loomio (not yet working), and new config for postgres and redis
This commit is contained in:
64
loomio/db-init-job.yaml
Normal file
64
loomio/db-init-job.yaml
Normal file
@@ -0,0 +1,64 @@
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: loomio-db-init
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
containers:
|
||||
- name: db-init
|
||||
image: postgres:15-alpine
|
||||
env:
|
||||
- name: PGHOST
|
||||
value: "{{ .db.host }}"
|
||||
- name: PGPORT
|
||||
value: "{{ .db.port }}"
|
||||
- name: PGUSER
|
||||
value: postgres
|
||||
- name: PGPASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: postgres-secrets
|
||||
key: postgres.password
|
||||
- name: LOOMIO_DB_NAME
|
||||
value: "{{ .db.name }}"
|
||||
- name: LOOMIO_DB_USER
|
||||
value: "{{ .db.user }}"
|
||||
- name: LOOMIO_DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: loomio-secrets
|
||||
key: dbPassword
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
echo "Creating database and user for Loomio..."
|
||||
|
||||
# Check if database exists, create if not
|
||||
psql -tc "SELECT 1 FROM pg_database WHERE datname = '$LOOMIO_DB_NAME'" | grep -q 1 || \
|
||||
psql -c "CREATE DATABASE \"$LOOMIO_DB_NAME\""
|
||||
|
||||
# Check if user exists, create or update password
|
||||
psql -tc "SELECT 1 FROM pg_user WHERE usename = '$LOOMIO_DB_USER'" | grep -q 1 && \
|
||||
psql -c "ALTER USER \"$LOOMIO_DB_USER\" WITH PASSWORD '$LOOMIO_DB_PASSWORD'" || \
|
||||
psql -c "CREATE USER \"$LOOMIO_DB_USER\" WITH PASSWORD '$LOOMIO_DB_PASSWORD'"
|
||||
|
||||
# Grant all privileges
|
||||
psql -c "GRANT ALL PRIVILEGES ON DATABASE \"$LOOMIO_DB_NAME\" TO \"$LOOMIO_DB_USER\""
|
||||
|
||||
# Connect to the database and grant schema permissions
|
||||
psql -d "$LOOMIO_DB_NAME" -c "GRANT ALL ON SCHEMA public TO \"$LOOMIO_DB_USER\""
|
||||
|
||||
echo "Database initialization complete!"
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 999 # postgres user
|
||||
runAsGroup: 999
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
readOnlyRootFilesystem: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
101
loomio/deployment-worker.yaml
Normal file
101
loomio/deployment-worker.yaml
Normal file
@@ -0,0 +1,101 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: loomio-worker
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
component: worker
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
component: worker
|
||||
spec:
|
||||
containers:
|
||||
- name: worker
|
||||
image: {{ .workerImage }}
|
||||
env:
|
||||
- name: TASK
|
||||
value: worker
|
||||
- name: RAILS_ENV
|
||||
value: production
|
||||
- name: SITE_NAME
|
||||
value: {{ .appName }}
|
||||
- name: CANONICAL_HOST
|
||||
value: {{ .domain }}
|
||||
- name: PUBLIC_APP_URL
|
||||
value: https://{{ .domain }}
|
||||
- name: SUPPORT_EMAIL
|
||||
value: {{ .supportEmail }}
|
||||
- name: DATABASE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: loomio-secrets
|
||||
key: dbUrl
|
||||
- name: REDIS_URL
|
||||
value: {{ .redisUrl }}
|
||||
- name: DEVISE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: loomio-secrets
|
||||
key: deviseSecret
|
||||
- name: SECRET_COOKIE_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: loomio-secrets
|
||||
key: secretCookieToken
|
||||
- name: ACTIVE_STORAGE_SERVICE
|
||||
value: {{ .activeStorageService }}
|
||||
- name: SMTP_AUTH
|
||||
value: {{ .smtp.auth }}
|
||||
- name: SMTP_DOMAIN
|
||||
value: {{ .smtp.domain }}
|
||||
- name: SMTP_SERVER
|
||||
value: {{ .smtp.host }}
|
||||
- name: SMTP_PORT
|
||||
value: "{{ .smtp.port }}"
|
||||
- name: SMTP_USERNAME
|
||||
value: {{ .smtp.user }}
|
||||
- name: SMTP_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: loomio-secrets
|
||||
key: smtpPassword
|
