cluster

Infrastructure files for Nordgedanken and Midnightthoughts.
git clone git://archive.git.mtrnord.blog/MTRNord/cluster.git
Log | Files | Refs | README
commit 535809fcdac16fc52e7e957609a173e9e2d0423c
parent bc5ed7f9b52975d0a0c47625de1d250aca485bd3
Author: MTRNord <mtrnord1@gmail.com>
Date:   Sun, 21 Apr 2024 14:55:45 +0200

Change db for forgejo

Diffstat:

Mapps/base/forgejo/release.yaml | 39+++++++++++++++++++++++----------------


Mdecrypt.sh | 2+-


Mencrypt.sh | 2+-


3 files changed, 25 insertions(+), 18 deletions(-)

diff --git a/apps/base/forgejo/release.yaml b/apps/base/forgejo/release.yaml
@@ -35,7 +35,7 @@ spec:
                     - SYS_CHROOT
         signing:
             enabled: true
-            privateKey: ENC[AES256_GCM,data:q2EGvhlqIpIAltL41svQ1axJHTD09pCmSxFpHAYNYA+Zepq/jdXKdwoiuHLK9EgeLuZlOue/C74ZA5vie7VXR/x/usPFO6/PY23nyJcrbEukeW8ACKMDwwbf3CBBgz4Yfp3d+1tzyTOoNV5sViITjuL6qb6AavZMVN1He2mHm6WAFtS1EPOqZI1OPZIaCgtxE90hRJ9f+sizKumNBRjNh/A7GDC21kQkBP8aEySumP/Ajs90hKLtvDP3HNqPMTu8+6P7ydgwXIk9kSlRypbT4a2ipaCGMIiAm5XORme+JTGtA+kJVcE5LVaXMA7/d6HcW6EKWk/c6Lqq1xTXFa2YkS4XN4GeMddC9KQp58NXsN5lgGKg/PCgtR+jdgxCSlDJ+CuonWDzylRPBuht79iMakwqDNhGof38RSDVZWT/JOjuIRRp63JHj2L8eTB0SmlE8Jf7PyYq5fLLbBSWUH2byrN0AZ+5kD7ePrXcShb/GtJbiKXBtRplUYkHNmC2mOqYKH6FUkFtcs+36PyBSr+RYiMjHCQolf6O/dc5f7Mm2iwv5xPqqZ+MblY5Lt5u1UfCwha6uSM24e5YSj3THHQuD+k+RxWsPTnl0kDP1eSOlZYFmCoL6dsorRjUl8Nl1mKz+UvB0PvQKiQrxmG6H8F+2LmJu4WvwhiRaWkjE+h95+u+wnB+JseVVc6I3Gg5Zj/DT1HNQvZDILHm1iPFHhlyecMUUAe9Q9Sh/Gk0b53NDqImctbOFY+mmq8iBMqQ4YT5+l3jFwHpnVloFo4i4lx6KPCJTUN7H9xKq5Uxq0ScSomnWjt7MFCxBkKsU4TCya8sp9yr3/7QtMnjPsi3HeXeYBFOcURoHi2Yr+IkPk1kg86UpSA0/ba4f/dzUld8NzhmJ3gxfGPFFBVMsEroPU0JfQyof6u8lARdnyh90mI340Kc7T7Scc3AsxtJ9RUZ1CZVRV+YiYZjE0J6UNuL3nIDXH/XhNpAiBG6tTKjsSf/mI9DgBDStcoWlw==,iv:IJbmILZhSrsBpoqknl8B+zkAW292Ovl8/DBuUOEcWJU=,tag:wnh4UJ/Aru1TUXIsJu+12A==,type:str]
+            privateKey: ENC[AES256_GCM,data:YPjuaJ02cp/MWMdYJ8zxjXkCHKdwfmbbWYcZCYRC5S8s1xlGqL3lLvEHwk71YBWF2V9i0oP/CPz4Sx6Ml+6bEhtK7VArsnjYUIiVzz0JrD0rMTkabT+Ym2uTuM5FPLLCQ13mDJ6mCn+E2ZTsNWA5Gagxk/XC0GTIgUS9b7/yGTIqC/+3PrTytwxh+px3nY8pOq8VsOMU0Ar/ppcxHNLKZiUtFAJjq1TDUccCMpiZsMB3HHjw5mrLTDW3Uu7YP7cYvHbTPgXFuNTewKPRVtW1p7O2WCi2Bl5+KIDFdrBjFHIRcLlQaD3aObCJYF5EduOcoR4YiGEMyQG2HCxHlJhx4ykChWjsDOuHaNyGKa9+6a19zCWzkLPkZN68g0fZrqKpf2ptAsqZjMlLjOhRZXg/A09htlk2S3lVLPbkOkYpHht+ZbCBoYfKi0qxoDqLzyzfg5sC24OyEoTeLSUeF7VoEF+L6RkFqxq/ILvQXK72QmA2hgBHoQHTCb2LH8CI2/7FX1mnUN18RRnbE4kDtBBaNu5/F/1AcvweNa74/VRiHbwsZpkdkqkmhbhPbIcOsfM/Y5prU3GmVZxXu4DcYOr1Xg68SYYi7h+Sb8P4Xbzqd/DVDJUmvQtRBWwt0syf20FXMcWbHjjB5bUcRNRwYqMsurzz9JNzyjV+LGZkK1XHLyn0jbrRRPhreQM8UUoNtY+iXRUNsOhFEvkugk4mnLN7V1lClNCdUbVmsEEc+eq2xrmpUAs7gS1Jm0feIUbi/IlcC+rBa99kBUNPjgBy7HJQG3qgQVaftlh1ibr9IB7RaNXJ1E1ESXm23rtbnrKW68MD/6jOFkT+9TSOpM7teGBYI4TfloXL3mjL1Y9/DUTotGXBzZWFbsu5SJDO/mXSoAot3eLJn7ATmN5crwMPztyjRw22kI3ynFPqgbI5LgW/kBQis56+IypWHlGHiLUz/Kqw/uWIUY2vgJXftg03K8cbomNYOzqvDyj/8RUjR2T6zjEClz+a2IF2AQ==,iv:KBmnusb1FD2UzyGmjRalFxZAijDpvxt3KOvQiTeSJp0=,tag:oqlP1kUSQtT+FTX9lazd7A==,type:str]
         persistence:
             enabled: true
             create: false
@@ -59,11 +59,11 @@ spec:
                 - name: keycloak
                   provider: openidConnect
                   key: gitea
-                  secret: ENC[AES256_GCM,data:CVIT5cGmGSfn4ejb05w0Kxr/olIpMeBx2zL4PjTPwns=,iv:6k4qdKp0nP9UyvRIBuHnHVp3yo5u+ZRgENLWoi3EqIY=,tag:5rLgXrlZWfpjP+5/kVqy3w==,type:str]
+                  secret: ENC[AES256_GCM,data:xJlSKvZdun0jy+V+6Aii6LOvqVF0/y22GdUQ7NFa1no=,iv:Sm4tpp89LdnhNftb10Hy0jGlxFmt4Rp6bqfsdN0w5S8=,tag:6IpBsKS9KBe2GKxKeB9u/Q==,type:str]
                   autoDiscoverUrl: https://keycloak.midnightthoughts.space/realms/Gitea/.well-known/openid-configuration
             admin:
                 username: gitea_admin
-                password: ENC[AES256_GCM,data:/1Khn/RNpe1BuPLF4b2l8mmH0kJuNCd69QfUHE2uo5v6tJqbbk24w+uExghuM0aTpa/jaXhzsAvh2vMSU1EBbA==,iv:+of+SmL0utVqr7cY0fUInsqoElEOVj2IAiYZYscod80=,tag:5ROrBXvWf1VIh+TflU+WJA==,type:str]
+                password: ENC[AES256_GCM,data:cXzrmTFmyNh0KjPearBRkVx5VaodcgpoA+CETn1c+p+BO8CY+8CtuX2G1cysYmzP+BV31TYIIB60ru9f2oTflw==,iv:E36NkUzIoccKIXG83OvETSNk38lM+yddssDW5PotYtI=,tag:sdKyuYp0zuGKTlnseHY+qQ==,type:str]
                 email: ops@nordgedanken.dev
             metrics:
                 enabled: true
@@ -103,7 +103,7 @@ spec:
                     SMTP_PORT: 465
                     PROTOCOL: smtps
                     USER: ops@nordgedanken.dev
-                    PASSWD: ENC[AES256_GCM,data:O6r2uOsPE28A,iv:DIox5pYytIl2uEvlVqtSm8IWGmDeYe9upjvvPkC52Fw=,tag:DapIgcKLFHkeA2n1yDGdOA==,type:str]
+                    PASSWD: ENC[AES256_GCM,data:HnKkGw06eIyq,iv:OJwLNqfI90kYb+sIawBRq7A01vXaZHGR1bOnSrWGxRc=,tag:O/55TFCmDXQNM+FbmUg5VA==,type:str]
                 session:
                     #PROVIDER: redis-cluster
                     PROVIDER: redis
@@ -119,6 +119,13 @@ spec:
                     TYPE: redis
                     #CONN_STR: redis+cluster://:@forgejo-redis-cluster-headless.forgejo.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
