apps: preliminiary cal.com and peertube configuration

This commit is contained in:
xeruf 2024-02-18 10:58:58 +01:00
parent 14fb770e20
commit 3eef04c32d
27 changed files with 415 additions and 131 deletions

View File

@ -1,96 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: stackspin-vikunja-test-values
namespace: stackspout
data:
# https://github.com/truecharts/charts/blob/master/charts/stable/vikunja/values.yaml
values.yaml: |
frontend:
image:
tag: unstable
pullPolicy: Always
ingress:
main:
enabled: true
annotations:
kubernetes.io/tls-acme: "true"
hosts:
- host: "do-test.${domain}"
paths:
- path: /
pathType: Prefix
tls:
- secretName: vikunja-test-tls
hosts:
- "do-test.${domain}"
api:
image:
tag: unstable
pullPolicy: Always
ingress:
main:
enabled: true
annotations:
kubernetes.io/tls-acme: "true"
hosts:
- host: "do-test.${domain}"
paths:
- path: /
pathType: Prefix
tls:
- secretName: vikunja-test-tls
hosts:
- "do-test.${domain}"
configMaps:
config:
data:
config.yml: |-
auth:
openid:
# https://vikunja.io/docs/config-options/#openid
# Example: https://github.com/go-vikunja/api/blob/main/config.yml.sample#L289-L312
enabled: true
redirecturl: "https://do-test.${domain}/auth/openid/"
providers:
- name: Stackspin
authurl: "https://${hydra_domain}/"
clientid: "${client_id}"
clientsecret: "${client_secret}"
service:
frontendurl: "https://do-test.${domain}"
motd: "This is a test instance, do not use for production data as it can vanish without notice! Use Stackspin login, as usual."
timezone: "CET"
JWTSecret: "${jwt}"
database:
type: postgres
host: vikunja-test-postgresql
password: "${postgresql_password}"
log:
path: "/app/vikunja"
http: stdout
database: stderr
databaselevel: debug
defaultsettings:
avatar_provider: gravatar
discoverable_by_name: true
discoverable_by_email: true
week_start: 1
timezone: CET
# TODO default_project_id
#persistence:
# files:
# labels:
# stackspin.net/backupSet: "vikunja"
postgresql:
enabled: true
global:
postgresql:
database: vikunja
username: vikunja
password: "${postgresql_password}"
persistence:
enabled: true
existingClaim: vikunja-postgres
typesense:
enabled: false

View File

@ -8,7 +8,7 @@ spec:
chart: chart:
spec: spec:
chart: n8n chart: n8n
version: 1.0 # TODO version: 0.20.1
sourceRef: sourceRef:
kind: HelmRepository kind: HelmRepository
name: n8n name: n8n

View File

@ -4,6 +4,7 @@ resources:
- ninja-kustomization.yaml - ninja-kustomization.yaml
- do-kustomization.yaml - do-kustomization.yaml
- forge-kustomization.yaml - forge-kustomization.yaml
- flow-kustomization.yaml
- support-kustomization.yaml - support-kustomization.yaml
- flow-kustomization.yaml
- people-kustomization.yaml - people-kustomization.yaml
- meet-kustomization.yaml

View File

@ -0,0 +1,13 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: add-meet
namespace: flux-system
spec:
interval: 10m
prune: true
path: ./apps/meet
sourceRef:
kind: GitRepository
name: stackspout

View File

@ -0,0 +1,35 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: calcom
namespace: flux-system
spec:
interval: 5m
retryInterval: 2m
timeout: 10m
wait: true
prune: true
path: ./apps/meet/calcom
sourceRef:
kind: GitRepository
name: stackspout
dependsOn:
- name: flux
- name: local-path-provisioner
- name: calcom-secrets
- name: nginx
- name: single-sign-on
postBuild:
substituteFrom:
- kind: Secret
name: stackspin-cluster-variables
- kind: ConfigMap
name: stackspin-calcom-kustomization-variables
- kind: Secret
name: stackspin-calcom-variables
# OIDC
- kind: Secret
name: stackspin-calcom-oauth-variables
- kind: ConfigMap
name: stackspin-single-sign-on-kustomization-variables

