j00lz
/
strato-infra
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Add umami analytics

main
Julius 2022-05-25 19:13:13 +02:00
parent df52299784
commit 58f3ab978b
Signed by: j00lz
GPG Key ID: AF241B0AA237BBA2
17 changed files with 152 additions and 130 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
flux/cluster/apps/asraphiel/kustomization.yaml Normal file
View File

@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- umami

39
flux/cluster/apps/asraphiel/umami/deployment.yaml Normal file
View File

@ -0,0 +1,39 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: umami-deployment
namespace: asraphiel
labels:
app: umami-deployment
keel.sh/policy: poll
keel.sh/match-tag: "true"
keel.sh/pollSchedule: "@weekly"
spec:
replicas: 1
selector:
matchLabels:
app: umami-deployment
template:
metadata:
labels:
app: umami-deployment
spec:
containers:
- name: umami-deployment
imagePullPolicy: Always
image: ghcr.io/mikecao/umami:postgresql-latest
ports:
- containerPort: 3000
env:
- name: DATABASE_TYPE
value: postgres
- name: DATABASE_URL
valueFrom:
secretKeyRef:
name: umami-secrets
key: db-url
- name: HASH_SALT
valueFrom:
secretKeyRef:
name: umami-secrets
key: salt

17
flux/cluster/apps/asraphiel/umami/ingress.yaml Normal file
View File

@ -0,0 +1,17 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: umami-deployment-ingress
namespace: asraphiel
spec:
rules:
- host: "analytics.asraphiel.dev"
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: umami-deployment-service
port:
number: 80

2
flux/cluster/apps/misc/cdn-control/kustomization.yaml → flux/cluster/apps/asraphiel/umami/kustomization.yaml
View File

@ -4,4 +4,4 @@ resources:
- deployment.yaml
- ingress.yaml
- service.yaml
- secret.yaml
- secret.yaml

21
flux/cluster/apps/asraphiel/umami/secret.yaml Normal file
View File

@ -0,0 +1,21 @@
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: umami-secrets
namespace: asraphiel
spec:
refreshInterval: "15s"
secretStoreRef:
name: vault
kind: ClusterSecretStore
target:
name: umami-secrets
data:
- secretKey: db-url
remoteRef:
key: k8s/umami
property: db-url
- secretKey: salt
remoteRef:
key: k8s/umami
property: salt

12
flux/cluster/apps/asraphiel/umami/service.yaml Normal file
View File

@ -0,0 +1,12 @@
apiVersion: v1
kind: Service
metadata:
name: umami-deployment-service
namespace: asraphiel
spec:
selector:
app: umami-deployment
ports:
- protocol: TCP
port: 80
targetPort: 3000

1
flux/cluster/apps/kustomization.yaml
View File

@ -7,3 +7,4 @@ resources:
- drone
- keel
- family
- asraphiel

53
flux/cluster/apps/misc/cdn-control/deployment.yaml
View File

@ -1,53 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: cdn-deployment
namespace: misc
labels:
app: cdn-deployment
keel.sh/policy: force
keel.sh/match-tag: "true"
spec:
replicas: 1
selector:
matchLabels:
app: cdn-deployment
template:
metadata:
labels:
app: cdn-deployment
spec:
containers:
- name: cdn-deployment
imagePullPolicy: Always
image: registry.asraphiel.dev/library/cdn-control:main
ports:
- containerPort: 8080
env:
- name: CDN_ACCESS_KEY
valueFrom:
secretKeyRef:
name: cdn-secrets
key: access-key
- name: CDN_SECRET_KEY
valueFrom:
secretKeyRef:
name: cdn-secrets
key: secret-key
- name: CDN_ENDPOINT
valueFrom:
secretKeyRef:
name: cdn-secrets
key: endpoint
- name: CDN_BASE_PATH
valueFrom:
secretKeyRef:
name: cdn-secrets
key: base-path
- name: CDN_BUCKET
valueFrom:
secretKeyRef:
name: cdn-secrets
key: bucket
imagePullSecrets:
- name: registry-creds

27
flux/cluster/apps/misc/cdn-control/ingress.yaml
View File

@ -1,27 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: cdn-deployment-ingress
namespace: misc
spec:
rules:
- host: "cdn.asraphiel.dev"
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: cdn-deployment-service
port:
number: 80
- host: "cdn.voidcorp.nl"
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: cdn-deployment-service
port:
number: 80

