feat: deploy ConvertX

apps/convertx/certificate.yaml

@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: convert-home-lan
+  namespace: convertx
+spec:
+  secretName: convert-home-lan-tls
+  dnsNames:
+    - convert.home.lan
+  issuerRef:
+    name: home-lab-ca
+    kind: ClusterIssuer

apps/convertx/deployment.yaml

@@ -0,0 +1,93 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: convertx
+  namespace: convertx
+  labels:
+    app.kubernetes.io/name: convertx
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: convertx
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: convertx
+    spec:
+      terminationGracePeriodSeconds: 60
+      containers:
+        - name: convertx
+          image: ghcr.io/c4illin/convertx:v0.18.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+          env:
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: convertx-secret
+                  key: JWT_SECRET
+            - name: ACCOUNT_REGISTRATION
+              value: "false"
+            - name: ALLOW_UNAUTHENTICATED
+              value: "false"
+            - name: AUTO_DELETE_EVERY_N_HOURS
+              value: "24"
+            - name: HIDE_HISTORY
+              value: "false"
+            - name: LANGUAGE
+              value: en-US
+            - name: MAX_CONVERT_PROCESS
+              value: "2"
+            - name: TZ
+              value: America/Indiana/Indianapolis
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+              ephemeral-storage: 1Gi
+            limits:
+              cpu: "4"
+              memory: 4Gi
+              ephemeral-storage: 10Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          startupProbe:
+            httpGet:
+              path: /
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 30
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 6
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 5
+          volumeMounts:
+            - name: data
+              mountPath: /app/data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: convertx-data

apps/convertx/ingress.yaml

@@ -0,0 +1,33 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: convertx
+  namespace: convertx
+  labels:
+    app.kubernetes.io/name: convertx
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: convert.home.lan
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/proxy-body-size: 5g
+    nginx.ingress.kubernetes.io/proxy-buffering: "off"
+    nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - convert.home.lan
+      secretName: convert-home-lan-tls
+  rules:
+    - host: convert.home.lan
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: convertx
+                port:
+                  name: http

apps/convertx/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - sealed-secret.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - certificate.yaml
+  - ingress.yaml
+  - networkpolicy.yaml

apps/convertx/namespace.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: convertx
+  labels:
+    app.kubernetes.io/name: convertx
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/audit: baseline
+    pod-security.kubernetes.io/warn: baseline

apps/convertx/networkpolicy.yaml

@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: convertx-ingress
+  namespace: convertx
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: convertx
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: ingress-nginx
+      ports:
+        - protocol: TCP
+          port: 3000

apps/convertx/pvc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: convertx-data
+  namespace: convertx
+  labels:
+    app.kubernetes.io/name: convertx
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 30Gi

apps/convertx/sealed-secret.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: convertx-secret
+  namespace: convertx
+spec:
+  encryptedData:
+    JWT_SECRET: AgBptlSzQ4WeohEDePGHohCwDOq77Y1j84uASpjoB5EjZozYNatCJWOdwZMdMTnF4W6Y0jvn35uiXhA1PgGX9uV99+V2LHBfeE2StwDLx+UY45qBDe3K8hXZWeT/OSfyxIewka4KnysHNs29Z33weTlQufOfY+hioyZxo3r68NcpeexKkdlvg9EnVdxAAY1zx0y8Ps7Lw9gorN2QESHTHBz8dN3R7iq4xTgNZR16ZIx7T3+HITdp1GxPLwtYvR24HV9LKk76xR4rc8V57kHSSYwZkusOcHW5e2kK2T5MiqT6PaGDlf1gq+aFDxbarfiNn963W7UtVKxT8c63s5qYuk9wAut3hs7GJgFwBdOs8tip8QSr7iH9wQ+0t5x17hw/ESxWzAj1E10OxE387S0NnO1t61iU4tWEiir5nq0m3CiCmI2D/FvdiU0thECqRnSWLsfcRqmKuZuUmrVAYPNZv+frfd4WLtDjry3W7BMdveJrDYPNsjaCKZwUzk31Lbp2NRAQPj4FN3DF4gErBJWiqYcCVDLHEWTiTCms6w+6b5SPYjhtQKl16GEr4nDIszeIiK5KE1LUYwaKe8K43PwmSMaE2MeqFKJydCqtxl7tkV7FX4iDRYAK+enkvPNN/esywESmDk2pjF6SbEMBKugm2MxWegn84LKkHOq+w43qvcZCL9yYGeUN39yxuxI0gENP4kuQ3kdGIT/J1e2rrnRSRPN98X5eKWw0tOgfnQFuD3yucuU/kHDvUb2/xup205WgSnQ8S01zYZ4Kb2cM4jjV95S3zDRrWh3V/jmHgQIFJYnDd4dMGmyVFjcb
+  template:
+    metadata:
+      name: convertx-secret
+      namespace: convertx

apps/convertx/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: convertx
+  namespace: convertx
+  labels:
+    app.kubernetes.io/name: convertx
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: convertx
+  ports:
+    - name: http
+      port: 3000
+      targetPort: http
+      protocol: TCP

argocd/convertx-application.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: convertx
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://git.phillips-home.net/jay/k8s-gitops.git
+    targetRevision: main
+    path: apps/convertx
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: convertx
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - PruneLast=true
+      - ServerSideApply=true