Promote kyoo-v5

apps/kyoo-v5.yaml

@@ -1,120 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: kyoo-v5
-  namespace: argocd
-spec:
-  project: default
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: kyoo-next
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-  source:
-    repoURL: https://github.com/zoriya/Kyoo
-    path: chart
-    targetRevision: master
-    # repoURL: ghcr.io/zoriya/helm-charts
-    # chart: kyoo
-    # targetRevision: edge
-    helm:
-      valuesObject:
-        global:
-          image:
-            tag: edge
-            imagePullPolicy: Always
-          postgres:
-            shared:
-              host: kyoo-v5-postgres
-          extraEnv:
-            - name: OTEL_EXPORTER_OTLP_ENDPOINT
-              value: "http://otel-collector.otel.svc:4317"
-            - name: OTEL_EXPORTER_OTLP_PROTOCOL
-              value: "grpc"
-        postgres:
-          enabled: true
-          persistence:
-            size: 16Gi
-        kyoo:
-          address: https://beta.sdg.moe
-          transcoderAcceleration: nvidia
-          auth:
-            guestClaims: '{"permissions": ["users.read", "apikeys.read", "core.read", "core.play"], "verified": true}'
-            apikeys:
-              extra:
-                - name: admin
-                  existingSecret: admin-apikey
-                  apikeyKey: uuid
-                  claims: '{"permissions": ["users.read", "users.write", "apikeys.read", "apikeys.write", "users.delete", "core.read", "core.write", "core.play", "scanner.trigger"], "verified": true}'
-        api:
-          persistence:
-            size: 32Gi
-        transcoder:
-          runtimeClass: nvidia
-          persistence:
-            size: 32Gi
-        ingress:
-          enabled: true
-          host: beta.sdg.moe
-          ingressClassName: cilium
-          annotations:
-            cert-manager.io/cluster-issuer: letsencrypt
-            acme.cert-manager.io/http01-edit-in-place: "true"
-          tls: true
-          tlsSecret: kyoo-tls
-        extraObjects:
-          - apiVersion: v1
-            kind: Secret
-            metadata:
-              name: bigsecret
-            type: Opaque
-            stringData:
-              postgres_user: kyoo_all
-              postgres_password: watchSomething4me
-              scanner_apikey: scanner-triquarter4u
-
-          - apiVersion: v1
-            kind: PersistentVolume
-            metadata:
-              name: kyoo-v5-medias
-            spec:
-              accessModes:
-                - ReadWriteOnce
-              capacity:
-                storage: 200Ti
-              csi:
-                driver: zfs.csi.openebs.io
-                fsType: zfs
-                volumeAttributes:
-                  openebs.io/poolname: ocean
-                volumeHandle: "medias"
-              persistentVolumeReclaimPolicy: Retain
-          - apiVersion: v1
-            kind: PersistentVolumeClaim
-            metadata:
-              name: media
-            spec:
-              storageClassName: ""
-              volumeName: kyoo-v5-medias
-              accessModes:
-                - ReadWriteOnce
-              resources:
-                requests:
-                  storage: 200Ti
-
-          - apiVersion: external-secrets.io/v1
-            kind: ExternalSecret
-            metadata:
-              name: admin-apikey
-            spec:
-              refreshPolicy: CreatedOnce
-              dataFrom:
-                - sourceRef:
-                    generatorRef:
-                      apiVersion: generators.external-secrets.io/v1alpha1
-                      kind: ClusterGenerator
-                      name: uuid