33
flux/cluster/apps/misc/cdn-control/secret.yaml
View File

@ -1,33 +0,0 @@
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: cdn-secrets
namespace: misc
spec:
refreshInterval: "15s"
secretStoreRef:
name: vault
kind: ClusterSecretStore
target:
name: cdn-secrets
data:
- secretKey: access-key
remoteRef:
key: k8s/cdn
property: access-key
- secretKey: secret-key
remoteRef:
key: k8s/cdn
property: secret-key
- secretKey: endpoint
remoteRef:
key: k8s/cdn
property: endpoint
- secretKey: base-path
remoteRef:
key: k8s/cdn
property: base-path
- secretKey: bucket
remoteRef:
key: k8s/cdn
property: bucket

12
flux/cluster/apps/misc/cdn-control/service.yaml
View File

@ -1,12 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: cdn-deployment-service
namespace: misc
spec:
selector:
app: cdn-deployment
ports:
- protocol: TCP
port: 80
targetPort: 8080

1
flux/cluster/apps/misc/kustomization.yaml
View File

@ -3,4 +3,3 @@ kind: Kustomization
resources:
- pinbot
- registry-creds.yaml
- cdn-control

6
flux/cluster/core/namespaces/asraphiel.yaml Normal file
View File

@ -0,0 +1,6 @@
kind: Namespace
apiVersion: v1
metadata:
name: asraphiel
labels:
name: asraphiel

1
flux/cluster/core/namespaces/kustomization.yaml
View File

@ -9,3 +9,4 @@ resources:
- keel.yaml
- family.yaml
- misc.yaml
- asraphiel.yaml

2
nixos/machines/nginx/default.nix
View File

@ -63,6 +63,7 @@ in {
virtualHosts."registry.asraphiel.dev" = proxy "http://registry.lxd:5000/";
virtualHosts."vaultwarden.asraphiel.dev" =
proxy "http://vaultwarden.lxd:8000/";
virtualHosts."analytics.asraphiel.dev" = k8sProxy;
virtualHosts."groenehartansichtkaarten.nl" = k8sProxy;
virtualHosts."ansichtkaarten.asraphiel.dev" = k8sProxy;
@ -77,6 +78,7 @@ in {
http2 = true;
globalRedirect = "galerievanslagmaat.nl";
};
};
security.acme.email = "acme@voidcorp.nl";

12
nixos/machines/postgres/default.nix
View File

@ -1,4 +1,10 @@
{ config, pkgs, ... }: {
{ config, pkgs, ... }:
let
user = name: {
name = name;
ensurePermissions = { "DATABASE \"${name}\"" = "ALL PRIVILEGES"; };
};
in {
imports = [ ../../common ../../common/lxc.nix ];
networking.hostName = "postgres";
system.stateVersion = "21.11";
@ -17,13 +23,12 @@
host all all 10.0.0.0/8 trust
host all all fd42:8db7:2e6b:8e9b:216:3eff::/96 trust
'';
ensureDatabases = [ "gitea" "vault" "vaultwarden" "authentik" ];
ensureDatabases = [ "gitea" "vault" "vaultwarden" "authentik" "umami" ];
ensureUsers = [
{
name = "gitea";
ensurePermissions = { "DATABASE \"gitea\"" = "ALL PRIVILEGES"; };
}
{
name = "vault";
ensurePermissions = { "DATABASE \"vault\"" = "ALL PRIVILEGES"; };
@ -36,6 +41,7 @@
name = "authentik";
ensurePermissions = { "DATABASE \"authentik\"" = "ALL PRIVILEGES"; };
}
(user "umami")
];
enableTCPIP = true;

39
s3-policy.json Normal file
View File

@ -0,0 +1,39 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": [
"*"
]
},
"Action": [
"s3:GetBucketLocation",
"s3:ListBucket",
"s3:ListBucketMultipartUploads"
],
"Resource": [
"arn:aws:s3:::galerie"
]
},
{
"Effect": "Allow",
"Principal": {
"AWS": [
"*"
]
},
"Action": [
"s3:PutObject",
"s3:AbortMultipartUpload",
"s3:DeleteObject",
"s3:GetObject",
"s3:ListMultipartUploadParts"
],
"Resource": [
"arn:aws:s3:::galerie/*"
]
}
]
}