yonote/onprem-deploy
17
0
Fork 0
Code Pull Requests Releases Activity

Remove-Bitnami-Dependencies #7

Merged
stuart.armstrong merged 11 commits from Remove-Bitnami-Dependencies into 2.0.0 2025-12-08 11:15:43 +00:00
Conversation 0 Commits 11 Files Changed 8 +54 -259
4 changed files with 54 additions and 259 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 214f94f8b5 - Show all commits

8
yonote-chart-service/Chart.yaml
View File

@ -1,6 +1,6 @@
apiVersion: v2 apiVersion: v2
name: yonote-chart name: yonote-chart
version: 1.3.0 version: 2.0.0
description: description:
Generic application Helm chart. Generic application Helm chart.
This chart includes multiple dependencies. The base of this chart is derived from the Dysnix app chart. This chart includes multiple dependencies. The base of this chart is derived from the Dysnix app chart.
@ -53,12 +53,6 @@ dependencies:
condition: minio.enabled condition: minio.enabled
alias: minio alias: minio
# - name: app
# version: "0.3.15"
# repository: https://artifacts.wilix.dev/repository/helm-dysnix
# condition: keycloak.enabled
# alias: keycloak
- name: keycloakx - name: keycloakx
version: "1.3.2" version: "1.3.2"
repository: https://codecentric.github.io/helm-charts repository: https://codecentric.github.io/helm-charts

13
yonote-chart-service/secret-values.yaml
View File

@ -13,7 +13,7 @@ global:
UTILS_SECRET: "7bd5e9ac4415dd0dbf6b7721e2a21e9427b268cd0140c7516d13dece5024d479" # Сгенерируйте уникальный случайный ключ. Формат не важен, но вы все равно можете использовать`openssl rand -hex 32` в вашем терминале, чтобы создать это. UTILS_SECRET: "7bd5e9ac4415dd0dbf6b7721e2a21e9427b268cd0140c7516d13dece5024d479" # Сгенерируйте уникальный случайный ключ. Формат не важен, но вы все равно можете использовать`openssl rand -hex 32` в вашем терминале, чтобы создать это.
TELEGRAM_BOT_TOKEN: "1234" TELEGRAM_BOT_TOKEN: "1234"
UNSPLASH_API_ACCESS_KEY: "a-yGo6HpRP6jNfravx4Bz-oiPrRnH_5-24Xa9ZPlePE" UNSPLASH_API_ACCESS_KEY: "a-yGo6HpRP6jNfravx4Bz-oiPrRnH_5-24Xa9ZPlePE"
LICENSE_KEY: "eyJhbGciOiJSUzUxMiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjAzNDA0NTYsImV4cCI6MTc2MzA2NzU5OX0.Umhd1az0qC8EXEiC8xvVuqrxG2oEePGGWa_RAYWgzSKavXy7qnaIn_pjK8J56UfP8nDLVC6rxgjPhs0g8bZfrDslYrzMuiWstUt5TDwFDfjZbqHvxzShkBZ5FUSM-qFD3qdGnfBucKdt046CY40_S0hlN3Rjl7WasnOZHnyTlHpbVeaFTwc8fsWL0IxBOxCF73F7hI4S7FC15ANwUD4WwKQDCGxYJ5ZTn5uYZII9WZ2wjWC-__xGEehZ7cHmwRAPcm471zEwkUY9sXRoMjITtTbtFkCChpp8BPC1zBUdWVPgtMqFnFbtjhtmDiCiQeebVqz9tjE_wgU6gBhNpJhXaA" # Обратитесь в отдел продаж для получения LICENSE_KEY: "" # Обратитесь в отдел продаж для получения
SERVICE_WORKER_PUBLIC_KEY: "1234" SERVICE_WORKER_PUBLIC_KEY: "1234"
SERVICE_WORKER_PRIVATE_KEY: "1234" SERVICE_WORKER_PRIVATE_KEY: "1234"
# Генерация ключей (web-push) Service Worker # Генерация ключей (web-push) Service Worker
@ -38,8 +38,9 @@ minio:
keycloak: keycloak:
database: database:
password: password1 password: password1
#secrets: secrets:
# secrets: secrets:
# stringData: stringData:
# KEYCLOAK_ADMIN_PASSWORD: secret KEYCLOAK_ADMIN_PASSWORD: secret
# KC_DB_PASSWORD: "password1" KC_DB_PASSWORD: "password1"
OIDC_CLIENT_SECRET: "iS3jOA3Z7zXBwSN8EzJm36ybz57JNgpR"

169
yonote-chart-service/templates/realm-configmap.yaml
View File

