commit 77ca74b911da93f244b7d8c3202f5ceb77e04a2f
parent 5dc3747d2d1fa9f2b1ce16505144443c8590be8a
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Sat, 11 Apr 2026 20:05:03 +0200
install wanderer
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
11 files changed, 390 insertions(+), 0 deletions(-)
diff --git a/apps/talos_cluster/envoy-gateway/gateway_settings.yaml b/apps/talos_cluster/envoy-gateway/gateway_settings.yaml
@@ -845,6 +845,18 @@ spec:
certificateRefs:
- kind: Secret
name: jenkins.midnightthoughts.space-tls
+ - name: https-mtrnord-blog-wanderer
+ protocol: HTTPS
+ hostname: "wanderer.mtrnord.blog"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: wanderer.mtrnord.blog-tls
- name: http
protocol: HTTP
port: 80
diff --git a/apps/talos_cluster/kustomization.yaml b/apps/talos_cluster/kustomization.yaml
@@ -45,3 +45,4 @@ resources:
- ./matrix-backup
#- ./proxmox-ccm
- ./jenkins
+ - ./wanderer
diff --git a/apps/talos_cluster/namespaces/kustomization.yaml b/apps/talos_cluster/namespaces/kustomization.yaml
@@ -31,3 +31,4 @@ resources:
- persephone.yaml
- codeberg.yaml
- opencost.yaml
+ - wanderer.yaml
diff --git a/apps/talos_cluster/namespaces/wanderer.yaml b/apps/talos_cluster/namespaces/wanderer.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+ name: wanderer
diff --git a/apps/talos_cluster/wanderer/kustomization.yaml b/apps/talos_cluster/wanderer/kustomization.yaml
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: wanderer
+resources:
+ - secret.yaml
+ - pvc.yaml
+ - meilisearch.yaml
+ - pocketbase.yaml
+ - web.yaml
+ - route.yaml
diff --git a/apps/talos_cluster/wanderer/meilisearch.yaml b/apps/talos_cluster/wanderer/meilisearch.yaml
@@ -0,0 +1,63 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: wanderer-search
+ namespace: wanderer
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: wanderer-search
+ strategy:
+ type: Recreate
+ template:
+ metadata:
+ labels:
+ app: wanderer-search
+ spec:
+ containers:
+ - name: meilisearch
+ image: getmeili/meilisearch:v1.11.3
+ ports:
+ - containerPort: 7700
+ env:
+ - name: MEILI_MASTER_KEY
+ valueFrom:
+ secretKeyRef:
+ name: wanderer-secrets
+ key: MEILI_MASTER_KEY
+ - name: MEILI_NO_ANALYTICS
+ value: "true"
+ volumeMounts:
+ - name: data
+ mountPath: /meili_data
+ livenessProbe:
+ httpGet:
+ path: /health
+ port: 7700
+ initialDelaySeconds: 15
+ periodSeconds: 15
+ failureThreshold: 10
+ readinessProbe:
+ httpGet:
+ path: /health
+ port: 7700
+ initialDelaySeconds: 5
+ periodSeconds: 10
+ failureThreshold: 10
+ volumes:
+ - name: data
+ persistentVolumeClaim:
+ claimName: wanderer-meilisearch-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: wanderer-search
+ namespace: wanderer
+spec:
+ selector:
+ app: wanderer-search
