171 lines
4.7 KiB
YAML
171 lines
4.7 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: mastodon-web
|
|
namespace: {{ .namespace }}
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
component: web
|
|
template:
|
|
metadata:
|
|
labels:
|
|
component: web
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 991
|
|
runAsGroup: 991
|
|
fsGroup: 991
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: web
|
|
image: {{ .image }}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
readOnlyRootFilesystem: false
|
|
command:
|
|
- bundle
|
|
- exec
|
|
- puma
|
|
- -C
|
|
- config/puma.rb
|
|
ports:
|
|
- name: http
|
|
containerPort: {{ .webPort }}
|
|
protocol: TCP
|
|
env:
|
|
- name: LOCAL_DOMAIN
|
|
value: "{{ .domain }}"
|
|
- name: RAILS_ENV
|
|
value: production
|
|
- name: RAILS_LOG_LEVEL
|
|
value: info
|
|
- name: DEFAULT_LOCALE
|
|
value: "{{ .locale }}"
|
|
- name: SINGLE_USER_MODE
|
|
value: "{{ .singleUserMode }}"
|
|
- name: SECRET_KEY_BASE
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mastodon-secrets
|
|
key: secretKeyBase
|
|
- name: OTP_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mastodon-secrets
|
|
key: otpSecret
|
|
- name: VAPID_PRIVATE_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mastodon-secrets
|
|
key: vapidPrivateKey
|
|
- name: VAPID_PUBLIC_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mastodon-secrets
|
|
key: vapidPublicKey
|
|
- name: ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mastodon-secrets
|
|
key: activeRecordPrimaryKey
|
|
- name: ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mastodon-secrets
|
|
key: activeRecordDeterministicKey
|
|
- name: ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mastodon-secrets
|
|
key: activeRecordKeyDerivationSalt
|
|
- name: DB_HOST
|
|
value: "{{ .dbHostname }}"
|
|
- name: DB_PORT
|
|
value: "{{ .dbPort }}"
|
|
- name: DB_NAME
|
|
value: "{{ .dbName }}"
|
|
- name: DB_USER
|
|
value: "{{ .dbUsername }}"
|
|
- name: DB_PASS
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mastodon-secrets
|
|
key: dbPassword
|
|
- name: POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mastodon-secrets
|
|
key: postgres.password
|
|
- name: REDIS_HOST
|
|
value: "{{ .redisHostname }}"
|
|
- name: REDIS_PORT
|
|
value: "{{ .redisPort }}"
|
|
- name: REDIS_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mastodon-secrets
|
|
key: redis.password
|
|
- name: SMTP_SERVER
|
|
value: "{{ .smtp.server }}"
|
|
- name: SMTP_PORT
|
|
value: "{{ .smtp.port }}"
|
|
- name: SMTP_LOGIN
|
|
value: "{{ .smtp.user }}"
|
|
- name: SMTP_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mastodon-secrets
|
|
key: smtpPassword
|
|
- name: SMTP_FROM_ADDRESS
|
|
value: "{{ .smtp.from }}"
|
|
- name: SMTP_AUTH_METHOD
|
|
value: "{{ .smtp.authMethod }}"
|
|
- name: SMTP_ENABLE_STARTTLS
|
|
value: "{{ .smtp.enableStarttls }}"
|
|
- name: SMTP_TLS
|
|
value: "{{ .smtp.tls }}"
|
|
- name: STREAMING_API_BASE_URL
|
|
value: "wss://{{ .domain }}"
|
|
- name: WEB_CONCURRENCY
|
|
value: "2"
|
|
- name: MAX_THREADS
|
|
value: "5"
|
|
volumeMounts:
|
|
- name: assets
|
|
mountPath: /opt/mastodon/public/assets
|
|
- name: system
|
|
mountPath: /opt/mastodon/public/system
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 768Mi
|
|
limits:
|
|
memory: 1280Mi
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: http
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /health
|
|
port: http
|
|
initialDelaySeconds: 20
|
|
periodSeconds: 5
|
|
timeoutSeconds: 3
|
|
volumes:
|
|
- name: assets
|
|
persistentVolumeClaim:
|
|
claimName: mastodon-assets
|
|
- name: system
|
|
persistentVolumeClaim:
|
|
claimName: mastodon-system
|