yonote/onprem-deploy
21
0
Fork 0
Code Pull Requests Releases Activity

clear-onprem #5

Closed
artem.drozdov wants to merge 14 commits from clear-onprem into main
pull from: clear-onprem
merge into: yonote:main
Conversation 0 Commits 14 Files Changed 20 +76 -192
9 changed files with 76 additions and 192 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit ad776209f4 - Show all commits

0
yonote-chart/templates/secret.yaml → secret.yaml
View File

6
yonote-chart/Chart.lock
View File

@ -28,6 +28,6 @@ dependencies:
version: 11.6.2 version: 11.6.2
- name: minio - name: minio
repository: https://charts.bitnami.com/bitnami repository: https://charts.bitnami.com/bitnami
version: 14.6.20 version: 14.0.0
digest: sha256:c5b8b9e07fb2f98522c86c4b5e0758d5adecd9d2493fa65d942c5fbcca316a9b digest: sha256:d885d7c44dc28f36c26f218ca8c5ae318aced1b312b31403d00aec70d1be1d78
generated: "2024-08-14T15:57:19.424501351+03:00" generated: "2024-08-16T13:31:48.832508252+03:00"

2
yonote-chart/Chart.yaml
View File

@ -60,7 +60,7 @@ dependencies:
alias: keycloak-database alias: keycloak-database
- name: minio - name: minio
version: "14.6.20" version: "14.0.0"
repository: https://charts.bitnami.com/bitnami repository: https://charts.bitnami.com/bitnami
condition: minio.enabled condition: minio.enabled
alias: minio alias: minio

BIN
yonote-chart/charts/minio-14.0.0.tgz Normal file
View File

Binary file not shown.

BIN
yonote-chart/charts/minio-14.6.20.tgz
View File

Binary file not shown.

26
yonote-chart/secret-values.yaml
View File

@ -3,8 +3,8 @@ global:
config: config:
secret: secret:
stringData: stringData:
DATABASE_URL: 'postgres://{{ .Values.global.postgresql.auth.username }}:{{ .Values.global.postgresql.auth.password }}@yonote-db:5432/{{ .Values.global.postgresql.auth.database }}' # DATABASE_URL: "postgres://{{ .Values.global.postgresql.auth.username }}:{{ .Values.global.postgresql.auth.password }}@yonote-db:5432/{{ .Values.global.postgresql.auth.database }}"
POSTGRES_PASSWORD: wsGZ6kXhr5 # POSTGRES_PASSWORD: "{{ .Values.global.postgresql.auth.password }}"
AWS_ACCESS_KEY_ID: "" # Ваш идентификатор ключа доступа к AWS. Поведение в SelfHosted: устанавливает логин сервис аккаунта для доступа приложения к Minio S3 хранилищу AWS_ACCESS_KEY_ID: "" # Ваш идентификатор ключа доступа к AWS. Поведение в SelfHosted: устанавливает логин сервис аккаунта для доступа приложения к Minio S3 хранилищу
AWS_SECRET_ACCESS_KEY: "minioadmin" # Ваш секретный ключ доступа AWS. Поведение в SelfHosted: устанавливает пароль сервис аккаунта для доступа приложения к Minio S3 хранилищу AWS_SECRET_ACCESS_KEY: "minioadmin" # Ваш секретный ключ доступа AWS. Поведение в SelfHosted: устанавливает пароль сервис аккаунта для доступа приложения к Minio S3 хранилищу
OIDC_CLIENT_SECRET: "Kdq8rk5Pv5RW1c5kHXpnyfrmMRzI9xSD" OIDC_CLIENT_SECRET: "Kdq8rk5Pv5RW1c5kHXpnyfrmMRzI9xSD"
@ -21,22 +21,24 @@ global:
# 2) Выполнить команду для генерации ключей # 2) Выполнить команду для генерации ключей
# npx web-push generate-vapid-keys # npx web-push generate-vapid-keys
# 3) Полученные значения ввести в .env файл (SERVICE_WORKER_PUBLIC_KEY, SERVICE_WORKER_PRIVATE_KEY) # 3) Полученные значения ввести в .env файл (SERVICE_WORKER_PUBLIC_KEY, SERVICE_WORKER_PRIVATE_KEY)
yonote-database:
global:
postgresql:
auth:
password: "wsGZ6kXhr5"
postgresPassword: "QQYw4UjOU"
postgresql:
auth:
password: "wsGZ6kXhr5"
postgresPassword: "QQYw4UjOU"
keycloak-app: keycloak-database:
global: global:
postgresql: postgresql:
auth: auth:
password: "tT9BqYdNyd1" password: "tT9BqYdNyd1"
keycloak: keycloak:
secrets:
secrets: secrets:
secrets: stringData:
stringData: KEYCLOAK_ADMIN_PASSWORD: "12345"
KEYCLOAK_ADMIN_PASSWORD: "12345" KC_DB_PASSWORD: "tT9BqYdNyd1"
KC_DB_PASSWORD: "tT9BqYdNyd1"

