initial: yandex-prod gitops infrastructure

Gitea + ArgoCD + cert-manager + Traefik + CNPG + monitoring + loki + alloy
Matrix homeservers for mrt0rtikize.ru, t0rt1k.tech, roglog.space

manifests/cert-manager/cluster-issuers.yaml

@@ -0,0 +1,29 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-production
+spec:
+  acme:
+    email: i_am@rogov.al
+    privateKeySecretRef:
+      name: letsencrypt-production-account-key
+    server: https://acme-v02.api.letsencrypt.org/directory
+    solvers:
+      - http01:
+          ingress:
+            class: traefik
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    email: i_am@rogov.al
+    privateKeySecretRef:
+      name: letsencrypt-staging-account-key
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    solvers:
+      - http01:
+          ingress:
+            class: traefik

manifests/cnpg/cluster.yaml

@@ -0,0 +1,41 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: shared-pg
+  namespace: cnpg
+spec:
+  instances: 3
+  imageName: ghcr.io/cloudnative-pg/postgresql:16
+
+  resources:
+    requests:
+      memory: 1Gi
+      cpu: 250m
+    limits:
+      memory: 2Gi
+      cpu: 1000m
+
+  storage:
+    size: 20Gi
+    storageClass: yc-network-ssd
+
+  affinity:
+    podAntiAffinityType: required
+
+  bootstrap:
+    initdb:
+      database: postgres
+      owner: postgres
+
+  postgresql:
+    parameters:
+      shared_buffers: "512MB"
+      effective_cache_size: "1536MB"
+      maintenance_work_mem: "64MB"
+      max_connections: "200"
+      work_mem: "16MB"
+      random_page_cost: "1.1"
+      effective_io_concurrency: "200"
+
+  monitoring:
+    enablePodMonitor: true

manifests/cnpg/databases.yaml

@@ -0,0 +1,66 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: synapse-mrt0rtikize
+  namespace: cnpg
+spec:
+  name: synapse_mrt0rtikize
+  owner: synapse_mrt0rtikize
+  cluster:
+    name: shared-pg
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: mas-mrt0rtikize
+  namespace: cnpg
+spec:
+  name: mas_mrt0rtikize
+  owner: mas_mrt0rtikize
+  cluster:
+    name: shared-pg
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: synapse-t0rt1k
+  namespace: cnpg
+spec:
+  name: synapse_t0rt1k
+  owner: synapse_t0rt1k
+  cluster:
+    name: shared-pg
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: mas-t0rt1k
+  namespace: cnpg
+spec:
+  name: mas_t0rt1k
+  owner: mas_t0rt1k
+  cluster:
+    name: shared-pg
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: synapse-roglog
+  namespace: cnpg
+spec:
+  name: synapse_roglog
+  owner: synapse_roglog
+  cluster:
+    name: shared-pg
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: mas-roglog
+  namespace: cnpg
+spec:
+  name: mas_roglog
+  owner: mas_roglog
+  cluster:
+    name: shared-pg
+

manifests/cnpg/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cnpg

manifests/gitea/ingressroute-ssh.yaml

@@ -0,0 +1,13 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: gitea-ssh
+  namespace: gitea
+spec:
+  entryPoints:
+    - ssh
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: gitea
+          port: 22

manifests/matrix-mrt0rtikize/ingressroute-rtc-tcp.yaml

@@ -0,0 +1,13 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: rtc-tcp
+  namespace: matrix-mrt0rtikize
+spec:
+  entryPoints:
+    - rtc-tcp-mrt0rtikize
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: matrix-mrt0rtikize-matrix-rtc-sfu-tcp
+          port: 30009

manifests/matrix-mrt0rtikize/ingressroute-rtc-udp.yaml

@@ -0,0 +1,12 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteUDP
+metadata:
+  name: rtc-udp
+  namespace: matrix-mrt0rtikize
+spec:
+  entryPoints:
+    - rtc-udp-mrt0rtikize
+  routes:
+    - services:
+        - name: matrix-mrt0rtikize-matrix-rtc-sfu-muxed-udp
+          port: 30008

manifests/matrix-roglog/ingressroute-rtc-tcp.yaml

@@ -0,0 +1,13 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: rtc-tcp
+  namespace: matrix-roglog
+spec:
+  entryPoints:
+    - rtc-tcp-roglog
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: matrix-roglog-matrix-rtc-sfu-tcp
+          port: 30005

manifests/matrix-roglog/ingressroute-rtc-udp.yaml

@@ -0,0 +1,12 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteUDP
+metadata:
+  name: rtc-udp
+  namespace: matrix-roglog
+spec:
+  entryPoints:
+    - rtc-udp-roglog
+  routes:
+    - services:
+        - name: matrix-roglog-matrix-rtc-sfu-muxed-udp
+          port: 30004

manifests/matrix-t0rt1k/ingressroute-rtc-tcp.yaml

@@ -0,0 +1,13 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: rtc-tcp
+  namespace: matrix-t0rt1k
+spec:
+  entryPoints:
+    - rtc-tcp-t0rt1k
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: matrix-t0rt1k-matrix-rtc-sfu-tcp
+          port: 30007

manifests/matrix-t0rt1k/ingressroute-rtc-udp.yaml

@@ -0,0 +1,12 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteUDP
+metadata:
+  name: rtc-udp
+  namespace: matrix-t0rt1k
+spec:
+  entryPoints:
+    - rtc-udp-t0rt1k
+  routes:
+    - services:
+        - name: matrix-t0rt1k-matrix-rtc-sfu-muxed-udp
+          port: 30006

manifests/matrix-t0rt1k/vmpodscrape-synapse.yaml

@@ -0,0 +1,15 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: synapse
+  namespace: matrix-t0rt1k
+spec:
+  namespaceSelector:
+    matchNames:
+      - matrix-t0rt1k
+  podMetricsEndpoints:
+    - port: synapse-metrics
+      path: /metrics
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: matrix-server

manifests/metrics/grafana/ingress.yaml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: grafana
+  namespace: metrics
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - grafana.prod.t01tt.tech
+      secretName: grafana-tls
+  rules:
+    - host: grafana.prod.t01tt.tech
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: monitoring-grafana
+                port:
+                  number: 80

manifests/metrics/grafana/loki-datasource.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: loki-grafana-ds
+  namespace: metrics
+  labels:
+    grafana_datasource: "1"
+data:
+  datasource.yaml: |
+    apiVersion: 1
+    datasources:
+      - access: proxy
+        isDefault: false
+        name: Loki
+        type: loki
+        uid: Loki
+        url: http://loki.metrics.svc.cluster.local:3100

manifests/metrics/grafana/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: metrics