From 961a0e7e46721ddb8c904cdbaf8b71ab5e88942b Mon Sep 17 00:00:00 2001 From: admin Date: Mon, 15 Jun 2026 00:01:56 +0200 Subject: [PATCH] changed miniflux to cnpg on postgress-db --- .../homelab/apps/miniflux/cnpg-cluster.yaml | 29 ++++++++++++++ .../homelab/apps/miniflux/kustomization.yaml | 4 +- .../miniflux/minio-cnpg-credentials.sops.yaml | 30 ++++++++++++++ .../homelab/apps/miniflux/secret.sops.yaml | 31 ++++++--------- docs/cnpg-cluster-mas.yaml.old | 26 +++++++++++++ docs/cnpg-cluster-synapse.yaml.old | 26 +++++++++++++ docs/secret.sops.yaml | 39 +++++++++++++++++++ 7 files changed, 165 insertions(+), 20 deletions(-) create mode 100644 clusters/homelab/apps/miniflux/cnpg-cluster.yaml create mode 100644 clusters/homelab/apps/miniflux/minio-cnpg-credentials.sops.yaml create mode 100644 docs/cnpg-cluster-mas.yaml.old create mode 100644 docs/cnpg-cluster-synapse.yaml.old create mode 100644 docs/secret.sops.yaml diff --git a/clusters/homelab/apps/miniflux/cnpg-cluster.yaml b/clusters/homelab/apps/miniflux/cnpg-cluster.yaml new file mode 100644 index 0000000..5b58cc3 --- /dev/null +++ b/clusters/homelab/apps/miniflux/cnpg-cluster.yaml @@ -0,0 +1,29 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: miniflux-db + namespace: miniflux +spec: + instances: 3 + storage: + size: 2Gi + storageClass: longhorn + backup: + barmanObjectStore: + destinationPath: s3://cnpg-backups/miniflux + endpointURL: http://192.168.2.107:9010 + s3Credentials: + accessKeyId: + name: minio-cnpg-credentials + key: ACCESS_KEY_ID + secretAccessKey: + name: minio-cnpg-credentials + key: ACCESS_SECRET_KEY + retentionPolicy: "30d" + bootstrap: + initdb: + database: miniflux + owner: miniflux + secret: + name: miniflux-secret + key: DATABASE_PASSWORD diff --git a/clusters/homelab/apps/miniflux/kustomization.yaml b/clusters/homelab/apps/miniflux/kustomization.yaml index 2cad920..1268a32 100644 --- a/clusters/homelab/apps/miniflux/kustomization.yaml +++ b/clusters/homelab/apps/miniflux/kustomization.yaml @@ -4,5 +4,7 @@ resources: - namespace.yaml - helmrepository.yaml - secret.sops.yaml + - minio-cnpg-credentials.sops.yaml + - cnpg-cluster.yaml - helmrelease.yaml - - httproute.yaml + - httproute.yaml \ No newline at end of file diff --git a/clusters/homelab/apps/miniflux/minio-cnpg-credentials.sops.yaml b/clusters/homelab/apps/miniflux/minio-cnpg-credentials.sops.yaml