studio/sbbb
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
265a68d85f2a76a4e750bf4eb799fcd07e33984e
sbbb/base/lasuite/kustomization.yaml

82 lines
2.5 KiB
YAML
Raw Normal View History

chore: initial infrastructure scaffold Kustomize base + overlays for the full Sunbeam k3s stack: - base/mesh — Linkerd edge (crds + control-plane + viz) - base/ingress — custom Pingora edge proxy - base/ory — Kratos 0.60.1 + Hydra 0.60.1 + login-ui - base/data — CloudNativePG 0.27.1, Valkey 8, OpenSearch 2 - base/storage — SeaweedFS master + volume + filer (S3 on :8333) - base/lasuite — Hive sync daemon + La Suite app placeholders - base/media — LiveKit livekit-server 1.9.0 - base/devtools — Gitea 12.5.0 (external PG + Valkey) overlays/local — sslip.io domain, mkcert TLS, Lima hostPort overlays/production — stub (TODOs for sunbeam.pt values) scripts/ — local-up/down/certs/urls helpers justfile — up / down / certs / urls targets
2026-02-28 13:42:27 +00:00
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: lasuite
resources:
- namespace.yaml
feat: replace nginx placeholder with custom Pingora proxy; add Postfix MTA Ingress: - Deploy custom sunbeam-proxy (Pingora/Rust) replacing nginx placeholder - HTTPS termination with mkcert (local) / rustls-acme (production) - Host-prefix routing with path-based sub-routing for auth virtual host: /oauth2 + /.well-known + /userinfo → Hydra, /kratos → Kratos (prefix stripped), default → login-ui - HTTP→HTTPS redirect, WebSocket passthrough, JSON audit logging, OTEL stub - cert-manager HTTP-01 ACME challenge routing via Ingress watcher - RBAC for Ingress watcher (pingora-watcher ClusterRole) - local overlay: hostPorts 80/443, LiveKit TURN demoted to ClusterIP to avoid klipper conflict Infrastructure: - socket_vmnet shared network for host↔VM reachability (192.168.105.2) - local-up.sh: cert-manager installation, eth1-based LIMA_IP detection, correct DOMAIN_SUFFIX sed substitution - Postfix MTA in lasuite namespace: outbound relay via Scaleway TEM, accepts SMTP from cluster pods - Kratos SMTP courier pointed at postfix.lasuite.svc.cluster.local:25 - Production overlay: cert-manager ClusterIssuer, ACME-enabled Pingora values
2026-03-01 16:25:11 +00:00
- postfix-deployment.yaml
chore: initial infrastructure scaffold Kustomize base + overlays for the full Sunbeam k3s stack: - base/mesh — Linkerd edge (crds + control-plane + viz) - base/ingress — custom Pingora edge proxy - base/ory — Kratos 0.60.1 + Hydra 0.60.1 + login-ui - base/data — CloudNativePG 0.27.1, Valkey 8, OpenSearch 2 - base/storage — SeaweedFS master + volume + filer (S3 on :8333) - base/lasuite — Hive sync daemon + La Suite app placeholders - base/media — LiveKit livekit-server 1.9.0 - base/devtools — Gitea 12.5.0 (external PG + Valkey) overlays/local — sslip.io domain, mkcert TLS, Lima hostPort overlays/production — stub (TODOs for sunbeam.pt values) scripts/ — local-up/down/certs/urls helpers justfile — up / down / certs / urls targets
2026-02-28 13:42:27 +00:00
- hive-config.yaml
- hive-deployment.yaml
- hive-service.yaml
- seaweedfs-buckets.yaml
lasuite: declarative pre-work for La Suite app deployments - Add find user and find_db to postgres-cluster.yaml (11th database) - Add sunbeam-messages-imports and sunbeam-people buckets to SeaweedFS - Configure Hydra Maester with enabledNamespaces: [lasuite] so it can create and update OAuth2Client secrets in the lasuite namespace - Add find to Kratos allowed_return_urls - Add shared ConfigMaps: lasuite-postgres, lasuite-valkey, lasuite-s3, lasuite-oidc-provider — single source of truth for all app env vars - Add HydraOAuth2Client CRDs for all nine La Suite apps (docs, drive, meet, conversations, messages, people, find, gitea, hive); Maester will create oidc-<app> secrets with CLIENT_ID and CLIENT_SECRET
2026-03-01 18:03:13 +00:00
- shared-config.yaml
- oidc-clients.yaml
feat(lasuite): add People service (desk chart); migrate La Suite secrets to VSO People (desk chart v0.0.7): - Add people-values.yaml with all env vars wired to ConfigMaps and Secrets. DB password, S3 credentials, OIDC client, and Django secret key all come from VSO-managed K8s Secrets via secretKeyRef — nothing hardcoded. - Add Helm chart entry to kustomization.yaml (repo: suitenumerique/people). La Suite VSO secrets (vault-secrets.yaml): - seaweedfs-s3-credentials VSS (shared S3 creds → S3_ACCESS_KEY / S3_SECRET_KEY) - hive-db-url VDS (database/static-creds/hive → postgresql:// DSN, 24h rotation) - hive-oidc VSS (secret/hive → client-id / client-secret) - people-db-credentials VDS (database/static-creds/people → password, 24h rotation) - people-django-secret VSS (secret/people → DJANGO_SECRET_KEY)
2026-03-02 18:33:28 +00:00
- vault-secrets.yaml
feat(lasuite): deploy La Suite Docs (impress) Adds the impress Helm chart (suitenumerique/docs, v4.5.0) to the lasuite namespace with full Pingora routing, VSO secrets, and local overlay resource tuning. Routing (pingora-config.yaml): - docs.* frontend -> docs-frontend:80 (nginx, static Next.js export) - /api/* and /admin/* -> docs-backend:80 (Django/uvicorn) - /collaboration/ws/* -> docs-y-provider:4444 (Hocuspocus WebSocket) - integration.* -> integration:80 (La Gaufre hub, same file) Secrets (vault-secrets.yaml): - VaultDynamicSecret docs-db-credentials (DB engine, static role) - VaultStaticSecret docs-django-secret (DJANGO_SECRET_KEY) - VaultStaticSecret docs-collaboration-secret (y-provider shared secret) OIDC client (oidc-clients.yaml): - Fix redirect_uri from /oidc/callback/ to /api/v1.0/callback/ -- impress mounts all OIDC URLs under api/{API_VERSION}/ via lasuite.oidc_login, same pattern as people. Local overlay (values-resources.yaml): - docs-backend: 512Mi limit, WEB_CONCURRENCY=2 (4 uvicorn workers exceeded 384Mi at startup on the arm64 Lima VM) - docs-celery-worker: 384Mi limit, CELERY_WORKER_CONCURRENCY=2 - docs-y-provider: 256Mi limit - seaweedfs-filer: raised from 256Mi to 512Mi (OOMKilled during 188MB multipart S3 upload of impress-y-provider image layer) Local overlay (kustomization.yaml): - Image mirrors for impress-backend, impress-frontend, impress-y-provider (amd64-only images retagged to Gitea via cmd_mirror before deploy)
2026-03-03 14:30:45 +00:00
- integration-deployment.yaml
feat(infra): Meet integration, La Suite theming, Pingora SSH + meet routes Meet: add backend/frontend/celery deployments and services, meet-config ConfigMap, nginx SPA config, VSO secrets (meet-db-credentials VDS, meet-django-secret and meet-livekit VSS). Wire oidc-meet OAuth2Client. La Suite overlay discipline: move people/docs frontend nginx ConfigMaps and patches from overlays/local to base so both environments share them. Remove values-ory.yaml (folded into base). Add docs-frontend nginx config with sub_filter theming. Add local gitea mkcert CA patch. Pingora: add [ssh] TCP passthrough block (port 22 → Gitea SSH pod) and split meet route into frontend default + backend paths for /api/, /admin/, /oidc/, /static/, /__. Remove now-unused values-pingora.yaml from production overlay (host ports moved to patch-pingora-hostport.yaml). Update both overlay kustomizations to reference all new resources and add meet-backend/meet-frontend image entries.
2026-03-06 12:08:21 +00:00
- people-frontend-nginx-configmap.yaml
feat: La Suite email/messages, buildkitd, monitoring, vault and storage updates - Add Messages (email) service: backend, frontend, MTA in/out, MPA, SOCKS proxy, worker, DKIM config, and theme customization - Add Collabora deployment for document collaboration - Add Drive frontend nginx config and values - Add buildkitd namespace for in-cluster container builds - Add SeaweedFS remote sync and additional S3 buckets - Update vault secrets across namespaces (devtools, lasuite, media, monitoring, ory, storage) with expanded credential management - Update monitoring: rename grafana→metrics OAuth2Client, add Prometheus remote write and additional scrape configs - Update local/production overlays with resource patches - Remove stale login-ui resource patch from production overlay
2026-03-10 19:00:57 +00:00
- collabora-deployment.yaml
- collabora-service.yaml
feat(infra): Meet integration, La Suite theming, Pingora SSH + meet routes Meet: add backend/frontend/celery deployments and services, meet-config ConfigMap, nginx SPA config, VSO secrets (meet-db-credentials VDS, meet-django-secret and meet-livekit VSS). Wire oidc-meet OAuth2Client. La Suite overlay discipline: move people/docs frontend nginx ConfigMaps and patches from overlays/local to base so both environments share them. Remove values-ory.yaml (folded into base). Add docs-frontend nginx config with sub_filter theming. Add local gitea mkcert CA patch. Pingora: add [ssh] TCP passthrough block (port 22 → Gitea SSH pod) and split meet route into frontend default + backend paths for /api/, /admin/, /oidc/, /static/, /__. Remove now-unused values-pingora.yaml from production overlay (host ports moved to patch-pingora-hostport.yaml). Update both overlay kustomizations to reference all new resources and add meet-backend/meet-frontend image entries.
2026-03-06 12:08:21 +00:00
- meet-config.yaml
- meet-backend-deployment.yaml
- meet-backend-service.yaml
- meet-celery-worker-deployment.yaml
- meet-frontend-nginx-configmap.yaml
- meet-frontend-deployment.yaml
- meet-frontend-service.yaml
feat: La Suite email/messages, buildkitd, monitoring, vault and storage updates - Add Messages (email) service: backend, frontend, MTA in/out, MPA, SOCKS proxy, worker, DKIM config, and theme customization - Add Collabora deployment for document collaboration - Add Drive frontend nginx config and values - Add buildkitd namespace for in-cluster container builds - Add SeaweedFS remote sync and additional S3 buckets - Update vault secrets across namespaces (devtools, lasuite, media, monitoring, ory, storage) with expanded credential management - Update monitoring: rename grafana→metrics OAuth2Client, add Prometheus remote write and additional scrape configs - Update local/production overlays with resource patches - Remove stale login-ui resource patch from production overlay
2026-03-10 19:00:57 +00:00
- drive-frontend-nginx-configmap.yaml
- messages-config.yaml
- messages-backend-deployment.yaml
- messages-backend-service.yaml
- messages-frontend-theme-configmap.yaml
- messages-frontend-deployment.yaml
- messages-frontend-service.yaml
- messages-worker-deployment.yaml
- messages-mta-in-deployment.yaml
- messages-mta-in-service.yaml
- messages-mta-out-deployment.yaml
- messages-mta-out-service.yaml
- messages-mpa-dkim-config.yaml
- messages-mpa-deployment.yaml
- messages-mpa-service.yaml
- messages-socks-proxy-deployment.yaml
- messages-socks-proxy-service.yaml
feat(lasuite): add calendars service deployment manifests Add K8s manifests for calendars backend, frontend (Caddy), CalDAV server, and Celery worker. Wire Pingora routing for cal.sunbeam.pt with path-based backend/caldav/static splits. Add OAuth2Client for OIDC, VaultDynamicSecret for DB credentials, VaultStaticSecret for Django/CalDAV keys, and TLS cert coverage for the cal subdomain. Register calendars in the integration service gaufre widget.
2026-03-18 18:36:05 +00:00
- calendars-config.yaml
- calendars-theme-configmap.yaml
- calendars-backend-deployment.yaml
- calendars-backend-service.yaml
- calendars-caldav-deployment.yaml
- calendars-caldav-service.yaml
- calendars-worker-deployment.yaml
- calendars-frontend-caddyfile.yaml
- calendars-frontend-deployment.yaml
- calendars-frontend-service.yaml
feat(lasuite): add Projects (Planka Kanban) service Deploy Planka-based project management at projects.DOMAIN_SUFFIX: - ConfigMap with OIDC, S3, SMTP, La Gaufre widget config - Deployment + Service (init container for DB migrations, Sails on 1337) - OAuth2Client (client_secret_basic, redirect to /oidc-callback) - VaultDynamicSecret for DATABASE_URL, VaultStaticSecret for SECRET_KEY - Pingora route with websocket support (Socket.io) - Image overrides in both local and production overlays - TLS cert dnsNames updated for projects subdomain - Integration service.json updated with Projects entry - seaweedfs-s3-credentials rolloutRestartTargets includes projects
2026-03-20 13:41:54 +00:00
- projects-config.yaml
- projects-deployment.yaml
feat(infra): Meet integration, La Suite theming, Pingora SSH + meet routes Meet: add backend/frontend/celery deployments and services, meet-config ConfigMap, nginx SPA config, VSO secrets (meet-db-credentials VDS, meet-django-secret and meet-livekit VSS). Wire oidc-meet OAuth2Client. La Suite overlay discipline: move people/docs frontend nginx ConfigMaps and patches from overlays/local to base so both environments share them. Remove values-ory.yaml (folded into base). Add docs-frontend nginx config with sub_filter theming. Add local gitea mkcert CA patch. Pingora: add [ssh] TCP passthrough block (port 22 → Gitea SSH pod) and split meet route into frontend default + backend paths for /api/, /admin/, /oidc/, /static/, /__. Remove now-unused values-pingora.yaml from production overlay (host ports moved to patch-pingora-hostport.yaml). Update both overlay kustomizations to reference all new resources and add meet-backend/meet-frontend image entries.
2026-03-06 12:08:21 +00:00
patches:
# Rewrite hardcoded production integration URL + inject theme CSS in people-frontend
- path: patch-people-frontend-nginx.yaml
feat: La Suite email/messages, buildkitd, monitoring, vault and storage updates - Add Messages (email) service: backend, frontend, MTA in/out, MPA, SOCKS proxy, worker, DKIM config, and theme customization - Add Collabora deployment for document collaboration - Add Drive frontend nginx config and values - Add buildkitd namespace for in-cluster container builds - Add SeaweedFS remote sync and additional S3 buckets - Update vault secrets across namespaces (devtools, lasuite, media, monitoring, ory, storage) with expanded credential management - Update monitoring: rename grafana→metrics OAuth2Client, add Prometheus remote write and additional scrape configs - Update local/production overlays with resource patches - Remove stale login-ui resource patch from production overlay
2026-03-10 19:00:57 +00:00
# Mount media auth proxy nginx config in drive-frontend
- path: patch-drive-frontend-nginx.yaml
feat(lasuite): add People service (desk chart); migrate La Suite secrets to VSO People (desk chart v0.0.7): - Add people-values.yaml with all env vars wired to ConfigMaps and Secrets. DB password, S3 credentials, OIDC client, and Django secret key all come from VSO-managed K8s Secrets via secretKeyRef — nothing hardcoded. - Add Helm chart entry to kustomization.yaml (repo: suitenumerique/people). La Suite VSO secrets (vault-secrets.yaml): - seaweedfs-s3-credentials VSS (shared S3 creds → S3_ACCESS_KEY / S3_SECRET_KEY) - hive-db-url VDS (database/static-creds/hive → postgresql:// DSN, 24h rotation) - hive-oidc VSS (secret/hive → client-id / client-secret) - people-db-credentials VDS (database/static-creds/people → password, 24h rotation) - people-django-secret VSS (secret/people → DJANGO_SECRET_KEY)
2026-03-02 18:33:28 +00:00
# La Suite Numérique Helm charts.
# Charts with a published Helm repo use helmCharts below.
# find has no published repo yet — deploy manually when OpenSearch is ready.
helmCharts:
# helm repo add people https://suitenumerique.github.io/people/
- name: desk
repo: https://suitenumerique.github.io/people/
version: "0.0.7"
releaseName: people
namespace: lasuite
valuesFile: people-values.yaml
chore: initial infrastructure scaffold Kustomize base + overlays for the full Sunbeam k3s stack: - base/mesh — Linkerd edge (crds + control-plane + viz) - base/ingress — custom Pingora edge proxy - base/ory — Kratos 0.60.1 + Hydra 0.60.1 + login-ui - base/data — CloudNativePG 0.27.1, Valkey 8, OpenSearch 2 - base/storage — SeaweedFS master + volume + filer (S3 on :8333) - base/lasuite — Hive sync daemon + La Suite app placeholders - base/media — LiveKit livekit-server 1.9.0 - base/devtools — Gitea 12.5.0 (external PG + Valkey) overlays/local — sslip.io domain, mkcert TLS, Lima hostPort overlays/production — stub (TODOs for sunbeam.pt values) scripts/ — local-up/down/certs/urls helpers justfile — up / down / certs / urls targets
2026-02-28 13:42:27 +00:00
feat: La Suite email/messages, buildkitd, monitoring, vault and storage updates - Add Messages (email) service: backend, frontend, MTA in/out, MPA, SOCKS proxy, worker, DKIM config, and theme customization - Add Collabora deployment for document collaboration - Add Drive frontend nginx config and values - Add buildkitd namespace for in-cluster container builds - Add SeaweedFS remote sync and additional S3 buckets - Update vault secrets across namespaces (devtools, lasuite, media, monitoring, ory, storage) with expanded credential management - Update monitoring: rename grafana→metrics OAuth2Client, add Prometheus remote write and additional scrape configs - Update local/production overlays with resource patches - Remove stale login-ui resource patch from production overlay
2026-03-10 19:00:57 +00:00
# helm repo add drive https://suitenumerique.github.io/drive/
- name: drive
repo: https://suitenumerique.github.io/drive/
version: "0.14.0"
releaseName: drive
feat(lasuite): deploy La Suite Docs (impress) Adds the impress Helm chart (suitenumerique/docs, v4.5.0) to the lasuite namespace with full Pingora routing, VSO secrets, and local overlay resource tuning. Routing (pingora-config.yaml): - docs.* frontend -> docs-frontend:80 (nginx, static Next.js export) - /api/* and /admin/* -> docs-backend:80 (Django/uvicorn) - /collaboration/ws/* -> docs-y-provider:4444 (Hocuspocus WebSocket) - integration.* -> integration:80 (La Gaufre hub, same file) Secrets (vault-secrets.yaml): - VaultDynamicSecret docs-db-credentials (DB engine, static role) - VaultStaticSecret docs-django-secret (DJANGO_SECRET_KEY) - VaultStaticSecret docs-collaboration-secret (y-provider shared secret) OIDC client (oidc-clients.yaml): - Fix redirect_uri from /oidc/callback/ to /api/v1.0/callback/ -- impress mounts all OIDC URLs under api/{API_VERSION}/ via lasuite.oidc_login, same pattern as people. Local overlay (values-resources.yaml): - docs-backend: 512Mi limit, WEB_CONCURRENCY=2 (4 uvicorn workers exceeded 384Mi at startup on the arm64 Lima VM) - docs-celery-worker: 384Mi limit, CELERY_WORKER_CONCURRENCY=2 - docs-y-provider: 256Mi limit - seaweedfs-filer: raised from 256Mi to 512Mi (OOMKilled during 188MB multipart S3 upload of impress-y-provider image layer) Local overlay (kustomization.yaml): - Image mirrors for impress-backend, impress-frontend, impress-y-provider (amd64-only images retagged to Gitea via cmd_mirror before deploy)
2026-03-03 14:30:45 +00:00
namespace: lasuite
feat: La Suite email/messages, buildkitd, monitoring, vault and storage updates - Add Messages (email) service: backend, frontend, MTA in/out, MPA, SOCKS proxy, worker, DKIM config, and theme customization - Add Collabora deployment for document collaboration - Add Drive frontend nginx config and values - Add buildkitd namespace for in-cluster container builds - Add SeaweedFS remote sync and additional S3 buckets - Update vault secrets across namespaces (devtools, lasuite, media, monitoring, ory, storage) with expanded credential management - Update monitoring: rename grafana→metrics OAuth2Client, add Prometheus remote write and additional scrape configs - Update local/production overlays with resource patches - Remove stale login-ui resource patch from production overlay
2026-03-10 19:00:57 +00:00
valuesFile: drive-values.yaml
Reference in New Issue Copy Permalink