commit a23efb0e8ddb947a93cb186b7dd94a44d812be1d
parent b162803f6bc6660de8b1343c499c90cdfc7d1b0d
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Mon, 4 Aug 2025 11:24:40 +0200
Migrate collabora
Diffstat:
7 files changed, 206 insertions(+), 5 deletions(-)
diff --git a/apps/2024_cluster/kustomization.yaml b/apps/2024_cluster/kustomization.yaml
@@ -1,13 +1,13 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- - ../base/authentik
+ #- ../base/authentik
- ../base/victoria-metrics-k8s-stack
#- ../base/traefik
#- ../base/externaldns
#- ../base/postgres-operator
- - ../base/postgres-exporter
- - ../base/vaultwarden
+ #- ../base/postgres-exporter
+ #- ../base/vaultwarden
- ../base/matrix/matrix-helm
#- ../base/matrix/meowlnir
#- ../base/matrix/draupnir-synapse
@@ -51,9 +51,9 @@ resources:
- ../base/xandikos
- ../base/plane
- ../base/irc
- - ../base/matrix/heisenbridge
+ #- ../base/matrix/heisenbridge
#- ../base/matrix/livekit
- - ../base/collabora
+ #- ../base/collabora
- ../base/matrix/continuwuity
- ../base/matrix/connectivity-tester
- ../base/flagger
diff --git a/apps/talos_cluster/collabora/kustomization.yaml b/apps/talos_cluster/collabora/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: collabora
+resources:
+ - repository.yaml
+ - release.yaml
diff --git a/apps/talos_cluster/collabora/release.yaml b/apps/talos_cluster/collabora/release.yaml
@@ -0,0 +1,181 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+ name: collabora
+ namespace: collabora
+spec:
+ releaseName: collabora-online
+ chart:
+ spec:
+ chart: collabora-online
+ sourceRef:
+ kind: HelmRepository
+ name: collabora
+ interval: 50m
+ timeout: 25m
+ install:
+ timeout: 25m
+ remediation:
+ retries: 3
+ values:
+ ingress:
+ enabled: false
+ replicaCount: 1
+ collabora:
+ aliasgroups:
+ - host: https://collabora.midnightthoughts.space
+ - host: https://cloud.midnightthoughts.space
+ extra_params: --o:ssl.enable=false --o:ssl.termination=true
+ username: admin
+ password: ENC[AES256_GCM,data:0+VngqllfqMxssZU38/UMaUajdL2y4lKHAVM654YBPd2sT3GNijs9Zmdj6urc6ymEgaLZDHoe0F2pIkOFOhyqQ==,iv:GQitiFEShCv/Jrq1D/V5S+G6Jor+6H8/QncvltT81Uc=,tag:5gxOH59m2sGUmGBPGjtBuw==,type:str]
+ resources:
+ limits:
+ cpu: 1800m
+ memory: 2000Mi
+ requests:
+ cpu: 1800m
+ memory: 2000Mi
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6UStLR1RNZzErZ0VaNTRw
+ a0VETXVqaG5YMzNOOTRrRHhFYXBBNnVIcVNFCmp5RnNja3VMZGxvcnRMNkpFQ21w
+ NHNkdzl3VGY4b1oxVWdtNzM1Y0NVWFUKLS0tIGd2NSttbVFRSnBxSFlzSFgyaVhH
+ bnJ0cVFJZS9MOGdlSlFrZVRrODlKazgKv9LSpwR009/fBUM1PopiVPmUbAWQtNlT
+ JZNZWONdbuKCLy0YzETiL+eUbUu7/G9KMQVXIV/z5qaLdSmWkVlJwQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-05-06T20:29:10Z"
+ mac: ENC[AES256_GCM,data:dMajaAWAzF/vZITich+V0pENWfhM9HV9T3+JD6YNPg/FcpCni2oirgXZvp66oPk/oWRsfq9l4zQmX9Td62Hws4kEtXwUIIMMgSAgugzVLrJ2clkqApRdBAV7UP8dOLCdVn3j7zgRLYujrHKnOV4j9CIX9eU4jKtIgpsY+iEA12A=,iv:K4H82oJi0ecMB1gS4xzLv5A2EeEEXgeaSGmDTuIRzG4=,tag:BxPn0YaHraPF3pRclwka8g==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: HTTPRouteFilter
+metadata:
+ name: deny
+ namespace: collabora
+spec:
+ directResponse:
+ contentType: text/plain
+ statusCode: 403
+ body:
+ type: Inline
+ inline: Oops! Your request is not found.
