Serge Bazanski | 06b61d4 | 2020-09-15 18:21:35 +0000 | [diff] [blame] | 1 | // ONLYOFFICE document server. |
| 2 | // JWT secret needs to be generated as follows per environment: |
| 3 | // kubectl -n onlyoffice-prod create secret generic documentserver-jwt --from-literal=jwt=$(pwgen 32 1) |
| 4 | |
Radek Pietruszewski | f584431 | 2023-10-27 22:41:18 +0200 | [diff] [blame] | 5 | local kube = import "../../kube/hscloud.libsonnet"; |
Serge Bazanski | 06b61d4 | 2020-09-15 18:21:35 +0000 | [diff] [blame] | 6 | local policies = import "../../kube/policies.libsonnet"; |
| 7 | |
| 8 | { |
| 9 | onlyoffice:: { |
| 10 | local oo = self, |
| 11 | local cfg = oo.cfg, |
| 12 | cfg:: { |
| 13 | namespace: error "cfg.namespace must be set", |
Piotr Dobrowolski | 4978706 | 2022-02-09 21:30:16 +0100 | [diff] [blame] | 14 | image: "onlyoffice/documentserver:7.0.0.132", |
Serge Bazanski | 06b61d4 | 2020-09-15 18:21:35 +0000 | [diff] [blame] | 15 | storageClassName: "waw-hdd-redundant-3", |
| 16 | domain: error "cfg.domain must be set", |
| 17 | }, |
| 18 | |
radex | 99ed6a7 | 2023-11-24 11:42:55 +0100 | [diff] [blame^] | 19 | local ns = kube.Namespace(cfg.namespace), |
Serge Bazanski | 06b61d4 | 2020-09-15 18:21:35 +0000 | [diff] [blame] | 20 | |
radex | 99ed6a7 | 2023-11-24 11:42:55 +0100 | [diff] [blame^] | 21 | pvc: ns.Contain(kube.PersistentVolumeClaim("documentserver")) { |
radex | 36964dc | 2023-11-24 11:19:46 +0100 | [diff] [blame] | 22 | storage:: "10Gi", |
| 23 | storageClass:: cfg.storageClassName, |
Serge Bazanski | 06b61d4 | 2020-09-15 18:21:35 +0000 | [diff] [blame] | 24 | }, |
| 25 | |
radex | 99ed6a7 | 2023-11-24 11:42:55 +0100 | [diff] [blame^] | 26 | deploy: ns.Contain(kube.Deployment("documentserver")) { |
Serge Bazanski | 06b61d4 | 2020-09-15 18:21:35 +0000 | [diff] [blame] | 27 | spec+: { |
| 28 | template+: { |
| 29 | spec+: { |
| 30 | containers_: { |
| 31 | documentserver: kube.Container("default") { |
| 32 | image: cfg.image, |
| 33 | resources: { |
| 34 | requests: { memory: "4G", cpu: "100m" }, |
| 35 | limits: { memory: "8G", cpu: "2" }, |
| 36 | }, |
| 37 | env_: { |
| 38 | JWT_ENABLED: "true", |
| 39 | JWT_SECRET: { secretKeyRef: { name: "documentserver-jwt", key: "jwt", }}, |
| 40 | }, |
| 41 | ports_: { |
| 42 | http: { containerPort: 80 }, |
| 43 | }, |
| 44 | local make(sp, p) = { name: "data", mountPath: p, subPath: sp }, |
| 45 | volumeMounts: [ |
| 46 | // Per upstream Dockerfile: |
Radek Pietruszewski | f584431 | 2023-10-27 22:41:18 +0200 | [diff] [blame] | 47 | // VOLUME /var/log/$COMPANY_NAME /var/lib/$COMPANY_NAME |
Serge Bazanski | 06b61d4 | 2020-09-15 18:21:35 +0000 | [diff] [blame] | 48 | // /var/www/$COMPANY_NAME/Data /var/lib/postgresql |
| 49 | // /var/lib/rabbitmq /var/lib/redis |
| 50 | // /usr/share/fonts/truetype/custom |
| 51 | make("log", "/var/log/onlyoffice"), |
| 52 | make("www-data", "/var/www/onlyoffice/Data"), |
| 53 | make("postgres", "/var/lib/postgresql"), |
| 54 | make("rabbit", "/var/lib/rabbitmq"), |
| 55 | make("redis", "/var/lib/redis"), |
| 56 | make("fonts", "/usr/share/fonts/truetype/custom"), |
| 57 | ], |
| 58 | }, |
| 59 | }, |
| 60 | volumes_: { |
| 61 | data: kube.PersistentVolumeClaimVolume(oo.pvc), |
| 62 | }, |
| 63 | }, |
| 64 | }, |
| 65 | }, |
| 66 | }, |
| 67 | |
radex | 99ed6a7 | 2023-11-24 11:42:55 +0100 | [diff] [blame^] | 68 | svc: ns.Contain(kube.Service("documentserver")) { |
radex | 8b8f387 | 2023-11-24 11:09:46 +0100 | [diff] [blame] | 69 | target:: oo.deploy, |
Serge Bazanski | 06b61d4 | 2020-09-15 18:21:35 +0000 | [diff] [blame] | 70 | }, |
Radek Pietruszewski | f584431 | 2023-10-27 22:41:18 +0200 | [diff] [blame] | 71 | |
radex | 99ed6a7 | 2023-11-24 11:42:55 +0100 | [diff] [blame^] | 72 | ingress: ns.Contain(kube.SimpleIngress("office")) { |
Radek Pietruszewski | f584431 | 2023-10-27 22:41:18 +0200 | [diff] [blame] | 73 | hosts:: [cfg.domain], |
| 74 | target_service:: oo.svc, |
Serge Bazanski | 06b61d4 | 2020-09-15 18:21:35 +0000 | [diff] [blame] | 75 | }, |
| 76 | |
| 77 | // Needed because the documentserver runs its own supervisor, and: |
| 78 | // - rabbitmq wants to mkdir in /run, which starts out with the wrong permissions |
| 79 | // - nginx wants to bind to port 80 |
| 80 | insecure: policies.AllowNamespaceInsecure(cfg.namespace), |
| 81 | }, |
| 82 | |
| 83 | prod: self.onlyoffice { |
| 84 | cfg+: { |
| 85 | namespace: "onlyoffice-prod", |
| 86 | domain: "office.hackerspace.pl", |
| 87 | }, |
| 88 | }, |
| 89 | } |