mastodon new opensearch

2026-07-12 19:06:02 +03:00
parent 8b1854604b
commit dacbce4c85
4 changed files with 171 additions and 104 deletions
--- a/argocd/apps/mastodon.yaml
+++ b/argocd/apps/mastodon.yaml
@@ -7,112 +7,121 @@ metadata:
    - resources-finalizer.argocd.argoproj.io
 spec:
  project: default
-  source:
-    repoURL: https://mastodon.github.io/helm-charts/
-    chart: mastodon
-    targetRevision: "1.0.3"
-    helm:
-      values: |
-        mastodon:
-          localDomain: mastodon.t0rt1k.tech
+  sources:
+    - repoURL: http://gitea.gitea.svc.cluster.local:3000/admin/main.git
+      targetRevision: master
+      path: manifests/mastodon
+      directory:
+        recurse: true
+        include: "*.yaml"
+    - repoURL: https://mastodon.github.io/helm-charts/
+      chart: mastodon
+      targetRevision: "1.0.3"
+      helm:
+        values: |
+          mastodon:
+            localDomain: mastodon.t0rt1k.tech

-          secrets:
-            secretKeyBase: c858bb02549193f4677f06db375f6015c282d7c2912c0a894bdcab66948f5ebcbf10286c94bcec8306cf704ecfe8c59a871fb14bcc29b50bad4c192039f84c25
-            vapidPrivateKey: 5mrGQP9Cvo_t5hPwuVzY-zGfK-2pScDk42yhTwN193c=
-            vapidPublicKey: BF5GrO2MLqWBbIDhgmQP6xMMfqdor0Fm3KkjsMx_QYB5kKzdDvACwA59SP3T9zWWe5dB7EsYbHe-LF6S0sV7DKk=
-            arePrimaryKey: 2kcXaHigLHS0HDAPyGv53M4QJxZ7VTPCKqrIxnHyK+M=
-            areDeterministicKey: Oy5iD9DVPiCZu0PDKiv+R0MgvDHu7xYTT+U7Ml6HeBA=
-            areKeyDerivationSalt: UiOT/p0DYXIQ82yABJlCErrPB/VSneb7jW+XQ6TBHrg=
+            secrets:
+              secretKeyBase: c858bb02549193f4677f06db375f6015c282d7c2912c0a894bdcab66948f5ebcbf10286c94bcec8306cf704ecfe8c59a871fb14bcc29b50bad4c192039f84c25
+              vapidPrivateKey: 5mrGQP9Cvo_t5hPwuVzY-zGfK-2pScDk42yhTwN193c=
+              vapidPublicKey: BF5GrO2MLqWBbIDhgmQP6xMMfqdor0Fm3KkjsMx_QYB5kKzdDvACwA59SP3T9zWWe5dB7EsYbHe-LF6S0sV7DKk=
+              arePrimaryKey: 2kcXaHigLHS0HDAPyGv53M4QJxZ7VTPCKqrIxnHyK+M=
+              areDeterministicKey: Oy5iD9DVPiCZu0PDKiv+R0MgvDHu7xYTT+U7Ml6HeBA=
+              areKeyDerivationSalt: UiOT/p0DYXIQ82yABJlCErrPB/VSneb7jW+XQ6TBHrg=

-          s3:
+            s3:
+              enabled: true
+              hostname: minio.minio.svc.cluster.local:9000
+              endpoint: minio.minio.svc.cluster.local:9000
+              protocol: http
+              bucket: mastodon
+              accessKeyId: admin
+              secretAccessKey: change-me
+              overridePathStyle: "true"
+
+            web:
+              resources:
+                requests:
+                  cpu: 100m
+                  memory: 256Mi
+                limits:
+                  cpu: 500m
+                  memory: 512Mi
+
+            sidekiq:
+              workers:
+                - name: all-queues
+                  replicas: 1
+                  concurrency: 15
+                  resources:
+                    requests:
+                      cpu: 100m
+                      memory: 256Mi
+                    limits:
+                      cpu: 500m
+                      memory: 512Mi
+
+            streaming:
+              replicas: 1
+              resources:
+                requests:
+                  cpu: 50m
+                  memory: 128Mi
+                limits:
+                  cpu: 250m
+                  memory: 256Mi
+
+            smtp:
+              fromAddress: notifications@t0rt1k.tech
+              server: smtp.example.com
+              port: 587
+              username: dummy
+              password: dummy
+
+          postgresql:
+            hostname: shared-pg-rw.cnpg.svc.cluster.local
+            port: 5432
+            database: mastodon
+            username: mastodon
+            password: change-me
+
+          redis:
+            hostname: redis-master.redis.svc.cluster.local
+            port: 6379
+            password: change-me
+
+          elasticsearch:
            enabled: true
-            hostname: minio.minio.svc.cluster.local:9000
-            endpoint: minio.minio.svc.cluster.local:9000
-            protocol: http
-            bucket: mastodon
-            accessKeyId: admin
-            secretAccessKey: change-me
-            overridePathStyle: "true"
+            hostname: shared-os.opensearch.svc.cluster.local
+            port: 9200
+            tls: true
+            preset: small_cluster
+            existingSecret: mastodon-os
+            caSecret:
+              name: os-ca
+              key: ca.crt
+              mountPath: /opt/opensearch/config/ca.certs

