diff --git a/clusters/base/apps/immich/helmrelease-server.yaml b/clusters/base/apps/immich/helmrelease-server.yaml index 7a87d2e..b94fac0 100644 --- a/clusters/base/apps/immich/helmrelease-server.yaml +++ b/clusters/base/apps/immich/helmrelease-server.yaml @@ -34,8 +34,7 @@ spec: # already there. Running it as a restartPolicy:Always init # container (started, gated on the startupProbe below, before # regular containers) guarantees that ordering; a regular sidecar - # container racing "app" on every pod start does not. Same - # pattern as clusters/base/apps/nfs-photo. + # container racing "app" on every pod start does not. mergerfs: dependsOn: - fix-permissions diff --git a/clusters/base/apps/nfs-photo/configmap.yaml b/clusters/base/apps/nfs-photo/configmap.yaml deleted file mode 100644 index ca23170..0000000 --- a/clusters/base/apps/nfs-photo/configmap.yaml +++ /dev/null @@ -1,95 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: nfs-photo-config - namespace: nfs -data: - ganesha.conf: | - NFS_Core_Param { - NFS_Port = 2049; - Protocols = NFSv4; - Fsid_Device = true; - } - - NFSV4 { - RecoveryBackend = fs_ng; - RecoveryRoot = /recovery; - Lease_Lifetime = 40; - Grace_Period = 50; - } - - VFS { - Link_Support = true; - Symlink_Support = true; - CanSetTime = true; - umask = 0000; - } - - EXPORT { - Export_Id = 1; - - Path = /export; - Pseudo = /export; - - SecType = sys; - Protocols = NFSv4; - - FSAL { - Name = VFS; - } - - CLIENT { - Clients = *; - Access_Type = RW; - Squash = No_Root_Squash; - Protocols = NFSv4; - } - } - - # individual disks, exported alongside the merged /export view so - # clients (webdav) can also see each underlying disk on its own. - EXPORT { - Export_Id = 2; - - Path = /disks/base; - Pseudo = /base; - - SecType = sys; - Protocols = NFSv4; - - FSAL { - Name = VFS; - } - - CLIENT { - Clients = *; - Access_Type = RW; - Squash = No_Root_Squash; - Protocols = NFSv4; - } - } - - EXPORT { - Export_Id = 3; - - Path = /disks/sub1; - Pseudo = /sub1; - - SecType = sys; - Protocols = NFSv4; - - FSAL { - Name = VFS; - } - - CLIENT { - Clients = *; - Access_Type = RW; - Squash = No_Root_Squash; - Protocols = NFSv4; - } - } - - LOG { - Default_Log_Level = INFO; - } diff --git a/clusters/base/apps/nfs-photo/helmrelease.yaml b/clusters/base/apps/nfs-photo/helmrelease.yaml deleted file mode 100644 index 3d7025e..0000000 --- a/clusters/base/apps/nfs-photo/helmrelease.yaml +++ /dev/null @@ -1,240 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: nfs-photo - namespace: nfs -spec: - interval: 30m - chartRef: - kind: OCIRepository - name: nfs-photo - driftDetection: - mode: enabled - values: - controllers: - app: - strategy: Recreate - podDisruptionBudget: - maxUnavailable: "0" - initContainers: - fix-permissions: - image: - repository: hectorm/nfs-ganesha - tag: v10 - command: - - sh - - -c - - chmod -R a+rwX /disks/base /disks/sub1 - # native sidecar (restartPolicy: Always): mounts the two disks and - # exposes their union at /disks/merged via FUSE. It must be up and - # actually mounted *before* the "app" container is created, since - # HostToContainer propagation only relays mounts made *after* the - # receiving container's own mount exists - it won't retroactively - # pick up a FUSE mount that's already there. Running it as a - # restartPolicy:Always init container (started, gated on the - # startupProbe below, before regular containers) guarantees that - # ordering; a regular sidecar container racing "app" on every pod - # start does not. - mergerfs: - dependsOn: - - fix-permissions - restartPolicy: Always - image: - repository: ghcr.io/hotio/mergerfs - tag: release-v2.42.0 - args: - - "-o" - # category.search=newest (not ff): getattr on the merged root - # dir has to report one branch's attrs, and with ff that's - # always the first branch (base) regardless of which branch - # actually changed. NFS-Ganesha's directory cache relies on - # that mtime to know when to re-fetch a stale readdir listing - # - with ff, writes to any branch but the first never bump the - # merged root's reported mtime, so Ganesha keeps serving a - # stale listing to NFS clients (confirmed: mergerfs's own - # readdir is always a correct live union - this is purely a - # getattr/mtime-propagation issue up through the NFS cache). - - "allow_other,use_ino,func.create=ff,category.action=all,category.create=ff,category.search=newest" - - "/disks/base:/disks/sub1" - - "/disks/merged" - securityContext: - privileged: true - probes: - startup: - enabled: true - custom: true - spec: - exec: - command: - - sh - - -c - - grep -q fuse.mergerfs /proc/mounts - periodSeconds: 1 - timeoutSeconds: 2 - failureThreshold: 30 - resources: - requests: - cpu: 50m - memory: 64Mi - limits: - memory: 512Mi - # runs after mergerfs is confirmed mounted (see dependsOn) and has - # /export, /disks/base and /disks/sub1 all mounted too, so the - # /proc/self/mounts snapshot it takes covers every path ganesha - # exports. ganesha's FSAL_VFS resolves each EXPORT's Path against - # this frozen /etc/mtab, not the live /proc/mounts - any exported - # path missing from it (e.g. this ran before mergerfs, or without - # that path mounted here at all) fails at startup with - # "resolve_posix_filesystem() ... No such file or directory" - # even though the path is mounted fine in every other container. - mtab-setup: - dependsOn: - - mergerfs - image: - repository: hectorm/nfs-ganesha - tag: v10 - command: - - sh - - -c - - cat /proc/self/mounts > /mtab-vol/mtab - containers: - app: - image: - repository: hectorm/nfs-ganesha - tag: v10 - securityContext: - readOnlyRootFilesystem: true - capabilities: - drop: - - ALL - add: - - CHOWN - - DAC_OVERRIDE - - DAC_READ_SEARCH - - FOWNER - - FSETID - - SETGID - - SETUID - - SYS_RESOURCE - probes: - liveness: - enabled: true - spec: - initialDelaySeconds: 2 - periodSeconds: 10 - timeoutSeconds: 2 - failureThreshold: 3 - readiness: - enabled: true - spec: - initialDelaySeconds: 1 - periodSeconds: 2 - timeoutSeconds: 1 - failureThreshold: 2 - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - memory: 512Mi - - service: - app: - controller: app - # cluster-internal only. pinned (not DNS name): webdav's PV mounts - # this over NFS via the kubelet's in-tree kernel NFS client, which - # runs in the node's host network namespace and can't reliably - # resolve/route Kubernetes Service DNS names - it needs a stable IP - # it can reach directly. - type: ClusterIP - clusterIP: 10.43.166.34 - ports: - nfs: - port: 2049 - protocol: TCP - - persistence: - config: - type: configMap - name: nfs-photo-config - globalMounts: - - path: /etc/ganesha/ganesha.conf - subPath: ganesha.conf - readOnly: true - base: - type: persistentVolumeClaim - accessMode: ReadWriteOnce - size: 100Gi - storageClass: longhorn-single-replica - retain: true - advancedMounts: - app: - mergerfs: - - path: /disks/base - fix-permissions: - - path: /disks/base - # exported directly as its own NFS share (Pseudo=/base, see - # configmap.yaml) alongside the merged /export view. - app: - - path: /disks/base - mtab-setup: - - path: /disks/base - sub1: - type: persistentVolumeClaim - accessMode: ReadWriteOnce - size: 100Gi - storageClass: longhorn-single-replica - retain: true - advancedMounts: - app: - mergerfs: - - path: /disks/sub1 - fix-permissions: - - path: /disks/sub1 - # exported directly as its own NFS share (Pseudo=/sub1, see - # configmap.yaml) alongside the merged /export view. - app: - - path: /disks/sub1 - mtab-setup: - - path: /disks/sub1 - merged: - type: emptyDir - advancedMounts: - app: - mergerfs: - - path: /disks/merged - mountPropagation: Bidirectional - app: - - path: /export - mountPropagation: HostToContainer - mtab-setup: - - path: /export - mountPropagation: HostToContainer - dev-fuse: - type: hostPath - hostPath: /dev/fuse - advancedMounts: - app: - mergerfs: - - path: /dev/fuse - run: - type: emptyDir - globalMounts: - - path: /run - tmp: - type: emptyDir - globalMounts: - - path: /tmp - recovery: - type: emptyDir - globalMounts: - - path: /recovery - etc-mtab: - type: emptyDir - advancedMounts: - app: - app: - - path: /etc/mtab - subPath: mtab - mtab-setup: - - path: /mtab-vol diff --git a/clusters/base/apps/nfs-photo/helmrepository.yaml b/clusters/base/apps/nfs-photo/helmrepository.yaml deleted file mode 100644 index 7df387a..0000000 --- a/clusters/base/apps/nfs-photo/helmrepository.