5Z+RiMTI7B0YWWZ+HnlBQyIt+MbFVE64Y4iervz1Mr3Kjv0LHnyEufFBe8ElIx2g1U9KF,iv:sZdF3pS6rpswHbEu/SUi9ERgrA/u8bvr6YKcsLcFji8=,tag:PMQm/WwskIIdqLUtTn/OqQ==,type:str]
+ otelUserName: otelcollector
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqMlZyVUdXWmE0WjMrbHFP
+ WG5CUk9IMyszbHFtL2kzT2RCS0dFalRUQXc0CldDdHo0dTJvU0NWWGJYRU82U1Nt
+ b09HemtsRGdQMithN1JUS09UZDRHSWcKLS0tIEFPZGU1ODE1TXd2ZUJRYlZLMW1I
+ eGNtd3NNczZOMjFRS1RtN3lKL0taVmcK3w3ogo8SFbRmw3sxiOlqsaKjLIcMQVhh
+ pKY7aJNzGdCJ62OtTyrkalchu2aOT1XYU+LdEeg/Ri4x9YfaroEuyA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-01-05T18:07:41Z"
+ mac: ENC[AES256_GCM,data:wWMXAkHv3Fkl4hBjTdiNnxsx0GbVvwxvdz6jG5yf2+r1Osyyjw4egF9ZThkYNqU6KR0aWuru/kcILbHm4R+8pz726jt1YjRDnFkCMtZXLoGN3UQfFy/uL0ua92zHTh1sNgDwbgWm/eLLXI//Dq4cG32OyWobdgCBJ1nXSCutyKw=,iv:1rbOokVGnG5x/5hViOYBMcsj8OUU7tb8Vqn1erbqJWs=,tag:sw365YJ+NXwVzIlqf7GjAA==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/clickstack/repository.yaml b/apps/talos_cluster/clickstack/repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+ name: clickstack
+ namespace: clickstack
+spec:
+ interval: 60m
+ url: https://hyperdxio.github.io/helm-charts
diff --git a/apps/talos_cluster/kustomization.yaml b/apps/talos_cluster/kustomization.yaml
@@ -31,3 +31,4 @@ resources:
#- ./sentry
- ./immich
- ./convex
+ - ./clickstack
diff --git a/apps/talos_cluster/namespaces/clickstack.yaml b/apps/talos_cluster/namespaces/clickstack.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+ name: clickstack
diff --git a/apps/talos_cluster/namespaces/kustomization.yaml b/apps/talos_cluster/namespaces/kustomization.yaml
@@ -26,3 +26,4 @@ resources:
- weblate.yaml
- immich.yaml
- convex.yaml
+ - clickstack.yaml
diff --git a/encrypt.sh b/encrypt.sh
@@ -5,13 +5,13 @@ if [ -z "$1" ]; then
# Encrypt apps/talos_cluster/externaldns/release.yaml as a whole
sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh \
--encrypt \
- --encrypted-regex '^(extraArgs|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$' \
+ --encrypted-regex '^(apiKey|appUserPassword|otelUserPassword|extraArgs|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$' \
--in-place apps/talos_cluster/externaldns/release2.yaml
else
echo "Encrypting file: $1"
sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh \
--encrypt \
- --encrypted-regex '^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$' \
+ --encrypted-regex '^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$' \
--in-place "$1"
fi
