config changes

apps/cloud/affine.yaml

@@ -0,0 +1,129 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: affine
+  namespace: cloud
+  labels:
+    app: affine
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: affine
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: affine
+    spec:
+      containers:
+        - name: affine
+          image: ghcr.io/toeverything/affine:stable
+          imagePullPolicy: Always
+          command:
+            [
+              "sh",
+              "-c",
+              "node ./scripts/self-host-predeploy.js && node ./dist/main.js",
+            ]
+          env:
+            - name: AFFINE_CONFIG_PATH
+              value: "/root/.affine/config"
+            - name: AFFINE_SERVER_EXTERNAL_URL
+              value: "http://affine.haven"
+            - name: AFFINE_SERVER_HOST
+              value: "0.0.0.0"
+            - name: AFFINE_SERVER_PORT
+              value: "3010"
+            - name: AFFINE_SERVER_HTTPS
+              value: "false"
+            - name: AFFINE_SERVER_SUBPATH
+              value: "/"
+            - name: AFFINE_ENABLE_SYNC_FROM_STARTUP
+              value: "true"
+            - name: DATABASE_URL
+              value: "postgres://affine:affine@postgresql.haven:5432/affine"
+            - name: REDIS_SERVER_HOST
+              value: "redis.haven"
+            - name: REDIS_SERVER_PORT
+              value: "6379"
+          ports:
+            - containerPort: 3010
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 3010
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            failureThreshold: 6
+          resources:
+            requests:
+              cpu: 200m
+              memory: 512Mi
+            limits:
+              cpu: 2000m
+              memory: 2Gi
+          volumeMounts:
+            - name: config
+              mountPath: /root/.affine/config
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: affine-config
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: affine
+  namespace: cloud
+  labels:
+    app: affine
+spec:
+  type: ClusterIP
+  selector:
+    app: affine
+  ports:
+    - name: http
+      port: 3010
+      protocol: TCP
+      targetPort: http
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: affine-config
+  namespace: cloud
+  annotations:
+    nfs.io/storage-path: "affine-config"
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: affine
+  namespace: cloud
+  labels:
+    app: affine
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: affine.haven
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: affine
+                port:
+                  number: 3010

apps/cloud/cloudreve.yaml

@@ -0,0 +1,172 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cloudreve
+  namespace: cloud
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: cloudreve
+  template:
+    metadata:
+      labels:
+        app: cloudreve
+    spec:
+      containers:
+        - name: cloudreve
+          image: cloudreve/cloudreve:v4
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 5212
+              name: http
+            - containerPort: 6888
+              name: slave-tcp
+              protocol: TCP
+            - containerPort: 6888
+              name: slave-udp
+              protocol: UDP
+          env:
+            - name: CR_CONF_Database.Type
+              value: "postgres"
+            - name: CR_CONF_Database.Host
+              value: "postgresql.haven"
+            - name: CR_CONF_Database.Port
+              value: "5432"
+            - name: CR_CONF_Database.User
+              valueFrom:
+                secretKeyRef:
+                  name: cloudreve-secret
+                  key: DB_USER
+            - name: CR_CONF_Database.Name
+              valueFrom:
+                secretKeyRef:
+                  name: cloudreve-secret
+                  key: DB_NAME
+            - name: CR_CONF_Database.Password
+              valueFrom:
+                secretKeyRef:
+                  name: cloudreve-secret
+                  key: DB_PASSWORD
+            - name: CR_CONF_Database.SSLMode
+              value: "disable"
+            - name: CR_CONF_Redis.Server
+              value: ""
+            - name: CR_CONF_Redis.Password
+              valueFrom:
+                secretKeyRef:
+                  name: cloudreve-secret
+                  key: REDIS_PASSWORD
+          volumeMounts:
+            - name: cloudreve-data
+              mountPath: /cloudreve/data
+          resources:
+            requests:
+              cpu: "250m"
+              memory: "256Mi"
+            limits:
+              cpu: "1000m"
+              memory: "1Gi"
+      volumes:
+        - name: cloudreve-data
+          nfs:
+            server: 192.168.15.99
+            path: /export/Storage/Cloud
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: cloudreve
+  namespace: cloud
+spec:
+  type: ClusterIP
+  selector:
+    app: cloudreve
+  ports:
+    - port: 5212
+      targetPort: 5212
+      name: http
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: cloudreve-slave
+  namespace: cloud
+spec:
+  type: ClusterIP
+  selector:
+    app: cloudreve
+  ports:
+    - port: 6888
+      targetPort: 6888
+      name: slave-tcp
+      protocol: TCP
+    - port: 6888
+      targetPort: 6888
+      name: slave-udp
+      protocol: UDP
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: cloudreve-data
+  namespace: cloud
+  annotations:
+    nfs.io/storage-path: "cloudreve-data"
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+    limits:
+      storage: 50Gi
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cloudreve
+  namespace: cloud
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: cloud.haven
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: cloudreve
+                port:
+                  number: 5212
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cloudreve-public
+  namespace: cloud
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: cloud.ivanch.me
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: cloudreve
+                port:
+                  number: 5212

apps/cloud/slink.yaml

@@ -0,0 +1,136 @@
+# 1) Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: slink
+  namespace: cloud
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: slink
+  template:
+    metadata:
+      labels:
+        app: slink
+    spec:
+      containers:
+        - name: slink
+          image: anirdev/slink:latest
+          imagePullPolicy: Always
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: ORIGIN
+              value: "http://slink.haven"
+            - name: TZ
+              value: "America/Sao_Paulo"
+            - name: USER_APPROVAL_REQUIRED
+              value: "true"
+            - name: USER_PASSWORD_MIN_LENGTH
+              value: "8"
+            - name: USER_PASSWORD_REQUIREMENTS
+              value: "15"
+            - name: ADMIN_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: slink-secret
+                  key: ADMIN_USERNAME
+            - name: ADMIN_EMAIL
+              valueFrom:
+                secretKeyRef:
+                  name: slink-secret
+                  key: ADMIN_EMAIL
+            - name: ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: slink-secret
+                  key: ADMIN_PASSWORD
+            - name: IMAGE_MAX_SIZE
+              value: "50M"
+            - name: IMAGE_STRIP_EXIF_METADATA
+              value: "true"
+            - name: IMAGE_COMPRESSION_QUALITY
+              value: "90"
+            - name: STORAGE_PROVIDER
+              value: "local"
+          ports:
+            - containerPort: 3000
+              name: slink-port
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "64Mi"
+            limits:
+              cpu: "500m"
+              memory: "512Mi"
+          volumeMounts:
+            - name: slink-data
+              mountPath: /app/var/data
+            - name: slink-data
+              mountPath: /app/slink/images
+      volumes:
+        - name: slink-data
+          persistentVolumeClaim:
+            claimName: slink-data
+---
+# 2) Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: slink
+  namespace: cloud
+spec:
+  type: ClusterIP
+  selector:
+    app: slink
+  ports:
+    - port: 3000
+      targetPort: slink-port
+---
+# 3) PersistentVolumeClaim
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: slink-data
+  namespace: cloud
+  annotations:
+    nfs.io/storage-path: "slink-data"
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 5Gi
+    limits:
+      storage: 15Gi
+---
+# 4) Ingress
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: slink
+  namespace: cloud
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: slink.haven
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: slink
+                port:
+                  number: 3000

apps/root/applicationset.yaml

@@ -11,14 +11,11 @@ spec:
         repoURL: https://git.ivanch.me/ivanch/haven-ops.git
         revision: main
         files:
-          # one Application per <app>.yaml under apps/<ns>/
           - path: "apps/*/*.yaml"
-          # never generate apps for the bootstrap/root manifests themselves
           - path: "apps/root/*.yaml"
             exclude: true
   template:
     metadata:
-      # apps/default/notepad.yaml -> Application "notepad"
       name: '{{ .path.filename | trimSuffix ".yaml" }}'
       namespace: argocd
       finalizers:
@@ -28,13 +25,12 @@ spec:
       source:
         repoURL: https://git.ivanch.me/ivanch/haven-ops.git
         targetRevision: main
-        # in the git files generator .path.path IS the containing directory
-        path: '{{ .path.path }}'
+        path: "{{ .path.path }}"
         directory:
-          include: '{{ .path.filename }}'
+          include: "{{ .path.filename }}"
       destination:
         server: https://kubernetes.default.svc
-        namespace: '{{ index .path.segments 1 }}'
+        namespace: "{{ index .path.segments 1 }}"
       syncPolicy:
         automated:
           prune: true

bootstrap/argocd-install/kustomization.yaml

@@ -4,14 +4,8 @@ kind: Kustomization
 namespace: argocd
 
 resources:
-  # cluster-install already includes ALL CRDs (applications, appprojects,
-  # applicationsets). Do NOT also add manifests/crds — kustomize fails with
-  # "may not add resource with an already registered id".
   - https://github.com/argoproj/argo-cd.git/manifests/cluster-install?ref=stable
   - ingress.yaml
 
-# Serve plain HTTP behind the nginx ingress (TLS terminates at nothing —
-# internal-only app convention). Applied live via kubectl patch on first
-# install; this file keeps git as the source of truth.
 patches:
   - path: server-insecure-patch.yaml