-          web:
-            resources:
-              requests:
-                cpu: 100m
-                memory: 256Mi
-              limits:
-                cpu: 500m
-                memory: 512Mi
+          ingress:
+            enabled: true
+            className: traefik
+            annotations:
+              cert-manager.io/cluster-issuer: letsencrypt-production
+              traefik.ingress.kubernetes.io/router.entrypoints: websecure
+              traefik.ingress.kubernetes.io/router.tls: "true"
+            hosts:
+              - host: mastodon.t0rt1k.tech
+                paths:
+                  - path: /
+                    pathType: Prefix
+            tls:
+              - secretName: mastodon-tls
+                hosts:
+                  - mastodon.t0rt1k.tech

-          sidekiq:
-            workers:
-              - name: all-queues
-                replicas: 1
-                concurrency: 15
-                resources:
-                  requests:
-                    cpu: 100m
-                    memory: 256Mi
-                  limits:
-                    cpu: 500m
-                    memory: 512Mi
-
-          streaming:
-            replicas: 1
-            resources:
-              requests:
-                cpu: 50m
-                memory: 128Mi
-              limits:
-                cpu: 250m
-                memory: 256Mi
-
-          smtp:
-            fromAddress: notifications@t0rt1k.tech
-            server: smtp.example.com
-            port: 587
-            username: dummy
-            password: dummy
-
-        postgresql:
-          hostname: shared-pg-rw.cnpg.svc.cluster.local
-          port: 5432
-          database: mastodon
-          username: mastodon
-          password: change-me
-
-        redis:
-          hostname: redis-master.redis.svc.cluster.local
-          port: 6379
-          password: change-me
-
-        elasticsearch:
-          enabled: true
-          hostname: shared-os-nodes.opensearch.svc.cluster.local
-          port: 9200
-          tls: false
-          preset: single_node_cluster
-          username: dummy
-          password: dummy
-
-        ingress:
-          enabled: true
-          className: traefik
-          annotations:
-            cert-manager.io/cluster-issuer: letsencrypt-production
-            traefik.ingress.kubernetes.io/router.entrypoints: websecure
-            traefik.ingress.kubernetes.io/router.tls: "true"
-          hosts:
-            - host: mastodon.t0rt1k.tech
-              paths:
-                - path: /
-                  pathType: Prefix
-          tls:
-            - secretName: mastodon-tls
-              hosts:
-                - mastodon.t0rt1k.tech
-
-        httproute:
-          enabled: false
+          httproute:
+            enabled: false
  destination:
    server: https://kubernetes.default.svc
    namespace: mastodon
--- a/manifests/mastodon/secrets.yaml
+++ b/manifests/mastodon/secrets.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mastodon-os
+  namespace: mastodon
+type: Opaque
+stringData:
+  username: mastodon
+  password: "2&ey0J8c1pHbu%kP"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: os-ca
+  namespace: mastodon
+type: Opaque
+data:
