underpost 2.8.1 → 2.8.41

package/manifests/core/underpost-engine-mongodb-backup-cronjob.yaml

@@ -0,0 +1,40 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: mongodb-backup
+spec:
+  schedule: '*/5 * * * *' # Runs backup every five minutes
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+            - name: mongodump
+              image: docker.io/library/mongo:latest
+              command:
+                - sh
+                - -c
+                - |
+                  # Perform backup
+                  mongodump -u $MONGO_INITDB_ROOT_USERNAME -p $MONGO_INITDB_ROOT_PASSWORD --host=mongodb-service --port=27017 --out=/backup/$(date +\%Y-\%m-\%dT\%H-\%M-\%S)
+                  # Remove backups older than 7 days
+                  find /backup -type d -mtime +7 -exec rm -rf {} +
+              volumeMounts:
+                - name: backup-storage
+                  mountPath: /backup
+              env:
+                - name: MONGO_INITDB_ROOT_USERNAME
+                  valueFrom:
+                    secretKeyRef:
+                      name: mongodb-secret
+                      key: username
+                - name: MONGO_INITDB_ROOT_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: mongodb-secret
+                      key: password
+          restartPolicy: Never
+          volumes:
+            - name: backup-storage
+              persistentVolumeClaim:
+                claimName: backup-pvc

package/manifests/core/underpost-engine-mongodb-configmap.yaml

@@ -0,0 +1,26 @@
+# origin conf: /etc/mongod.conf
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mongodb-config-file
+  namespace: default
+data:
+  mongod.conf: |
+    storage:
+      dbPath: /data/db
+    systemLog:
+      destination: file
+      logAppend: true
+      path: /var/log/mongodb/mongod.log
+    replication:
+      replSetName: rs0
+    net:
+      bindIp: 127.0.0.1
+      port: 27017
+    processManagement:
+      fork: true
+    setParameter:
+      enableLocalhostAuthBypass: false
+    security:
+      authorization: enabled
+      keyFile: /etc/mongodb-keyfile

package/manifests/core/underpost-engine-pv-pvc.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: mongodb-pv
+spec:
+  capacity:
+    storage: 5Gi
+  accessModes:
+    - ReadWriteOnce
+  hostPath:
+    path: /data/mongodb
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mongodb-pvc
+spec:
+  storageClassName: ''
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi

package/manifests/core/underpost-engine-statefulset.yaml

@@ -0,0 +1,91 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: mongodb # Specifies the name of the statefulset
+spec:
+  serviceName: 'mongodb-service' # Specifies the service to use
+  replicas: 2
+  selector:
+    matchLabels:
+      app: mongodb
+  template:
+    metadata:
+      labels:
+        app: mongodb
+    spec:
+      containers:
+        - name: mongodb
+          image: docker.io/library/mongo:latest
+          command:
+            - mongod
+            - '--replSet'
+            - 'rs0'
+            # - '--config'
+            # - '-f'
+            # - '/etc/mongod.conf'
+            # - '--auth'
+            # - '--clusterAuthMode'
+            # - 'keyFile'
+            # - '--keyFile'
+            # - '/etc/mongodb-keyfile'
+            # - '--interleave'
+            # - 'all'
+            # - '--wiredTigerCacheSizeGB'
+            # - '0.25'
+            # - '--setParameter'
+            # - 'authenticationMechanisms=SCRAM-SHA-1'
+            # - '--fork'
+            - '--logpath'
+            - '/var/log/mongodb/mongod.log'
+            - '--bind_ip_all'
+          ports:
+            - containerPort: 27017
+          volumeMounts:
+            - name: mongodb-storage
+              mountPath: /data/db
+            - name: keyfile
+              mountPath: /etc/mongodb-keyfile
+              readOnly: true
+            # - name: mongodb-configuration-file
+            #   mountPath: /etc/mongod.conf
+            #   subPath: mongod.conf
+            #   readOnly: true
+            # - name: mongodb-config
+            #   mountPath: /config
+          env:
+            - name: MONGO_INITDB_ROOT_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: mongodb-secret
+                  key: username
+            - name: MONGO_INITDB_ROOT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: mongodb-secret
+                  key: password
+          resources:
+            requests:
+              cpu: '100m'
+              memory: '256Mi'
+            limits:
+              cpu: '500m'
+              memory: '512Mi'
+      volumes:
+        - name: keyfile
+          secret:
+            secretName: mongodb-keyfile
+            defaultMode: 0400
+        # - name: mongodb-configuration-file
+        #   configMap:
+        #     name: mongodb-config-file
+        # - name: mongodb-config
+        #   configMap:
+        #     name: mongodb-config
+  volumeClaimTemplates:
+    - metadata:
+        name: mongodb-storage
+      spec:
+        accessModes: ['ReadWriteOnce']
+        resources:
+          requests:
+            storage: 5Gi