View File

@ -0,0 +1,22 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: calcom-secrets
namespace: flux-system
spec:
interval: 5m
timeout: 4m
wait: true
prune: true
path: ./apps/meet/calcom-secrets
sourceRef:
kind: GitRepository
name: stackspout
dependsOn:
- name: flux
- name: secrets-controller
postBuild:
substituteFrom:
- kind: Secret
name: stackspin-cluster-variables

View File

@ -0,0 +1,7 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: stackspin-calcom-kustomization-variables
namespace: flux-system
data:
calcom_domain: meet.${domain}

View File

@ -0,0 +1,12 @@
---
apiVersion: secretgenerator.mittwald.de/v1alpha1
kind: StringSecret
metadata:
name: stackspin-calcom-oauth-variables
namespace: flux-system
spec:
data:
client_id: calcom
fields:
- fieldName: client_secret
length: "32"

View File

@ -0,0 +1,14 @@
---
apiVersion: secretgenerator.mittwald.de/v1alpha1
kind: StringSecret
metadata:
name: stackspin-calcom-variables
namespace: flux-system
spec:
# DATABASE_URL
# NEXT_PUBLIC_WEBAPP_URL
fields:
- fieldname: postgresql_password
- fieldname: postgresql_postgres_password
- fieldName: NEXTAUTH_SECRET
- fieldName: CALENDSO_ENCRYPTION_KEY

View File

@ -1,8 +1,8 @@
apiVersion: hydra.ory.sh/v1alpha1 apiVersion: hydra.ory.sh/v1alpha1
kind: OAuth2Client kind: OAuth2Client
metadata: metadata:
name: vikunja-test-oauth-client name: calcom-oauth-client
# Has to live in the same namespace as the stackspin-*-oauth-variables secret # Has to live in the same namespace as the stackspin-calcom-oauth-variables secret
namespace: flux-system namespace: flux-system
spec: spec:
# TODO copied from wekan: https://github.com/wekan/wekan/wiki/Keycloak # TODO copied from wekan: https://github.com/wekan/wekan/wiki/Keycloak
@ -15,7 +15,7 @@ spec:
- id_token - id_token
- code - code
scope: "openid profile email stackspin_roles" scope: "openid profile email stackspin_roles"
secretName: stackspin-vikunja-test-oauth-variables secretName: stackspin-calcom-oauth-variables
redirectUris: #redirectUris:
- https://do-test.${domain}/auth/openid/stackspin # - https://${calcom_domain}/oauth/openid/
tokenEndpointAuthMethod: client_secret_post #tokenEndpointAuthMethod: client_secret_post

View File

@ -1,8 +1,10 @@
apiVersion: v1 apiVersion: v1
kind: PersistentVolumeClaim kind: PersistentVolumeClaim
metadata: metadata:
name: vikunja-test-postgres name: calcom-postgres
namespace: stackspout namespace: stackspout
labels:
stackspin.net/backupSet: "calcom"
spec: spec:
accessModes: accessModes:
- ReadWriteOnce - ReadWriteOnce

View File

@ -1,30 +1,27 @@
apiVersion: helm.toolkit.fluxcd.io/v2beta1 apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease kind: HelmRelease
metadata: metadata:
name: vikunja-test name: calcom
namespace: stackspout namespace: stackspout
spec: spec:
releaseName: vikunja-test releaseName: calcom
chart: chart:
spec: spec:
chart: vikunja chart: calcom-stack
version: 0.4.1 version: 0.1.6
sourceRef: sourceRef:
kind: HelmRepository kind: HelmRepository
name: vikunja name: calcom
namespace: flux-system namespace: flux-system
interval: 5m interval: 5m
valuesFrom: valuesFrom:
- kind: ConfigMap - kind: ConfigMap
name: stackspin-vikunja-values name: stackspout-calcom-values
optional: false
- kind: ConfigMap
name: stackspin-vikunja-test-values
optional: false optional: false
# Allow overriding values by ConfigMap or Secret # Allow overriding values by ConfigMap or Secret
- kind: ConfigMap - kind: ConfigMap
name: stackspin-vikunja-override name: stackspout-calcom-override
optional: true optional: true
- kind: Secret - kind: Secret
name: stackspin-vikunja-override name: stackspout-calcom-override
optional: true optional: true

