From f13417bc8f3bf761e004b3e4531b36744957be59 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Tue, 21 Jul 2026 14:33:31 +0200 Subject: [PATCH] Add bolletjestrui app + vic.rubenhensen.nl Deploys ghcr.io/rubenhensen/bolletjestrui at vic.rubenhensen.nl: - bolletjestrui/ folder: deployment (SQLite on a PVC, migrate-on-start, ORIGIN + raised BODY_SIZE_LIMIT for GPX uploads), service, nginx ingress with prod-cluster-issuer TLS, PVC, and a Vault ExternalSecret (kv/bolletjestrui: site_password, admin_password, key_secret). - apps/templates/bolletjestrui-folder.yaml: ArgoCD Application. - dns: vic A record -> 46.224.26.65 (ingress LB). - renovate: watch bolletjestrui/ for image tag bumps. Committed locally, not pushed: needs the Vault secret created and the ghcr package made public first. --- apps/templates/bolletjestrui-folder.yaml | 21 +++++ bolletjestrui/bolletjestrui-deployment.yaml | 80 +++++++++++++++++++ bolletjestrui/bolletjestrui-service.yaml | 13 +++ bolletjestrui/data-persistentvolumeclaim.yaml | 12 +++ bolletjestrui/external-secret.yaml | 25 ++++++ bolletjestrui/ingress.yaml | 26 ++++++ dns/domains/rubenhensen.nl.yaml | 4 + renovate.json | 3 +- 8 files changed, 183 insertions(+), 1 deletion(-) create mode 100644 apps/templates/bolletjestrui-folder.yaml create mode 100644 bolletjestrui/bolletjestrui-deployment.yaml create mode 100644 bolletjestrui/bolletjestrui-service.yaml create mode 100644 bolletjestrui/data-persistentvolumeclaim.yaml create mode 100644 bolletjestrui/external-secret.yaml create mode 100644 bolletjestrui/ingress.yaml diff --git a/apps/templates/bolletjestrui-folder.yaml b/apps/templates/bolletjestrui-folder.yaml new file mode 100644 index 0000000..56e0286 --- /dev/null +++ b/apps/templates/bolletjestrui-folder.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: bolletjestrui + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: https://github.com/rubenhensen/k8scd.git + targetRevision: HEAD + path: bolletjestrui + destination: + server: https://kubernetes.default.svc + namespace: bolletjestrui + syncPolicy: + syncOptions: + - CreateNamespace=true + automated: + selfHeal: true diff --git a/bolletjestrui/bolletjestrui-deployment.yaml b/bolletjestrui/bolletjestrui-deployment.yaml new file mode 100644 index 0000000..47f75ec --- /dev/null +++ b/bolletjestrui/bolletjestrui-deployment.yaml @@ -0,0 +1,80 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: bolletjestrui + name: bolletjestrui +spec: + replicas: 1 + selector: + matchLabels: + app: bolletjestrui + strategy: + type: Recreate + template: + metadata: + labels: + app: bolletjestrui + spec: + containers: + - image: ghcr.io/rubenhensen/bolletjestrui:main-bb54c6a + name: bolletjestrui + ports: + - containerPort: 3000 + protocol: TCP + env: + - name: DATABASE_URL + value: /app/data/bolletjestrui.db + - name: ORIGIN + value: https://vic.rubenhensen.nl + - name: PROTOCOL_HEADER + value: x-forwarded-proto + - name: HOST_HEADER + value: x-forwarded-host + # route GPX uploads can be a few MB; raise adapter-node's 512K default + - name: BODY_SIZE_LIMIT + value: "10M" + - name: TZ + value: Europe/Amsterdam + - name: SITE_PASSWORD + valueFrom: + secretKeyRef: + name: bolletjestrui-secrets + key: site_password + - name: ADMIN_PASSWORD + valueFrom: + secretKeyRef: + name: bolletjestrui-secrets + key: admin_password + - name: KEY_SECRET + valueFrom: + secretKeyRef: + name: bolletjestrui-secrets + key: key_secret + resources: + requests: + memory: "128Mi" + cpu: "50m" + limits: + memory: "512Mi" + cpu: "500m" + readinessProbe: + httpGet: + path: /login + port: 3000 + initialDelaySeconds: 5 + periodSeconds: 10 + livenessProbe: + httpGet: + path: /login + port: 3000 + initialDelaySeconds: 15 + periodSeconds: 20 + volumeMounts: + - mountPath: /app/data + name: data + restartPolicy: Always + volumes: + - name: data + persistentVolumeClaim: + claimName: bolletjestrui-data diff --git a/bolletjestrui/bolletjestrui-service.yaml b/bolletjestrui/bolletjestrui-service.yaml new file mode 100644 index 0000000..db79ab5 --- /dev/null +++ b/bolletjestrui/bolletjestrui-service.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app: bolletjestrui + name: bolletjestrui +spec: + ports: + - name: "3000" + port: 3000 + targetPort: 3000 + selector: + app: bolletjestrui diff --git a/bolletjestrui/data-persistentvolumeclaim.yaml b/bolletjestrui/data-persistentvolumeclaim.yaml new file mode 100644 index 0000000..39624e1 --- /dev/null +++ b/bolletjestrui/data-persistentvolumeclaim.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + labels: + app: bolletjestrui + name: bolletjestrui-data +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 2Gi diff --git a/bolletjestrui/external-secret.yaml b/bolletjestrui/external-secret.yaml new file mode 100644 index 0000000..0d7b6ea --- /dev/null +++ b/bolletjestrui/external-secret.yaml @@ -0,0 +1,25 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: bolletjestrui-secrets +spec: + secretStoreRef: + name: vault-backend + kind: ClusterSecretStore + refreshInterval: 15m + target: + name: bolletjestrui-secrets + creationPolicy: Owner + data: + - secretKey: site_password + remoteRef: + key: kv/bolletjestrui + property: site_password + - secretKey: admin_password + remoteRef: + key: kv/bolletjestrui + property: admin_password + - secretKey: key_secret + remoteRef: + key: kv/bolletjestrui + property: key_secret diff --git a/bolletjestrui/ingress.yaml b/bolletjestrui/ingress.yaml new file mode 100644 index 0000000..7cfc7ca --- /dev/null +++ b/bolletjestrui/ingress.yaml @@ -0,0 +1,26 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: bolletjestrui-ingress + annotations: + cert-manager.io/cluster-issuer: prod-cluster-issuer + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" + nginx.ingress.kubernetes.io/ssl-passthrough: "false" + nginx.ingress.kubernetes.io/proxy-body-size: "10m" +spec: + ingressClassName: nginx + rules: + - host: vic.rubenhensen.nl + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: bolletjestrui + port: + number: 3000 + tls: + - secretName: letsencrypt-prod + hosts: + - vic.rubenhensen.nl diff --git a/dns/domains/rubenhensen.nl.yaml b/dns/domains/rubenhensen.nl.yaml index b334ecd..c134432 100644 --- a/dns/domains/rubenhensen.nl.yaml +++ b/dns/domains/rubenhensen.nl.yaml @@ -59,6 +59,10 @@ records: expire: 300 type: A content: "46.224.26.65" + - name: "vic" + expire: 300 + type: A + content: "46.224.26.65" - name: "@" expire: 300 type: MX diff --git a/renovate.json b/renovate.json index e95a512..269bf18 100644 --- a/renovate.json +++ b/renovate.json @@ -16,7 +16,8 @@ "kubernetes": { "managerFilePatterns": [ "/apps/templates/.+\\.yaml$/", - "/serpbear/.+\\.yaml$/" + "/serpbear/.+\\.yaml$/", + "/bolletjestrui/.+\\.yaml$/" ] }, "customManagers": [