root-at-skic
e2adb79e2d
A Copier template for deploying Archify Sync with Argo CD: an app-of-apps, the server's Helm chart and its values, optional secrets through External Secrets and an optional static NFS volume for PostgreSQL.
73 lines
2.4 KiB
Django/Jinja
73 lines
2.4 KiB
Django/Jinja
{% macro render() %}
|
|
{%- set image = archify_sync.get('image', {}) %}
|
|
{%- set database = archify_sync.get('database', {}) %}
|
|
{%- set oidc = archify_sync.get('oidc', {}) %}
|
|
{%- set metrics = archify_sync.get('metrics', {}) %}
|
|
{%- set host = archify_sync.get('host', 'archify.example.com') %}
|
|
# Values for charts/archify-sync of the server repository.
|
|
image:
|
|
repository: {{ image.get('repository', 'registry.example.com/archify-sync') }}
|
|
tag: {{ image.get('tag', '0.1.0') | string | tojson }}
|
|
pullPolicy: IfNotPresent
|
|
{%- if image.get('pull_secret') %}
|
|
imagePullSecrets:
|
|
- name: {{ image.get('pull_secret') }}
|
|
{%- endif %}
|
|
|
|
# TLS ends at your ingress or edge proxy; people reach the server here.
|
|
publicUrl: https://{{ host }}
|
|
|
|
# The bundled PostgreSQL, its password and URL from Secret archify-sync-secrets
|
|
# (0100 with External Secrets, or made by hand).
|
|
postgresql:
|
|
enabled: true
|
|
existingSecret: archify-sync-secrets
|
|
{%- if database.get('nfs_path') %}
|
|
# The static NFS volume from 0150-archify-sync-storage.
|
|
existingClaim: archify-sync-database
|
|
{%- else %}
|
|
{%- if database.get('storage_class') %}
|
|
storageClass: {{ database.get('storage_class') }}
|
|
{%- endif %}
|
|
storage: {{ database.get('size', '8Gi') }}
|
|
{%- endif %}
|
|
|
|
config:
|
|
name: Archify Sync
|
|
membersCanInvite: {{ archify_sync.get('members_can_invite', false) | tojson }}
|
|
logJson: true
|
|
|
|
{%- if oidc.get('is_enabled', false) %}
|
|
oidc:
|
|
enabled: true
|
|
issuer: {{ oidc.get('issuer', 'https://sso.example.com/realms/home') }}
|
|
clientId: {{ oidc.get('client_id', 'archify-sync') }}
|
|
existingSecret: archify-sync-secrets
|
|
existingSecretKey: client-secret
|
|
label: {{ oidc.get('label', 'Keycloak') | tojson }}
|
|
allowedGroups: {{ oidc.get('allowed_groups', []) | tojson }}
|
|
adminGroups: {{ oidc.get('admin_groups', []) | tojson }}
|
|
{%- endif %}
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: {{ archify_sync.get('ingress_class', 'nginx') }}
|
|
host: {{ host }}
|
|
annotations:
|
|
# Edits travel over a WebSocket that stays open for hours.
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
|
nginx.ingress.kubernetes.io/proxy-body-size: 8m
|
|
|
|
metrics:
|
|
enabled: {{ metrics.get('is_enabled', true) | tojson }}
|
|
serviceMonitor:
|
|
enabled: {{ metrics.get('service_monitor', false) | tojson }}
|
|
{% endmacro %}
|
|
{%- set result = render() -%}
|
|
{%- for line in result.split('\n') -%}
|
|
{% if line | trim | length != 0 -%}
|
|
{{ line }}
|
|
{% endif %}
|
|
{%- endfor %}
|