commit 36214ecfdedcaa6dd1d35be20f7490d725893dc6
parent 095efb276df0c053092ac310e6f4b701e7b3a7ba
Author: MTRNord <mtrnord1@gmail.com>
Date: Mon, 28 Apr 2025 11:23:53 +0200
Deploy draupnir4all-web
Diffstat:
4 files changed, 175 insertions(+), 44 deletions(-)
diff --git a/apps/2024_cluster/secrets/draupnir4all-web.yaml b/apps/2024_cluster/secrets/draupnir4all-web.yaml
@@ -0,0 +1,57 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: draupnir4all-web
+ namespace: matrix
+type: Opaque
+stringData:
+ session-secret: ENC[AES256_GCM,data:3DuYllirgKK4m1/J/PRGNf6MDTwPk9ecpL/Ti4Y4Dz96q3JYbkbMp+xeCJAMXpdPVv5FweTTlBaGceVCX+Bugg==,iv:e1w26ng6jguk+fYX7U0mwN9frXKM/srgrReHzV67yA4=,tag:aAwSW5ooUvCqtP1eS/4MJw==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWV1RoOVlrUmNBQ0lYVndv
+ aThXbE5aMjE0dVU2MHlFaTh4SXUzSGVXc0hFCmxlZ0JqU2V2aGNGZ3V0b2ZBWk9q
+ cmlPdllRU1g1M3BwNXoxOFErNzJ0WTQKLS0tIDNVd2d2dTFWd2Z2Z1l1WURVbVpJ
+ WWQreDVmVHMwbjZ1ZWpxTmI2alluaGcKSgClGHGhWC0extu+MGGqUWvqAVQh4LoN
+ cK2UyZBOor6Mm0dWHg7cZRGPJocGZ9fkyBLsJMBWa+DSWIs3WeOD8w==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-04-28T09:22:52Z"
+ mac: ENC[AES256_GCM,data:gyUWaw9muoP/t8tOGvSFzrKydhpzj0olAdco4UNVUAC42PXC94oxNYlA2Kr0KxN5zQudpBwnJHNpfIUKPV2VqNu0e6jNWRlJOpk9/p6Kbbzlq5LG2QVA4qNEV9F3HcnhzNF+JbQ70KesPMfCSOVS+caHKwd2zZgIxGxe2k7xRdY=,iv:2EVTJpuHFO87BNRR7BRSwcblK2MMDCJEkAq3HHqfFNY=,tag:ANRnXMVYZn1M8tPDD6ieww==,type:str]
+ pgp: []
+ encrypted_regex: ^(root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+data:
+ .dockerconfigjson: ENC[AES256_GCM,data:ZZJzEUNanUg+0uvgB/qZfnLqdLmA6xgzEjvhSWK62pT48JuHk4xn7jJ6Axwx1E4lxThL9GKznNRabz7H4ihcpVXu+AsCOsvLc0PSIeUT5ER9Ut5TRpi/+k7sYLVoinaxfmfQeirueEfEC7D6djeYBOqOY1zcwRT+SDBbdUV5i/dScpsB5VFljHMwaMEIvCEbkdRoDxZcPop+jN9lURkTydaqPcUiWIVUAnWAWCSIgKhbMQJREkN4gEak7XhLgfSacu696w==,iv:0qJ2U6SXxzAX5Eb/kH2ZDyAmCF3O9jFGBHMts/SjAQA=,tag:6XCtGd1TNIL64ZJulPqNnw==,type:str]
+kind: Secret
+metadata:
+ name: ghcr-pull
+ namespace: matrix
+type: kubernetes.io/dockerconfigjson
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWV1RoOVlrUmNBQ0lYVndv
+ aThXbE5aMjE0dVU2MHlFaTh4SXUzSGVXc0hFCmxlZ0JqU2V2aGNGZ3V0b2ZBWk9q
+ cmlPdllRU1g1M3BwNXoxOFErNzJ0WTQKLS0tIDNVd2d2dTFWd2Z2Z1l1WURVbVpJ
+ WWQreDVmVHMwbjZ1ZWpxTmI2alluaGcKSgClGHGhWC0extu+MGGqUWvqAVQh4LoN
+ cK2UyZBOor6Mm0dWHg7cZRGPJocGZ9fkyBLsJMBWa+DSWIs3WeOD8w==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-04-28T09:22:52Z"
+ mac: ENC[AES256_GCM,data:gyUWaw9muoP/t8tOGvSFzrKydhpzj0olAdco4UNVUAC42PXC94oxNYlA2Kr0KxN5zQudpBwnJHNpfIUKPV2VqNu0e6jNWRlJOpk9/p6Kbbzlq5LG2QVA4qNEV9F3HcnhzNF+JbQ70KesPMfCSOVS+caHKwd2zZgIxGxe2k7xRdY=,iv:2EVTJpuHFO87BNRR7BRSwcblK2MMDCJEkAq3HHqfFNY=,tag:ANRnXMVYZn1M8tPDD6ieww==,type:str]
+ pgp: []
+ encrypted_regex: ^(root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
diff --git a/apps/2024_cluster/secrets/kustomization.yaml b/apps/2024_cluster/secrets/kustomization.yaml
@@ -22,3 +22,4 @@ resources:
- archivebox.yaml
- irc.yaml
- heisenbridge.yaml
+ - draupnir4all-web.yaml
diff --git a/apps/base/matrix/draupnir4all/deployment.yaml b/apps/base/matrix/draupnir4all/deployment.yaml
@@ -36,15 +36,17 @@ spec:
app.kubernetes.io/instance: main-process
app.kubernetes.io/name: draupnir4all
spec:
+ imagePullSecrets:
+ - name: ghcr-pull
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
- matchExpressions:
- - key: app
- operator: In
- values:
- - draupnir4all
+ matchExpressions:
+ - key: app
+ operator: In
+ values:
+ - draupnir4all
topologyKey: "kubernetes.io/hostname"
containers:
- name: draupnir4all
