mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Phase 2: deploy n8n and Nextcloud warm standbys on the VPS
Same CNPG replica-cluster pattern as Authentik (continuous WAL replay from home via VPS MinIO, app at 0 replicas until manual promotion - see infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml for the full rationale). n8n: N8N_ENCRYPTION_KEY copied byte-identical from home (kubectl, not git) - decrypts stored credentials in the replicated DB, same reasoning as Vault's unseal key / root token copies. Nextcloud: adds infrastructure/vps-standby/nextcloud/manifests/ pvc-restore-cronjob.yaml, the read side of home's existing nextcloud-pvc-sync restic backup - restores the latest snapshot from VPS MinIO into this standby's PVC daily at 04:00 (2h after home's 02:00 backup). No Redis on the VPS side (no redis-operator deployed there, out of scope for a standby that isn't serving traffic - Nextcloud degrades gracefully to DB-based locking without it).
This commit is contained in:
Scooby Husky
@@ -0,0 +1,57 @@
|
||||
---
|
||||
# CNPG replica cluster continuously replaying WAL from home's pg-n8n
|
||||
# (apps/n8n/manifests/cnpg-cluster.yaml) via VPS MinIO's
|
||||
# cnpg-backups/pg-n8n bucket path. Same pattern as
|
||||
# infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml - see
|
||||
# that file's comments for the full rationale (replica-cluster mode vs.
|
||||
# custom restore scripting, read-only until manual promotion).
|
||||
#
|
||||
# vps-minio-secret is a plain Secret copied here manually (kubectl, not
|
||||
# git), same as the authentik one:
|
||||
# kubectl -n n8n create secret generic vps-minio-secret \
|
||||
# --from-literal=accesskey=<vps minio root user> \
|
||||
# --from-literal=secretkey=<vps minio root password>
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Cluster
|
||||
metadata:
|
||||
name: pg-n8n
|
||||
namespace: n8n
|
||||
spec:
|
||||
imageName: ghcr.io/cloudnative-pg/postgresql:16
|
||||
instances: 1
|
||||
|
||||
resources:
|
||||
requests:
|
||||
memory: "256Mi"
|
||||
cpu: "25m"
|
||||
limits:
|
||||
memory: "1Gi"
|
||||
cpu: "250m"
|
||||
|
||||
storage:
|
||||
size: 10Gi
|
||||
storageClass: local-path
|
||||
|
||||
bootstrap:
|
||||
recovery:
|
||||
source: home-backup
|
||||
|
||||
externalClusters:
|
||||
- name: home-backup
|
||||
barmanObjectStore:
|
||||
destinationPath: s3://cnpg-backups/pg-n8n
|
||||
endpointURL: http://vps-minio.minio.svc.cluster.local:9000
|
||||
s3Credentials:
|
||||
accessKeyId:
|
||||
name: vps-minio-secret
|
||||
key: accesskey
|
||||
secretAccessKey:
|
||||
name: vps-minio-secret
|
||||
key: secretkey
|
||||
|
||||
replica:
|
||||
enabled: true
|
||||
source: home-backup
|
||||
|
||||
monitoring:
|
||||
enablePodMonitor: false
|
||||
@@ -0,0 +1,105 @@
|
||||
# n8n warm standby on the VPS - Phase 2. Same discipline as
|
||||
# infrastructure/vps-standby/authentik/values.yaml: the CNPG replica
|
||||
# cluster keeps the DB continuously warm in the background, but the app
|
||||
# itself stays at replicaCount: 0 until a deliberate manual promotion
|
||||
# (flip pg-n8n's spec.replica.enabled to false, then scale this up).
|
||||
#
|
||||
# N8N_ENCRYPTION_KEY must be byte-identical to home's - it decrypts
|
||||
# stored credentials (API keys, OAuth tokens, etc.) that live encrypted
|
||||
# in the DB being replicated. Unlike Authentik's chart-deterministic
|
||||
# secret_key, n8n's isn't derived from anything reproducible - it's
|
||||
# copied for real (kubectl, not git, same as Vault's unseal key /
|
||||
# root token):
|
||||
# kubectl -n n8n create secret generic n8n-config-secret \
|
||||
# --from-literal=encryption-key=<home's N8N_ENCRYPTION_KEY>
|
||||
image:
|
||||
repository: n8nio/n8n
|
||||
tag: "2.0.3"
|
||||
|
||||
config:
|
||||
database:
|
||||
type: postgresdb
|
||||
postgresdb:
|
||||
host: pg-n8n-rw
|
||||
port: 5432
|
||||
database: n8n
|
||||
user: n8n
|
||||
schema: public
|
||||
generic:
|
||||
timezone: America/New_York
|
||||
path: /
|
||||
host: n8n.kube.huskypup.net
|
||||
port: 5678
|
||||
protocol: https
|
||||
executions:
|
||||
mode: regular
|
||||
saveDataOnError: all
|
||||
saveDataOnSuccess: all
|
||||
saveDataManualExecutions: true
|
||||
pruneData: true
|
||||
pruneDataMaxAge: 3760
|
||||
|
||||
secret: {}
|
||||
|
||||
# Not run in normal operation - see file header.
|
||||
replicaCount: 0
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 80
|
||||
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
ingress:
|
||||
enabled: false
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
type: existing
|
||||
existingClaim: n8n-main-persistence
|
||||
storageClass: local-path
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
size: 10Gi
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "500m"
|
||||
memory: 512Mi
|
||||
|
||||
extraEnvSecrets:
|
||||
DB_POSTGRESDB_PASSWORD:
|
||||
name: pg-n8n-app
|
||||
key: password
|
||||
N8N_ENCRYPTION_KEY:
|
||||
name: n8n-config-secret
|
||||
key: encryption-key
|
||||
|
||||
extraEnv:
|
||||
WEBHOOK_URL: https://n8n.kube.huskypup.net/
|
||||
N8N_EDITOR_BASE_URL: https://n8n.kube.huskypup.net
|
||||
N8N_LOG_LEVEL: error
|
||||
|
||||
postgresql:
|
||||
enabled: false
|
||||
|
||||
redis:
|
||||
enabled: false
|
||||
|
||||
scaling:
|
||||
enabled: false
|
||||
|
||||
extraVolumes: []
|
||||
extraVolumeMounts: []
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
@@ -0,0 +1,56 @@
|
||||
---
|
||||
# CNPG replica cluster continuously replaying WAL from home's pg-nextcloud
|
||||
# (apps/nextcloud/manifests/cnpg-cluster.yaml) via VPS MinIO's
|
||||
# cnpg-backups/pg-nextcloud bucket path. Same pattern as the authentik/n8n
|
||||
# VPS replica clusters - see infrastructure/vps-standby/authentik/
|
||||
# manifests/cnpg-cluster.yaml for the full rationale.
|
||||
#
|
||||
# vps-minio-secret is a plain Secret copied here manually (kubectl, not
|
||||
# git):
|
||||
# kubectl -n nextcloud create secret generic vps-minio-secret \
|
||||
# --from-literal=accesskey=<vps minio root user> \
|
||||
# --from-literal=secretkey=<vps minio root password>
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Cluster
|
||||
metadata:
|
||||
name: pg-nextcloud
|
||||
namespace: nextcloud
|
||||
spec:
|
||||
imageName: ghcr.io/cloudnative-pg/postgresql:16
|
||||
instances: 1
|
||||
|
||||
resources:
|
||||
requests:
|
||||
memory: "256Mi"
|
||||
cpu: "25m"
|
||||
limits:
|
||||
memory: "1Gi"
|
||||
cpu: "250m"
|
||||
|
||||
storage:
|
||||
size: 20Gi
|
||||
storageClass: local-path
|
||||
|
||||
bootstrap:
|
||||
recovery:
|
||||
source: home-backup
|
||||
|
||||
externalClusters:
|
||||
- name: home-backup
|
||||
barmanObjectStore:
|
||||
destinationPath: s3://cnpg-backups/pg-nextcloud
|
||||
endpointURL: http://vps-minio.minio.svc.cluster.local:9000
|
||||
s3Credentials:
|
||||
accessKeyId:
|
||||
name: vps-minio-secret
|
||||
key: accesskey
|
||||
secretAccessKey:
|
||||
name: vps-minio-secret
|
||||
key: secretkey
|
||||
|
||||
replica:
|
||||
enabled: true
|
||||
source: home-backup
|
||||
|
||||
monitoring:
