iac/kubernetes/apps/dawarich/helm-release.yml at f9b37fb6a924aa595cd1f50802640ba6088b0e15 · chkpwd/iac · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
---
# yaml-language-server: $schema=https://chkpwd.github.io/iac/helm.toolkit.fluxcd.io/helmrelease_v2.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: dawarich
spec:
  interval: 1h
  chart:
    spec:
      chart: app-template
      version: 5.0.1
      interval: 30m
      sourceRef:
        kind: HelmRepository
        name: bjw-s-labs
        namespace: flux-system
  values:
    controllers:
      dawarich:
        type: deployment
        annotations:
          reloader.stakater.com/auto: "true"
        defaultContainerOptionsStrategy: merge
        defaultContainerOptions:
          envFrom: &envFrom
            - secretRef:
                name: dawarich
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
        containers:
          app:
            image: &image
              repository: docker.io/freikin/dawarich
              tag: 1.11.0
            command: ["web-entrypoint.sh"]
            args: ["bin/rails", "server", "-p", "3000", "-b", "::"]
            env: &env
              RAILS_ENV: production
              SELF_HOSTED: "true"
              STORE_GEODATA: "true"
              RAILS_LOG_TO_STDOUT: "true"
              TIME_ZONE: America/New_York
              APPLICATION_PROTOCOL: https
              APPLICATION_HOSTS: dawarich.chkpwd.com
              REDIS_URL: redis://dawarich-redis.tools.svc.cluster.local:6379
              DATABASE_PORT: "5432"
              PROMETHEUS_EXPORTER_ENABLED: "false"
              DATABASE_HOST:
                valueFrom:
                  secretKeyRef:
                    name: dawarich-pguser-dawarich
                    key: host
              DATABASE_USERNAME:
                valueFrom:
                  secretKeyRef:
                    name: dawarich-pguser-dawarich
                    key: user
              DATABASE_PASSWORD:
                valueFrom:
                  secretKeyRef:
                    name: dawarich-pguser-dawarich
                    key: password
              DATABASE_NAME:
                valueFrom:
                  secretKeyRef:
                    name: dawarich-pguser-dawarich
                    key: dbname
            probes:
              liveness: &probes
                enabled: true
                custom: true
                spec:
                  httpGet:
                    path: /api/v1/health
                    port: 3000
                  initialDelaySeconds: 30
                  periodSeconds: 10
                  timeoutSeconds: 5
                  failureThreshold: 30
              readiness: *probes
              startup:
                enabled: false
            resources:
              requests:
                cpu: 50m
                memory: 512Mi
              limits:
                memory: 2Gi
      sidekiq:
        type: deployment
        annotations:
          reloader.stakater.com/auto: "true"
        defaultContainerOptionsStrategy: merge
        defaultContainerOptions:
          envFrom: *envFrom
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
        containers:
          app:
            image: *image
            command: ["sidekiq-entrypoint.sh"]
            args: ["sidekiq"]
            env:
              <<: *env
              BACKGROUND_PROCESSING_CONCURRENCY: "5"
            probes:
              liveness:
                enabled: true
                custom: true
                spec:
                  exec:
                    command: ["pgrep", "-f", "sidekiq"]
                  initialDelaySeconds: 30
                  periodSeconds: 30
                  timeoutSeconds: 10
                  failureThreshold: 5
              readiness:
                enabled: false
              startup:
                enabled: false
            resources:
              requests:
                cpu: 25m
                memory: 256Mi
              limits:
                memory: 2Gi
    defaultPodOptions:
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 1999
        runAsGroup: 1999
        fsGroup: 1999
        fsGroupChangePolicy: OnRootMismatch
    service:
      app:
        controller: dawarich
        ports:
          http:
            port: 3000
    route:
      private:
        kind: HTTPRoute
        hostnames: ["{{ .Release.Name }}.chkpwd.com"]
        parentRefs:
          - name: private
            namespace: networking
            sectionName: https
    persistence:
      storage:
        type: nfs
        server: nas-srv-01.chkpwd.com
        path: /volume1/vault-01/static_media/documents/dawarich/storage
        advancedMounts:
          dawarich:
            app:
              - path: /var/app/storage
          sidekiq:
            app:
              - path: /var/app/storage
      watched:
        type: nfs
        server: nas-srv-01.chkpwd.com
        path: /volume1/vault-01/static_media/documents/dawarich/watched
        advancedMounts:
          dawarich:
            app:
              - path: /var/app/tmp/imports/watched
          sidekiq:
            app:
              - path: /var/app/tmp/imports/watched
      public:
        type: emptyDir
        advancedMounts:
          dawarich:
            app:
              - path: /var/app/public
          sidekiq:
            app:
              - path: /var/app/public
      tmp:
        type: emptyDir