From 5b36590c045e84990b9aa3cbe5f9882852fc408d Mon Sep 17 00:00:00 2001 From: "azykov@mail.ru" Date: Mon, 20 Jul 2026 18:27:54 +0300 Subject: [PATCH] radicale --- .gitignore | 3 +- clusters/base/apps/radicale/configmap.yaml | 44 +++++++++++ clusters/base/apps/radicale/helmrelease.yaml | 74 +++++++++++++++++++ .../base/apps/radicale/helmrepository.yaml | 10 +++ .../base/apps/radicale/kustomization.yaml | 7 ++ clusters/base/apps/radicale/secret.enc.yaml | 22 ++++++ .../base/apps/vaultwarden/secret.enc.yaml | 18 ++--- .../base/apps/zigbee2mqtt/secret.enc.yaml | 16 ++-- clusters/base/namespaces/radicale.yaml | 4 + clusters/home/apps/kustomization.yaml | 1 + clusters/home/namespaces/kustomization.yaml | 1 + 11 files changed, 182 insertions(+), 18 deletions(-) create mode 100644 clusters/base/apps/radicale/configmap.yaml create mode 100644 clusters/base/apps/radicale/helmrelease.yaml create mode 100644 clusters/base/apps/radicale/helmrepository.yaml create mode 100644 clusters/base/apps/radicale/kustomization.yaml create mode 100644 clusters/base/apps/radicale/secret.enc.yaml create mode 100644 clusters/base/namespaces/radicale.yaml diff --git a/.gitignore b/.gitignore index 1a098d1..0425b73 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ -migration-from-old-files/ \ No newline at end of file +migration-from-old-files/ +migration-from-docker/ \ No newline at end of file diff --git a/clusters/base/apps/radicale/configmap.yaml b/clusters/base/apps/radicale/configmap.yaml new file mode 100644 index 0000000..b5672c7 --- /dev/null +++ b/clusters/base/apps/radicale/configmap.yaml @@ -0,0 +1,44 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: radicale-config + namespace: radicale +data: + # storage.hook (the git-commit-per-change hook in the old compose setup) + # called out to a webhooks sidecar that isn't part of this deployment yet, + # so it's dropped here rather than pointing at a script that doesn't exist. + config: | + [server] + hosts = 0.0.0.0:5232 + ssl = False + + [auth] + type = htpasswd + htpasswd_filename = /config/users + htpasswd_encryption = bcrypt + + [rights] + type = owner_only + # file = /config/rights + + [storage] + type = multifilesystem + filesystem_folder = /data/collections + + [headers] + Access-Control-Allow-Origin = * + Access-Control-Allow-Methods: GET, POST, OPTIONS, PROPFIND, PROPPATCH, REPORT, PUT, MOVE, DELETE, LOCK, UNLOCK + Access-Control-Allow-Headers: User-Agent, Authorization, Content-type, Depth, If-match, If-None-Match, Lock-Token, Timeout, Destination, Overwrite, Prefer, X-client, X-Requested-With + Access-Control-Expose-Headers: Etag, Preference-Applied + rights: | + # read access to root collection for all users + [all-read-root-collection] + user = .+ + collection = + permission = r + + # write access to own files for each user + [owner-write] + user: .+ + collection: ^%(login)s(/.+)?