View File

@ -0,0 +1,57 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: stackspin-calcom-values
namespace: stackspout
data:
values.yaml: |
postgresql:
enabled: true
commonLabels:
stackspin.net/backupSet: "calcom"
#global:
# postgresql:
auth:
database: calcom
username: calcom
password: "${postgresql_password}"
postgresPassword: "${postgresql_postgres_password}"
primary:
persistence:
existingClaim: calcom-postgres
podAnnotations:
backup.velero.io/backup-volumes: "data"
calcom:
secretRef: "stackspin-calcom-variables"
commonLabels:
stackspin.net/backupSet: "calcom"
podLabels:
stackspin.net/backupSet: "calcom"
ingress:
enabled: true
annotations:
kubernetes.io/tls-acme: "true"
hosts:
- host: "${calcom_domain}"
paths:
- path: /
pathType: Prefix
tls:
- secretName: calcom-tls
hosts:
- "${calcom_domain}"
# TODO Adjust calcom Mailing config
# mailer:
# enabled: "${outgoing_mail_enabled}"
# host: "${outgoing_mail_smtp_host}"
# port: "${outgoing_mail_smtp_port}"
# username: "${outgoing_mail_smtp_user}"
# password: "${outgoing_mail_smtp_password}"
# fromemail: "${outgoing_mail_from_address}"
# TODO Adjust calcom OpenID Connect Single Sign-On Configuration
# - name: Stackspin
# key: "${client_id}"
# secret: "${client_secret}"
# autoDiscoverUrl: 'https://${hydra_domain}/.well-known/openid-configuration'

View File

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- calcom-kustomization.yaml
- calcom-secrets-kustomization.yaml

View File

@ -1,17 +1,3 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: add-people
namespace: flux-system
spec:
interval: 10m
prune: true
path: ./apps/people
sourceRef:
kind: GitRepository
name: stackspout
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization kind: Kustomization
metadata: metadata:

View File

@ -8,7 +8,7 @@ spec:
chart: chart:
spec: spec:
chart: zammad chart: zammad
version: version: 10.3.0
sourceRef: sourceRef:
kind: HelmRepository kind: HelmRepository
name: zammad name: zammad

View File

@ -0,0 +1,13 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: add-video
namespace: flux-system
spec:
interval: 10m
prune: true
path: ./apps/video
sourceRef:
kind: GitRepository
name: stackspout

View File

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- peertube-kustomization.yaml
- peertube-secrets-kustomization.yaml

View File

@ -0,0 +1,35 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: peertube
namespace: flux-system
spec:
interval: 5m
retryInterval: 2m
timeout: 10m
wait: true
prune: true
path: ./apps/video/peertube
sourceRef:
kind: GitRepository
name: stackspout
dependsOn:
- name: flux
- name: local-path-provisioner
- name: peertube-secrets
- name: nginx
- name: single-sign-on
postBuild:
substituteFrom:
- kind: Secret
name: stackspin-cluster-variables
- kind: ConfigMap
name: stackspin-peertube-kustomization-variables
- kind: Secret
name: stackspin-peertube-variables
# OIDC
- kind: Secret
name: stackspin-peertube-oauth-variables
- kind: ConfigMap
name: stackspin-single-sign-on-kustomization-variables

View File

@ -0,0 +1,22 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: peertube-secrets
namespace: flux-system
spec:
interval: 5m
timeout: 4m
wait: true
prune: true
path: ./apps/video/peertube-secrets
sourceRef:
kind: GitRepository
name: stackspout
dependsOn:
- name: flux
- name: secrets-controller
postBuild:
substituteFrom:
- kind: Secret
name: stackspin-cluster-variables

