Skip to content

Commit c1ded89

Browse files
chkpwdchkpwd
committed
deploy actual
1 parent eab67ee commit c1ded89

10 files changed

Lines changed: 221 additions & 22 deletions

File tree

‎ansible/inventory/group_vars/dns_servers/main.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
dns_service_definitions:
2+
- name: gravity
3+
image: "ghcr.io/beryju/gravity:25d922bec97919b565f10a5c1b6b987ad475fed2"
4+
hostname: "{{ inventory_hostname }}"
5+
ports:
6+
- 53:53/udp
7+
- 8008:8008/tcp
8+
- 8009:8009/tcp
9+
env:
10+
BOOTSTRAP_ROLES: dns;dhcp;api;etcd;backup;monitoring;tsdb
11+
DATA_PATH: /data
12+
LOG_LEVEL: info
13+
ADMIN_PASSWORD: "{{ lookup('bws_cache', 'infra-gravity-secrets').value.admin_password }}"
14+
ADMIN_TOKEN: "{{ lookup('bws_cache', 'infra-gravity-secrets').value.admin_token }}"
15+
ETCD_JOIN_CLUSTER: "{{ lookup('bws_cache', 'infra-gravity-secrets').value.etcd_join_token }},http://mgmt-srv-01.chkpwd.com:8008"
16+
volumes:
17+
- data:/data
18+
log_driver: json-file
19+
log_options:
20+
max-size: "10m"
21+
max-file: "3"

‎ansible/inventory/host_vars/mgmt-srv-01.yml‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -93,22 +93,6 @@ service_definitions:
9393
TWINGATE_LABEL_HOSTNAME: "`hostname`"
9494
TWINGATE_LABEL_DEPLOYED_BY: "docker"
9595
state: stopped
96-
- name: gravity
97-
image: "ghcr.io/beryju/gravity:325595bf7a82412fa878a32dc96853d6e3686771"
98-
hostname: rpi-gravity
99-
network_mode: host
100-
env:
101-
BOOTSTRAP_ROLES: dns;dhcp;api;etcd;backup;monitoring;tsdb
102-
DATA_PATH: /data
103-
LOG_LEVEL: info
104-
ADMIN_PASSWORD: "{{ lookup('bws_cache', 'infra-gravity-secrets').value.admin_password }}"
105-
ADMIN_TOKEN: "{{ lookup('bws_cache', 'infra-gravity-secrets').value.admin_token }}"
106-
volumes:
107-
- data:/data
108-
log_driver: json-file
109-
log_options:
110-
max-size: "10m"
111-
max-file: "3"
11296
- name: bws-cache
11397
image: ghcr.io/ripplefcl/bws-cache:v2.6.1
11498
env:

‎ansible/playbooks/setup_dns.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,17 +11,17 @@
1111
- curl
1212
- wget
1313
- iputils-ping
14+
- gpg
1415
state: present
15-
roles:
16-
- linux_setup
17-
- role: geerlingguy.docker
16+
roles: [{"linux_setup", "role": "geerlingguy.docker"}]
1817
tasks:
1918
- name: Expand file system
2019
when: "'mgmt-srv-01' in ansible_nodename"
2120
command: raspi-config nonint do_expand_rootfs
2221
changed_when: false
2322
- name: Deploy Docker containers # noqa args[module]
2423
community.docker.docker_container: "{{ item }}"
25-
loop: "{{ service_definitions }}"
24+
loop: "{{ dns_service_definitions }}"
2625
loop_control:
2726
label: "{{ item.name }}"
27+
tags: deploy_containers

‎kubernetes/apps/actual/external-secret.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
# yaml-language-server: $schema=https://lds-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
3+
apiVersion: external-secrets.io/v1
4+
kind: ExternalSecret
5+
metadata:
6+
name: actual
7+
spec:
8+
refreshInterval: 15m
9+
secretStoreRef:
10+
name: bitwarden-secrets-manager
11+
kind: ClusterSecretStore
12+
target:
13+
name: actual
14+
template:
15+
engineVersion: v2
16+
data:
17+
client_id: "{{ .openid_client_id }}"
18+
client_secret: "{{ .openid_client_secret }}"
19+
dataFrom:
20+
- extract:
21+
key: "actual-budget"

‎kubernetes/apps/actual/flux-kustomization.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
3+
apiVersion: kustomize.toolkit.fluxcd.io/v1
4+
kind: Kustomization
5+
metadata:
6+
name: &app actual
7+
namespace: &ns tools
8+
spec:
9+
targetNamespace: *ns
10+
path: ./kubernetes/apps/actual/
11+
commonMetadata:
12+
labels:
13+
app.kubernetes.io/name: *app
14+
components:
15+
- ../../core/volsync/components/
16+
postBuild:
17+
substitute:
18+
APP: *app
19+
CLAIM: config-actual-0
20+
VOLSYNC_PUID: "1999"
21+
VOLSYNC_PGID: "1999"
22+
VOLSYNC_CAPACITY: "500Mi"
23+
prune: true
24+
sourceRef:
25+
kind: GitRepository
26+
name: chkpwd-ops
27+
namespace: flux-system
28+
wait: false
29+
interval: 30m
30+
retryInterval: 1m
31+
timeout: 5m

‎kubernetes/apps/actual/helm-release.yml‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
---
2+
# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s-labs/helm-charts/common-3.1.0/charts/library/common/values.schema.json
3+
apiVersion: helm.toolkit.fluxcd.io/v2
4+
kind: HelmRelease
5+
metadata:
6+
name: actual
7+
spec:
8+
interval: 15m
9+
chart:
10+
spec:
11+
chart: app-template
12+
version: 4.1.1
13+
interval: 30m
14+
sourceRef:
15+
kind: HelmRepository
16+
name: bjw-s-labs
17+
namespace: flux-system
18+
driftDetection:
19+
mode: enabled
20+
install:
21+
remediation:
22+
retries: -1
23+
upgrade:
24+
remediation:
25+
retries: 3
26+
values:
27+
global:
28+
fullnameOverride: actual
29+
controllers:
30+
actual:
31+
enabled: true
32+
type: statefulset
33+
annotations:
34+
reloader.stakater.com/auto: "true"
35+
replicas: 1
36+
statefulset:
37+
volumeClaimTemplates:
38+
- name: config
39+
accessMode: ReadWriteOnce
40+
size: "${VOLSYNC_CAPACITY}"
41+
storageClass: ceph-block
42+
dataSourceRef:
43+
kind: ReplicationDestination
44+
apiGroup: volsync.backube
45+
name: "${APP}"
46+
globalMounts:
47+
- path: /data
48+
pod:
49+
securityContext:
50+
runAsNonRoot: true
51+
runAsUser: &context 1999
52+
runAsGroup: *context
53+
fsGroup: *context
54+
fsGroupChangePolicy: "OnRootMismatch"
55+
containers:
56+
app:
57+
image:
58+
repository: ghcr.io/actualbudget/actual-server
59+
tag: 25.6.1
60+
pullPolicy: IfNotPresent
61+
env:
62+
TZ: "America/New_York"
63+
ACTUAL_LOGIN_METHOD: "openid"
64+
ACTUAL_ALLOWED_LOGIN_METHODS: '["openid"]'
65+
ACTUAL_OPENID_DISCOVERY_URL: https://authentik.chkpwd.com/application/o/actual/
66+
ACTUAL_OPENID_CLIENT_ID:
67+
valueFrom:
68+
secretKeyRef:
69+
name: actual
70+
key: client_id
71+
ACTUAL_OPENID_CLIENT_SECRET:
72+
valueFrom:
73+
secretKeyRef:
74+
name: actual
75+
key: client_secret
76+
ACTUAL_OPENID_SERVER_HOSTNAME: "{{ .Release.Name }}.chkpwd.com"
77+
ACTUAL_PORT: &port 5006
78+
probes:
79+
liveness: &probes
80+
enabled: true
81+
custom: true
82+
spec:
83+
exec:
84+
command:
85+
- node
86+
- src/scripts/health-check.js
87+
timeoutSeconds: 5
88+
readiness: *probes
89+
startup:
90+
enabled: false
91+
securityContext:
92+
allowPrivilegeEscalation: false
93+
readOnlyRootFilesystem: true
94+
capabilities:
95+
drop:
96+
- ALL
97+
resources:
98+
requests:
99+
cpu: 10m
100+
memory: 150Mi
101+
limits:
102+
memory: 350Mi
103+
service:
104+
app:
105+
controller: actual
106+
ports:
107+
http:
108+
port: *port
109+
route:
110+
public:
111+
enabled: true
112+
kind: HTTPRoute
113+
hostnames: ["{{ .Release.Name }}.chkpwd.com"]
114+
rules:
115+
- matches:
116+
- path:
117+
type: PathPrefix
118+
value: /
119+
backendRefs:
120+
- name: actual
121+
port: *port
122+
parentRefs:
123+
- name: public
124+
namespace: kube-system
125+
sectionName: https
126+
persistence:
127+
tmp:
128+
enabled: true
129+
type: emptyDir

‎kubernetes/apps/actual/kustomization.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
3+
apiVersion: kustomize.config.k8s.io/v1beta1
4+
kind: Kustomization
5+
resources:
6+
- helm-release.yml
7+
- external-secret.yml

‎kubernetes/apps/kustomization.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ resources:
2828
- headlamp/flux-kustomization.yml
2929
- karakeep/flux-kustomization.yml
3030
- soundbored/flux-kustomization.yml
31+
- actual/flux-kustomization.yml
3132
# - kestra/flux-kustomization.yml # don't need for now
3233
# - pulsarr/flux-kustomization.yml # pulsarr is not ready yet
3334
# - discovarr/flux-kustomization.yml # discovarr is not ready yet

‎terraform/gravity/records.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,11 @@
7070
"data": "172.16.16.15",
7171
"type": "A"
7272
},
73+
{
74+
"hostname": "gravity-dns-02",
75+
"data": "172.16.16.7",
76+
"type": "A"
77+
},
7378
{
7479
"hostname": "pve-srv-01",
7580
"data": "172.16.16.3",

‎terraform/proxmox/guest-machines.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,8 @@ resource "proxmox_virtual_environment_vm" "ollama" {
6161
}
6262
}
6363

64-
resource "proxmox_virtual_environment_vm" "gravity-dns" {
65-
name = "gravity-dns"
64+
resource "proxmox_virtual_environment_vm" "gravity-dns-02" {
65+
name = "gravity-dns-02"
6666
node_name = "pve-srv-01"
6767
vm_id = 300
6868
on_boot = true

0 commit comments

Comments
 (0)