cmd/mi: use kustomize

Signed-off-by: Xe Iaso <me@xeiaso.net>

12 files changed, 212 insertions, 230 deletions

diff --git a/cmd/mi/manifest.yaml b/cmd/mi/manifest.yaml
deleted file mode 100644
index 948881f..0000000
--- a/cmd/mi/manifest.yaml
+++ /dev/null
@@ -1,229 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: mi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: mi
-  namespace: mi
-  labels:
-    app.kubernetes.io/name: mi
-    recurring-job-group.longhorn.io/backup: enabled
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 2Gi
----
-apiVersion: onepassword.com/v1
-kind: OnePasswordItem
-metadata:
-  name: mi-bluesky
-  namespace: mi
-spec:
-  itemPath: "vaults/Kubernetes/items/Bluesky xeiaso.net"
----
-apiVersion: onepassword.com/v1
-kind: OnePasswordItem
-metadata:
-  name: mi-mastodon
-  namespace: mi
-spec:
-  itemPath: "vaults/Kubernetes/items/@cadey@pony.social token"
----
-apiVersion: onepassword.com/v1
-kind: OnePasswordItem
-metadata:
-  name: mi-irc
-  namespace: mi
-spec:
-  itemPath: "vaults/Kubernetes/items/IRC [Mara]"
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mi
-  namespace: mi
-  labels:
-    app.kubernetes.io/name: mi
-  annotations:
-    operator.1password.io/auto-restart: "true"
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: mi
-  template:
-    metadata:
-      namespace: mi
-      labels:
-        app.kubernetes.io/name: mi
-    spec:
-      volumes:
-        - name: vol
-          persistentVolumeClaim:
-            claimName: mi
-        - name: bluesky
-          secret:
-            secretName: mi-bluesky
-        - name: irc
-          secret:
-            secretName: mi-irc
-        - name: mastodon
-          secret:
-            secretName: mi-mastodon
-      securityContext:
-        fsGroup: 1000
-      containers:
-        - name: main
-          image: ghcr.io/xe/x/mi:latest
-          imagePullPolicy: "Always"
-          resources:
-            limits:
-              cpu: "500m"
-              memory: "1024Mi"
-            requests:
-              cpu: "100m"
-              memory: "512Mi"
-          securityContext:
-            runAsUser: 1000
-            runAsGroup: 1000
-            runAsNonRoot: true
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            seccompProfile:
-              type: RuntimeDefault
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: 8080
-              httpHeaders:
-                - name: X-Kubernetes
-                  value: "is kinda okay"
-            initialDelaySeconds: 3
-            periodSeconds: 3
-          env:
-            - name: BIND
-              value: ":8080"
-            - name: DB_LOC
-              value: "/data/mi.db"
-            - name: INTERNAL_BIND
-              value: ":9195"
-          volumeMounts:
-            - name: vol
-              mountPath: "/data"
-            - name: bluesky
-              readOnly: true
-              mountPath: "/run/secrets/bluesky"
-            - name: irc
-              readOnly: true
-              mountPath: "/run/secrets/irc"
-            - name: mastodon
-              readOnly: true
-              mountPath: "/run/secrets/mastodon"
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: mi
-  namespace: mi
-  labels:
-    app.kubernetes.io/name: mi
-spec:
-  selector:
-    app.kubernetes.io/name: mi
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 8080
-      name: http
-    - protocol: TCP
-      port: 9195
-      targetPort: 9195
-      name: metrics
-  type: ClusterIP
----
-apiVersion: onepassword.com/v1
-kind: OnePasswordItem
-metadata:
-  name: public-http-auth
-  namespace: mi
-  labels:
-    app.kubernetes.io/name: mi
-spec:
-  itemPath: "vaults/lc5zo4zjz3if3mkeuhufjmgmui/items/4ytaobocixjfaoje7rhrtidg4m"
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: mi-public
-  namespace: mi
-  labels:
-    app.kubernetes.io/name: mi
-  annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    nginx.ingress.kubernetes.io/auth-type: basic
