mirror of https://gerrit.hackerspace.pl/hscloud
111 lines
4.0 KiB
Plaintext
111 lines
4.0 KiB
Plaintext
local kube = import '../../kube/hscloud.libsonnet';
|
|
|
|
// Deploy SourceGraph, a code serach tool.
|
|
// Its configuration is fully managed within sourcegraph itself, including user accounts.
|
|
{
|
|
local top = self,
|
|
local cfg = top.cfg,
|
|
|
|
cfg:: {
|
|
name: 'sourcegraph',
|
|
namespace: 'sourcegraph',
|
|
domain: 'cs.hackerspace.pl',
|
|
image: "sourcegraph/server:3.17.1",
|
|
storageClassName: "waw-hdd-redundant-3",
|
|
},
|
|
|
|
local ns = kube.Namespace(cfg.namespace),
|
|
|
|
deployment: ns.Contain(kube.Deployment(cfg.name)) {
|
|
spec+: {
|
|
replicas: 1,
|
|
template+: {
|
|
spec+: {
|
|
volumes_: {
|
|
data: top.data.volume,
|
|
etc: top.etc.volume,
|
|
},
|
|
// This container fixes some permissions that Kubernetes volume mounts break.
|
|
initContainers_: {
|
|
fixperms: kube.Container("fixperms") {
|
|
image: "alpine:3",
|
|
volumeMounts_+: {
|
|
data: { mountPath: "/var/opt/sourcegraph" },
|
|
},
|
|
command: [
|
|
"sh", "-c",
|
|
"chmod 755 /var/opt/sourcegraph; chmod -R 700 /var/opt/sourcegraph/postgresql",
|
|
],
|
|
},
|
|
},
|
|
containers_: {
|
|
default: kube.Container('default') {
|
|
image: cfg.image,
|
|
ports_: {
|
|
http: { containerPort: 7080 },
|
|
},
|
|
volumeMounts_: {
|
|
data: { mountPath: "/var/opt/sourcegraph" },
|
|
etc: { mountPath: "/etc/sourcegraph" },
|
|
},
|
|
resources: {
|
|
requests: { cpu: "100m", memory: "1Gi" },
|
|
limits: { cpu: "1", memory: "2Gi" },
|
|
},
|
|
},
|
|
},
|
|
securityContext: {
|
|
runAsUser: 0,
|
|
fsGroup: 0,
|
|
},
|
|
},
|
|
}
|
|
}
|
|
},
|
|
|
|
data: ns.Contain(kube.PersistentVolumeClaim(cfg.name + "-data")) {
|
|
storage: "40Gi",
|
|
storageClass: cfg.storageClassName,
|
|
},
|
|
|
|
etc: ns.Contain(kube.PersistentVolumeClaim(cfg.name + "-etc")) {
|
|
storage: "4Gi",
|
|
storageClass: cfg.storageClassName,
|
|
},
|
|
|
|
service: ns.Contain(kube.Service(cfg.name)) {
|
|
target:: top.deployment,
|
|
},
|
|
|
|
// Fake service that doesn't point to anything
|
|
blockService: ns.Contain(kube.Service(cfg.name + "-block")) {
|
|
spec+: {
|
|
selector: null,
|
|
ports: [{ port: 2137, targetPort: 2137 }],
|
|
},
|
|
},
|
|
|
|
ingress: ns.Contain(kube.SimpleIngress(cfg.name)) {
|
|
hosts:: [cfg.domain],
|
|
target:: top.service,
|
|
metadata+: {
|
|
annotations+: {
|
|
// Authenticate as 'Anonymous' user by default. This is done in tandem
|
|
// with Sourcegraphs authenticate-by-http-header feature, and is a
|
|
// workaround for the lack of a public view in the self-hosted free
|
|
// version of Sourcegraph.
|
|
// https://twitter.com/sqs/status/1272659451292422144
|
|
"nginx.ingress.kubernetes.io/configuration-snippet": "proxy_set_header X-Forwarded-User Anonymous;"
|
|
},
|
|
},
|
|
extraPaths:: [
|
|
{
|
|
// Redirect anonymous user settings to a service that doesn't
|
|
// have any endpoints/backends.
|
|
path: "/users/Anonymous/settings",
|
|
backend: { serviceName: top.blockService.metadata.name, servicePort: 8080 },
|
|
},
|
|
],
|
|
},
|
|
}
|