cluster

commit 63c225589e99bcb542afc09901e80743a4d1dfb4
parent 4675cf3f45041b7cc47dec46983d4b288ffefec3
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Tue,  3 Mar 2026 21:36:58 +0100

move clickhouse to s3

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
A
apps/talos_cluster/plausible/clickhouse-s3-secret.yaml
 | 
29
+++++++++++++++++++++++++++++
M
apps/talos_cluster/plausible/kustomization.yaml
 | 
1
+
M
apps/talos_cluster/plausible/release.yaml
 | 
29
++++++++++++++++++++++++++++-

3 files changed, 58 insertions(+), 1 deletion(-)
diff --git a/apps/talos_cluster/plausible/clickhouse-s3-secret.yaml b/apps/talos_cluster/plausible/clickhouse-s3-secret.yaml
@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: clickhouse-s3-credentials
+    namespace: blog
+type: Opaque
+stringData:
+    CH_S3_ACCESS_KEY: ENC[AES256_GCM,data:wFyPpDFnm5+/GZISQpKyfTyH4SA=,iv:jRj75miPnJeGtklqPrgn4x8I8UWkUu60O1mWvhkaKcw=,tag:Dof0dbdEHEwsolnkwKIrhQ==,type:str]
+    CH_S3_SECRET_KEY: ENC[AES256_GCM,data:rALu8qattXA3AJOJrEW447Q/3DRsRgQW4Si0TkxiRl2IpAOjmswqJA==,iv:TSOvambKzQd8NGnSQDyRn9R2lJSRdkAL9Q5ck3nOn9Y=,tag:tfq00asf1qROjPT6LDDDeg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxcm51YjN6YWsxc201QVBy
+            cEtMRGRHYjYvcW4yMEhPOUxDVGxOWnc4WDBnClNvUkYydkVLRFkrcFc4STV3VlpU
+            WjRnM1h5UlM0YmxCd0tiSDl4SHR5TmsKLS0tIHJjSS9kSTBuUlJTL1pBejE3dGcy
+            T2poVzBzbFNiNHZSM0EvbnM2SDVjL00KYAh87VeNxwtmDtmWL195TRCc6eWFSJ45
+            yCvpjXphd3dHDf7tExMEP6I1dZZT/OBQ7JpsCFFctC3pYfFX1ihpZQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-03T20:36:50Z"
+    mac: ENC[AES256_GCM,data:uSpF6Biea9g2a/uG3y5yW3MD+oSckJD1a8EDQpn1SJ5S2/MjHx07E+/hzP5tFM8QH6mwUQhmQeqCDZF/Jrk2rlSQYTeJqoiIplVm/K4ABwLVFxE3jbSy/9G4B5w3ygx9kGZ3l0XcccHvrnaL85CemE+A0j/cbv3RuOdWLOT3BQ8=,iv:qzWb103qsWWC7W2szuewtG6ELBWRoPAL79lULYLyTck=,tag:PCtldcjLqOfaF4hlQt4J5g==,type:str]
+    pgp: []
+    encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|integration_key|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+    version: 3.9.1
diff --git a/apps/talos_cluster/plausible/kustomization.yaml b/apps/talos_cluster/plausible/kustomization.yaml
@@ -5,3 +5,4 @@ resources:
   - repository.yaml
   - release.yaml
   - route.yaml
+  - clickhouse-s3-secret.yaml
diff --git a/apps/talos_cluster/plausible/release.yaml b/apps/talos_cluster/plausible/release.yaml
@@ -42,7 +42,34 @@ spec:
       persistence:
         storageClass: longhorn
         enabled: true
-        size: 8Gi
+        size: 256Mi
+      extraEnvVarsSecret: clickhouse-s3-credentials
+      configdFiles:
+        s3-storage.xml: |
+          <clickhouse>
+            <storage_configuration>
+              <disks>
+                <s3_disk>
+                  <type>s3</type>
+                  <endpoint>https://hel1.your-objectstorage.com/midnightthoughts-clickhouse/</endpoint>
+                  <access_key_id from_env="CH_S3_ACCESS_KEY"/>
+                  <secret_access_key from_env="CH_S3_SECRET_KEY"/>
+                </s3_disk>
+              </disks>
+              <policies>
+                <s3_only>
+                  <volumes>
+                    <main>
+                      <disk>s3_disk</disk>
+                    </main>
+                  </volumes>
+                </s3_only>
+              </policies>
+            </storage_configuration>
+            <merge_tree>
+              <storage_policy>s3_only</storage_policy>
+            </merge_tree>
+          </clickhouse>
     ingress:
       enabled: false
       annotations: