commit ef39184940476cd6843be1089c25507588a80ab0
parent 4fbe71c999975fe427c1e174ab65f9ed82dc750c
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Sat, 29 Nov 2025 12:23:04 +0100
Initial bookwyrm setup prep
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
7 files changed, 369 insertions(+), 1 deletion(-)
diff --git a/apps/talos_cluster/bookwyrm/bookwyrm.sh b/apps/talos_cluster/bookwyrm/bookwyrm.sh
@@ -0,0 +1,41 @@
+#! /bin/bash
+
+migrate() {
+ python manage.py migrate "$@" || return 1
+}
+
+initdb() {
+ python manage.py initdb "$@" || return 1
+}
+
+init() {
+ echo "Running init function..."
+ migrate || return 1
+ migrate "django_celery_beat" || return 1
+ initdb || return 1
+ python manage.py compile_themes || return 1
+ python manage.py collectstatic --no-input || return 1
+ python manage.py admin_code || return 1
+ return 0
+}
+
+update() {
+ echo "Running update function..."
+ migrate || return 1
+ python manage.py compile_themes || return 1
+ python manage.py collectstatic --no-input || return 1
+
+ return 0
+}
+
+op="${1}"
+if [[ "${op}" == "init" ]]; then
+ init || exit 1
+elif [[ "${op}" == "update" ]]; then
+ update || exit 1
+else
+ echo "Unknown operation ${op}, aborting."
+ exit 1
+fi
+
+exit 0
diff --git a/apps/talos_cluster/bookwyrm/deployment.yaml b/apps/talos_cluster/bookwyrm/deployment.yaml
@@ -0,0 +1,105 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: bookwyrm
+ labels:
+ app: bookwyrm
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: bookwyrm
+ strategy:
+ type: "Recreate"
+ template:
+ metadata:
+ labels:
+ app: bookwyrm
+ spec:
+ automountServiceAccountToken: false
+ securityContext:
+ fsGroup: 1000
+ initContainers:
+ - name: bookwyrm-update
+ image: ghcr.io/mtrnord/bookwyrm:v0.8.2
+ command: ["bash"]
+ args:
+ - /hl/bookwyrm.sh
+ - update
+ volumeMounts:
+ - name: bookwyrm-script
+ mountPath: /hl
+ readOnly: true
+ env:
+ containers:
+ - name: bookwyrm-web
+ image: ghcr.io/mtrnord/bookwyrm:v0.8.2
+ command: ["python"]
+ args:
+ - "manage.py"
+ - "runserver"
+ - "0.0.0.0:8080"
+ resources:
+ requests:
+ cpu: 200m
+ memory: 500Mi
+ env:
+ livenessProbe:
+ httpGet:
+ port: 8080
+ path: "/"
+ initialDelaySeconds: 15
+ periodSeconds: 30
+ ports:
+ - name: bookwyrm-http
+ containerPort: 8080
+ protocol: TCP
+ - name: bookwyrm-celery-worker
+ image: ghcr.io/mtrnord/bookwyrm:v0.8.2
+ command: ["celery"]
+ args:
+ - "-A"
+ - "celerywyrm"
+ - "worker"
+ - "-l"
+ - "info"
+ - "-Q"
+ - "high_priority,medium_priority,low_priority,streams,images,suggested_users,email,connectors,lists,inbox,imports,import_triggered,broadcast,misc"
+ resources:
+ requests:
+ cpu: 200m
+ memory: 200Mi
+ env:
+ - name: bookwyrm-celery-beat
+ image: ghcr.io/mtrnord/bookwyrm:v0.8.2
+ command: ["celery"]
+ args:
+ - "-A"
+ - "celerywyrm"
+ - "beat"
+ - "-l"
+ - "INFO"
+ - "--scheduler"
+ - "django_celery_beat.schedulers:DatabaseScheduler"
+ resources:
+ requests:
+ cpu: 200m
+ memory: 200Mi
+ env:
+ - name: bookwyrm-flower