apps/kyoo.yaml

@@ -13,136 +13,185 @@ spec:
       prune: true
       selfHeal: true
     syncOptions:
-    - CreateNamespace=true
+      - CreateNamespace=true
   source:
-    # repoURL: ghcr.io/zoriya/helm-charts
+    repoURL: https://github.com/zoriya/Kyoo
-    # chart: kyoo
-    # targetRevision: 4.7.1
-    repoURL: https://github.com/zoriya/kyoo
     path: chart
-    targetRevision: feat/runtime-class
+    targetRevision: feat/volumes
     helm:
       valuesObject:
         global:
           image:
-            tag: 4.7.1
+            tag: edge
-        meilisearch:
+            imagePullPolicy: Always
-          enabled: true
+          postgres:
-        rabbitmq:
+            shared:
-          enabled: true
+              host: postgres-cluster-rw.postgres
-        postgresql:
+              userOverride: kyoo
-          enabled: true
+              databaseOverride: kyoo
+              sslmodeOverride: verify-full
+          extraEnv:
+            - name: OTEL_EXPORTER_OTLP_ENDPOINT
+              value: "http://otel-collector.otel.svc:4317"
+            - name: OTEL_EXPORTER_OTLP_PROTOCOL
+              value: "grpc"
+            - name: PGSSLCERT
+              value: /var/postgres-ssl/tls.crt
+            - name: PGSSLKEY
+              value: /var/postgres-ssl/tls.key
+            - name: PGSSLROOTCERT
+              value: /var/postgres-ssl/ca.crt
+          extraVolumes:
+            - name: postgres-cert
+              secret:
+                secretName: postgres-kyoo
+                defaultMode: 0640
+            - name: media
+              persistentVolumeClaim:
+                claimName: media
+          extraVolumeMounts:
+            - name: postgres-cert
+              mountPath: /var/postgres-ssl
         kyoo:
           address: https://kyoo.sdg.moe
           transcoderAcceleration: nvidia
-          oidc_providers:
+          auth:
-            - name: Authentik
+            guestClaims: '{"permissions": ["users.read", "apikeys.read", "core.read", "core.play"], "verified": true}'
-              logo: https://avatars.githubusercontent.com/u/82976448?s=48&v=4
+            apikeys:
-              existingSecret: sso
+              extra:
-              clientIdKey: clientId
+                - name: admin
-              clientSecretKey: clientSecret
+                  existingSecret: admin-apikey
-              scope: "email openid profile"
+                  apikeyKey: uuid
-              authMethod: ClientSecretBasic
+                  claims: '{"permissions": ["users.read", "users.write", "apikeys.read", "apikeys.write", "users.delete", "core.read", "core.write", "core.play", "scanner.trigger"], "verified": true}'
-              authorizationAddress: https://authentik.sdg.moe/application/o/authorize/
+            # oidc_providers:
-              tokenAddress: https://authentik.sdg.moe/application/o/token/
+            #   - name: Authentik
-              profileAddress: https://authentik.sdg.moe/application/o/userinfo/
+            #     logo: https://avatars.githubusercontent.com/u/82976448?s=48&v=4
-        autosync:
+            #     existingSecret: sso
-          replicaCount: 0
+            #     clientIdKey: clientId
-        back:
+            #     clientSecretKey: clientSecret
-          replicaCount: 0
+            #     scope: "email openid profile"
+            #     authMethod: ClientSecretBasic
+            #     authorizationAddress: https://authentik.sdg.moe/application/o/authorize/
+            #     tokenAddress: https://authentik.sdg.moe/application/o/token/
+            #     profileAddress: https://authentik.sdg.moe/application/o/userinfo/
+        api:
           persistence:
-            size: 20Gi
+            size: 32Gi
-        front:
-          replicaCount: 0
-        matcher:
-          replicaCount: 0
-        scanner:
-          replicaCount: 0
         transcoder:
-          replicaCount: 0
           runtimeClass: nvidia
           persistence:
-            size: 10Gi
+            size: 32Gi
-          kyoo_transcoder:
+        auth:
-            extraEnv:
+          securityContext:
-            - name: GOCODER_PREFIX
+            fsGroup: 10001
-              value: /video
+          kyoo_auth:
+            containerSecurityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                  - ALL
+              readOnlyRootFilesystem: true
+              runAsGroup: 10001
+              runAsNonRoot: true
+              runAsUser: 10001
         ingress:
           enabled: true
+          host: kyoo.sdg.moe
           ingressClassName: cilium
           annotations:
             cert-manager.io/cluster-issuer: letsencrypt
             acme.cert-manager.io/http01-edit-in-place: "true"
-          host: kyoo.sdg.moe
           tls: true
           tlsSecret: kyoo-tls
-        media:
-          baseMountPath: /medias
-          volumeMounts:
-          - name: medias
-            mountPath: /medias
-            readOnly: true
-          volumes:
-          - name: medias
-            persistentVolumeClaim:
-              claimName: medias
         extraObjects:
-        - apiVersion: v1
+          - apiVersion: v1
-          kind: Secret
+            kind: Secret
-          metadata:
+            metadata:
-            name: bigsecret
+              name: bigsecret
-          type: Opaque
+            type: Opaque
-          stringData:
+            stringData:
-            # yes those aren't really secrets, i'll change it for v5 soonish
+              postgres_user: kyoo_all
-            kyoo_apikeys: yHXWGsjfjE6sy6UxavqmTUYxgCFYek
+              postgres_password: watchSomething4me
-            tmdb_apikey: ""
+              scanner_apikey: scanner-triquarter4u
-            tvdb_apikey: ""
-            tvdb_pin: ""
-            MEILI_MASTER_KEY: barkLike8SuperDucks
-            postgres_user: kyoo_all
-            postgres_password: watchSomething4me
-            rabbitmq_user: kyoo_all
-            rabbitmq_password: youAreAmazing2
-            rabbitmq_cookie: mmmGoodCookie
 
