feat: crunchy

kubernetes/apps/default/plant-it/app/externalsecret.yaml → .archive/kubernetes/plant-it/app/externalsecret.yaml

@@ -20,7 +20,7 @@ spec:
         MYSQL_ROOT_PASSWORD: &dbPass "{{ .PLANTIT__MARIADB_ROOT_PASS }}"
         MYSQL_USERNAME: "{{ .PLANTIT__MARIADB_USER }}"
         MYSQL_PSW: *dbPass
-        FLORACODEX_KEY: "{{ .PLANTIT__FLORACODEX_KEY }}"
+        FLORACODEX_KEY: "{{ .PLANTIT__TREFLE_KEY }}"
         JWT_SECRET: "{{ .PLANTIT__JWT_SECRET }}"
 
   dataFrom:

.archive/kubernetes/windmill/app/externalsecret.yaml

@@ -0,0 +1,19 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: windmill
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: crunchy-pgo-secrets
+  target:
+    name: windmill-secret
+    template:
+      engineVersion: v2
+      data:
+        WINDMILL_POSTGRES_URL: 'postgres://{{ index . "user" }}:{{ index . "password" }}@{{ index . "host" }}/{{ index . "dbname" }}'
+  dataFrom:
+    - extract:
+        key: postgres-pguser-windmill

kubernetes/apps/default/windmill/app/helmrelease.yaml → .archive/kubernetes/windmill/app/helmrelease.yaml

@@ -29,37 +29,6 @@ spec:
       app:
         annotations:
           reloader.stakater.com/auto: "true"
-        initContainers:
-          - name: init-db
-            image: ghcr.io/onedr0p/postgres-init:16
-            envFrom:
-              - secretRef:
-                  name: &secret windmill-secret
-          - name: init-grants
-            image: ghcr.io/onedr0p/postgres-init:16
-            command:
-              - /bin/bash
-              - -c
-              - |
-                #!/bin/bash
-
-                set -o errexit
-                set -o nounset
-
-                /var/run/grants.sh
-            envFrom:
-              - secretRef:
-                  name: *secret
-            volumeMounts:
-              - name: grants
-                readOnly: true
-                subPath: grants.sh
-                mountPath: /var/run/grants.sh
-        volumes:
-          - name: grants
-            configMap:
-              name: windmill-grants
-              defaultMode: 509
       baseDomain: &host "windmill.${SECRET_EXTERNAL_DOMAIN}"
       baseProtocol: https
       appReplicas: 1
@@ -105,6 +74,6 @@ spec:
       enabled: false
   valuesFrom:
     - kind: Secret
-      name: *secret
+      name: windmill-secret
       valuesKey: WINDMILL_POSTGRES_URL
       targetPath: windmill.databaseUrl

kubernetes/apps/default/windmill/app/kustomization.yaml → .archive/kubernetes/windmill/app/kustomization.yaml

@@ -7,11 +7,3 @@ resources:
   - ./externalsecret.yaml
   - ./helmrelease.yaml
   - ../../../../templates/gatus/guarded
-configMapGenerator:
-  - name: windmill-grants
-    files:
-      - ./scripts/grants.sh
-generatorOptions:
-  disableNameSuffixHash: true
-  annotations:
-    kustomize.toolkit.fluxcd.io/substitute: disabled

kubernetes/apps/default/windmill/ks.yaml → .archive/kubernetes/windmill/ks.yaml

@@ -11,6 +11,7 @@ spec:
     labels:
       app.kubernetes.io/name: *app
   dependsOn:
+    - name: crunchy-postgres-operator-cluster
     - name: external-secrets-stores
   path: ./kubernetes/apps/default/windmill/app
   prune: true

