From a4e1f2953e461cf3004e38ffdfabbe24c9986b43 Mon Sep 17 00:00:00 2001 From: Zoe Roux Date: Thu, 19 Mar 2026 09:51:20 +0100 Subject: [PATCH] Promote kyoo-v5 --- apps/kyoo-v5.yaml | 120 ----------------- apps/kyoo.yaml | 265 ++++++++++++++++++++++--------------- apps/postgres/cluster.yaml | 3 + 3 files changed, 160 insertions(+), 228 deletions(-) delete mode 100644 apps/kyoo-v5.yaml diff --git a/apps/kyoo-v5.yaml b/apps/kyoo-v5.yaml deleted file mode 100644 index 6bc1411..0000000 --- a/apps/kyoo-v5.yaml +++ /dev/null @@ -1,120 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: kyoo-v5 - namespace: argocd -spec: - project: default - destination: - server: https://kubernetes.default.svc - namespace: kyoo-next - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - source: - repoURL: https://github.com/zoriya/Kyoo - path: chart - targetRevision: master - # repoURL: ghcr.io/zoriya/helm-charts - # chart: kyoo - # targetRevision: edge - helm: - valuesObject: - global: - image: - tag: edge - imagePullPolicy: Always - postgres: - shared: - host: kyoo-v5-postgres - extraEnv: - - name: OTEL_EXPORTER_OTLP_ENDPOINT - value: "http://otel-collector.otel.svc:4317" - - name: OTEL_EXPORTER_OTLP_PROTOCOL - value: "grpc" - postgres: - enabled: true - persistence: - size: 16Gi - kyoo: - address: https://beta.sdg.moe - transcoderAcceleration: nvidia - auth: - guestClaims: '{"permissions": ["users.read", "apikeys.read", "core.read", "core.play"], "verified": true}' - apikeys: - extra: - - name: admin - existingSecret: admin-apikey - apikeyKey: uuid - claims: '{"permissions": ["users.read", "users.write", "apikeys.read", "apikeys.write", "users.delete", "core.read", "core.write", "core.play", "scanner.trigger"], "verified": true}' - api: - persistence: - size: 32Gi - transcoder: - runtimeClass: nvidia - persistence: - size: 32Gi - ingress: - enabled: true - host: beta.sdg.moe - ingressClassName: cilium - annotations: - cert-manager.io/cluster-issuer: letsencrypt - acme.cert-manager.io/http01-edit-in-place: "true" - tls: true - tlsSecret: kyoo-tls - extraObjects: - - apiVersion: v1 - kind: Secret - metadata: - name: bigsecret - type: Opaque - stringData: - postgres_user: kyoo_all - postgres_password: watchSomething4me - scanner_apikey: scanner-triquarter4u - - - apiVersion: v1 - kind: PersistentVolume - metadata: - name: kyoo-v5-medias - spec: - accessModes: - - ReadWriteOnce - capacity: - storage: 200Ti - csi: - driver: zfs.csi.openebs.io - fsType: zfs - volumeAttributes: - openebs.io/poolname: ocean - volumeHandle: "medias" - persistentVolumeReclaimPolicy: Retain - - apiVersion: v1 - kind: PersistentVolumeClaim - metadata: - name: media - spec: - storageClassName: "" - volumeName: kyoo-v5-medias - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 200Ti - - - apiVersion: external-secrets.io/v1 - kind: ExternalSecret - metadata: - name: admin-apikey - spec: - refreshPolicy: CreatedOnce - dataFrom: - - sourceRef: - generatorRef: - apiVersion: generators.external-secrets.io/v1alpha1 - kind: ClusterGenerator - name: uuid diff --git a/apps/kyoo.yaml b/apps/kyoo.yaml index 6e7eadb..346ea18 100644 --- a/apps/kyoo.yaml +++ b/apps/kyoo.yaml @@ -13,136 +13,185 @@ spec: prune: true selfHeal: true syncOptions: - - CreateNamespace=true + - CreateNamespace=true