initial: yandex-prod gitops infrastructure

Gitea + ArgoCD + cert-manager + Traefik + CNPG + monitoring + loki + alloy matrix homeservers for mrt0rtikize.ru, t0rt1k.tech, roglog.space

manifests/cnpg/cluster.yaml

@@ -7,6 +7,14 @@ spec:
   instances: 3
   imageName: ghcr.io/cloudnative-pg/postgresql:16
 
+  resources:
+    requests:
+      memory: 1Gi
+      cpu: 250m
+    limits:
+      memory: 2Gi
+      cpu: 1000m
+
   storage:
     size: 20Gi
     storageClass: yc-network-ssd
@@ -21,10 +29,13 @@ spec:
 
   postgresql:
     parameters:
-      shared_buffers: "256MB"
-      effective_cache_size: "768MB"
+      shared_buffers: "512MB"
+      effective_cache_size: "1536MB"
       maintenance_work_mem: "64MB"
       max_connections: "200"
+      work_mem: "16MB"
+      random_page_cost: "1.1"
+      effective_io_concurrency: "200"
 
   monitoring:
     enablePodMonitor: true

manifests/cnpg/databases.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   name: synapse_mrt0rtikize
   owner: synapse_mrt0rtikize
-  clusterRef:
+  cluster:
     name: shared-pg
 ---
 apiVersion: postgresql.cnpg.io/v1
@@ -17,7 +17,7 @@ metadata:
 spec:
   name: mas_mrt0rtikize
   owner: mas_mrt0rtikize
-  clusterRef:
+  cluster:
     name: shared-pg
 ---
 apiVersion: postgresql.cnpg.io/v1
@@ -28,7 +28,7 @@ metadata:
 spec:
   name: synapse_t0rt1k
   owner: synapse_t0rt1k
-  clusterRef:
+  cluster:
     name: shared-pg
 ---
 apiVersion: postgresql.cnpg.io/v1
@@ -39,7 +39,7 @@ metadata:
 spec:
   name: mas_t0rt1k
   owner: mas_t0rt1k
-  clusterRef:
+  cluster:
     name: shared-pg
 ---
 apiVersion: postgresql.cnpg.io/v1
@@ -50,7 +50,7 @@ metadata:
 spec:
   name: synapse_roglog
   owner: synapse_roglog
-  clusterRef:
+  cluster:
     name: shared-pg
 ---
 apiVersion: postgresql.cnpg.io/v1
@@ -61,7 +61,7 @@ metadata:
 spec:
   name: mas_roglog
   owner: mas_roglog
-  clusterRef:
+  cluster:
     name: shared-pg
 ---
 apiVersion: postgresql.cnpg.io/v1
@@ -72,7 +72,7 @@ metadata:
 spec:
   name: synapse_uretra
   owner: synapse_uretra
-  clusterRef:
+  cluster:
     name: shared-pg
 ---
 apiVersion: postgresql.cnpg.io/v1
@@ -83,5 +83,5 @@ metadata:
 spec:
   name: mas_uretra
   owner: mas_uretra
-  clusterRef:
+  cluster:
     name: shared-pg

manifests/cnpg/secrets.yaml

@@ -1,63 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: mrt0rtikize-pg-creds
-  namespace: cnpg
-  labels:
-    cnpg.io/reload: ""
-type: kubernetes.io/basic-auth
-stringData:
-  synapse: |
-    username: synapse_mrt0rtikize
-    password: change-me-synapse
-  mas: |
-    username: mas_mrt0rtikize
-    password: change-me-mas
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: t0rt1k-pg-creds
-  namespace: cnpg
-  labels:
-    cnpg.io/reload: ""
-type: kubernetes.io/basic-auth
-stringData:
-  synapse: |
-    username: synapse_t0rt1k
-    password: change-me-synapse
-  mas: |
-    username: mas_t0rt1k
-    password: change-me-mas
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: roglog-pg-creds
-  namespace: cnpg
-  labels:
-    cnpg.io/reload: ""
-type: kubernetes.io/basic-auth
-stringData:
-  synapse: |
-    username: synapse_roglog
-    password: change-me-synapse
-  mas: |
-    username: mas_roglog
-    password: change-me-mas
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: uretra-pg-creds
-  namespace: cnpg
-  labels:
-    cnpg.io/reload: ""
-type: kubernetes.io/basic-auth
-stringData:
-  synapse: |
-    username: synapse_uretra
-    password: change-me-synapse
-  mas: |
-    username: mas_uretra
-    password: change-me-mas