new file mode 100644 index 0000000..40a93c6 --- /dev/null +++ b/clusters/homelab/apps/miniflux/minio-cnpg-credentials.sops.yaml @@ -0,0 +1,30 @@ +apiVersion: v1 +kind: Secret +metadata: + name: minio-cnpg-credentials + namespace: miniflux +stringData: + #ENC[AES256_GCM,data:xYrHpRiIconyB2DAUy0HU2MOYeNtPL7UCWXZqRWpQs+b1RpHIlfA6Vgk,iv:8YUY4l2N5prOAcGH8gJiUf9PqVwbJdWHUUOg3G3R3tE=,tag:hSJ+o1csa30VmNKoJFOyig==,type:comment] + ACCESS_KEY_ID: ENC[AES256_GCM,data:7dG7YckrDbhL43wr0Jw2hN1g/FVT,iv:eyovJjdjS6b+7tXDZFoZ+Q6SVFbv0n8jl09eB2LGaCM=,tag:gTD42bGYlxQAD6dqeh5YOQ==,type:str] + #ENC[AES256_GCM,data:0wIOC+y/yZhDMk57VbzKAwNQ3G1qSijpXyxwGR8LWkg0TuSbuKd4x6oV,iv:QezGS3AmjNYMJB0JKVgVfxowDqZhHZTnGHE9oKr0fCg=,tag:sDLN5fUTY01ND5JzUv1mfQ==,type:comment] + ACCESS_SECRET_KEY: ENC[AES256_GCM,data:0XZnU4w4ioU79B8T7yH+LLQepeK3k5hawnFR0U2Ufoqru9eGj7vf23I=,iv:dwL1QEra19Cp/QG1/JA9bCanwQwaQDg2trxLLVVrQpI=,tag:LaD5lh8iLBBD5ThNB2rDRw==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5aGErUzdOeGZmb2VnRCtN + eXdVdXNuNlpuejNMQ1ZMR2R5eWZKNnF3MWxFCis5blJPSTB2bUNCZXBOYitJVWJM + dUEvcEF1M3l3UnBNbWh4UWtQQVBvN3cKLS0tIGZJdzRBUFpITXJWTGFqODNyclU0 + c05YM0s2TCtEbU02Nmhiem83NHVnTjgKWs0HTyVFYqOO/2Jb37fdk4Fqb5VYvIon + jpNKcqbld/GL5c0V1XJfRpvG8pWBrXpHIZkJiIRGHKxbdkHFGjry1w== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-06-14T21:59:18Z" + mac: ENC[AES256_GCM,data:9OMWUd5senN4/m8SuGKMW7S5ca93Xy6DK08P2+JrQHzyn3Mf/9YE5rlbLMcrUABOcxDRlxHOK52UpX9B59UgjIIWkck1kVpVHYDg2NYSOVknng2d8RN4ZM7oV+uRQKm8bJc4UWcIDE9JCzOfVe/Z6wMTCSikkkXurgqn/1yqwhQ=,iv:34gN+4siBZDHyAMXGHwTYYc2OsBPUpow7J3LKzln3J4=,tag:nZihciLodaMPAJMSXOV6rg==,type:str] + pgp: [] + encrypted_regex: ^(data|stringData)$ + version: 3.9.4 diff --git a/clusters/homelab/apps/miniflux/secret.sops.yaml b/clusters/homelab/apps/miniflux/secret.sops.yaml index b184915..59b14c6 100644 --- a/clusters/homelab/apps/miniflux/secret.sops.yaml +++ b/clusters/homelab/apps/miniflux/secret.sops.yaml @@ -1,8 +1,3 @@ -# Encrypt with: sops -e -i clusters/homelab/apps/miniflux/secret.sops.yaml -# Decrypt with: sops -d -i clusters/homelab/apps/miniflux/secret.sops.yaml -# -# Vor dem Verschlüsseln alle Werte befüllen, dann: -# sops -e -i secret.sops.yaml apiVersion: v1 kind: Secret metadata: @@ -10,13 +5,11 @@ metadata: namespace: miniflux type: Opaque stringData: - ADMIN_USERNAME: ENC[AES256_GCM,data:woNpWag=,iv:3Vqh339AXYMNFTASe7nrf3KmLhdtuZLfBLjHvoPrerI=,tag:NuaHcOOKHbwXvKkmRr092Q==,type:str] - #ENC[AES256_GCM,data:Ti2obChg+7O52lsSQMMqpErz2RrfaxYYm8fepbKf9Q==,iv:E4KxwbNiv7GvFCJ3q+GFWr2Bz9CEl7qqEYoxE3hl1js=,tag:OqLL45ToDlWmz28a+jRW6w==,type:comment] - ADMIN_PASSWORD: ENC[AES256_GCM,data:02YttmLmFK4=,iv:sYFkjVFfACTVXLjzbBwHdWMNTWal9HfL2eWBQJEa09Q=,tag:0ZJgrsMuEewOZ9ulEF/SZA==,type:str] - #ENC[AES256_GCM,data:zXoL2YlP7e4vhChUBoWng5ygbi+CbCPXdOHn9UkciA==,iv:2KnngsZZ2DOD1J7w/xGhvqvr6IW8u+lUKLBYPtnxHLI=,tag:hsXmHOFURRubjGZt9RowfQ==,type:comment] - DATABASE_PASSWORD: ENC[AES256_GCM,data:o6wZcwVwavI=,iv:vNF1VS0oeyXzDCtCJapaPrSa3lzHggcQJuvV49zzoEU=,tag:YZPsL0zu1ab8UEuyAC/bWw==,type:str] - DATABASE_URL: ENC[AES256_GCM,data:r9W6p028Mc+rFiVNfWiO01Wsze++2ruhopUyvgAL5qHmWW+GDQ/Ry3+4Yr9+6eGz2g5LddZ3Z/fN9Mki2FllGWlcTR9vnwC4Uw==,iv:TXsTHci37QelS1KYiX0ZL/142+9HU9/E1f6bDvpjU84=,tag:c4yZ12qHclljlETV/vtHIA==,type:str] - #ENC[AES256_GCM,data:KGjPnHLv5sgJ7ywlBSFAO5co15cC1dRvMZEXn7fn8QffzhDB1YyiSBPBjcdA8UKPgb8g6PU+H/KH,iv:hhsGldHz4/4Pt0uo23KY2zTi/ggSp83bIyND9g75cs4=,tag:aUuK7wlVX8qH6fjgNCQSVQ==,type:comment] + ADMIN_USERNAME: ENC[AES256_GCM,data:JgKPGKY=,iv:3pMpb2KK3e5TLjnW6hepetFtRZV/mjiEmTV6DGd5J6Y=,tag:FHVPWXU0g+gkbJEPoxRyVw==,type:str] + #ENC[AES256_GCM,data:SjLoj8TH8MnBD3JTRD1UPoKPiBF1dSiYkz+xA8fWfQ==,iv:WKw7OaLJcAd0xNR0cje+CzS6endjgfIZXujl7ueyLLM=,tag:fddKHu+J0686cZ/J3WMz9A==,type:comment] + ADMIN_PASSWORD: ENC[AES256_GCM,data:oU+Tr3X7Uh8=,iv:VAzcNm53kVNFkn5LGzMO0aWfcPdH9RqihcrwyMKd4xs=,tag:LR/SjrIy8zE8qMOCXfoWSg==,type:str] + #ENC[AES256_GCM,data:eKjJifmqO0rsqsLu7BgfLHqF7E5o0Fh4PO5YOkl0Sw==,iv:2JZH/WRcYYRMVm12khnxsrTEBq/mVuea9xdJ9N3STh8=,tag:ewhAbZs3a5E/oUUZ4TdrTw==,type:comment] + DATABASE_PASSWORD: ENC[AES256_GCM,data:JI3ItljhR04=,iv:tXDkYmIThEYcJA7wTxnpLdYdWOzTqSdHZIHVEFNaakI=,tag:k+t09jcZxwT2N1Xg4Qqd9Q==,type:str] sops: kms: [] gcp_kms: [] @@ -26,14 +19,14 @@ sops: - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvbS9JTjltQnN1OHBRaDRr - OGRubVcwZEthc2IrbVVCaHNQV0Q5cm4xQ1djCmZ0OTZYcERvazRreU9PREpaZ0xH - QWFXOVAwVUt0ZktOcCtROStuRW9lNWMKLS0tIE90V0dqSXRtMUVYNUhtZ0x1anN1 - ZjZ4K1BqZXlncmd1cUFLb3ZoOG5GdFkKNWJbxRZ+gI/c6nm2lChS7zS+mcmyypGl - 5FdUr5kpSVsTm5EgK3DrZsrUOC83+TG4TSOQeZ/a/e6dhcxZOKJRNw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDcFpuU0xCczhLalNqcncx + KzZLcFk1TGRKRzgwMzdDZjQ3c3VoaDIvWTJNCkFiME1VZ0V5aDM4MlkyeWtJTTZm + L3JGYi9XbE5DOTMwcEw4U0ZUNTFzUVkKLS0tIGVYVDErWGxUbDFta04yKzg3RjNG + MXI0YnMxQXRkQkpGMzRwNStJR1N2cWcKIG7CiAiFoyNqkBrG3qbLAm9z211JAEuS + 9mTxhBZWxf5cv0ZjGtF3WcWbLPu1SBivY56+Ru/MHx7BX3ucz7/hlw== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-06-14T00:49:51Z" - mac: ENC[AES256_GCM,data:FViN33vsu8wWMPBQh1n8Oj0qlfGcf7QKB1MQ+ZXKY7aclY86mQCv9NweYcNAPrfs9e5G7fcNxWPCyNOCZRJkkXSK87tFVZEBq8rNAHTbGUMP3b8xpgHPZmKygUnRcTZ+1Xjh0jLQlUZApDUpc8KI3xRW6jTOAUVkO6AjJRila3A=,iv:86OMAhNQxU13s7hSrXqLNt0UjhsYN2KSoNkXL34uqUc=,tag:SWoL9kd6MmD/D5vY4iCREA==,type:str] + lastmodified: "2026-06-14T21:59:56Z" + mac: ENC[AES256_GCM,data:sXpM/tQFRqPAQ73BbENV5z9cE4TABx0yD3mFXAG5tzoJtZCNAi4vRJ4wIEQZ+CHwJnlx1MAbwesJr8woKMjryWRtn9zMtc5veDmMj6pnY2zEP3xAQrOFBqXV4UQvOzNDOzp9xBuR0WgLyEYWbnUrZ+uVtiXjvjYO7D/7z5yGvs0=,iv:ke8NSMQmbhjeVSOs5TcfT8L3n8AAsmTP6L733BNaeLA=,tag:YS8NojwgSDvr0Kqv5J+n4w==,type:str] pgp: [] encrypted_regex: ^(data|stringData)$ version: 3.9.4 diff --git a/docs/cnpg-cluster-mas.yaml.old b/docs/cnpg-cluster-mas.yaml.old new file mode 100644 index 0000000..9efbd6a --- /dev/null +++ b/docs/cnpg-cluster-mas.yaml.old @@ -0,0 +1,26 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: mas-db + namespace: synapse +spec: + instances: 3 + storage: + size: 2Gi + storageClass: longhorn + backup: + barmanObjectStore: + destinationPath: s3://cnpg-backups/mas + endpointURL: http://192.168.2.107:9010 + s3Credentials: + accessKeyId: + name: minio-cnpg-credentials + key: ACCESS_KEY_ID + secretAccessKey: + name: minio-cnpg-credentials + key: ACCESS_SECRET_KEY + retentionPolicy: "30d" + bootstrap: + initdb: + database: mas + owner: mas diff --git a/docs/cnpg-cluster-synapse.yaml.old b/docs/cnpg-cluster-synapse.yaml.old new file mode 100644 index 0000000..1e06187 --- /dev/null +++ b/docs/cnpg-cluster-synapse.yaml.old @@ -0,0 +1,26 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: synapse-db + namespace: synapse +spec: + instances: 3 + storage: + size: 5Gi + storageClass: longhorn + backup: + barmanObjectStore: + destinationPath: s3://cnpg-backups/synapse + endpointURL: http://192.168.2.107:9010 + s3Credentials: + accessKeyId: + name: minio-cnpg-credentials + key: ACCESS_KEY_ID + secretAccessKey: + name: minio-cnpg-credentials + key: ACCESS_SECRET_KEY + retentionPolicy: "30d" + bootstrap: + initdb: + database: synapse + owner: synapse diff --git a/docs/secret.sops.yaml b/docs/secret.sops.yaml