Change to ghost:alpine

ghost-blog/ghost-config-es.yaml

@@ -1,66 +1,42 @@
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
-  name: ghost-config-prod
+  name: ghost-mail-config
   namespace: ghost-blog
-  annotations:
-    argocd.argoproj.io/sync-wave: "4"
 spec:
   refreshInterval: "15m"
   secretStoreRef:
     name: vault-backend
     kind: ClusterSecretStore
   target:
-    name: ghost-config-prod
+    name: ghost-mail-config
     creationPolicy: Owner
   data:
-  - secretKey: config.production.json
+  - secretKey: mail__transport
     remoteRef:
       key: kv/ghost-blog/config
-    template:
-      engine: gotmpl
-      data: |
-        {
-          "url": "https://blog.hensen.io",
-          "admin": {
-            "url": "https://blog.hensen.io"
-          },
-          "server": {
-            "port": 2368,
-            "host": "0.0.0.0"
-          },
-          "mail": {
-            "transport": "SMTP",
-            "from": "{{ .email_from }}",
-            "options": {
-              "service": "{{ .email_service }}",
-              "host": "{{ .email_host }}",
-              "port": {{ .email_port }},
-              "secure": {{ .email_secure }},
-              "auth": {
-                "user": "{{ .email_user }}",
-                "pass": "{{ .email_password }}"
-              }
-            }
-          },
-          "logging": {
-            "transports": [
-              "stdout"
-            ]
-          },
-          "database": {
-            "client": "mysql",
-            "connection": 
-            {
-              "host": "ghost-mysql-service",
-              "user": "{{ .db_user }}",
-              "password": "{{ .db_password }}",
-              "database": "{{ .db_name }}",
-              "port": "3306"
-            }
-          },
-          "process": "local",
-          "paths": {
-            "contentPath": "/home/nonroot/app/ghost/content"
-          }
-        }
+      property: email_transport
+  - secretKey: mail__from
+    remoteRef:
+      key: kv/ghost-blog/config
+      property: email_from
+  - secretKey: mail__options__service
+    remoteRef:
+      key: kv/ghost-blog/config
+      property: email_service
+  - secretKey: mail__options__host
+    remoteRef:
+      key: kv/ghost-blog/config
+      property: email_host
+  - secretKey: mail__options__port
+    remoteRef:
+      key: kv/ghost-blog/config
+      property: email_port
+  - secretKey: mail__options__auth__user
+    remoteRef:
+      key: kv/ghost-blog/config
+      property: email_user
+  - secretKey: mail__options__auth__pass
+    remoteRef:
+      key: kv/ghost-blog/config
+      property: email_password

ghost-blog/ghost-deployment.yaml

@@ -10,8 +10,6 @@ metadata:
     app.kubernetes.io/version: '5.92'
     app.kubernetes.io/component: ghost
     app.kubernetes.io/part-of: ghost-blog
-  annotations:
-    argocd.argoproj.io/sync-wave: "6"
 spec:
   replicas: 1
   selector:
@@ -36,35 +34,24 @@ spec:
       - name: ghost-content
         persistentVolumeClaim:
           claimName: ghost-content
-      - name: ghost-config-prod
-        secret:
-          secretName: ghost-config-prod
-          defaultMode: 420
       - name: tmp
         emptyDir:
           sizeLimit: 64Mi
-      - name: ghost-logs
-        emptyDir:
-          sizeLimit: 256Mi
 
       initContainers:
       - name: permissions-fix
         imagePullPolicy: IfNotPresent
         image: docker.io/busybox:stable-musl
         env:
-        - name: GHOST_INSTALL
-          value: /home/nonroot/app/ghost
         - name: GHOST_CONTENT
-          value: /home/nonroot/app/ghost/content
-        - name: NODE_ENV
-          value: production
+          value: /var/lib/ghost/content
         securityContext:
           readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
         resources:
           limits:
-            cpu: 900m
-            memory: 1000Mi
+            cpu: 500m
+            memory: 256Mi
           requests:
             cpu: 100m
             memory: 128Mi
@@ -81,20 +68,17 @@ spec:
                 echo "Creating $GHOST_CONTENT/$dir directory"
                 mkdir -pv $GHOST_CONTENT/$dir || echo "Error creating $GHOST_CONTENT/$dir directory"
               fi
-              chown -Rfv 65532:65532 $GHOST_CONTENT/$dir && echo "chown ok on $dir" || echo "Error changing ownership of $GHOST_CONTENT/$dir directory"
+              chown -Rfv 1000:1000 $GHOST_CONTENT/$dir && echo "chown ok on $dir" || echo "Error changing ownership of $GHOST_CONTENT/$dir directory"
             done
             exit 0
         volumeMounts:
         - name: ghost-content
-          mountPath: /home/nonroot/app/ghost/content
-          readOnly: false
-        - name: ghost-logs
-          mountPath: /home/nonroot/app/ghost/versions/5.114.0/content/logs
+          mountPath: /var/lib/ghost/content
           readOnly: false
 
       containers:
       - name: ghost-blog
-        image: ghost:latest
+        image: ghost:5.114.1-alpine
         imagePullPolicy: Always
         ports:
         - name: ghost
@@ -131,6 +115,30 @@ spec:
         env:
         - name: NODE_ENV
           value: production
+        - name: database__client
+          value: mysql
+        - name: database__connection__host
+          value: ghost-mysql-service
+        - name: database__connection__user
+          valueFrom:
+            secretKeyRef:
+              name: ghost-mysql-env
+              key: MYSQL_USER
+        - name: database__connection__password
+          valueFrom:
+            secretKeyRef:
+              name: ghost-mysql-env
+              key: MYSQL_PASSWORD
+        - name: database__connection__database
+          valueFrom:
+            secretKeyRef:
+              name: ghost-mysql-env
+              key: MYSQL_DATABASE
+        - name: url
+          value: https://blog.hensen.io
+        envFrom:
+        - secretRef:
+            name: ghost-mail-config
         resources:
           limits:
             cpu: 800m
@@ -153,10 +161,12 @@ spec:
           mountPath: /home/nonroot/app/ghost/versions/5.114.0/content/logs
           readOnly: false
         securityContext:
-          readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
           runAsNonRoot: true
-          runAsUser: 65532
+          runAsUser: 1000
       restartPolicy: Always
       terminationGracePeriodSeconds: 15
-      dnsPolicy: ClusterFirst
+      dnsPolicy: ClusterFirst
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault