Fix kustomization: remove shelfmark/docuseal, recreate affine gateway files

affine/affine/affine-config-pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: affine-config-pvc
+  namespace: affine
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-static
+  resources:
+    requests:
+      storage: 1Gi

affine/affine/affine-pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: affine-data-pvc
+  namespace: affine
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-static
+  resources:
+    requests:
+      storage: 30Gi

affine/affine/affine-svc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: affine
+  namespace: affine
+spec:
+  selector:
+    app: affine
+  type: ClusterIP
+  ports:
+    - name: http
+      protocol: TCP
+      port: 3010
+      targetPort: 3010

affine/affine/affine.yaml

@@ -0,0 +1,82 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: affine
+  namespace: affine
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: affine
+  serviceName: affine
+  template:
+    metadata:
+      labels:
+        app: affine
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 30
+      initContainers:
+        - name: affine-migration
+          image: ghcr.io/toeverything/affine:stable
+          command: ["sh", "-c", "node ./scripts/self-host-predeploy.js"]
+          env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: affine-secrets
+                  key: DATABASE_URL
+            - name: REDIS_SERVER_HOST
+              value: affine-valkey.affine.svc.cluster.local
+            - name: AFFINE_INDEXER_ENABLED
+              value: "false"
+          volumeMounts:
+            - name: affine-storage
+              mountPath: /root/.affine/storage
+            - name: affine-config
+              mountPath: /root/.affine/config
+      containers:
+        - name: affine
+          image: ghcr.io/toeverything/affine:stable
+          resources:
+            requests:
+              cpu: 200m
+              memory: 512Mi
+            limits:
+              cpu: 1000m
+              memory: 2Gi
+          ports:
+            - containerPort: 3010
+              name: http
+          env:
+            - name: NODE_ENV
+              value: production
+            - name: AFFINE_SERVER_HOST
+              value: affine.jsme.be
+            - name: AFFINE_SERVER_HTTPS
+              value: "true"
+            - name: AFFINE_SERVER_PORT
+              value: "3010"
+            - name: AFFINE_INDEXER_ENABLED
+              value: "false"
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: affine-secrets
+                  key: DATABASE_URL
+            - name: REDIS_SERVER_HOST
+              value: affine-valkey.affine.svc.cluster.local
+            - name: REDIS_SERVER_PORT
+              value: "6379"
+          volumeMounts:
+            - name: affine-storage
+              mountPath: /root/.affine/storage
+            - name: affine-config
+              mountPath: /root/.affine/config
+      volumes:
+        - name: affine-storage
+          persistentVolumeClaim:
+            claimName: affine-data-pvc
+        - name: affine-config
+          persistentVolumeClaim:
+            claimName: affine-config-pvc

affine/httproute.yaml

@@ -0,0 +1,46 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: affine-route
+  namespace: affine
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: affine
+  hostnames:
+    - "affine.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            set:
+              - name: X-Forwarded-Host
+                value: "affine.jsme.be"
+              - name: X-Forwarded-Proto
+                value: https
+        - type: ResponseHeaderModifier
+          responseHeaderModifier:
+            set:
+              - name: Strict-Transport-Security
+                value: "max-age=31536000; includeSubDomains"
+              - name: X-Content-Type-Options
+                value: nosniff
+              - name: X-Frame-Options
+                value: SAMEORIGIN
+              - name: Referrer-Policy
+                value: strict-origin-when-cross-origin
+              - name: Permissions-Policy
+                value: "camera=(), microphone=(), geolocation=(), payment=()"
+      backendRefs:
+        - name: affine
+          port: 3010
+          kind: Service
+          group: ""
+          weight: 1