new file mode 100644 index 0000000..de3766e --- /dev/null +++ b/docs/secret.sops.yaml @@ -0,0 +1,39 @@ +# Encrypt with: sops -e -i clusters/homelab/apps/miniflux/secret.sops.yaml +# Decrypt with: sops -d -i clusters/homelab/apps/miniflux/secret.sops.yaml +# +# Vor dem Verschlüsseln alle Werte befüllen, dann: +# sops -e -i secret.sops.yaml +apiVersion: v1 +kind: Secret +metadata: + name: miniflux-secret + namespace: miniflux +type: Opaque +stringData: + ADMIN_USERNAME: ENC[AES256_GCM,data:f/FgSD8=,iv:bB+GaY/1MN8aG4TCYCHAmavFozwrWQ/+0bC/LTvJhD8=,tag:NEMkgfRnoB2i/NSHJx4MGg==,type:str] + #ENC[AES256_GCM,data:Ma1jDNjpHkobl4r9/wIbsZVZqqr7Iessv3Q+UQkjxg==,iv:MJ6yKRL1Gn7VV7X1KWmRXN9yvPaIKy2CN0p5/TrVHhM=,tag:wxu3F5vdP04QSqjfCroNxg==,type:comment] + ADMIN_PASSWORD: ENC[AES256_GCM,data:Z7hoDI/Keno=,iv:I0AETeStVt5LJ9psk40jnWZPh8oiKFfezdhZL5iM9WM=,tag:USvnhlecC09Pc0ku/dhx/Q==,type:str] + #ENC[AES256_GCM,data:T7SPFoVLeSAqaFpbRFRS58rduAiLNrlS8VH3BMcFbQ==,iv:/jN8TQbRJfoJ5KJOMv9a/hJz1FUyzjShmim9geCgz3c=,tag:VDMwkIeaINRHbnhIVHEofA==,type:comment] + DATABASE_PASSWORD: ENC[AES256_GCM,data:C+mU6Wb/ms4=,iv:1ttWYChCSEBPIIFcEUuuDQvQ5GE+HqimD8yXbhlVaTI=,tag:5EE8U08A10HCrbMbO6UkXQ==,type:str] + DATABASE_URL: ENC[AES256_GCM,data:T8DQXi8F2Fo2Jb0sVE+/Mp9oqXYogRgU+ksjG9lh0rkLu5RczgUWFezAJQaae3RIZgbNpa0Mdmgfwkkj8KSH0GRWLEHSw8922w==,iv:QZ+gqCf9o6Mt037YBh70BWXxiR5279CnwwJ1daFkSMA=,tag:x7ygf+iAJ93cfsppO1UsZg==,type:str] + #ENC[AES256_GCM,data:AZlOZfM0wkF4IxH7qemubgBE4QVG2X9yE1atfI2TLb4CF8ZWbBeVpxdoLLSfufzCUhRWTjmYe1rO,iv:88tOImH0NWa3AnqVsgo7+wFsie2pY7h1Qp9if6XQhGU=,tag:bQ1QRlmxS6Q3nW3+sL7TMQ==,type:comment] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtZ3hxczlSQk5TQUNUQlBv + aTh0UE52aXlLOFFkS2xKb3RMN1BwNk1IMmprCnQvV2pJdVNPRFkrSkp5NktabjNs + cDdySTdiSysrS3IzV0dKZGhMOXUrdXcKLS0tIHVMaGE4UFdEbGlHdzdnRmVqQ0ZG + RE1JVFY4SzZnVWk3K2JOcHpwSDdySEkK5y19Pb4c0s0PNWWAQU8VQFukM5Uz19pD + MSY6AJELaCv8DniZfm3v9OHWvvOE3HKaSfV3UDbCujn6JJmJnd7Bdg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-06-14T21:55:36Z" + mac: ENC[AES256_GCM,data:BnESpyLJwxlLXa++K/zuJJuoGN/gBcvVPwjt5cNcGJUgyvwzYW9326JWQIWHzn3zX5J06oB6FzOJPbt/QpuI4IQ5U6EM6UOPC3tSzZdtTr0l2WH3Jrhm/3mqUA7dl4uFr6QdAjaYL0Jmsozb4T5rTelGbe+Bjpj8JhGh3ljcF2o=,iv:yiHHmjDxAtn3SgPoDenCoInQOQKQgW6NCnjtYGmboKU=,tag:OlBzltHcDgJHRpcdOYKfqA==,type:str] + pgp: [] + encrypted_regex: ^(data|stringData)$ + version: 3.9.4