                     CONN_STR: redis://:@forgejo-keydb.forgejo.svc.cluster.local:6379/0
+                database:
+                    DB_TYPE: postgres
+                    HOST: matrix-postgres-cluster.matrix-postgres-cluster.svc.cluster.local:5432
+                    NAME: forgejo
+                    USER: forgejo
+                    PASSWD: ENC[AES256_GCM,data:Ba4k7893dFIBZ77yzmsz+o6/YJERRtpL/vGTa4UsyNUo0tQrAbREzd1WxwoMJYvha78eaVTSKK53L9QLohaR+Q==,iv:wXZaqe9DOItmw0hP4BZp6jjMIgFah+p/ekpAE9EiEqY=,tag:ARYQ5IXa8yv0OORVFQ3RlQ==,type:str]
+                    SSL_MODE: require
         redis-cluster:
             enabled: false
         postgresql-ha:
@@ -128,21 +135,21 @@ spec:
                 registry: docker.io
                 repository: bitnami/postgresql
                 tag: 11.11.0-debian-10-r62
-            enabled: true
+            enabled: false
             global:
                 postgresql:
                     service:
                         ports:
                             postgresql: 5432
                     auth:
-                        password: ENC[AES256_GCM,data:T4Z/E43GR9M4dsQIZtJkYQkWF7e2X3a0AUeleBsxTlmwRu598W2DmLyTgk/N2YwIQ/gPA583Wn/fJqhkMQRf0w==,iv:w1tu00eHvAzicJBUVtWxTk1YYZW1vo25ZByZEVSiqQ0=,tag:akBuNgyA+uFy3T1pp5apkA==,type:str]
+                        password: ENC[AES256_GCM,data:YO6rRodCmcgVYofE8iy6fvaVLOh2vwRMZTZplvdC92JYlsUaGnU5XuBMZDs8r/UTFVk9QUPyVNDhfJ/kudeoJA==,iv:dHY7R+qOuUwdQrkrHsb8Cp9thIg/P1M2jGBJUt6yzEc=,tag:ZwKB+ihw+PyUkSi0r2iwKw==,type:str]
                         database: gitea
                         username: gitea
             auth:
                 database: gitea
                 username: gitea
-                postgresPassword: ENC[AES256_GCM,data:29uGZw3VawguUg==,iv:3EZkM/8hq/hHVEcKc2ZZm0+geZ9MOyyyQRu19O2qk4Q=,tag:zn9kcklLayUpo7s9Hd601A==,type:str]
-                password: ENC[AES256_GCM,data:brZSTTDILdVcuWdqt7qjHElV0pMzb0C2TXUXCxaslf3P48IPM+WC3y8CFlna829WhF8sK8yNs8OmrJKVqR0uSA==,iv:fXWfq0XNs/GQsADDBebPh/ExjEMPiBg1exj01F2dTKg=,tag:qaiHoTI7ZMyFBLh1Q7AJkQ==,type:str]
+                postgresPassword: ENC[AES256_GCM,data:1JZnYjLTRh+IdA==,iv:ZsbyafabYJHj4edLvZL8gQtBzFwO9T9Bx2mEviasUvk=,tag:JvL6s7UdS8rSNrUZn79UrA==,type:str]
+                password: ENC[AES256_GCM,data:UJRBYwXWihilXq2C3698qF4YOdOqo6BaEoZl6MebK1OMQ8VOugmoRSKbJ5+IAHRRLbdJyYzvrNYZHlJ9BnGyXQ==,iv:Mil9qK0BlvvmIkjPc/TYolcC7Tu0T+dWrMypOr95d6s=,tag:yJ1Aa/BrLeE/nwf0R9QcIQ==,type:str]
             persistence:
                 enabled: true
                 size: 25Gi
@@ -158,14 +165,14 @@ sops:
         - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYaW44RHZFRzE4TzlmVkRN
-            cTRjeHV4SFllcjNuSjg2alFuSDVrZVJ0ZkZ3ClFSWE5Qa1I1OEM5WlRWSXNuN1ZP
-            WDN0T3ppSmpQajk5dVpXU2t2bEVtU3MKLS0tIDZtbldIT2MrQUw4dE85aWQvaGFy
-            d3k5Qkc4K3plUk80YTNYblBzdDdWLzQKJwxRFp0xM0M/YQt1UYO+gyiMX2Lsxwfw
-            dX6Va5dT9C8iGAkQ5wwdZ0GK153XoxcJjFvtsOFqPLFebxjay8YAig==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRcnRlclZzQnh4dXhJZmlp
+            Tk95R2lTRTJPdTdlTmtXeDIzbFUyaGVNenlvCmRNem9XUzAvTUt0c21VWWVDWEhV
+            bVY4aEtVRmhYbzZHd0U3WGpSK3NoR28KLS0tIGp3aG9ZeDN4VGl4UExzc3RBZTNJ
+            cXZGNDJEQ2NVN3VvdysraWcrV0wrR0EK3xmV3CHBDNLvBlUuHJbYwsU+eJY9QUIk
+            aR9lY+YHO1nWb74CUCUB8yItyq9mS9udZUGrIZk5I6sWm6E3lM2CTA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-04-21T12:14:11Z"
-    mac: ENC[AES256_GCM,data:+1FyXz33iTQaPb+HCpI0o5v9CFY7BgzLBwN0D/hX4cya85xKxCRGDoG6ePQm0SoZswghlszDv2EBRCb3ZjW6A4vzXJxLPqq8TMOnKVSXMd0GSSgaivkGX32GX+gR27hL97FZQ4CDnuBuhGhxT0NpCe4s9TA2uAA/eh8fQw4hBVc=,iv:k38WzExq+B4QDAmDguW2aD2fdPwzJAEu0YF/SlFXMuc=,tag:MNZbfGVgbWGIUzgl0dhxPw==,type:str]
+    lastmodified: "2024-04-21T12:55:11Z"
+    mac: ENC[AES256_GCM,data:yNvWPuev7yvPxLZP/v/6nQ0hDzPnlQ3n+8gfKzexxEAcka34IE+pSr06zD9j+w3/8sVUG6HxzxGDUn3umTK3JjTfQByCEIsBPC6wwEQPDabpRycBSswByY5LP4bqdNinRTyBPZ7z56vlbHVSYcGXgYXIXiwF8S8qGjJn4aRc6Bw=,iv:9i0cu4GLrVVP16+UQhrUMmnACiuh9Z3TQiVsJYVrRD4=,tag:w+rCMZIuTE4ox/LYBxCnqA==,type:str]
     pgp: []
-    encrypted_regex: ^(AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$
+    encrypted_regex: ^(PASSWD|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$
     version: 3.8.1
diff --git a/decrypt.sh b/decrypt.sh
@@ -1,4 +1,4 @@
 #!/bin/bash
 
 export SOPS_AGE_KEY_FILE="$(pwd)/age.agekey"
-sops --ignore-mac --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh --decrypt --encrypted-regex '^(AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$' --in-place "$1"
+sops --ignore-mac --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh --decrypt --encrypted-regex '^(PASSWD|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$' --in-place "$1"
diff --git a/encrypt.sh b/encrypt.sh
@@ -1,3 +1,3 @@
 #!/bin/bash
 
-sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh --encrypt --encrypted-regex '^(AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$' --in-place "$1"
+sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh --encrypt --encrypted-regex '^(PASSWD|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$' --in-place "$1"