Archify Sync server, Dockerfile and Helm chart
Rust server (axum, yrs, sqlx/PostgreSQL): live shared models over the y-websocket protocol, versions, browser sign-in with PKCE, invites, single sign-on through OIDC, metrics. Docker image on distroless, compose file, and a Helm chart with one pod, optional bundled PostgreSQL and secrets from existing Secrets.
This commit is contained in:
root-at-skic committed
commit
5c43b90ef8
67 files changed
+8362
No files matched your search
@@ -0,0 +1,151 @@
|
||||
{{- if not (or .Values.postgresql.enabled .Values.database.existingSecret .Values.database.url) }}
|
||||
{{- fail "Set database.url, database.existingSecret or postgresql.enabled" }}
|
||||
{{- end }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "archify-sync.fullname" . }}
|
||||
labels:
|
||||
{{- include "archify-sync.labels" . | nindent 4 }}
|
||||
{{- include "archify-sync.selector" . | nindent 4 }}
|
||||
spec:
|
||||
# One server holds the live copy of each space; see values.yaml.
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "archify-sync.selector" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "archify-sync.labels" . | nindent 8 }}
|
||||
{{- include "archify-sync.selector" . | nindent 8 }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: false
|
||||
# Leaving stores a snapshot of every open space.
|
||||
terminationGracePeriodSeconds: 30
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: server
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- name: metrics
|
||||
containerPort: {{ .Values.metrics.port }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: ARCHIFY_SYNC_DATABASE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "archify-sync.dbSecret" . }}
|
||||
key: {{ include "archify-sync.dbSecretKey" . }}
|
||||
- name: ARCHIFY_SYNC_DATABASE_MAX_CONNECTIONS
|
||||
value: {{ .Values.database.maxConnections | quote }}
|
||||
- name: ARCHIFY_SYNC_LISTEN
|
||||
value: "0.0.0.0:8080"
|
||||
- name: ARCHIFY_SYNC_PUBLIC_URL
|
||||
value: {{ .Values.publicUrl | quote }}
|
||||
- name: ARCHIFY_SYNC_NAME
|
||||
value: {{ .Values.config.name | quote }}
|
||||
- name: ARCHIFY_SYNC_SNAPSHOT_IDLE_SECS
|
||||
value: {{ .Values.config.snapshotIdleSecs | quote }}
|
||||
- name: ARCHIFY_SYNC_SNAPSHOT_MAX_SECS
|
||||
value: {{ .Values.config.snapshotMaxSecs | quote }}
|
||||
- name: ARCHIFY_SYNC_SNAPSHOT_MAX_EDITS
|
||||
value: {{ .Values.config.snapshotMaxEdits | quote }}
|
||||
- name: ARCHIFY_SYNC_INVITE_HOURS
|
||||
value: {{ .Values.config.inviteHours | quote }}
|
||||
- name: ARCHIFY_SYNC_MEMBERS_CAN_INVITE
|
||||
value: {{ .Values.config.membersCanInvite | quote }}
|
||||
- name: ARCHIFY_SYNC_ACCESS_TTL_SECS
|
||||
value: {{ .Values.config.accessTtlSecs | quote }}
|
||||
- name: ARCHIFY_SYNC_REFRESH_TTL_DAYS
|
||||
value: {{ .Values.config.refreshTtlDays | quote }}
|
||||
- name: ARCHIFY_SYNC_REFRESH_GRACE_SECS
|
||||
value: {{ .Values.config.refreshGraceSecs | quote }}
|
||||
- name: ARCHIFY_SYNC_REDIRECT_SCHEMES
|
||||
value: {{ .Values.config.redirectSchemes | quote }}
|
||||
- name: ARCHIFY_SYNC_MAX_MESSAGE_BYTES
|
||||
value: {{ .Values.config.maxMessageBytes | int64 | quote }}
|
||||
- name: ARCHIFY_SYNC_LOG_JSON
|
||||
value: {{ .Values.config.logJson | quote }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- name: ARCHIFY_SYNC_METRICS_LISTEN
|
||||
value: "0.0.0.0:{{ .Values.metrics.port }}"
|
||||
{{- end }}
|
||||
{{- with .Values.oidc }}
|
||||
{{- if .enabled }}
|
||||
- name: ARCHIFY_SYNC_OIDC_ISSUER
|
||||
value: {{ required "oidc.issuer is required when oidc.enabled" .issuer | quote }}
|
||||
- name: ARCHIFY_SYNC_OIDC_CLIENT_ID
|
||||
value: {{ .clientId | quote }}
|
||||
{{- if .existingSecret }}
|
||||
- name: ARCHIFY_SYNC_OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .existingSecret }}
|
||||
key: {{ .existingSecretKey }}
|
||||
{{- end }}
|
||||
- name: ARCHIFY_SYNC_OIDC_LABEL
|
||||
value: {{ .label | quote }}
|
||||
- name: ARCHIFY_SYNC_OIDC_SCOPES
|
||||
value: {{ .scopes | quote }}
|
||||
- name: ARCHIFY_SYNC_OIDC_GROUPS_CLAIM
|
||||
value: {{ .groupsClaim | quote }}
|
||||
- name: ARCHIFY_SYNC_OIDC_ALLOWED_GROUPS
|
||||
value: {{ join "," .allowedGroups | quote }}
|
||||
- name: ARCHIFY_SYNC_OIDC_ADMIN_GROUPS
|
||||
value: {{ join "," .adminGroups | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: RUST_LOG
|
||||
value: {{ .Values.config.logLevel | quote }}
|
||||
{{- with .Values.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
startupProbe:
|
||||
httpGet: { path: /healthz, port: http }
|
||||
periodSeconds: 2
|
||||
failureThreshold: 60
|
||||
livenessProbe:
|
||||
httpGet: { path: /healthz, port: http }
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet: { path: /readyz, port: http }
|
||||
periodSeconds: 5
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
Reference in new issue
Block a user