385abf1092
- infrastructure/outline/vk-infra: namespace, HelmRelease outline-valkey (valkey 0.1.0, standalone) и outline (outline 0.1.0, Outline 1.12.0) - clusters/vk-infra: подключение outline/vk-infra - istio-config/vk-infra: Certificate, Gateway и VirtualService для wiki.sarex.space Секреты outline и outline-valkey созданы в кластере вручную.
140 lines
3.9 KiB
YAML
140 lines
3.9 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: outline
|
|
namespace: outline
|
|
spec:
|
|
interval: 10m
|
|
timeout: 10m
|
|
chart:
|
|
spec:
|
|
chart: outline
|
|
version: "0.1.0"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: yc-oci-charts
|
|
namespace: flux-system
|
|
interval: 10m
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
dependsOn:
|
|
- name: istiod
|
|
namespace: istio-system
|
|
- name: outline-valkey
|
|
namespace: outline
|
|
values:
|
|
universal-chart:
|
|
global:
|
|
env: infra
|
|
image:
|
|
name:
|
|
infra: cr.yandex/crp3ccidau046kdj8g9q/outlinewiki/outline:1.12.0
|
|
envs:
|
|
- name: NODE_ENV
|
|
value:
|
|
_default: production
|
|
- name: URL
|
|
value:
|
|
_default: https://wiki.sarex.space
|
|
- name: PORT
|
|
value:
|
|
_default: "3000"
|
|
- name: WEB_CONCURRENCY
|
|
value:
|
|
_default: "1"
|
|
# TLS терминируется на istio ingressgateway
|
|
- name: FORCE_HTTPS
|
|
value:
|
|
_default: "false"
|
|
- name: ENABLE_UPDATES
|
|
value:
|
|
_default: "false"
|
|
- name: LOG_LEVEL
|
|
value:
|
|
_default: info
|
|
- name: PGSSLMODE
|
|
value:
|
|
_default: require
|
|
- name: FILE_STORAGE
|
|
value:
|
|
_default: s3
|
|
- name: AWS_REGION
|
|
value:
|
|
_default: ru-msk
|
|
- name: AWS_S3_UPLOAD_BUCKET_URL
|
|
value:
|
|
_default: https://hb.ru-msk.vkcloud-storage.ru
|
|
- name: AWS_S3_UPLOAD_BUCKET_NAME
|
|
value:
|
|
_default: sarex-wiki
|
|
- name: AWS_S3_FORCE_PATH_STYLE
|
|
value:
|
|
_default: "true"
|
|
- name: AWS_S3_ACL
|
|
value:
|
|
_default: private
|
|
# VK Object Storage документирует presigned PUT; presigned POST не описан
|
|
- name: AWS_S3_UPLOAD_METHOD
|
|
value:
|
|
_default: put
|
|
- name: OIDC_DISPLAY_NAME
|
|
value:
|
|
_default: Sarex IAM
|
|
- name: OIDC_AUTH_URI
|
|
value:
|
|
_default: https://iam.sarex.io/oauth/v2/authorize
|
|
- name: OIDC_TOKEN_URI
|
|
value:
|
|
_default: https://iam.sarex.io/oauth/v2/token
|
|
- name: OIDC_USERINFO_URI
|
|
value:
|
|
_default: https://iam.sarex.io/oidc/v1/userinfo
|
|
- name: OIDC_LOGOUT_URI
|
|
value:
|
|
_default: https://iam.sarex.io/oidc/v1/end_session
|
|
- name: OIDC_USERNAME_CLAIM
|
|
value:
|
|
_default: preferred_username
|
|
- name: OIDC_SCOPES
|
|
value:
|
|
_default: openid profile email offline_access
|
|
# SMTP подключается отдельным шагом: добавить SMTP_HOST, SMTP_PORT,
|
|
# SMTP_FROM_EMAIL сюда и SMTP_USERNAME, SMTP_PASSWORD в secretEnvs.
|
|
secretEnvs:
|
|
- name: SECRET_KEY
|
|
secretName:
|
|
_default: outline
|
|
secretKey: SECRET_KEY
|
|
- name: UTILS_SECRET
|
|
secretName:
|
|
_default: outline
|
|
secretKey: UTILS_SECRET
|
|
- name: DATABASE_URL
|
|
secretName:
|
|
_default: outline
|
|
secretKey: DATABASE_URL
|
|
- name: REDIS_URL
|
|
secretName:
|
|
_default: outline
|
|
secretKey: REDIS_URL
|
|
- name: AWS_ACCESS_KEY_ID
|
|
secretName:
|
|
_default: outline
|
|
secretKey: AWS_ACCESS_KEY_ID
|
|
- name: AWS_SECRET_ACCESS_KEY
|
|
secretName:
|
|
_default: outline
|
|
secretKey: AWS_SECRET_ACCESS_KEY
|
|
- name: OIDC_CLIENT_ID
|
|
secretName:
|
|
_default: outline
|
|
secretKey: OIDC_CLIENT_ID
|
|
- name: OIDC_CLIENT_SECRET
|
|
secretName:
|
|
_default: outline
|
|
secretKey: OIDC_CLIENT_SECRET
|