diff --git a/apps/splitpro/cluster.yaml b/apps/splitpro/cluster.yaml new file mode 100644 index 0000000..6f457a5 --- /dev/null +++ b/apps/splitpro/cluster.yaml @@ -0,0 +1,33 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: splitpro-db + namespace: splitpro +spec: + bootstrap: + initdb: + database: splitpro + owner: splitpro + postInitApplicationSQL: + - CREATE EXTENSION IF NOT EXISTS pg_cron; + - GRANT USAGE ON SCHEMA cron TO splitpro; + - GRANT REFERENCES ON cron.job TO splitpro; + - GRANT EXECUTE ON FUNCTION cron.alter_job(bigint, text, text, text, text, boolean) TO splitpro; + enablePDB: false + imageName: ghcr.io/whyredfire/postgres-cnpg:18-sha-62e724e + instances: 1 + postgresql: + parameters: + cron.database_name: splitpro + cron.timezone: UTC + cron.use_background_workers: "on" + shared_preload_libraries: + - pg_cron + resources: + limits: + memory: 512Mi + requests: + cpu: 50m + memory: 128Mi + storage: + size: 1Gi diff --git a/apps/splitpro/deployment.yaml b/apps/splitpro/deployment.yaml new file mode 100644 index 0000000..9d49839 --- /dev/null +++ b/apps/splitpro/deployment.yaml @@ -0,0 +1,108 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: splitpro + namespace: splitpro +spec: + replicas: 1 + revisionHistoryLimit: 3 + selector: + matchLabels: + app.kubernetes.io/name: splitpro + strategy: + type: Recreate + template: + metadata: + labels: + app.kubernetes.io/name: splitpro + spec: + automountServiceAccountToken: false + containers: + - env: + - name: DATABASE_URL + valueFrom: + secretKeyRef: + key: uri + name: splitpro-db-app + - name: DEFAULT_HOMEPAGE + value: /balances + - name: HOSTNAME + value: 0.0.0.0 + - name: INVITE_ONLY + value: "false" + - name: NEXTAUTH_URL + value: https://split.whyredfire.dev + - name: NEXTAUTH_URL_INTERNAL + value: http://localhost:3000 + envFrom: + - secretRef: + name: splitpro + image: ghcr.io/whyredfire/splitpro:529739ab7f506ce258f6d09596ed8bb0833c20c1 + livenessProbe: + httpGet: + path: /api/auth/providers + port: http + name: splitpro + ports: + - containerPort: 3000 + name: http + readinessProbe: + httpGet: + path: /api/auth/providers + port: http + resources: + limits: + cpu: "1" + memory: 1Gi + requests: + cpu: 50m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + startupProbe: + failureThreshold: 60 + httpGet: + path: /api/auth/providers + port: http + periodSeconds: 5 + volumeMounts: + - mountPath: /app/uploads + name: uploads + - mountPath: /app/.next/cache + name: cache + - mountPath: /tmp + name: tmp + initContainers: + - command: + - sh + - -c + - until nc -z -w 2 splitpro-db-rw 5432; do echo waiting for database; sleep 2; done + image: ghcr.io/whyredfire/splitpro:529739ab7f506ce258f6d09596ed8bb0833c20c1 + name: wait-for-db + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + securityContext: + fsGroup: 1000 + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + volumes: + - emptyDir: + sizeLimit: 256Mi + name: cache + - emptyDir: + sizeLimit: 256Mi + name: tmp + - name: uploads + persistentVolumeClaim: + claimName: splitpro-uploads diff --git a/apps/splitpro/httproute.yaml b/apps/splitpro/httproute.yaml new file mode 100644 index 0000000..33d92a7 --- /dev/null +++ b/apps/splitpro/httproute.yaml @@ -0,0 +1,23 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + annotations: + argocd.argoproj.io/sync-wave: "2" + name: splitpro + namespace: splitpro +spec: + hostnames: + - split.whyredfire.dev + parentRefs: + - kind: Gateway + name: traefik-gateway + namespace: traefik + sectionName: websecure + rules: + - backendRefs: + - name: splitpro + port: 3000 + matches: + - path: + type: PathPrefix + value: / diff --git a/apps/splitpro/kustomization.yaml b/apps/splitpro/kustomization.yaml new file mode 100644 index 0000000..6625a1f --- /dev/null +++ b/apps/splitpro/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - sealed-secret.yaml + - cluster.yaml + - pvc.yaml + - deployment.yaml + - service.yaml + - httproute.yaml diff --git a/apps/splitpro/pvc.yaml b/apps/splitpro/pvc.yaml new file mode 100644 index 0000000..7edcb5b --- /dev/null +++ b/apps/splitpro/pvc.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: splitpro-uploads + namespace: splitpro +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 2Gi diff --git a/apps/splitpro/sealed-secret.yaml b/apps/splitpro/sealed-secret.yaml new file mode 100644 index 0000000..303b227 --- /dev/null +++ b/apps/splitpro/sealed-secret.yaml @@ -0,0 +1,14 @@ +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: splitpro + namespace: splitpro +spec: + encryptedData: + GOOGLE_CLIENT_ID: AgDRctXaM2WUp9CYS1HQaxq1F6qJ6wyuV5PRK1hhSYCGCpZwId6mT/M+YCGiPnvAqR2W0L0cJ199ytZ5aV7UBrgbLG6XK7jN1txxpdWTSq0pONPj2jOrUvqdToA/6hUCsQBW6oqshbhjV/H53PxmKzR/t2zTQ0xoI64FK81INBsyaCY1gzdZQWYZCkmDhBUrvzfprcI6ayTvOtMhJkXMFU/TNielxjQtmRKnjz1wqyKZkvie7ZS2oEzU7R+VuuoMQVyL/N1pcu8rd5/WaJxJNgtG0oTFtJMQMCKvV80nXRWTXaTCGtpd4Ior+COgUW1ruzxU7HvrOMeQk/pwRPtVuANA5XUgwABWJH+RMmSDTsmqFlqaIYluE4swYGeR2dvEVWv4PN7YjBuJzYrWOCntp571JLw9jJ8ffCCEETQiEYc65ZMochp1rayZaHFJXAoorS/AbOK5fBYpdwM7R9KYl9tGxYzNcqzihezqb2hZuIIyEQnCtKPJl68TywiDXcUiftwlIhf56v2Us9nYaHRsIVstot1FhkrO2DqYrRxJ9/k8wPeJjPFCqrpx56y9bqRiyq4R4tfAKv/iHTZ2d8hVUZ1Pr/bc2pqwjxtjzBlGBXrAC4xSQWf463wk5IvY2dthRq0LZsXd7c8zV8QN9ZGwtWgWulNB/VXIsv0LoI7lmujWbCAGcis8helOo1wRgYE/NVeD/SEpJGEPkzx9XRuplj+00WsjOYmsbfvtQIcOOJbEtM3d6vqLd+SeFswSg1z01YFX6gagPhHCbDqfy0+DFkkM3QVsAPxKrBwT + GOOGLE_CLIENT_SECRET: AgAkBnqzqC9srhWzQA/q7ZfMpgfTy+J0on856vHPrIS8oe5P30vciaGlgkQdf1oMLA5ovHaSq6x9AEqv7HRzoeSrdUSjswZce1akAcXU+wA0mQGzVsmaTpCERAJ7GXWmSgsvIQNQXF5N6BLiZliueDiMIy3sZYAcoffrZ5l22mWOSBlHCXXZqZoP+F4Y4tQrlO28NjlWGo1UBf83JZ6TZMtK7IOuYoMDsZo/NlE1x0zj3beMm1VLvHJXRn1plU06IwlIKH0xEed2izff4FQ7f4Q3Dqmtbz6PhTdVqy4HQvhIrkAl/6IwQCZdTWHRdgv6fXQWs+ZftoeRMHFXI0xB3YfbLoqO8Q2kDqgxSOM8Xixdbabq1v8u0EVZCNRryb+XuWwG46xWNPVF2Nl1SIaeLxWQhFGEXTUf9IqYH9fQ1kpqIlj5IgEa1MUWsx1eE+vik1shT20woU7Lj21Zcu3RZob92qMVNZHheB2Lzkcw+dP1BwRIwXTiLXfdyDDHXlajnkvkkrrcwO62K4zEIIS/LyoLt2vdk63mfXKSz343pnpOsN2hEqJSTkCx3CFhB4JBSybSFrBtljcCDjK95dvsTQq8qZKEqLFZEQjRWXxsiR9aoNo2MCmPA+dDfvsJ7/GZ8mnjyNdLw+UCxrTiyXMI0pAgezZZZf96KPGUL+LnRbJiTHxxsfk+q2/nMZeU+ftZdV0F7zrCUQhkyJZwhYk2XsblyHiKsPCvLHtKbhIXVpwnLdXPgw== + NEXTAUTH_SECRET: AgCdNnXbHEuOlg1UnJii5eGJVfBZh5nWaybBODJJK3FbyhYPuj2KhGfNB/ld529FpddAEDv1IGWwKAOaSCkhSv1Nh1P2NZj37jpgbsHx8vw1omLLSkWqtRf1m4AhHhEwQoY49dlAk4AxSkjk5IckH8PbbRWFXx8Ns8kAGrJLrp6i7EbxrkI3U+hbEz93sQwRJo8XOeYCEodr7JPKoYHwy5roAwB0PmFL56bZFfuCa9yEje4BFxdQMrm0grSDMotTDH3nTF6irq5HSOEgqnL7Tt3kHW+Uaz5mvUZcCxAMUoB9q2mjTjm8fiprybVfMmCsib3epcZGrn0DiPZhihePkrfL6vTaz0pm1Nr7qkbtXFVY3RWgZjFpmDyAl/of7ddh9VYQVmqVAhfI610Czqqyou0zFuvlOXGlp1ljp7FNiwo+r02WxYoJ1leikB+CCnVxd/ErELA0AVneGUcWzoKG6r+OlDzsfV/gp2LXanAq2jKyeZ09ARhkLs3PHzkoGDaOF1Dr+3ZCidrfV+GRcnr73P7QEQNO6R+tEmL+idKiLr4uI56zrFg/Vb5Yxk/jMr2Hrfw7ai/nV2A+eqgXFQammCEZlDyCS8GPX8ULervbG/n4JmXXMUtGB9esM40cfTlsNhhv7sBC2P8QkOI00wvgdiwcPkOE+1i33Sxd1Vt20d8EP6TMfwhofQz2zYdYQEWYmBgiG+zX7mwwh3awuA5uH+ooA5vFe/aHPvMYM2rbTYDihEISJt1b6cbCiE8+Iw== + template: + metadata: + name: splitpro + namespace: splitpro diff --git a/apps/splitpro/service.yaml b/apps/splitpro/service.yaml new file mode 100644 index 0000000..79f0a99 --- /dev/null +++ b/apps/splitpro/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: splitpro + namespace: splitpro +spec: + ports: + - name: http + port: 3000 + targetPort: http + selector: + app.kubernetes.io/name: splitpro diff --git a/argocd-apps/services/splitpro.yaml b/argocd-apps/services/splitpro.yaml new file mode 100644 index 0000000..dc83dfc --- /dev/null +++ b/argocd-apps/services/splitpro.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + annotations: + argocd.argoproj.io/sync-wave: "3" + name: splitpro + namespace: argocd +spec: + destination: + namespace: splitpro + server: https://kubernetes.default.svc + project: default + source: + path: apps/splitpro + repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git + targetRevision: main + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true