View File

@ -0,0 +1,7 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: stackspin-peertube-kustomization-variables
namespace: flux-system
data:
peertube_domain: video.${domain}

View File

@ -0,0 +1,12 @@
---
apiVersion: secretgenerator.mittwald.de/v1alpha1
kind: StringSecret
metadata:
name: stackspin-peertube-oauth-variables
namespace: flux-system
spec:
data:
client_id: peertube
fields:
- fieldName: client_secret
length: "32"

View File

@ -0,0 +1,9 @@
---
apiVersion: secretgenerator.mittwald.de/v1alpha1
kind: StringSecret
metadata:
name: stackspin-peertube-variables
namespace: flux-system
spec:
fields:
- fieldname: password

View File

@ -0,0 +1,21 @@
apiVersion: hydra.ory.sh/v1alpha1
kind: OAuth2Client
metadata:
name: peertube-oauth-client
# Has to live in the same namespace as the stackspin-peertube-oauth-variables secret
namespace: flux-system
spec:
# TODO copied from wekan: https://github.com/wekan/wekan/wiki/Keycloak
grantTypes:
- authorization_code
- refresh_token
- client_credentials
- implicit
responseTypes:
- id_token
- code
scope: "openid profile email stackspin_roles"
secretName: stackspin-peertube-oauth-variables
#redirectUris:
# - https://${peertube_domain}/oauth/openid/
#tokenEndpointAuthMethod: client_secret_post

View File

@ -0,0 +1,15 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: peertube-data
namespace: stackspout
labels:
stackspin.net/backupSet: "peertube"
spec:
accessModes:
- ReadWriteOnce
volumeMode: Filesystem
resources:
requests:
storage: 2Gi
storageClassName: local-path

View File

@ -0,0 +1,27 @@
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: peertube
namespace: stackspout
spec:
releaseName: peertube
chart:
spec:
chart: peertube
version: 1.6.0
sourceRef:
kind: HelmRepository
name: peertube
namespace: flux-system
interval: 5m
valuesFrom:
- kind: ConfigMap
name: stackspout-peertube-values
optional: false
# Allow overriding values by ConfigMap or Secret
- kind: ConfigMap
name: stackspout-peertube-override
optional: true
- kind: Secret
name: stackspout-peertube-override
optional: true

View File

@ -0,0 +1,63 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: stackspin-peertube-values
namespace: stackspout
data:
values.yaml: |
commonLabels:
stackspin.net/backupSet: "peertube"
podLabels:
stackspin.net/backupSet: "peertube"
podAnnotations:
# TODO FIXME comma separation correct?
backup.velero.io/backup-volumes: "data,config"
persistence:
data:
enabled: true
existingClaim: peertube-data
config:
enabled: true
existingClaim: peertube-config
ingress:
enabled: true
annotations:
kubernetes.io/tls-acme: "true"
hosts:
- host: "${peertube_domain}"
paths:
- path: /
pathType: Prefix
tls:
- secretName: peertube-tls
hosts:
- "${peertube_domain}"
resources:
requests:
cup: 2
memory: 4Gi
environment:
hostname: "${peertube_domain}"
# TODO database
dbHostname: your.postgresql.hostname
dbUser: peertube
dbPassword: postgres
redisHostname: redis
redisAuth: redispassword
#smtpenabled: "${outgoing_mail_enabled}"
smtpHostname: "${outgoing_mail_smtp_host}"
smtpPort: "${outgoing_mail_smtp_port}"
smtpUser: "${outgoing_mail_smtp_user}"
smtpPassword: "${outgoing_mail_smtp_password}"
smtpFrom: "${outgoing_mail_from_address}"
admin: "${outgoing_mail_from_address}"
# TODO Adjust peertube OpenID Connect Single Sign-On Configuration
# - name: Stackspin
# key: "${client_id}"
# secret: "${client_secret}"
# autoDiscoverUrl: 'https://${hydra_domain}/.well-known/openid-configuration'