immich-app/devtools
1
0
Fork 0
mirror of https://github.com/immich-app/devtools.git synced 2026-09-30 13:23:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: outline deployment (#248)

Browse Source
This commit is contained in:
bo0tzz
2024-11-11 16:43:05 +01:00
committed by GitHub
parent fc144fecfa
commit 0fa1c5c641
17 changed files with 347 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/terragrunt.yaml
+1
View File
@@ -19,6 +19,7 @@ env:
tofu_version: '1.7.1'
tg_version: '0.58.12'
working_dir: 'deployment'
TERRAGRUNT_PARALLELISM: 1
jobs:
check:
deployment/modules/1password/account/k8s-secrets.tf
+43
View File
@@ -137,3 +137,46 @@ resource "onepassword_item" "grafana_oauth_client_secret" {
}
}
}
resource "random_password" "outline_secret_key" {
length = 40
special = false
}
resource "random_password" "outline_utils_secret" {
length = 40
special = false
}
resource "random_password" "outline_oauth_client_secret" {
length = 40
special = false
}
resource "onepassword_item" "outline_secret" {
vault = data.onepassword_vault.kubernetes.uuid
title = "outline-secret"
category = "secure_note"
section {
label = "Outline secret"
field {
label = "SECRET_KEY"
type = "CONCEALED"
value = random_password.outline_secret_key.result
}
field {
label = "UTILS_SECRET"
type = "CONCEALED"
value = random_password.outline_utils_secret.result
}
field {
label = "OIDC_CLIENT_SECRET"
type = "CONCEALED"
value = random_password.outline_oauth_client_secret.result
}
}
}
deployment/modules/cloudflare/account/1password.tf
+60
View File
@@ -60,3 +60,63 @@ resource "onepassword_item" "mich_cloudflare_r2_victoriametrics_backups_bucket"
}
}
}
resource "random_password" "outline_backups_restic_secret" {
length = 40
special = true
override_special = "!@#$%^&*()_+"
}
resource "onepassword_item" "mich_cloudflare_r2_outline_volsync_backup" {
vault = data.onepassword_vault.kubernetes.uuid
title = "mich-cloudflare-r2-outline-volsync-backup"
category = "secure_note"
section {
label = "Cloudflare R2 Bucket"
field {
label = "RESTIC_REPOSITORY"
type = "string"
value = "s3:https://${cloudflare_r2_bucket.outline_volsync_backups.account_id}.r2.cloudflarestorage.com/${cloudflare_r2_bucket.outline_volsync_backups.name}"
}
field {
label = "RESTIC_PASSWORD"
type = "CONCEALED"
value = random_password.outline_backups_restic_secret.result
}
field {
label = "AWS_ACCESS_KEY_ID"
type = "CONCEALED"
value = data.terraform_remote_state.api_keys_state.outputs.mich_cloudflare_r2_token_id
}
field {
label = "AWS_SECRET_ACCESS_KEY"
type = "CONCEALED"
value = sha256(data.terraform_remote_state.api_keys_state.outputs.mich_cloudflare_r2_token_value)
}
}
}
resource "onepassword_item" "mich_cloudflare_r2_outline_database_backups_bucket" {
vault = data.onepassword_vault.kubernetes.uuid
title = "mich-cloudflare-r2-outline-database-backup-bucket"
category = "secure_note"
section {
label = "Cloudflare R2 Bucket"
field {
label = "bucket_name"
type = "STRING"
value = cloudflare_r2_bucket.outline_database_backups.name
}
field {
label = "api_endpoint"
type = "STRING"
value = "https://${cloudflare_r2_bucket.outline_database_backups.account_id}.r2.cloudflarestorage.com"
}
}
}
deployment/modules/cloudflare/account/r2.tf
+12
View File
@@ -10,6 +10,18 @@ resource "cloudflare_r2_bucket" "victoriametrics_backups" {
location = "WEUR"
}
resource "cloudflare_r2_bucket" "outline_database_backups" {
account_id = var.cloudflare_account_id
name = "outline-database-backups"
location = "WEUR"
}
resource "cloudflare_r2_bucket" "outline_volsync_backups" {
account_id = var.cloudflare_account_id
name = "outline-volsync-backups"
location = "WEUR"
}
resource "cloudflare_r2_bucket" "static" {
account_id = var.cloudflare_account_id
name = "static"
kubernetes/apps/authentication/dexidp/app/helmrelease.yaml
+5
View File
@@ -105,6 +105,11 @@ spec:
redirectURIs:
- "https://monitoring.immich.cloud/login/generic_oauth"
- "https://monitoring.dev.immich.cloud/login/generic_oauth"
- id: outline
name: outline
secretEnv: OIDC_CLIENT_SECRET
redirectURIs:
- "https://outline.immich.cloud/auth/oidc.callback"
resources:
requests:
kubernetes/apps/authentication/dexidp/app/secrets.yaml
+8
View File
@@ -21,3 +21,11 @@ metadata:
namespace: authentication
spec:
itemPath: "vaults/Kubernetes/items/grafana-oauth-client-secret"
---
apiVersion: onepassword.com/v1
kind: OnePasswordItem
metadata:
name: outline-oauth
namespace: authentication
spec:
itemPath: "vaults/Kubernetes/items/outline-secret"
kubernetes/apps/tools/kustomization.yaml
+1
View File
@@ -7,3 +7,4 @@ resources:
- ./hedgedoc/ks.yaml
- ./discord-bot/ks.yaml
- ./containerssh/ks.yaml
- ./outline/ks.yaml
kubernetes/apps/tools/outline/app/backup.yaml
+9
View File
@@ -0,0 +1,9 @@
apiVersion: postgresql.cnpg.io/v1
kind: ScheduledBackup
metadata:
name: outline-db-daily-backup
namespace: tools
spec:
schedule: "0 17 * * *"
cluster:
name: outline-db
kubernetes/apps/tools/outline/app/database.yaml
+23
View File
@@ -0,0 +1,23 @@
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: outline-db
namespace: tools
spec:
storage:
size: 10Gi
storageClass: zfs
backup:
retentionPolicy: "14d"
barmanObjectStore:
destinationPath: s3://${bucket_name}
endpointURL: ${api_endpoint}
wal:
compression: bzip2
s3Credentials:
accessKeyId:
name: outline-database-backup-secret
key: AWS_ACCESS_KEY_ID
secretAccessKey:
name: outline-database-backup-secret
key: AWS_SECRET_ACCESS_KEY
kubernetes/apps/tools/outline/app/helmrelease.yaml
+93
View File
@@ -0,0 +1,93 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: outline
namespace: tools
spec:
interval: 30m
chart:
spec:
chart: app-template
version: 3.5.0
sourceRef:
kind: HelmRepository
name: bjw-s
namespace: flux-system
maxHistory: 2
install:
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
strategy: rollback
retries: 3
values:
controllers:
outline:
containers:
app:
image:
repository: docker.io/outlinewiki/outline
tag: 0.80.2@sha256:fde16562c9b8c67bc7855c71d8a1203125d63fcefc7ebb4e649de35a9281e6df
env:
#ref https://github.com/outline/outline/blob/d3c8224839f09fbff601e4a3e7fd8ff1a6b2ba08/.env.sample
URL: "https://outline.immich.cloud"
REDIS_URL: "redis://outline-valkey:6379"
ENABLE_UPDATES: false
FILE_STORAGE: local
FILE_STORAGE_LOCAL_ROOT_DIR: /data
FILE_STORAGE_UPLOAD_MAX_SIZE: "26214400"
FILE_STORAGE_IMPORT_MAX_SIZE: "26214400"
OIDC_CLIENT_ID: outline
OIDC_SCOPES: "openid profile email"
OIDC_AUTH_URI: "https://auth.immich.cloud/auth"
OIDC_TOKEN_URI: "https://auth.immich.cloud/token"
