diff --git a/manifests/dashboard/chart.yaml b/manifests/dashboard/chart.yaml index 862e613..91088e4 100644 --- a/manifests/dashboard/chart.yaml +++ b/manifests/dashboard/chart.yaml @@ -1,32 +1,21 @@ apiVersion: source.toolkit.fluxcd.io/v1 kind: HelmRepository metadata: - name: kubernetes-dashboard + name: headlamp spec: - url: https://kubernetes.github.io/dashboard/ + url: "https://kubernetes-sigs.github.io/headlamp/" interval: "24h" --- apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: - name: kubernetes-dashboard + name: headlamp spec: interval: "24h" chart: spec: - chart: kubernetes-dashboard + chart: headlamp sourceRef: kind: HelmRepository - name: kubernetes-dashboard + name: headlamp interval: "24h" - values: - app: - settings: - global: - clusterName: Hellings Home - itemsPerPage: 25 - ingress: - enabled: true - hosts: - - dashboard.shire-zebra.ts.net - ingressClassName: tailscale diff --git a/manifests/dashboard/ingress.yaml b/manifests/dashboard/ingress.yaml new file mode 100644 index 0000000..be512bd --- /dev/null +++ b/manifests/dashboard/ingress.yaml @@ -0,0 +1,14 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: dashboard-tailscale +spec: + ingressClassName: tailscale + defaultBackend: + service: + name: headlamp + port: + number: 3001 + tls: + - hosts: + - headlamp diff --git a/manifests/dashboard/kustomization.yaml b/manifests/dashboard/kustomization.yaml index 8745d42..5f6afdf 100644 --- a/manifests/dashboard/kustomization.yaml +++ b/manifests/dashboard/kustomization.yaml @@ -4,3 +4,4 @@ resources: - namespace.yaml - chart.yaml - user.yaml + - ingress.yaml diff --git a/manifests/databases/immich.yaml b/manifests/databases/immich.yaml deleted file mode 100644 index eabe172..0000000 --- a/manifests/databases/immich.yaml +++ /dev/null @@ -1,89 +0,0 @@ -apiVersion: postgresql.cnpg.io/v1 -kind: Cluster -metadata: - name: immich -spec: - imageName: "ghcr.io/corentingiraud/cnpg-pgvector-vectorchord:16-migration" - #imageName: "ghcr.io/tensorchord/cloudnative-pgvecto.rs:16-v0.3.0" - #postgresUID: 1 - instances: 1 - storage: - size: 60Gi - primaryUpdateStrategy: unsupervised - postgresql: - shared_preload_libraries: - - vectors.so - - vchord.so - - bootstrap: - recovery: - source: origin - # initdb: - # database: immich - # owner: immich - # secret: - # name: postgres-user-immich - # dataChecksums: true - # postInitApplicationSQL: - # - ALTER SYSTEM SET search_path TO "$user", public, vectors; - # - SET search_path TO "$user", public, vectors; - # - CREATE EXTENSION IF NOT EXISTS "cube"; - # - CREATE EXTENSION IF NOT EXISTS "earthdistance"; - # - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "immich"; - - externalClusters: - - name: origin - plugin: - name: barman-cloud.cloudnative-pg.io - parameters: - barmanObjectName: k3sbackup-objectstore - serverName: pgvector - - managed: - roles: - - name: immich - ensure: present - comment: Immich DB user - login: true - superuser: true - passwordSecret: - name: postgres-user-immich - - plugins: - - name: barman-cloud.cloudnative-pg.io - isWALArchiver: true - parameters: - barmanObjectName: k3sbackup-objectstore ---- -apiVersion: postgresql.cnpg.io/v1 -kind: Database -metadata: - name: database-immich -spec: - name: immich - owner: immich - cluster: - name: immich - extensions: - - name: vectors - ensure: present - - name: vectorchord - ensure: present - - name: cube - ensure: present - - name: earthdistance - ensure: present ---- -apiVersion: postgresql.cnpg.io/v1 -kind: ScheduledBackup -metadata: - name: immich-backup -spec: - immediate: true # Create one when this is added to the cluster - schedule: "0 2 0 * * *" # 1AM, nightly - backupOwnerReference: self - cluster: - name: immich - method: plugin - pluginConfiguration: - name: barman-cloud.cloudnative-pg.io diff --git a/manifests/databases/kustomization.yaml b/manifests/databases/kustomization.yaml index 4a5c0e7..3d46a2d 100644 --- a/manifests/databases/kustomization.yaml +++ b/manifests/databases/kustomization.yaml @@ -7,5 +7,4 @@ resources: - postgres-gitlab.yaml - postgres-pgadmin.yaml - postgres-matrix.yaml - - immich.yaml - ingress.yaml diff --git a/manifests/databases/secrets.yaml b/manifests/databases/secrets.yaml index b7533a1..946b660 100644 --- a/manifests/databases/secrets.yaml +++ b/manifests/databases/secrets.yaml @@ -133,37 +133,3 @@ spec: remoteRef: key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b property: password ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: postgres-user-immich - namespace: db -spec: - target: - name: postgres-user-immich - deletionPolicy: Delete - template: - type: Opaque - data: - username: |- - {{ .username }} - password: |- - {{ .password }} - data: - - secretKey: username - sourceRef: - storeRef: - name: bitwarden-login - kind: ClusterSecretStore - remoteRef: - key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f - property: username - - secretKey: password - sourceRef: - storeRef: - name: bitwarden-login - kind: ClusterSecretStore - remoteRef: - key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f - property: password diff --git a/manifests/helm/external-secrets.yaml b/manifests/helm/external-secrets.yaml index 263e56a..3be0d27 100644 --- a/manifests/helm/external-secrets.yaml +++ b/manifests/helm/external-secrets.yaml @@ -31,3 +31,6 @@ spec: crds: create: true includeCRDs: true + webhook: + certManager: + enable: true diff --git a/manifests/helm/kyverno.yaml b/manifests/helm/kyverno.yaml index d15bc1d..f4ca616 100644 --- a/manifests/helm/kyverno.yaml +++ b/manifests/helm/kyverno.yaml @@ -22,7 +22,7 @@ spec: chart: spec: chart: kyverno - version: "1.17.1" + version: "3.7.1" sourceRef: kind: HelmRepository name: kyverno diff --git a/manifests/immich/chart.yaml b/manifests/immich/chart.yaml index 9b8cad2..1a1bb6d 100644 --- a/manifests/immich/chart.yaml +++ b/manifests/immich/chart.yaml @@ -34,7 +34,7 @@ spec: image: tag: v2.7.5 env: - DB_HOSTNAME: immich-rw.db.svc.cluster.local + DB_HOSTNAME: immich-rw DB_DATABASE_NAME: immich DB_USERNAME: valueFrom: diff --git a/manifests/immich/database.yaml b/manifests/immich/database.yaml new file mode 100644 index 0000000..5dfae2f --- /dev/null +++ b/manifests/immich/database.yaml @@ -0,0 +1,161 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: immich +spec: + imageName: "ghcr.io/tensorchord/cloudnative-vectorchord:18" + #postgresUID: 1 + instances: 1 + storage: + size: 60Gi + primaryUpdateStrategy: unsupervised + postgresql: + shared_preload_libraries: + - vchord.so + + bootstrap: + # Use these with the name "immich-1" to restore from the backups + recovery: + source: origin + # Use these two lines in order to restore from the other database, + # once it has restored from the WALs + #pg_basebackup: + # source: restore + # Use this block to bootstrap the cluster, if you don't have backups. + # What are you doing without backups, you chump?! + # initdb: + # database: immich + # owner: immich + # secret: + # name: postgres-user-immich + # dataChecksums: true + # postInitApplicationSQL: + # - ALTER SYSTEM SET search_path TO "$user", public, vectors; + # - SET search_path TO "$user", public, vectors; + # - CREATE EXTENSION IF NOT EXISTS "cube"; + # - CREATE EXTENSION IF