10
yonote-chart/traefic-http-to-https-redirect-middleware.yaml
View File

@ -1,10 +0,0 @@
{{- if eq $.Values.global.yonote.ingress.ingressClassName "traefik" }}
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: yonote-onprem-redirect-https
spec:
redirectScheme:
scheme: https
permanent: true
{{- end }}

10
yonote-chart/traefik-wss-headers-middleware.yaml
View File

@ -1,10 +0,0 @@
{{- if eq $.Values.global.yonote.ingress.ingressClassName "traefik" }}
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: yonote-onprem-wss-headers
spec:
headers:
customRequestHeaders:
X-Forwarded-Proto: https
{{- end }}

192
yonote-chart/values.yaml
View File

@ -1,9 +1,4 @@
global: global:
postgresql:
auth:
database: yonote
username: yonote
yonote: yonote:
dbMigrationEnv: production-ssl-disabled # Режим подключения к базе данных при выполнении миграций. При использовании SSL подключения, установите значение `production` dbMigrationEnv: production-ssl-disabled # Режим подключения к базе данных при выполнении миграций. При использовании SSL подключения, установите значение `production`
baseListenAddress: onprem-test.stands.wilix.dev baseListenAddress: onprem-test.stands.wilix.dev
@ -74,21 +69,6 @@ global:
cron_enabled: "true" cron_enabled: "true"
url: http://yonote-web/api/cron.schedule url: http://yonote-web/api/cron.schedule
# ingress:
# enabled: true
# hostname: 'app.onprem-test.stands.wilix.dev'
# ingressClassName: traefik
# path: '/'
# pathType: Prefix
# annotations:
# cert-manager.io/cluster-issuer: letsencrypt.rancher.wilix.dev
# # nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
# # nginx.ingress.kubernetes.io/configuration-snippet: |
# # more_set_headers "Host $http_host";
# # more_set_headers "X-Real-IP $remote_addr";
# # more_set_headers "X-Forwarded-Proto $scheme";
# # more_set_headers "X-Forwarded-For $proxy_add_x_forwarded_for";
ingress: ingress:
enabled: true enabled: true
name: yonote-ingress name: yonote-ingress
@ -227,26 +207,6 @@ yonote-web:
- secretRef: - secretRef:
name: yonote-secrets name: yonote-secrets
# ingress:
# enabled: true
# hostname: 'app.onprem-test.stands.wilix.dev'
# ingressClassName: traefik
# path: '/'
# pathType: Prefix
# annotations:
# cert-manager.io/cluster-issuer: letsencrypt.rancher.wilix.dev
# traefik.ingress.kubernetes.io/router.middlewares: '{{ .Release.Namespace }}-redirect-https@kubernetescrd,{{.Release.Namespace }}-wss-headers@kubernetescrd,kube-system-wilix-office-ipwhitelist@kubernetescrd'
# # nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
# # nginx.ingress.kubernetes.io/configuration-snippet: |
# # more_set_headers "Host $http_host";
# # more_set_headers "X-Real-IP $remote_addr";
# # more_set_headers "X-Forwarded-Proto $scheme";
# # more_set_headers "X-Forwarded-For $proxy_add_x_forwarded_for";
# extraTls:
# - hosts:
# - "app.onprem-test.stands.wilix.dev"
# secretName: "app.onprem-test.stands.wilix.dev"
podLabels: podLabels:
redis-client: 'true' redis-client: 'true'
@ -316,25 +276,6 @@ yonote-websocket:
port: 80 port: 80
targetPort: app targetPort: app
# ingress:
# enabled: true
# hostname: 'app.onprem-test.stands.wilix.dev'
# ingressClassName: traefik
# path: '/realtime'
# pathType: Prefix
# annotations:
# cert-manager.io/cluster-issuer: letsencrypt.rancher.wilix.dev
# traefik.ingress.kubernetes.io/router.middlewares: '{{ .Release.Namespace }}-redirect-https@kubernetescrd,{{.Release.Namespace }}-wss-headers@kubernetescrd,kube-system-wilix-office-ipwhitelist@kubernetescrd'
# # nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
# # nginx.ingress.kubernetes.io/configuration-snippet: |
# # more_set_headers "Host $http_host";
# # more_set_headers "X-Real-IP $remote_addr";
# # more_set_headers "X-Forwarded-Proto $scheme";
# # more_set_headers "X-Forwarded-For $proxy_add_x_forwarded_for";
# extraTls:
# - hosts:
# - "app.onprem-test.stands.wilix.dev"
# secretName: "app.onprem-test.stands.wilix.dev"
podLabels: podLabels:
redis-client: 'true' redis-client: 'true'
@ -405,27 +346,6 @@ yonote-whiteboard:
port: 80 port: 80
targetPort: app targetPort: app
# ingress:
# enabled: true
# hostname: 'app.onprem-test.stands.wilix.dev'
# ingressClassName: traefik
# path: '/whiteboard'
# pathType: Prefix
# annotations:
# cert-manager.io/cluster-issuer: letsencrypt.rancher.wilix.dev
# traefik.ingress.kubernetes.io/router.middlewares: '{{ .Release.Namespace }}-redirect-https@kubernetescrd,{{.Release.Namespace }}-wss-headers@kubernetescrd,kube-system-wilix-office-ipwhitelist@kubernetescrd'
# # nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
# # nginx.ingress.kubernetes.io/configuration-snippet: |
# # more_set_headers "Host $http_host";
# # more_set_headers "X-Real-IP $remote_addr";
# # more_set_headers "X-Forwarded-Proto $scheme";
# # more_set_headers "X-Forwarded-For $proxy_add_x_forwarded_for";
# extraTls:
# - hosts:
# - "app.onprem-test.stands.wilix.dev"
# secretName: "app.onprem-test.stands.wilix.dev"
podLabels: podLabels:
redis-client: 'true' redis-client: 'true'
@ -550,26 +470,6 @@ yonote-collaboration:
port: 80 port: 80
targetPort: app targetPort: app
# ingress:
# enabled: true
# hostname: 'app.onprem-test.stands.wilix.dev'
# ingressClassName: traefik
# path: '/collaboration'
# pathType: Prefix
# annotations:
# cert-manager.io/cluster-issuer: letsencrypt.rancher.wilix.dev
# traefik.ingress.kubernetes.io/router.middlewares: '{{ .Release.Namespace }}-redirect-https@kubernetescrd,{{.Release.Namespace }}-wss-headers@kubernetescrd,kube-system-wilix-office-ipwhitelist@kubernetescrd'
# # nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
# # nginx.ingress.kubernetes.io/configuration-snippet: |
# # more_set_headers "Host $http_host";
# # more_set_headers "X-Real-IP $remote_addr";
# # more_set_headers "X-Forwarded-Proto $scheme";
# # more_set_headers "X-Forwarded-For $proxy_add_x_forwarded_for";
# extraTls:
# - hosts:
# - "app.onprem-test.stands.wilix.dev"
# secretName: "app.onprem-test.stands.wilix.dev"
envFrom: envFrom:
