joplin

.sops.yaml

@@ -29,3 +29,6 @@ creation_rules:
   - path_regex: s3-backup-proxy.*\.enc\.yaml$
     encrypted_regex: ^(data|stringData)$
     age: age15vc3geq4lsec69rnxczluvwgcexeqae02zxzjpswsuatthaasu7qzath48
+  - path_regex: joplin.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1dertyl956fjsmh00cw468gdnl7lf3frasg4n4c82z0chm6qm2cks6w8gha

clusters/base/apps/joplin/helmrelease-joplin.yaml

@@ -0,0 +1,83 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: joplin
+  namespace: pim
+spec:
+  interval: 10m
+  dependsOn:
+    - name: joplin-postgres
+  chartRef:
+    kind: OCIRepository
+    name: joplin
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        # temporarily disabled - see joplin-postgres HelmRelease; the app
+        # must not connect until the migrated database data is in place.
+        replicas: 0
+        containers:
+          app:
+            image:
+              repository: joplin/server
+              # verified via Docker Hub API (hub.docker.com/v2/repositories/
+              # joplin/server/tags): "3.7.1" and "latest" were pushed at the
+              # same timestamp, i.e. this is what "latest" (the original
+              # compose.yaml's tag) currently resolves to.
+              tag: "3.7.1"
+            env:
+              APP_PORT: "22300"
+              APP_BASE_URL: https://notes.aggtaa.com
+              DB_CLIENT: pg
+              POSTGRES_DATABASE: joplin
+              POSTGRES_USER: joplin
+              POSTGRES_HOST: joplin-postgres
+              POSTGRES_PORT: "5432"
+              POSTGRES_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: joplin-secrets
+                    key: POSTGRES_PASSWORD
+            probes:
+              startup:
+                enabled: true
+                spec:
+                  periodSeconds: 5
+                  failureThreshold: 60
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 50m
+                memory: 128Mi
+              limits:
+                memory: 1Gi
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 22300
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: notes.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: joplin-tls
+            hosts:
+              - notes.aggtaa.com

clusters/base/apps/joplin/helmrelease-postgres.yaml

@@ -0,0 +1,53 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: joplin-postgres
+  namespace: pim
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: joplin
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      postgres:
+        containers:
+          app:
+            image:
+              repository: postgres
+              # not alpine: the original docker instance ran the glibc-based
+              # postgres:16 image (Debian). Its on-disk cluster was initdb'd
+              # under glibc collation; reading it back with the musl-based
+              # alpine image risks silent index corruption from differing
+              # text collation order between the two libcs.
+              # TODO: pin exact minor version once running (check via
+              # `SELECT version();` or the resolved imageID) - original
+              # compose.yaml only pinned the major version "16".
+              tag: "16"
+            env:
+              TZ: Europe/Moscow
+              POSTGRES_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: joplin-secrets
+                    key: POSTGRES_PASSWORD
+
+    service:
+      app:
+        controller: postgres
+        ports:
+          postgres:
+            port: 5432
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 20Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /var/lib/postgresql/data
+            subPath: data

clusters/base/apps/joplin/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: joplin
+  namespace: pim
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/joplin/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease-postgres.yaml
+  - helmrelease-joplin.yaml

clusters/base/apps/joplin/secret.enc.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: joplin-secrets
+    namespace: pim
+stringData:
+    POSTGRES_PASSWORD: ENC[AES256_GCM,data:cI3zfdaJUbo2344RuLIG4DjPsgx4Afl6GKMJVHrOHOg=,iv:8QliTSQ44ScVUchDxh0DF/wU9bTLK9Jq4ojxSMXsNC8=,tag:VB2mf4uhLnRnafWg0mRRpg==,type:str]
+sops:
+    age:
+        - recipient: age1dertyl956fjsmh00cw468gdnl7lf3frasg4n4c82z0chm6qm2cks6w8gha
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFQ2JKZWxseVAxUWU5NlhL
+            S0xWQUh1NFpBU2ZpQkJXbkg4TlZ2cTR5TXhjCjlMTGdGMEF4UzBEbS9wdndJb1VE
+            OXBOanpJS1lpTFVhWm52K2xhaGx2M00KLS0tIGF5b3FZOWRNVWNpenRmUDVOT3Vp
+            aHpCbXkvdXM3SjYxWTlsT0cxU2RDOFkKximxt9bmd6FZAtU/SBirzDH3NMitQKrZ
+            PfwicphmFEXVN+HtD9vwRbP4TMa1swOMbOVINGKuA8YZwEk1GyPe4w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-27T10:16:36Z"
+    mac: ENC[AES256_GCM,data:85dGV8WPFqd+4l6k7PLqDROm5+kwiAjO80ElNKfSJFOgeI9y7DyhyhDklcBJXMJljatbEfAmCFFqnoyRGmeIjc6FBfteUGQtpLgI6e8RTlRHPvaRzqDwA1OhnlQbAW9TTf5vha6tyYso/PprCWjJSMjBEfiu7ApiRMdZcLd1V4c=,iv:Dh9z/r7UbhdREwXT787HkmVM04X/BAtQmQteN3j7AKU=,tag:oUMYT5CL85PAYfItf5TIdw==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/home/apps/joplin.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: joplin
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/apps/joplin
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+    - name: infra
+  retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age-joplin

clusters/home/apps/kustomization.yaml

@@ -15,3 +15,4 @@ resources:
   - infcloud.yaml
   - syncthing.yaml
   - immich.yaml
+  - joplin.yaml