-        - apiVersion: v1
+          - apiVersion: postgresql.cnpg.io/v1
-          kind: PersistentVolume
+            kind: Database
-          metadata:
+            metadata:
-            name: kyoo-medias
+              name: kyoo-db
-          spec:
+              namespace: postgres
-            accessModes:
+            spec:
-            - ReadWriteOnce
+              name: kyoo
-            capacity:
+              owner: kyoo
-              storage: 200Ti
+              cluster:
-            csi:
+                name: postgres-cluster
-              driver: zfs.csi.openebs.io
+              databaseReclaimPolicy: delete
-              fsType: zfs
+
-              volumeAttributes:
+          - apiVersion: cert-manager.io/v1
-                openebs.io/poolname: ocean
+            kind: Certificate
-              volumeHandle: "medias"
+            metadata:
-            persistentVolumeReclaimPolicy: Retain
+              name: postgres-kyoo
-        - apiVersion: v1
+            spec:
-          kind: PersistentVolumeClaim
+              secretName: postgres-kyoo
-          metadata:
+              usages:
-            name: medias
+                - client auth
-          spec:
+              # same as pg user
-            storageClassName: ""
+              commonName: kyoo
-            volumeName: kyoo-medias
+              issuerRef:
-            accessModes:
+                name: postgres-ca
-            - ReadWriteOnce
+                kind: ClusterIssuer
-            resources:
+                group: cert-manager.io
-              requests:
+
+          - apiVersion: v1
+            kind: PersistentVolume
+            metadata:
+              name: kyoo-medias
+            spec:
+              accessModes:
+                - ReadWriteOnce
+              capacity:
                 storage: 200Ti
+              csi:
+                driver: zfs.csi.openebs.io
+                fsType: zfs
+                volumeAttributes:
+                  openebs.io/poolname: ocean
+                volumeHandle: "medias"
+              persistentVolumeReclaimPolicy: Retain
+          - apiVersion: v1
+            kind: PersistentVolumeClaim
+            metadata:
+              name: media
+            spec:
+              storageClassName: ""
+              volumeName: kyoo-medias
+              accessModes:
+                - ReadWriteOnce
+              resources:
+                requests:
+                  storage: 200Ti
 
-        - apiVersion: external-secrets.io/v1
+          - apiVersion: external-secrets.io/v1
-          kind: ExternalSecret
+            kind: ExternalSecret
-          metadata:
+            metadata:
-            name: sso
+              name: admin-apikey
-          spec:
+            spec:
-            refreshInterval: 24h
+              refreshPolicy: CreatedOnce
-            secretStoreRef:
+              dataFrom:
-              kind: ClusterSecretStore
+                - sourceRef:
-              name: bitwarden
+                    generatorRef:
-            dataFrom:
+                      apiVersion: generators.external-secrets.io/v1alpha1
-              - extract:
+                      kind: ClusterGenerator
-                  key: kyoo-sso
+                      name: uuid
+
+          - apiVersion: external-secrets.io/v1
+            kind: ExternalSecret
+            metadata:
+              name: sso
+            spec:
+              refreshInterval: 24h
+              secretStoreRef:
+                kind: ClusterSecretStore
+                name: bitwarden
+              dataFrom:
+                - extract:
+                    key: kyoo-sso

apps/postgres/cluster.yaml

@@ -43,3 +43,6 @@ spec:
     - name: immich
       login: true
       disablePassword: true
+    - name: kyoo
+      login: true
+      disablePastword: true