diff --git a/k8s/argo-apps/oxicloud.yaml b/k8s/argo-apps/oxicloud.yaml index 0f67c31..9bf459b 100644 --- a/k8s/argo-apps/oxicloud.yaml +++ b/k8s/argo-apps/oxicloud.yaml @@ -12,39 +12,41 @@ spec: sources: - repoURL: git.roboces.dev/catalin/fukuops chart: oxicloud - targetRevision: 0.1.0 + targetRevision: 1.0.0 helm: valuesObject: - persistence: - enabled: true - storageClass: "truenas-nfs-csi" - accessMode: ReadWriteMany - size: 50Gi - service: - type: LoadBalancer - config: - server: - port: 8086 - host: "0.0.0.0" - baseUrl: "https://cloud.roboces.dev" - features: - enableAuth: "true" - enableSharing: "true" - mimalloc: - purgeDelay: "0" - allowLargeOsPages: "0" - secrets: - existingSecret: oxicloud - wopi: - enabled: false - ingress: - className: "traefik" - hosts: - - host: cloud.roboces.dev - paths: - - path: / - pathType: ImplementationSpecific - tls: [] + oxicloud: + persistence: + enabled: true + storageClass: "truenas-nfs-csi" + accessMode: ReadWriteMany + size: 50Gi + service: + type: LoadBalancer + config: + server: + port: 8086 + host: "0.0.0.0" + baseUrl: "https://cloud.roboces.dev" + features: + enableAuth: true + enableSharing: true + mimalloc: + purgeDelay: "0" + allowLargeOsPages: "0" + secret: + existingSecretName: oxicloud + wopi: + enabled: false + ingress: + enabled: true + className: "traefik" + hosts: + - host: cloud.roboces.dev + paths: + - path: / + pathType: ImplementationSpecific + tls: [] project: roboces syncPolicy: automated: {} diff --git a/k8s/charts/README.md b/k8s/charts/README.md new file mode 100644 index 0000000..4448910 --- /dev/null +++ b/k8s/charts/README.md @@ -0,0 +1,209 @@ +# Helm charts + +# Normalization project + +There is a need to normalize all charts that are under this folder. This means: +- a single way of providing config values: as hierarchical yaml objects instead of environment variables. This means a user of the chart +should provide config values as: + +```yaml +# assuming immich which bundles two services +immich: + db: + hostname: db.example.com + port: 5432 + ingress: + enabled: true + general: # general settings + someoption: false + persistence: ... + resources: ... + secret: + existingSecretName: immich-secret # reference to an existing secret for sensible values +machin-learning: + someoption: + enabled: true + service: + type: LoadBalancer + port: 8888 +``` + +instead of: +```yaml +immich: + env: + - IMMICH_DB_HOSTNAME: db.example.com + - IMMICH_SOMEOPTION: false + - ... # etc +``` + +- default values in charts should match the defaults of my infra: + - service of type LoadBalancer + - persistence layer should be prefixed with `-data`, unles there are many, which would have an infix for the type. + For example, a service like oxicould which only has one persistence layer, its pvc should be called `oxicloud-data`, + while immich, which has a bunch of them, should be something like: + - `immich-library-data` + - `immich-encodedVideo-data` + - `immich-upload-data` + - ... +- usage of Deployment vs StatefulSet: Deployment will be the default unless the doesn't support HA (e.g., more than one +pod) autoscaling out of the box. This sometimes is hard to actually know, each service is different and should +be investigated beforehand. In any case, we should default to deployments of one (1) replica with an autoscaling option + +- each chart should have a standard, artifacthub-compliant README that describes how to install and each available +value + +- when normalization begins, each chart should bump its major