NOT EXISTS "earthdistance"; + # - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "immich"; + + externalClusters: + - name: origin + plugin: + name: barman-cloud.cloudnative-pg.io + parameters: + barmanObjectName: k3sbackup-objectstore + serverName: immich + - name: restore + connectionParameters: + host: immich-1-rw + user: streaming_replica + sslmode: verify-full + sslCert: + name: immich-1-replication + key: tls.crt + sslKey: + name: immich-1-replication + key: tls.key + sslRootCert: + name: immich-1-ca + key: ca.crt + + managed: + roles: + - name: immich + ensure: present + comment: Immich DB user + login: true + superuser: true + passwordSecret: + name: postgres-user-immich + + plugins: + - name: barman-cloud.cloudnative-pg.io + isWALArchiver: true + parameters: + barmanObjectName: k3sbackup-objectstore +--- +apiVersion: postgresql.cnpg.io/v1 +kind: Database +metadata: + name: database-immich +spec: + name: immich + owner: immich + cluster: + name: immich + extensions: + - name: vectors + ensure: present + - name: vectorchord + ensure: present + - name: cube + ensure: present + - name: earthdistance + ensure: present +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: k3sbackup-externalsecret +spec: + target: + name: k3sbackup-secret + deletionPolicy: Delete + template: + type: Opaque + data: + username: |- + {{ .username }} + password: |- + {{ .password }} + data: + - secretKey: username + sourceRef: + storeRef: + name: bitwarden-login + kind: ClusterSecretStore + remoteRef: + key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b + property: username + - secretKey: password + sourceRef: + storeRef: + name: bitwarden-login + kind: ClusterSecretStore + remoteRef: + key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b + property: password + +--- +apiVersion: barmancloud.cnpg.io/v1 +kind: ObjectStore +metadata: + name: k3sbackup-objectstore +spec: + configuration: + destinationPath: "s3://k3sbackup/postgres" + endpointURL: "http://chronicles.thehellings.lan:9000/" + s3Credentials: + accessKeyId: + name: k3sbackup-secret + key: username + secretAccessKey: + name: k3sbackup-secret + key: password + wal: + compression: gzip + retentionPolicy: "30d" +--- +apiVersion: postgresql.cnpg.io/v1 +kind: ScheduledBackup +metadata: + name: immich-backup +spec: + immediate: false # Create one when this is added to the cluster + schedule: "0 2 0 * * *" # 1AM, nightly + backupOwnerReference: self + cluster: + name: immich + method: plugin + pluginConfiguration: + name: barman-cloud.cloudnative-pg.io diff --git a/manifests/immich/kustomization.yaml b/manifests/immich/kustomization.yaml index 40ec1ea..e37b1d2 100644 --- a/manifests/immich/kustomization.yaml +++ b/manifests/immich/kustomization.yaml @@ -2,8 +2,9 @@ namespace: immich resources: - namespace.yaml - - chart.yaml - postgres-user-secret.yaml + - database.yaml + - chart.yaml - pvc.yaml - ingress.yaml - backup.yaml diff --git a/modules/nixos/kubernetes.nix b/modules/nixos/kubernetes.nix index 7ded731..cd5ac45 100644 --- a/modules/nixos/kubernetes.nix +++ b/modules/nixos/kubernetes.nix @@ -7,8 +7,8 @@ let cfg = config.greg.kubernetes; cert-manager = pkgs.fetchurl { - url = "https://github.com/cert-manager/cert-manager/releases/download/v1.18.2/cert-manager.yaml"; - sha256 = "0vx1nfyhl0rzb6psfxplq8pfp18mrrdk83n8rj2ph8q6r15vcih5"; + url = "https://github.com/cert-manager/cert-manager/releases/download/v1.20.2/cert-manager.yaml"; + sha256 = "sha256-HOEcrpEq3sxp5rtiNDX6/J7SFQX57/+YvXHXuA8B2x8="; }; flux = pkgs.fetchurl { url = "https://github.com/fluxcd/flux2/releases/download/v2.7.2/install.yaml";