.github/workflows/renovate.yaml

@@ -13,8 +13,8 @@ on:
         description: Log Level
         default: debug
         required: false
-  schedule:
-    - cron: "0 * * * *"
+  # schedule:
+  #   - cron: "0 * * * *"
   push:
     branches: ["main"]
     paths:

kubernetes/apps/cert-manager/cert-manager/issuers/externalsecret.yaml

@@ -14,7 +14,7 @@ spec:
     template:
       engineVersion: v2
       data:
-        CLOUDFLARE_API_KEY: "{{ .CLOUDFLARE_API_KEY }}"
+        CLOUDFLARE_TOKEN: "{{ .CLOUDFLARE_TOKEN }}"
   dataFrom:
     - extract:
         key: cloudflare

kubernetes/apps/cert-manager/cert-manager/issuers/helmrelease.yaml

@@ -14,9 +14,9 @@ spec:
       - dns01:
           cloudflare:
             email: "${SECRET_CLUSTER_DOMAIN_EMAIL}"
-            apiKeySecretRef:
+            apiTokenSecretRef:
               name: cloudflare-secret
-              key: CLOUDFLARE_API_KEY
+              key: CLOUDFLARE_TOKEN
         selector:
           dnsZones: ["${SECRET_EXTERNAL_DOMAIN}"]
 ---
@@ -35,8 +35,8 @@ spec:
       - dns01:
           cloudflare:
             email: "${SECRET_CLUSTER_DOMAIN_EMAIL}"
-            apiKeySecretRef:
+            apiTokenSecretRef:
               name: cloudflare-secret
-              key: CLOUDFLARE_API_KEY
+              key: CLOUDFLARE_TOKEN
         selector:
           dnsZones: ["${SECRET_EXTERNAL_DOMAIN}"]

kubernetes/apps/database/crunchy-postgres-operator/cluster/cluster.yaml

@@ -0,0 +1,182 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/postgres-operator.crunchydata.com/postgrescluster_v1beta1.json
+apiVersion: postgres-operator.crunchydata.com/v1beta1
+kind: PostgresCluster
+metadata:
+  name: &name postgres
+spec:
+  postgresVersion: 17
+
+  metadata:
+    labels:
+      crunchy-userinit.ramblurr.github.com/enabled: "true"
+      crunchy-userinit.ramblurr.github.com/superuser: "postgres"
+
+  patroni: # turn on sync writes to at least 1 other replica
+    dynamicConfiguration:
+      synchronous_mode: true
+      postgresql:
+        max_wal_size: 5GB
+        synchronous_commit: "on"
+        pg_hba:
+          - hostnossl authelia all 192.168.8.0/22 md5 # Needed because authelia does not support SSL yet
+          - hostssl all all all md5
+        parameters:
+          max_connections: 500
+  instances:
+    - name: postgres
+      metadata:
+        labels:
+          app.kubernetes.io/name: crunchy-postgres
+      replicas: &replica 3
+      dataVolumeClaimSpec:
+        storageClassName: openebs-hostpath
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 80Gi
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: "kubernetes.io/hostname"
+          whenUnsatisfiable: "DoNotSchedule"
+          labelSelector:
+            matchLabels:
+              postgres-operator.crunchydata.com/cluster: *name
+              postgres-operator.crunchydata.com/data: postgres
+
+  users:
+    # Superuser
+    - name: postgres
+      databases:
+        - postgres
+      options: "SUPERUSER"
+      password: &password
+        type: AlphaNumeric
+    # Applications
+    - name: authelia
+      databases:
+        - authelia
+      password: *password
+    - name: ghostfolio
+      databases:
+        - ghostfolio
+      password: *password
+    - name: home-assistant
+      databases:
+        - home-assistant
+      password: *password
+    - name: joplin
+      databases:
+        - joplin
+      password: *password
+    - name: lychee
+      databases:
+        - lychee
+      password: *password
+    - name: outline
+      databases:
+        - outline
+      password: *password
+    - name: paperless
+      databases:
+        - paperless
+      password: *password
+    - name: pushover-notifier
+      databases:
+        - pushover-notifier
+      password: *password
+    - name: tandoor
+      databases:
+        - tandoor
+      password: *password
+    - name: vaultwarden
+      databases:
+        - vaultwarden
+      password: *password
+    - name: vikunja
+      databases:
+        - vikunja
+      password: *password
+    - name: windmill
+      databases:
+        - windmill
+      password: *password
+  backups:
+    pgbackrest:
+      configuration: &backupConfig
+        - secret:
+            name: crunchy-postgres-secret
+      global: &backupFlag
+        compress-type: "bz2"
+        compress-level: "9"
+        # Minio
+        repo1-block: "y"
+        repo1-bundle: "y"
+        repo1-path: /crunchy-pgo
+        repo1-retention-full: "30" # days
+        repo1-retention-full-type: "time"
+        repo1-s3-uri-style: path
+      manual:
+        repoName: repo1
+        options:
+          - --type=full
+      metadata:
+        labels:
+          app.kubernetes.io/name: crunchy-postgres-backup
+      repos:
+        - name: repo1 # Minio
+          s3: &minio
+            bucket: crunchy-postgres
+            endpoint: "s3.${SECRET_INTERNAL_DOMAIN}"
+            region: us-east-1
+          schedules:
+            full: "0 1 * * 0" # Sunday at 01:00
+            differential: "0 1 * * 1-6" # Mon-Sat at 01:00
+            incremental: "0 2-23 * * *" # Every hour except 01:00
+
+  # dataSource:
+  #   pgbackrest:
+  #     stanza: "db"
+  #     configuration: *backupConfig
+  #     global: *backupFlag
+  #     repo:
+  #       name: "repo1"
+  #       s3: *minio
+
+  monitoring:
+    pgmonitor:
+      exporter:
+        resources:
+          requests:
+            cpu: 10m
+            memory: 64M
+          limits:
+            memory: 512M
+
+  proxy:
+    pgBouncer:
+      port: 5432
+      service:
+        metadata:
+          annotations:
+            lbipam.cilium.io/ips: ${CLUSTER_LB_POSTGRES}
+        type: LoadBalancer
+      replicas: *replica
+      metadata:
+        labels:
+          app.kubernetes.io/name: crunchy-postgres-pgbouncer
+      config:
+        global:
+          pool_mode: "session" # Grafana requires session https://github.com/grafana/grafana/issues/74260#issuecomment-1702795311. Everything else is happy with transaction
+          client_tls_sslmode: prefer
+          default_pool_size: "100"
+          max_client_conn: "500"
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: "kubernetes.io/hostname"
+          whenUnsatisfiable: "DoNotSchedule"
+          labelSelector:
+            matchLabels:
+              postgres-operator.crunchydata.com/cluster: *name
+              postgres-operator.crunchydata.com/role: pgbouncer

