adding small nginx server

cloud/affine.yaml

@@ -0,0 +1,130 @@
+---
+# ============ AFFiNE app ============
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: affine
+  namespace: cloud
+  labels:
+    app: affine
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: affine
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: affine
+    spec:
+      containers:
+        - name: affine
+          image: ghcr.io/toeverything/affine:stable
+          imagePullPolicy: Always
+          command:
+            [
+              "sh",
+              "-c",
+              "node ./scripts/self-host-predeploy.js && node ./dist/main.js",
+            ]
+          env:
+            - name: AFFINE_CONFIG_PATH
+              value: "/root/.affine/config"
+            - name: AFFINE_SERVER_EXTERNAL_URL
+              value: "http://affine.haven"
+            - name: AFFINE_SERVER_HOST
+              value: "0.0.0.0"
+            - name: AFFINE_SERVER_PORT
+              value: "3010"
+            - name: AFFINE_SERVER_HTTPS
+              value: "false"
+            - name: AFFINE_SERVER_SUBPATH
+              value: "/"
+            - name: AFFINE_ENABLE_SYNC_FROM_STARTUP
+              value: "true"
+            - name: DATABASE_URL
+              value: "postgres://affine:affine@postgresql.haven:5432/affine"
+            - name: REDIS_SERVER_HOST
+              value: "redis.haven"
+            - name: REDIS_SERVER_PORT
+              value: "6379"
+          ports:
+            - containerPort: 3010
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 3010
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            failureThreshold: 6
+          resources:
+            requests:
+              cpu: 200m
+              memory: 512Mi
+            limits:
+              cpu: 2000m
+              memory: 2Gi
+          volumeMounts:
+            - name: config
+              mountPath: /root/.affine/config
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: affine-config
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: affine
+  namespace: cloud
+  labels:
+    app: affine
+spec:
+  type: ClusterIP
+  selector:
+    app: affine
+  ports:
+    - name: http
+      port: 3010
+      protocol: TCP
+      targetPort: http
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: affine-config
+  namespace: cloud
+  annotations:
+    nfs.io/storage-path: "affine-config"
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: affine
+  namespace: cloud
+  labels:
+    app: affine
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: affine.haven
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: affine
+                port:
+                  number: 3010

default/changedetection.yaml

@@ -0,0 +1,157 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: changedetection
+  namespace: default
+  labels:
+    app.kubernetes.io/name: changedetection
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: changedetection
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: changedetection
+    spec:
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/hostname
+                    operator: In
+                    values:
+                      - iris
+      containers:
+        - name: changedetection
+          image: lscr.io/linuxserver/changedetection.io:latest
+          imagePullPolicy: Always
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: TZ
+              value: "Etc/UTC"
+            - name: BASE_URL
+              value: "http://change.haven/"
+            - name: PLAYWRIGHT_DRIVER_URL
+              value: "ws://localhost:3000"
+          ports:
+            - containerPort: 5000
+              name: http
+              protocol: TCP
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 2000m
+              memory: 1Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsUser: 0
+          volumeMounts:
+            - name: config
+              mountPath: /config
+        - name: browser-sockpuppet-chrome
+          image: dgtlmoon/sockpuppetbrowser:latest
+          imagePullPolicy: Always
+          env:
+            - name: SCREEN_WIDTH
+              value: "1920"
+            - name: SCREEN_HEIGHT
+              value: "1024"
+            - name: SCREEN_DEPTH
+              value: "16"
+            - name: MAX_CONCURRENT_CHROME_PROCESSES
+              value: "10"
+          ports:
+            - containerPort: 3000
+              name: ws
+              protocol: TCP
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 2000m
+              memory: 4Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              add:
+                - SYS_ADMIN
+              drop:
+                - ALL
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: changedetection-config
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 30
+---
+# 2) Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: changedetection
+  namespace: default
+  labels:
+    app.kubernetes.io/name: changedetection
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: changedetection
+  ports:
+    - name: http
+      port: 5000
+      protocol: TCP
+      targetPort: http
+---
+# 3) PersistentVolumeClaim
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: changedetection-config
+  namespace: default
+  annotations:
+    nfs.io/storage-path: "changedetection-config"
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+    limits:
+      storage: 2Gi
+---
+# 4) Ingress
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: changedetection
+  namespace: default
+  labels:
+    app.kubernetes.io/name: changedetection
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: change.haven
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: changedetection
+                port:
+                  number: 5000

default/homepage.yaml

@@ -113,7 +113,7 @@ spec:
           imagePullPolicy: Always
           env:
             - name: HOMEPAGE_ALLOWED_HOSTS
-              value: homepage.haven # required, may need port. See gethomepage.dev/installation/#homepage_allowed_hosts
+              value: "*"
           ports:
             - name: http
               containerPort: 3000

