niks3: Add nix binary cache

2026-06-09 13:27:27 +02:00
parent 5df05acd46
commit 2aed9ead11
17 changed files with 227 additions and 326 deletions
@@ -0,0 +1,2 @@
+niks3:
+  enabled: true
@@ -0,0 +1,3 @@
+niks3:
+  enabled: false
+  autosync: false
@@ -0,0 +1,14 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: niks3-db
+  namespace: niks3
+  labels:
+    app: niks3-db
+spec:
+  instances: 1
+  primaryUpdateStrategy: unsupervised
+  backup:
+    retentionPolicy: "7d"
+  storage:
+    size: "20Gi"
@@ -0,0 +1,73 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: niks3
+spec:
+  selector:
+    matchLabels:
+      app: niks3
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: niks3
+    spec:
+      containers:
+        - name: niks3
+          image: ghcr.io/mic92/niks3:v1.6.1
+          ports:
+            - name: http
+              containerPort: 5751
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+          env:
+            - name: NIKS3_DB
+              valueFrom:
+                secretKeyRef:
+                  name: niks3-db-app
+                  key: uri
+            - name: NIKS3_API_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: server
+                  key: api-token
+            - name: NIKS3_S3_ENDPOINT
+              value: "10.255.241.30:30080"
+            - name: NIKS3_S3_BUCKET
+              value: "niks3"
+            - name: NIKS3_S3_REGION
+              value: "default"
+            - name: NIKS3_S3_USE_SSL
+              value: "false"
+            - name: NIKS3_S3_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: server
+                  key: s3-access-key
+            - name: NIKS3_S3_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: server
+                  key: s3-secret-key
+            - name: NIKS3_ENABLE_READ_PROXY
+              value: "true"
+            - name: NIKS3_CACHE_URL
+              value: "https://cache.ekman.oceanbox.io"
+            - name: NIKS3_SIGN_KEY_PATHS
+              value: "/secrets/sign-key"
+          volumeMounts:
+            - name: server
+              mountPath: /secrets
+              readOnly: true
+      volumes:
+        - name: server
+          secret:
+            secretName: server
@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    oceanbox.io/expose: internal
+  labels:
+    app.kubernetes.io/component: niks3
+  name: niks3
+  namespace: niks3
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: cache.ekman.oceanbox.io
+    http:
+      paths:
+      - backend:
+          service:
+            name: niks3
+            port:
+              name: http
+        path: /
+        pathType: Prefix
+  tls:
+  - hosts:
+    - cache.ekman.oceanbox.io
+    secretName: cache.ekman.oceanbox.io-tls
@@ -0,0 +1,42 @@
+{{- if .Values.clusterConfig.argo.enabled }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: niks3
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: niks3
+    server: https://kubernetes.default.svc
+  project: aux
+  sources:
+  - repoURL: {{ .Values.clusterConfig.manifests }}
+    targetRevision: HEAD
+    path: helmfile.d
+    plugin:
+      name: helmfile-cmp
+      env:
+      - name: CLUSTER_NAME
+        value: {{ .Values.clusterConfig.cluster }}
+      - name: HELMFILE_ENVIRONMENT
+        value: default
+      - name: HELMFILE_FILE_PATH
+        value: niks3.yaml.gotmpl
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        component: aux
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      # - ServerSideApply=true
+    {{- if .Values.niks3.autosync }}
+    automated:
+      prune: true
+      # selfHeal: false
+    {{- end }}
+{{- end }}
@@ -0,0 +1,47 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-egress
+  namespace: niks3
+spec:
+  # ekman has no cluster-wide allow-namespace-traffic baseline (unlike hel1/oceanbox),
+  # so once niks3 is selected by an egress rule it is default-deny for egress and every
+  # destination must be listed explicitly: RGW (S3), in-namespace PostgreSQL, and DNS.
+  description: niks3 egress to Ceph RGW (S3), in-namespace PostgreSQL, and kube-dns
+  endpointSelector:
+    matchLabels:
+      app: niks3
+  egress:
+    # Ceph RadosGW (S3 object storage backend) via NodePort
+    - toCIDR:
+        - 10.255.241.30/32
+        - 10.255.241.31/32
+        - 10.255.241.32/32
+      toPorts:
+        - ports:
+            - port: "30080"
+              protocol: TCP
+    # PostgreSQL (CNPG niks3-db cluster, same namespace)
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: niks3
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+    # DNS resolution
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+{{- end }}
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: niks3
+  labels:
+    app: niks3
+spec:
+  type: ClusterIP
+  selector:
+    app: niks3
+  ports:
+    - name: http
+      port: 5751
+      targetPort: http