manifests/gitea/ingressroute-ssh.yaml

@@ -0,0 +1,13 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: gitea-ssh
+  namespace: gitea
+spec:
+  entryPoints:
+    - ssh
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: gitea
+          port: 22

manifests/matrix-mrt0rtikize/ingressroute-rtc-tcp.yaml

@@ -0,0 +1,13 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: rtc-tcp
+  namespace: matrix-mrt0rtikize
+spec:
+  entryPoints:
+    - rtc-tcp-mrt0rtikize
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: matrix-mrt0rtikize-matrix-rtc-sfu-tcp
+          port: 30009

manifests/matrix-mrt0rtikize/ingressroute-rtc-udp.yaml

@@ -0,0 +1,12 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteUDP
+metadata:
+  name: rtc-udp
+  namespace: matrix-mrt0rtikize
+spec:
+  entryPoints:
+    - rtc-udp-mrt0rtikize
+  routes:
+    - services:
+        - name: matrix-mrt0rtikize-matrix-rtc-sfu-muxed-udp
+          port: 30008

manifests/matrix-roglog/ingressroute-rtc-tcp.yaml

@@ -0,0 +1,13 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: rtc-tcp
+  namespace: matrix-roglog
+spec:
+  entryPoints:
+    - rtc-tcp-roglog
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: matrix-roglog-matrix-rtc-sfu-tcp
+          port: 30005

manifests/matrix-roglog/ingressroute-rtc-udp.yaml

@@ -0,0 +1,12 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteUDP
+metadata:
+  name: rtc-udp
+  namespace: matrix-roglog
+spec:
+  entryPoints:
+    - rtc-udp-roglog
+  routes:
+    - services:
+        - name: matrix-roglog-matrix-rtc-sfu-muxed-udp
+          port: 30004

manifests/matrix-t0rt1k/ingressroute-rtc-tcp.yaml

@@ -0,0 +1,13 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: rtc-tcp
+  namespace: matrix-t0rt1k
+spec:
+  entryPoints:
+    - rtc-tcp-t0rt1k
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: matrix-t0rt1k-matrix-rtc-sfu-tcp
+          port: 30007

manifests/matrix-t0rt1k/ingressroute-rtc-udp.yaml

@@ -0,0 +1,12 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteUDP
+metadata:
+  name: rtc-udp
+  namespace: matrix-t0rt1k
+spec:
+  entryPoints:
+    - rtc-udp-t0rt1k
+  routes:
+    - services:
+        - name: matrix-t0rt1k-matrix-rtc-sfu-muxed-udp
+          port: 30006

manifests/matrix-t0rt1k/vmpodscrape-synapse.yaml

@@ -0,0 +1,15 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: synapse
+  namespace: matrix-t0rt1k
+spec:
+  namespaceSelector:
+    matchNames:
+      - matrix-t0rt1k
+  podMetricsEndpoints:
+    - port: synapse-metrics
+      path: /metrics
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: matrix-server

manifests/metrics/grafana/ingress.yaml

@@ -21,6 +21,6 @@ spec:
             pathType: Prefix
             backend:
               service:
-                name: vm-k8s-stack-grafana
+                name: monitoring-grafana
                 port:
                   number: 80

manifests/metrics/grafana/loki-datasource.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: loki-grafana-ds
+  namespace: metrics
+  labels:
+    grafana_datasource: "1"
+data:
+  datasource.yaml: |
+    apiVersion: 1
+    datasources:
+      - access: proxy
+        isDefault: false
+        name: Loki
+        type: loki
+        uid: Loki
+        url: http://loki.metrics.svc.cluster.local:3100