From bacc31dcdb03655310ac9a62495ca7435fe9b786 Mon Sep 17 00:00:00 2001 From: Jeffrey Smeets Date: Tue, 2 Jun 2026 19:32:03 +0200 Subject: [PATCH] Fix kustomization: remove shelfmark/docuseal, recreate affine gateway files --- affine/affine/affine-config-pvc.yaml | 12 ++++ affine/affine/affine-pvc.yaml | 12 ++++ affine/affine/affine-svc.yaml | 14 +++++ affine/affine/affine.yaml | 82 +++++++++++++++++++++++++ affine/httproute.yaml | 46 ++++++++++++++ affine/postgres/postgres.yaml | 55 +++++++++++++++++ affine/postgres/postgresql-pvc.yaml | 12 ++++ affine/postgres/postgresql-svc.yaml | 14 +++++ affine/redis/redis-svc.yaml | 14 +++++ affine/redis/redis.yaml | 28 +++++++++ argocd/applications/affine.yaml | 28 +++++++++ envoy-gateway/affine/certificate.yaml | 14 +++++ envoy-gateway/affine/gateway-patch.yaml | 19 ++++++ envoy-gateway/kustomization.yaml | 14 ----- infisical/Infisical-secrets/affine.yaml | 22 +++++++ 15 files changed, 372 insertions(+), 14 deletions(-) create mode 100644 affine/affine/affine-config-pvc.yaml create mode 100644 affine/affine/affine-pvc.yaml create mode 100644 affine/affine/affine-svc.yaml create mode 100644 affine/affine/affine.yaml create mode 100644 affine/httproute.yaml create mode 100644 affine/postgres/postgres.yaml create mode 100644 affine/postgres/postgresql-pvc.yaml create mode 100644 affine/postgres/postgresql-svc.yaml create mode 100644 affine/redis/redis-svc.yaml create mode 100644 affine/redis/redis.yaml create mode 100644 argocd/applications/affine.yaml create mode 100644 envoy-gateway/affine/certificate.yaml create mode 100644 envoy-gateway/affine/gateway-patch.yaml create mode 100644 infisical/Infisical-secrets/affine.yaml diff --git a/affine/affine/affine-config-pvc.yaml b/affine/affine/affine-config-pvc.yaml new file mode 100644 index 0000000..1a6a4b8 --- /dev/null +++ b/affine/affine/affine-config-pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: affine-config-pvc + namespace: affine +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn-static + resources: + requests: + storage: 1Gi diff --git a/affine/affine/affine-pvc.yaml b/affine/affine/affine-pvc.yaml new file mode 100644 index 0000000..e9ef922 --- /dev/null +++ b/affine/affine/affine-pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: affine-data-pvc + namespace: affine +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn-static + resources: + requests: + storage: 30Gi diff --git a/affine/affine/affine-svc.yaml b/affine/affine/affine-svc.yaml new file mode 100644 index 0000000..a5ab9de --- /dev/null +++ b/affine/affine/affine-svc.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: affine + namespace: affine +spec: + selector: + app: affine + type: ClusterIP + ports: + - name: http + protocol: TCP + port: 3010 + targetPort: 3010 diff --git a/affine/affine/affine.yaml b/affine/affine/affine.yaml new file mode 100644 index 0000000..df9ac83 --- /dev/null +++ b/affine/affine/affine.yaml @@ -0,0 +1,82 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: affine + namespace: affine +spec: + replicas: 1 + selector: + matchLabels: + app: affine + serviceName: affine + template: + metadata: + labels: + app: affine + spec: + restartPolicy: Always + terminationGracePeriodSeconds: 30 + initContainers: + - name: affine-migration + image: ghcr.io/toeverything/affine:stable + command: ["sh", "-c", "node ./scripts/self-host-predeploy.js"] + env: + - name: DATABASE_URL + valueFrom: + secretKeyRef: + name: affine-secrets + key: DATABASE_URL + - name: REDIS_SERVER_HOST + value: affine-valkey.affine.svc.cluster.local + - name: AFFINE_INDEXER_ENABLED + value: "false" + volumeMounts: + - name: affine-storage + mountPath: /root/.affine/storage + - name: affine-config + mountPath: /root/.affine/config + containers: + - name: affine + image: ghcr.io/toeverything/affine:stable + resources: + requests: + cpu: 200m + memory: 512Mi + limits: + cpu: 1000m + memory: 2Gi + ports: + - containerPort: 3010 + name: http + env: + - name: NODE_ENV + value: production + - name: AFFINE_SERVER_HOST + value: affine.jsme.be + - name: AFFINE_SERVER_HTTPS + value: "true" + - name: AFFINE_SERVER_PORT + value: "3010" + - name: AFFINE_INDEXER_ENABLED + value: "false" + - name: DATABASE_URL + valueFrom: + secretKeyRef: + name: affine-secrets + key: DATABASE_URL + - name: REDIS_SERVER_HOST + value: affine-valkey.affine.svc.cluster.local + - name: REDIS_SERVER_PORT + value: "6379" + volumeMounts: + - name: affine-storage + mountPath: /root/.affine/storage + - name: affine-config + mountPath: /root/.affine/config + volumes: + - name: affine-storage + persistentVolumeClaim: + claimName: affine-data-pvc + - name: affine-config + persistentVolumeClaim: + claimName: affine-config-pvc diff --git a/affine/httproute.yaml b/affine/httproute.yaml new file mode 100644 index 0000000..0da5f32 --- /dev/null +++ b/affine/httproute.yaml @@ -0,0 +1,46 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: affine-route + namespace: affine +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-internal + namespace: envoy-gateway + sectionName: affine + hostnames: + - "affine.jsme.be" + rules: + - matches: + - path: + type: PathPrefix + value: / + filters: + - type: RequestHeaderModifier + requestHeaderModifier: + set: + - name: X-Forwarded-Host + value: "affine.jsme.be" + - name: X-Forwarded-Proto + value: https + - type: ResponseHeaderModifier + responseHeaderModifier: + set: + - name: Strict-Transport-Security + value: "max-age=31536000; includeSubDomains" + - name: X-Content-Type-Options + value: nosniff + - name: X-Frame-Options + value: SAMEORIGIN + - name: Referrer-Policy + value: strict-origin-when-cross-origin + - name: Permissions-Policy + value: "camera=(), microphone=(), geolocation=(), payment=()" + backendRefs: + - name: affine + port: 3010 + kind: Service + group: "" + weight: 1 diff --git a/affine/postgres/postgres.yaml b/affine/postgres/postgres.yaml new file mode 100644 index 0000000..d28c6d0 --- /dev/null +++ b/affine/postgres/postgres.yaml @@ -0,0 +1,55 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: affine-postgresql + namespace: affine +spec: + replicas: 1 + selector: + matchLabels: + app: affine-postgresql + serviceName: affine-postgresql + template: + metadata: + labels: + app: affine-postgresql + spec: + restartPolicy: Always + terminationGracePeriodSeconds: 60 + containers: + - name: affine-postgresql + image: pgvector/pgvector:pg17 + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi + ports: + - containerPort: 5432 + volumeMounts: + - name: affine-postgresql-database + mountPath: /var/lib/postgresql/volumes/pgdata + env: + - name: PGDATA + value: /var/lib/postgresql/volumes/pgdata/data + - name: POSTGRES_DB + valueFrom: + secretKeyRef: + name: affine-secrets + key: db_name + - name: POSTGRES_USER + valueFrom: + secretKeyRef: + name: affine-secrets + key: db_user + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: affine-secrets + key: db_password + volumes: + - name: affine-postgresql-database + persistentVolumeClaim: + claimName: affine-postgresql-pvc diff --git a/affine/postgres/postgresql-pvc.yaml b/affine/postgres/postgresql-pvc.yaml new file mode 100644 index 0000000..32c5ec3 --- /dev/null +++ b/affine/postgres/postgresql-pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: affine-postgresql-pvc + namespace: affine +spec: + accessModes: + - ReadWriteMany + storageClassName: longhorn + resources: + requests: + storage: 5Gi diff --git a/affine/postgres/postgresql-svc.yaml b/affine/postgres/postgresql-svc.yaml new file mode 100644 index 0000000..8153dc7 --- /dev/null +++ b/affine/postgres/postgresql-svc.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: affine-postgresql + namespace: affine +spec: + selector: + app: affine-postgresql + type: ClusterIP + ports: + - name: postgresql + protocol: TCP + port: 5432 + targetPort: 5432 diff --git a/affine/redis/redis-svc.yaml b/affine/redis/redis-svc.yaml new file mode 100644 index 0000000..e0fca32 --- /dev/null +++ b/affine/redis/redis-svc.