@@ -64,56 +66,107 @@ spec:
# - name: TRACING_METRIC_URL
# value: http://tempo.monitoring.svc.cluster.local:4318/v1/metrics
env:
- - name: NODE_OPTIONS
- value: "--trace-warnings"
+ - name: NODE_OPTIONS
+ value: "--trace-warnings"
command: ["./draupnir-entrypoint.sh"]
- args: ["appservice", "-c", "/data/config/config.appservice.yaml", "-f", "/data/config/draupnir-registration.yaml",
- "--draupnir-config", "/data/config/draupnir-config.yaml", "-p", "9000"]
+ args:
+ [
+ "appservice",
+ "-c",
+ "/data/config/config.appservice.yaml",
+ "-f",
+ "/data/config/draupnir-registration.yaml",
+ "--draupnir-config",
+ "/data/config/draupnir-config.yaml",
+ "-p",
+ "9000",
+ ]
resources:
- limits: {}
- requests:
- memory: "344Mi"
- cpu: "252m"
+ limits: {}
+ requests:
+ memory: "344Mi"
+ cpu: "252m"
securityContext:
- runAsUser: 1000
- runAsGroup: 1000
- readOnlyRootFilesystem: true
+ runAsUser: 1000
+ runAsGroup: 1000
+ readOnlyRootFilesystem: true
ports:
- - containerPort: 9001
- name: widgets
- protocol: TCP
- - containerPort: 9000
- name: appservice
- protocol: TCP
+ - containerPort: 9001
+ name: widgets
+ protocol: TCP
+ - containerPort: 9000
+ name: appservice
+ protocol: TCP
volumeMounts:
- - name: configs
- mountPath: "/data/config"
- readOnly: true
- - mountPath: /data/storage
- name: storage
- - mountPath: /tmp
- name: tmp
+ - name: configs
+ mountPath: "/data/config"
+ readOnly: true
+ - mountPath: /data/storage
+ name: storage
+ - mountPath: /tmp
+ name: tmp
livenessProbe:
- httpGet:
- path: /healthz
- port: appservice
- scheme: HTTP
- initialDelaySeconds: 15
- periodSeconds: 10
+ httpGet:
+ path: /healthz
+ port: appservice
+ scheme: HTTP
+ initialDelaySeconds: 15
+ periodSeconds: 10
startupProbe:
- httpGet:
- path: /healthz
- port: appservice
- initialDelaySeconds: 15
- failureThreshold: 30
- periodSeconds: 10
+ httpGet:
+ path: /healthz
+ port: appservice
+ initialDelaySeconds: 15
+ failureThreshold: 30
+ periodSeconds: 10
+ - name: draupnir4all-web
+ image: ghcr.io/mtrnord/draupnir4all-web:latest
+ imagePullPolicy: Always
+ env:
+ - name: SESSION_SECRET
+ valueFrom:
+ secretKeyRef:
+ name: draupnir4all-web
+ key: session-secret
+ - name: D4ALL_INSTANCE_ADDRESS
+ value: "http://localhost:9001"
+ resources:
+ limits: {}
+ requests:
+ memory: "344Mi"
+ cpu: "252m"
+ securityContext:
+ runAsUser: 1000
+ runAsGroup: 1000
+ readOnlyRootFilesystem: true
+ ports:
+ - containerPort: 3000
+ name: web
+ protocol: TCP
+ volumeMounts:
+ - mountPath: /tmp
+ name: tmp
+ livenessProbe:
+ httpGet:
+ path: /
+ port: appservice
+ scheme: HTTP
+ initialDelaySeconds: 15
+ periodSeconds: 10
+ startupProbe:
+ httpGet:
+ path: /
+ port: appservice
+ initialDelaySeconds: 15
+ failureThreshold: 30
+ periodSeconds: 10
volumes:
- name: configs
secret:
- secretName: draupnir-appservice
+ secretName: draupnir-appservice
- name: storage
persistentVolumeClaim:
- claimName: d4all-persistent-storage
+ claimName: d4all-persistent-storage
- name: tmp
emptyDir:
- sizeLimit: 2048Mi
+ sizeLimit: 2048Mi
diff --git a/apps/base/matrix/draupnir4all/service.yaml b/apps/base/matrix/draupnir4all/service.yaml
@@ -17,3 +17,23 @@ spec:
targetPort: widgets
protocol: TCP
name: widgets
+ - port: 3000
+ targetPort: web
+ protocol: TCP
+ name: web
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ name: draupnir4all-web
+ namespace: matrix
+spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - draupnir.midnightthoughts.space
+ rules:
+ - backendRefs:
+ - name: draupnir4all
+ port: 3000
