commit e930a6acb86214058b797f258168a82c06aa0e14
parent 7b4a66d8bdec846f0fe86e3676934af1ea356865
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Thu, 16 Oct 2025 22:16:32 +0200
install plausible
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
7 files changed, 132 insertions(+), 23 deletions(-)
diff --git a/apps/talos_cluster/blog/docker/Dockerfile b/apps/talos_cluster/blog/docker/Dockerfile
@@ -113,6 +113,21 @@ RUN wget -q https://downloads.wordpress.org/plugin/wp-mail-smtp.4.6.0.zip \
&& unzip -q wp-mail-smtp.4.6.0.zip -d /var/www/html/wordpress/wp-content/plugins/ \
&& rm wp-mail-smtp.4.6.0.zip
+# Install Simply Gallery Block
+RUN wget -q https://downloads.wordpress.org/plugin/simply-gallery-block.3.2.7.zip \
+ && unzip -q simply-gallery-block.3.2.7.zip -d /var/www/html/wordpress/wp-content/plugins/ \
+ && rm simply-gallery-block.3.2.7.zip
+
+# Install Table of Contents Block
+RUN wget -q https://downloads.wordpress.org/plugin/table-of-content-block.1.0.6.zip \
+ && unzip -q table-of-content-block.1.0.6.zip -d /var/www/html/wordpress/wp-content/plugins/ \
+ && rm table-of-content-block.1.0.6.zip
+
+# Install Plausible Analytics
+RUN wget -q https://downloads.wordpress.org/plugin/plausible-analytics.latest-stable.zip \
+ && unzip -q plausible-analytics.latest-stable.zip -d /var/www/html/wordpress/wp-content/plugins/ \
+ && rm plausible-analytics.latest-stable.zip
+
# Install twenty-twenty-five theme
RUN wget -q https://downloads.wordpress.org/theme/twentytwentyfive.1.3.zip \
&& unzip -q -o twentytwentyfive.1.3.zip -d /var/www/html/wordpress/wp-content/themes/ \
diff --git a/apps/talos_cluster/kustomization.yaml b/apps/talos_cluster/kustomization.yaml
@@ -22,4 +22,5 @@ resources:
- ./wkd
- ./cgit
- ./blog
+ - ./plausible
# - ./matrix-org-statistics
diff --git a/apps/talos_cluster/plausible/kustomization.yaml b/apps/talos_cluster/plausible/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: blog
+resources:
+ - repository.yaml
+ - release.yaml
diff --git a/apps/talos_cluster/plausible/release.yaml b/apps/talos_cluster/plausible/release.yaml
@@ -0,0 +1,67 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+ name: plausible
+ namespace: blog
+spec:
+ chart:
+ spec:
+ chart: plausible-analytics
+ sourceRef:
+ kind: HelmRepository
+ name: plausible
+ interval: 60m
+ timeout: 10m
+ install:
+ timeout: 10m
+ remediation:
+ retries: 3
+ values:
+ baseURL: https://plausible.midnightthoughts.space
+ disableRegistration: true
+ totpVaultKey: ENC[AES256_GCM,data:tXOL3fSg2Xu5IgqVofgBvZGTODK7uDjzIK2HR4SqGHm3gFAaXkpxTBb1OMI=,iv:PXGHz5SGzqS7SvkTqjTPya+2ieF5cwLJw0DfA/Vtf0I=,tag:mEUJLEEF+qxwC/IPeJO61Q==,type:str]
+ clickhouseDatabaseURL: ENC[AES256_GCM,data:RvSx+1Ym/oJEBbLXLn8bHWLMWFDPPUTBh8IObyuJGUWlzg4X1UbKLIuAi5YeNB2yrZBVfM9ELVZsCJApONOrZG26525+kou0f4DmRiFxKSgT+eH/x3Mb1hc/yv5/h0Kkx4PTrzNhUvyFLqywNQEFiwyMhYAbEsuUm8j8cJm08l9RFc5xX6gXcXutZDGzdzaS/dqWYbxs3kIHqkqI,iv:kG9aJnbc4PEYBjK8CeAVKbnKH03eA88Cg5dss8CjEdA=,tag:nU3flOIwns07SFe49sedcQ==,type:str]
+ databaseURL: ENC[AES256_GCM,data:J5RmR4sJJZ1iKNDbQRA4UNNmk8UJMzzaZqU6b9xOHOvZjdj+bYVs3dD3gLKHpPdKp55c6WZV505f0C9eeo+FEapM3ipxzsNRcbOrF7zFpwVSQr0FG1OeJ/RY25SDuTwPve/nGQL5DZgyQvSQA/zomiFudkMszRXeUwhpKavE6jmxSZ9bIG6jbBpXNr87QMktuDirtYJmSJO72eU6ZQCCy5E=,iv:INaiWi1e69POVtfAVgjnh4Bsd1zmblRp5Y/Rm/W9vDE=,tag:hkDNpamNk+jYZl4x6vq4pQ==,type:str]
+ mailer:
+ # TODO: Set up mailer
+ enabled: false
+ postgresql:
+ enabled: false
+ clickhouse:
+ auth:
+ password: ENC[AES256_GCM,data:bN5kN21E9bpF8DMoXmvYbjPl+mqEwxTdGZuNME/F6SAkDEJCWa8vOuciIX6OPTw79IJ0hnpFhfUnnzSkIGWS9g==,iv:VqL5Ser0rTYU6WUMmNKTJtZChAZtK+nsnLV3U9FgCuQ=,tag:EiHbI5S/0ef9XX0ccTuP7Q==,type:str]
+ persistence:
+ storageClass: longhorn
+ enabled: true
+ size: 8Gi
+ ingress:
+ enabled: false
+ annotations:
+ cert-manager.io/cluster-issuer: letsencrypt-dns
+ hosts:
+ - plausible.midnightthoughts.space
+ path: /
+ tls:
+ - secretName: plausible.midnightthoughts.space-tls
+ hosts:
+ - plausible.midnightthoughts.space
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCMkRvUTB3L2xpcFJNaTZn
+ R054UkJYRjRqWUdkS0szN25PRTZDclFMQWxVCnBzSWhDOWhvUEszUUhSNjNWdENi
+ VmsyWU5zRk1GeEE2dm1aekl3LzVWL2MKLS0tIHZWRHZONmFuaTdrcFMxUmVrK3BS
+ SDd4ekJjbTdtTVlONWdPM3pRK015MUEKIEXHPt2qVOuLZgOJxDj0WIdHLIlFri2z
