Adds plausible.

plausible/versions/3/deployment.yaml

@@ -0,0 +1,121 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: plausible
+  labels:
+    component: web
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      component: web
+  template:
+    metadata:
+      labels:
+        component: web
+    spec:
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+      - name: init-dirs
+        image: busybox:1.37
+        command:
+        - /bin/sh
+        - -c
+        - |
+          mkdir -p /data/tmp /data/tzdata_data/release_ets
+          chmod -R 777 /data/tmp /data/tzdata_data
+        securityContext:
+          runAsUser: 0
+        volumeMounts:
+        - name: plausible-data
+          mountPath: /data
+      - name: wait-for-clickhouse
+        image: busybox:1.37
+        command:
+        - /bin/sh
+        - -c
+        - |
+          until wget --no-verbose --tries=1 -O - http://{{ .clickhouse.host }}:{{ .clickhouse.port }}/ping; do
+            echo "Waiting for ClickHouse..."
+            sleep 3
+          done
+        securityContext:
+          runAsUser: 65534
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+      containers:
+      - name: plausible
+        image: ghcr.io/plausible/community-edition:v3.2.1
+        command:
+        - sh
+        - -c
+        - /entrypoint.sh db createdb && /entrypoint.sh db migrate && /entrypoint.sh run
+        ports:
+        - name: http
+          containerPort: 8000
+          protocol: TCP
+        env:
+        - name: BASE_URL
+          value: https://{{ .domain }}
+        - name: TMPDIR
+          value: /var/lib/plausible/tmp
+        - name: DISABLE_REGISTRATION
+          value: "{{ .disableRegistration }}"
+        - name: SECRET_KEY_BASE
+          valueFrom:
+            secretKeyRef:
+              name: plausible-secrets
+              key: secretKeyBase
+        - name: DATABASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: plausible-secrets
+              key: dbUrl
+        - name: CLICKHOUSE_DATABASE_URL
+          value: http://{{ .clickhouse.host }}:{{ .clickhouse.port }}/{{ .clickhouse.db }}
+        volumeMounts:
+        - name: plausible-data
+          mountPath: /var/lib/plausible
+        readinessProbe:
+          httpGet:
+            path: /
+            port: 8000
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 3
+        livenessProbe:
+          httpGet:
+            path: /
+            port: 8000
+          initialDelaySeconds: 60
+          periodSeconds: 20
+          timeoutSeconds: 5
+          failureThreshold: 3
+        resources:
+          limits:
+            cpu: "1"
+            memory: 1Gi
+            ephemeral-storage: 1Gi
+          requests:
+            cpu: 100m
+            memory: 256Mi
+            ephemeral-storage: 50Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: false
+      volumes:
+      - name: plausible-data
+        persistentVolumeClaim:
+          claimName: plausible-data
+      restartPolicy: Always