Initial commit: k8s cluster manifests and scripts

apps/codimd/manifests/00-codimd-middleware.yaml

@@ -0,0 +1,14 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: codimd-cors
+  namespace: default
+spec:
+  headers:
+    accessControlAllowMethods: ["GET", "OPTIONS", "PUT", "POST"]
+    accessControlAllowOriginList: ["*"]
+    accessControlAllowHeaders: ["*"]
+    accessControlMaxAge: 100
+    addVaryHeader: true
+    customResponseHeaders:
+      Cache-Control: "no-cache, no-store, must-revalidate"

apps/codimd/manifests/01-codimd-secrets.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: codimd-secrets
+type: Opaque
+stringData:
+  POSTGRES_PASSWORD: "8xG94tL0uKlGiBEd"
+  CMD_DB_URL: "postgres://codimd:8xG94tL0uKlGiBEd@codimd-db/codimd"

apps/codimd/manifests/02-codimd-pvc.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: codimd-db-pvc
+spec:
+  storageClassName: longhorn
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: codimd-upload-pvc
+spec:
+  storageClassName: longhorn
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 5Gi

apps/codimd/manifests/03-codimd-db-deployment.yaml

@@ -0,0 +1,38 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: codimd-db
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate # 確保 RWO 磁碟順利切換節點
+  selector:
+    matchLabels:
+      app: codimd-db
+  template:
+    metadata:
+      labels:
+        app: codimd-db
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:17-alpine
+          env:
+            - name: POSTGRES_USER
+              value: "codimd"
+            - name: POSTGRES_DB
+              value: "codimd"
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: codimd-secrets
+                  key: POSTGRES_PASSWORD
+            - name: PGDATA
+              value: "/var/lib/postgresql/data/pgdata"
+          volumeMounts:
+            - mountPath: "/var/lib/postgresql/data"
+              name: db-data
+      volumes:
+        - name: db-data
+          persistentVolumeClaim:
+            claimName: codimd-db-pvc

apps/codimd/manifests/04-codimd-db-svc.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: codimd-db
+  labels:
+    app: codimd-db
+spec:
+  selector:
+    app: codimd-db
+  ports:
+    - protocol: TCP
+      port: 5432
+      targetPort: 5432

apps/codimd/manifests/05-codimd-app-deployment.yaml

@@ -0,0 +1,43 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: codimd-app
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate 
+  selector:
+    matchLabels:
+      app: codimd
+  template:
+    metadata:
+      labels:
+        app: codimd
+    spec:
+      securityContext:      # <-- 這裡開始
+        runAsUser: 0
+        fsGroup: 0          # <-- 結束
+      containers:
+        - name: codimd
+          image: hackmdio/hackmd:latest
+          env:
+            - name: CMD_DB_URL
+              valueFrom:
+                secretKeyRef:
+                  name: codimd-secrets
+                  key: CMD_DB_URL
+            - name: CMD_USECDN
+              value: "false"
+            - name: CMD_DOMAIN
+              value: "codimd.lotimmy.com"
+            - name: CMD_PROTOCOL_USESSL
+              value: "true"
+            - name: CMD_CSP_ENABLE
+              value: "false"
+          volumeMounts:
+            - mountPath: "/home/hackmd/app/public/uploads"
+              name: upload-data
+      volumes:
+        - name: upload-data
+          persistentVolumeClaim:
+            claimName: codimd-upload-pvc

apps/codimd/manifests/06-codimd-app-svc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: codimd-service
+  labels:
+    app: codimd
+spec:
+  selector:
+    app: codimd
+  ports:
+    - protocol: TCP
+      name: http
+      port: 3000
+      targetPort: 3000

apps/codimd/manifests/07-codimd-ingress.yaml

@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: codimd-ingress
+  labels: 
+    app: codimd
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web, websecure
+    traefik.ingress.kubernetes.io/router.middlewares: default-codimd-cors@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - codimd.192.168.42.120.nip.io
+      secretName: nip-io-cert
+  rules:
+    - host: codimd.lotimmy.com
+      http: &http_rules
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: codimd-service
+                port:
+                  number: 3000
+    - host: codimd.192.168.42.120.nip.io
+      http: *http_rules