@ -1,169 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: realm-export
data:
realm-export.json: |
{
"realm": "yonote",
"enabled": true,
"notBefore": 1647809856,
"defaultSignatureAlgorithm": "RS256",
"revokeRefreshToken": false,
"refreshTokenMaxReuse": 0,
"accessTokenLifespan": 300,
"accessTokenLifespanForImplicitFlow": 900,
"ssoSessionIdleTimeout": 1800,
"ssoSessionMaxLifespan": 36000,
"ssoSessionIdleTimeoutRememberMe": 0,
"ssoSessionMaxLifespanRememberMe": 0,
"offlineSessionIdleTimeout": 2592000,
"offlineSessionMaxLifespanEnabled": false,
"offlineSessionMaxLifespan": 5184000,
"clientSessionIdleTimeout": 0,
"clientSessionMaxLifespan": 0,
"clientOfflineSessionIdleTimeout": 0,
"clientOfflineSessionMaxLifespan": 0,
"accessCodeLifespan": 60,
"accessCodeLifespanUserAction": 300,
"accessCodeLifespanLogin": 1800,
"actionTokenGeneratedByAdminLifespan": 43200,
"actionTokenGeneratedByUserLifespan": 300,
"oauth2DeviceCodeLifespan": 600,
"oauth2DevicePollingInterval": 5,
"sslRequired": "external",
"registrationAllowed": true,
"registrationEmailAsUsername": true,
"rememberMe": true,
"verifyEmail": false,
"loginWithEmailAllowed": true,
"duplicateEmailsAllowed": false,
"resetPasswordAllowed": true,
"editUsernameAllowed": false,
"bruteForceProtected": false,
"permanentLockout": false,
"maxFailureWaitSeconds": 900,
"minimumQuickLoginWaitSeconds": 60,
"waitIncrementSeconds": 60,
"quickLoginCheckMilliSeconds": 1000,
"maxDeltaTimeSeconds": 43200,
"failureFactor": 30,
"clients": [
{
"clientId": "{{ .Values.global.yonote.config.plain.data.OIDC_CLIENT_ID }}",
"secret": "{{ .Values.global.yonote.config.secret.stringData.OIDC_CLIENT_SECRET }}",
"redirectUris": [
"https://*.{{ .Values.global.yonote.baseListenAddress }}/*",
"http://*.{{ .Values.global.yonote.baseListenAddress }}/*",
"http://team.{{ .Values.global.yonote.baseListenAddress }}/*",
"https://team.{{ .Values.global.yonote.baseListenAddress }}/*",
"https://team.{{ .Values.global.yonote.baseListenAddress }}/auth/oidc.callback/*"
],
"baseUrl": "https://team.{{ .Values.global.yonote.baseListenAddress }}",
"enabled": true,
"publicClient": false,
"protocol": "openid-connect",
"attributes": {
"client.secret": "{{ .Values.global.yonote.config.secret.stringData.OIDC_CLIENT_SECRET }}",
"display.on.consent.screen": "true"
},
"authenticationFlowBindingOverrides": {},
"fullScopeAllowed": false,
"protocolMappers": [
{
"name": "oidc-display-name",
"protocol": "openid-connect",
"protocolMapper": "oidc-usermodel-attribute-mapper",
"consentRequired": false,
"config": {
"userinfo.token.claim": "true",
"user.attribute": "{{ .Values.global.yonote.config.plain.data.OIDC_DISPLAY_NAME }}",
"id.token.claim": "true",
"access.token.claim": "true",
"claim.name": "{{ .Values.global.yonote.config.plain.data.OIDC_DISPLAY_NAME }}",
"jsonType.label": "String"
}
}
],
"defaultClientScopes": ["openid", "email"]
}
],
"identityProviders": [],
"internationalizationEnabled": true,
"clientScopes": [
{
"name": "openid",
"protocol": "openid-connect",
"attributes": {
"include.in.token.scope": "true",
"display.on.consent.screen": "true",
"consent.screen.text": "{{ .Values.global.yonote.config.plain.data.OIDC_DISPLAY_NAME }}"
},
"protocolMappers": []
},
{
"name": "email",
"protocol": "openid-connect",
"attributes": {
"include.in.token.scope": "true",
