Add data group, kanban, postgres

apps/apps.yaml

@@ -19,6 +19,25 @@ spec:
 ---
 apiVersion: argoproj.io/v1alpha1
 kind: Application
+metadata:
+  name: data
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+    targetRevision: HEAD
+    path: manifests/data
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
 metadata:
   name: services
   namespace: argocd
@@ -35,4 +54,3 @@ spec:
     automated:
       prune: true
       selfHeal: true
-

charts/kan/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: kan
+description: kan.bn kanban app
+type: application
+version: 0.1.0

charts/kan/templates/external-secret.yaml

@@ -0,0 +1,25 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: kan-secrets
+  namespace: kan
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: aws-secrets-manager
+    kind: ClusterSecretStore
+  target:
+    name: kan-secrets
+    template:
+      data:
+        BETTER_AUTH_SECRET: "{{ `{{ .better_auth_secret }}` }}"
+        POSTGRES_URL: "postgresql://postgres:{{ `{{ .postgres_password }}` }}@postgres.postgres.svc.cluster.local:5432/kan?sslmode=disable"
+  data:
+    - secretKey: better_auth_secret
+      remoteRef:
+        key: dumpnet
+        property: kan.better_auth_secret
+    - secretKey: postgres_password
+      remoteRef:
+        key: dumpnet
+        property: postgres.password

charts/kan/templates/kan.yaml

@@ -0,0 +1,84 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: kan-migrate
+  namespace: kan
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  template:
+    spec:
+      restartPolicy: OnFailure
+      containers:
+        - name: migrate
+          image: ghcr.io/kanbn/kan-migrate:latest
+          envFrom:
+            - secretRef:
+                name: kan-secrets
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kan
+  namespace: kan
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: kan
+  template:
+    metadata:
+      labels:
+        app: kan
+    spec:
+      containers:
+        - name: kan
+          image: ghcr.io/kanbn/kan:latest
+          ports:
+            - containerPort: 3000
+          env:
+            - name: NEXT_PUBLIC_BASE_URL
+              value: https://todo.dumpnet.chat
+            - name: NEXT_PUBLIC_DISABLE_SIGN_UP
+              value: "true"
+          envFrom:
+            - secretRef:
+                name: kan-secrets
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: kan
+  namespace: kan
+spec:
+  selector:
+    app: kan
+  ports:
+    - port: 80
+      targetPort: 3000
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: kan
+  namespace: kan
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - todo.dumpnet.chat
+      secretName: kan-tls
+  rules:
+    - host: todo.dumpnet.chat
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: kan
+                port:
+                  number: 80

manifests/data/appdata.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: appdata
+spec:
+  capacity:
+    storage: 100Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: local
+  hostPath:
+    path: /var/local/appdata
+    type: DirectoryOrCreate
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: postgres

manifests/data/postgres.yaml

@@ -0,0 +1,84 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgres-data
+  namespace: postgres
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: local
+  resources:
+    requests:
+      storage: 20Gi
+  volumeName: appdata
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: postgres-credentials
+  namespace: postgres
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: aws-secrets-manager
+    kind: ClusterSecretStore
+  target:
+    name: postgres-credentials
+  data:
+    - secretKey: POSTGRES_PASSWORD
+      remoteRef:
+        key: dumpnet
+        property: postgres.password
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postgres
+  namespace: postgres
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:16
+          env:
+            - name: POSTGRES_USER
+              value: postgres
+            - name: POSTGRES_DB
+              value: postgres
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-credentials
+                  key: POSTGRES_PASSWORD
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          ports:
+            - containerPort: 5432
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+              subPath: postgres
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: postgres-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres
+  namespace: postgres
+spec:
+  selector:
+    app: postgres
+  ports:
+    - port: 5432
+      targetPort: 5432

manifests/services/kan.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kan
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+    targetRevision: HEAD
+    path: charts/kan
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kan
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

terraform/terraform.tfvars

@@ -1 +1,2 @@
 hosted_zone_id = "Z068835512G0ZQJ9SJGOI"
+dns_records    = ["argocd", "todo"]