+ 5/eK6C8eNEhbntLmrKCpHgIQDN1Z59nHsqWG4iGOxwq8MO5yTd4d5Q==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-10-16T20:16:27Z"
+ mac: ENC[AES256_GCM,data:fTG04BZQa6prIdD4N4pRJfwBOIZAW0qOYgZGK2SIKHTryD6A50X3mY2h8nnyQnLD58mxGtADzkkkoTf9rQ3rGUK/lR5zyfxTGZ+cn3XGB7VZJMRWOZI/nMGMcHpohIReNIXPlhZ1icrpkVGe26pb/yIIfoXdomoXx4SAq7GQ9+g=,iv:ezgggADwhOWMNwzorvhoRigZAdhIFF7wUEHfmSn3pHk=,tag:Dtq51OLXR9TqUXoMgPiagg==,type:str]
+ pgp: []
+ encrypted_regex: ^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/plausible/repository.yaml b/apps/talos_cluster/plausible/repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+ name: plausible
+ namespace: blog
+spec:
+ interval: 5m
+ url: https://imio.github.io/helm-charts
diff --git a/encrypt.sh b/encrypt.sh
@@ -2,5 +2,5 @@
sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh \
--encrypt \
- --encrypted-regex '^(harborAdminPassword|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$' \
+ --encrypted-regex '^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$' \
--in-place "$1"
diff --git a/infrastructure_talos/configs/cnpg-cluster.yaml b/infrastructure_talos/configs/cnpg-cluster.yaml
@@ -112,7 +112,7 @@ spec:
- name: barman-cloud.cloudnative-pg.io
isWALArchiver: true
parameters:
- barmanObjectName: hetzner-base-backup
+ barmanObjectName: hetzner-base-backup
managed:
roles:
- name: freshrss
@@ -120,128 +120,128 @@ spec:
login: true
superuser: false
passwordSecret:
- name: freshrss
+ name: freshrss
- name: meowlnir
ensure: present
login: true
comment: Read Only Access for synapse required but RW to meowlnir db
superuser: false
passwordSecret:
- name: meowlnir
+ name: meowlnir
- name: connectivity-tester-stage
ensure: present
login: true
superuser: false
passwordSecret:
- name: connectivity-tester-stage
+ name: connectivity-tester-stage
- name: connectivity-tester
ensure: present
login: true
superuser: false
passwordSecret:
- name: connectivity-tester
+ name: connectivity-tester
- name: draupnir_synapse
ensure: present
login: true
superuser: false
passwordSecret:
- name: draupnir-synapse
+ name: draupnir-synapse
- name: authentik
ensure: present
login: true
superuser: false
passwordSecret:
- name: authentik
+ name: authentik
- name: ejabberd
ensure: present
login: true
superuser: false
passwordSecret:
- name: ejabberd
+ name: ejabberd
- name: vaultwarden
ensure: present
login: true
superuser: false
passwordSecret:
- name: vaultwarden
+ name: vaultwarden
- name: mastodon
ensure: present
login: true
superuser: false
passwordSecret:
- name: mastodon
+ name: mastodon
- name: openproject
ensure: present
login: true
superuser: false
passwordSecret:
- name: openproject
+ name: openproject
- name: plausible
ensure: present
login: true
superuser: false
passwordSecret:
- name: plausible
+ name: plausible
- name: coder
ensure: present
login: true
superuser: false
passwordSecret:
- name: coder
+ name: coder
- name: matrix_auth
ensure: present
login: true
superuser: false
passwordSecret:
- name: matrix-auth
+ name: matrix-auth
- name: cachet
ensure: present
login: true
superuser: false
passwordSecret:
- name: cachet
+ name: cachet
- name: docuseal
ensure: present
login: true
superuser: false
passwordSecret:
- name: docuseal
+ name: docuseal
- name: bugzilla
ensure: present
login: true
superuser: false
passwordSecret:
- name: bugzilla
+ name: bugzilla
- name: rundeck
ensure: present
login: true
superuser: false
passwordSecret:
- name: rundeck
+ name: rundeck
- name: plane
ensure: present
login: true
superuser: false
passwordSecret:
- name: plane
+ name: plane
- name: gotosocial
ensure: present
login: true
superuser: false
passwordSecret:
- name: gotosocial
+ name: gotosocial
- name: grafana-ro
ensure: present
login: true
superuser: false
passwordSecret:
- name: grafana-ro
+ name: grafana-ro
- name: mailman
ensure: present
login: true
superuser: false
passwordSecret:
- name: mailman
+ name: mailman
storage:
storageClass: hcloud-volumes
size: 15Gi
@@ -422,3 +422,15 @@ spec:
ensure: present
cluster:
name: pg-cluster-v2
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+ name: plausible
+ namespace: postgres-cluster
+spec:
+ name: plausible
+ owner: plausible
+ ensure: present
+ cluster:
+ name: pg-cluster-v2
