docker-cache: first iteration

apps/docker-cache/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

apps/docker-cache/Chart.yaml

@@ -0,0 +1,7 @@
+apiVersion: v2
+name: ungleich-docker-cache
+description: A docker registry usable as a cache
+type: application
+
+version: 0.1.1
+appVersion: "2.7.1"

apps/docker-cache/README.md

@@ -0,0 +1,3 @@
+## Docker-Cache
+
+A cache for a certain registry

apps/docker-cache/nginx/default.conf

@@ -0,0 +1,17 @@
+server {
+    listen 443      ssl http2;
+    listen [::]:443 ssl http2;
+    server_name {{ tpl .Values.fqdn . }};
+
+    # Use Mozilla's guidelines for SSL/TLS settings
+    # https://mozilla.github.io/server-side-tls/ssl-config-generator/
+    ssl_certificate      /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem;
+    ssl_certificate_key  /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/privkey.pem;
+
+
+    client_max_body_size 1024m;
+
+    location / {
+        proxy_pass http://localhost:3000;
+    }
+}

apps/docker-cache/templates/deployment.yaml

@@ -0,0 +1,83 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-registry
+spec:
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}-registry
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}-registry
+        use-as-service: {{ .Release.Name }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/nginxconf.yaml") . | sha256sum }}
+    spec:
+      containers:
+        - name: nginx
+          image: ungleich/ungleich-certbot:0.3.2
+          ports:
+            - containerPort: 443
+              name: https
+            - containerPort: 80
+              name: http
+          env:
+            - name: DOMAIN
+              value: "{{ tpl .Values.fqdn . }}"
+            - name: EMAIL
+              value: "{{ .Values.email }}"
+            - name: NGINX
+              value: "yes"
+            {{ if eq .Values.letsencryptStaging "no" }}
+            - name: STAGING
+              value: "no"
+            {{ end }}
+          volumeMounts:
+            - name: nginx-config
+              mountPath: "/etc/nginx/conf.d/"
+            - name: etcletsencrypt
+              mountPath: "/etc/letsencrypt"
+        - name: registry
+          image: registry:{{ .Chart.AppVersion }}
+          ports:
+            - containerPort: 5000
+          # env:
+          #   - name: SYNAPSE_CONFIG_PATH
+          #     value: "/baseconfig/homeserver.yaml"
+          #   - name: SYNAPSE_CONFIG_DIR
+          #     value: "/config"
+
+          volumeMounts:
+            - name: data
+              mountPath: "/var/lib/registry"
+      volumes:
+        - name: etcletsencrypt
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}-letsencrypt-certs
+        - name: nginx-config
+          configMap:
+            name: {{ .Release.Name }}-nginx-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}-data
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    app: {{ .Release.Name }}
+spec:
+  type: ClusterIP
+  ports:
+   # Required for letsencrypt
+   - port: 80
+     name: http
+   - port: 443
+     name: https
+  selector:
+   use-as-service: {{ .Release.Name }}

apps/docker-cache/templates/nginxconf.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-nginx-config
+data:
+{{ tpl (.Files.Glob "nginx/*").AsConfig . | indent 2 }}

apps/docker-cache/templates/pvc.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}-letsencrypt-certs
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.storage.letsencrypt.size }}
+  storageClassName: {{ .Values.storage.letsencrypt.storageClass }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}-data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.storage.data.size }}
+  storageClassName: {{ .Values.storage.data.storageClass }}

apps/docker-cache/values.yaml

@@ -0,0 +1,14 @@
+clusterDomain: c2.k8s.ooo
+email: technik@ungleich.ch
+letsencryptStaging: "yes"
+fqdn: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}"
+
+registry: https://registry-1.docker.io!
+
+storage:
+  data:
+    size: 100Gi
+    storageClass: rook-ceph-block
+  letsencrypt:
+    size: 50Mi
+    storageClass: rook-ceph-block