+ image: ghcr.io/mtrnord/bookwyrm:v0.8.2
+ command: ["celery"]
+ args:
+ - "-A"
+ - "celerywyrm"
+ - "flower"
+ - "--url_prefix=flower"
+ resources:
+ requests:
+ cpu: 200m
+ memory: 200Mi
+ env:
+ ports:
+ - name: flower-http
+ containerPort: 5555
+ protocol: TCP
diff --git a/apps/talos_cluster/bookwyrm/initJob.yaml b/apps/talos_cluster/bookwyrm/initJob.yaml
@@ -0,0 +1,116 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+ name: bookwyrm-init
+ labels:
+ app: bookwyrm
+spec:
+ template:
+ metadata:
+ name: bookwyrm-init
+ labels:
+ app: bookwyrm
+ spec:
+ restartPolicy: Never
+ containers:
+ - name: init-script
+ image: ghcr.io/mtrnord/bookwyrm:v0.8.2
+ command: ["bash"]
+ args:
+ - /hl/bookwyrm.sh
+ - init
+ volumeMounts:
+ - name: bookwyrm-script
+ mountPath: /hl
+ readOnly: true
+ env:
+ - name: POD_IP
+ valueFrom:
+ fieldRef:
+ fieldPath: status.podIP
+ - name: DEBUG
+ value: "false"
+ - name: ALLOWED_HOSTS
+ value: "books.mtrnord.blog,localhost,$(POD_IP)"
+ - name: SECRET_KEY
+ valueFrom:
+ secretKeyRef:
+ name: bookwyrm-secrets
+ key: SECRET_KEY
+ - name: DOMAIN
+ value: "books.mtrnord.blog"
+ - name: USE_HTTPS
+ value: "true"
+ - name: PGPORT
+ value: "5432"
+ - name: POSTGRES_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: bookwyrm-secrets
+ key: POSTGRES_PASSWORD
+ - name: POSTGRES_USER
+ value: "bookwyrm"
+ - name: POSTGRES_DB
+ value: "bookwyrm"
+ - name: POSTGRES_HOST
+ value: "pg-cluster-v2-rw.postgres-cluster.svc.cluster.local"
+ # TODO: Setup Redis
+ - name: REDIS_ACTIVITY_URL
+ value: "redis://bookwyrm-keydb.bookwyrm.svc.cluster.local:6379/0"
+ - name: REDIS_BROKER_URL
+ value: "redis://bookwyrm-keydb.bookwyrm.svc.cluster.local:6379/1"
+ - name: FLOWER_USER
+ value: "bookwyrm"
+ - name: FLOWER_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: bookwyrm-secrets
+ key: FLOWER_PASSWORD
+ - name: FLOWER_BASIC_AUTH
+ value: "$(FLOWER_USER):$(FLOWER_PASSWORD)"
+ - name: FLOWER_PORT
+ value: "5555"
+ - name: EMAIL_HOST
+ value: "mail.midnightthoughts.space"
+ - name: EMAIL_PORT
+ value: "465"
+ - name: EMAIL_HOST_USER
+ value: "support@midnightthoughts.space"
+ - name: EMAIL_HOST_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: bookwyrm-secrets
+ key: EMAIL_HOST_PASSWORD
+ - name: USE_S3
+ value: "false"
+ - name: AWS_ACCESS_KEY_ID
+ valueFrom:
+ secretKeyRef:
+ name: bookwyrm-secrets
+ key: AWS_ACCESS_KEY_ID
+ - name: AWS_SECRET_ACCESS_KEY
+ valueFrom:
+ secretKeyRef:
+ name: bookwyrm-secrets
+ key: AWS_SECRET_ACCESS_KEY
+ - name: AWS_STORAGE_BUCKET_NAME
+ valueFrom:
+ secretKeyRef:
+ name: bookwyrm-secrets
+ key: AWS_STORAGE_BUCKET_NAME
+ - name: AWS_S3_CUSTOM_DOMAIN
+ valueFrom:
+ secretKeyRef:
+ name: bookwyrm-secrets
+ key: AWS_S3_CUSTOM_DOMAIN
+ - name: AWS_S3_ENDPOINT_URL
+ valueFrom:
+ secretKeyRef:
+ name: bookwyrm-secrets
+ key: AWS_S3_ENDPOINT_URL
+ - name: ENABLETHUMBNAIL_GENERATION
+ value: "true"
+ volumes:
+ - name: bookwyrm-script
+ configMap:
+ name: bookwyrm-script
diff --git a/apps/talos_cluster/bookwyrm/keydb.yaml b/apps/talos_cluster/bookwyrm/keydb.yaml
