diff --git a/apps/convertx/certificate.yaml b/apps/convertx/certificate.yaml new file mode 100644 index 0000000..f8e0cbc --- /dev/null +++ b/apps/convertx/certificate.yaml @@ -0,0 +1,12 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: convert-home-lan + namespace: convertx +spec: + secretName: convert-home-lan-tls + dnsNames: + - convert.home.lan + issuerRef: + name: home-lab-ca + kind: ClusterIssuer diff --git a/apps/convertx/deployment.yaml b/apps/convertx/deployment.yaml new file mode 100644 index 0000000..6e0de55 --- /dev/null +++ b/apps/convertx/deployment.yaml @@ -0,0 +1,93 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: convertx + namespace: convertx + labels: + app.kubernetes.io/name: convertx +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app.kubernetes.io/name: convertx + template: + metadata: + labels: + app.kubernetes.io/name: convertx + spec: + terminationGracePeriodSeconds: 60 + containers: + - name: convertx + image: ghcr.io/c4illin/convertx:v0.18.0 + imagePullPolicy: IfNotPresent + ports: + - name: http + containerPort: 3000 + protocol: TCP + env: + - name: JWT_SECRET + valueFrom: + secretKeyRef: + name: convertx-secret + key: JWT_SECRET + - name: ACCOUNT_REGISTRATION + value: "false" + - name: ALLOW_UNAUTHENTICATED + value: "false" + - name: AUTO_DELETE_EVERY_N_HOURS + value: "24" + - name: HIDE_HISTORY + value: "false" + - name: LANGUAGE + value: en-US + - name: MAX_CONVERT_PROCESS + value: "2" + - name: TZ + value: America/Indiana/Indianapolis + resources: + requests: + cpu: 250m + memory: 512Mi + ephemeral-storage: 1Gi + limits: + cpu: "4" + memory: 4Gi + ephemeral-storage: 10Gi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + startupProbe: + httpGet: + path: / + port: http + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 30 + readinessProbe: + httpGet: + path: / + port: http + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + livenessProbe: + httpGet: + path: / + port: http + initialDelaySeconds: 60 + periodSeconds: 30 + timeoutSeconds: 5 + failureThreshold: 5 + volumeMounts: + - name: data + mountPath: /app/data + volumes: + - name: data + persistentVolumeClaim: + claimName: convertx-data diff --git a/apps/convertx/ingress.yaml b/apps/convertx/ingress.yaml new file mode 100644 index 0000000..923378d --- /dev/null +++ b/apps/convertx/ingress.yaml @@ -0,0 +1,33 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: convertx + namespace: convertx + labels: + app.kubernetes.io/name: convertx + annotations: + external-dns.alpha.kubernetes.io/hostname: convert.home.lan + nginx.ingress.kubernetes.io/backend-protocol: HTTP + nginx.ingress.kubernetes.io/proxy-body-size: 5g + nginx.ingress.kubernetes.io/proxy-buffering: "off" + nginx.ingress.kubernetes.io/proxy-request-buffering: "off" + nginx.ingress.kubernetes.io/proxy-read-timeout: "3600" + nginx.ingress.kubernetes.io/proxy-send-timeout: "3600" + nginx.ingress.kubernetes.io/ssl-redirect: "true" +spec: + ingressClassName: nginx + tls: + - hosts: + - convert.home.lan + secretName: convert-home-lan-tls + rules: + - host: convert.home.lan + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: convertx + port: + name: http diff --git a/apps/convertx/kustomization.yaml b/apps/convertx/kustomization.yaml new file mode 100644 index 0000000..71788b7 --- /dev/null +++ b/apps/convertx/kustomization.yaml @@ -0,0 +1,11 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - sealed-secret.yaml + - pvc.yaml + - deployment.yaml + - service.yaml + - certificate.yaml + - ingress.yaml + - networkpolicy.yaml diff --git a/apps/convertx/namespace.yaml b/apps/convertx/namespace.yaml new file mode 100644 index 0000000..2366c0b --- /dev/null +++ b/apps/convertx/namespace.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: convertx + labels: + app.kubernetes.io/name: convertx + pod-security.kubernetes.io/enforce: baseline + pod-security.kubernetes.io/audit: baseline + pod-security.kubernetes.io/warn: baseline diff --git a/apps/convertx/networkpolicy.yaml b/apps/convertx/networkpolicy.yaml new file mode 100644 index 0000000..90bff1d --- /dev/null +++ b/apps/convertx/networkpolicy.yaml @@ -0,0 +1,19 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: convertx-ingress + namespace: convertx +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: convertx + policyTypes: + - Ingress + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: ingress-nginx + ports: + - protocol: TCP + port: 3000 diff --git a/apps/convertx/pvc.yaml b/apps/convertx/pvc.yaml new file mode 100644 index 0000000..82d1e92 --- /dev/null +++ b/apps/convertx/pvc.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: convertx-data + namespace: convertx + labels: + app.kubernetes.io/name: convertx +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 30Gi diff --git a/apps/convertx/sealed-secret.yaml b/apps/convertx/sealed-secret.yaml new file mode 100644 index 0000000..dfe530b --- /dev/null +++ b/apps/convertx/sealed-secret.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: convertx-secret + namespace: convertx +spec: + encryptedData: + JWT_SECRET: AgBptlSzQ4WeohEDePGHohCwDOq77Y1j84uASpjoB5EjZozYNatCJWOdwZMdMTnF4W6Y0jvn35uiXhA1PgGX9uV99+V2LHBfeE2StwDLx+UY45qBDe3K8hXZWeT/OSfyxIewka4KnysHNs29Z33weTlQufOfY+hioyZxo3r68NcpeexKkdlvg9EnVdxAAY1zx0y8Ps7Lw9gorN2QESHTHBz8dN3R7iq4xTgNZR16ZIx7T3+HITdp1GxPLwtYvR24HV9LKk76xR4rc8V57kHSSYwZkusOcHW5e2kK2T5MiqT6PaGDlf1gq+aFDxbarfiNn963W7UtVKxT8c63s5qYuk9wAut3hs7GJgFwBdOs8tip8QSr7iH9wQ+0t5x17hw/ESxWzAj1E10OxE387S0NnO1t61iU4tWEiir5nq0m3CiCmI2D/FvdiU0thECqRnSWLsfcRqmKuZuUmrVAYPNZv+frfd4WLtDjry3W7BMdveJrDYPNsjaCKZwUzk31Lbp2NRAQPj4FN3DF4gErBJWiqYcCVDLHEWTiTCms6w+6b5SPYjhtQKl16GEr4nDIszeIiK5KE1LUYwaKe8K43PwmSMaE2MeqFKJydCqtxl7tkV7FX4iDRYAK+enkvPNN/esywESmDk2pjF6SbEMBKugm2MxWegn84LKkHOq+w43qvcZCL9yYGeUN39yxuxI0gENP4kuQ3kdGIT/J1e2rrnRSRPN98X5eKWw0tOgfnQFuD3yucuU/kHDvUb2/xup205WgSnQ8S01zYZ4Kb2cM4jjV95S3zDRrWh3V/jmHgQIFJYnDd4dMGmyVFjcb + template: + metadata: + name: convertx-secret + namespace: convertx diff --git a/apps/convertx/service.yaml b/apps/convertx/service.yaml new file mode 100644 index 0000000..0bed02e --- /dev/null +++ b/apps/convertx/service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: convertx + namespace: convertx + labels: + app.kubernetes.io/name: convertx +spec: + type: ClusterIP + selector: + app.kubernetes.io/name: convertx + ports: + - name: http + port: 3000 + targetPort: http + protocol: TCP diff --git a/argocd/convertx-application.yaml b/argocd/convertx-application.yaml new file mode 100644 index 0000000..5c158d3 --- /dev/null +++ b/argocd/convertx-application.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: convertx + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: https://git.phillips-home.net/jay/k8s-gitops.git + targetRevision: main + path: apps/convertx + destination: + server: https://kubernetes.default.svc + namespace: convertx + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - PruneLast=true + - ServerSideApply=true