feat: use postgresql for media applications when possible

M0NsTeRRR · Jun 18, 2024 · e88f1de · e88f1de
1 parent a746323
commit e88f1de
Show file tree

Hide file tree

Showing 24 changed files with 623 additions and 4 deletions.
diff --git a/ansible/group_vars/kubernetes_master/all.yml b/ansible/group_vars/kubernetes_master/all.yml
@@ -142,6 +142,26 @@ vault_policies:
       - path: secret/data/homelab/prod/hyperglass
         capabilities:
           - read
+  - name: bazarr
+    rules:
+      - path: secret/data/homelab/prod/bazarr
+        capabilities:
+          - read
+  - name: prowlarr
+    rules:
+      - path: secret/data/homelab/prod/prowlarr
+        capabilities:
+          - read
+  - name: radarr
+    rules:
+      - path: secret/data/homelab/prod/radarr
+        capabilities:
+          - read
+  - name: sonarr
+    rules:
+      - path: secret/data/homelab/prod/sonarr
+        capabilities:
+          - read
   - name: qbittorrent
     rules:
       - path: secret/data/homelab/prod/qbittorrent
@@ -266,6 +286,30 @@ public_vault_datas:
       bound_service_account_namespaces: qbittorrent
       policies: qbittorrent
       ttl: 1h
+  - path: auth/kubernetes/role/bazarr
+    data:
+      bound_service_account_names: bazarr-vault
+      bound_service_account_namespaces: bazarr
+      policies: bazarr
+      ttl: 1h
+  - path: auth/kubernetes/role/prowlarr
+    data:
+      bound_service_account_names: prowlarr-vault
+      bound_service_account_namespaces: prowlarr
+      policies: prowlarr
+      ttl: 1h
+  - path: auth/kubernetes/role/radarr
+    data:
+      bound_service_account_names: radarr-vault
+      bound_service_account_namespaces: radarr
+      policies: radarr
+      ttl: 1h
+  - path: auth/kubernetes/role/sonarr
+    data:
+      bound_service_account_names: sonarr-vault
+      bound_service_account_namespaces: sonarr
+      policies: sonarr
+      ttl: 1h
 vault_datas: "{{ public_vault_datas + secret_vault_datas }}"
 external_secrets_localhost_kubeconfig_path: "{{ kubernetes_localhost_kubeconfig_path }}"
 cert_manager_localhost_kubeconfig_path: "{{ kubernetes_localhost_kubeconfig_path }}"

diff --git a/ansible/group_vars/kubernetes_master/secrets.example b/ansible/group_vars/kubernetes_master/secrets.example
@@ -85,6 +85,30 @@ secret_vault_datas:
       data:
         REDIS_PASSWORD:
         devices.yaml: "{{ hyperglass_device_config }}"
+  - path: secret/data/homelab/prod/bazarr
+    data:
+      data:
+        API_KEY:
+        POSTGRES_USER:
+        POSTGRES_PASSWORD:
+  - path: secret/data/homelab/prod/prowlarr
+    data:
+      data:
+        API_KEY:
+        POSTGRES_USER:
+        POSTGRES_PASSWORD:
+  - path: secret/data/homelab/prod/radarr
+    data:
+      data:
+        API_KEY:
+        POSTGRES_USER:
+        POSTGRES_PASSWORD:
+  - path: secret/data/homelab/prod/sonarr
+    data:
+      data:
+        API_KEY:
+        POSTGRES_USER:
+        POSTGRES_PASSWORD:
   - path: secret/data/homelab/prod/qbittorrent
     data:
       data:

diff --git a/argocd/media/bazarr/kustomization.yaml b/argocd/media/bazarr/kustomization.yaml
@@ -6,7 +6,9 @@ kind: Kustomization
 namespace: &namespace bazarr
 
 resources:
-  - manifests/01_pvc.yaml
+  - manifests/01_external_secret.yaml
+  - manifests/02_pvc.yaml
+  - manifests/03_postgres.yaml
 
 helmCharts:
 - name: bazarr

diff --git a/argocd/media/bazarr/manifests/01_external_secret.yaml b/argocd/media/bazarr/manifests/01_external_secret.yaml
@@ -0,0 +1,92 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bazarr-vault
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/secretstore_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: SecretStore
+metadata:
+  name: vault
+spec:
+  provider:
+    vault:
+      server: "https://vault.vault.svc:8200"
+      path: "secret"
+      version: "v2"
+      auth:
+        kubernetes:
+          mountPath: "kubernetes"
+          role: "bazarr"
+          serviceAccountRef:
+            name: "bazarr-vault"
+      caProvider:
+        type: "ConfigMap"
+        name: "homelab-ca"
+        key: "ca.crt"
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: bazarr-vault
+spec:
+  refreshInterval: "1m"
+  target:
+    creationPolicy: "Owner"
+    deletionPolicy: "Retain"
+  secretStoreRef:
+    kind: SecretStore
+    name: vault
+  data:
+    - secretKey: RADARR__AUTH__APIKEY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: secret/data/homelab/prod/bazarr
+        property: API_KEY
+    - secretKey: POSTGRES_USERNAME
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: secret/data/homelab/prod/bazarr
+        property: POSTGRES_USER
+    - secretKey: POSTGRES_PASSWORD
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: secret/data/homelab/prod/bazarr
+        property: POSTGRES_PASSWORD
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: postgres-vault
+spec:
+  refreshInterval: "1m"
+  target:
+    creationPolicy: "Owner"
+    deletionPolicy: "Retain"
+  secretStoreRef:
+    kind: SecretStore
+    name: vault
+  data:
+    - secretKey: username
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: secret/data/homelab/prod/bazarr
+        property: POSTGRES_USER
+    - secretKey: password
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: secret/data/homelab/prod/bazarr
+        property: POSTGRES_PASSWORD
diff --git a/argocd/media/bazarr/manifests/01_pvc.yaml → argocd/media/bazarr/manifests/02_pvc.yaml b/argocd/media/bazarr/manifests/01_pvc.yaml → argocd/media/bazarr/manifests/02_pvc.yaml
diff --git a/argocd/media/bazarr/manifests/03_postgres.yaml b/argocd/media/bazarr/manifests/03_postgres.yaml
@@ -0,0 +1,23 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: bazarr-cluster
+spec:
+  instances: 1
+
+  primaryUpdateStrategy: unsupervised
+
+  enableSuperuserAccess: false
+
+  bootstrap:
+    initdb:
+      database: bazarr
+      owner: bazarr
+      secret:
+        name: postgres-vault
+      dataChecksums: true
+      encoding: 'UTF8'
+
+  storage:
+    size: 2Gi
diff --git a/argocd/media/bazarr/values.yaml b/argocd/media/bazarr/values.yaml
@@ -1,7 +1,18 @@
 ---
+strategy:
+  type: RollingUpdate
+
 extraEnv:
   - name: TZ
     value: Europe/Paris
+  - name: POSTGRES_ENABLED
+    value: "True"
+  - name: POSTGRES_HOST
+    value: "bazarr-cluster-rw"
+  - name: POSTGRES_PORT
+    value: "5432"
+  - name: POSTGRES_DATABASE
+    value: bazarr
 volumes:
   - name: data
     persistentVolumeClaim:

diff --git a/argocd/media/joal/values.yaml b/argocd/media/joal/values.yaml
@@ -1,4 +1,7 @@
 ---
+strategy:
+  type: RollingUpdate
+
 volumes:
   - name: &volume-config joal-config
     configMap:

diff --git a/argocd/media/prowlarr/kustomization.yaml b/argocd/media/prowlarr/kustomization.yaml
@@ -5,6 +5,10 @@ kind: Kustomization
 
 namespace: &namespace prowlarr
 
+resources:
+  - manifests/01_external_secret.yaml
+  - manifests/02_postgres.yaml
+
 helmCharts:
 - name: prowlarr
   releaseName: prowlarr

diff --git a/argocd/media/prowlarr/manifests/01_external_secret.yaml b/argocd/media/prowlarr/manifests/01_external_secret.yaml
@@ -0,0 +1,92 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: prowlarr-vault
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/secretstore_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: SecretStore
+metadata:
+  name: vault
+spec:
+  provider:
+    vault:
+      server: "https://vault.vault.svc:8200"
+      path: "secret"
+      version: "v2"
+      auth:
+        kubernetes:
+          mountPath: "kubernetes"
+          role: "prowlarr"
+          serviceAccountRef:
+            name: "prowlarr-vault"
+      caProvider:
+        type: "ConfigMap"
+        name: "homelab-ca"
+        key: "ca.crt"
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: prowlarr-vault
+spec:
+  refreshInterval: "1m"
+  target:
+    creationPolicy: "Owner"
+    deletionPolicy: "Retain"
+  secretStoreRef:
+    kind: SecretStore
+    name: vault
+  data:
+    - secretKey: PROWLARR__AUTH__APIKEY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: secret/data/homelab/prod/prowlarr
+        property: API_KEY
+    - secretKey: PROWLARR__POSTGRES__USER
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: secret/data/homelab/prod/prowlarr
+        property: POSTGRES_USER
+    - secretKey: PROWLARR__POSTGRES__PASSWORD
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: secret/data/homelab/prod/prowlarr
+        property: POSTGRES_PASSWORD
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: postgres-vault
+spec:
+  refreshInterval: "1m"
+  target:
+    creationPolicy: "Owner"
+    deletionPolicy: "Retain"
+  secretStoreRef:
+    kind: SecretStore
+    name: vault
+  data:
+    - secretKey: username
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: secret/data/homelab/prod/prowlarr
+        property: POSTGRES_USER
+    - secretKey: password
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: secret/data/homelab/prod/prowlarr
+        property: POSTGRES_PASSWORD
diff --git a/argocd/media/prowlarr/manifests/02_postgres.yaml b/argocd/media/prowlarr/manifests/02_postgres.yaml
@@ -0,0 +1,23 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: prowlarr-cluster
+spec:
+  instances: 1
+
+  primaryUpdateStrategy: unsupervised
+
+  enableSuperuserAccess: false
+
+  bootstrap:
+    initdb:
+      database: prowlarr
+      owner: prowlarr
+      secret:
+        name: postgres-vault
+      dataChecksums: true
+      encoding: 'UTF8'
+
+  storage:
+    size: 2Gi