Remove ghost-blog and whishper

Neither is used any more: the blog moves to a self-written site, and
whishper needs more compute than this setup has. Ghost also ran Node 18,
which won't get the eMudhra root store fix.

Drops both apps, the blog DNS record, Gatus check and node001 tunnel
entry, their ca-bundle namespaces, and the leftover ExternalSecret for the
old hensen.io blog namespace. Final Velero backups keep the data:
ghost-blog-final-202610220955 until 22 October 2027 and
whisper-final-202610220955 until 20 January 2027.

apps/templates/ghost-blog-folder.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: ghost-blog
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: https://github.com/rubenhensen/k8scd.git
-    targetRevision: HEAD
-    path: ghost-blog
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: ghost-blog
-  syncPolicy:
-    syncOptions:
-    - CreateNamespace=true
-    automated:
-      selfHeal: true

apps/templates/whisper-folder.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: whisper
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: https://github.com/rubenhensen/k8scd.git
-    targetRevision: HEAD
-    path: whishper
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: whisper
-  syncPolicy:
-    syncOptions:
-    - CreateNamespace=true
-    automated:
-      selfHeal: true

ca-bundle/values.yaml

@@ -6,9 +6,7 @@ namespaces:
   - bolletjestrui
   - cert-manager
   - gatus
-  - ghost-blog
   - gitea
   - immich
   - ntfy
   - serpbear
-  - whisper

dns/domains/rubenhensen.nl.yaml

@@ -39,10 +39,6 @@ records:
     expire: 300
     type: A
     content: "46.224.26.65"
-  - name: "blog"
-    expire: 300
-    type: A
-    content: "46.224.26.65"
   - name: "serpbear"
     expire: 300
     type: A

gatus/config.yaml

@@ -73,11 +73,6 @@ endpoints:
     conditions:
       - "[STATUS] == 401"
       - "[CERTIFICATE_EXPIRATION] > 168h"
-  - name: blog
-    group: rubenhensen.nl
-    url: https://blog.rubenhensen.nl
-    interval: 60s
-    conditions: *http-ok
   - name: serpbear
     group: rubenhensen.nl
     url: https://serpbear.rubenhensen.nl

ghost-blog/ghost-config-es.yaml

@@ -1,42 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: ghost-mail-config
-  namespace: ghost-blog
-spec:
-  refreshInterval: "15m"
-  secretStoreRef:
-    name: vault-backend
-    kind: ClusterSecretStore
-  target:
-    name: ghost-mail-config
-    creationPolicy: Owner
-  data:
-  - secretKey: mail__transport
-    remoteRef:
-      key: kv/ghost-blog/config
-      property: email_transport
-  - secretKey: mail__from
-    remoteRef:
-      key: kv/ghost-blog/config
-      property: email_from
-  - secretKey: mail__options__service
-    remoteRef:
-      key: kv/ghost-blog/config
-      property: email_service
-  - secretKey: mail__options__host
-    remoteRef:
-      key: kv/ghost-blog/config
-      property: email_host
-  - secretKey: mail__options__port
-    remoteRef:
-      key: kv/ghost-blog/config
-      property: email_port
-  - secretKey: mail__options__auth__user
-    remoteRef:
-      key: kv/ghost-blog/config
-      property: email_user
-  - secretKey: mail__options__auth__pass
-    remoteRef:
-      key: kv/ghost-blog/config
-      property: email_password

ghost-blog/ghost-deployment.yaml

@@ -1,178 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: ghost-blog
-  namespace: ghost-blog
-  labels:
-    app: ghost-blog
-    app.kubernetes.io/name: ghost-blog
-    app.kubernetes.io/instance: ghost-blog
-    app.kubernetes.io/version: '5.92'
-    app.kubernetes.io/component: ghost
-    app.kubernetes.io/part-of: ghost-blog
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: ghost-blog
-  minReadySeconds: 5
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 0
-      maxSurge: 3
-  revisionHistoryLimit: 4
-  progressDeadlineSeconds: 600
-  template:
-    metadata:
-      namespace: ghost-blog
-      labels:
-        app: ghost-blog
-    spec:
-      automountServiceAccountToken: false
-      volumes:
-      - name: ghost-content
-        persistentVolumeClaim:
-          claimName: ghost-content
-      - name: tmp
-        emptyDir:
-          sizeLimit: 64Mi
-      - name: patched-ca-bundle
-        configMap:
-          name: patched-ca-bundle
-
-      initContainers:
-      - name: permissions-fix
-        imagePullPolicy: IfNotPresent
-        image: docker.io/busybox:stable-musl
-        env:
-        - name: GHOST_CONTENT
-          value: /var/lib/ghost/content
-        securityContext:
-          readOnlyRootFilesystem: true
-          allowPrivilegeEscalation: false
-        resources:
-          limits:
-            cpu: 500m
-            memory: 256Mi
-          requests:
-            cpu: 100m
-            memory: 128Mi
-        command:
-          - /bin/sh
-          - '-c'
-          - |
-            set -e
-            export DIRS='files logs apps themes data public settings images media'
-            echo 'Check if base dirs exists, if not, create them'
-            echo "Directories to check: $DIRS"
-            for dir in $DIRS; do
-              if [ ! -d $GHOST_CONTENT/$dir ]; then
-                echo "Creating $GHOST_CONTENT/$dir directory"
-                mkdir -pv $GHOST_CONTENT/$dir || echo "Error creating $GHOST_CONTENT/$dir directory"
-              fi
-              chown -Rfv 1000:1000 $GHOST_CONTENT/$dir && echo "chown ok on $dir" || echo "Error changing ownership of $GHOST_CONTENT/$dir directory"
-            done
-            exit 0
-        volumeMounts:
-        - name: ghost-content
-          mountPath: /var/lib/ghost/content
-          readOnly: false
-
-      containers:
-      - name: ghost-blog
-        image: ghost:5.114.1-alpine
-        imagePullPolicy: Always
-        ports:
-        - name: ghost
-          containerPort: 2368
-          protocol: TCP
-        readinessProbe:
-          httpGet:
-            path: /ghost/api/v4/admin/site/
-            port: ghost
-            httpHeaders:
-            - name: X-Forwarded-Proto
-              value: https
-            - name: Host
-              value: blog.rubenhensen.nl
-          periodSeconds: 10
-          timeoutSeconds: 3
-          successThreshold: 1
-          failureThreshold: 3
-          initialDelaySeconds: 10
-        livenessProbe:
-          httpGet:
-            path: /ghost/api/v4/admin/site/
-            port: ghost
-            httpHeaders:
-            - name: X-Forwarded-Proto
-              value: https
-            - name: Host
-              value: blog.rubenhensen.nl
-          periodSeconds: 300
-          timeoutSeconds: 3
-          successThreshold: 1
-          failureThreshold: 1
-          initialDelaySeconds: 30
-        env:
-        - name: NODE_ENV
-          value: production
-        - name: database__client
-          value: mysql
-        - name: database__connection__host
-          value: ghost-mysql-service
-        - name: database__connection__user
-          valueFrom:
-            secretKeyRef:
-              name: ghost-mysql-env
-              key: MYSQL_USER
-        - name: database__connection__password
-          valueFrom:
-            secretKeyRef:
-              name: ghost-mysql-env
-              key: MYSQL_PASSWORD
-        - name: database__connection__database
-          valueFrom:
-            secretKeyRef:
-              name: ghost-mysql-env
-              key: MYSQL_DATABASE
-        - name: url
-          value: https://blog.rubenhensen.nl
-        # Node trusts its built-in roots, which still include the ones above
-        # the compromised eMudhra intermediates. Use patched-ca-bundle through
-        # OpenSSL instead until Node ships a fix.
-        - name: NODE_OPTIONS
-          value: --use-openssl-ca
-        - name: SSL_CERT_FILE
-          value: /etc/ssl/certs/ca-certificates.crt
-        envFrom:
-        - secretRef:
-            name: ghost-mail-config
-        resources:
-          limits:
-            cpu: 800m
-            memory: 800Mi
-          requests:
-            cpu: 200m
-            memory: 400Mi
-        volumeMounts:
-        - name: ghost-content
-          mountPath: /var/lib/ghost/content
-          readOnly: false
-        - name: tmp
-          mountPath: /tmp
-          readOnly: false
-        - name: patched-ca-bundle
-          mountPath: /etc/ssl/certs
-          readOnly: true
-        securityContext:
-          allowPrivilegeEscalation: false
-          runAsNonRoot: true
-          runAsUser: 1000
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 15
-      dnsPolicy: ClusterFirst
-      securityContext:
-        seccompProfile:
-          type: RuntimeDefault

ghost-blog/ingress.yaml

@@ -1,33 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: ghost-blog-ingress
-  namespace: ghost-blog
-  labels:
-    app: ghost-blog
-    app.kubernetes.io/name: ghost-blog-ingress
-    app.kubernetes.io/instance: ghost-blog
-    app.kubernetes.io/version: '5.92'
-    app.kubernetes.io/component: ingress
-    app.kubernetes.io/part-of: ghost-blog
-  annotations:
-    cert-manager.io/cluster-issuer: prod-cluster-issuer
-    nginx.ingress.kubernetes.io/proxy-body-size: 1G
-    argocd.argoproj.io/sync-wave: "7"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - blog.rubenhensen.nl
-    secretName: ghost-tls-secret
-  rules:
-  - host: blog.rubenhensen.nl
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: ghost-service
-            port:
-              name: ghost

ghost-blog/mysql-es.yaml

@@ -1,36 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: ghost-mysql-env
-  namespace: ghost-blog
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-spec:
-  refreshInterval: "15m"
-  secretStoreRef:
-    name: vault-backend
-    kind: ClusterSecretStore
-  target:
-    name: ghost-mysql-env
-    creationPolicy: Owner
-  data:
-  - secretKey: MYSQL_DATABASE
-    remoteRef:
-      key: kv/ghost-blog/mysql
-      property: database
-  - secretKey: MYSQL_USER
-    remoteRef:
-      key: kv/ghost-blog/mysql
-      property: username
-  - secretKey: MYSQL_PASSWORD
-    remoteRef:
-      key: kv/ghost-blog/mysql
-      property: password
-  - secretKey: MYSQL_ROOT_PASSWORD
-    remoteRef:
-      key: kv/ghost-blog/mysql
-      property: root_password
-  # - secretKey: MYSQL_HOST
-  #   remoteRef:
-  #     key: kv/ghost-blog/mysql
-  #     property: host

ghost-blog/mysql.yaml

@@ -1,114 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: ghost-mysql
-  namespace: ghost-blog
-  labels:
-    app: ghost-mysql
-    app.kubernetes.io/name: ghost-mysql
-    app.kubernetes.io/instance: ghost-blog
-    app.kubernetes.io/version: '5.92'
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: ghost-blog
-  annotations:
-    argocd.argoproj.io/sync-wave: "5"
-spec:
-  serviceName: ghost-mysql-service
-  replicas: 1
-  selector:
-    matchLabels:
-      app: ghost-mysql
-  template:
-    metadata:
-      labels:
-        app: ghost-mysql
-    spec:
-      initContainers:
-      - name: ghost-mysql-init
-        securityContext:
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-        image: docker.io/busybox:stable-musl
-        imagePullPolicy: IfNotPresent
-        command:
-        - /bin/sh
-        - -c
-        - |
-          set -e
-          echo 'Changing ownership of mysql mount directory to 65534:65534'
-          chown -Rfv 65534:65534 /mnt/mysql || echo 'Error changing ownership of mysql mount directory to 65534:65534'
-          echo 'Changing ownership of tmp mount directory to 65534:65534'
-          chown -Rfv 65534:65534 /mnt/tmp || echo 'Error changing ownership of tmp mount directory to 65534:65534'
-          echo 'Changing ownership of socket mount directory to 65534:65534'
-          chown -Rfv 65534:65534 /mnt/var/run/mysqld || echo 'Error changing ownership of socket mount directory to 65534:65534'
-        volumeMounts:
-        - name: ghost-mysql-volume
-          mountPath: /mnt/mysql
-          subPath: mysql-empty-subdir
-          readOnly: false
-        - name: ghost-mysql-tmp
-          mountPath: /mnt/tmp
-          readOnly: false
-        - name: ghost-mysql-socket
-          mountPath: /mnt/var/run/mysqld
-          readOnly: false
-        resources:
-          requests:
-            memory: 50Mi
-            cpu: 50m
-          limits:
-            memory: 100Mi
-            cpu: 100m
-
-      containers:
-      - name: ghost-mysql
-        securityContext:
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 65534
-        image: docker.io/mysql:8.4
-        imagePullPolicy: IfNotPresent
-        envFrom:
-        - secretRef:
-            name: ghost-mysql-env
-        resources:
-          requests:
-            memory: 256Mi
-            cpu: 100m
-          limits:
-            memory: 512Mi
-            cpu: 500m
-        ports:
-        - containerPort: 3306
-          protocol: TCP
-          name: mysql
-        volumeMounts:
-        - name: ghost-mysql-volume
-          mountPath: /var/lib/mysql
-          subPath: mysql-empty-subdir
-          readOnly: false
-        - name: ghost-mysql-tmp
-          mountPath: /tmp
-          readOnly: false
-        - name: ghost-mysql-socket
-          mountPath: /var/run/mysqld
-          readOnly: false
-
-      automountServiceAccountToken: false
-      securityContext:
-        seccompProfile:
-          type: RuntimeDefault
-
-      volumes:
-      - name: ghost-mysql-volume
-        persistentVolumeClaim:
-          claimName: ghost-mysql-pvc
-      - name: ghost-mysql-tmp
-        emptyDir:
-          sizeLimit: 128Mi
-      - name: ghost-mysql-socket
-        emptyDir:
-          sizeLimit: 128Mi

ghost-blog/pvc.yaml

@@ -1,41 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: ghost-content
-  namespace: ghost-blog
-  labels:
-    app: ghost-blog
-    app.kubernetes.io/name: ghost-content
-    app.kubernetes.io/instance: ghost-blog
-    app.kubernetes.io/version: '5.92'
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: ghost-blog
-spec:
-  storageClassName: "longhorn"
-  volumeMode: Filesystem
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: ghost-mysql-pvc
-  namespace: ghost-blog
-  labels:
-    app: ghost-mysql
-    app.kubernetes.io/name: ghost-mysql-pvc
-    app.kubernetes.io/instance: ghost-blog
-    app.kubernetes.io/version: '5.92'
-    app.kubernetes.io/component: database-storage
-    app.kubernetes.io/part-of: ghost-blog
-spec:
-  storageClassName: "longhorn"
-  volumeMode: Filesystem
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi

ghost-blog/services.yaml

@@ -1,44 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: ghost-service
-  namespace: ghost-blog
-  labels:
-    app: ghost-blog
-    app.kubernetes.io/name: ghost-service
-    app.kubernetes.io/instance: ghost-blog
-    app.kubernetes.io/version: '5.92'
-    app.kubernetes.io/component: service-frontend
-    app.kubernetes.io/part-of: ghost-blog
-spec:
-  ports:
-  - port: 2368
-    protocol: TCP
-    targetPort: ghost
-    name: ghost
-  type: ClusterIP
-  selector:
-    app: ghost-blog
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: ghost-mysql-service
-  namespace: ghost-blog
-  labels:
-    app: ghost-mysql
-    app.kubernetes.io/name: ghost-mysql-service
-    app.kubernetes.io/instance: ghost-blog
-    app.kubernetes.io/version: '5.92'
-    app.kubernetes.io/component: service-database
-    app.kubernetes.io/part-of: ghost-blog
-spec:
-  ports:
-  - port: 3306
-    protocol: TCP
-    targetPort: mysql
-    name: mysql
-  type: ClusterIP
-  selector:
-    app: ghost-mysql

nix-infra-machine/nodes/node001.nix

@@ -16,7 +16,6 @@ let
     "argocd.rubenhensen.nl"
     "ha.rubenhensen.nl"
     "longhorn.rubenhensen.nl"
-    "blog.rubenhensen.nl"
     "serpbear.rubenhensen.nl"
     "git.rubenhensen.nl"
     "vic.rubenhensen.nl"

secrets/blog.yaml

@@ -1,33 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: hensenio-ghost-secrets
-  namespace: blog
-spec:
-  refreshInterval: "15m"
-  secretStoreRef:
-    name: vault-backend
-    kind: ClusterSecretStore
-  target:
-    name: ghost-es
-    creationPolicy: Owner
-  data:
-    - secretKey: mysql-root-password
-      remoteRef:
-        key: kv/ghost
-        property: ghostmsqlrootpw
-
-    - secretKey: mysql-password
-      remoteRef:
-        key: kv/ghost
-        property: ghostmsqlpw
-
-    - secretKey: ghost-password
-      remoteRef:
-        key: kv/ghost
-        property: ghostpw
-
-    - secretKey: smtp-password
-      remoteRef:
-        key: kv/hensenio/smtp
-        property: password

whishper/env-configmap.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-data:
-  DB_PASS: whishper
-  DB_USER: whishper
-  LT_LOAD_ONLY: es,en,fr,nl
-  WHISHPER_HOST: http://127.0.0.1:8082
-  WHISPER_MODELS: tiny,small,large-v3
-kind: ConfigMap
-metadata:
-  labels:
-    io.kompose.service: mongo-env
-  name: env

whishper/mongo-claim0-persistentvolumeclaim.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  labels:
-    io.kompose.service: mongo-claim10
-  name: mongo-claim10
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi

whishper/mongo-claim1-persistentvolumeclaim.yaml

@@ -1,12 +0,0 @@
-# apiVersion: v1
-# kind: PersistentVolumeClaim
-# metadata:
-#   labels:
-#     io.kompose.service: mongo-claim1
-#   name: mongo-claim1
-# spec:
-#   accessModes:
-#     - ReadWriteOnce
-#   resources:
-#     requests:
-#       storage: 10Gi

whishper/mongo-deployment.yaml

@@ -1,76 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  annotations:
-    kompose.cmd: kompose convert
-    kompose.version: 1.34.0 (cbf2835db)
-  labels:
-    io.kompose.service: mongo
-  name: mongo
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      io.kompose.service: mongo
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      annotations:
-        kompose.cmd: kompose convert
-        kompose.version: 1.34.0 (cbf2835db)
-      labels:
-        io.kompose.service: mongo
-    spec:
-      containers:
-        # - args:
-        #     - --logpath
-        #     - /var/log/mongodb/mongod.log
-        - env:
-            - name: DB_PASS
-              valueFrom:
-                configMapKeyRef:
-                  key: DB_PASS
-                  name: env
-            - name: DB_USER
-              valueFrom:
-                configMapKeyRef:
-                  key: DB_USER
-                  name: env
-            - name: LT_LOAD_ONLY
-              valueFrom:
-                configMapKeyRef:
-                  key: LT_LOAD_ONLY
-                  name: env
-            - name: MONGO_INITDB_ROOT_PASSWORD
-              value: whishper
-            - name: MONGO_INITDB_ROOT_USERNAME
-              value: whishper
-            - name: WHISHPER_HOST
-              valueFrom:
-                configMapKeyRef:
-                  key: WHISHPER_HOST
-                  name: env
-            - name: WHISPER_MODELS
-              valueFrom:
-                configMapKeyRef:
-                  key: WHISPER_MODELS
-                  name: env
-          image: mongo
-          name: mongo
-          ports:
-            - containerPort: 27017
-              protocol: TCP
-          volumeMounts:
-            - mountPath: /data/db
-              name: mongo-claim0
-            # - mountPath: /var/log/mongodb
-            #   name: mongo-claim1
-      restartPolicy: Always
-      volumes:
-        - name: mongo-claim0
-          persistentVolumeClaim:
-            claimName: mongo-claim10
-        # - name: mongo-claim1
-        #   persistentVolumeClaim:
-        #     claimName: mongo-claim1

whishper/mongo-service.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    kompose.cmd: kompose convert
-    kompose.version: 1.34.0 (cbf2835db)
-  labels:
-    io.kompose.service: mongo
-  name: mongo
-spec:
-  ports:
-    - name: "27017"
-      port: 27017
-      targetPort: 27017
-  selector:
-    io.kompose.service: mongo

whishper/translate-claim0-persistentvolumeclaim.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  labels:
-    io.kompose.service: translate-claim0
-  name: translate-claim0
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi

whishper/translate-claim1-persistentvolumeclaim.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  labels:
-    io.kompose.service: translate-claim1
-  name: translate-claim1
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi

whishper/translate-deployment.yaml

@@ -1,97 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  annotations:
-    kompose.cmd: kompose convert
-    kompose.version: 1.34.0 (cbf2835db)
-  labels:
-    io.kompose.service: translate
-  name: translate
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      io.kompose.service: translate
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      annotations:
-        kompose.cmd: kompose convert
-        kompose.version: 1.34.0 (cbf2835db)
-      labels:
-        io.kompose.service: translate
-    spec:
-      containers:
-        - image: libretranslate/libretranslate:latest
-          securityContext:
-            runAsUser: 0
-            runAsGroup: 0
-            runAsNonRoot: false
-          livenessProbe:
-            exec:
-              command:
-                - ./venv/bin/python scripts/healthcheck.py
-            failureThreshold: 5
-            periodSeconds: 2
-            timeoutSeconds: 3
-          name: whisper-libretranslate
-          ports:
-            - containerPort: 5000
-              protocol: TCP
-          tty: true
-          volumeMounts:
-            - mountPath: /home/libretranslate/.local/share
-              name: translate-claim0
-            - mountPath: /home/libretranslate/.local/cache
-              name: translate-claim1
-            - mountPath: /etc/ssl/certs
-              name: patched-ca-bundle
-              readOnly: true
-          env:
-            # Trust store without the compromised eMudhra intermediates, see
-            # ca-bundle/. requests would otherwise use certifi.
-            - name: SSL_CERT_FILE
-              value: /etc/ssl/certs/ca-certificates.crt
-            - name: REQUESTS_CA_BUNDLE
-              value: /etc/ssl/certs/ca-certificates.crt
-            - name: DB_PASS
-              valueFrom:
-                configMapKeyRef:
-                  key: DB_PASS
-                  name: env
-            - name: DB_USER
-              valueFrom:
-                configMapKeyRef:
-                  key: DB_USER
-                  name: env
-            - name: LT_DISABLE_WEB_UI
-              value: "true"
-            - name: LT_LOAD_ONLY
-              valueFrom:
-                configMapKeyRef:
-                  key: LT_LOAD_ONLY
-                  name: env
-            - name: LT_UPDATE_MODELS
-              value: "true"
-            - name: WHISHPER_HOST
-              valueFrom:
-                configMapKeyRef:
-                  key: WHISHPER_HOST
-                  name: env
-            - name: WHISPER_MODELS
-              valueFrom:
-                configMapKeyRef:
-                  key: WHISPER_MODELS
-                  name: env
-      restartPolicy: Always
-      volumes:
-        - name: patched-ca-bundle
-          configMap:
-            name: patched-ca-bundle
-        - name: translate-claim0
-          persistentVolumeClaim:
-            claimName: translate-claim0
-        - name: translate-claim1
-          persistentVolumeClaim:
-            claimName: translate-claim1

whishper/translate-service.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    kompose.cmd: kompose convert
-    kompose.version: 1.34.0 (cbf2835db)
-  labels:
-    io.kompose.service: translate
-  name: translate
-spec:
-  ports:
-    - name: "5000"
-      port: 5000
-      targetPort: 5000
-  selector:
-    io.kompose.service: translate

whishper/whishper-claim0-persistentvolumeclaim.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  labels:
-    io.kompose.service: whishper-claim0
-  name: whishper-claim0
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi

whishper/whishper-claim1-persistentvolumeclaim.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  labels:
-    io.kompose.service: whishper-claim1
-  name: whishper-claim1
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi

whishper/whishper-deployment.yaml

@@ -1,96 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  annotations:
-    kompose.cmd: kompose convert
-    kompose.version: 1.34.0 (cbf2835db)
-  labels:
-    io.kompose.service: whishper
-  name: whishper
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      io.kompose.service: whishper
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      annotations:
-        kompose.cmd: kompose convert
-        kompose.version: 1.34.0 (cbf2835db)
-      labels:
-        io.kompose.service: whishper
-    spec:
-      containers:
-        - env:
-            - name: CPU_THREADS
-              value: "4"
-            - name: DB_PASS
-              valueFrom:
-                configMapKeyRef:
-                  key: DB_PASS
-                  name: env
-            - name: DB_USER
-              valueFrom:
-                configMapKeyRef:
-                  key: DB_USER
-                  name: env
-            - name: LT_LOAD_ONLY
-              valueFrom:
-                configMapKeyRef:
-                  key: LT_LOAD_ONLY
-                  name: env
-            - name: PUBLIC_API_HOST
-            - name: PUBLIC_INTERNAL_API_HOST
-              value: http://127.0.0.1:80
-            - name: PUBLIC_TRANSLATION_API_HOST
-            - name: PUBLIC_WHISHPER_PROFILE
-              value: cpu
-            - name: UPLOAD_DIR
-              value: /app/uploads
-            - name: WHISHPER_HOST
-              valueFrom:
-                configMapKeyRef:
-                  key: WHISHPER_HOST
-                  name: env
-            - name: WHISPER_MODELS
-              valueFrom:
-                configMapKeyRef:
-                  key: WHISPER_MODELS
-                  name: env
-            - name: WHISPER_MODELS_DIR
-              value: /app/models
-            # Trust store without the compromised eMudhra intermediates, see
-            # ca-bundle/. Node needs --use-openssl-ca to stop using its
-            # built-in roots; requests would otherwise use certifi.
-            - name: NODE_OPTIONS
-              value: --use-openssl-ca
-            - name: SSL_CERT_FILE
-              value: /etc/ssl/certs/ca-certificates.crt
-            - name: REQUESTS_CA_BUNDLE
-              value: /etc/ssl/certs/ca-certificates.crt
-          image: pluja/whishper:latest
-          name: whishper
-          ports:
-            - containerPort: 80
-              protocol: TCP
-          volumeMounts:
-            - mountPath: /app/uploads
-              name: whishper-claim0
-            - mountPath: /var/log/whishper
-              name: whishper-claim1
-            - mountPath: /etc/ssl/certs
-              name: patched-ca-bundle
-              readOnly: true
-      restartPolicy: Always
-      volumes:
-        - name: patched-ca-bundle
-          configMap:
-            name: patched-ca-bundle
-        - name: whishper-claim0
-          persistentVolumeClaim:
-            claimName: whishper-claim0
-        - name: whishper-claim1
-          persistentVolumeClaim:
-            claimName: whishper-claim1

whishper/whishper-service.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    kompose.cmd: kompose convert
-    kompose.version: 1.34.0 (cbf2835db)
-  labels:
-    io.kompose.service: whishper
-  name: whishper
-spec:
-  ports:
-    - name: "8082"
-      port: 8082
-      targetPort: 80
-  selector:
-    io.kompose.service: whishper