feat: add linkding

kube/clusters/biohazard/flux/kustomization.yaml

@@ -111,6 +111,7 @@ resources:
   - ../../../deploy/apps/homebox/
   - ../../../deploy/apps/vikunja/
   - ../../../deploy/apps/reactive-resume/
+  - ../../../deploy/apps/linkding/
   - ../../../deploy/vm/_kubevirt/
   #- ../../../deploy/vm/_base/
   - ../../../deploy/vm/ad/

kube/deploy/apps/linkding/app/es.yaml

@@ -0,0 +1,19 @@
+---
+# yaml-language-server: $schema=https://crds.jank.ing/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name linkding-secrets
+  namespace: linkding
+spec:
+  refreshInterval: 1m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: 1p
+  dataFrom:
+    - extract:
+        key: "linkding - ${CLUSTER_NAME}"
+  target:
+    creationPolicy: Owner
+    deletionPolicy: Retain
+    name: *name

kube/deploy/apps/linkding/app/hr.yaml

@@ -0,0 +1,143 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+  name: &app linkding
+  namespace: *app
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: "2.6.0"
+      sourceRef:
+        name: bjw-s
+        kind: HelmRepository
+        namespace: flux-system
+  values:
+    controllers:
+      main:
+        type: deployment
+        replicas: 1
+        pod:
+          labels:
+            ingress.home.arpa/nginx-internal: "allow"
+            db.home.arpa/pg: "pg-home"
+            authentik.home.arpa/https: "allow"
+            # egress.home.arpa/internet: "allow"
+        containers:
+          main:
+            image: &img
+              repository: "docker.io/sissbruecker/linkding"
+              tag: "1.25.0@sha256:32ec417b6ddb92ca20ff71a07c524b68ad2853e99258acfae1d3cef2de03f3cc"
+            env:
+              TZ: "${CONFIG_TZ}"
+              LD_ENABLE_OIDC: "true"
+              LD_CSRF_TRUSTED_ORIGINS: "https://${APP_DNS_LINKDING}"
+              LD_SERVER_PORT: &http "8080"
+              LD_LOG_X_FORWARDED_FOR: "true"
+              LD_FAVICON_PROVIDER: "https://icons.duckduckgo.com/ip3/{domain}.ico"
+              LD_DB_ENGINE: "postgres"
+              LD_DB_OPTIONS: |-
+                {"sslmode": "require"}
+              LD_DB_HOST:
+                valueFrom:
+                  secretKeyRef:
+                    name: "pg-home-pguser-linkding"
+                    key: "pgbouncer-host"
+              LD_DB_PORT:
+                valueFrom:
+                  secretKeyRef:
+                    name: "pg-home-pguser-linkding"
+                    key: "pgbouncer-port"
+              LD_DB_DATABASE:
+                valueFrom:
+                  secretKeyRef:
+                    name: "pg-home-pguser-linkding"
+                    key: "dbname"
+              LD_DB_USER:
+                valueFrom:
+                  secretKeyRef:
+                    name: "pg-home-pguser-linkding"
+                    key: "user"
+              LD_DB_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: "pg-home-pguser-linkding"
+                    key: "password"
+            envFrom:
+              - secretRef:
+                  name: "linkding-secrets"
+            securityContext: &sc
+              readOnlyRootFilesystem: true
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop: ["ALL"]
+            resources:
+              requests:
+                cpu: "10m"
+                memory: "128Mi"
+              limits:
+                cpu: "3000m"
+                memory: "1Gi"
+    service:
+      main:
+        ports:
+          http:
+            port: *http
+    ingress:
+      main:
+        enabled: true
+        primary: true
+        className: "nginx-internal"
+        hosts:
+          - host: &host "${APP_DNS_LINKDING}"
+            paths: &paths
+              - path: /
+                pathType: Prefix
+                service:
+                  name: main
+                  port: http
+        tls:
+          - hosts: [*host]
+    persistence:
+      config:
+        enabled: false
+      tmp:
+        enabled: true
+        type: emptyDir
+        medium: Memory
+        globalMounts:
+          - subPath: "data"
+            path: "/etc/linkding/data"
+            readOnly: false
+          - subPath: "tmp"
+            path: "/tmp"
+            readOnly: false
+    defaultPodOptions:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      hostAliases:
+        - ip: "${APP_IP_AUTHENTIK}"
+          hostnames: ["${APP_DNS_AUTHENTIK}"]
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: &uid ${APP_UID_LINKDING}
+        runAsGroup: *uid
+        fsGroup: *uid
+        fsGroupChangePolicy: "Always"
+        seccompProfile: { type: "RuntimeDefault" }
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: "kubernetes.io/hostname"
+          whenUnsatisfiable: "DoNotSchedule"
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: *app
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: "fuckoff.home.arpa/linkding"
+                    operator: "DoesNotExist"

kube/deploy/apps/linkding/ks.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: linkding-app
+  namespace: flux-system
+  labels: &l
+    app.kubernetes.io/name: "linkding"
+spec:
+  commonMetadata:
+    labels: *l
+  path: ./kube/deploy/apps/linkding/app
+  targetNamespace: "linkding"
+  dependsOn:
+    - name: linkding-db
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: linkding-db
+  namespace: flux-system
+  labels: &l
+    prune.flux.home.arpa/enabled: "true"
+    db.home.arpa/pg: "pg-home"
+    app.kubernetes.io/name: "linkding"
+spec:
+  commonMetadata:
+    labels: *l
+  path: ./kube/deploy/core/db/pg/clusters/template/pguser
+  targetNamespace: "pg"
+  dependsOn:
+    - name: 1-core-db-pg-clusters-home
+    - name: 1-core-secrets-es-k8s
+  postBuild:
+    substitute:
+      PG_NAME: "home"
+      PG_DB_USER: &app "linkding"
+      PG_APP_NS: *app

kube/deploy/apps/linkding/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ns.yaml
+  - ks.yaml

kube/deploy/apps/linkding/ns.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: linkding
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+    pod-security.kubernetes.io/enforce: &ps restricted
+    pod-security.kubernetes.io/audit: *ps
+    pod-security.kubernetes.io/warn: *ps

kube/deploy/core/db/pg/clusters/home/ks.yaml

@@ -45,6 +45,8 @@ spec:
               databases: ["kanboard"]
             - name: "reactive-resume"
               databases: ["reactive-resume"]
+            - name: "linkding"
+              databases: ["linkding"]
           patroni:
             dynamicConfiguration:
               synchronous_mode: true