-    nginx.ingress.kubernetes.io/auth-secret: public-http-auth
-    nginx.ingress.kubernetes.io/auth-realm: "Authentication Required"
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-    - hosts:
-      - mi.cetacean.club
-      secretName: mi-public-tls
-  rules:
-  - host: mi.cetacean.club
-    http:
-      paths:
-      - pathType: Prefix
-        path: "/"
-        backend:
-          service:
-            name: mi
-            port: 
-              name: http
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: mi-front-public
-  namespace: mi
-  labels:
-    app.kubernetes.io/name: mi
-  annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    nginx.ingress.kubernetes.io/custom-headers: "mi-front-public-headers"
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-    - hosts:
-      - home.cetacean.club
-      secretName: home-cetacean-club-tls
-  rules:
-  - host: home.cetacean.club
-    http:
-      paths:
-      - pathType: Prefix
-        path: "/front"
-        backend:
-          service:
-            name: mi
-            port: 
-              name: http
----
-apiVersion: v1
-data:
-  Server: "within.website/x/cmd/mi + within.website/x/cmd/ingressd"
-kind: ConfigMap
-metadata:
-  name: mi-front-public-headers
-  namespace: mi
diff --git a/cmd/mi/manifest/1password.yaml b/cmd/mi/manifest/1password.yaml
new file mode 100644
index 0000000..2650935
--- /dev/null
+++ b/cmd/mi/manifest/1password.yaml
@@ -0,0 +1,26 @@
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: mi-bluesky
+  labels:
+    app.kubernetes.io/name: mi
+spec:
+  itemPath: "vaults/Kubernetes/items/Bluesky xeiaso.net"
+---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: mi-mastodon
+  labels:
+    app.kubernetes.io/name: mi
+spec:
+  itemPath: "vaults/Kubernetes/items/@cadey@pony.social token"
+---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: mi-irc
+  labels:
+    app.kubernetes.io/name: mi
+spec:
+  itemPath: "vaults/Kubernetes/items/IRC [Mara]"
diff --git a/cmd/mi/manifest/deployment.yaml b/cmd/mi/manifest/deployment.yaml
new file mode 100644
index 0000000..c0ba452
--- /dev/null
+++ b/cmd/mi/manifest/deployment.yaml
@@ -0,0 +1,74 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mi
+  annotations:
+    operator.1password.io/auto-restart: "true"
+spec:
+  replicas: 1
+  template:
+    spec:
+      volumes:
+        - name: vol
+          persistentVolumeClaim:
+            claimName: mi
+        - name: bluesky
+          secret:
+            secretName: mi-bluesky
+        - name: irc
+          secret:
+            secretName: mi-irc
+        - name: mastodon
+          secret:
+            secretName: mi-mastodon
+      securityContext:
+        fsGroup: 1000
+      containers:
+        - name: main
+          image: ghcr.io/xe/x/mi:latest
+          imagePullPolicy: "Always"
+          resources:
+            limits:
+              cpu: "500m"
+              memory: "1024Mi"
+            requests:
+              cpu: "100m"
+              memory: "512Mi"
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+              httpHeaders:
+                - name: X-Kubernetes
+                  value: "is kinda okay"
+            initialDelaySeconds: 3
+            periodSeconds: 3
+          env:
+            - name: BIND
+              value: ":8080"
+            - name: DB_LOC
+              value: "/data/mi.db"
+            - name: INTERNAL_BIND
+              value: ":9195"
+          volumeMounts:
+            - name: vol
+              mountPath: "/data"
+            - name: bluesky
+              readOnly: true
+              mountPath: "/run/secrets/bluesky"
+            - name: irc
+              readOnly: true
+              mountPath: "/run/secrets/irc"
+            - name: mastodon
+              readOnly: true
+              mountPath: "/run/secrets/mastodon"
diff --git a/cmd/mi/manifest/kustomization.yaml b/cmd/mi/manifest/kustomization.yaml
new file mode 100644
index 0000000..271463a
--- /dev/null