version and be uploaded to the registry, unless that +chart is already normalized. + +## Normalization report + +### Summary + +| Chart | Current Version | Structure | Needs Major Bump | +|-------|----------------|-----------|------------------| +| dokuwiki | 0.1.0 | flat | Yes | +| helm-rustical | 0.3.0 | flat | Yes | +| immich | 0.2.3 | hierarchical | Yes | +| miniflux | 0.1.0 | flat | Yes | +| oxicloud | 0.1.0 | flat | Yes | +| vaultwarden | 0.1.0 | flat | Yes | + +### dokuwiki + +**Status:** Needs normalization + +**Changes required:** +1. Wrap all values under `dokuwiki:` key (hierarchical structure) +2. Convert `env.PHP_*` variables to nested config objects under `dokuwiki.config.php.*` +3. Rename PVC to `dokuwiki-data` +4. Add `secret.existingSecretName` for PHP config secrets +5. Change service type to `LoadBalancer` (currently LoadBalancer - good) +6. Add `secret.enabled: true` pattern for secrets +7. Add artifacthub.io annotations to Chart.yaml +8. Add standard README.md + +--- + +### helm-rustical + +**Status:** Needs normalization + +**Changes required:** +1. Wrap all values under `rustical:` key +2. Rename PVC to `rustical-data` +3. Change service type from `ClusterIP` to `LoadBalancer` +4. Add artifacthub.io annotations to Chart.yaml +5. Add standard README.md + +--- + +### immich + +**Status:** Partially normalized (hierarchical), needs fixes + +**Changes required:** +1. **Security:** Move `db` and `redis` credentials from cleartext values to `secret.existingSecretName` +2. Service types should be `LoadBalancer` (both `immich` and `machineLearning`) +3. Rename PVCs with `-data` suffix is already done in README spec, but current names are just `library`, `encodedVideo`, etc. - they should be `immich-library-data`, etc. (check templates) +4. Add `secret.enabled: true` pattern +5. Add artifacthub.io annotations to Chart.yaml +6. Add standard README.md + +--- + +### miniflux + +**Status:** Needs normalization + +**Changes required:** +1. Wrap all values under `miniflux:` key +2. Change service type from `ClusterIP` to `LoadBalancer` +3. Add `secret.existingSecretName` for DATABASE_URL and credentials +4. Add artifacthub.io annotations to Chart.yaml +5. Add standard README.md + +--- + +### oxicloud + +**Status:** Needs normalization - **HIGH PRIORITY security issue** + +**Changes required:** +1. Wrap all values under `oxicloud:` key +2. **Security fix:** Move `wopi.collabora.admin.password` from cleartext to a secret reference +3. Rename PVC to `oxicloud-data` +4. Change service type from `ClusterIP` to `LoadBalancer` +5. Add `secret.existingSecretName` for `secrets.jwtSecret` and `secrets.oidcClientSecret` +6. Add artifacthub.io annotations to Chart.yaml +7. Add standard README.md + +--- + +### vaultwarden + +**Status:** Needs normalization + +**Changes required:** +1. Wrap all values under `vaultwarden:` key +2. Convert `conf.db.*` to hierarchical config under `vaultwarden.config.database.*` +3. Rename PVC to `vaultwarden-data` +4. Change service type from `ClusterIP` to `LoadBalancer` +5. Add `secret.enabled: true` pattern +6. Add artifacthub.io annotations to Chart.yaml +7. Add standard README.md + +--- + +## Even more things + +### 1. Secret Management +- **dokuwiki, miniflux, oxicloud**: No `secret.enabled` pattern - secrets are in cleartext or missing +- **oxicloud**: Collabora admin password is hardcoded in values.yaml - CRITICAL +- **immich**: DB and Redis credentials in cleartext - should use secrets + +### 2. Service Type Standardization +Per README spec, all services should be `LoadBalancer` by default. Currently: +- dokuwiki: LoadBalancer (correct) +- helm-rustical: ClusterIP (needs change) +- immich: ClusterIP (both services - needs change) +- miniflux: ClusterIP (needs change) +- oxicloud: ClusterIP (needs change) +- vaultwarden: ClusterIP (needs change) + +### 3. PVC Naming Convention +Per README spec, single-persistence charts should name PVCs `-data`. Current state: +- dokuwiki: default (no explicit name) → should be `dokuwiki-data` +- helm-rustical: default → should be `rustical-data` +- immich: already follows pattern (library, thumbs, upload, etc.) but should be `immich-*-data` +- miniflux: no persistence (ok) +- oxicloud: default → should be `oxicloud-data` +- vaultwarden: default → should be `vaultwarden-data` + +### 4. ArtifactHub Compliance +None of the charts have proper `artifacthub.io/*` annotations except basic image annotations in some. Recommended additions: +- `artifacthub.io/changes` - list of changes in this version +- `artifacthub.io/containsSecurityUpdates` - boolean +- `artifacthub.io/maintainers` - list of maintainers +- `artifacthub.io/recommendations` - related charts/apps + +### 5. Helm README Documentation +Only oxicloud has a `.helmignore` file. None have proper README.md with: +- Chart installation instructions +- Values reference table +- Configuration examples +- Troubleshooting tips + +### 6. Probe Configuration +- miniflux has empty `livenessProbe: {}` and `readinessProbe: {}` - should have proper defaults +- Most charts use `tcpSocket` which is fine, but should verify it's the correct port + +### 7. Security Context +- All charts have empty `securityContext: {}` and `podSecurityContext: {}` - should define proper PSP/foundationa +- Consider adding `runAsNonRoot: true`, `runAsUser`, `fsGroup` defaults + +### 8. Resource Defaults +- All charts have empty `resources: {}` - should define sensible defaults or at least comments indicating what's expected + +### 9. Repository Metadata +Consider adding `home:` and `sources:` to Chart.yaml pointing to the upstream project URLs diff --git a/k8s/charts/oxicloud/Chart.yaml b/k8s/charts/oxicloud/Chart.yaml index b1be9f3..738f76d 100644 --- a/k8s/charts/oxicloud/Chart.yaml +++ b/k8s/charts/oxicloud/Chart.yaml @@ -5,9 +5,13 @@ description: 'Ultra-fast, secure & lightweight self-hosted cloud storage — you ' type: application -version: 0.1.0 +version: 1.0.0 appVersion: 0.8.6 annotations: - artifacthub.io/images: | - - name: oxicloud - image: diocrafts/oxicloud:0.8.6 + artifacthub.io/images: "- name: oxicloud\n image: diocrafts/oxicloud:0.8.6\n" + artifacthub.io/changes: "- kind: changed\n description: \"Normalized structure\ + \ to use hierarchical values under `oxicloud:` key\"\n- kind: changed\n description:\ + \ \"Changed service type default to LoadBalancer\"\n- kind: changed\n description:\ + \ \"Renamed PVC to `oxicloud-data`\"\n- kind: changed\n description: \"Disabled\ + \ WOPI/Collabora by default\"\n- kind: security\n description: \"Removed hardcoded\ + \ credentials from values.yaml; use existingSecretName instead\"\n" diff --git a/k8s/charts/oxicloud/templates/configmap.yaml b/k8s/charts/oxicloud/templates/configmap.yaml index edd8d27..e38403a 100644 --- a/k8s/charts/oxicloud/templates/configmap.yaml +++ b/k8s/charts/oxicloud/templates/configmap.yaml @@ -4,19 +4,19 @@ kind: ConfigMap metadata: name: {{ include "oxicloud.fullname" . }}-config data: - OXICLOUD_SERVER_PORT: {{ .Values.config.server.port | quote }} - OXICLOUD_SERVER_HOST: {{ .Values.config.server.host | quote }} - {{- if .Values.config.server.baseUrl }} - OXICLOUD_BASE_URL: {{ .Values.config.server.baseUrl | quote }} + OXICLOUD_SERVER_PORT: {{ .Values.oxicloud.config.server.port | quote }} + OXICLOUD_SERVER_HOST: {{ .Values.oxicloud.config.server.host | quote }} + {{- if .Values.oxicloud.config.server.baseUrl }} + OXICLOUD_BASE_URL: {{ .Values.oxicloud.config.server.baseUrl | quote }} {{- end }} - OXICLOUD_ENABLE_AUTH: {{ .Values.config.features.enableAuth | quote }} - OXICLOUD_ENABLE_FILE_SHARING: {{ .Values.config.features.enableSharing | quote }} - MIMALLOC_PURGE_DELAY: {{ .Values.config.mimalloc.purgeDelay | quote }} - MIMALLOC_ALLOW_LARGE_OS_PAGES: {{ .Values.config.mimalloc.allowLargeOsPages | quote }} + OXICLOUD_ENABLE_AUTH: {{ .Values.oxicloud.config.features.enableAuth | quote }} + OXICLOUD_ENABLE_FILE_SHARING: {{ .Values.oxicloud.config.features.enableSharing | quote }} + MIMALLOC_PURGE_DELAY: {{ .Values.oxicloud.config.mimalloc.purgeDelay | quote }} + MIMALLOC_ALLOW_LARGE_OS_PAGES: {{ .Values.oxicloud.config.mimalloc.allowLargeOsPages | quote }} - {{- if .Values.wopi.enabled }} + {{- if .Values.oxicloud.wopi.enabled }} OXICLOUD_WOPI_ENABLED: "true" - OXICLOUD_WOPI_DISCOVERY_URL: "{{ .Values.config.server.baseUrl }}/hosting/discovery" + OXICLOUD_WOPI_DISCOVERY_URL: "{{ .Values.oxicloud.config.server.baseUrl }}/hosting/discovery" {{- else }} OXICLOUD_WOPI_ENABLED: "false" {{- end }} diff --git a/k8s/charts/oxicloud/templates/ingress.yaml b/k8s/charts/oxicloud/templates/ingress.yaml index ab3a14b..d2a2ff2 100644 --- a/k8s/charts/oxicloud/templates/ingress.yaml +++ b/k8s/charts/oxicloud/templates/ingress.yaml @@ -1,22 +1,22 @@ --- -{{- if .Values.ingress.enabled -}} +{{- if .Values.oxicloud.ingress.enabled -}} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: {{ include "oxicloud.fullname" . }} labels: {{- include "oxicloud.labels" . | nindent 4 }} - {{- with .Values.ingress.annotations }} + {{- with .Values.oxicloud.ingress.annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{- if .Values.ingress.className }} - ingressClassName: {{ .Values.ingress.className }} + {{- if .Values.oxicloud.ingress.className }} + ingressClassName: {{ .Values.oxicloud.ingress.className }} {{- end }} - {{- if .Values.ingress.tls }} + {{- if .Values.oxicloud.ingress.tls }} tls: - {{- range .Values.ingress.tls }} + {{- range .Values.oxicloud.ingress.tls }} - hosts: {{- range .hosts }} - {{ . | quote }} @@ -25,40 +25,38 @@ spec: {{- end }} {{- end }} rules: - - host: {{ (index .Values.ingress.hosts 0).host | quote }} + - host: {{ (index .Values.oxicloud.ingress.hosts 0).host | quote }} http: paths: - {{- if .Values.wopi.enabled }} - # Route Collabora traffic to the WOPI pod + {{- if .Values.oxicloud.wopi.enabled }} - path: /browser pathType: Prefix backend: service: name: {{ include "oxicloud.fullname" $ }}-wopi port: - number: {{ .Values.wopi.collabora.service.port }} + number: {{ .Values.oxicloud.wopi.collabora.service.port }} - path: /hosting pathType: Prefix backend: service: name: {{ include "oxicloud.fullname" $ }}-wopi port: - number: {{ .Values.wopi.collabora.service.port }} + number: {{ .Values.oxicloud.wopi.collabora.service.port }} - path: /cool pathType: Prefix backend: service: name: {{ include "oxicloud.fullname" $ }}-wopi port: - number: {{ .Values.wopi.collabora.service.port }} + number: {{ .Values.oxicloud.wopi.collabora.service.port }} {{- end }} - # Default Catch-All: Route everything else to OxiCloud - path: / pathType: Prefix backend: service: name: {{ include "oxicloud.fullname" $ }} port: - number: {{ $.Values.service.port }} + number: {{ $.Values.oxicloud.service.port }} {{- end }} diff --git a/k8s/charts/oxicloud/templates/secret.yaml b/k8s/charts/oxicloud/templates/secret.yaml index d5aac3c..3c9fafb 100644 --- a/k8s/charts/oxicloud/templates/secret.yaml +++ b/k8s/charts/oxicloud/templates/secret.yaml @@ -1,5 +1,5 @@ --- -{{- if not .Values.secrets.existingSecret }} +{{- if not .Values.oxicloud.secret.existingSecretName }} apiVersion: v1 kind: Secret metadata: @@ -8,12 +8,15 @@ metadata: {{- include "oxicloud.labels" . | nindent 4 }} type: Opaque data: - {{- if .Values.secrets.jwtSecret }} - OXICLOUD_JWT_SECRET: {{ .Values.secrets.jwtSecret | b64enc | quote }} + {{- if .Values.oxicloud.secret.data.jwtSecret }} + OXICLOUD_JWT_SECRET: {{ .Values.oxicloud.secret.data.jwtSecret | b64enc | quote }} + {{- end }} + {{- if .Values.oxicloud.wopi.enabled }} + {{- if .Values.oxicloud.wopi.collabora.admin.username }} + WOPI_ADMIN_USERNAME: {{ .Values.oxicloud.wopi.collabora.admin.username | b64enc | quote }} + {{- end }} + {{- if .Values.oxicloud.wopi.collabora.admin.password }} + WOPI_ADMIN_PASSWORD: {{ .Values.oxicloud.wopi.collabora.admin.password | b64enc | quote }} {{- end }} - DB_PASSWORD: {{ .Values.database.password | b64enc | quote }} - {{- if .Values.wopi.enabled }} - WOPI_ADMIN_USERNAME: {{ .Values.wopi.collabora.admin.username | b64enc | quote }} - WOPI_ADMIN_PASSWORD: {{ .Values.wopi.collabora.admin.password | b64enc | quote }} {{- end }} {{- end }} diff --git a/k8s/charts/oxicloud/templates/service.yaml b/k8s/charts/oxicloud/templates/service.yaml index b0a4bc8..9ae8571 100644 --- a/k8s/charts/oxicloud/templates/service.yaml +++ b/k8s/charts/oxicloud/templates/service.yaml @@ -6,9 +6,9 @@ metadata: labels: {{- include "oxicloud.labels" . | nindent 4 }} spec: - type: {{ .Values.service.type }} + type: {{ .Values.oxicloud.service.type }} ports: - - port: {{ .Values.service.port }} + - port: {{ .Values.oxicloud.service.port }} targetPort: http protocol: TCP name: http @@ -24,7 +24,7 @@ metadata: spec: clusterIP: None ports: - - port: {{ .Values.service.port }} + - port: {{ .Values.oxicloud.service.port }} targetPort: http protocol: TCP name: http diff --git a/k8s/charts/oxicloud/templates/statefulset.yaml b/k8s/charts/oxicloud/templates/statefulset.yaml index 442fac1..20f64e1 100644 --- a/k8s/charts/oxicloud/templates/statefulset.yaml +++ b/k8s/charts/oxicloud/templates/statefulset.yaml @@ -6,7 +6,7 @@ metadata: {{- include "oxicloud.labels" . | nindent 4 }} spec: serviceName: {{ include "oxicloud.fullname" . }}-headless - replicas: {{ .Values.replicaCount }} + replicas: {{ .Values.oxicloud.replicaCount }} selector: matchLabels: {{- include "oxicloud.selectorLabels" . | nindent 6 }} @@ -17,37 +17,55 @@ spec: spec: containers: - name: oxicloud - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} + image: "{{ .Values.oxicloud.image.repository }}:{{ .Values.oxicloud.