default/stirling-pdf.yaml

@@ -0,0 +1,113 @@
+---
+# 1) Deployment - Stirling-PDF
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: stirlingpdf
+  namespace: default
+  labels:
+    app: stirlingpdf
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: stirlingpdf
+  template:
+    metadata:
+      labels:
+        app: stirlingpdf
+    spec:
+      containers:
+        - name: stirlingpdf
+          image: stirlingtools/stirling-pdf:latest
+          imagePullPolicy: Always
+          env:
+            - name: TZ
+              value: "America/Sao_Paulo"
+            - name: DOCKER_ENABLE_SECURITY
+              value: "false"
+            - name: SECURITY_ENABLELOGIN
+              value: "false"
+          ports:
+            - containerPort: 8080
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 8080
+            initialDelaySeconds: 20
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 100m
+              memory: 1Gi
+            limits:
+              cpu: 2000m
+              memory: 2Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsUser: 0
+          volumeMounts:
+            - name: config
+              mountPath: /configs
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: stirlingpdf-config
+      terminationGracePeriodSeconds: 30
+---
+# 2) Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: stirlingpdf
+  namespace: default
+  labels:
+    app: stirlingpdf
+spec:
+  type: ClusterIP
+  selector:
+    app: stirlingpdf
+  ports:
+    - name: http
+      port: 8080
+      protocol: TCP
+      targetPort: http
+---
+# 3) PersistentVolumeClaim
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: stirlingpdf-config
+  namespace: default
+  annotations:
+    nfs.io/storage-path: "stirlingpdf-config"
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+---
+# 4) Ingress
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: stirlingpdf
+  namespace: default
+  labels:
+    app: stirlingpdf
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: stirling.haven
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: stirlingpdf
+                port:
+                  number: 8080

infra/file-nginx.yaml

@@ -0,0 +1,129 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: file-nginx
+  namespace: infra
+  labels:
+    app: file-nginx
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+  selector:
+    matchLabels:
+      app: file-nginx
+  template:
+    metadata:
+      labels:
+        app: file-nginx
+    spec:
+      containers:
+        - name: nginx
+          image: nginx:alpine
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 80
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsUser: 0
+          volumeMounts:
+            - name: html
+              mountPath: /usr/share/nginx/data
+            - name: nginx-conf
+              mountPath: /etc/nginx/conf.d/default.conf
+              subPath: default.conf
+          startupProbe:
+            httpGet:
+              path: /
+              port: 80
+            failureThreshold: 30
+            periodSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+      volumes:
+        - name: html
+          nfs:
+            server: vega.haven
+            path: /export/Fast
+        - name: nginx-conf
+          configMap:
+            name: file-nginx-conf
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: file-nginx-conf
+  namespace: infra
+data:
+  default.conf: |
+    server {
+        listen       80;
+        listen  [::]:80;
+        server_name  _;
+
+        root   /usr/share/nginx/data/file-nginx;
+        index  index.html;
+
+        autoindex on;
+
+        location / {
+            try_files $uri $uri/ =404;
+        }
+    }
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: file-nginx
+  namespace: infra
+spec:
+  selector:
+    app: file-nginx
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 80
+
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: file-nginx
+  namespace: infra
+  annotations:
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/cors-allow-origin: "*"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: file-nginx.haven
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: file-nginx
+                port:
+                  number: 80

infra/wg-easy.yaml

@@ -33,13 +33,13 @@ spec:
       affinity:
         nodeAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              preference:
+            - preference:
                 matchExpressions:
                   - key: kubernetes.io/hostname
                     operator: In
                     values:
                       - nexus
+              weight: 100
       containers:
         - name: wg-easy
           image: ghcr.io/wg-easy/wg-easy:latest

secrets/affine.yaml

@@ -0,0 +1,30 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: affine, namespace: cloud }
+spec:
+  refreshInterval: 1h
+  target:
+    name: affine-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        DB_USERNAME: "{{ .DB_USERNAME }}"
+        DB_PASSWORD: "{{ .DB_PASSWORD }}"
+        DB_NAME: "{{ .DB_NAME }}"
+  data:
+    - secretKey: DB_USERNAME
+      remoteRef:
+        { key: 4f15af1c-9b66-41d0-80db-a99ebe50e91f, property: username }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: DB_PASSWORD
+      remoteRef:
+        { key: 4f15af1c-9b66-41d0-80db-a99ebe50e91f, property: password }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: DB_NAME
+      remoteRef:
+        { key: 4f15af1c-9b66-41d0-80db-a99ebe50e91f, property: DB_NAME }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }