mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
Ruben Hensen
1f04831a97
ingress-nginx is gone and every app is served by the Envoy Gateway. The certificates were created by cert-manager's ingress-shim and are owned by the Ingresses, so each app now declares its Certificate itself, with the same name, secret and usages, so nothing gets reissued. gateway-shim can't take over because the certificates live in the app namespaces. immich drops mbg.hensen.io, which has no route, so that one certificate is reissued through the Gateway's HTTP-01 solver. Also removes the Longhorn test-port redirect URI and updates comments that still described nginx.
82 lines
2.1 KiB
YAML
82 lines
2.1 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: helm-actual-budget
|
|
namespace: argocd
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
destination:
|
|
namespace: actual-budget
|
|
server: https://kubernetes.default.svc
|
|
project: default
|
|
source:
|
|
repoURL: https://community-charts.github.io/helm-charts
|
|
targetRevision: 1.8.9
|
|
chart: actualbudget
|
|
helm:
|
|
values: |
|
|
# Actual Budget configuration
|
|
|
|
image:
|
|
tag: "26.6.0"
|
|
|
|
# Authentication configuration
|
|
login:
|
|
method: openid
|
|
openid:
|
|
enforce: true
|
|
providerName: Authentik
|
|
discoveryUrl: https://authentik.rubenhensen.nl/application/o/actualbudget/
|
|
authMethod: openid
|
|
existingSecret:
|
|
name: actualbudget-oidc-client-secret
|
|
clientIdKey: client_id
|
|
clientSecretKey: client_secret
|
|
|
|
extraEnvVars:
|
|
ACTUAL_OPENID_SERVER_HOSTNAME: https://ynab.rubenhensen.nl
|
|
# Node trusts its built-in roots, which still include the ones
|
|
# above the compromised eMudhra intermediates. Use patched-ca-bundle
|
|
# through OpenSSL instead until Node ships a fix.
|
|
NODE_OPTIONS: --use-openssl-ca
|
|
SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
|
|
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|
|
volumeMounts:
|
|
- name: patched-ca-bundle
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
|
|
# Service configuration
|
|
service:
|
|
type: ClusterIP
|
|
port: 5006
|
|
|
|
# Persistence configuration
|
|
persistence:
|
|
enabled: true
|
|
storageClass: longhorn
|
|
size: 10Gi
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
|
|
# Resource limits
|
|
resources:
|
|
requests:
|
|
memory: "256Mi"
|
|
cpu: "100m"
|
|
limits:
|
|
memory: "512Mi"
|
|
cpu: "500m"
|
|
|
|
syncPolicy:
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
automated:
|
|
selfHeal: true
|
|
prune: true
|