This commit is contained in:
Nico Schottelius 2021-07-26 13:51:46 +02:00
parent a8bb931914
commit 730dfbf612
9 changed files with 296 additions and 0 deletions

2
apps/.gitignore vendored Normal file
View File

@ -0,0 +1,2 @@
# Ignore helm packages
*.tgz

23
apps/buildbot/.helmignore Normal file
View File

@ -0,0 +1,23 @@
# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*.orig
*~
# Various IDEs
.project
.idea/
*.tmproj
.vscode/

6
apps/buildbot/Chart.yaml Normal file
View File

@ -0,0 +1,6 @@
apiVersion: v2
name: ungleich-buildbot
description: buildbot for ungleich infrastructure
version: 0.1.0
appVersion: "3.2.0"

10
apps/buildbot/README.md Normal file
View File

@ -0,0 +1,10 @@
## Introduction
[Buildbot](https://buildbot.net/) running on IPv6.
## Todo
* DB
* TLS
* Workers (2+)
* Build configuration

View File

@ -0,0 +1,233 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ .Release.Name }}-gitea
spec:
selector:
matchLabels:
app: {{ .Release.Name }}-gitea
replicas: 1
template:
metadata:
labels:
app: {{ .Release.Name }}-gitea
use-as-service: {{ .Release.Name }}
spec:
initContainers:
- name: wait-for-cert
image: busybox
command:
- sh
- -c
- until ls /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem; do sleep 5; done
volumeMounts:
- name: etcletsencrypt
mountPath: "/etc/letsencrypt"
containers:
# This container will only start *after* the cert has been placed
- name: nginx
image: nginx:1.21-alpine
ports:
- containerPort: 443
volumeMounts:
- name: nginx-config
mountPath: "/etc/nginx/conf.d/"
- name: etcletsencrypt
mountPath: "/etc/letsencrypt"
- name: postgres
image: postgres:13
ports:
- containerPort: 5432
envFrom:
- configMapRef:
name: {{ tpl .Values.identifier . }}-postgres-config
# Use subpath to avoid lost+found error
volumeMounts:
- name: postgres-data
mountPath: "/var/lib/postgresql/data"
subPath: postgres
- name: gitea
image: gitea/gitea:{{ .Chart.AppVersion }}
ports:
- containerPort: 22
- containerPort: 3000
securityContext:
capabilities:
add:
- SYS_CHROOT
env:
- name: USER_UID
value: "1000"
- name: USER_GID
value: "1000"
- name: GITEA__server__DOMAIN
value: "{{ tpl .Values.fqdn . }}"
- name: GITEA__server__ROOT_URL
value: "https://{{ tpl .Values.fqdn . }}"
- name: GITEA__database__DB_TYPE
value: "postgres"
- name: GITEA__database__HOST
value: "localhost"
- name: GITEA__database__NAME
valueFrom:
configMapKeyRef:
name: {{ tpl .Values.identifier . }}-postgres-config
key: POSTGRES_DB
- name: GITEA__database__USER
valueFrom:
configMapKeyRef:
name: {{ tpl .Values.identifier . }}-postgres-config
key: POSTGRES_USER
- name: GITEA__database__PASSWD
valueFrom:
configMapKeyRef:
name: {{ tpl .Values.identifier . }}-postgres-config
key: POSTGRES_PASSWORD
volumeMounts:
- name: etcletsencrypt
mountPath: "/etc/letsencrypt"
- name: data
mountPath: "/data"
volumes:
- name: etcletsencrypt
persistentVolumeClaim:
claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs
- name: data
persistentVolumeClaim:
claimName: {{ tpl .Values.identifier . }}-data
- name: postgres-data
persistentVolumeClaim:
claimName: {{ tpl .Values.identifier . }}-postgres-data
- name: nginx-config
configMap:
name: {{ tpl .Values.identifier . }}-nginx-config
---
apiVersion: v1
kind: Service
metadata:
name: {{ tpl .Values.identifier . }}
labels:
app: {{ tpl .Values.identifier . }}
spec:
type: ClusterIP
ports:
- port: 22
name: ssh
# Required for letsencrypt
- port: 80
name: http
- port: 443
name: https
selector:
use-as-service: {{ .Release.Name }}
# ---
# apiVersion: v1
# kind: ConfigMap
# metadata:
# name: {{ tpl .Values.identifier . }}-giteaconfig
# data:
# {{ tpl (.Files.Glob "gitea/*").AsConfig . | indent 2 }}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ tpl .Values.identifier . }}-letsencrypt-certs
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 50Mi
storageClassName: rook-cephfs
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ tpl .Values.identifier . }}-data
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 1Gi
storageClassName: rook-cephfs
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ tpl .Values.identifier . }}-postgres-data
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 500Mi
storageClassName: rook-ceph-block
---
apiVersion: batch/v1
kind: Job
metadata:
name: {{ tpl .Values.identifier . }}-getcert
spec:
template:
metadata:
labels:
app: certbot-letsencrypt-getcert
use-as-service: {{ .Release.Name }}
spec:
restartPolicy: Never
containers:
- name: certbot
image: ungleich/ungleich-certbot
ports:
- containerPort: 80
env:
- name: DOMAIN
value: "{{ tpl .Values.fqdn . }}"
- name: EMAIL
value: "{{ .Values.email }}"
{{ if eq .Values.letsencryptStaging "no" }}
- name: STAGING
value: "no"
{{ end }}
volumeMounts:
- name: etcletsencrypt
mountPath: "/etc/letsencrypt"
volumes:
- name: etcletsencrypt
persistentVolumeClaim:
claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs
backoffLimit: 3
---
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ tpl .Values.identifier . }}-nginx-config
data:
default.conf: |
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name {{ tpl .Values.fqdn . }};
ssl_certificate /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/privkey.pem;
client_max_body_size 256m;
location / {
proxy_pass http://localhost:3000;
}
}
---
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ tpl .Values.identifier . }}-postgres-config
data:
POSTGRES_USER: gitea
POSTGRES_PASSWORD: aiJohtoqueeng0oosh8ohfoh1chahPh3
POSTGRES_DB: gitea

View File

@ -0,0 +1,13 @@
apiVersion: v1
kind: Pod
metadata:
name: "{{ tpl .Values.identifier . }}-test-connection"
annotations:
"helm.sh/hook": test
spec:
containers:
- name: wget
image: busybox
command: ['wget']
args: ['https://{{ tpl .Values.fqdn . }}']
restartPolicy: Never

View File

@ -0,0 +1,8 @@
clusterDomain: c2.k8s.ooo
email: technik@ungleich.ch
letsencryptStaging: "yes"
# This is how the service and the data volumes are named - i.e. the
# persistent thing
identifier: "{{ .Release.Name }}"
fqdn: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}"

View File

@ -84,6 +84,7 @@ spec:
- port: 80
name: http
- port: 443
targetPort: 8080
name: https
selector:
use-as-service: {{ .Release.Name }}