REFACTOR(apps): migrate to app-template

- docusaurus: Replace with app-template, configmap in manifests/
- homer: Replace with app-template, configMapGenerator for config.yml
- crafty: Replace with app-template, pvc/ingress/service in manifests/
- mas: Replace with app-template, rbac/external-secret in manifests/
- All apps use app-template chart v3.6.1
This commit is contained in:
2026-01-06 15:42:07 +09:00
parent 753543648b
commit be6723cc55
29 changed files with 453 additions and 532 deletions

View File

@@ -8,6 +8,15 @@ metadata:
spec:
project: default
sources:
- repoURL: https://bjw-s.github.io/helm-charts
chart: app-template
targetRevision: 3.6.1
helm:
valueFiles:
- $values/crafty/helm-values.yaml
- repoURL: https://github.com/K3S-HOME/applications.git
targetRevision: main
ref: values
- repoURL: https://github.com/K3S-HOME/applications.git
targetRevision: main
path: crafty

View File

@@ -1,68 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: crafty
namespace: crafty
labels:
app: crafty
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: crafty
template:
metadata:
labels:
app: crafty
spec:
securityContext:
fsGroup: 0
initContainers:
- name: init-permissions
image: busybox:latest
command: ['sh', '-c', 'chown -R 1000:0 /crafty && chmod -R g+rwX /crafty']
volumeMounts:
- name: servers
mountPath: /crafty/servers
- name: config
mountPath: /crafty/app/config
securityContext:
runAsUser: 0
containers:
- name: crafty
image: registry.gitlab.com/crafty-controller/crafty-4:latest
env:
- name: TZ
value: Asia/Seoul
ports:
- name: https
containerPort: 8443
protocol: TCP
- name: dynmap
containerPort: 8123
protocol: TCP
- name: bedrock
containerPort: 19132
protocol: UDP
resources:
requests:
memory: "512Mi"
cpu: "250m"
limits:
memory: "2Gi"
volumeMounts:
- name: servers
mountPath: /crafty/servers
- name: config
mountPath: /crafty/app/config
securityContext:
allowPrivilegeEscalation: false
volumes:
- name: servers
persistentVolumeClaim:
claimName: crafty-servers
- name: config
persistentVolumeClaim:
claimName: crafty-config

67
crafty/helm-values.yaml Normal file
View File

@@ -0,0 +1,67 @@
# crafty - bjw-s/app-template values
# Minecraft server manager
defaultPodOptions:
securityContext:
fsGroup: 0
controllers:
main:
strategy: Recreate
initContainers:
init-permissions:
image:
repository: busybox
tag: latest
command:
- sh
- -c
- "chown -R 1000:0 /crafty && chmod -R g+rwX /crafty"
securityContext:
runAsUser: 0
containers:
main:
image:
repository: registry.gitlab.com/crafty-controller/crafty-4
tag: latest
env:
TZ: Asia/Seoul
resources:
requests:
cpu: 250m
memory: 512Mi
limits:
memory: 2Gi
securityContext:
allowPrivilegeEscalation: false
service:
main:
controller: main
ports:
https:
port: 8443
dynmap:
port: 8123
persistence:
servers:
enabled: true
type: persistentVolumeClaim
existingClaim: crafty-servers
advancedMounts:
main:
init-permissions:
- path: /crafty/servers
main:
- path: /crafty/servers
config:
enabled: true
type: persistentVolumeClaim
existingClaim: crafty-config
advancedMounts:
main:
init-permissions:
- path: /crafty/app/config
main:
- path: /crafty/app/config

View File

@@ -1,9 +1,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- pvc.yaml
- deployment.yaml
- service.yaml
- serverstransport.yaml
- ingress.yaml
- manifests/pvc.yaml
- manifests/minecraft-service.yaml
- manifests/serverstransport.yaml
- manifests/ingress.yaml

View File

@@ -1,26 +1,5 @@
apiVersion: v1
kind: Service
metadata:
name: crafty
namespace: crafty
labels:
app: crafty
spec:
type: ClusterIP
selector:
app: crafty
ports:
- name: https
port: 8443
targetPort: 8443
protocol: TCP
- name: dynmap
port: 8123
targetPort: 8123
protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
name: crafty-minecraft
namespace: crafty
@@ -29,7 +8,7 @@ metadata:
spec:
type: LoadBalancer
selector:
app: crafty
app.kubernetes.io/name: crafty
ports:
- name: bedrock
port: 19132

View File

@@ -8,6 +8,15 @@ metadata:
spec:
project: default
sources:
- repoURL: https://bjw-s.github.io/helm-charts
chart: app-template
targetRevision: 3.6.1
helm:
valueFiles:
- $values/docusaurus/helm-values.yaml
- repoURL: https://github.com/K3S-HOME/applications.git
targetRevision: main
ref: values
- repoURL: https://github.com/K3S-HOME/applications.git
targetRevision: main
path: docusaurus
@@ -18,11 +27,8 @@ spec:
automated:
prune: true
selfHeal: true
allowEmpty: false
syncOptions:
- CreateNamespace=true
- PrunePropagationPolicy=foreground
- PruneLast=true
retry:
limit: 5
backoff:
@@ -32,15 +38,3 @@ spec:
managedNamespaceMetadata:
labels:
goldilocks.fairwinds.com/enabled: 'true'
revisionHistoryLimit: 10
ignoreDifferences:
- group: apps
kind: Deployment
jqPathExpressions:
- .metadata.annotations
- group: ''
kind: Service
name: docusaurus
namespace: docusaurus
jsonPointers:
- /spec/clusterIP

View File

@@ -1,118 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: docusaurus
namespace: docusaurus
labels:
app: docusaurus
spec:
replicas: 1
selector:
matchLabels:
app: docusaurus
template:
metadata:
labels:
app: docusaurus
annotations:
docusaurus/source-hash: "2024-12-30-v1"
spec:
initContainers:
- name: build-docusaurus
image: node:18-alpine
workingDir: /workspace
command:
- sh
- -c
- |
apk add --no-cache git
echo "Cloning repository..."
git clone https://github.com/K3S-HOME/applications.git /tmp/repo
cd /tmp/repo/docusaurus/asset
echo "Installing dependencies..."
npm install --legacy-peer-deps
echo "Building Docusaurus site..."
npm run build
echo "Copying build output..."
cp -r build/. /build/
echo "Build complete!"
volumeMounts:
- name: build-output
mountPath: /build
containers:
- name: nginx
image: nginx:alpine
ports:
- containerPort: 80
name: http
volumeMounts:
- name: build-output
mountPath: /usr/share/nginx/html
- name: nginx-config
mountPath: /etc/nginx/conf.d/default.conf
subPath: default.conf
resources:
requests:
cpu: 50m
memory: 64Mi
limits:
memory: 128Mi
livenessProbe:
httpGet:
path: /
port: 80
initialDelaySeconds: 10
periodSeconds: 10
readinessProbe:
httpGet:
path: /
port: 80
initialDelaySeconds: 5
periodSeconds: 5
volumes:
- name: build-output
emptyDir: {}
- name: nginx-config
configMap:
name: nginx-config
---
apiVersion: v1
kind: ConfigMap
metadata:
name: nginx-config
namespace: docusaurus
data:
default.conf: |
server {
listen 80;
server_name _;
root /usr/share/nginx/html;
index index.html;
# Enable gzip compression
gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss application/javascript application/json;
# Redirect root to intro page
location = / {
return 301 /intro/;
}
# SPA fallback
location / {
try_files $uri $uri/ /intro/index.html;
}
# Cache static assets
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
expires 1y;
add_header Cache-Control "public, immutable";
}
# Security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
}

104
docusaurus/helm-values.yaml Normal file
View File

@@ -0,0 +1,104 @@
# docusaurus - bjw-s/app-template values
# Documentation site with build-time static generation
controllers:
main:
annotations:
docusaurus/source-hash: "2024-12-30-v1"
initContainers:
build-docusaurus:
image:
repository: node
tag: 18-alpine
command:
- sh
- -c
- |
apk add --no-cache git
echo "Cloning repository..."
git clone https://github.com/K3S-HOME/applications.git /tmp/repo
cd /tmp/repo/docusaurus/asset
echo "Installing dependencies..."
npm install --legacy-peer-deps
echo "Building Docusaurus site..."
npm run build
echo "Copying build output..."
cp -r build/. /build/
echo "Build complete!"
containers:
main:
image:
repository: nginx
tag: alpine
resources:
requests:
cpu: 50m
memory: 64Mi
limits:
memory: 128Mi
probes:
liveness:
enabled: true
custom: true
spec:
httpGet:
path: /
port: 80
initialDelaySeconds: 10
periodSeconds: 10
readiness:
enabled: true
custom: true
spec:
httpGet:
path: /
port: 80
initialDelaySeconds: 5
periodSeconds: 5
service:
main:
controller: main
ports:
http:
port: 80
ingress:
main:
enabled: true
className: traefik
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
hosts:
- host: docusaurus0213.kro.kr
paths:
- path: /
service:
identifier: main
port: http
tls:
- secretName: docusaurus-tls
hosts:
- docusaurus0213.kro.kr
persistence:
build-output:
enabled: true
type: emptyDir
globalMounts:
- path: /build
advancedMounts:
main:
build-docusaurus:
- path: /build
main:
- path: /usr/share/nginx/html
nginx-config:
enabled: true
type: configMap
name: nginx-config
advancedMounts:
main:
main:
- path: /etc/nginx/conf.d/default.conf
subPath: default.conf

View File

@@ -1,27 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: docusaurus-ingress
namespace: docusaurus
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-prod"
nginx.ingress.kubernetes.io/proxy-body-size: "0"
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
spec:
ingressClassName: traefik
tls:
- hosts:
- docusaurus0213.kro.kr
secretName: docusaurus-tls
rules:
- host: docusaurus0213.kro.kr
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: docusaurus
port:
number: 80

View File

@@ -1,7 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- deployment.yaml
- service.yaml
- ingress.yaml
namespace: docusaurus
resources:
- manifests/configmap.yaml

View File

@@ -0,0 +1,40 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: nginx-config
namespace: docusaurus
data:
default.conf: |
server {
listen 80;
server_name _;
root /usr/share/nginx/html;
index index.html;
# Enable gzip compression
gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss application/javascript application/json;
# Redirect root to intro page
location = / {
return 301 /intro/;
}
# SPA fallback
location / {
try_files $uri $uri/ /intro/index.html;
}
# Cache static assets
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
expires 1y;
add_header Cache-Control "public, immutable";
}
# Security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
}

View File

@@ -1,16 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: docusaurus
namespace: docusaurus
labels:
app: docusaurus
spec:
type: ClusterIP
ports:
- name: http
port: 80
targetPort: 80
protocol: TCP
selector:
app: docusaurus

View File

@@ -8,6 +8,15 @@ metadata:
spec:
project: default
sources:
- repoURL: https://bjw-s.github.io/helm-charts
chart: app-template
targetRevision: 3.6.1
helm:
valueFiles:
- $values/homer/helm-values.yaml
- repoURL: https://github.com/K3S-HOME/applications.git
targetRevision: main
ref: values
- repoURL: https://github.com/K3S-HOME/applications.git
targetRevision: main
path: homer

View File

@@ -1,68 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: homer
namespace: homer
labels:
app: homer
spec:
replicas: 1
selector:
matchLabels:
app: homer
template:
metadata:
labels:
app: homer
spec:
initContainers:
- name: copy-homer-files
image: b4bz/homer:latest
command: ['sh', '-c']
args:
- |
# Homer의 기본 파일들을 emptyDir로 복사
cp -r /www/* /tmp/www/
volumeMounts:
- name: www
mountPath: /tmp/www
- name: copy-assets
image: alpine/git:latest
command: ['sh', '-c']
args:
- |
# Git에서 assets 복사
git clone --depth 1 --branch main https://github.com/K3S-HOME/applications.git /tmp/repo
# assets 폴더 덮어쓰기
rm -rf /www/assets
cp -r /tmp/repo/homer/assets /www/assets
# config.yml 복사
cp /config/config.yml /www/assets/config.yml
# lighttpd 사용자(uid=1000)가 읽을 수 있도록 권한 변경
chmod -R 755 /www/assets
chown -R 1000:65533 /www/assets
volumeMounts:
- name: config
mountPath: /config
- name: www
mountPath: /www
containers:
- name: homer
image: b4bz/homer:latest
imagePullPolicy: IfNotPresent
ports:
- containerPort: 8080
name: http
volumeMounts:
- name: www
mountPath: "/www"
resources:
requests:
memory: "64Mi"
cpu: "5m"
volumes:
- name: config
configMap:
name: homer-config
- name: www
emptyDir: {}