+ ports:
+ - port: 7700
+ targetPort: 7700
diff --git a/apps/talos_cluster/wanderer/pocketbase.yaml b/apps/talos_cluster/wanderer/pocketbase.yaml
@@ -0,0 +1,102 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: wanderer-db
+ namespace: wanderer
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: wanderer-db
+ strategy:
+ type: Recreate
+ template:
+ metadata:
+ labels:
+ app: wanderer-db
+ spec:
+ containers:
+ - name: pocketbase
+ image: flomp/wanderer-db:latest
+ ports:
+ - containerPort: 8090
+ env:
+ - name: MEILI_URL
+ value: "http://wanderer-search:7700"
+ - name: MEILI_MASTER_KEY
+ valueFrom:
+ secretKeyRef:
+ name: wanderer-secrets
+ key: MEILI_MASTER_KEY
+ - name: POCKETBASE_ENCRYPTION_KEY
+ valueFrom:
+ secretKeyRef:
+ name: wanderer-secrets
+ key: POCKETBASE_ENCRYPTION_KEY
+ - name: ORIGIN
+ value: "https://wanderer.mtrnord.blog"
+ - name: POCKETBASE_SMTP_ENABLED
+ value: "true"
+ - name: POCKETBASE_SMTP_HOST
+ valueFrom:
+ secretKeyRef:
+ name: wanderer-secrets
+ key: POCKETBASE_SMTP_HOST
+ - name: POCKETBASE_SMTP_PORT
+ valueFrom:
+ secretKeyRef:
+ name: wanderer-secrets
+ key: POCKETBASE_SMTP_PORT
+ - name: POCKETBASE_SMTP_USERNAME
+ valueFrom:
+ secretKeyRef:
+ name: wanderer-secrets
+ key: POCKETBASE_SMTP_USERNAME
+ - name: POCKETBASE_SMTP_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: wanderer-secrets
+ key: POCKETBASE_SMTP_PASSWORD
+ - name: POCKETBASE_SMTP_SENDER_ADDRESS
+ valueFrom:
+ secretKeyRef:
+ name: wanderer-secrets
+ key: POCKETBASE_SMTP_SENDER_ADDRESS
+ - name: POCKETBASE_SMTP_SENDER_NAME
+ valueFrom:
+ secretKeyRef:
+ name: wanderer-secrets
+ key: POCKETBASE_SMTP_SENDER_NAME
+ volumeMounts:
+ - name: data
+ mountPath: /pb_data
+ livenessProbe:
+ httpGet:
+ path: /api/health
+ port: 8090
+ initialDelaySeconds: 15
+ periodSeconds: 15
+ failureThreshold: 10
+ readinessProbe:
+ httpGet:
+ path: /api/health
+ port: 8090
+ initialDelaySeconds: 5
+ periodSeconds: 10
+ failureThreshold: 10
+ volumes:
+ - name: data
+ persistentVolumeClaim:
+ claimName: wanderer-pocketbase-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: wanderer-db
+ namespace: wanderer
+spec:
+ selector:
+ app: wanderer-db
+ ports:
+ - port: 8090
+ targetPort: 8090
diff --git a/apps/talos_cluster/wanderer/pvc.yaml b/apps/talos_cluster/wanderer/pvc.yaml
@@ -0,0 +1,38 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+ name: wanderer-meilisearch-data
+ namespace: wanderer
+spec:
+ accessModes:
+ - ReadWriteOnce
+ resources:
+ requests:
+ storage: 1Gi
+ storageClassName: longhorn
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+ name: wanderer-pocketbase-data
+ namespace: wanderer
+spec:
+ accessModes:
+ - ReadWriteOnce
+ resources:
+ requests:
+ storage: 1Gi