affine/postgres/postgres.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: affine-postgresql
+  namespace: affine
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: affine-postgresql
+  serviceName: affine-postgresql
+  template:
+    metadata:
+      labels:
+        app: affine-postgresql
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 60
+      containers:
+        - name: affine-postgresql
+          image: pgvector/pgvector:pg17
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          ports:
+            - containerPort: 5432
+          volumeMounts:
+            - name: affine-postgresql-database
+              mountPath: /var/lib/postgresql/volumes/pgdata
+          env:
+            - name: PGDATA
+              value: /var/lib/postgresql/volumes/pgdata/data
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: affine-secrets
+                  key: db_name
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: affine-secrets
+                  key: db_user
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: affine-secrets
+                  key: db_password
+      volumes:
+        - name: affine-postgresql-database
+          persistentVolumeClaim:
+            claimName: affine-postgresql-pvc

affine/postgres/postgresql-pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: affine-postgresql-pvc
+  namespace: affine
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 5Gi

affine/postgres/postgresql-svc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: affine-postgresql
+  namespace: affine
+spec:
+  selector:
+    app: affine-postgresql
+  type: ClusterIP
+  ports:
+    - name: postgresql
+      protocol: TCP
+      port: 5432
+      targetPort: 5432

affine/redis/redis-svc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: affine-valkey
+  namespace: affine
+spec:
+  selector:
+    app: affine-valkey
+  type: ClusterIP
+  ports:
+    - name: valkey
+      protocol: TCP
+      port: 6379
+      targetPort: 6379

affine/redis/redis.yaml

@@ -0,0 +1,28 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: affine-valkey
+  namespace: affine
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: affine-valkey
+  template:
+    metadata:
+      labels:
+        app: affine-valkey
+    spec:
+      restartPolicy: Always
+      containers:
+        - name: affine-valkey
+          image: valkey/valkey:9
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 256Mi
+          ports:
+            - containerPort: 6379

argocd/applications/affine.yaml

@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: affine
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git
+    path: affine
+    targetRevision: main
+    directory:
+      recurse: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: affine
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - PruneLast=true
+  ignoreDifferences:
+    - group: ""
+      kind: PersistentVolumeClaim
+      jsonPointers:
+        - /spec/volumeName

envoy-gateway/affine/certificate.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: affine-tls
+  namespace: envoy-gateway
+spec:
+  secretName: affine-tls
+  privateKey:
+    rotationPolicy: Always
+  issuerRef:
+    name: azure-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - affine.jsme.be

envoy-gateway/affine/gateway-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: affine
+    protocol: HTTPS
+    port: 443
+    hostname: "affine.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: affine
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: affine-tls
+          namespace: envoy-gateway

envoy-gateway/kustomization.yaml

@@ -30,7 +30,6 @@ resources:
   - technitium/technitium-backup-certificate.yaml
   - truenas/certificate.yaml
   - unifi/certificate.yaml
-  - shelfmark/certificate.yaml
   - wikijs/certificate.yaml
   - zipline/certificate.yaml
   - vaultwarden/certificate.yaml
@@ -41,7 +40,6 @@ resources:
   - ollama/certificate.yaml
   - openwebui/certificate.yaml
   - searxng/certificate.yaml
-  - docuseal/certificate.yaml
   - affine/certificate.yaml
   - pelican/certificate.yaml
 
@@ -179,12 +177,6 @@ patches:
       kind: Gateway
       name: gateway-internal
     path: resume/resume-gateway-patch.yaml
-  - target:
-      group: gateway.networking.k8s.io
-      version: v1
-      kind: Gateway
-      name: gateway-internal
-    path: shelfmark/gateway-patch.yaml
   - target:
       group: gateway.networking.k8s.io
       version: v1
@@ -257,12 +249,6 @@ patches:
       kind: Gateway
       name: gateway-internal
     path: searxng/gateway-patch.yaml
-  - target:
-      group: gateway.networking.k8s.io
-      version: v1
-      kind: Gateway
-      name: gateway-internal
-    path: docuseal/gateway-patch.yaml
   - target:
       group: gateway.networking.k8s.io
       version: v1

infisical/Infisical-secrets/affine.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: affine-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/affine"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: affine-secrets
+    secretNamespace: affine
+    secretType: Opaque