OIDC_USERINFO_URI: "https://auth.immich.cloud/userinfo"
WEB_CONCURRENCY: 10
DATABASE_URL:
valueFrom:
secretKeyRef:
name: outline-db-app
key: uri
envFrom:
- secretRef:
name: outline-secret
valkey:
containers:
app:
image:
repository: valkey/valkey
tag: 8.0.1
persistence:
data:
enabled: true
existingClaim: outline
service:
app:
controller: outline
ports:
http:
port: 3000
valkey:
controller: valkey
ports:
main:
port: 6379
ingress:
app:
className: nginx
annotations:
cert-manager.io/cluster-issuer: letsencrypt-production
hosts:
- host: &host "outline.immich.cloud"
paths:
- path: /
service:
identifier: app
port: http
tls:
- hosts:
- *host
secretName: outline-tls
kubernetes/apps/tools/outline/app/kustomization.yaml
+8
View File
@@ -0,0 +1,8 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./database.yaml
- ./backup.yaml
- ../../../../../templates/kubernetes/volsync
- ./helmrelease.yaml
kubernetes/apps/tools/outline/ks.yaml
+53
View File
@@ -0,0 +1,53 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app outline-secrets
namespace: flux-system
spec:
targetNamespace: tools
commonMetadata:
labels:
app.kubernetes.io/name: *app
dependsOn:
- name: cluster-apps-onepassword
path: ./kubernetes/apps/tools/outline/secrets
prune: true
sourceRef:
kind: GitRepository
name: immich-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 5m
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app outline
namespace: flux-system
spec:
targetNamespace: tools
commonMetadata:
labels:
app.kubernetes.io/name: *app
dependsOn:
- name: dexidp
- name: outline-secrets
path: ./kubernetes/apps/tools/outline/app
prune: true
sourceRef:
kind: GitRepository
name: immich-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 5m
postBuild:
substituteFrom:
- kind: Secret
name: outline-database-backup-bucket
substitute:
APP: *app
VOLSYNC_CAPACITY: 20Gi
VOLSYNC_SCHEDULE: "0 17 * * *"
VOLSYNC_REPO_SECRET: mich-cloudflare-r2-outline-volsync-backup
kubernetes/apps/tools/outline/secrets/db-backup-bucket.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: onepassword.com/v1
kind: OnePasswordItem
metadata:
name: outline-database-backup-bucket
namespace: flux-system
spec:
itemPath: "vaults/Kubernetes/items/mich-cloudflare-r2-outline-database-backup-bucket"
kubernetes/apps/tools/outline/secrets/db-backup-secret.yaml
+9
View File
@@ -0,0 +1,9 @@
apiVersion: onepassword.com/v1
kind: OnePasswordItem
metadata:
name: outline-database-backup-secret
namespace: tools
labels:
cnpg.io/reload: true
spec:
itemPath: "vaults/Kubernetes/items/mich-cloudflare-r2-token"
kubernetes/apps/tools/outline/secrets/kustomization.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./secret.yaml
- ./db-backup-secret.yaml
- ./db-backup-bucket.yaml
kubernetes/apps/tools/outline/secrets/secret.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: onepassword.com/v1
kind: OnePasswordItem
metadata:
name: outline-secret
namespace: tools
spec:
itemPath: "vaults/Kubernetes/items/outline-secret"
templates/kubernetes/volsync/replication/replicationsource.yaml
+1 -1
View File
@@ -7,7 +7,7 @@ metadata:
spec:
sourcePVC: "${VOLSYNC_CLAIM:-${APP}}"
trigger:
schedule: "0 4 * * *"
schedule: "${VOLSYNC_SCHEDULE:-0 4 * * *}"
restic:
copyMethod: Snapshot
repository: "${VOLSYNC_REPO_SECRET}"