package/manifests/deployment/mongo-express.yaml

@@ -0,0 +1,60 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mongo-express
+  labels:
+    app: mongo-express
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mongo-express
+  template:
+    metadata:
+      labels:
+        app: mongo-express
+    spec:
+      containers:
+        - name: mongo-express
+          image: mongo-express
+          ports:
+            - containerPort: 8081
+          env:
+            - name: ME_CONFIG_MONGODB_ADMINUSERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: mongodb-secret
+                  key: username
+            - name: ME_CONFIG_MONGODB_ADMINPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: mongodb-secret
+                  key: password
+            - name: ME_CONFIG_BASICAUTH_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: mongodb-secret
+                  key: username
+            - name: ME_CONFIG_BASICAUTH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: mongodb-secret
+                  key: password
+            - name: ME_CONFIG_MONGODB_SERVER
+              value: 'mongodb-0.mongodb-service'
+            - name: ME_CONFIG_MONGODB_ENABLE_ADMIN
+              value: 'true'
+            - name: ME_CONFIG_MONGODB_PORT
+              value: '27017'
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mongo-express-service
+spec:
+  selector:
+    app: mongo-express
+  ports:
+    - protocol: TCP
+      port: 8081
+      targetPort: 8081

package/manifests/deployment/phpmyadmin.yaml

@@ -0,0 +1,54 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: phpmyadmin-deployment
+  labels:
+    app: phpmyadmin
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: phpmyadmin
+  template:
+    metadata:
+      labels:
+        app: phpmyadmin
+    spec:
+      containers:
+        - name: phpmyadmin
+          image: phpmyadmin/phpmyadmin
+          ports:
+            - containerPort: 80
+          env:
+            - name: PMA_HOST
+              value: 'mariadb'
+            - name: PMA_PORT
+              value: '3306'
+            - name: PMA_USER
+              valueFrom:
+                secretKeyRef:
+                  name: mariadb-secret
+                  key: username
+            - name: PMA_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: mariadb-secret
+                  key: password
+            - name: UPLOAD_LIMIT
+              value: '300M'
+            - name: PMA_ARBITRARY
+              value: '1'
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: phpmyadmin-service
+spec:
+  type: NodePort
+  selector:
+    app: phpmyadmin
+  ports:
+    - protocol: TCP
+      nodePort: 31008
+      port: 80
+      targetPort: 80

package/manifests/kind-config.yaml

@@ -0,0 +1,12 @@
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+nodes:
+  - role: control-plane
+  - role: worker
+    extraPortMappings:
+      - containerPort: 80
+        hostPort: 80
+        listenAddress: '0.0.0.0'
+      - containerPort: 443
+        hostPort: 443
+        listenAddress: '0.0.0.0'

package/manifests/letsencrypt-prod.yaml

@@ -0,0 +1,15 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+  namespace: cert-manager
+spec:
+  acme:
+    email: development@underpost.net
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    server: https://acme-v02.api.letsencrypt.org/directory
+    solvers:
+      - http01:
+          ingress:
+            class: contour