+ storageClassName: longhorn
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+ name: wanderer-uploads
+ namespace: wanderer
+spec:
+ accessModes:
+ - ReadWriteOnce
+ resources:
+ requests:
+ storage: 2Gi
+ storageClassName: longhorn
diff --git a/apps/talos_cluster/wanderer/route.yaml b/apps/talos_cluster/wanderer/route.yaml
@@ -0,0 +1,49 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ name: wanderer
+ namespace: wanderer
+spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - wanderer.mtrnord.blog
+ rules:
+ - matches:
+ - path:
+ type: PathPrefix
+ value: /api
+ - path:
+ type: PathPrefix
+ value: /_
+ backendRefs:
+ - name: wanderer-db
+ port: 8090
+ timeouts:
+ request: 120s
+ backendRequest: 0s
+ - matches:
+ - path:
+ type: PathPrefix
+ value: /
+ backendRefs:
+ - name: wanderer-web
+ port: 3000
+ timeouts:
+ request: 240s
+ backendRequest: 0s
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+ name: wanderer-compression
+ namespace: wanderer
+spec:
+ targetRef:
+ group: gateway.networking.k8s.io
+ kind: HTTPRoute
+ name: wanderer
+ compression:
+ - type: Gzip
+ - type: Brotli
diff --git a/apps/talos_cluster/wanderer/secret.yaml b/apps/talos_cluster/wanderer/secret.yaml
@@ -0,0 +1,37 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: wanderer-secrets
+ namespace: wanderer
+type: Opaque
+stringData:
+ #ENC[AES256_GCM,data:vG/HRSM/LPQZ7xjLHx8JVy/VT+EHYAnu/XvZ8Cl8Hv0mdGTG,iv:Up8aVwvw5MLQDOnXnKLF3/FKePls2QQDRW9/+9NKIYg=,tag:LzA7OBij7SErnl0aK/SI1A==,type:comment]
+ POCKETBASE_ENCRYPTION_KEY: ENC[AES256_GCM,data:NMGVPX+uTqf5bsY1ZcoPe710oik4id6MzLiHGrnMPPw=,iv:N6Gn2G2XlrB3eVpQwEwtU1QCXnMh+gjaq9C/CPitgWk=,tag:YUO4HcmbycZGVeqM+9i9xg==,type:str]
+ #ENC[AES256_GCM,data:bTRYkId+LN90Dh/W+e/5I0JEDnehxnfpDOJrrRmppd6Es80OKV9I,iv:obOg48tY6XDpDd/TtSS6KNe4ea7CmN/LuAGEnxBWB9w=,tag:JDJFCgUfXq2+aSe5B7n7lQ==,type:comment]
+ MEILI_MASTER_KEY: ENC[AES256_GCM,data:5JPrsuEYMD0jI4xI1j7wxw0epSSzCcClFf94I5fnYRBUxyrV1D5cWc5xq6E5DsxztxRXdCuGd7KB7tjHCHwO,iv:E+UFLAUFRJFim3+eC6RcGM6QhSIAI+7EegLzeXCvcZA=,tag:ihK04pltp9eYswYmDTcFAA==,type:str]
+ POCKETBASE_SMTP_HOST: ENC[AES256_GCM,data:qmplnWDMg08LX7EThKw2f9CdiM3MojE+oT1/,iv:VCWlnFdvXOXZq+IfDq6x+uij8x9UFqN9IEcHOnXgP/k=,tag:dq5Tb7PZs9OY50rGUIRawg==,type:str]
+ POCKETBASE_SMTP_PORT: ENC[AES256_GCM,data:GVUp,iv:Q1bfpsyDXqXxahW098IGglOLkq37TuD0ETlESoiEvrI=,tag:5Y7lcEJqo899il08QpMX/w==,type:str]
+ POCKETBASE_SMTP_USERNAME: ENC[AES256_GCM,data:YWBBBsiBZ3FI6H3pNaa02uOPfUVzc2pS+HOTo7ZDCQ==,iv:032lCs7oDd5UGbCHwtOTXwcjGAoDC1eF7UYsSgr6+PI=,tag:08NDXNa3Kn0ak8x2CjN2Kw==,type:str]
+ POCKETBASE_SMTP_PASSWORD: ENC[AES256_GCM,data:OGxbLar9TQUiFH9iKCnF3KCciXumlRUqCioNTj5bWLproOyBUhGOmC3o5E/WvrZjud7bhu+2O2hFl5i4i7xM,iv:vxjpZuZRJT+Z88P2tonPyZAZl8jXa60QfHCvdbYQfJU=,tag:YRYt6+jmh/YKucH4nJTAdw==,type:str]
