cluster

commit 2d9faf4a6fc6bd7de88aed94a90df8e9b0b0f605
parent 4f865c9efefe6e20a1b909e126143b925b34c249
Author: MTRNord <mtrnord1@gmail.com>
Date:   Wed, 14 Jun 2023 17:51:30 +0200

create a openproject setup

Diffstat:
A
apps/base/openproject/kustomization.yaml
 | 
6
++++++
A
apps/base/openproject/release.yaml
 | 
52
++++++++++++++++++++++++++++++++++++++++++++++++++++
A
apps/base/openproject/repository.yaml
 | 
8
++++++++
A
apps/namespaces/openproject.yaml
 | 
4
++++
M
apps/production/kustomization.yaml
 | 
2
++
A
apps/production/openproject-values.yaml
 | 
56
++++++++++++++++++++++++++++++++++++++++++++++++++++++++
M
encrypt.sh
 | 
3
+--

7 files changed, 129 insertions(+), 2 deletions(-)
diff --git a/apps/base/openproject/kustomization.yaml b/apps/base/openproject/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: openproject
+resources:
+  - repository.yaml
+  - release.yaml
diff --git a/apps/base/openproject/release.yaml b/apps/base/openproject/release.yaml
@@ -0,0 +1,52 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: openproject
+  namespace: openproject
+spec:
+  releaseName: openproject
+  chart:
+    spec:
+      chart: openproject
+      sourceRef:
+        kind: HelmRepository
+        name: openproject
+  interval: 50m
+  install:
+    remediation:
+      retries: 3
+  values:
+    ## Whether to allocate persistent volume disk for the data directory.
+    ## In case of node failure, the node data directory will still persist.
+    ##
+    ## Ref.: https://kubernetes.io/docs/concepts/storage/persistent-volumes/
+    #
+    persistence:
+      ## Whether to enable session affinity or not. It is required by ingress.
+      #
+      enabled: true
+
+      ## Define the volume access modes:
+      ##
+      ## "ReadWriteOnce" => The volume can be mounted as read-write by a single node. ReadWriteOnce access mode still can
+      ##                    allow multiple pods to access the volume when the pods are running on the same node.
+      ## "ReadOnlyMany" => The volume can be mounted as read-only by many nodes.
+      ## "ReadWriteMany" => The volume can be mounted as read-write by many nodes.
+      ## "ReadWriteOncePod" => The volume can be mounted as read-write by a single Pod. Use ReadWriteOncePod access mode if
+      ##                       you want to ensure that only one pod across whole cluster can read that PVC or write to it.
+      #
+      accessModes:
+        - "ReadWriteMany"
+
+      ## Define custom storage annotations:
+      ##
+      annotations: {}
+
+      ## Define the volume size.
+      #
+      size: "5Gi"
+
+      ## Define the class of PV.
+      storageClassName: "rook-main-fs"
+    strategy:
+      type: "RollingUpdate"
diff --git a/apps/base/openproject/repository.yaml b/apps/base/openproject/repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: openproject
+  namespace: openproject
+spec:
+  interval: 5m
+  url: https://charts.openproject.org
diff --git a/apps/namespaces/openproject.yaml b/apps/namespaces/openproject.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: openproject
diff --git a/apps/production/kustomization.yaml b/apps/production/kustomization.yaml
@@ -10,6 +10,7 @@ resources:
   - ../base/postgres-operator
   - ../base/matrix
   - ../base/postgres-exporter
+  - ../base/openproject
   - sliding-proxy-ingress.yaml
   - pvcs-mjolnir.yaml
 patchesStrategicMerge:
@@ -23,3 +24,4 @@ patchesStrategicMerge:
   - sliding-proxy-values.yaml
   - synapse-midnightthoughts.yaml
   - postgres-exporter-values.yaml
+  - openproject-values.yaml
diff --git a/apps/production/openproject-values.yaml b/apps/production/openproject-values.yaml
@@ -0,0 +1,56 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+    name: openproject
+    namespace: openproject
+spec:
+    chart:
+        spec:
+            version: 1.7.x
+    values:
+        ingress:
+            host: openproject.midnightthoughts.space
+            annotations:
+                cert-manager.io/cluster-issuer: letsencrypt-dns
+            tls:
+                secretName: openproject.midnightthoughts.space-tls
+        memcached:
+            auth:
+                user: memcached
+                password: ENC[AES256_GCM,data:P6XOH88UYKPEzBrdHUWESWSX62pSA8vx5KsPB1pS/WsOswc1ACGYCPFOmRW2WFPCCt0RPzZvlxTOkCRDynJc5A==,iv:v46bOI3W8HXK40huBwgiEkwqRQ1RaZEZB1LVq6p9GIQ=,tag:k/jtAK7V+Wgn9OlVulhoaw==,type:str]
+        openproject:
+            oidc:
+                enabled: true
+                provider: Keycloak
+                host: keycloak.midnightthoughts.space
+                identifier: https://openproject.midnightthoughts.space
+                secret: ENC[AES256_GCM,data:jMy3oDmMlWnoyactBUisahkhRBEgS0QOFJypVKIPZvw=,iv:pXnWr5BUYH2aaZBQY00wl5nbMynaZSo2UyTOzYVF4/o=,tag:TDFflLjijfCnVZmKtpQ/EQ==,type:str]
+                authorizationEndpoint: /auth/realms/Gitea/protocol/openid-connect/auth
+                tokenEndpoint: /auth/realms/Gitea/protocol/openid-connect/token
+                userinfoEndpoint: /auth/realms/Gitea/protocol/openid-connect/userinfo
+                endSessionEndpoint: https://keycloak.midnightthoughts.space/realms/Gitea/protocol/openid-connect/logout
+                #scope: "[openid]"
+        postgresql:
+            auth:
+                password: ENC[AES256_GCM,data:AwuWgJ1307f8FG0FgRt3qK8pQJhgm3NNpmsLLkkrWLkBiUCvXBJtZi70Fqjy5QzD5LPNkQYm79OKevkRhfd0sA==,iv:wfOmgpl+tfwcvkwKlLheJfPiuIAztHoOGc0YFSlAJlM=,tag:LxyXhxtXzorfxtRiT9eAaA==,type:str]
+                postgresPassword: ENC[AES256_GCM,data:BsQoKyaoByl/JKWfAxiPAzcm3E12xIRC/wMzOaWo4YcMYmbwMg0pkgZhG52u5EYohP57i+JJJ0L4T23F7I17ag==,iv:fA08y+tKQTCPbOHfp44CPh2RCnVoZgwXC2zoO4eEjeU=,tag:rIF2lRyextAOJIqAfjrVwg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXZzgwSHZZc1hjT2xaNFE4
+            Y1c0Rkx2QU5aaHdFR1RNR1VIK2lpWXN5bFdRCjFUS2FGcmhZTHNrVFVTS3luUk5W
+            Y2tJMmdGNksrU0IrQSszLy9HdS9xcHcKLS0tIFVFcy96Zi8vTVoxRUhSWExueFI3
+            L1huN05ENDV1RFN2aU40QWMxUmF6MWsKYdm+vgO82+OtkP6JA+ajFIVnO0z7Jybe
+            FUpEL6Q3HGtMoBDcjDQId9XkgVo1UTXgnOCYAUo+K6kHBsoD4PnxNg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-06-14T15:51:22Z"
+    mac: ENC[AES256_GCM,data:VXz0EFDes7pOlyV+IJu0KXp3qpa3EmXX0BPNI0zSDkorMOTsDk1iluuRJLmvUAfELNaowzz5QAv02wIOGgMq3EkgUGrdLvUQMCuCt6we6O4MxNni7WlwDOyHhnndYSBqDgp9KItovO6QFcuqwdRrIknlgeEg8I75sAaauHGrnDw=,iv:NjgGEnfC3MgCbhLV7ZRdfDgkv/t3h0oxxmFYFhjtXQ8=,tag:vjOocx+Rlo6gURRGYGMZMA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData|password|postgresPassword|registration_shared_secret|shared_secret|secret)$
+    version: 3.7.3
diff --git a/encrypt.sh b/encrypt.sh
@@ -1,3 +1,3 @@
 #!/bin/bash
 
-sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh --encrypt --encrypted-regex '^(data|stringData|password|registration_shared_secret|shared_secret)$' --in-place "$1"
-\ No newline at end of file
+sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh --encrypt --encrypted-regex '^(data|stringData|password|postgresPassword|registration_shared_secret|shared_secret|secret)$' --in-place "$1"