"display.on.consent.screen": "true"
},
"protocolMappers": [
{
"id": "56fe6d23-690a-465c-bc36-99bff8fef6eb",
"name": "email verified",
"protocol": "openid-connect",
"protocolMapper": "oidc-usermodel-property-mapper",
"consentRequired": false,
"config": {
"userinfo.token.claim": "true",
"user.attribute": "emailVerified",
"id.token.claim": "true",
"access.token.claim": "true",
"claim.name": "email_verified",
"jsonType.label": "boolean"
}
},
{
"id": "2c6acd0e-b776-48f5-9c3b-7bfdbbe712dc",
"name": "email",
"protocol": "openid-connect",
"protocolMapper": "oidc-usermodel-property-mapper",
"consentRequired": false,
"config": {
"userinfo.token.claim": "true",
"user.attribute": "email",
"id.token.claim": "true",
"access.token.claim": "true",
"claim.name": "email",
"jsonType.label": "String"
}
}
]
}
],
"browserSecurityHeaders": {
"contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';"
},
"webAuthnPolicyRpEntityName": "keycloak",
"webAuthnPolicySignatureAlgorithms": ["ES256"],
"webAuthnPolicyRpId": "",
"webAuthnPolicyAttestationConveyancePreference": "not specified",
"webAuthnPolicyAuthenticatorAttachment": "not specified",
"webAuthnPolicyRequireResidentKey": "not specified",
"webAuthnPolicyUserVerificationRequirement": "not specified",
"webAuthnPolicyCreateTimeout": 0,
"webAuthnPolicyAvoidSameAuthenticatorRegister": false,
"webAuthnPolicyAcceptableAaguids": [],
"webAuthnPolicyPasswordlessRpEntityName": "keycloak",
"webAuthnPolicyPasswordlessSignatureAlgorithms": ["ES256"],
"webAuthnPolicyPasswordlessRpId": "",
"webAuthnPolicyPasswordlessAttestationConveyancePreference": "not specified",
"webAuthnPolicyPasswordlessAuthenticatorAttachment": "not specified",
"webAuthnPolicyPasswordlessRequireResidentKey": "not specified",
"webAuthnPolicyPasswordlessUserVerificationRequirement": "not specified",
"webAuthnPolicyPasswordlessCreateTimeout": 0,
"webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister": false,
"webAuthnPolicyPasswordlessAcceptableAaguids": [],
"smtpServer": {}
}

123
yonote-chart-service/values.yaml
View File

@ -2,7 +2,7 @@ global:
name: yonote-app name: yonote-app
yonote: yonote:
dbMigrationEnv: production-ssl-disabled # Режим подключения к базе данных при выполнении миграций. При использовании SSL подключения, установите значение `production` dbMigrationEnv: production-ssl-disabled # Режим подключения к базе данных при выполнении миграций. При использовании SSL подключения, установите значение `production`
baseListenAddress: onprem-test.stands.wilix.dev # Доменный адрес для yonote baseListenAddress: example.com # Доменный адрес для yonote
config: config:
plain: plain:
@ -32,13 +32,13 @@ global:
OIDC_DISPLAY_NAME: email OIDC_DISPLAY_NAME: email
OIDC_SCOPES: openid email OIDC_SCOPES: openid email
OIDC_CLIENT_ID: yonote OIDC_CLIENT_ID: yonote
OIDC_AUTH_URI: 'https://auth.onprem-test.stands.wilix.dev/realms/yonote/protocol/openid-connect/auth' # URL для авторизации пользователей через OpenID Connect (OIDC). Пользователь перенаправляется на этот адрес для входа в систему. OIDC_AUTH_URI: 'https://auth.example.com/realms/yonote/protocol/openid-connect/auth' # URL для авторизации пользователей через OpenID Connect (OIDC). Пользователь перенаправляется на этот адрес для входа в систему.