+ POCKETBASE_SMTP_SENDER_ADDRESS: ENC[AES256_GCM,data:3mb/4q89G9jo/Ea8HH1PhmcpY3lW,iv:sQaG078KUKcxa9qcQ/gx4gGelIyhjskhAk22lzV6wPg=,tag:xiTLI7b4qyPl6pT9mDaldw==,type:str]
+ POCKETBASE_SMTP_SENDER_NAME: ENC[AES256_GCM,data:4IjSH2YZfrc=,iv:v3rQGo6CNsDwy/kgdvQXfSvx+9IYFwT5iNi+2D/6r68=,tag:Nr/B1AZW7stNMcMxyqYNtg==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpdElkeUVtTHRjQldBeFpE
+ MjRicVhsVUxDbThmY2RTQkVUNzU5Y0IwOGc4CnNHU3RnWmZ4RnZQSUlsNjB5K29I
+ Z1Qya3ZQemZOQnBLaXFxZjVKK0UzSUEKLS0tIFNxZFhnVWhjSWMwcnN6RVRjc2V0
+ WFhBK09EU2t5ZmxLV21JUUJpWktqMmsKgDniMoiwHu0zyc1v636qNuJuL34+ifyD
+ EyR1VPWEfOPYrMRUuM/E8DKK6Z+YsV1iGUQH6fpW0GeE7yIqNmPldQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-04-11T18:04:51Z"
+ mac: ENC[AES256_GCM,data:mnhHk9oWRML/K7tomayhgpb+cCyKsmvY6/ZlPba5JmvbCGGMfSJUzHvBMd3PmtN9kdkQDJWiET/T9jTd8v53WUt4fQdZ9Tunkh6J1TVRpbulExC/A6tIii+ghwrZl744QHdeZhUO9Tolav641B/stiU+ntAvt8jKS1qp1l1+ty8=,iv:ZAuGd2NbqfdUVsO1uxMFzRIy19SzhuJbVL+mTvolfjY=,tag:S6DwaNfEC6b7nBD93Gc3eQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|smtp_auth_password|addresses|smtp_auth_username|authorization_credentials|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|integration_key|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret|content)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/wanderer/web.yaml b/apps/talos_cluster/wanderer/web.yaml
@@ -0,0 +1,73 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: wanderer-web
+ namespace: wanderer
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: wanderer-web
+ strategy:
+ type: Recreate
+ template:
+ metadata:
+ labels:
+ app: wanderer-web
+ spec:
+ containers:
+ - name: web
+ image: flomp/wanderer-web:latest
+ ports:
+ - containerPort: 3000
+ env:
+ - name: ORIGIN
+ value: "https://wanderer.mtrnord.blog"
+ - name: PUBLIC_POCKETBASE_URL
+ value: "https://wanderer.mtrnord.blog"
+ - name: MEILI_URL
+ value: "http://wanderer-search:7700"
+ - name: MEILI_MASTER_KEY
+ valueFrom:
+ secretKeyRef:
+ name: wanderer-secrets
+ key: MEILI_MASTER_KEY
+ - name: PUBLIC_DISABLE_SIGNUP
+ value: "true"
+ - name: PUBLIC_PRIVATE_INSTANCE
+ value: "true"
+ - name: BODY_SIZE_LIMIT
+ value: "Infinity"
+ volumeMounts:
+ - name: uploads
+ mountPath: /app/uploads
+ livenessProbe:
+ httpGet:
+ path: /
+ port: 3000
+ initialDelaySeconds: 15
+ periodSeconds: 15
+ failureThreshold: 10
+ readinessProbe:
+ httpGet:
+ path: /
+ port: 3000
+ initialDelaySeconds: 5
+ periodSeconds: 10
+ failureThreshold: 10
+ volumes:
+ - name: uploads
+ persistentVolumeClaim:
+ claimName: wanderer-uploads
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: wanderer-web
+ namespace: wanderer
+spec:
+ selector:
+ app: wanderer-web
+ ports:
+ - port: 3000
+ targetPort: 3000