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: source.toolkit.fluxcd.io/v1 -kind: OCIRepository -metadata: - name: nfs-photo - namespace: nfs -spec: - interval: 1h - url: oci://ghcr.io/bjw-s-labs/helm/app-template - ref: - tag: "5.0.1" diff --git a/clusters/base/apps/nfs-photo/kustomization.yaml b/clusters/base/apps/nfs-photo/kustomization.yaml deleted file mode 100644 index eea457f..0000000 --- a/clusters/base/apps/nfs-photo/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - helmrepository.yaml - - configmap.yaml - - helmrelease.yaml diff --git a/clusters/base/apps/webdav/helmrelease.yaml b/clusters/base/apps/webdav/helmrelease.yaml index 0db73e2..de1a244 100644 --- a/clusters/base/apps/webdav/helmrelease.yaml +++ b/clusters/base/apps/webdav/helmrelease.yaml @@ -90,21 +90,6 @@ spec: existingClaim: ganesha-export globalMounts: - path: /webdav/export - photo: - type: persistentVolumeClaim - existingClaim: nfs-photo-export - globalMounts: - - path: /webdav/photo/library - photo-base: - type: persistentVolumeClaim - existingClaim: nfs-photo-base - globalMounts: - - path: /webdav/photo/library-base - photo-sub1: - type: persistentVolumeClaim - existingClaim: nfs-photo-sub1 - globalMounts: - - path: /webdav/photo/library-sub1 sda2: type: persistentVolumeClaim existingClaim: nas1-sda2 diff --git a/clusters/base/apps/webdav/pv-pvc-data.yaml b/clusters/base/apps/webdav/pv-pvc-data.yaml index 56d540a..bf298df 100644 --- a/clusters/base/apps/webdav/pv-pvc-data.yaml +++ b/clusters/base/apps/webdav/pv-pvc-data.yaml @@ -36,118 +36,6 @@ spec: --- apiVersion: v1 kind: PersistentVolume -metadata: - name: nfs-photo-export-nfs -spec: - capacity: - storage: 200Gi - accessModes: - - ReadWriteMany - persistentVolumeReclaimPolicy: Retain - storageClassName: "" - mountOptions: - - nfsvers=4.1 - nfs: - # pinned ClusterIP, not the service DNS name - kubelet's in-tree kernel - # NFS client runs in the node's host network namespace and can't - # reliably resolve/route Kubernetes Service DNS names. See nfs-photo's - # helmrelease.yaml (service.app.clusterIP) for the matching pin. - server: 10.43.166.34 - path: /export - claimRef: - namespace: webdav - name: nfs-photo-export ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: nfs-photo-export - namespace: webdav - annotations: - helm.sh/resource-policy: keep -spec: - accessModes: - - ReadWriteMany - storageClassName: "" - volumeName: nfs-photo-export-nfs - resources: - requests: - storage: 200Gi ---- -apiVersion: v1 -kind: PersistentVolume -metadata: - name: nfs-photo-base-nfs -spec: - capacity: - storage: 100Gi - accessModes: - - ReadWriteMany - persistentVolumeReclaimPolicy: Retain - storageClassName: "" - mountOptions: - - nfsvers=4.1 - nfs: - server: 10.43.166.34 - path: /base - claimRef: - namespace: webdav - name: nfs-photo-base ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: nfs-photo-base - namespace: webdav - annotations: - helm.sh/resource-policy: keep -spec: - accessModes: - - ReadWriteMany - storageClassName: "" - volumeName: nfs-photo-base-nfs - resources: - requests: - storage: 100Gi ---- -apiVersion: v1 -kind: PersistentVolume -metadata: - name: nfs-photo-sub1-nfs -spec: - capacity: - storage: 100Gi - accessModes: - - ReadWriteMany - persistentVolumeReclaimPolicy: Retain - storageClassName: "" - mountOptions: - - nfsvers=4.1 - nfs: - server: 10.43.166.34 - path: /sub1 - claimRef: - namespace: webdav - name: nfs-photo-sub1 ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: nfs-photo-sub1 - namespace: webdav - annotations: - helm.sh/resource-policy: keep -spec: - accessModes: - - ReadWriteMany - storageClassName: "" - volumeName: nfs-photo-sub1-nfs - resources: - requests: - storage: 100Gi ---- -apiVersion: v1 -kind: PersistentVolume metadata: name: nas1-sda2-nfs spec: diff --git a/clusters/home/apps/kustomization.yaml b/clusters/home/apps/kustomization.yaml index e33f142..414d745 100644 --- a/clusters/home/apps/kustomization.yaml +++ b/clusters/home/apps/kustomization.yaml @@ -14,6 +14,5 @@ resources: - fava.yaml - infcloud.yaml - syncthing.yaml - - nfs-photo.yaml - photo-stats.yaml - immich.yaml \ No newline at end of file diff --git a/clusters/home/apps/nfs-photo.yaml b/clusters/home/apps/nfs-photo.yaml deleted file mode 100644 index 890a480..0000000 --- a/clusters/home/apps/nfs-photo.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: nfs-photo - namespace: flux-system -spec: - interval: 10m - sourceRef: - kind: GitRepository - name: flux-system - path: ./clusters/base/apps/nfs-photo - prune: true - wait: true - dependsOn: - - name: namespaces - - name: infra - retryInterval: 5s diff --git a/clusters/home/apps/webdav.yaml b/clusters/home/apps/webdav.yaml index 6a6c6cf..cbf073a 100644 --- a/clusters/home/apps/webdav.yaml +++ b/clusters/home/apps/webdav.yaml @@ -14,7 +14,6 @@ spec: dependsOn: - name: namespaces - name: nfs-ganesha - - name: nfs-photo retryInterval: 5s decryption: provider: sops