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: affine-valkey + namespace: affine +spec: + selector: + app: affine-valkey + type: ClusterIP + ports: + - name: valkey + protocol: TCP + port: 6379 + targetPort: 6379 diff --git a/affine/redis/redis.yaml b/affine/redis/redis.yaml new file mode 100644 index 0000000..d622f39 --- /dev/null +++ b/affine/redis/redis.yaml @@ -0,0 +1,28 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: affine-valkey + namespace: affine +spec: + replicas: 1 + selector: + matchLabels: + app: affine-valkey + template: + metadata: + labels: + app: affine-valkey + spec: + restartPolicy: Always + containers: + - name: affine-valkey + image: valkey/valkey:9 + resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 200m + memory: 256Mi + ports: + - containerPort: 6379 diff --git a/argocd/applications/affine.yaml b/argocd/applications/affine.yaml new file mode 100644 index 0000000..51e6675 --- /dev/null +++ b/argocd/applications/affine.yaml @@ -0,0 +1,28 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: affine + namespace: argocd +spec: + project: default + source: + repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git + path: affine + targetRevision: main + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: affine + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - PruneLast=true + ignoreDifferences: + - group: "" + kind: PersistentVolumeClaim + jsonPointers: + - /spec/volumeName diff --git a/envoy-gateway/affine/certificate.yaml b/envoy-gateway/affine/certificate.yaml new file mode 100644 index 0000000..e678e70 --- /dev/null +++ b/envoy-gateway/affine/certificate.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: affine-tls + namespace: envoy-gateway +spec: + secretName: affine-tls + privateKey: + rotationPolicy: Always + issuerRef: + name: azure-dns + kind: ClusterIssuer + dnsNames: + - affine.jsme.be diff --git a/envoy-gateway/affine/gateway-patch.yaml b/envoy-gateway/affine/gateway-patch.yaml new file mode 100644 index 0000000..5cf82c9 --- /dev/null +++ b/envoy-gateway/affine/gateway-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: affine + protocol: HTTPS + port: 443 + hostname: "affine.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: affine + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: affine-tls + namespace: envoy-gateway diff --git a/envoy-gateway/kustomization.yaml b/envoy-gateway/kustomization.yaml index 89597a5..59fba79 100644 --- a/envoy-gateway/kustomization.yaml +++ b/envoy-gateway/kustomization.yaml @@ -35,7 +35,6 @@ resources: - torrent/certificate.yaml - truenas/certificate.yaml - unifi/certificate.yaml - - shelfmark/certificate.yaml - wikijs/certificate.yaml - zipline/certificate.yaml - vaultwarden/certificate.yaml @@ -46,7 +45,6 @@ resources: - ollama/certificate.yaml - openwebui/certificate.yaml - searxng/certificate.yaml - - docuseal/certificate.yaml - affine/certificate.yaml - pelican/certificate.yaml @@ -214,12 +212,6 @@ patches: kind: Gateway name: gateway-internal path: resume/resume-gateway-patch.yaml - - target: - group: gateway.networking.k8s.io - version: v1 - kind: Gateway - name: gateway-internal - path: shelfmark/gateway-patch.yaml - target: group: gateway.networking.k8s.io version: v1 @@ -292,12 +284,6 @@ patches: kind: Gateway name: gateway-internal path: searxng/gateway-patch.yaml - - target: - group: gateway.networking.k8s.io - version: v1 - kind: Gateway - name: gateway-internal - path: docuseal/gateway-patch.yaml - target: group: gateway.networking.k8s.io version: v1 diff --git a/infisical/Infisical-secrets/affine.yaml b/infisical/Infisical-secrets/affine.yaml new file mode 100644 index 0000000..7ab6160 --- /dev/null +++ b/infisical/Infisical-secrets/affine.yaml @@ -0,0 +1,22 @@ +apiVersion: secrets.infisical.com/v1alpha1 +kind: InfisicalSecret +metadata: + name: affine-secrets + namespace: infisical +spec: + hostAPI: https://infisical.jsme.be + resyncInterval: 30 + authentication: + universalAuth: + secretsScope: + projectSlug: "kubernetes" + envSlug: "prod" + secretsPath: "/affine" + recursive: true + credentialsRef: + secretName: infisical-universal-auth + secretNamespace: infisical + managedSecretReference: + secretName: affine-secrets + secretNamespace: affine + secretType: Opaque