From b1ec7bbca7c51b635292d24efc264e1cb4d49442 Mon Sep 17 00:00:00 2001 From: Ian Keane Date: Thu, 17 Sep 2026 17:08:48 -0400 Subject: [PATCH] Add opengist --- charts/opengist/Chart.yaml | 5 ++ .../opengist/templates/external-secret.yaml | 22 +++++ charts/opengist/templates/namespace.yaml | 4 + charts/opengist/templates/opengist.yaml | 90 +++++++++++++++++++ charts/opengist/values.yaml | 6 ++ manifests/services/opengist.yaml | 33 +++++++ terraform/opengist-dns.tf | 13 +++ 7 files changed, 173 insertions(+) create mode 100644 charts/opengist/Chart.yaml create mode 100644 charts/opengist/templates/external-secret.yaml create mode 100644 charts/opengist/templates/namespace.yaml create mode 100644 charts/opengist/templates/opengist.yaml create mode 100644 charts/opengist/values.yaml create mode 100644 manifests/services/opengist.yaml create mode 100644 terraform/opengist-dns.tf diff --git a/charts/opengist/Chart.yaml b/charts/opengist/Chart.yaml new file mode 100644 index 0000000..25cf2fa --- /dev/null +++ b/charts/opengist/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +name: opengist +description: OpenGist - self-hosted pastebin/gist service +type: application +version: 0.1.0 diff --git a/charts/opengist/templates/external-secret.yaml b/charts/opengist/templates/external-secret.yaml new file mode 100644 index 0000000..c00e0f5 --- /dev/null +++ b/charts/opengist/templates/external-secret.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: opengist-secrets + namespace: opengist + annotations: + argocd.argoproj.io/sync-wave: "-1" +spec: + refreshInterval: 1h + secretStoreRef: + name: aws-secrets-manager + kind: ClusterSecretStore + target: + name: opengist-secrets + template: + data: + OG_DB_URI: "postgres://postgres:{{ `{{ .postgres_password }}` }}@postgres.postgres.svc.cluster.local:5432/opengist" + data: + - secretKey: postgres_password + remoteRef: + key: dumpnet + property: postgres.password diff --git a/charts/opengist/templates/namespace.yaml b/charts/opengist/templates/namespace.yaml new file mode 100644 index 0000000..414cdb3 --- /dev/null +++ b/charts/opengist/templates/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: opengist diff --git a/charts/opengist/templates/opengist.yaml b/charts/opengist/templates/opengist.yaml new file mode 100644 index 0000000..40c36d7 --- /dev/null +++ b/charts/opengist/templates/opengist.yaml @@ -0,0 +1,90 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: opengist + namespace: opengist +spec: + replicas: 1 + selector: + matchLabels: + app: opengist + template: + metadata: + labels: + app: opengist + spec: + containers: + - name: opengist + image: "ghcr.io/thomiceli/opengist:1" + env: + - name: OG_GIT_DEFAULT_BRANCH + value: "main" + - name: OG_EXTERNAL_URL + value: "https://{{ .Values.gistSubdomain }}.{{ .Values.gistDomain }}" + envFrom: + - secretRef: + name: opengist-secrets + ports: + - name: http + containerPort: 6157 + - name: ssh + containerPort: 2222 + volumeMounts: + - name: data + mountPath: /opengist + readinessProbe: + httpGet: + path: /healthcheck + port: 6157 + initialDelaySeconds: 5 + livenessProbe: + httpGet: + path: /healthcheck + port: 6157 + initialDelaySeconds: 15 + volumes: + - name: data + hostPath: + path: /var/local/appdata/opengist + type: DirectoryOrCreate +--- +apiVersion: v1 +kind: Service +metadata: + name: opengist + namespace: opengist +spec: + selector: + app: opengist + ports: + - name: http + port: 80 + targetPort: 6157 + - name: ssh + port: 2222 + targetPort: 2222 +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: opengist + namespace: opengist + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod +spec: + ingressClassName: nginx + tls: + - hosts: + - "{{ .Values.gistSubdomain }}.{{ .Values.gistDomain }}" + secretName: opengist-tls + rules: + - host: "{{ .Values.gistSubdomain }}.{{ .Values.gistDomain }}" + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: opengist + port: + number: 80 diff --git a/charts/opengist/values.yaml b/charts/opengist/values.yaml new file mode 100644 index 0000000..6c1687c --- /dev/null +++ b/charts/opengist/values.yaml @@ -0,0 +1,6 @@ +domain: dumpnet.chat +gistDomain: keane.sh +gistSubdomain: gist +registry: + host: forge.keane.sh + user: ian diff --git a/manifests/services/opengist.yaml b/manifests/services/opengist.yaml new file mode 100644 index 0000000..df21b51 --- /dev/null +++ b/manifests/services/opengist.yaml @@ -0,0 +1,33 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: opengist + namespace: argocd +spec: + project: default + sources: + - repoURL: https://forge.keane.sh/ian/dumpnet-argo.git + targetRevision: HEAD + path: charts/opengist + helm: + valueFiles: + - $values/values.yaml + - repoURL: https://forge.keane.sh/ian/dumpnet-argo.git + targetRevision: HEAD + ref: values + destination: + server: https://kubernetes.default.svc + namespace: opengist + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + ignoreDifferences: + - group: external-secrets.io + kind: ExternalSecret + jsonPointers: + - /spec/target/template/mergePolicy + - /spec/target/template/engineVersion + - /spec/target/template/type diff --git a/terraform/opengist-dns.tf b/terraform/opengist-dns.tf new file mode 100644 index 0000000..927ba07 --- /dev/null +++ b/terraform/opengist-dns.tf @@ -0,0 +1,13 @@ +# gist.keane.sh -> OpenGist, running on the same k8s cluster (different +# hosted zone than dumpnet.chat, so this is separate from dns_records/dns.tf) +data "aws_route53_zone" "keane_sh" { + name = "keane.sh" +} + +resource "aws_route53_record" "opengist" { + zone_id = data.aws_route53_zone.keane_sh.zone_id + name = "gist.keane.sh" + type = "A" + ttl = 300 + records = [aws_eip.controlplane.public_ip] +}