8cdfd0e2f9
- New namespace grist with in-namespace PostgreSQL 16 - Ingress grist.basicstack.de + letsencrypt-prod (DNS-01 via Hetzner) - Pocket ID OIDC login (client "Grist", group "grist") - All PVCs on hcloud-volumes-encrypted - ArgoCD application via apps/app-grist.yaml Co-Authored-By: Paperclip <noreply@paperclip.ing>
127 lines
3.3 KiB
YAML
127 lines
3.3 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: grist
|
|
namespace: grist
|
|
labels:
|
|
app: grist
|
|
component: app
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: grist
|
|
component: app
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: grist
|
|
component: app
|
|
spec:
|
|
initContainers:
|
|
- name: wait-for-postgres
|
|
image: postgres:16-alpine
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
until pg_isready -h grist-postgres -U grist; do
|
|
echo "Waiting for PostgreSQL..."
|
|
sleep 2
|
|
done
|
|
securityContext:
|
|
fsGroup: 1000
|
|
containers:
|
|
- name: grist
|
|
image: gristlabs/grist:1.7.7
|
|
ports:
|
|
- name: http
|
|
containerPort: 8484
|
|
env:
|
|
- name: APP_HOME_URL
|
|
value: https://grist.basicstack.de
|
|
- name: GRIST_DOMAIN
|
|
value: grist.basicstack.de
|
|
- name: GRIST_SINGLE_ORG
|
|
value: docs
|
|
- name: GRIST_ORG_IN_PATH
|
|
value: "false"
|
|
- name: GRIST_DEFAULT_PRODUCT
|
|
value: Free
|
|
- name: GRIST_HIDE_UI_ELEMENTS
|
|
value: billing
|
|
- name: PORT
|
|
value: "8484"
|
|
- name: TYPEORM_TYPE
|
|
value: postgres
|
|
- name: TYPEORM_HOST
|
|
value: grist-postgres
|
|
- name: TYPEORM_PORT
|
|
value: "5432"
|
|
- name: TYPEORM_DATABASE
|
|
value: grist
|
|
- name: TYPEORM_USERNAME
|
|
value: grist
|
|
- name: TYPEORM_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: grist-db-credentials
|
|
key: postgres-password
|
|
- name: GRIST_SESSION_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: grist-app-secrets
|
|
key: session-secret
|
|
- name: GRIST_OIDC_IDP_ISSUER
|
|
value: https://auth.basicstack.de
|
|
- name: GRIST_OIDC_IDP_CLIENT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: grist-oidc-secret
|
|
key: client-id
|
|
- name: GRIST_OIDC_IDP_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: grist-oidc-secret
|
|
key: client-secret
|
|
- name: GRIST_OIDC_SP_HOST
|
|
value: https://grist.basicstack.de
|
|
- name: GRIST_OIDC_IDP_SCOPES
|
|
value: openid email profile
|
|
- name: GRIST_OIDC_IDP_END_SESSION_ENDPOINT
|
|
value: https://auth.basicstack.de/api/oidc/end-session
|
|
- name: GRIST_OIDC_SP_IGNORE_EMAIL_VERIFIED
|
|
value: "true"
|
|
- name: GRIST_DEFAULT_EMAIL
|
|
value: andreas.leinen@basicstack.de
|
|
- name: GRIST_FORCE_LOGIN
|
|
value: "true"
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 2Gi
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: 8484
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /status
|
|
port: 8484
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 5
|
|
timeoutSeconds: 3
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /persist
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: grist-data
|