diff --git a/clusters/vk-infra/infrastructure/kustomization.yaml b/clusters/vk-infra/infrastructure/kustomization.yaml index f8d629b..a3d9a36 100644 --- a/clusters/vk-infra/infrastructure/kustomization.yaml +++ b/clusters/vk-infra/infrastructure/kustomization.yaml @@ -12,3 +12,4 @@ resources: - ../../../infrastructure/kb/vk-infra - ../../../infrastructure/gitlab-runner/vk-infra - ../../../infrastructure/nexus/vk-infra + - ../../../infrastructure/outline/vk-infra diff --git a/infrastructure/istio-config/vk-infra/istio-config.yaml b/infrastructure/istio-config/vk-infra/istio-config.yaml index 488b328..dea2280 100644 --- a/infrastructure/istio-config/vk-infra/istio-config.yaml +++ b/infrastructure/istio-config/vk-infra/istio-config.yaml @@ -92,6 +92,17 @@ spec: renewBefore: 360h0m0s privateKey: rotationPolicy: Always + wiki-tls: + dnsNames: + - wiki.sarex.space + issuerRef: + name: letsencrypt-issuer-istio + kind: ClusterIssuer + spec: + duration: 2160h0m0s + renewBefore: 360h0m0s + privateKey: + rotationPolicy: Always istio: gateways: vault: @@ -150,6 +161,17 @@ spec: tls: credentialName: idp-tls mode: SIMPLE + wiki: + name: wiki-gateway + namespace: istio-system + selector: + istio: ingressgateway + servers: + - hosts: + - wiki.sarex.space + tls: + credentialName: wiki-tls + mode: SIMPLE virtualServices: vault-virt-service: namespace: istio-system @@ -217,3 +239,14 @@ spec: prefix: / service: idp.zitadel.svc.cluster.local port: 8080 + wiki-virt-service: + namespace: istio-system + hosts: + - wiki.sarex.space + gateways: + - istio-system/wiki-gateway + routes: + - path: + prefix: / + service: outline.outline.svc.cluster.local + port: 80 diff --git a/infrastructure/outline/vk-infra/kustomization.yaml b/infrastructure/outline/vk-infra/kustomization.yaml new file mode 100644 index 0000000..c8fc9b2 --- /dev/null +++ b/infrastructure/outline/vk-infra/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - valkey.yaml + - outline.yaml diff --git a/infrastructure/outline/vk-infra/namespace.yaml b/infrastructure/outline/vk-infra/namespace.yaml new file mode 100644 index 0000000..9782220 --- /dev/null +++ b/infrastructure/outline/vk-infra/namespace.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: outline + labels: + istio-injection: enabled diff --git a/infrastructure/outline/vk-infra/outline.yaml b/infrastructure/outline/vk-infra/outline.yaml new file mode 100644 index 0000000..c6c4224 --- /dev/null +++ b/infrastructure/outline/vk-infra/outline.yaml @@ -0,0 +1,139 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: outline + namespace: outline +spec: + interval: 10m + timeout: 10m + chart: + spec: + chart: outline + version: "0.1.0" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + dependsOn: + - name: istiod + namespace: istio-system + - name: outline-valkey + namespace: outline + values: + universal-chart: + global: + env: infra + image: + name: + infra: cr.yandex/crp3ccidau046kdj8g9q/outlinewiki/outline:1.12.0 + envs: + - name: NODE_ENV + value: + _default: production + - name: URL + value: + _default: https://wiki.sarex.space + - name: PORT + value: + _default: "3000" + - name: WEB_CONCURRENCY + value: + _default: "1" + # TLS терминируется на istio ingressgateway + - name: FORCE_HTTPS + value: + _default: "false" + - name: ENABLE_UPDATES + value: + _default: "false" + - name: LOG_LEVEL + value: + _default: info + - name: PGSSLMODE + value: + _default: require + - name: FILE_STORAGE + value: + _default: s3 + - name: AWS_REGION + value: + _default: ru-msk + - name: AWS_S3_UPLOAD_BUCKET_URL + value: + _default: https://hb.ru-msk.vkcloud-storage.ru + - name: AWS_S3_UPLOAD_BUCKET_NAME + value: + _default: sarex-wiki + - name: AWS_S3_FORCE_PATH_STYLE + value: + _default: "true" + - name: AWS_S3_ACL + value: + _default: private + # VK Object Storage документирует presigned PUT; presigned POST не описан + - name: AWS_S3_UPLOAD_METHOD + value: + _default: put + - name: OIDC_DISPLAY_NAME + value: + _default: Sarex IAM + - name: OIDC_AUTH_URI + value: + _default: https://iam.sarex.io/oauth/v2/authorize + - name: OIDC_TOKEN_URI + value: + _default: https://iam.sarex.io/oauth/v2/token + - name: OIDC_USERINFO_URI + value: + _default: https://iam.sarex.io/oidc/v1/userinfo + - name: OIDC_LOGOUT_URI + value: + _default: https://iam.sarex.io/oidc/v1/end_session + - name: OIDC_USERNAME_CLAIM + value: + _default: preferred_username + - name: OIDC_SCOPES + value: + _default: openid profile email offline_access + # SMTP подключается отдельным шагом: добавить SMTP_HOST, SMTP_PORT, + # SMTP_FROM_EMAIL сюда и SMTP_USERNAME, SMTP_PASSWORD в secretEnvs. + secretEnvs: + - name: SECRET_KEY + secretName: + _default: outline + secretKey: SECRET_KEY + - name: UTILS_SECRET + secretName: + _default: outline + secretKey: UTILS_SECRET + - name: DATABASE_URL + secretName: + _default: outline + secretKey: DATABASE_URL + - name: REDIS_URL + secretName: + _default: outline + secretKey: REDIS_URL + - name: AWS_ACCESS_KEY_ID + secretName: + _default: outline + secretKey: AWS_ACCESS_KEY_ID + - name: AWS_SECRET_ACCESS_KEY + secretName: + _default: outline + secretKey: AWS_SECRET_ACCESS_KEY + - name: OIDC_CLIENT_ID + secretName: + _default: outline + secretKey: OIDC_CLIENT_ID + - name: OIDC_CLIENT_SECRET + secretName: + _default: outline + secretKey: OIDC_CLIENT_SECRET diff --git a/infrastructure/outline/vk-infra/valkey.yaml b/infrastructure/outline/vk-infra/valkey.yaml new file mode 100644 index 0000000..2775d9f --- /dev/null +++ b/infrastructure/outline/vk-infra/valkey.yaml @@ -0,0 +1,58 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: outline-valkey + namespace: outline +spec: + interval: 10m + timeout: 10m + chart: + spec: + chart: valkey + version: "0.1.0" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + fullnameOverride: outline-valkey + global: + imagePullSecrets: + - istio-registry-secret + security: + allowInsecureImages: true + architecture: standalone + auth: + enabled: true + sentinel: false + existingSecret: outline-valkey + existingSecretPasswordKey: valkey-password + # Outline хранит в Valkey очереди фоновых задач и состояние websocket. + # Персистентность не нужна, вытеснение ключей недопустимо для очередей. + commonConfiguration: |- + appendonly no + save "" + maxmemory 256mb + maxmemory-policy noeviction + primary: + podAnnotations: + sidecar.istio.io/inject: "false" + nodeSelector: + sarex.io/pool: svc + resources: + requests: + cpu: 50m + memory: 128Mi + limits: + memory: 384Mi + persistence: + enabled: false + metrics: + enabled: false