deployment.yaml (12206B)
1 # Redis deployment for PeerTube 2 apiVersion: apps/v1 3 kind: Deployment 4 metadata: 5 name: peertube-redis 6 namespace: peertube 7 spec: 8 replicas: 1 9 selector: 10 matchLabels: 11 app: peertube-redis 12 template: 13 metadata: 14 labels: 15 app: peertube-redis 16 spec: 17 automountServiceAccountToken: false 18 securityContext: 19 fsGroup: 999 20 containers: 21 - name: redis 22 image: redis:8-alpine 23 securityContext: 24 allowPrivilegeEscalation: false 25 readOnlyRootFilesystem: true 26 runAsNonRoot: true 27 runAsUser: 999 28 runAsGroup: 999 29 capabilities: 30 drop: 31 - ALL 32 seccompProfile: 33 type: RuntimeDefault 34 ports: 35 - containerPort: 6379 36 name: redis 37 volumeMounts: 38 - name: redis-data 39 mountPath: /data 40 - name: tmp 41 mountPath: /tmp 42 resources: 43 requests: 44 memory: "128Mi" 45 cpu: "100m" 46 limits: 47 memory: "256Mi" 48 cpu: "200m" 49 volumes: 50 - name: redis-data 51 emptyDir: 52 sizeLimit: 1Gi 53 - name: tmp 54 emptyDir: {} 55 --- 56 apiVersion: v1 57 kind: Service 58 metadata: 59 name: peertube-redis 60 namespace: peertube 61 spec: 62 selector: 63 app: peertube-redis 64 ports: 65 - name: redis 66 port: 6379 67 targetPort: 6379 68 --- 69 # PeerTube main deployment with nginx sidecar 70 apiVersion: apps/v1 71 kind: Deployment 72 metadata: 73 name: peertube 74 namespace: peertube 75 spec: 76 replicas: 0 77 strategy: 78 type: Recreate 79 selector: 80 matchLabels: 81 app: peertube 82 template: 83 metadata: 84 labels: 85 app: peertube 86 spec: 87 automountServiceAccountToken: false 88 containers: 89 # Nginx sidecar for S3 caching and static content 90 - name: nginx 91 image: nginxinc/nginx-unprivileged:1.27-alpine 92 securityContext: 93 allowPrivilegeEscalation: false 94 readOnlyRootFilesystem: false # envsubst template processing writes to /etc/nginx/conf.d/ 95 runAsNonRoot: true 96 runAsUser: 101 97 runAsGroup: 101 98 capabilities: 99 drop: 100 - ALL 101 seccompProfile: 102 type: RuntimeDefault 103 ports: 104 - containerPort: 8080 105 name: http 106 protocol: TCP 107 env: 108 - name: S3_ENDPOINT 109 valueFrom: 110 secretKeyRef: 111 name: peertube-secrets 112 key: S3_ENDPOINT 113 - name: S3_HOST 114 valueFrom: 115 secretKeyRef: 116 name: peertube-secrets 117 key: S3_HOST 118 volumeMounts: 119 - name: nginx-config 120 mountPath: /etc/nginx/templates/default.conf.template 121 subPath: peertube.conf 122 readOnly: true 123 - name: nginx-tmp 124 mountPath: /tmp 125 - name: nginx-log 126 mountPath: /var/log/nginx 127 - name: nginx-cache 128 mountPath: /var/cache/nginx 129 resources: 130 requests: 131 memory: "128Mi" 132 cpu: "100m" 133 limits: 134 memory: "512Mi" 135 cpu: "200m" 136 livenessProbe: 137 httpGet: 138 path: /api/v1/ping 139 port: http 140 initialDelaySeconds: 60 141 periodSeconds: 30 142 timeoutSeconds: 10 143 readinessProbe: 144 httpGet: 145 path: /api/v1/ping 146 port: http 147 initialDelaySeconds: 30 148 periodSeconds: 10 149 timeoutSeconds: 5 150 151 # PeerTube application 152 - name: peertube 153 image: chocobozzz/peertube:production-trixie 154 ports: 155 - containerPort: 9000 156 name: peertube 157 protocol: TCP 158 - containerPort: 1935 159 name: rtmp 160 protocol: TCP 161 env: 162 # Database configuration (using CNPG cluster) 163 - name: PEERTUBE_DB_HOSTNAME 164 value: "pg-cluster-v2-rw.postgres-cluster.svc.cluster.local" 165 - name: PEERTUBE_DB_USERNAME 166 value: "peertube" 167 - name: PEERTUBE_DB_PASSWORD 168 valueFrom: 169 secretKeyRef: 170 name: peertube-secrets 171 key: POSTGRES_PASSWORD 172 - name: PEERTUBE_DB_NAME 173 value: "peertube" 174 - name: PEERTUBE_DB_SSL 175 value: "false" 176 # Redis configuration 177 - name: PEERTUBE_REDIS_HOSTNAME 178 value: "peertube-redis" 179 - name: PEERTUBE_REDIS_PORT 180 value: "6379" 181 # Webserver configuration 182 - name: PEERTUBE_WEBSERVER_HOSTNAME 183 value: "peertube.mtrnord.blog" 184 - name: PEERTUBE_WEBSERVER_PORT 185 value: "443" 186 - name: PEERTUBE_WEBSERVER_HTTPS 187 value: "true" 188 # Trust proxy (envoy gateway and nginx sidecar) 189 - name: PEERTUBE_TRUST_PROXY 190 value: '["127.0.0.1", "loopback", "10.0.0.0/8", "100.64.0.0/10"]' 191 # Secret 192 - name: PEERTUBE_SECRET 193 valueFrom: 194 secretKeyRef: 195 name: peertube-secrets 196 key: PEERTUBE_SECRET 197 # Email configuration (using existing mailserver) 198 - name: PEERTUBE_SMTP_HOSTNAME 199 value: "mail.midnightthoughts.space" 200 - name: PEERTUBE_SMTP_PORT 201 value: "465" 202 - name: PEERTUBE_SMTP_USERNAME 203 valueFrom: 204 secretKeyRef: 205 name: peertube-secrets 206 key: SMTP_USERNAME 207 - name: PEERTUBE_SMTP_PASSWORD 208 valueFrom: 209 secretKeyRef: 210 name: peertube-secrets 211 key: SMTP_PASSWORD 212 - name: PEERTUBE_SMTP_FROM 213 value: "noreply@peertube.mtrnord.blog" 214 - name: PEERTUBE_SMTP_TLS 215 value: "true" 216 - name: PEERTUBE_SMTP_DISABLE_STARTTLS 217 value: "true" 218 - name: PEERTUBE_ADMIN_EMAIL 219 value: "support@midnightthoughts.space" 220 # S3 Object Storage Configuration (Hetzner) 221 - name: PEERTUBE_OBJECT_STORAGE_ENABLED 222 value: "true" 223 - name: PEERTUBE_OBJECT_STORAGE_ENDPOINT 224 valueFrom: 225 secretKeyRef: 226 name: peertube-secrets 227 key: S3_ENDPOINT 228 - name: PEERTUBE_OBJECT_STORAGE_REGION 229 valueFrom: 230 secretKeyRef: 231 name: peertube-secrets 232 key: S3_REGION 233 - name: PEERTUBE_OBJECT_STORAGE_CREDENTIALS_ACCESS_KEY_ID 234 valueFrom: 235 secretKeyRef: 236 name: peertube-secrets 237 key: S3_ACCESS_KEY_ID 238 - name: PEERTUBE_OBJECT_STORAGE_CREDENTIALS_SECRET_ACCESS_KEY 239 valueFrom: 240 secretKeyRef: 241 name: peertube-secrets 242 key: S3_SECRET_ACCESS_KEY 243 # S3 Bucket Configuration - Web Videos 244 - name: PEERTUBE_OBJECT_STORAGE_WEB_VIDEOS_BUCKET_NAME 245 valueFrom: 246 secretKeyRef: 247 name: peertube-secrets 248 key: S3_BUCKET_NAME 249 - name: PEERTUBE_OBJECT_STORAGE_WEB_VIDEOS_PREFIX 250 value: "web-videos/" 251 - name: PEERTUBE_OBJECT_STORAGE_WEB_VIDEOS_BASE_URL 252 value: "https://peertube.mtrnord.blog/static" 253 # S3 Bucket Configuration - Streaming Playlists (HLS) 254 - name: PEERTUBE_OBJECT_STORAGE_STREAMING_PLAYLISTS_BUCKET_NAME 255 valueFrom: 256 secretKeyRef: 257 name: peertube-secrets 258 key: S3_BUCKET_NAME 259 - name: PEERTUBE_OBJECT_STORAGE_STREAMING_PLAYLISTS_PREFIX 260 value: "streaming-playlists/" 261 - name: PEERTUBE_OBJECT_STORAGE_STREAMING_PLAYLISTS_BASE_URL 262 value: "https://peertube.mtrnord.blog/static" 263 # S3 Bucket Configuration - User Exports 264 - name: PEERTUBE_OBJECT_STORAGE_USER_EXPORTS_BUCKET_NAME 265 valueFrom: 266 secretKeyRef: 267 name: peertube-secrets 268 key: S3_BUCKET_NAME 269 - name: PEERTUBE_OBJECT_STORAGE_USER_EXPORTS_PREFIX 270 value: "user-exports/" 271 - name: PEERTUBE_OBJECT_STORAGE_USER_EXPORTS_BASE_URL 272 value: "https://peertube.mtrnord.blog/static" 273 # S3 Bucket Configuration - Original Video Files 274 - name: PEERTUBE_OBJECT_STORAGE_ORIGINAL_VIDEO_FILES_BUCKET_NAME 275 valueFrom: 276 secretKeyRef: 277 name: peertube-secrets 278 key: S3_BUCKET_NAME 279 - name: PEERTUBE_OBJECT_STORAGE_ORIGINAL_VIDEO_FILES_PREFIX 280 value: "original-video-files/" 281 - name: PEERTUBE_OBJECT_STORAGE_ORIGINAL_VIDEO_FILES_BASE_URL 282 value: "https://peertube.mtrnord.blog/static" 283 # S3 Bucket Configuration - Captions 284 - name: PEERTUBE_OBJECT_STORAGE_CAPTIONS_BUCKET_NAME 285 valueFrom: 286 secretKeyRef: 287 name: peertube-secrets 288 key: S3_BUCKET_NAME 289 - name: PEERTUBE_OBJECT_STORAGE_CAPTIONS_PREFIX 290 value: "captions/" 291 - name: PEERTUBE_OBJECT_STORAGE_CAPTIONS_BASE_URL 292 value: "https://peertube.mtrnord.blog/static" 293 # S3 ACL settings 294 - name: PEERTUBE_OBJECT_STORAGE_UPLOAD_ACL_PUBLIC 295 value: "public-read" 296 - name: PEERTUBE_OBJECT_STORAGE_UPLOAD_ACL_PRIVATE 297 value: "private" 298 securityContext: 299 allowPrivilegeEscalation: false 300 readOnlyRootFilesystem: false 301 runAsNonRoot: true 302 runAsUser: 999 303 runAsGroup: 999 304 capabilities: 305 drop: 306 - ALL 307 seccompProfile: 308 type: RuntimeDefault 309 volumeMounts: 310 - name: data 311 mountPath: /data 312 - name: config 313 mountPath: /config 314 resources: 315 requests: 316 memory: "1Gi" 317 cpu: "500m" 318 limits: 319 memory: "4Gi" 320 cpu: "2000m" 321 startupProbe: 322 httpGet: 323 path: /api/v1/ping 324 port: peertube 325 initialDelaySeconds: 30 326 periodSeconds: 10 327 failureThreshold: 30 328 329 volumes: 330 - name: data 331 persistentVolumeClaim: 332 claimName: peertube-data 333 - name: config 334 persistentVolumeClaim: 335 claimName: peertube-config 336 - name: nginx-config 337 configMap: 338 name: peertube-nginx 339 - name: nginx-tmp 340 emptyDir: {} 341 - name: nginx-log 342 emptyDir: {} 343 - name: nginx-cache 344 emptyDir: 345 sizeLimit: 11Gi 346 --- 347 apiVersion: v1 348 kind: Service 349 metadata: 350 name: peertube 351 namespace: peertube 352 spec: 353 selector: 354 app: peertube 355 ports: 356 - name: http 357 port: 8080 358 targetPort: 8080 359 - name: rtmp 360 port: 1935 361 targetPort: 1935 362 --- 363 apiVersion: gateway.networking.k8s.io/v1 364 kind: HTTPRoute 365 metadata: 366 name: peertube 367 namespace: peertube 368 spec: 369 parentRefs: 370 - name: envoy-gateway 371 namespace: envoy-gateway 372 hostnames: 373 - peertube.mtrnord.blog 374 rules: 375 - backendRefs: 376 - name: peertube 377 port: 8080 378 timeouts: 379 request: 600s 380 backendRequest: 0s 381 --- 382 apiVersion: gateway.envoyproxy.io/v1alpha1 383 kind: BackendTrafficPolicy 384 metadata: 385 name: peertube-policy 386 namespace: peertube 387 spec: 388 targetRef: 389 group: gateway.networking.k8s.io 390 kind: HTTPRoute 391 name: peertube 392 compression: 393 - type: Gzip 394 - type: Brotli