||||
- name: SMTP_USE_SSL
|
||||
value: "{{ .smtp.tls }}"
|
||||
- name: REPLY_HOSTNAME
|
||||
value: {{ .smtp.from }}
|
||||
volumeMounts:
|
||||
- name: uploads
|
||||
mountPath: /loomio/public/system
|
||||
- name: storage
|
||||
mountPath: /loomio/storage
|
||||
- name: tmp
|
||||
mountPath: /loomio/tmp
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
readOnlyRootFilesystem: false
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumes:
|
||||
- name: uploads
|
||||
persistentVolumeClaim:
|
||||
claimName: loomio-uploads
|
||||
- name: storage
|
||||
persistentVolumeClaim:
|
||||
claimName: loomio-storage
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
124
loomio/deployment.yaml
Normal file
124
loomio/deployment.yaml
Normal file
@@ -0,0 +1,124 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: loomio
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
component: web
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
component: web
|
||||
spec:
|
||||
containers:
|
||||
- name: loomio
|
||||
image: {{ .image }}
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
env:
|
||||
- name: RAILS_ENV
|
||||
value: production
|
||||
- name: SITE_NAME
|
||||
value: {{ .appName }}
|
||||
- name: CANONICAL_HOST
|
||||
value: {{ .domain }}
|
||||
- name: PUBLIC_APP_URL
|
||||
value: https://{{ .domain }}
|
||||
- name: SUPPORT_EMAIL
|
||||
value: {{ .supportEmail }}
|
||||
- name: DATABASE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: loomio-secrets
|
||||
key: dbUrl
|
||||
- name: REDIS_URL
|
||||
value: {{ .redisUrl }}
|
||||
- name: DEVISE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: loomio-secrets
|
||||
key: deviseSecret
|
||||
- name: SECRET_COOKIE_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: loomio-secrets
|
||||
key: secretCookieToken
|
||||
- name: FORCE_SSL
|
||||
value: "{{ .forceSSL }}"
|
||||
- name: USE_RACK_ATTACK
|
||||
value: "{{ .useRackAttack }}"
|
||||
- name: PUMA_WORKERS
|
||||
value: "{{ .pumaWorkers }}"
|
||||
- name: MIN_THREADS
|
||||
value: "{{ .minThreads }}"
|
||||
- name: MAX_THREADS
|
||||
value: "{{ .maxThreads }}"
|
||||
- name: ACTIVE_STORAGE_SERVICE
|
||||
value: {{ .activeStorageService }}
|
||||
- name: SMTP_AUTH
|
||||
value: {{ .smtp.auth }}
|
||||
- name: SMTP_DOMAIN
|
||||
value: {{ .smtp.domain }}
|
||||
- name: SMTP_SERVER
|
||||
value: {{ .smtp.host }}
|
||||
- name: SMTP_PORT
|
||||
value: "{{ .smtp.port }}"
|
||||
- name: SMTP_USERNAME
|
||||
value: {{ .smtp.user }}
|
||||
- name: SMTP_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: loomio-secrets
|
||||
key: smtpPassword
|
||||
- name: SMTP_USE_SSL
|
||||
value: "{{ .smtp.tls }}"
|
||||
- name: REPLY_HOSTNAME
|
||||
value: {{ .smtp.from }}
|
||||
volumeMounts:
|
||||
- name: uploads
|
||||
mountPath: /loomio/public/system
|
||||
- name: storage
|
||||
mountPath: /loomio/storage
|
||||
- name: tmp
|
||||
mountPath: /loomio/tmp
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 200m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 1000m
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 30
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 3000
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
readOnlyRootFilesystem: false
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumes:
|
||||
- name: uploads
|
||||
persistentVolumeClaim:
|
||||
claimName: loomio-uploads
|
||||
- name: storage
|
||||
persistentVolumeClaim:
|
||||
claimName: loomio-storage
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
24
loomio/ingress.yaml
Normal file
24
loomio/ingress.yaml
Normal file
@@ -0,0 +1,24 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: loomio
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/target: {{ .externalDnsDomain }}
|
||||
external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
- hosts:
|
||||
- {{ .domain }}
|
||||
secretName: {{ .tlsSecretName }}
|
||||
rules:
|
||||
- host: {{ .domain }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: loomio
|
||||
port:
|
||||
number: 80
|
||||
20
loomio/kustomization.yaml
Normal file
20
loomio/kustomization.yaml
Normal file
@@ -0,0 +1,20 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: loomio
|
||||
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- pvc-uploads.yaml
|
||||
- pvc-storage.yaml
|
||||
- deployment.yaml
|
||||
- deployment-worker.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
- db-init-job.yaml
|
||||
|
||||
labels:
|
||||
- includeSelectors: true
|
||||
pairs:
|
||||
app: loomio
|
||||
managedBy: kustomize
|
||||
partOf: wild-cloud
|
||||
55
loomio/manifest.yaml
Normal file
55
loomio/manifest.yaml
Normal file
@@ -0,0 +1,55 @@
|
||||
name: loomio
|
||||
description: Loomio is a collaborative decision-making tool that makes it easy for groups to make decisions together
|
||||
version: 3.0.11
|
||||
icon: https://www.loomio.com/favicon.ico
|
||||
requires:
|
||||
- name: postgres
|
||||
installed_as: postgres
|
||||
- name: redis
|
||||
defaultConfig:
|
||||
namespace: loomio
|
||||
externalDnsDomain: {{ .cloud.domain }}
|
||||
image: loomio/loomio:v3.0.11
|
||||
workerImage: loomio/loomio:v3.0.11
|
||||
appName: Loomio
|
||||
domain: loomio.{{ .cloud.domain }}
|
||||
tlsSecretName: wildcard-wild-cloud-tls
|
||||
port: 3000
|
||||
storage:
|
||||
uploads: 5Gi
|
||||
files: 5Gi
|
||||
plugins: 1Gi
|
||||
redisUrl: {{ .apps.redis.uri }}
|
||||
adminEmail: "admin@{{ .cloud.domain }}"
|
||||
supportEmail: "support@{{ .cloud.domain }}"
|
||||
forceSSL: "1"
|
||||
useRackAttack: "1"
|
||||
pumaWorkers: "2"
|
||||
minThreads: "5"
|
||||
maxThreads: "5"
|
||||
activeStorageService: local
|
||||
db:
|
||||
name: loomio
|
||||
user: loomio
|
||||
host: {{ .apps.postgres.host }}
|
||||
port: {{ .apps.postgres.port }}
|
||||
smtp:
|
||||
auth: plain
|
||||
domain: "{{ .cloud.domain }}"
|
||||
host: "{{ .cloud.smtp.host }}"
|
||||
port: "{{ .cloud.smtp.port }}"
|
||||
user: "{{ .cloud.smtp.user }}"
|
||||
tls: "{{ .cloud.smtp.tls }}"
|
||||
from: "{{ .cloud.smtp.from }}"
|
||||
defaultSecrets:
|
||||
- key: dbPassword
|
||||
default: "{{ random.AlphaNum 32 }}"
|
||||
- key: dbUrl
|
||||
default: "postgresql://{{ .app.db.user }}:{{ .secrets.dbPassword }}@{{ .app.db.host }}:{{ .app.db.port }}/{{ .app.db.name }}?pool=30"
|
||||
- key: deviseSecret
|
||||
default: "{{ random.AlphaNum 32 }}"
|
||||
- key: secretCookieToken
|
||||
default: "{{ random.AlphaNum 32 }}"
|
||||
- key: smtpPassword
|
||||
requiredSecrets:
|
||||
- postgres.password
|
||||
4
loomio/namespace.yaml
Normal file
4
loomio/namespace.yaml
Normal file
@@ -0,0 +1,4 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: {{ .namespace }}
|
||||
11
loomio/pvc-storage.yaml
Normal file
11
loomio/pvc-storage.yaml
Normal file
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: loomio-storage
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .storage.files }}
|
||||
storageClassName: longhorn
|
||||
11
loomio/pvc-uploads.yaml
Normal file
11
loomio/pvc-uploads.yaml
Normal file
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: loomio-uploads
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .storage.uploads }}
|
||||
storageClassName: longhorn
|
||||
13
loomio/service.yaml
Normal file
13
loomio/service.yaml
Normal file
@@ -0,0 +1,13 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: loomio
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
component: web
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 3000
|
||||
protocol: TCP
|
||||
Reference in New Issue
Block a user