+++ b/cmd/mi/manifest/kustomization.yaml
@@ -0,0 +1,11 @@
+resources:
+  - namespace.yaml
+  - pvc.yaml
+  - 1password.yaml
+  - deployment.yaml
+  - service.yaml
+  - public-api-ingress.yaml
+  - public-front-ingress.yaml
+namespace: mi
+commonLabels:
+  app.kubernetes.io/name: mi
diff --git a/cmd/mi/manifest/namespace.yaml b/cmd/mi/manifest/namespace.yaml
new file mode 100644
index 0000000..6d7fb97
--- /dev/null
+++ b/cmd/mi/manifest/namespace.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mi
+  labels:
+    app.kubernetes.io/name: mi
diff --git a/cmd/mi/manifest/public-api-ingress.yaml b/cmd/mi/manifest/public-api-ingress.yaml
new file mode 100644
index 0000000..2c5b60a
--- /dev/null
+++ b/cmd/mi/manifest/public-api-ingress.yaml
@@ -0,0 +1,34 @@
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: public-http-auth
+spec:
+  itemPath: "vaults/lc5zo4zjz3if3mkeuhufjmgmui/items/4ytaobocixjfaoje7rhrtidg4m"
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: mi-public
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    nginx.ingress.kubernetes.io/auth-type: basic
+    nginx.ingress.kubernetes.io/auth-secret: public-http-auth
+    nginx.ingress.kubernetes.io/auth-realm: "Authentication Required"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+      - mi.cetacean.club
+      secretName: mi-public-tls
+  rules:
+  - host: mi.cetacean.club
+    http:
+      paths:
+      - pathType: Prefix
+        path: "/"
+        backend:
+          service:
+            name: mi
+            port: 
+              name: http
diff --git a/cmd/mi/manifest/public-front-ingress.yaml b/cmd/mi/manifest/public-front-ingress.yaml
new file mode 100644
index 0000000..28b7fb3
--- /dev/null
+++ b/cmd/mi/manifest/public-front-ingress.yaml
@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: mi-front-public
+  namespace: mi
+  labels:
+    app.kubernetes.io/name: mi
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+      - home.cetacean.club
+      secretName: home-cetacean-club-tls
+  rules:
+  - host: home.cetacean.club
+    http:
+      paths:
+      - pathType: Prefix
+        path: "/front"
+        backend:
+          service:
+            name: mi
+            port: 
+              name: http
diff --git a/cmd/mi/manifest/pvc.yaml b/cmd/mi/manifest/pvc.yaml
new file mode 100644
index 0000000..1cfb13a
--- /dev/null
+++ b/cmd/mi/manifest/pvc.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mi
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 2Gi
diff --git a/cmd/mi/manifest/service.yaml b/cmd/mi/manifest/service.yaml
new file mode 100644
index 0000000..42aecb2
--- /dev/null
+++ b/cmd/mi/manifest/service.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mi
+spec:
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 8080
+      name: http
+    - protocol: TCP
+      port: 9195
+      targetPort: 9195
+      name: metrics
+  type: ClusterIP
diff --git a/cmd/mi/yeetfile.js b/cmd/mi/yeetfile.js
index 6711e04..6c118b7 100644
--- a/cmd/mi/yeetfile.js
+++ b/cmd/mi/yeetfile.js
@@ -1,5 +1,5 @@
 nix.build(".#docker.mi");
 docker.load("./result");
 docker.push(`ghcr.io/xe/x/mi`);
-yeet.run("kubectl", "apply", "-f=manifest.yaml");
+yeet.run("kubectl", "apply", "-k=manifest");
 yeet.run("sh", "-c", "kubectl rollout restart -n mi deployments/mi");
diff --git a/cmd/mimi/manifest/irc-1password.yaml b/cmd/mimi/manifest/irc-1password.yaml
new file mode 100644
index 0000000..26c9fb8
--- /dev/null
+++ b/cmd/mimi/manifest/irc-1password.yaml
@@ -0,0 +1,6 @@
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: irc
+spec:
+  itemPath: vaults/Kubernetes/items/IRC [Mara]
diff --git a/cmd/mimi/manifest/kustomization.yaml b/cmd/mimi/manifest/kustomization.yaml
index d0c1736..cf39140 100644
--- a/cmd/mimi/manifest/kustomization.yaml
+++ b/cmd/mimi/manifest/kustomization.yaml
@@ -1,6 +1,7 @@
 resources:
   - namespace.yaml
   - inference-proxy.yaml
+  - irc-1password.yaml
   - mimi-1password.yaml
   - deployment.yaml
   - service.yaml