package/manifests/mariadb/config.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mariadb-config
+data:
+  my.cnf: | # bind-address=0.0.0.0
+    [mysqld]
+    default_storage_engine=InnoDB
+    innodb_file_per_table=1
+    max_connections=1000

package/manifests/mariadb/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+# kubectl apply -k mariadb/.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - pv.yaml
+  - pvc.yaml
+  - statefulset.yaml
+  - service.yaml

package/manifests/mariadb/pv.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: mariadb-pv
+spec:
+  capacity:
+    storage: 1Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  hostPath:
+    path: /data/mariadb

package/manifests/mariadb/pvc.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mariadb-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

package/manifests/mariadb/secret.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mariadb-secret
+type: Opaque
+data:
+  password:
+  username:

package/manifests/mariadb/service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mariadb
+spec:
+  ports:
+    - port: 3306
+      targetPort: 3306
+  selector:
+    app: mariadb

package/manifests/mariadb/statefulset.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: mariadb-statefulset
+spec:
+  serviceName: mariadb
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mariadb
+  template:
+    metadata:
+      labels:
+        app: mariadb
+    spec:
+      containers:
+        - name: mariadb
+          image: mariadb:latest
+          env:
+            - name: MYSQL_ROOT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: mariadb-secret
+                  key: password
+            # - name: MYSQL_PASSWORD
+            #   valueFrom:
+            #     secretKeyRef:
+            #       name: mariadb-secret
+            #       key: password
+            # - name: MYSQL_USER
+            #   valueFrom:
+            #     secretKeyRef:
+            #       name: mariadb-secret
+            #       key: username
+            # - name: MYSQL_DATABASE
+            #   value: default
+          ports:
+            - containerPort: 3306
+          volumeMounts:
+            - mountPath: /var/lib/mysql
+              name: mariadb-storage
+      #       - mountPath: /etc/mysql/conf.d
+      #         name: config-volume
+      # volumes:
+      #   - name: config-volume
+      #     configMap:
+      #       name: mariadb-config
+  volumeClaimTemplates:
+    - metadata:
+        name: mariadb-storage
+      spec:
+        accessModes: ['ReadWriteOnce']
+        resources:
+          requests:
+            storage: 1Gi

package/manifests/valkey/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# kubectl apply -k valkey/.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - underpost-engine-valkey-service.yaml
+  - underpost-engine-valkey-statefulset.yaml

package/manifests/valkey/underpost-engine-valkey-service.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: service-valkey
+  namespace: default
+spec:
+  ports:
+    - port: 6379
+      targetPort: 6379
+  selector:
+    app: service-valkey
+  ipFamilyPolicy: PreferDualStack
+  ipFamilies:
+    - IPv4
+    # - IPv6
+  type: ClusterIP

package/manifests/valkey/underpost-engine-valkey-statefulset.yaml

@@ -0,0 +1,39 @@
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: service-valkey
+  namespace: default
+spec:
+  serviceName: service-valkey
+  replicas: 1
+  selector:
+    matchLabels:
+      app: service-valkey
+  template:
+    metadata:
+      labels:
+        app: service-valkey
+    spec:
+      containers:
+        - name: service-valkey
+          image: docker.io/valkey/valkey:latest
+          env:
+            - name: TZ
+              value: Europe/Zurich
+          ports:
+            - containerPort: 6379
+          startupProbe:
+            tcpSocket:
+              port: 6379
+            failureThreshold: 30
+            periodSeconds: 5
+            timeoutSeconds: 5
+          livenessProbe:
+            tcpSocket:
+              port: 6379
+            failureThreshold: 2
+            periodSeconds: 30
+            timeoutSeconds: 5
+      restartPolicy: Always
+      automountServiceAccountToken: false