Sienna Meridian Satterwhite
a589e6280d
- Ory Hydra + Kratos: fixed secret management, DSN config, DB migrations, OAuth2Client CRD (helm template skips crds/ dir), login-ui env vars - SeaweedFS: added s3.json credentials file via -s3.config CLI flag - OpenBao: standalone mode with auto-unseal sidecar, keys in K8s secret - OpenSearch: increased memory to 1.5Gi / JVM 1g heap - Gitea: SSL_MODE disable, S3 bucket creation fixed - Hive: automountServiceAccountToken: false (Lima virtiofs read-only rootfs quirk) - LiveKit: API keys in values, hostPort conflict resolved - Linkerd: native sidecar (proxy.nativeSidecar=true) to avoid blocking Jobs - All placeholder images replaced: pingora→nginx:alpine, login-ui→oryd/kratos-selfservice-ui-node Full stack running: postgres, valkey, openbao, opensearch, seaweedfs, kratos, hydra, gitea, livekit, hive (placeholder), login-ui
188 lines
7.9 KiB
Bash
Executable File
188 lines
7.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Start the Sunbeam local dev stack.
|
|
# Idempotent: safe to run multiple times.
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
CTX="--context=sunbeam"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 1. Check prerequisites
|
|
# ---------------------------------------------------------------------------
|
|
echo "==> Checking prerequisites..."
|
|
for tool in limactl mkcert kubectl kustomize linkerd jq; do
|
|
if ! command -v "$tool" &>/dev/null; then
|
|
echo "ERROR: '$tool' not found. Install with: brew install $tool" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
echo " OK"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 2. Start Lima VM (skip if already running)
|
|
# ---------------------------------------------------------------------------
|
|
LIMA_STATUS=$(limactl list --json 2>/dev/null | \
|
|
python3 -c "import sys,json; vms=[v for v in json.load(sys.stdin) if v['name']=='sunbeam']; print(vms[0]['status'] if vms else 'none')" 2>/dev/null || echo "none")
|
|
|
|
if [[ "$LIMA_STATUS" == "Running" ]]; then
|
|
echo "==> Lima VM 'sunbeam' already running."
|
|
elif [[ "$LIMA_STATUS" == "Stopped" ]]; then
|
|
echo "==> Starting existing Lima VM 'sunbeam'..."
|
|
limactl start sunbeam
|
|
else
|
|
echo "==> Creating Lima VM 'sunbeam' (k3s, 6 CPU / 12 GB / 60 GB)..."
|
|
limactl start \
|
|
--name=sunbeam \
|
|
template:k3s \
|
|
--memory=12 \
|
|
--cpus=6 \
|
|
--disk=60 \
|
|
--vm-type=vz \
|
|
--mount-type=virtiofs
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 3. Merge kubeconfig into ~/.kube/config as context "sunbeam"
|
|
# ---------------------------------------------------------------------------
|
|
echo "==> Merging kubeconfig..."
|
|
LIMA_KUBECONFIG="/Users/$USER/.lima/sunbeam/copied-from-guest/kubeconfig.yaml"
|
|
if [[ ! -f "$LIMA_KUBECONFIG" ]]; then
|
|
echo "ERROR: Lima kubeconfig not found at $LIMA_KUBECONFIG" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Extract cert data and set context
|
|
mkdir -p ~/.kube /tmp/sunbeam-kube
|
|
yq '.clusters[0].cluster.certificate-authority-data' "$LIMA_KUBECONFIG" | base64 -d > /tmp/sunbeam-kube/ca.crt
|
|
yq '.users[0].user.client-certificate-data' "$LIMA_KUBECONFIG" | base64 -d > /tmp/sunbeam-kube/client.crt
|
|
yq '.users[0].user.client-key-data' "$LIMA_KUBECONFIG" | base64 -d > /tmp/sunbeam-kube/client.key
|
|
|
|
kubectl config set-cluster sunbeam --server=https://127.0.0.1:6443 --certificate-authority=/tmp/sunbeam-kube/ca.crt --embed-certs=true
|
|
kubectl config set-credentials sunbeam-admin --client-certificate=/tmp/sunbeam-kube/client.crt --client-key=/tmp/sunbeam-kube/client.key --embed-certs=true
|
|
kubectl config set-context sunbeam --cluster=sunbeam --user=sunbeam-admin
|
|
rm -rf /tmp/sunbeam-kube
|
|
echo " Context 'sunbeam' ready."
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 4. Disable Traefik (k3s default) if still present
|
|
# ---------------------------------------------------------------------------
|
|
if kubectl $CTX get helmchart traefik -n kube-system &>/dev/null; then
|
|
echo "==> Removing Traefik (replaced by Pingora)..."
|
|
kubectl $CTX delete helmchart traefik traefik-crd -n kube-system 2>/dev/null || true
|
|
fi
|
|
# Remove startup manifest so k3s doesn't re-create it
|
|
limactl shell sunbeam sudo rm -f /var/lib/rancher/k3s/server/manifests/traefik.yaml 2>/dev/null || true
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 5. Install Gateway API CRDs + Linkerd via CLI
|
|
# ---------------------------------------------------------------------------
|
|
if ! kubectl $CTX get ns linkerd &>/dev/null; then
|
|
echo "==> Installing Gateway API CRDs..."
|
|
kubectl $CTX apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.0/standard-install.yaml
|
|
|
|
echo "==> Installing Linkerd CRDs..."
|
|
linkerd install --crds | kubectl $CTX apply -f -
|
|
|
|
echo "==> Installing Linkerd control plane..."
|
|
linkerd install | kubectl $CTX apply -f -
|
|
kubectl $CTX -n linkerd rollout status deployment/linkerd-identity --timeout=120s
|
|
kubectl $CTX -n linkerd rollout status deployment/linkerd-destination --timeout=120s
|
|
kubectl $CTX -n linkerd rollout status deployment/linkerd-proxy-injector --timeout=120s
|
|
echo " Linkerd installed."
|
|
else
|
|
echo "==> Linkerd already installed."
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 6. Generate mkcert wildcard cert
|
|
# ---------------------------------------------------------------------------
|
|
LIMA_IP=$(limactl shell sunbeam hostname -I | awk '{print $1}')
|
|
DOMAIN="${LIMA_IP}.sslip.io"
|
|
SECRETS_DIR="$REPO_ROOT/secrets/local"
|
|
|
|
if [[ ! -f "$SECRETS_DIR/tls.crt" ]]; then
|
|
echo "==> Generating TLS cert for *.$DOMAIN..."
|
|
mkdir -p "$SECRETS_DIR"
|
|
cd "$SECRETS_DIR"
|
|
mkcert "*.$DOMAIN"
|
|
mv "_wildcard.${DOMAIN}.pem" tls.crt
|
|
mv "_wildcard.${DOMAIN}-key.pem" tls.key
|
|
cd "$REPO_ROOT"
|
|
else
|
|
echo "==> TLS cert already exists."
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 7. Create TLS Secret in ingress namespace
|
|
# ---------------------------------------------------------------------------
|
|
echo "==> Applying TLS Secret to ingress namespace..."
|
|
kubectl $CTX create namespace ingress --dry-run=client -o yaml | kubectl $CTX apply -f -
|
|
kubectl $CTX create secret tls pingora-tls \
|
|
--cert="$SECRETS_DIR/tls.crt" \
|
|
--key="$SECRETS_DIR/tls.key" \
|
|
-n ingress \
|
|
--dry-run=client -o yaml | kubectl $CTX apply -f -
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 8. Apply manifests (server-side apply handles large CRDs)
|
|
# ---------------------------------------------------------------------------
|
|
echo "==> Applying manifests (domain: $DOMAIN)..."
|
|
cd "$REPO_ROOT"
|
|
kustomize build overlays/local --enable-helm | \
|
|
sed "s/DOMAIN_SUFFIX/${DOMAIN}/g" | \
|
|
kubectl $CTX apply --server-side --force-conflicts -f -
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 9. Seed secrets (waits for postgres, creates K8s secrets, inits OpenBao)
|
|
# ---------------------------------------------------------------------------
|
|
echo "==> Seeding secrets..."
|
|
bash "$SCRIPT_DIR/local-seed-secrets.sh"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 10. Restart deployments that were waiting for secrets
|
|
# ---------------------------------------------------------------------------
|
|
echo "==> Restarting services that were waiting for secrets..."
|
|
for ns_deploy in \
|
|
"ory/hydra" \
|
|
"ory/kratos" \
|
|
"ory/login-ui" \
|
|
"devtools/gitea" \
|
|
"storage/seaweedfs-filer" \
|
|
"lasuite/hive" \
|
|
"media/livekit-server"; do
|
|
ns="${ns_deploy%%/*}"
|
|
dep="${ns_deploy##*/}"
|
|
kubectl $CTX -n "$ns" rollout restart deployment/"$dep" 2>/dev/null || true
|
|
done
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 11. Wait for core components
|
|
# ---------------------------------------------------------------------------
|
|
echo "==> Waiting for Valkey..."
|
|
kubectl $CTX rollout status deployment/valkey -n data --timeout=120s || true
|
|
|
|
echo "==> Waiting for Kratos..."
|
|
kubectl $CTX rollout status deployment/kratos -n ory --timeout=120s || true
|
|
|
|
echo "==> Waiting for Hydra..."
|
|
kubectl $CTX rollout status deployment/hydra -n ory --timeout=120s || true
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 12. Print URLs
|
|
# ---------------------------------------------------------------------------
|
|
echo ""
|
|
echo "==> Stack is up. Domain: $DOMAIN"
|
|
echo ""
|
|
echo "Services:"
|
|
echo " Auth: https://auth.${DOMAIN}/"
|
|
echo " Docs: https://docs.${DOMAIN}/"
|
|
echo " Meet: https://meet.${DOMAIN}/"
|
|
echo " Drive: https://drive.${DOMAIN}/"
|
|
echo " Chat: https://chat.${DOMAIN}/"
|
|
echo " People: https://people.${DOMAIN}/"
|
|
echo " Gitea: https://src.${DOMAIN}/"
|
|
echo ""
|
|
echo "OpenBao UI: kubectl $CTX -n data port-forward svc/openbao 8200:8200"
|
|
echo " http://localhost:8200 (token from: kubectl $CTX -n data get secret openbao-keys -o jsonpath='{.data.root-token}' | base64 -d)"
|