Compare commits
22 Commits
auto-updat
...
auto-updat
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
0af09e8998 | ||
| 327bcc90d8 | |||
| 7d2beb584c | |||
| a889518e3b | |||
| 4575cd69a9 | |||
| 6460684218 | |||
| 935b9e0a51 | |||
| 9e68fc91a2 | |||
| a613ca086c | |||
|
|
dcd15b296f | ||
|
|
f21c9f548b | ||
|
|
c4bc80eed2 | ||
|
|
176c6e910e | ||
|
|
5834fc23a7 | ||
|
|
567e62e48c | ||
|
|
0a9af8f7bd | ||
|
|
b52676e8c7 | ||
|
|
51fa410231 | ||
|
|
8e69b134a4 | ||
|
|
ecb611cf5f | ||
|
|
1843cb2beb | ||
|
|
cfda43e116 |
@@ -18,16 +18,43 @@ spec:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
containers:
|
||||
- name: furumi-server
|
||||
image: ultradesu/furumi-server:latest
|
||||
image: ultradesu/furumi-server:trunk
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: FURUMI_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-token
|
||||
name: furumi-ng-creds
|
||||
key: TOKEN
|
||||
- name: FURUMI_OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_CLIENT_ID
|
||||
- name: FURUMI_OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_CLIENT_SECRET
|
||||
- name: FURUMI_OIDC_ISSUER_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_ISSUER_URL
|
||||
- name: FURUMI_OIDC_REDIRECT_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_REDIRECT_URL
|
||||
- name: FURUMI_OIDC_SESSION_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_SESSION_SECRET
|
||||
- name: FURUMI_ROOT
|
||||
value: "/media"
|
||||
- name: RUST_LOG
|
||||
value: "info"
|
||||
ports:
|
||||
- name: grpc
|
||||
containerPort: 50051
|
||||
@@ -35,6 +62,9 @@ spec:
|
||||
- name: metrics
|
||||
containerPort: 9090
|
||||
protocol: TCP
|
||||
- name: web-ui
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: music
|
||||
mountPath: /media
|
||||
|
||||
@@ -2,16 +2,26 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: furumi-ng-token
|
||||
name: furumi-ng-creds
|
||||
spec:
|
||||
target:
|
||||
name: furumi-ng-token
|
||||
name: furumi-ng-creds
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
TOKEN: |-
|
||||
{{ .token }}
|
||||
OIDC_CLIENT_ID: |-
|
||||
{{ .client_id }}
|
||||
OIDC_CLIENT_SECRET: |-
|
||||
{{ .client_secret }}
|
||||
OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-ng-web/
|
||||
OIDC_REDIRECT_URL: https://music.hexor.cy/auth/callback
|
||||
OIDC_SESSION_SECRET: |-
|
||||
{{ .session_secret }}
|
||||
PG_STRING: |-
|
||||
postgres://furumi:{{ .pg_pass }}@psql.psql.svc:5432/furumi
|
||||
data:
|
||||
- secretKey: token
|
||||
sourceRef:
|
||||
@@ -21,3 +31,35 @@ spec:
|
||||
remoteRef:
|
||||
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
|
||||
property: fields[0].value
|
||||
- secretKey: client_id
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
|
||||
property: fields[1].value
|
||||
- secretKey: client_secret
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
|
||||
property: fields[2].value
|
||||
- secretKey: session_secret
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
|
||||
property: fields[3].value
|
||||
- secretKey: pg_pass
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[16].value
|
||||
|
||||
59
k8s/apps/furumi-server/ingress.yaml
Normal file
59
k8s/apps/furumi-server/ingress.yaml
Normal file
@@ -0,0 +1,59 @@
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: admin-strip
|
||||
spec:
|
||||
stripPrefix:
|
||||
prefixes:
|
||||
- /admin
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: furumi-tls-ingress
|
||||
annotations:
|
||||
ingressClassName: traefik
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
acme.cert-manager.io/http01-edit-in-place: "true"
|
||||
spec:
|
||||
rules:
|
||||
- host: music.hexor.cy
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: furumi-web-player
|
||||
port:
|
||||
number: 8080
|
||||
tls:
|
||||
- secretName: furumi-tls
|
||||
hosts:
|
||||
- '*.hexor.cy'
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: furumi-admin-ingress
|
||||
annotations:
|
||||
ingressClassName: traefik
|
||||
traefik.ingress.kubernetes.io/router.middlewares: furumi-server-admin-strip@kubernetescrd,kube-system-https-redirect@kubernetescrd
|
||||
spec:
|
||||
rules:
|
||||
- host: music.hexor.cy
|
||||
http:
|
||||
paths:
|
||||
- path: /admin
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: furumi-metadata-agent
|
||||
port:
|
||||
number: 8090
|
||||
tls:
|
||||
- secretName: furumi-tls
|
||||
hosts:
|
||||
- '*.hexor.cy'
|
||||
@@ -7,3 +7,6 @@ resources:
|
||||
- service.yaml
|
||||
- servicemonitor.yaml
|
||||
- external-secrets.yaml
|
||||
- ingress.yaml
|
||||
- web-player.yaml
|
||||
- metadata-agent.yaml
|
||||
|
||||
59
k8s/apps/furumi-server/metadata-agent.yaml
Normal file
59
k8s/apps/furumi-server/metadata-agent.yaml
Normal file
@@ -0,0 +1,59 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: furumi-metadata-agent
|
||||
labels:
|
||||
app: furumi-metadata-agent
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: furumi-metadata-agent
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: furumi-metadata-agent
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
containers:
|
||||
- name: furumi-metadata-agent
|
||||
image: ultradesu/furumi-metadata-agent:trunk
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: FURUMI_AGENT_DATABASE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: PG_STRING
|
||||
- name: FURUMI_AGENT_INBOX_DIR
|
||||
value: "/inbox"
|
||||
- name: FURUMI_AGENT_STORAGE_DIR
|
||||
value: "/media"
|
||||
- name: FURUMI_AGENT_OLLAMA_URL
|
||||
value: "http://ollama.ollama.svc:11434"
|
||||
- name: FURUMI_AGENT_OLLAMA_MODEL
|
||||
value: "qwen3:14b"
|
||||
- name: FURUMI_AGENT_POLL_INTERVAL_SECS
|
||||
value: "10"
|
||||
- name: RUST_LOG
|
||||
value: "info"
|
||||
ports:
|
||||
- name: admin-ui
|
||||
containerPort: 8090
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: library
|
||||
mountPath: /media
|
||||
- name: inbox
|
||||
mountPath: /inbox
|
||||
volumes:
|
||||
- name: library
|
||||
hostPath:
|
||||
path: /k8s/furumi/library
|
||||
type: DirectoryOrCreate
|
||||
- name: inbox
|
||||
hostPath:
|
||||
path: /k8s/furumi/inbox
|
||||
type: DirectoryOrCreate
|
||||
|
||||
@@ -28,3 +28,35 @@ spec:
|
||||
protocol: TCP
|
||||
port: 9090
|
||||
targetPort: 9090
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: furumi-metadata-agent
|
||||
labels:
|
||||
app: furumi-metadata-agent
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: furumi-metadata-agent
|
||||
ports:
|
||||
- name: admin-ui
|
||||
protocol: TCP
|
||||
port: 8090
|
||||
targetPort: 8090
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: furumi-web-player
|
||||
labels:
|
||||
app: furumi-web-player
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: furumi-web-player
|
||||
ports:
|
||||
- name: web-ui
|
||||
protocol: TCP
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
|
||||
70
k8s/apps/furumi-server/web-player.yaml
Normal file
70
k8s/apps/furumi-server/web-player.yaml
Normal file
@@ -0,0 +1,70 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: furumi-web-player
|
||||
labels:
|
||||
app: furumi-web-player
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: furumi-web-player
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: furumi-web-player
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
containers:
|
||||
- name: furumi-web-player
|
||||
image: ultradesu/furumi-web-player:trunk
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: FURUMI_OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_CLIENT_ID
|
||||
- name: FURUMI_OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_CLIENT_SECRET
|
||||
- name: FURUMI_OIDC_ISSUER_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_ISSUER_URL
|
||||
- name: FURUMI_OIDC_REDIRECT_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_REDIRECT_URL
|
||||
- name: FURUMI_OIDC_SESSION_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: OIDC_SESSION_SECRET
|
||||
- name: FURUMI_PLAYER_DATABASE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: furumi-ng-creds
|
||||
key: PG_STRING
|
||||
- name: FURUMI_PLAYER_STORAGE_DIR
|
||||
value: "/media"
|
||||
- name: RUST_LOG
|
||||
value: "info"
|
||||
ports:
|
||||
- name: web-ui
|
||||
containerPort: 8080
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: music
|
||||
mountPath: /media
|
||||
volumes:
|
||||
- name: music
|
||||
hostPath:
|
||||
path: /k8s/furumi/library
|
||||
type: DirectoryOrCreate
|
||||
|
||||
@@ -77,101 +77,6 @@ spec:
|
||||
labels:
|
||||
app: gitea-runner
|
||||
spec:
|
||||
#nodeSelector:
|
||||
# kubernetes.io/hostname: home.homenet
|
||||
volumes:
|
||||
- name: docker-sock
|
||||
hostPath:
|
||||
path: /var/run/docker.sock
|
||||
type: Socket
|
||||
- name: runner-data
|
||||
emptyDir:
|
||||
sizeLimit: 30Gi
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 1
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- home.homenet
|
||||
- weight: 2
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- master.tail2fe2d.ts.net
|
||||
- weight: 3
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- it.tail2fe2d.ts.net
|
||||
- ch.tail2fe2d.ts.net
|
||||
- us.tail2fe2d.ts.net
|
||||
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- home.homenet
|
||||
- it.tail2fe2d.ts.net
|
||||
- ch.tail2fe2d.ts.net
|
||||
- us.tail2fe2d.ts.net
|
||||
- master.tail2fe2d.ts.net
|
||||
containers:
|
||||
- name: gitea-runner
|
||||
image: gitea/act_runner:nightly
|
||||
resources:
|
||||
requests:
|
||||
cpu: "100m"
|
||||
memory: "256Mi"
|
||||
ephemeral-storage: "1Gi" # reserve ephemeral storage
|
||||
limits:
|
||||
cpu: "3000m"
|
||||
memory: "4Gi"
|
||||
ephemeral-storage: "28Gi" # hard cap for /data usage
|
||||
volumeMounts:
|
||||
- name: docker-sock
|
||||
mountPath: /var/run/docker.sock
|
||||
- name: runner-data
|
||||
mountPath: /data
|
||||
env:
|
||||
- name: GITEA_INSTANCE_URL
|
||||
value: "https://gt.hexor.cy"
|
||||
- name: GITEA_RUNNER_REGISTRATION_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-runner-act-runner-secrets
|
||||
key: token
|
||||
- name: GITEA_RUNNER_NAME
|
||||
value: "k8s-runner"
|
||||
- name: GITEA_RUNNER_LABELS
|
||||
value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04"
|
||||
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: gitea-runner-desktop
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: gitea-runner-desktop
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: gitea-runner-desktop
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
|
||||
tolerations:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
@@ -185,6 +90,39 @@ spec:
|
||||
- name: runner-data
|
||||
emptyDir:
|
||||
sizeLimit: 30Gi
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- uk-desktop.tail2fe2d.ts.net
|
||||
- weight: 50
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- home.homenet
|
||||
- weight: 30
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- master.tail2fe2d.ts.net
|
||||
- weight: 10
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- it.tail2fe2d.ts.net
|
||||
- ch.tail2fe2d.ts.net
|
||||
- us.tail2fe2d.ts.net
|
||||
containers:
|
||||
- name: gitea-runner
|
||||
image: gitea/act_runner:nightly
|
||||
@@ -211,6 +149,6 @@ spec:
|
||||
name: gitea-runner-act-runner-secrets
|
||||
key: token
|
||||
- name: GITEA_RUNNER_NAME
|
||||
value: "k8s-runner-desktop"
|
||||
value: "k8s-runner"
|
||||
- name: GITEA_RUNNER_LABELS
|
||||
value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04"
|
||||
|
||||
@@ -131,6 +131,8 @@ spec:
|
||||
{{ .synapse }}
|
||||
USER_mas: |-
|
||||
{{ .mas }}
|
||||
USER_furumi: |-
|
||||
{{ .furumi }}
|
||||
data:
|
||||
- secretKey: authentik
|
||||
sourceRef:
|
||||
@@ -297,4 +299,15 @@ spec:
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[15].value
|
||||
- secretKey: furumi
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: 2a9deb39-ef22-433e-a1be-df1555625e22
|
||||
property: fields[16].value
|
||||
|
||||
|
||||
@@ -208,5 +208,25 @@ oauth_applications = {
|
||||
create_group = false
|
||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
||||
}
|
||||
"furumi-ng-web" = {
|
||||
name = "Furumi Web Player"
|
||||
slug = "furumi-ng-web"
|
||||
group = "Tools"
|
||||
meta_description = "Furumi Web Player"
|
||||
meta_icon = "https://img.icons8.com/pulsar-color/48/music.png"
|
||||
redirect_uris = [
|
||||
"https://music.hexor.cy/auth/callback",
|
||||
]
|
||||
meta_launch_url = "https://music.hexor.cy"
|
||||
client_type = "confidential"
|
||||
include_claims_in_id_token = true
|
||||
access_code_validity = "minutes=1"
|
||||
access_token_validity = "minutes=5"
|
||||
refresh_token_validity = "days=30"
|
||||
scope_mappings = ["openid", "profile", "email"]
|
||||
access_groups = []
|
||||
create_group = true
|
||||
signing_key = "1b1b5bec-034a-4d96-871a-133f11322360"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user