OIDC_LOGOUT_URI: 'https://auth.onprem-test.stands.wilix.dev/realms/yonote/protocol/openid-connect/logout' # URL для выхода из системы через OIDC. Пользователь перенаправляется на этот адрес для завершения сессии и выхода. OIDC_LOGOUT_URI: 'https://auth.example.com/realms/yonote/protocol/openid-connect/logout' # URL для выхода из системы через OIDC. Пользователь перенаправляется на этот адрес для завершения сессии и выхода.
OIDC_TOKEN_URI: 'https://auth.onprem-test.stands.wilix.dev/realms/yonote/protocol/openid-connect/token' # URL для получения токенов доступа и обновления. Этот адрес используется для обмена авторизационным кодом на токены OIDC_TOKEN_URI: 'https://auth.example.com/realms/yonote/protocol/openid-connect/token' # URL для получения токенов доступа и обновления. Этот адрес используется для обмена авторизационным кодом на токены
OIDC_USERINFO_URI: 'https://auth.onprem-test.stands.wilix.dev/realms/yonote/protocol/openid-connect/userinfo' # URL для получения информации о пользователе. Используется для получения данных профиля пользователя на основе его токена. OIDC_USERINFO_URI: 'https://auth.example.com/realms/yonote/protocol/openid-connect/userinfo' # URL для получения информации о пользователе. Используется для получения данных профиля пользователя на основе его токена.
AWS_S3_ACL: private AWS_S3_ACL: private
AWS_S3_UPLOAD_BUCKET_URL: 'https://api-s3.onprem-test.stands.wilix.dev' # Адрес API S3 хранилища AWS_S3_UPLOAD_BUCKET_URL: 'https://api-s3.example.com' # Адрес API S3 хранилища
AWS_S3_UPLOAD_BUCKET_NAME: yonote-bucket # Имя хранилища AWS_S3_UPLOAD_BUCKET_NAME: yonote-bucket # Имя хранилища
AWS_REGION: "RU" AWS_REGION: "RU"
AWS_S3_UPLOAD_MAX_SIZE: "226214400" # Максимальный размер хранилища AWS_S3_UPLOAD_MAX_SIZE: "226214400" # Максимальный размер хранилища
@ -78,12 +78,12 @@ ingress:
namespace: yonote-onprem namespace: yonote-onprem
ingressClassName: traefik ingressClassName: traefik
tls: tls:
secretName: "app.onprem-test.stands.wilix.dev-tls" secretName: "example.com-tls"
hosts: hosts:
- "app.onprem-test.stands.wilix.dev" - "app.example.com"
- "team.onprem-test.stands.wilix.dev" - "team.example.com"
rules: rules:
- host: "app.onprem-test.stands.wilix.dev" - host: "app.example.com"
paths: paths:
- path: / - path: /
pathType: Prefix pathType: Prefix
@ -105,7 +105,7 @@ ingress:
service: service:
name: yonote-collaboration name: yonote-collaboration
port: 80 port: 80
- host: "team.onprem-test.stands.wilix.dev" - host: "team.example.com"
paths: paths:
- path: / - path: /
pathType: Prefix pathType: Prefix
@ -128,8 +128,8 @@ ingress:
name: yonote-collaboration name: yonote-collaboration
port: 80 port: 80
annotations: #annotations:
cert-manager.io/cluster-issuer: letsencrypt.rancher.wilix.dev # Если используете # cert-manager.io/cluster-issuer: # Если используете
yonote-web: yonote-web:
fullnameOverride: yonote-web fullnameOverride: yonote-web
@ -147,7 +147,7 @@ yonote-web:
initContainers: initContainers:
- name: yonote-migration - name: yonote-migration
image: images.updates.yonote.ru/yonote:1.19.8 image: images.updates.yonote.ru/yonote:1.22.11
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
command: command:
- /bin/sh - /bin/sh
@ -506,7 +506,7 @@ yonote-database:
storage: storage:
requestedSize: 5Gi requestedSize: 5Gi
className: "longhorn" className: ""
resources: resources:
limits: limits:
@ -525,7 +525,7 @@ yonote-redis:
storage: storage:
requestedSize: 1Gi requestedSize: 1Gi
className: "longhorn" className: ""
resources: resources:
limits: limits:
cpu: 1 cpu: 1
@ -538,7 +538,6 @@ minio:
enabled: true enabled: true
name: minio name: minio
fullnameOverride: yonote-minio fullnameOverride: yonote-minio
#customUser: yonote
nameOverride: yonote-minio nameOverride: yonote-minio
mode: standalone mode: standalone
rootUser: admin rootUser: admin
@ -550,36 +549,38 @@ minio:
persistence: persistence:
enabled: true enabled: true
annotations:
helm.sh/resource-policy: keep
size: 1Gi size: 1Gi
storageClass: "longhorn" storageClass: ""
ingress: ingress:
enabled: true enabled: true
hosts: hosts:
- s3.onprem-test.stands.wilix.dev - s3.example.com
ingressClassName: traefik ingressClassName: traefik
path: '/' path: '/'
annotations: annotations:
kubernetes.io/ingress.class: traefik kubernetes.io/ingress.class: traefik
cert-manager.io/cluster-issuer: letsencrypt.rancher.wilix.dev # Если используете #cert-manager.io/cluster-issuer: letsencrypt.rancher.wilix.dev # Если используете
tls: tls:
- hosts: - hosts:
- "s3.onprem-test.stands.wilix.dev" - "s3.example.com"
secretName: "s3.onprem-test.stands.wilix.dev-tls" secretName: "example.com-tls"
consoleIngress: consoleIngress:
enabled: true enabled: true
hosts: hosts:
- api-s3.onprem-test.stands.wilix.dev - api-s3.example.com
ingressClassName: traefik ingressClassName: traefik
path: '/' path: '/'
annotations: annotations:
kubernetes.io/ingress.class: traefik kubernetes.io/ingress.class: traefik
cert-manager.io/cluster-issuer: letsencrypt.rancher.wilix.dev # Если используете #cert-manager.io/cluster-issuer: letsencrypt.rancher.wilix.dev # Если используете
tls: tls:
- hosts: - hosts:
- "api-s3.onprem-test.stands.wilix.dev" - "api-s3.example.com"
secretName: "api-s3.onprem-test.stands.wilix.dev" secretName: "example.com-tls"
resources: resources:
requests: requests:
@ -598,11 +599,11 @@ keycloak:
nameOverride: yonote-keycloak nameOverride: yonote-keycloak
image: image:
repository: quay.io/keycloak/keycloak #images.updates.yonote.ru/yonote-keycloak repository: images.updates.yonote.ru/yonote-keycloak
tag: 19.0.3 tag: latest
args: args:
- start-dev #--spi-login-protocol-openid-connect-legacy-logout-redirect-uri=true --import-realm - start-dev --spi-login-protocol-openid-connect-legacy-logout-redirect-uri=true --import-realm
cache: cache:
stack: custom stack: custom
@ -611,80 +612,48 @@ keycloak:
enabled: "false" enabled: "false"
extraEnv: | extraEnv: |