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6UStLR1RNZzErZ0VaNTRw
+ a0VETXVqaG5YMzNOOTRrRHhFYXBBNnVIcVNFCmp5RnNja3VMZGxvcnRMNkpFQ21w
+ NHNkdzl3VGY4b1oxVWdtNzM1Y0NVWFUKLS0tIGd2NSttbVFRSnBxSFlzSFgyaVhH
+ bnJ0cVFJZS9MOGdlSlFrZVRrODlKazgKv9LSpwR009/fBUM1PopiVPmUbAWQtNlT
+ JZNZWONdbuKCLy0YzETiL+eUbUu7/G9KMQVXIV/z5qaLdSmWkVlJwQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-05-06T20:29:10Z"
+ mac: ENC[AES256_GCM,data:dMajaAWAzF/vZITich+V0pENWfhM9HV9T3+JD6YNPg/FcpCni2oirgXZvp66oPk/oWRsfq9l4zQmX9Td62Hws4kEtXwUIIMMgSAgugzVLrJ2clkqApRdBAV7UP8dOLCdVn3j7zgRLYujrHKnOV4j9CIX9eU4jKtIgpsY+iEA12A=,iv:K4H82oJi0ecMB1gS4xzLv5A2EeEEXgeaSGmDTuIRzG4=,tag:BxPn0YaHraPF3pRclwka8g==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ name: collabora
+ namespace: collabora
+spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - collabora.midnightthoughts.space
+ rules:
+ - matches:
+ - path:
+ value: /
+ type: PathPrefix
+ backendRefs:
+ - name: collabora-online
+ port: 9980
+ timeouts:
+ request: 240s
+ backendRequest: 0s
+ - matches:
+ - path:
+ value: /cool/getMetrics
+ type: PathPrefix
+ backendRefs:
+ - name: collabora-online
+ port: 9980
+ timeouts:
+ request: 240s
+ backendRequest: 0s
+ filters:
+ - type: ExtensionRef
+ extensionRef:
+ group: gateway.envoyproxy.io
+ kind: HTTPRouteFilter
+ name: deny
+ - matches:
+ - path:
+ value: /cool/adminws
+ type: PathPrefix
+ backendRefs:
+ - name: collabora-online
+ port: 9980
+ timeouts:
+ request: 240s
+ backendRequest: 0s
+ filters:
+ - type: ExtensionRef
+ extensionRef:
+ group: gateway.envoyproxy.io
+ kind: HTTPRouteFilter
+ name: deny
+ - matches:
+ - path:
+ value: /browser/dist/admin/admin.html
+ type: Exact
+ backendRefs:
+ - name: collabora-online
+ port: 9980
+ timeouts:
+ request: 240s
+ backendRequest: 0s
+ filters:
+ - type: ExtensionRef
+ extensionRef:
+ group: gateway.envoyproxy.io
+ kind: HTTPRouteFilter
+ name: deny
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6UStLR1RNZzErZ0VaNTRw
+ a0VETXVqaG5YMzNOOTRrRHhFYXBBNnVIcVNFCmp5RnNja3VMZGxvcnRMNkpFQ21w
+ NHNkdzl3VGY4b1oxVWdtNzM1Y0NVWFUKLS0tIGd2NSttbVFRSnBxSFlzSFgyaVhH
+ bnJ0cVFJZS9MOGdlSlFrZVRrODlKazgKv9LSpwR009/fBUM1PopiVPmUbAWQtNlT
+ JZNZWONdbuKCLy0YzETiL+eUbUu7/G9KMQVXIV/z5qaLdSmWkVlJwQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-05-06T20:29:10Z"
+ mac: ENC[AES256_GCM,data:dMajaAWAzF/vZITich+V0pENWfhM9HV9T3+JD6YNPg/FcpCni2oirgXZvp66oPk/oWRsfq9l4zQmX9Td62Hws4kEtXwUIIMMgSAgugzVLrJ2clkqApRdBAV7UP8dOLCdVn3j7zgRLYujrHKnOV4j9CIX9eU4jKtIgpsY+iEA12A=,iv:K4H82oJi0ecMB1gS4xzLv5A2EeEEXgeaSGmDTuIRzG4=,tag:BxPn0YaHraPF3pRclwka8g==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/collabora/repository.yaml b/apps/talos_cluster/collabora/repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+ name: collabora
+ namespace: collabora
+spec:
+ interval: 5m
+ url: https://collaboraonline.github.io/online/
diff --git a/apps/talos_cluster/kustomization.yaml b/apps/talos_cluster/kustomization.yaml
@@ -9,3 +9,4 @@ resources:
- ./draupnir-synapse
- ./vaultwarden
- ./actualbudget-server
+ - ./collabora
diff --git a/apps/talos_cluster/namespaces/collabora.yaml b/apps/talos_cluster/namespaces/collabora.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+ name: collabora
diff --git a/apps/talos_cluster/namespaces/kustomization.yaml b/apps/talos_cluster/namespaces/kustomization.yaml
@@ -7,3 +7,4 @@ resources:
- matrix.yaml
- vaultwarden.yaml
- actualbudget-server.yaml
+ - collabora.yaml