kubernetes/apps/database/crunchy-postgres-operator/cluster/externalsecret.yaml

@@ -0,0 +1,26 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: crunchy-postgres
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: crunchy-postgres-secret
+    template:
+      engineVersion: v2
+      data:
+        s3.conf: |
+          [global]
+          repo1-s3-key={{ .CRUNCHY_POSTGRES_S3_ACCESS_KEY }}
+          repo1-s3-key-secret={{ .CRUNCHY_POSTGRES_S3_SECRET_KEY }}
+        encryption.conf: |
+          [global]
+          repo1-cipher-pass={{ .CRUNCHY_POSTGRES_BACKUP_ENCRYPTION_CIPHER }}
+  dataFrom:
+    - extract:
+        key: crunchy-postgres

kubernetes/apps/database/crunchy-postgres-operator/cluster/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./externalsecret.yaml
+  - ./cluster.yaml
+  - ./podmonitor.yaml

kubernetes/apps/database/crunchy-postgres-operator/cluster/podmonitor.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: cpgo-postgres
+spec:
+  jobLabel: cpgo-postgres
+  namespaceSelector:
+    matchNames:
+      - database
+  podMetricsEndpoints:
+    - honorLabels: true
+      path: /metrics
+      port: exporter
+      relabelings:
+        - sourceLabels:
+            [
+              "__meta_kubernetes_namespace",
+              "__meta_kubernetes_pod_label_postgres_operator_crunchydata_com_cluster",
+            ]
+          targetLabel: pg_cluster
+          separator: "/"
+          replacement: "$1$2"
+        - sourceLabels:
+            [
+              __meta_kubernetes_pod_label_postgres_operator_crunchydata_com_instance,
+            ]
+          targetLabel: deployment
+        - sourceLabels:
+            [__meta_kubernetes_pod_label_postgres_operator_crunchydata_com_role]
+          targetLabel: role
+        - sourceLabels: [__meta_kubernetes_pod_name]
+          targetLabel: instance
+  selector:
+    matchLabels:
+      postgres-operator.crunchydata.com/cluster: postgres
+      postgres-operator.crunchydata.com/crunchy-postgres-exporter: "true"