@@ -0,0 +1,61 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: bookwyrm-keydb
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: bookwyrm-keydb
+ template:
+ metadata:
+ labels:
+ app: bookwyrm-keydb
+ spec:
+ containers:
+ - name: bookwyrm-keydb
+ image: eqalpha/keydb:latest
+ imagePullPolicy: Always
+ command: ["keydb-server"]
+ args: ["/etc/keydb/keydb.conf", "--protected-mode", "no"]
+ ports:
+ - containerPort: 6379
+ resources:
+ requests:
+ memory: "128Mi"
+ cpu: "100m"
+ limits: {}
+ tolerations:
+ - key: arch
+ operator: Equal
+ value: arm64
+ effect: NoSchedule
+ livenessProbe:
+ exec:
+ command:
+ - sh
+ - -c
+ - keydb-cli ping
+ initialDelaySeconds: 10
+ timeoutSeconds: 5
+ readinessProbe:
+ exec:
+ command:
+ - sh
+ - -c
+ - keydb-cli ping
+ initialDelaySeconds: 10
+ timeoutSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: bookwyrm-keydb
+spec:
+ selector:
+ app: bookwyrm-keydb
+ ports:
+ - name: redis
+ protocol: TCP
+ port: 6379
+ targetPort: 6379
diff --git a/apps/talos_cluster/bookwyrm/kustomization.yaml b/apps/talos_cluster/bookwyrm/kustomization.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: bookwyrm
+resources:
+ - secret.yaml
+ - keydb.yaml
+ #- deployment.yaml
+configMapGenerator:
+ - name: bookwyrm-script
+ namespace: mailserver
+ files:
+ - bookwyrm.sh=bookwyrm.sh
+ options:
+ labels:
+ app: bookwyrm
diff --git a/apps/talos_cluster/bookwyrm/secret.yaml b/apps/talos_cluster/bookwyrm/secret.yaml
@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: grafana-ro
+ namespace: bookwyrm
+type: Opaque
+stringData:
+ POSTGRES_PASSWORD: ENC[AES256_GCM,data:REfNNN0bC/ivnprqGo89G3xRfqzCWTxsqReEJl61qkgmMTO6onzmfSGuVXOpDonvWWEhRJ+Q9FqZE7S1ugT42A==,iv:6LZqzzkKSz3OOV2RREVAOHzcTFhE2Usez80d1o6AZ/Y=,tag:jwyDlWHNwkBlQo1V8rgJ3w==,type:str]
+ SECRET_KEY: ENC[AES256_GCM,data:OwwvZGyNKb1Cx4Fg5ZD5XjXUAW5wh/KXoA12Xm9WsDkE6x8VQSco4MSthsRGrzb/yAbSGBSO75Zf4USjECkA9A==,iv:4A96Z26nAF9lZnehtPsVsn502cR02Ao2DAulEZa4+Dk=,tag:fjCjmPXTJNcsJH8DTt7Cag==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmQmU5U25vblh4eXNlNGwz
+ RHJJZ0drV0lGY3htc2wvWTV3Wm9SL1hkS0FZClN5cWVtVkFnR0RyYkw2Qy9Hazc5
+ VThWN2RzN1ltcytDN21lc0xFei8rTTgKLS0tIFIvcVI1NjFKZDgwb3czZUVnMjlk
+ U0NiZlBEeTBsd0F6VHdiM21zV0hPOWsKL9kTCO3HsOUzYnE5+vINwrpEdCjdc8Bj
+ D4jl+fs7y/jL/7KUpkktDFq0qr9rY27z8qeB0SbnXbOugPqTauUC2Q==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-11-29T11:17:37Z"
+ mac: ENC[AES256_GCM,data:PMxhtxg9L6kaTRvs+SLd57lwpXkYyzHo78PtqxdiWgLSLlQMMxaqmI5b2ixRmf8rD6vsFY1E8Ham7hndoLJjE3SLSROudow4QF2gSdCNd+gLvy0xb9+eOVE9UhrbXYPCdpuHUkgv2IlJgAwrhj0SBxjIlu7dBtLhOO0kvhBPbAQ=,iv:dZG64PUwD378Kd3n6b//5ITCMkl1ZaZWcL75qSEmkbY=,tag:y+N8NEgeWdt8wrlX1zPjiA==,type:str]
+ pgp: []
+ encrypted_regex: ^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/kustomization.yaml b/apps/talos_cluster/kustomization.yaml
@@ -23,4 +23,5 @@ resources:
- ./cgit
- ./blog
- ./plausible
-# - ./matrix-org-statistics
+ # - ./matrix-org-statistics
+ - ./bookwyrm