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.oxicloud.image.pullPolicy }} ports: - name: http - containerPort: 8086 + containerPort: {{ .Values.oxicloud.config.server.port }} protocol: TCP envFrom: - configMapRef: name: {{ include "oxicloud.fullname" . }}-config - secretRef: - name: {{ if .Values.secrets.existingSecret }}{{ .Values.secrets.existingSecret }}{{ else }}{{ include "oxicloud.fullname" . }}-secret{{ end }} + name: {{ if .Values.oxicloud.secret.existingSecretName }}{{ .Values.oxicloud.secret.existingSecretName }}{{ else }}{{ include "oxicloud.fullname" . }}-secret{{ end }} volumeMounts: - - name: storage-data + - name: oxicloud-data mountPath: /app/storage - {{- if not .Values.persistence.enabled }} + resources: + {{- toYaml .Values.oxicloud.resources | nindent 10 }} + livenessProbe: + {{- toYaml .Values.oxicloud.livenessProbe | nindent 10 }} + readinessProbe: + {{- toYaml .Values.oxicloud.readinessProbe | nindent 10 }} + {{- if not .Values.oxicloud.persistence.enabled }} volumes: - - name: storage-data + - name: oxicloud-data emptyDir: {} {{- end }} + {{- with .Values.oxicloud.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.oxicloud.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.oxicloud.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} - {{- if .Values.persistence.enabled }} + {{- if .Values.oxicloud.persistence.enabled }} volumeClaimTemplates: - metadata: - name: storage-data + name: oxicloud-data spec: accessModes: - - {{ .Values.persistence.accessMode }} - {{- if .Values.persistence.storageClass }} - storageClassName: {{ .Values.persistence.storageClass }} + - {{ .Values.oxicloud.persistence.accessMode }} + {{- if .Values.oxicloud.persistence.storageClass }} + storageClassName: {{ .Values.oxicloud.persistence.storageClass }} {{- end }} resources: requests: - storage: {{ .Values.persistence.size }} + storage: {{ .Values.oxicloud.persistence.size }} {{- end }} diff --git a/k8s/charts/oxicloud/templates/wopi-deployment.yaml b/k8s/charts/oxicloud/templates/wopi-deployment.yaml index 0cdc0d4..93debc9 100644 --- a/k8s/charts/oxicloud/templates/wopi-deployment.yaml +++ b/k8s/charts/oxicloud/templates/wopi-deployment.yaml @@ -1,5 +1,5 @@ --- -{{- if .Values.wopi.enabled -}} +{{- if .Values.oxicloud.wopi.enabled -}} apiVersion: apps/v1 kind: Deployment metadata: @@ -21,9 +21,8 @@ spec: spec: containers: - name: collabora - image: "{{ .Values.wopi.collabora.image.repository }}:{{ .Values.wopi.collabora.image.tag }}" - imagePullPolicy: {{ .Values.wopi.collabora.image.pullPolicy }} - # Required for Collabora to build chroot jails + image: "{{ .Values.oxicloud.wopi.collabora.image.repository }}:{{ .Values.oxicloud.wopi.collabora.image.tag }}" + imagePullPolicy: {{ .Values.oxicloud.wopi.collabora.image.pullPolicy }} securityContext: capabilities: add: @@ -34,20 +33,20 @@ spec: protocol: TCP env: - name: aliasgroup1 - value: "http://{{ .Values.wopi.collabora.domain }}" + value: "http://{{ .Values.oxicloud.wopi.collabora.domain }}" - name: server_name - value: {{ .Values.wopi.collabora.domain | quote }} + value: {{ .Values.oxicloud.wopi.collabora.domain | quote }} - name: extra_params - value: {{ .Values.wopi.collabora.extraParams | quote }} + value: {{ .Values.oxicloud.wopi.collabora.extraParams | quote }} - name: username valueFrom: secretKeyRef: - name: {{ if .Values.secrets.existingSecret }}{{ .Values.secrets.existingSecret }}{{ else }}{{ include "oxicloud.fullname" . }}-secret{{ end }} + name: {{ if .Values.oxicloud.secret.existingSecretName }}{{ .Values.oxicloud.secret.existingSecretName }}{{ else if .Values.oxicloud.wopi.collabora.admin.existingSecretName }}{{ .Values.oxicloud.wopi.collabora.admin.existingSecretName }}{{ else }}{{ include "oxicloud.fullname" . }}-secret{{ end }} key: WOPI_ADMIN_USERNAME - name: password valueFrom: secretKeyRef: - name: {{ if .Values.secrets.existingSecret }}{{ .Values.secrets.existingSecret }}{{ else }}{{ include "oxicloud.fullname" . }}-secret{{ end }} + name: {{ if .Values.oxicloud.secret.existingSecretName }}{{ .Values.oxicloud.secret.existingSecretName }}{{ else if .Values.oxicloud.wopi.collabora.admin.existingSecretName }}{{ .Values.oxicloud.wopi.collabora.admin.existingSecretName }}{{ else }}{{ include "oxicloud.fullname" . }}-secret{{ end }} key: WOPI_ADMIN_PASSWORD readinessProbe: httpGet: diff --git a/k8s/charts/oxicloud/templates/wopi-service.yaml b/k8s/charts/oxicloud/templates/wopi-service.yaml index 6b27207..a895791 100644 --- a/k8s/charts/oxicloud/templates/wopi-service.yaml +++ b/k8s/charts/oxicloud/templates/wopi-service.yaml @@ -1,5 +1,5 @@ --- -{{- if .Values.wopi.enabled -}} +{{- if .Values.oxicloud.wopi.enabled -}} apiVersion: v1 kind: Service metadata: @@ -10,7 +10,7 @@ metadata: spec: type: ClusterIP ports: - - port: {{ .Values.wopi.collabora.service.port }} + - port: {{ .Values.oxicloud.wopi.collabora.service.port }} targetPort: wopi protocol: TCP name: wopi diff --git a/k8s/charts/oxicloud/values.yaml b/k8s/charts/oxicloud/values.yaml index dbaca4c..0f69bc1 100644 --- a/k8s/charts/oxicloud/values.yaml +++ b/k8s/charts/oxicloud/values.yaml @@ -1,62 +1,87 @@ --- -replicaCount: 1 +oxicloud: + replicaCount: 1 + image: + repository: diocrafts/oxicloud + pullPolicy: Always + tag: "" - -image: - repository: diocrafts/oxicloud - pullpolicy: Always - tag: "" - -config: - server: + service: + type: LoadBalancer port: 8086 - host: "0.0.0.0" - baseUrl: "https://cloud.example.com" - features: - enableAuth: "true" - enableSharing: "true" - mimalloc: - purgeDelay: "0" - allowLargeOsPages: "0" -persistence: - enabled: true - storageClass: "" - accessMode: ReadWriteOnce - size: 50Gi + ingress: + enabled: true + className: "traefik" + annotations: {} + hosts: + - host: cloud.example.com + paths: + - path: / + pathType: ImplementationSpecific + tls: [] -wopi: - enabled: true - collabora: - url: "cloud.example.com" - image: - repository: collabora/code - tag: latest - pullPolicy: IfNotPresent - service: - port: 9980 - admin: - username: admin - password: "wopi_admin_password" - extraParams: "--o:ssl.enable=false --o:ssl.termination=false --o:net.frame_ancestors=http://* https://*" + config: + server: + port: 8086 + host: "0.0.0.0" + baseUrl: "https://cloud.example.com" + features: + enableAuth: true + enableSharing: true + mimalloc: + purgeDelay: "0" + allowLargeOsPages: "0" -secrets: - existingSecret: "" - jwtSecret: "" - oidcClientSecret: "" + persistence: + enabled: true + storageClass: "" + accessMode: ReadWriteOnce + size: 50Gi -service: - type: ClusterIP - port: 8086 + wopi: + enabled: false + collabora: + url: "cloud.example.com" + domain: "cloud.example.com" + image: + repository: collabora/code + tag: latest + pullPolicy: IfNotPresent + service: + port: 9980 + admin: + existingSecretName: "" + username: "" + password: "" + extraParams: "--o:ssl.enable=false --o:ssl.termination=false --o:net.frame_ancestors=http://* https://*" -ingress: - enabled: true - className: "traefik" - annotations: {} - hosts: - - host: cloud.example.com - paths: - - path: / - pathType: ImplementationSpecific - tls: [] + resources: {} + + livenessProbe: + tcpSocket: + port: 8086 + initialDelaySeconds: 30 + timeoutSeconds: 15 + successThreshold: 1 + failureThreshold: 3 + periodSeconds: 10 + + readinessProbe: + tcpSocket: + port: 8086 + initialDelaySeconds: 15 + timeoutSeconds: 2 + successThreshold: 1 + failureThreshold: 3 + periodSeconds: 10 + + nodeSelector: {} + tolerations: [] + affinity: {} + + secret: + enabled: true + existingSecretName: "oxicloud-secret" + data: {}