93
homer/helm-values.yaml Normal file
View File

@@ -0,0 +1,93 @@
# homer - bjw-s/app-template values
# Dashboard for self-hosted services
controllers:
main:
initContainers:
copy-homer-files:
image:
repository: b4bz/homer
tag: latest
command:
- sh
- -c
- |
cp -r /www/* /tmp/www/
copy-assets:
image:
repository: alpine/git
tag: latest
command:
- sh
- -c
- |
git clone --depth 1 --branch main https://github.com/K3S-HOME/applications.git /tmp/repo
rm -rf /www/assets
cp -r /tmp/repo/homer/assets /www/assets
cp /config/config.yml /www/assets/config.yml
chmod -R 755 /www/assets
chown -R 1000:65533 /www/assets
containers:
main:
image:
repository: b4bz/homer
tag: latest
pullPolicy: IfNotPresent
resources:
requests:
cpu: 5m
memory: 64Mi
service:
main:
controller: main
ports:
http:
port: 80
targetPort: 8080
ingress:
main:
enabled: true
className: traefik
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
hosts:
- host: mayne.kro.kr
paths:
- path: /
service:
identifier: main
port: http
- host: www.mayne.kro.kr
paths:
- path: /
service:
identifier: main
port: http
tls:
- secretName: homer-tls
hosts:
- mayne.kro.kr
- www.mayne.kro.kr
persistence:
www:
enabled: true
type: emptyDir
advancedMounts:
main:
copy-homer-files:
- path: /tmp/www
copy-assets:
- path: /www
main:
- path: /www
config:
enabled: true
type: configMap
name: homer-config
advancedMounts:
main:
copy-assets:
- path: /config

View File

@@ -1,35 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: homer-ingress
namespace: homer
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
ingressClassName: traefik
tls:
- hosts:
- mayne.kro.kr
- www.mayne.kro.kr
secretName: homer-tls
rules:
- host: mayne.kro.kr
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: homer
port:
number: 80
- host: www.mayne.kro.kr
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: homer
port:
number: 80

View File

@@ -1,11 +1,9 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- deployment.yaml
- service.yaml
- ingress.yaml
configMapGenerator:
- name: homer-config
namespace: homer
files:
- config.yml
generatorOptions:
disableNameSuffixHash: true

View File

@@ -1,13 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: homer
namespace: homer
spec:
type: ClusterIP
ports:
- name: http
port: 80
targetPort: 8080
selector:
app: homer

View File

@@ -8,6 +8,15 @@ metadata:
spec:
project: default
sources:
- repoURL: https://bjw-s.github.io/helm-charts
chart: app-template
targetRevision: 3.6.1
helm:
valueFiles:
- $values/mas/helm-values.yaml
- repoURL: https://github.com/K3S-HOME/applications.git
targetRevision: main
ref: values
- repoURL: https://github.com/K3S-HOME/applications.git
targetRevision: main
path: mas
@@ -18,11 +27,8 @@ spec:
automated:
prune: true
selfHeal: true
allowEmpty: false
syncOptions:
- CreateNamespace=true
- PrunePropagationPolicy=foreground
- PruneLast=true
retry:
limit: 5
backoff:
@@ -32,4 +38,3 @@ spec:
managedNamespaceMetadata:
labels:
goldilocks.fairwinds.com/enabled: 'true'
revisionHistoryLimit: 10

View File

@@ -1,77 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: mas
labels:
app: mas
spec:
replicas: 1
selector:
matchLabels:
app: mas
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 0
maxSurge: 1
revisionHistoryLimit: 3
template:
metadata:
labels:
app: mas
spec:
hostPID: true
serviceAccountName: mas
imagePullSecrets:
- name: ghcr-secret
containers:
- name: mas
image: ghcr.io/mayne0213/mas:latest
imagePullPolicy: Always
securityContext:
privileged: true
ports:
- containerPort: 8000
name: http
env:
- name: ANTHROPIC_API_KEY
valueFrom:
secretKeyRef:
name: mas-api-keys
key: anthropic-api-key
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: postgresql-password
key: password
- name: CHAINLIT_DATABASE_URL
value: "postgresql://bluemayne:$(POSTGRES_PASSWORD)@postgresql-rw.postgresql.svc.cluster.local:5432/mas"
- name: DATABASE_URL
value: "postgresql://bluemayne:$(POSTGRES_PASSWORD)@postgresql-rw.postgresql.svc.cluster.local:5432/mas"
- name: POSTGRES_HOST
value: "postgresql-rw.postgresql.svc.cluster.local"
- name: POSTGRES_PORT
value: "5432"
- name: POSTGRES_USER
value: "bluemayne"
- name: REDIS_URL
value: "redis://redis:6379/0"
resources:
requests:
memory: 256Mi
cpu: 100m
limits:
memory: 1Gi
livenessProbe:
httpGet:
path: /
port: 8000
initialDelaySeconds: 30
periodSeconds: 10
readinessProbe:
httpGet:
path: /
port: 8000
initialDelaySeconds: 10
periodSeconds: 5
restartPolicy: Always

102
mas/helm-values.yaml Normal file
View File

@@ -0,0 +1,102 @@
# mas - bjw-s/app-template values
# Multi-Agent System
defaultPodOptions:
hostPID: true
imagePullSecrets:
- name: ghcr-secret
serviceAccount:
create: false
name: mas
controllers:
main:
strategy: RollingUpdate
rollingUpdate:
unavailable: 0
surge: 1
revisionHistoryLimit: 3
containers:
main:
image:
repository: ghcr.io/mayne0213/mas
tag: latest
pullPolicy: Always
securityContext:
privileged: true
env:
ANTHROPIC_API_KEY:
valueFrom:
secretKeyRef:
name: mas-api-keys
key: anthropic-api-key
POSTGRES_PASSWORD:
valueFrom:
secretKeyRef:
name: postgresql-password
key: password
CHAINLIT_DATABASE_URL: "postgresql://bluemayne:$(POSTGRES_PASSWORD)@postgresql-rw.postgresql.svc.cluster.local:5432/mas"
DATABASE_URL: "postgresql://bluemayne:$(POSTGRES_PASSWORD)@postgresql-rw.postgresql.svc.cluster.local:5432/mas"
POSTGRES_HOST: "postgresql-rw.postgresql.svc.cluster.local"
POSTGRES_PORT: "5432"
POSTGRES_USER: "bluemayne"
REDIS_URL: "redis://redis:6379/0"
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
memory: 1Gi
probes:
liveness:
enabled: true
custom: true
spec:
httpGet:
path: /
port: 8000
initialDelaySeconds: 30
periodSeconds: 10
readiness:
enabled: true
custom: true
spec:
httpGet:
path: /
port: 8000
initialDelaySeconds: 10
periodSeconds: 5
service:
main:
controller: main
ports:
http:
port: 8000
ingress:
main:
enabled: true
className: traefik
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
traefik.ingress.kubernetes.io/router.middlewares: authelia-authelia-auth@kubernetescrd
hosts:
- host: mas0213.kro.kr
paths:
- path: /
service:
identifier: main
port: http
- host: www.mas0213.kro.kr
paths:
- path: /
service:
identifier: main
port: http
tls:
- secretName: mas-tls
hosts:
- mas0213.kro.kr
- www.mas0213.kro.kr

View File

@@ -1,35 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: mas-ingress
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
traefik.ingress.kubernetes.io/router.middlewares: authelia-authelia-auth@kubernetescrd
spec:
ingressClassName: traefik
tls:
- hosts:
- mas0213.kro.kr
- www.mas0213.kro.kr
secretName: mas-tls
rules:
- host: mas0213.kro.kr
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: mas
port:
number: 8000
- host: www.mas0213.kro.kr
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: mas
port:
number: 8000

View File

@@ -2,8 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: mas
resources:
- deployment.yaml
- service.yaml
- ingress.yaml
- external-secret.yaml
- rbac.yaml
- manifests/rbac.yaml
- manifests/external-secret.yaml

View File

@@ -1,15 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: mas
labels:
app: mas
spec:
type: ClusterIP
ports:
- port: 8000
targetPort: 8000
protocol: TCP
name: http
selector:
app: mas