Deploy a drive for zimit.kiwix.org

zimit/drive/drive-backup.yaml

@@ -0,0 +1,45 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: drive-backup
+  namespace: zimit
+spec:
+  schedule: "@daily"
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 1
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      template:
+        spec:
+          containers:
+            - name: borg-backup
+              image: ghcr.io/kiwix/borg-backup:latest
+              imagePullPolicy: Always
+              volumeMounts:
+              - name: files-volume
+                mountPath: "/storage"
+                readOnly: true
+              envFrom:
+                - secretRef:
+                    name: backup-credentials
+              env:
+                - name: BORGBASE_NAME
+                  value: "zimit-drive"
+                - name: BITWARDEN_EMAIL
+                  value: "[email protected]"
+              command: ["single-backup"]
+              resources:
+                requests:
+                  cpu: 50m
+                  memory: 64Mi
+                limits:
+                  memory: 256Mi
+          volumes:
+          - name: files-volume
+            persistentVolumeClaim:
+              claimName: drive-local-pvc
+          restartPolicy: Never
+          nodeSelector:
+            k8s.kiwix.org/role: "services"

zimit/drive/drive.pvc.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: drive-local-pvc
+  namespace: zimit
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 64Gi
+  storageClassName: ""
+  volumeName: zimit-drive-local-pv

zimit/drive/drive.yaml

@@ -0,0 +1,103 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: zimit
+  labels:
+    app: drive-app
+  name: drive-deployment
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: drive-app
+  template:
+    metadata:
+      labels:
+        app: drive-app
+    spec:
+      containers:
+      - image: ghcr.io/kiwix/nginx-webdav:latest
+        imagePullPolicy: Always
+        name: nginx
+        env:
+          - name: NAME
+            value: zimit-drive
+          - name: USERNAME
+            value: admin
+          - name: PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: drive-password
+                key: value
+                optional: false
+        volumeMounts:
+        - name: data-volume
+          mountPath: "/data"
+          readOnly: false
+        ports:
+        - containerPort: 80
+        resources:
+          requests:
+            memory: "32Mi"
+            cpu: "1m"
+      volumes:
+      - name: data-volume
+        persistentVolumeClaim:
+          claimName: drive-local-pvc
+      nodeSelector:
+        k8s.kiwix.org/role: "services"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: zimit
+  name: drive-service
+  labels:
+    app: drive-app
+spec:
+  selector:
+    app: drive-app
+  ports:
+  - protocol: TCP
+    port: 80
+    targetPort: 80
+    name: http
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: drive-ingress
+  namespace: zimit
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: 8196m
+    # see offspot/drive/drive.yaml
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      set $destination $http_destination;
+      if ($destination ~ ^https://(.*)) {
+          set $destination http://$1;
+          more_set_input_headers "Destination: $destination";
+          #more_set_input_headers -t 'text/plain' Destination $destination;
+      }
+
+    nginx.ingress.kubernetes.io/server-snippet: |
+      location /robots.txt {
+        add_header Content-Type "text/plain";
+        return 200 "User-agent: *\nDisallow: /";
+      }
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+      - drive.zimit.kiwix.org
+      secretName: drive-zimit-kiwix-org-tls
+  rules:
+  - host: drive.zimit.kiwix.org
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: drive-service
+            port:
+              name: http

zimit/drive/drive.zimit.kiwix.org.yaml

@@ -0,0 +1,13 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: drive-zimit-kiwix-org
+  namespace: zimit
+spec:
+  secretName: drive-zimit-kiwix-org-tls
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
+  commonName: drive.zimit.kiwix.org
+  dnsNames:
+  - drive.zimit.kiwix.org

zimit/drive/zimit-drive-local.pv.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: zimit-drive-local-pv
+spec:
+  capacity:
+    storage: 64Gi
+  volumeMode: Filesystem
+  accessModes:
+  - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: local-storage
+  local:
+    path: /data/zimit-drive
+  claimRef:
+    name: drive-local-pvc
+    namespace: zimit
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: k8s.kiwix.org/role
+              operator: In
+              values:
+              - services