$ + permission: rw diff --git a/clusters/base/apps/radicale/helmrelease.yaml b/clusters/base/apps/radicale/helmrelease.yaml new file mode 100644 index 0000000..bdadb19 --- /dev/null +++ b/clusters/base/apps/radicale/helmrelease.yaml @@ -0,0 +1,74 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: radicale + namespace: radicale +spec: + interval: 30m + chartRef: + kind: OCIRepository + name: app-template + values: + controllers: + radicale: + containers: + app: + image: + repository: tomsquest/docker-radicale + tag: "3.7.6.0" + probes: + liveness: + enabled: true + readiness: + enabled: true + + service: + app: + controller: radicale + ports: + http: + port: 5232 + + ingress: + app: + className: traefik + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod + hosts: + - host: c.aggtaa.com + paths: + - path: / + pathType: Prefix + service: + identifier: app + port: http + tls: + - secretName: radicale-tls + hosts: + - c.aggtaa.com + + persistence: + config: + type: configMap + name: radicale-config + globalMounts: + - path: /config/config + subPath: config + readOnly: true + - path: /config/rights + subPath: rights + readOnly: true + users: + type: secret + name: radicale-secrets + globalMounts: + - path: /config/users + subPath: users + readOnly: true + data: + type: persistentVolumeClaim + accessMode: ReadWriteOnce + size: 1Gi + storageClass: longhorn + globalMounts: + - path: /data diff --git a/clusters/base/apps/radicale/helmrepository.yaml b/clusters/base/apps/radicale/helmrepository.yaml new file mode 100644 index 0000000..f692354 --- /dev/null +++ b/clusters/base/apps/radicale/helmrepository.yaml @@ -0,0 +1,10 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: OCIRepository +metadata: + name: app-template + namespace: radicale +spec: + interval: 1h + url: oci://ghcr.io/bjw-s-labs/helm/app-template + ref: + tag: "5.0.1" diff --git a/clusters/base/apps/radicale/kustomization.yaml b/clusters/base/apps/radicale/kustomization.yaml new file mode 100644 index 0000000..e99a21d --- /dev/null +++ b/clusters/base/apps/radicale/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helmrepository.yaml + - secret.enc.yaml + - configmap.yaml + - helmrelease.yaml diff --git a/clusters/base/apps/radicale/secret.enc.yaml b/clusters/base/apps/radicale/secret.enc.yaml new file mode 100644 index 0000000..feb8a6b --- /dev/null +++ b/clusters/base/apps/radicale/secret.enc.yaml @@ -0,0 +1,22 @@ +apiVersion: v1 +kind: Secret +metadata: + name: radicale-secrets + namespace: radicale +stringData: + users: ENC[AES256_GCM,data:H1oE1jDfgArBjJlrDhMOMnd3Mrc2Mc+2jFJKz6srZ4NKI8u3K8vf3JmoZFK6XA/8CTUp5Rvpd+O459Spau8XZ4M+H0MqukCEVKWiMkuSS/tNuac2vGI2PufeIz6GR1HlpUWMfrnPr3SUDnp9bE3B1djkZk7w91HJLv/+GomyDffLcQkJF3q/jA==,iv:1iRIQ5g/crLYsJ/2csPxmXkyqG5oJUONY7zWmuHZbBc=,tag:sytxP8qgs/+7S3AZo8aC1A==,type:str] +sops: + age: + - recipient: age1nqjekn6qk8uqunyv5cl88nx9g3y8a94h5qr0u53q5dsdsmhr7g2syy6fsd + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFTC9nZjd2RjJqUHlBaUwz + OEl4Vlhud1lVK3gwZ3RWb0s4eUNZWmFqQTBJCjFNQlpTRGNFTUpoTC9idU1nNlA1 + UTVWaVJMY2hjMllKVEZSQUtvZGJCVGMKLS0tIEM0dGUrQWlRVzRRb1lvaTBCYjRM + T0MrSTJGcVk5ZFFjbStsVzM2VlNhYW8KBbevNTC/FymllcC5doSpn5xkfiOSBwMH + TG9dkscqQV86acTtouqexc/3UmpRwZhFqVelY4AbCs5hB0a/v0V1dg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-08-26T10:17:44Z" + mac: ENC[AES256_GCM,data:lE1WLOkSRXqetZG5260aSS7ZbhsuJaX3MxgtpyAKdycq9bm1uSv/S4GHDy7elIbNTlXPtUPwNmT+SrWskc+1hoeRdLHxknZwGr/mLHrBFXQhyvH1uKj0i5pYAFhce74HpW25TZGTue1POsC3VjAateU1qMAJly0fZuqt78PEDcU=,iv:mzw8iijCix0SFV/bjyswEZ3Xh55VvKCvjOjiLkDy0uo=,tag:dJ/j/i62/fDo7oqgxyLCxA==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.11.0 diff --git a/clusters/base/apps/vaultwarden/secret.enc.yaml b/clusters/base/apps/vaultwarden/secret.enc.yaml index ada9b73..2a90fe7 100644 --- a/clusters/base/apps/vaultwarden/secret.enc.yaml +++ b/clusters/base/apps/vaultwarden/secret.enc.yaml @@ -4,20 +4,20 @@ metadata: name: vaultwarden-secrets namespace: vaultwarden stringData: - #ENC[AES256_GCM,data:ZSi9ncwQt1hF89l00We38ZVpj6aZSdLM1Y0p8nFeKk/fpwvZ9EHP+eZsC1sqzU0eM14TVFZMY0/s,iv:HDHYINHS11OCEBYggNrHbYVydk8uR1We1Na/q8oCS30=,tag:s09J6DNSX97/YvJaKpdasA==,type:comment] - ADMIN_TOKEN: ENC[AES256_GCM,data:qAoDEzwuADkdgydaberlQ9G6Vfnl5xG0Ff1ERn4F5HK6okP0x5o7bAnbEhRJ5aJfPE/x0+POVT0EQU9REYA0jYyZtRS8Ntszb/NiIH39uaRRzkZ4wrcHQR8aMIcWp81j4NnUp7iGL7j01H58dIY4ABmNSoV7lA==,iv:B2izY/vJqtqXpAUeyZPBBIH8nKhWeiv9c52gyMM1wvY=,tag:bJE43ntkkDv3l1alBjuhwA==,type:str] + #ENC[AES256_GCM,data:AffIDcVKgZnTtLbbqx2PFZriPuccC//Lmy+PSx0VNQY1OLAwdE7ESFI1qlSx82PsDlUhCM0b7j/L,iv:OS26G7ChoAeM7xzjeK/oLg2pfMRnFFQi81otUPZq1vM=,tag:8L2tA86nGFR718l3KainTw==,type:comment] + ADMIN_TOKEN: ENC[AES256_GCM,data:zEXMwyWmiLXyuAqc3hFkWwBwuXtiiNWi36hlTQgvr3U+TCiJEJIiUPHK4ry8NHS4wZKlJJWZ41vlPyuP/Jr+8beFXlk4oZbPhRvNa/DTk2N1eKUd/ykLPyMkmwa2t119S12OIHqoQkfSkZ0X6VX3e91XqelYLA==,iv:xxoOP4qOrQKG6RfVY0ZelGoY63+oUlTr/V9XoHQykAs=,tag:0cNu4mGVnz9dBZgYoBCa9w==,type:str] sops: age: - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBETG1pVE50Q0JPMVdEdGhz - NmZzdGRDNkNpUUdNSld1ZjdvK0ZKSm96VzJ3ClpldzFxMWpoa3FmODF0amQ4Nkpq - Mit2dENsSGZmaHBsemEwc0I3VzdZYVEKLS0tIGsvRjRCZWQ0WkU2WVROQ2Z0bThj - eVplbElrRjFXV240MytFM3JxZldxYXMKaTSYz4rprKWo8gIyNAIBmrS0QOkL4NCZ - sMo4kzEI6J6fI9uHwBtYQ5xk70EZw/XGo9JWeGxriZ1CduJqW9J7kQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYZmVvbHp2MkcyVlJZQmZB + N0k2Rk9lak9PYVVudldJcGc2ZmhkaTl4NDFzCnVWSlRYc04zWHVkbUc1aVhjdnYw + YmorczRsYjdybFg5Y3RpUnV0Y2NKdTgKLS0tIGMxUXFkd0hMandMcFFPQktlOEVD + YWRyZVM3NGdrb2YwNGRyNUR4SFlMZGsK228mMCi6+cgQu4JEnRjJqcuIrpTPTq5Y + xHlyFMwo73UMQg5pzGok2yfi3ObhCD0GNtWeTHBu56SsDDaUJXPG6A== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-08-26T10:17:41Z" - mac: ENC[AES256_GCM,data:jw0L50e5SL/geTLLM0X53Coaxte2/cG481bsK79UZGzV8MnpXm1XkXa8gXN+8P4X5N4stFoVFMM537IAiI23yNVvp5pzfzqBAgZgvHyJn1bwJA/Rv9Gehf1unrQX32xXpNPO13D8S04kGfCansLoIrfoYVrhKnxp6K8drBl9zq4=,iv:Xyc+LWHXnbxsZMPiISw3mc6dyTaO+YO3FFnWh5wYRFo=,tag:y5YSLUswbo6jl06B0f6ZzA==,type:str] + lastmodified: "2026-08-26T10:17:45Z" + mac: ENC[AES256_GCM,data:hKPS2DWW4w8m4s7BWuUUjJKBsvRqHp6lp7qPeDmRyVOW44EqX+pusLDpvkBNAeAcwpz/2FvuPw8vkTc+z4EhGtqUy2k3pbwsC7cKJ6DyM/3kvdtoDrh+yerKUQymgYVW0PhMLjAWeCD//Ja5auhoPJ6O59QAH58xT3eHd/f5cSc=,iv:uC5F+y76Hh8HM7+EzML3G9ACLMREkHcpFEBSfOjMT54=,tag:8edRfJi/JQPAWqZdEAUeqg==,type:str] encrypted_regex: ^(data|stringData)$ version: 3.11.0 diff --git a/clusters/base/apps/zigbee2mqtt/secret.enc.yaml b/clusters/base/apps/zigbee2mqtt/secret.enc.yaml index a797edb..65b2611 100644 --- a/clusters/base/apps/zigbee2mqtt/secret.enc.yaml +++ b/clusters/base/apps/zigbee2mqtt/secret.enc.yaml @@ -4,19 +4,19 @@ metadata: name: zigbee2mqtt-secrets namespace: zigbee2mqtt stringData: - secret.yaml: ENC[AES256_GCM,data:x9YutASbHeMTPsm9wTaxuOMNzvvAJIhKwUYkS3s7rTpYgqVsMVtVLjDtbxW8V9iTOkdL2GhqpXHkuIPY77TFJ+IwB6dm321v1JjUonc48BQv/Qfqq9vNJdxnzZeQwd0RiD4Irdk38ZxUxxja+3MVKOfmGC9XGuzsoU+lFpI=,iv:SxoJzEwvpIC4DgEIuo1x7kAl7NBvb/gjBVeVThlI7KA=,tag:bXyEc9HBuHycRtfm2huoJQ==,type:str] + secret.yaml: ENC[AES256_GCM,data:8WWBEvJf1wO/f7hZYC1oL1kNdJ2cScytgL4OyYv1MM3r3JY5ctiyQi3BTTGMPlSeAkZ+K0wR6gj8v4s6+++TWzxkrRE1rv4WrVstxE0xPYg+qg4ZavwjsQ+g/QbXKSRbfYnBuva9gm/gsN2E286wS6JMiNlRiqWPtRYIqQE=,iv:/Ux9xf1cCKxvrh1h+kD5iEv4vTnYzkVuJ4BrMgU427c=,tag:7KcNdy5fpi/VzI11bh2DwA==,type:str] sops: age: - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5eXVjTVpUWGg5RUxRNUpS - OEg5eWVCSzYzenQvNGpDb3hpRHV0MGlQVndZCmVPZGU0NndJdDMrblc0MDhyUUlC - dG1OdzBPZ3Y0ci9TZ0dxMksxZUFZeUkKLS0tIGttMUt3d3Y1b2pyb3JEL2RvMGlN - amxpQkVkWW5Lay9XZ3NJcjQrbVlyVkEKG9hRHgo9WBbJELiEZ1rQ653LNgbm/jz5 - NqCt+kNx3oGoRFMibEsuqRV4MYNNL/epv+RPpg56LxghY0jQ6rFKjg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4cEdha2JyYXRrZlFRZlgw + RERhTVBVVjJYYURoaDFZMFJacVZJSFNwVlFnCkcydHRkRlQyMDlPR0wraDZCTnpp + cit3em5FYklnWFA5QXUyNEZlZkVvMGsKLS0tIEVLVFA1d0Z4dnoxWlpDMzd6MklH + TCtFMG8vdFg1cFlrbTFITFdQc0RTTm8K7Okh3TGaLLua7GpqAEMMvk2S6IKrMIGs + XcmPGAHvLEkgDy+TOUp5LKYxhhu2C9zoO/mYvseYeqECKzqtuzX3fA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-08-26T10:17:42Z" - mac: ENC[AES256_GCM,data:Ehu/yxV7LfmZoMoY1xD6NUi/53goQOk3d+FYEBnii+TZKJNzpm5ftSiuuKPjT7K4CQnQuZQd5whOT7UuzFiaDiRRloN4b0RXgS0I6oHKUE0CoBjtJL3oo091+PrMACoo4c4XHkePpE6vCg3hWbiy58z3MMM2kGvJA584+GznaL0=,iv:7cGMgW2fP8M3lqhMKHHhmivWN84iAhGMtvopBD2Ico4=,tag:9keLGJ/LtOKlh3iyEk6FpQ==,type:str] + lastmodified: "2026-08-26T10:17:45Z" + mac: ENC[AES256_GCM,data:8wLKvXRK/oC0YY6/+28m8scESchRQEduzjwz+t/diOLJFYqCK+Vn0iPyW8bog48Pnpk8TUoSoHg50D5D1DWzuLtDgvFSzk3UBljwnwgd4wmQe8vplAxTR9XALCxNaeGeR+x3DtrmAlK0ogAi0eMfaHVPsKGRbcQ1iO1GeDYUIUA=,iv:ve7apVK94QhszfZ+5cid0L+g+oCj0lbmSBMnypzPb+g=,tag:e1TE8oLYiUHqh032pdE9Gw==,type:str] encrypted_regex: ^(data|stringData)$ version: 3.11.0 diff --git a/clusters/base/namespaces/radicale.yaml b/clusters/base/namespaces/radicale.yaml new file mode 100644 index 0000000..899b712 --- /dev/null +++ b/clusters/base/namespaces/radicale.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: radicale diff --git a/clusters/home/apps/kustomization.yaml b/clusters/home/apps/kustomization.yaml index 648c908..bd48e79 100644 --- a/clusters/home/apps/kustomization.yaml +++ b/clusters/home/apps/kustomization.yaml @@ -3,3 +3,4 @@ kind: Kustomization resources: - ../../base/apps/vaultwarden - ../../base/apps/zigbee2mqtt + - ../../base/apps/radicale diff --git a/clusters/home/namespaces/kustomization.yaml b/clusters/home/namespaces/kustomization.yaml index 9ee8217..f8d230e 100644 --- a/clusters/home/namespaces/kustomization.yaml +++ b/clusters/home/namespaces/kustomization.yaml @@ -3,3 +3,4 @@ kind: Kustomization resources: - ../../base/namespaces/vaultwarden.yaml - ../../base/namespaces/zigbee2mqtt.yaml + - ../../base/namespaces/radicale.yaml