From 489439d3305912bfc19980518e00b7dfdd25c8c2 Mon Sep 17 00:00:00 2001 From: "azykov@mail.ru" Date: Thu, 27 Aug 2026 19:37:51 +0300 Subject: [PATCH] joplin --- .sops.yaml | 3 + .../base/apps/joplin/helmrelease-joplin.yaml | 83 +++++++++++++++++++ .../apps/joplin/helmrelease-postgres.yaml | 53 ++++++++++++ clusters/base/apps/joplin/helmrepository.yaml | 10 +++ clusters/base/apps/joplin/kustomization.yaml | 7 ++ clusters/base/apps/joplin/secret.enc.yaml | 22 +++++ clusters/home/apps/joplin.yaml | 21 +++++ clusters/home/apps/kustomization.yaml | 3 +- 8 files changed, 201 insertions(+), 1 deletion(-) create mode 100644 clusters/base/apps/joplin/helmrelease-joplin.yaml create mode 100644 clusters/base/apps/joplin/helmrelease-postgres.yaml create mode 100644 clusters/base/apps/joplin/helmrepository.yaml create mode 100644 clusters/base/apps/joplin/kustomization.yaml create mode 100644 clusters/base/apps/joplin/secret.enc.yaml create mode 100644 clusters/home/apps/joplin.yaml diff --git a/.sops.yaml b/.sops.yaml index ea651f6..1059dcd 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -29,3 +29,6 @@ creation_rules: - path_regex: s3-backup-proxy.*\.enc\.yaml$ encrypted_regex: ^(data|stringData)$ age: age15vc3geq4lsec69rnxczluvwgcexeqae02zxzjpswsuatthaasu7qzath48 + - path_regex: joplin.*\.enc\.yaml$ + encrypted_regex: ^(data|stringData)$ + age: age1dertyl956fjsmh00cw468gdnl7lf3frasg4n4c82z0chm6qm2cks6w8gha diff --git a/clusters/base/apps/joplin/helmrelease-joplin.yaml b/clusters/base/apps/joplin/helmrelease-joplin.yaml new file mode 100644 index 0000000..70c2fe4 --- /dev/null +++ b/clusters/base/apps/joplin/helmrelease-joplin.yaml @@ -0,0 +1,83 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: joplin + namespace: pim +spec: + interval: 10m + dependsOn: + - name: joplin-postgres + chartRef: + kind: OCIRepository + name: joplin + driftDetection: + mode: enabled + values: + controllers: + app: + # temporarily disabled - see joplin-postgres HelmRelease; the app + # must not connect until the migrated database data is in place. + replicas: 0 + containers: + app: + image: + repository: joplin/server + # verified via Docker Hub API (hub.docker.com/v2/repositories/ + # joplin/server/tags): "3.7.1" and "latest" were pushed at the + # same timestamp, i.e. this is what "latest" (the original + # compose.yaml's tag) currently resolves to. + tag: "3.7.1" + env: + APP_PORT: "22300" + APP_BASE_URL: https://notes.aggtaa.com + DB_CLIENT: pg + POSTGRES_DATABASE: joplin + POSTGRES_USER: joplin + POSTGRES_HOST: joplin-postgres + POSTGRES_PORT: "5432" + POSTGRES_PASSWORD: + valueFrom: + secretKeyRef: + name: joplin-secrets + key: POSTGRES_PASSWORD + probes: + startup: + enabled: true + spec: + periodSeconds: 5 + failureThreshold: 60 + liveness: + enabled: true + readiness: + enabled: true + resources: + requests: + cpu: 50m + memory: 128Mi + limits: + memory: 1Gi + + service: + app: + controller: app + ports: + http: + port: 22300 + + ingress: + app: + className: traefik + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod + hosts: + - host: notes.aggtaa.com + paths: + - path: / + pathType: Prefix + service: + identifier: app + port: http + tls: + - secretName: joplin-tls + hosts: + - notes.aggtaa.com diff --git a/clusters/base/apps/joplin/helmrelease-postgres.yaml b/clusters/base/apps/joplin/helmrelease-postgres.yaml new file mode 100644 index 0000000..3174baf --- /dev/null +++ b/clusters/base/apps/joplin/helmrelease-postgres.yaml @@ -0,0 +1,53 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: joplin-postgres + namespace: pim +spec: + interval: 10m + chartRef: + kind: OCIRepository + name: joplin + driftDetection: + mode: enabled + values: + controllers: + postgres: + containers: + app: + image: + repository: postgres + # not alpine: the original docker instance ran the glibc-based + # postgres:16 image (Debian). Its on-disk cluster was initdb'd + # under glibc collation; reading it back with the musl-based + # alpine image risks silent index corruption from differing + # text collation order between the two libcs. + # TODO: pin exact minor version once running (check via + # `SELECT version();` or the resolved imageID) - original + # compose.yaml only pinned the major version "16". + tag: "16" + env: + TZ: Europe/Moscow + POSTGRES_PASSWORD: + valueFrom: + secretKeyRef: + name: joplin-secrets + key: POSTGRES_PASSWORD + + service: + app: + controller: postgres + ports: + postgres: + port: 5432 + + persistence: + data: + type: persistentVolumeClaim + accessMode: ReadWriteOnce + size: 20Gi + storageClass: longhorn + retain: true + globalMounts: + - path: /var/lib/postgresql/data + subPath: data diff --git a/clusters/base/apps/joplin/helmrepository.yaml b/clusters/base/apps/joplin/helmrepository.yaml new file mode 100644 index 0000000..a440629 --- /dev/null +++ b/clusters/base/apps/joplin/helmrepository.yaml @@ -0,0 +1,10 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: OCIRepository +metadata: + name: joplin + namespace: pim +spec: + interval: 10m + url: oci://ghcr.io/bjw-s-labs/helm/app-template + ref: + tag: "5.0.1" diff --git a/clusters/base/apps/joplin/kustomization.yaml b/clusters/base/apps/joplin/kustomization.yaml new file mode 100644 index 0000000..f183626 --- /dev/null +++ b/clusters/base/apps/joplin/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helmrepository.yaml + - secret.enc.yaml + - helmrelease-postgres.yaml + - helmrelease-joplin.yaml diff --git a/clusters/base/apps/joplin/secret.enc.yaml b/clusters/base/apps/joplin/secret.enc.yaml new file mode 100644 index 0000000..a022391 --- /dev/null +++ b/clusters/base/apps/joplin/secret.enc.yaml @@ -0,0 +1,22 @@ +apiVersion: v1 +kind: Secret +metadata: + name: joplin-secrets + namespace: pim +stringData: + POSTGRES_PASSWORD: ENC[AES256_GCM,data:cI3zfdaJUbo2344RuLIG4DjPsgx4Afl6GKMJVHrOHOg=,iv:8QliTSQ44ScVUchDxh0DF/wU9bTLK9Jq4ojxSMXsNC8=,tag:VB2mf4uhLnRnafWg0mRRpg==,type:str] +sops: + age: + - recipient: age1dertyl956fjsmh00cw468gdnl7lf3frasg4n4c82z0chm6qm2cks6w8gha + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFQ2JKZWxseVAxUWU5NlhL + S0xWQUh1NFpBU2ZpQkJXbkg4TlZ2cTR5TXhjCjlMTGdGMEF4UzBEbS9wdndJb1VE + OXBOanpJS1lpTFVhWm52K2xhaGx2M00KLS0tIGF5b3FZOWRNVWNpenRmUDVOT3Vp + aHpCbXkvdXM3SjYxWTlsT0cxU2RDOFkKximxt9bmd6FZAtU/SBirzDH3NMitQKrZ + PfwicphmFEXVN+HtD9vwRbP4TMa1swOMbOVINGKuA8YZwEk1GyPe4w== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-08-27T10:16:36Z" + mac: ENC[AES256_GCM,data:85dGV8WPFqd+4l6k7PLqDROm5+kwiAjO80ElNKfSJFOgeI9y7DyhyhDklcBJXMJljatbEfAmCFFqnoyRGmeIjc6FBfteUGQtpLgI6e8RTlRHPvaRzqDwA1OhnlQbAW9TTf5vha6tyYso/PprCWjJSMjBEfiu7ApiRMdZcLd1V4c=,iv:Dh9z/r7UbhdREwXT787HkmVM04X/BAtQmQteN3j7AKU=,tag:oUMYT5CL85PAYfItf5TIdw==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.11.0 diff --git a/clusters/home/apps/joplin.yaml b/clusters/home/apps/joplin.yaml new file mode 100644 index 0000000..4c8b1f0 --- /dev/null +++ b/clusters/home/apps/joplin.yaml @@ -0,0 +1,21 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: joplin + namespace: flux-system +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: flux-system + path: ./clusters/base/apps/joplin + prune: true + wait: true + dependsOn: + - name: namespaces + - name: infra + retryInterval: 5s + decryption: + provider: sops + secretRef: + name: sops-age-joplin diff --git a/clusters/home/apps/kustomization.yaml b/clusters/home/apps/kustomization.yaml index 836f72a..90758ea 100644 --- a/clusters/home/apps/kustomization.yaml +++ b/clusters/home/apps/kustomization.yaml @@ -14,4 +14,5 @@ resources: - fava.yaml - infcloud.yaml - syncthing.yaml - - immich.yaml \ No newline at end of file + - immich.yaml + - joplin.yaml \ No newline at end of file