radicale

2026-07-20 18:27:54 +03:00
parent 75db76b185
commit 5b36590c04
11 changed files with 182 additions and 18 deletions
@@ -0,0 +1,44 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: radicale-config
+  namespace: radicale
+data:
+  # storage.hook (the git-commit-per-change hook in the old compose setup)
+  # called out to a webhooks sidecar that isn't part of this deployment yet,
+  # so it's dropped here rather than pointing at a script that doesn't exist.
+  config: |
+    [server]
+    hosts = 0.0.0.0:5232
+    ssl = False
+
+    [auth]
+    type = htpasswd
+    htpasswd_filename = /config/users
+    htpasswd_encryption = bcrypt
+
+    [rights]
+    type = owner_only
+    # file = /config/rights
+
+    [storage]
+    type = multifilesystem
+    filesystem_folder = /data/collections
+
+    [headers]
+    Access-Control-Allow-Origin = *
+    Access-Control-Allow-Methods: GET, POST, OPTIONS, PROPFIND, PROPPATCH, REPORT, PUT, MOVE, DELETE, LOCK, UNLOCK
+    Access-Control-Allow-Headers: User-Agent, Authorization, Content-type, Depth, If-match, If-None-Match, Lock-Token, Timeout, Destination, Overwrite, Prefer, X-client, X-Requested-With
+    Access-Control-Expose-Headers: Etag, Preference-Applied
+  rights: |
+    # read access to root collection for all users
+    [all-read-root-collection]
+    user = .+
+    collection =
+    permission = r
+
+    # write access to own files for each user
+    [owner-write]
+    user: .+
+    collection: ^%(login)s(/.+)?$
+    permission: rw
@@ -0,0 +1,74 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: radicale
+  namespace: radicale
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: app-template
+  values:
+    controllers:
+      radicale:
+        containers:
+          app:
+            image:
+              repository: tomsquest/docker-radicale
+              tag: "3.7.6.0"
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: radicale
+        ports:
+          http:
+            port: 5232
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: c.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: radicale-tls
+            hosts:
+              - c.aggtaa.com
+
+    persistence:
+      config:
+        type: configMap
+        name: radicale-config
+        globalMounts:
+          - path: /config/config
+            subPath: config
+            readOnly: true
+          - path: /config/rights
+            subPath: rights
+            readOnly: true
+      users:
+        type: secret
+        name: radicale-secrets
+        globalMounts:
+          - path: /config/users
+            subPath: users
+            readOnly: true
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 1Gi
+        storageClass: longhorn
+        globalMounts:
+          - path: /data
@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: app-template
+  namespace: radicale
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - configmap.yaml
+  - helmrelease.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: radicale-secrets
+    namespace: radicale
+stringData:
+    users: ENC[AES256_GCM,data:H1oE1jDfgArBjJlrDhMOMnd3Mrc2Mc+2jFJKz6srZ4NKI8u3K8vf3JmoZFK6XA/8CTUp5Rvpd+O459Spau8XZ4M+H0MqukCEVKWiMkuSS/tNuac2vGI2PufeIz6GR1HlpUWMfrnPr3SUDnp9bE3B1djkZk7w91HJLv/+GomyDffLcQkJF3q/jA==,iv:1iRIQ5g/crLYsJ/2csPxmXkyqG5oJUONY7zWmuHZbBc=,tag:sytxP8qgs/+7S3AZo8aC1A==,type:str]
+sops:
+    age:
+        - recipient: age1nqjekn6qk8uqunyv5cl88nx9g3y8a94h5qr0u53q5dsdsmhr7g2syy6fsd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFTC9nZjd2RjJqUHlBaUwz
+            OEl4Vlhud1lVK3gwZ3RWb0s4eUNZWmFqQTBJCjFNQlpTRGNFTUpoTC9idU1nNlA1
+            UTVWaVJMY2hjMllKVEZSQUtvZGJCVGMKLS0tIEM0dGUrQWlRVzRRb1lvaTBCYjRM
+            T0MrSTJGcVk5ZFFjbStsVzM2VlNhYW8KBbevNTC/FymllcC5doSpn5xkfiOSBwMH
+            TG9dkscqQV86acTtouqexc/3UmpRwZhFqVelY4AbCs5hB0a/v0V1dg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:17:44Z"
+    mac: ENC[AES256_GCM,data:lE1WLOkSRXqetZG5260aSS7ZbhsuJaX3MxgtpyAKdycq9bm1uSv/S4GHDy7elIbNTlXPtUPwNmT+SrWskc+1hoeRdLHxknZwGr/mLHrBFXQhyvH1uKj0i5pYAFhce74HpW25TZGTue1POsC3VjAateU1qMAJly0fZuqt78PEDcU=,iv:mzw8iijCix0SFV/bjyswEZ3Xh55VvKCvjOjiLkDy0uo=,tag:dJ/j/i62/fDo7oqgxyLCxA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0