source: - # repoURL: ghcr.io/zoriya/helm-charts - # chart: kyoo - # targetRevision: 4.7.1 - repoURL: https://github.com/zoriya/kyoo + repoURL: https://github.com/zoriya/Kyoo path: chart - targetRevision: feat/runtime-class + targetRevision: feat/volumes helm: valuesObject: global: image: - tag: 4.7.1 - meilisearch: - enabled: true - rabbitmq: - enabled: true - postgresql: - enabled: true + tag: edge + imagePullPolicy: Always + postgres: + shared: + host: postgres-cluster-rw.postgres + userOverride: kyoo + databaseOverride: kyoo + sslmodeOverride: verify-full + extraEnv: + - name: OTEL_EXPORTER_OTLP_ENDPOINT + value: "http://otel-collector.otel.svc:4317" + - name: OTEL_EXPORTER_OTLP_PROTOCOL + value: "grpc" + - name: PGSSLCERT + value: /var/postgres-ssl/tls.crt + - name: PGSSLKEY + value: /var/postgres-ssl/tls.key + - name: PGSSLROOTCERT + value: /var/postgres-ssl/ca.crt + extraVolumes: + - name: postgres-cert + secret: + secretName: postgres-kyoo + defaultMode: 0640 + - name: media + persistentVolumeClaim: + claimName: media + extraVolumeMounts: + - name: postgres-cert + mountPath: /var/postgres-ssl kyoo: address: https://kyoo.sdg.moe transcoderAcceleration: nvidia - oidc_providers: - - name: Authentik - logo: https://avatars.githubusercontent.com/u/82976448?s=48&v=4 - existingSecret: sso - clientIdKey: clientId - clientSecretKey: clientSecret - scope: "email openid profile" - authMethod: ClientSecretBasic - authorizationAddress: https://authentik.sdg.moe/application/o/authorize/ - tokenAddress: https://authentik.sdg.moe/application/o/token/ - profileAddress: https://authentik.sdg.moe/application/o/userinfo/ - autosync: - replicaCount: 0 - back: - replicaCount: 0 + auth: + guestClaims: '{"permissions": ["users.read", "apikeys.read", "core.read", "core.play"], "verified": true}' + apikeys: + extra: + - name: admin + existingSecret: admin-apikey + apikeyKey: uuid + claims: '{"permissions": ["users.read", "users.write", "apikeys.read", "apikeys.write", "users.delete", "core.read", "core.write", "core.play", "scanner.trigger"], "verified": true}' + # oidc_providers: + # - name: Authentik + # logo: https://avatars.githubusercontent.com/u/82976448?s=48&v=4 + # existingSecret: sso + # clientIdKey: clientId + # clientSecretKey: clientSecret + # scope: "email openid profile" + # authMethod: ClientSecretBasic + # authorizationAddress: https://authentik.sdg.moe/application/o/authorize/ + # tokenAddress: https://authentik.sdg.moe/application/o/token/ + # profileAddress: https://authentik.sdg.moe/application/o/userinfo/ + api: persistence: - size: 20Gi - front: - replicaCount: 0 - matcher: - replicaCount: 0 - scanner: - replicaCount: 0 + size: 32Gi transcoder: - replicaCount: 0 runtimeClass: nvidia persistence: - size: 10Gi - kyoo_transcoder: - extraEnv: - - name: GOCODER_PREFIX - value: /video + size: 32Gi + auth: + securityContext: + fsGroup: 10001 + kyoo_auth: + containerSecurityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 10001 + runAsNonRoot: true + runAsUser: 10001 ingress: enabled: true + host: kyoo.sdg.moe ingressClassName: cilium annotations: cert-manager.io/cluster-issuer: letsencrypt acme.cert-manager.io/http01-edit-in-place: "true" - host: kyoo.sdg.moe tls: true tlsSecret: kyoo-tls - media: - baseMountPath: /medias - volumeMounts: - - name: medias - mountPath: /medias - readOnly: true - volumes: - - name: medias - persistentVolumeClaim: - claimName: medias extraObjects: - - apiVersion: v1 - kind: Secret - metadata: - name: bigsecret - type: Opaque - stringData: - # yes those aren't really secrets, i'll change it for v5 soonish - kyoo_apikeys: yHXWGsjfjE6sy6UxavqmTUYxgCFYek - tmdb_apikey: "" - tvdb_apikey: "" - tvdb_pin: "" - MEILI_MASTER_KEY: barkLike8SuperDucks - postgres_user: kyoo_all - postgres_password: watchSomething4me - rabbitmq_user: kyoo_all - rabbitmq_password: youAreAmazing2 - rabbitmq_cookie: mmmGoodCookie + - apiVersion: v1 + kind: Secret + metadata: + name: bigsecret + type: Opaque + stringData: + postgres_user: kyoo_all + postgres_password: watchSomething4me + scanner_apikey: scanner-triquarter4u - - apiVersion: v1 - kind: PersistentVolume - metadata: - name: kyoo-medias - spec: - accessModes: - - ReadWriteOnce - capacity: - storage: 200Ti - csi: - driver: zfs.csi.openebs.io - fsType: zfs - volumeAttributes: - openebs.io/poolname: ocean - volumeHandle: "medias" - persistentVolumeReclaimPolicy: Retain - - apiVersion: v1 - kind: PersistentVolumeClaim - metadata: - name: medias - spec: - storageClassName: "" - volumeName: kyoo-medias - accessModes: - - ReadWriteOnce - resources: - requests: + - apiVersion: postgresql.cnpg.io/v1 + kind: Database + metadata: + name: kyoo-db + namespace: postgres + spec: + name: kyoo + owner: kyoo + cluster: + name: postgres-cluster + databaseReclaimPolicy: delete + + - apiVersion: cert-manager.io/v1 + kind: Certificate + metadata: + name: postgres-kyoo + spec: + secretName: postgres-kyoo + usages: + - client auth + # same as pg user + commonName: kyoo + issuerRef: + name: postgres-ca + kind: ClusterIssuer + group: cert-manager.io + + - apiVersion: v1 + kind: PersistentVolume + metadata: + name: kyoo-medias + spec: + accessModes: + - ReadWriteOnce + capacity: storage: 200Ti + csi: + driver: zfs.csi.openebs.io + fsType: zfs + volumeAttributes: + openebs.io/poolname: ocean + volumeHandle: "medias" + persistentVolumeReclaimPolicy: Retain + - apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: media + spec: + storageClassName: "" + volumeName: kyoo-medias + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 200Ti - - apiVersion: external-secrets.io/v1 - kind: ExternalSecret - metadata: - name: sso - spec: - refreshInterval: 24h - secretStoreRef: - kind: ClusterSecretStore - name: bitwarden - dataFrom: - - extract: - key: kyoo-sso + - apiVersion: external-secrets.io/v1 + kind: ExternalSecret + metadata: + name: admin-apikey + spec: + refreshPolicy: CreatedOnce + dataFrom: + - sourceRef: + generatorRef: + apiVersion: generators.external-secrets.io/v1alpha1 + kind: ClusterGenerator + name: uuid + + - apiVersion: external-secrets.io/v1 + kind: ExternalSecret + metadata: + name: sso + spec: + refreshInterval: 24h + secretStoreRef: + kind: ClusterSecretStore + name: bitwarden + dataFrom: + - extract: + key: kyoo-sso diff --git a/apps/postgres/cluster.yaml b/apps/postgres/cluster.yaml index fa01b12..595d84f 100644 --- a/apps/postgres/cluster.yaml +++ b/apps/postgres/cluster.yaml @@ -43,3 +43,6 @@ spec: - name: immich login: true disablePassword: true + - name: kyoo + login: true + disablePastword: true