Story Crater Bot
89f01b6f2e
Adds permissions claim + per-service admin groups in Authentik, scoped Role/RoleBinding per service, public PKCE kubernetes OAuth2 client, and kube-apiserver OIDC extraArgs. Also fixes paperless OIDC signup permissions via adapter override and adds CoreDNS rewrite for authentik.riotpiao.com.
104 lines
3.9 KiB
YAML
104 lines
3.9 KiB
YAML
# Single container runs webserver + consumer + scheduler (paperless-ngx's
|
|
# stock entrypoint does this internally) - no need to split into separate
|
|
# Deployments. replicas: 1 only: paperless-media is ReadWriteOnce, and the
|
|
# consumer polling the media dir doesn't benefit from horizontal scaling here.
|
|
#
|
|
# Pinned to talos-cp-3: paperless-media's disk physically lives there. Longhorn
|
|
# RWO volumes can only be attached from one node at a time, and the nightly
|
|
# backup-cronjob.yaml also mounts this same PVC (read-only) to mirror it into
|
|
# MinIO - pinning both to the same node avoids a cross-node attach conflict,
|
|
# and keeps the 3.5Ti read/write path off the network entirely.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: paperless
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate # ReadWriteOnce media PVC - avoid two pods fighting over it
|
|
selector:
|
|
matchLabels:
|
|
app: paperless
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: paperless
|
|
spec:
|
|
# Kubernetes injects legacy Docker-links env vars for every Service in
|
|
# this namespace (<SVC>_SERVICE_HOST, <SVC>_PORT, ...). The Service here
|
|
# is named "paperless", so that becomes PAPERLESS_PORT=tcp://<ip>:8000 -
|
|
# paperless-ngx's own entrypoint reads PAPERLESS_PORT for gunicorn's
|
|
# bind address, collides, and gunicorn crash-loops on "not a valid port
|
|
# number". Disable the injection instead of renaming the Service.
|
|
enableServiceLinks: false
|
|
nodeSelector:
|
|
kubernetes.io/hostname: talos-cp-3
|
|
containers:
|
|
- name: paperless
|
|
image: ghcr.io/paperless-ngx/paperless-ngx:2.13
|
|
ports:
|
|
- containerPort: 8000
|
|
envFrom:
|
|
- configMapRef:
|
|
name: paperless-config
|
|
env:
|
|
- name: PAPERLESS_DBUSER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-db-app
|
|
key: username
|
|
- name: PAPERLESS_DBPASS
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-db-app
|
|
key: password
|
|
- name: PAPERLESS_SECRET_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-secrets
|
|
key: PAPERLESS_SECRET_KEY
|
|
- name: PAPERLESS_ADMIN_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-secrets
|
|
key: PAPERLESS_ADMIN_USER
|
|
- name: PAPERLESS_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-secrets
|
|
key: PAPERLESS_ADMIN_PASSWORD
|
|
- name: PAPERLESS_SOCIALACCOUNT_PROVIDERS
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-oidc
|
|
key: SOCIALACCOUNT_PROVIDERS_JSON
|
|
resources:
|
|
requests: { cpu: "500m", memory: "1Gi" }
|
|
limits: { cpu: "2", memory: "4Gi" }
|
|
volumeMounts:
|
|
- name: media
|
|
mountPath: /usr/src/paperless/media
|
|
- name: data
|
|
mountPath: /usr/src/paperless/data
|
|
- name: consume
|
|
mountPath: /usr/src/paperless/consume
|
|
# Overrides paperless-ngx's own adapter.py in place - settings.py
|
|
# hardcodes the import path, so no Django setting changes, just
|
|
# the file content underneath it (see adapter-configmap.yaml).
|
|
- name: adapter
|
|
mountPath: /usr/src/paperless/src/paperless/adapter.py
|
|
subPath: adapter.py
|
|
readOnly: true
|
|
volumes:
|
|
- name: media
|
|
persistentVolumeClaim:
|
|
claimName: paperless-media
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: paperless-data
|
|
- name: consume
|
|
emptyDir: {}
|
|
- name: adapter
|
|
configMap:
|
|
name: paperless-adapter
|