+  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUV4akNDQTY2Z0F3SUJBZ0lVRFdRSm1XWjl4QlRzUVVlT3Q5RjVZU1BwcU9Jd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZOHhFekFSQmdvSmtpYUprL0lzWkFFWkZnTmpiMjB4RnpBVkJnb0praWFKay9Jc1pBRVpGZ2RsZUdGdApjR3hsTVJrd0Z3WURWUVFLREJCRmVHRnRjR3hsSUVOdmJTQkpibU11TVNFd0h3WURWUVFMREJoRmVHRnRjR3hsCklFTnZiU0JKYm1NdUlGSnZiM1FnUTBFeElUQWZCZ05WQkFNTUdFVjRZVzF3YkdVZ1EyOXRJRWx1WXk0Z1VtOXYKZENCRFFUQWVGdzB5TkRBeU1qQXhOekF3TXpaYUZ3MHpOREF5TVRjeE56QXdNelphTUlHUE1STXdFUVlLQ1pJbQppWlB5TEdRQkdSWURZMjl0TVJjd0ZRWUtDWkltaVpQeUxHUUJHUllIWlhoaGJYQnNaVEVaTUJjR0ExVUVDZ3dRClJYaGhiWEJzWlNCRGIyMGdTVzVqTGpFaE1COEdBMVVFQ3d3WVJYaGhiWEJzWlNCRGIyMGdTVzVqTGlCU2IyOTAKSUVOQk1TRXdId1lEVlFRRERCaEZlR0Z0Y0d4bElFTnZiU0JKYm1NdUlGSnZiM1FnUTBFd2dnRWlNQTBHQ1NxRwpTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFERVB5TjdKOVZHUHlKY1FtQ0JsNVRHd2ZTenZWZFd3b1FVCmo5YUVzZGZGSjZwQkNEUVNzajhMdjRScUwwZFpyYTdoN1NwWkxMWC9ZWmNuamlrcllDK3JQNU93c0k5eEVFLzQKVTk4Q3NUQlBoSU1ncUZLNlN6TkU1NDk0QnNBazRjTDcyZE9PYzh0WDE5b0RTL1B2QlVMYk5rdGhRMGFBRjFkZwp2YnJIdnU3aHE3TGlzQjVaUkdIVkUxay9BYkNzMlBhYUtrbjJqQ3cvYitVME1sOXFQdXVFZ3oybUFxSkRHWW9BCldTUjRZWHJPY3JtUHVScWJ3czQ2NFlaYkpXODk4LzBQbi9VMzAwZWQrNFlIaU5ZTExKcDUxQU1rUjRZRXc5NjkKVlJQYldJdkxyZDBQUUJvb0MvZUxyTDZydnVkL0dwWWhkUUVVeDhxY05DS2Q0YnozT2FRNUFnTUJBQUdqZ2dFVwpNSUlCRWpBUEJnTlZIUk1CQWY4RUJUQURBUUgvTUE0R0ExVWREd0VCL3dRRUF3SUJoakFkQmdOVkhRNEVGZ1FVCkY0ZmZvRnJyWmhLbjFkRDR1aEpGUExjckFKd3dnYzhHQTFVZEl3U0J4ekNCeElBVUY0ZmZvRnJyWmhLbjFkRDQKdWhKRlBMY3JBSnloZ1pXa2daSXdnWTh4RXpBUkJnb0praWFKay9Jc1pBRVpGZ05qYjIweEZ6QVZCZ29Ka2lhSgprL0lzWkFFWkZnZGxlR0Z0Y0d4bE1Sa3dGd1lEVlFRS0RCQkZlR0Z0Y0d4bElFTnZiU0JKYm1NdU1TRXdId1lEClZRUUxEQmhGZUdGdGNHeGxJRU52YlNCSmJtTXVJRkp2YjNRZ1EwRXhJVEFmQmdOVkJBTU1HRVY0WVcxd2JHVWcKUTI5dElFbHVZeTRnVW05dmRDQkRRWUlVRFdRSm1XWjl4QlRzUVVlT3Q5RjVZU1BwcU9Jd0RRWUpLb1pJaHZjTgpBUUVMQlFBRGdnRUJBTDNRM0FIVWhNaUxVeTZPbExTdDh3WDlJMm9OR0RLYkJ1MGF0cFVORHp0ay8wczNZTFFDCll1WGdONEtySWNNWFFJdUFYQ3g0MDdjK3BJbFQvVDFGTm4rVlFYd2k1NlBZenhRS3RscG9LVUwzb1BRRTFkMFYKNkVvaU5rKzZVb2R2eVpxcGRRdTdmWFZlbnRSTWsxUVg3RDlvdG1paU51WCtHU3hKaEpDMkx5enc2NU85RVVnRwoxeVZKb242UmtVR3RxQnFLSXVMa3NLd0VyLy9FTG5qbVhpdDRMUUtTbnFLcjBGVENCN3NlSXJLSk55YjM1UW5xCnF5OWEvVW5ob2tybWRkYTF0cjZNYnFVOGw3SG14THVTZC9LeStMMGVETnRZdjZZZk1ld3RqZzBUdEFuRnlRb3YKcmRYbWVxMWR5OUhMbzNEczRBRnozR3g5MDc2VHhjUlMvaUk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
--- a/manifests/opensearch/secrets.yaml
+++ b/manifests/opensearch/secrets.yaml
@@ -1,9 +1,9 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: shared-os-admin-credentials
+  name: mastodon-os-password
  namespace: opensearch
 type: Opaque
 stringData:
-  username: admin
-  password: "OiYj2^J1@1HuHSOk"
+  password: "2&ey0J8c1pHbu%kP"
+
--- a/manifests/opensearch/user.yaml
+++ b/manifests/opensearch/user.yaml
@@ -0,0 +1,40 @@
+apiVersion: opensearch.org/v1
+kind: OpensearchUser
+metadata:
+  name: mastodon
+  namespace: opensearch
+spec:
+  opensearchCluster:
+    name: shared-os
+  passwordFrom:
+    name: mastodon-os-password
+    key: password
+---
+apiVersion: opensearch.org/v1
+kind: OpensearchRole
+metadata:
+  name: mastodon
+  namespace: opensearch
+spec:
+  opensearchCluster:
+    name: shared-os
+  clusterPermissions:
+    - cluster_monitor
+  indexPermissions:
+    - indexPatterns:
+        - "*"
+      allowedActions:
+        - indices_all
+---
+apiVersion: opensearch.org/v1
+kind: OpensearchUserRoleBinding
+metadata:
+  name: mastodon
+  namespace: opensearch
+spec:
+  opensearchCluster:
+    name: shared-os
+  users:
+    - mastodon
+  roles:
+    - mastodon