From dacbce4c85535c5d85688ce7c7fdc75bf8c9e4ee Mon Sep 17 00:00:00 2001 From: Alexander Rogov Date: Sun, 12 Jul 2026 19:06:02 +0300 Subject: [PATCH] mastodon new opensearch --- argocd/apps/mastodon.yaml | 211 ++++++++++++++++-------------- manifests/mastodon/secrets.yaml | 18 +++ manifests/opensearch/secrets.yaml | 6 +- manifests/opensearch/user.yaml | 40 ++++++ 4 files changed, 171 insertions(+), 104 deletions(-) create mode 100644 manifests/mastodon/secrets.yaml create mode 100644 manifests/opensearch/user.yaml diff --git a/argocd/apps/mastodon.yaml b/argocd/apps/mastodon.yaml index d12d9ad..f79f4ae 100644 --- a/argocd/apps/mastodon.yaml +++ b/argocd/apps/mastodon.yaml @@ -7,112 +7,121 @@ metadata: - resources-finalizer.argocd.argoproj.io spec: project: default - source: - repoURL: https://mastodon.github.io/helm-charts/ - chart: mastodon - targetRevision: "1.0.3" - helm: - values: | - mastodon: - localDomain: mastodon.t0rt1k.tech + sources: + - repoURL: http://gitea.gitea.svc.cluster.local:3000/admin/main.git + targetRevision: master + path: manifests/mastodon + directory: + recurse: true + include: "*.yaml" + - repoURL: https://mastodon.github.io/helm-charts/ + chart: mastodon + targetRevision: "1.0.3" + helm: + values: | + mastodon: + localDomain: mastodon.t0rt1k.tech - secrets: - secretKeyBase: c858bb02549193f4677f06db375f6015c282d7c2912c0a894bdcab66948f5ebcbf10286c94bcec8306cf704ecfe8c59a871fb14bcc29b50bad4c192039f84c25 - vapidPrivateKey: 5mrGQP9Cvo_t5hPwuVzY-zGfK-2pScDk42yhTwN193c= - vapidPublicKey: BF5GrO2MLqWBbIDhgmQP6xMMfqdor0Fm3KkjsMx_QYB5kKzdDvACwA59SP3T9zWWe5dB7EsYbHe-LF6S0sV7DKk= - arePrimaryKey: 2kcXaHigLHS0HDAPyGv53M4QJxZ7VTPCKqrIxnHyK+M= - areDeterministicKey: Oy5iD9DVPiCZu0PDKiv+R0MgvDHu7xYTT+U7Ml6HeBA= - areKeyDerivationSalt: UiOT/p0DYXIQ82yABJlCErrPB/VSneb7jW+XQ6TBHrg= + secrets: + secretKeyBase: c858bb02549193f4677f06db375f6015c282d7c2912c0a894bdcab66948f5ebcbf10286c94bcec8306cf704ecfe8c59a871fb14bcc29b50bad4c192039f84c25 + vapidPrivateKey: 5mrGQP9Cvo_t5hPwuVzY-zGfK-2pScDk42yhTwN193c= + vapidPublicKey: BF5GrO2MLqWBbIDhgmQP6xMMfqdor0Fm3KkjsMx_QYB5kKzdDvACwA59SP3T9zWWe5dB7EsYbHe-LF6S0sV7DKk= + arePrimaryKey: 2kcXaHigLHS0HDAPyGv53M4QJxZ7VTPCKqrIxnHyK+M= + areDeterministicKey: Oy5iD9DVPiCZu0PDKiv+R0MgvDHu7xYTT+U7Ml6HeBA= + areKeyDerivationSalt: UiOT/p0DYXIQ82yABJlCErrPB/VSneb7jW+XQ6TBHrg= - s3: + s3: + enabled: true + hostname: minio.minio.svc.cluster.local:9000 + endpoint: minio.minio.svc.cluster.local:9000 + protocol: http + bucket: mastodon + accessKeyId: admin + secretAccessKey: change-me + overridePathStyle: "true" + + web: + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi + + sidekiq: + workers: + - name: all-queues + replicas: 1 + concurrency: 15 + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi + + streaming: + replicas: 1 + resources: + requests: + cpu: 50m + memory: 128Mi + limits: + cpu: 250m + memory: 256Mi + + smtp: + fromAddress: notifications@t0rt1k.tech + server: smtp.example.com + port: 587 + username: dummy + password: dummy + + postgresql: + hostname: shared-pg-rw.cnpg.svc.cluster.local + port: 5432 + database: mastodon + username: mastodon + password: change-me + + redis: + hostname: redis-master.redis.svc.cluster.local + port: 6379 + password: change-me + + elasticsearch: enabled: true - hostname: minio.minio.svc.cluster.local:9000 - endpoint: minio.minio.svc.cluster.local:9000 - protocol: http - bucket: mastodon - accessKeyId: admin - secretAccessKey: change-me - overridePathStyle: "true" + hostname: shared-os.opensearch.svc.cluster.local + port: 9200 + tls: true + preset: small_cluster + existingSecret: mastodon-os + caSecret: + name: os-ca + key: ca.crt + mountPath: /opt/opensearch/config/ca.certs - web: - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - cpu: 500m - memory: 512Mi + ingress: + enabled: true + className: traefik + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" + hosts: + - host: mastodon.t0rt1k.tech + paths: + - path: / + pathType: Prefix + tls: + - secretName: mastodon-tls + hosts: + - mastodon.t0rt1k.tech - sidekiq: - workers: - - name: all-queues - replicas: 1 - concurrency: 15 - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - cpu: 500m - memory: 512Mi - - streaming: - replicas: 1 - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - cpu: 250m - memory: 256Mi - - smtp: - fromAddress: notifications@t0rt1k.tech - server: smtp.example.com - port: 587 - username: dummy - password: dummy - - postgresql: - hostname: shared-pg-rw.cnpg.svc.cluster.local - port: 5432 - database: mastodon - username: mastodon - password: change-me - - redis: - hostname: redis-master.redis.svc.cluster.local - port: 6379 - password: change-me - - elasticsearch: - enabled: true - hostname: shared-os-nodes.opensearch.svc.cluster.local - port: 9200 - tls: false - preset: single_node_cluster - username: dummy - password: dummy - - ingress: - enabled: true - className: traefik - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production - traefik.ingress.kubernetes.io/router.entrypoints: websecure - traefik.ingress.kubernetes.io/router.tls: "true" - hosts: - - host: mastodon.t0rt1k.tech - paths: - - path: / - pathType: Prefix - tls: - - secretName: mastodon-tls - hosts: - - mastodon.t0rt1k.tech - - httproute: - enabled: false + httproute: + enabled: false destination: server: https://kubernetes.default.svc namespace: mastodon diff --git a/manifests/mastodon/secrets.yaml b/manifests/mastodon/secrets.yaml new file mode 100644 index 0000000..ae73d5c --- /dev/null +++ b/manifests/mastodon/secrets.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +kind: Secret +metadata: + name: mastodon-os + namespace: mastodon +type: Opaque +stringData: + username: mastodon + password: "2&ey0J8c1pHbu%kP" +--- +apiVersion: v1 +kind: Secret +metadata: + name: os-ca + namespace: mastodon +type: Opaque +data: + ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUV4akNDQTY2Z0F3SUJBZ0lVRFdRSm1XWjl4QlRzUVVlT3Q5RjVZU1BwcU9Jd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZOHhFekFSQmdvSmtpYUprL0lzWkFFWkZnTmpiMjB4RnpBVkJnb0praWFKay9Jc1pBRVpGZ2RsZUdGdApjR3hsTVJrd0Z3WURWUVFLREJCRmVHRnRjR3hsSUVOdmJTQkpibU11TVNFd0h3WURWUVFMREJoRmVHRnRjR3hsCklFTnZiU0JKYm1NdUlGSnZiM1FnUTBFeElUQWZCZ05WQkFNTUdFVjRZVzF3YkdVZ1EyOXRJRWx1WXk0Z1VtOXYKZENCRFFUQWVGdzB5TkRBeU1qQXhOekF3TXpaYUZ3MHpOREF5TVRjeE56QXdNelphTUlHUE1STXdFUVlLQ1pJbQppWlB5TEdRQkdSWURZMjl0TVJjd0ZRWUtDWkltaVpQeUxHUUJHUllIWlhoaGJYQnNaVEVaTUJjR0ExVUVDZ3dRClJYaGhiWEJzWlNCRGIyMGdTVzVqTGpFaE1COEdBMVVFQ3d3WVJYaGhiWEJzWlNCRGIyMGdTVzVqTGlCU2IyOTAKSUVOQk1TRXdId1lEVlFRRERCaEZlR0Z0Y0d4bElFTnZiU0JKYm1NdUlGSnZiM1FnUTBFd2dnRWlNQTBHQ1NxRwpTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFERVB5TjdKOVZHUHlKY1FtQ0JsNVRHd2ZTenZWZFd3b1FVCmo5YUVzZGZGSjZwQkNEUVNzajhMdjRScUwwZFpyYTdoN1NwWkxMWC9ZWmNuamlrcllDK3JQNU93c0k5eEVFLzQKVTk4Q3NUQlBoSU1ncUZLNlN6TkU1NDk0QnNBazRjTDcyZE9PYzh0WDE5b0RTL1B2QlVMYk5rdGhRMGFBRjFkZwp2YnJIdnU3aHE3TGlzQjVaUkdIVkUxay9BYkNzMlBhYUtrbjJqQ3cvYitVME1sOXFQdXVFZ3oybUFxSkRHWW9BCldTUjRZWHJPY3JtUHVScWJ3czQ2NFlaYkpXODk4LzBQbi9VMzAwZWQrNFlIaU5ZTExKcDUxQU1rUjRZRXc5NjkKVlJQYldJdkxyZDBQUUJvb0MvZUxyTDZydnVkL0dwWWhkUUVVeDhxY05DS2Q0YnozT2FRNUFnTUJBQUdqZ2dFVwpNSUlCRWpBUEJnTlZIUk1CQWY4RUJUQURBUUgvTUE0R0ExVWREd0VCL3dRRUF3SUJoakFkQmdOVkhRNEVGZ1FVCkY0ZmZvRnJyWmhLbjFkRDR1aEpGUExjckFKd3dnYzhHQTFVZEl3U0J4ekNCeElBVUY0ZmZvRnJyWmhLbjFkRDQKdWhKRlBMY3JBSnloZ1pXa2daSXdnWTh4RXpBUkJnb0praWFKay9Jc1pBRVpGZ05qYjIweEZ6QVZCZ29Ka2lhSgprL0lzWkFFWkZnZGxlR0Z0Y0d4bE1Sa3dGd1lEVlFRS0RCQkZlR0Z0Y0d4bElFTnZiU0JKYm1NdU1TRXdId1lEClZRUUxEQmhGZUdGdGNHeGxJRU52YlNCSmJtTXVJRkp2YjNRZ1EwRXhJVEFmQmdOVkJBTU1HRVY0WVcxd2JHVWcKUTI5dElFbHVZeTRnVW05dmRDQkRRWUlVRFdRSm1XWjl4QlRzUVVlT3Q5RjVZU1BwcU9Jd0RRWUpLb1pJaHZjTgpBUUVMQlFBRGdnRUJBTDNRM0FIVWhNaUxVeTZPbExTdDh3WDlJMm9OR0RLYkJ1MGF0cFVORHp0ay8wczNZTFFDCll1WGdONEtySWNNWFFJdUFYQ3g0MDdjK3BJbFQvVDFGTm4rVlFYd2k1NlBZenhRS3RscG9LVUwzb1BRRTFkMFYKNkVvaU5rKzZVb2R2eVpxcGRRdTdmWFZlbnRSTWsxUVg3RDlvdG1paU51WCtHU3hKaEpDMkx5enc2NU85RVVnRwoxeVZKb242UmtVR3RxQnFLSXVMa3NLd0VyLy9FTG5qbVhpdDRMUUtTbnFLcjBGVENCN3NlSXJLSk55YjM1UW5xCnF5OWEvVW5ob2tybWRkYTF0cjZNYnFVOGw3SG14THVTZC9LeStMMGVETnRZdjZZZk1ld3RqZzBUdEFuRnlRb3YKcmRYbWVxMWR5OUhMbzNEczRBRnozR3g5MDc2VHhjUlMvaUk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K diff --git a/manifests/opensearch/secrets.yaml b/manifests/opensearch/secrets.yaml index 5ecffc5..c8a206e 100644 --- a/manifests/opensearch/secrets.yaml +++ b/manifests/opensearch/secrets.yaml @@ -1,9 +1,9 @@ apiVersion: v1 kind: Secret metadata: - name: shared-os-admin-credentials + name: mastodon-os-password namespace: opensearch type: Opaque stringData: - username: admin - password: "OiYj2^J1@1HuHSOk" + password: "2&ey0J8c1pHbu%kP" + diff --git a/manifests/opensearch/user.yaml b/manifests/opensearch/user.yaml new file mode 100644 index 0000000..a5cb0f0 --- /dev/null +++ b/manifests/opensearch/user.yaml @@ -0,0 +1,40 @@ +apiVersion: opensearch.org/v1 +kind: OpensearchUser +metadata: + name: mastodon + namespace: opensearch +spec: + opensearchCluster: + name: shared-os + passwordFrom: + name: mastodon-os-password + key: password +--- +apiVersion: opensearch.org/v1 +kind: OpensearchRole +metadata: + name: mastodon + namespace: opensearch +spec: + opensearchCluster: + name: shared-os + clusterPermissions: + - cluster_monitor + indexPermissions: + - indexPatterns: + - "*" + allowedActions: + - indices_all +--- +apiVersion: opensearch.org/v1 +kind: OpensearchUserRoleBinding +metadata: + name: mastodon + namespace: opensearch +spec: + opensearchCluster: + name: shared-os + users: + - mastodon + roles: + - mastodon