- configMapRef: - configMapRef:
name: yonote-configs name: yonote-configs
@ -607,6 +507,11 @@ yonote-collaboration:
yonote-database: yonote-database:
enabled: true enabled: true
global:
postgresql:
auth:
database: "yonote"
username: "yonote"
fullnameOverride: yonote-db fullnameOverride: yonote-db
nameOverride: db nameOverride: db
@ -641,46 +546,13 @@ yonote-redis:
cpu: 50m cpu: 50m
memory: 128Mi memory: 128Mi
minio:
enabled: true
name: minio
fullnameOverride: yonote-minio
nameOverride: minio
accessKey: "minioadmin"
secretKey: "minioadminsecret"
persistence:
enabled: true
size: 500Mi
ingress:
enabled: true
hostname: 's3.onprem-test.stands.wilix.dev'
ingressClassName: traefik
path: '/'
pathType: Prefix
annotations:
kubernetes.io/ingress.class: traefik
cert-manager.io/cluster-issuer: letsencrypt.rancher.wilix.dev
extraTls:
- hosts:
- "s3.onprem-test.stands.wilix.dev"
secretName: "s3.onprem-test.stands.wilix.dev"
resources:
requests:
memory: 512Mi
cpu: 250m
limits:
memory: 1Gi
cpu: 500m
buckets:
- name: yonote-bucket
policy: none
keycloak-database: keycloak-database:
enabled: true enabled: true
global:
postgresql:
auth:
database: keycloak
username: keycloak
name: keycloak-database name: keycloak-database
fullnameOverride: yonote-keycloak-db fullnameOverride: yonote-keycloak-db
nameOverride: db nameOverride: db
@ -689,12 +561,6 @@ keycloak-database:
size: 512Mi size: 512Mi
keycloak: keycloak:
global:
postgresql:
auth:
database: keycloak
username: keycloak
enabled: true enabled: true
name: yonote-keycloak name: yonote-keycloak
fullnameOverride: yonote-keycloak fullnameOverride: yonote-keycloak
@ -717,7 +583,6 @@ keycloak:
KC_HOSTNAME: auth.onprem-test.stands.wilix.dev KC_HOSTNAME: auth.onprem-test.stands.wilix.dev
KC_DB: postgres KC_DB: postgres
KC_DB_URL: jdbc:postgresql://yonote-keycloak-db:5432/keycloak KC_DB_URL: jdbc:postgresql://yonote-keycloak-db:5432/keycloak
# KC_DB_URL_DATABASE: keycloak
KC_DB_USERNAME: keycloak KC_DB_USERNAME: keycloak
KC_HOSTNAME_STRICT_HTTPS: "false" KC_HOSTNAME_STRICT_HTTPS: "false"
KC_HOSTNAME_PATH: "/" KC_HOSTNAME_PATH: "/"
@ -778,3 +643,40 @@ keycloak:
# httpGet: # httpGet:
# path: / # path: /
# port: app # port: app
minio:
enabled: true
name: minio
fullnameOverride: yonote-minio
nameOverride: minio
accessKey: "minioadmin"
secretKey: "minioadminsecret"
persistence:
enabled: true
size: 500Mi
ingress:
enabled: true
hostname: 's3.onprem-test.stands.wilix.dev'
ingressClassName: traefik
path: '/'
pathType: Prefix
annotations:
kubernetes.io/ingress.class: traefik
cert-manager.io/cluster-issuer: letsencrypt.rancher.wilix.dev
extraTls:
- hosts:
- "s3.onprem-test.stands.wilix.dev"
secretName: "s3.onprem-test.stands.wilix.dev"
resources:
requests:
memory: 512Mi
cpu: 250m
limits:
memory: 1Gi
cpu: 500m
buckets:
- name: yonote-bucket
policy: none