#- name: KC_LOG_LEVEL
# value: DEBUG
- name: KEYCLOAK_ADMIN - name: KEYCLOAK_ADMIN
value: root valueFrom:
#valueFrom: secretKeyRef:
# secretKeyRef: name: {{ include "keycloak.fullname" . }}-admin-creds
# name: {{ include "keycloak.fullname" . }}-admin-creds key: user
# key: user
- name: KEYCLOAK_ADMIN_PASSWORD - name: KEYCLOAK_ADMIN_PASSWORD
value: ropoMBhQB1jwfr5y37u0GzaYmOwmXdDeFfjGC2 valueFrom:
#valueFrom: secretKeyRef:
# secretKeyRef: name: {{ include "keycloak.fullname" . }}-admin-creds
# name: {{ include "keycloak.fullname" . }}-admin-creds key: password
# key: password
- name: BASENAME_FOR_SUBDOMAIN - name: BASENAME_FOR_SUBDOMAIN
value: onprem-test.stands.wilix.dev value: example.com
- name: KC_HOSTNAME_STRICT - name: KC_HOSTNAME_STRICT
value: "false" value: "false"
#- name: KC_HOSTNAME_ADMIN
# value: auth.onprem-test.stands.wilix.dev/admin
- name: KC_HOSTNAME - name: KC_HOSTNAME
value: auth.onprem-test.stands.wilix.dev value: auth.example.com
- name: KC_HOSTNAME_STRICT_HTTPS - name: KC_HOSTNAME_STRICT_HTTPS
value: "false" value: "false"
- name: KC_HOSTNAME_PATH - name: KC_HOSTNAME_PATH
value: "/" value: "/"
#- name: KC_DB_URL
# value: jdbc:postgresql://yonote-database:5432/keycloak
- name: KC_HTTP_ENABLED - name: KC_HTTP_ENABLED
value: "true" value: "true"
#- name: KC_PROXY
# value: edge
#- name: JAVA_OPTS_APPEND
# value: -Djgroups.dns.query=keycloak-headless
#- name: KC_PROXY_HEADERS
# value: "xforwarded"
- name: PROXY_ADDRESS_FORWARDING - name: PROXY_ADDRESS_FORWARDING
value: "true" value: "true"
# extraVolumes: |
# - name: realm-export
# configMap:
# name: realm-export
# extraVolumeMounts: |
# - name: realm-export
# mountPath: /opt/keycloak/data/import
# readOnly: true
http: http:
relativePath: "/" relativePath: "/"
ingress: ingress:
enabled: true enabled: true
hostname: auth.onprem-test.stands.wilix.dev hostname: auth.example.com
ingressClassName: traefik ingressClassName: traefik
tls: tls:
- hosts: - hosts:
- "auth.onprem-test.stands.wilix.dev" - "auth.example.com"
secretName: "auth.onprem-test.stands.wilix.dev-tls" secretName: "example.com-tls"
annotations: annotations:
kubernetes.io/ingress.class: traefik kubernetes.io/ingress.class: traefik
cert-manager.io/cluster-issuer: letsencrypt.rancher.wilix.dev #Если используете #cert-manager.io/cluster-issuer: #Если используете
#nginx.ingress.kubernetes.io/proxy-buffer-size: "256k"
#nginx.ingress.kubernetes.io/proxy-buffers: "8 256k"
#nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
#nginx.ingress.kubernetes.io/large-client-header-buffers: "8 256k"
#nginx.ingress.kubernetes.io/proxy-set-headers: |
# X-Forwarded-For: $proxy_protocol_addr
# X-Forwarded-Proto: $scheme
# Host: $host
#nginx.ingress.kubernetes.io/use-forwarded-headers: "true"
rules: rules:
- host: "auth.onprem-test.stands.wilix.dev" - host: "auth.example.com"
paths: paths:
- path: / - path: /
pathType: ImplementationSpecific pathType: ImplementationSpecific