|
||||
enablePodMonitor: false
|
||||
@@ -0,0 +1,101 @@
|
||||
---
|
||||
# Restores the latest restic snapshot from home's nextcloud-pvc-sync
|
||||
# CronJob (apps/nextcloud/manifests/pvc-sync-cronjob.yaml, which backs up
|
||||
# to VPS MinIO's nextcloud-files/restic-repo daily at 02:00) into this
|
||||
# standby's own Nextcloud PVC. Runs daily at 04:00 - enough margin after
|
||||
# home's job to be sure that day's snapshot has landed.
|
||||
#
|
||||
# `restic restore latest --target /` restores into /data/... because
|
||||
# home's backup stored an absolute /data path (`restic backup /data ...`)
|
||||
# - mounting the destination PVC at /data here mirrors that exactly.
|
||||
#
|
||||
# nextcloud-restic-password must be the SAME password used to init the
|
||||
# repo at home (it's the decryption key for the whole restic repository,
|
||||
# not something that can differ per-consumer) - copied here manually
|
||||
# (kubectl, not git):
|
||||
# kubectl -n nextcloud create secret generic nextcloud-restic-password \
|
||||
# --from-literal=password=<home's nextcloud-restic-password>
|
||||
#
|
||||
# Nextcloud itself isn't running (replicas: 0, see values.yaml) so there's
|
||||
# no live-write conflict risk overwriting the PVC on every run.
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: nextcloud-pvc-restore
|
||||
namespace: nextcloud
|
||||
spec:
|
||||
schedule: "0 4 * * *"
|
||||
concurrencyPolicy: Forbid
|
||||
successfulJobsHistoryLimit: 3
|
||||
failedJobsHistoryLimit: 3
|
||||
jobTemplate:
|
||||
spec:
|
||||
backoffLimit: 2
|
||||
template:
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65534
|
||||
fsGroup: 33 # matches the real nextcloud Deployment's fsGroup, same reasoning as home's pvc-sync-cronjob
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: restic-restore
|
||||
image: restic/restic:0.16.4
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
set -eu
|
||||
export RESTIC_REPOSITORY="s3:http://vps-minio.minio.svc.cluster.local:9000/nextcloud-files/restic-repo"
|
||||
export RESTIC_PASSWORD_FILE=/restic-secret/password
|
||||
export AWS_ACCESS_KEY_ID="${MINIO_ACCESS_KEY}"
|
||||
export AWS_SECRET_ACCESS_KEY="${MINIO_SECRET_KEY}"
|
||||
export RESTIC_CACHE_DIR=/tmp/restic-cache
|
||||
|
||||
if ! restic snapshots >/dev/null 2>&1; then
|
||||
echo "No repo/snapshots reachable yet - nothing to restore."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "==> Restoring latest snapshot into /data..."
|
||||
restic restore latest --tag nextcloud --host nextcloud-k8s --target /
|
||||
|
||||
echo "==> Done."
|
||||
env:
|
||||
- name: MINIO_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: vps-minio-secret
|
||||
key: accesskey
|
||||
- name: MINIO_SECRET_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: vps-minio-secret
|
||||
key: secretkey
|
||||
volumeMounts:
|
||||
- name: nextcloud-data
|
||||
mountPath: /data
|
||||
- name: restic-secret
|
||||
mountPath: /restic-secret
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: nextcloud-data
|
||||
persistentVolumeClaim:
|
||||
# Chart-generated PVC name, follows the Helm release name
|
||||
# (Application metadata.name: vps-nextcloud) - same
|
||||
# release-name-based naming gotcha hit with vault-0/
|
||||
# vps-vault-0 and gitea-http/vps-gitea-http. Verify against
|
||||
# `kubectl -n nextcloud get pvc` after first deploy.
|
||||
claimName: vps-nextcloud-nextcloud
|
||||
- name: restic-secret
|
||||
secret:
|
||||
secretName: nextcloud-restic-password
|
||||
items:
|
||||
- key: password
|
||||
path: password
|
||||
@@ -0,0 +1,94 @@
|
||||
# Nextcloud warm standby on the VPS - Phase 2. Same discipline as the
|
||||
# other vps-standby apps: CNPG replica cluster (manifests/cnpg-cluster.yaml)
|
||||
# keeps the DB warm, manifests/pvc-restore-cronjob.yaml keeps file content
|
||||
# warm, but the app itself stays at replicaCount: 0 until a deliberate
|
||||
# manual promotion.
|
||||
#
|
||||
# No Redis here - the home instance uses the redis-operator
|
||||
# (infrastructure/vps-standby has no redis-operator deployed, out of
|
||||
# scope for a standby that isn't actually serving traffic). Nextcloud
|
||||
# runs fine without Redis (falls back to DB-based locking, just slower) -
|
||||
# acceptable for an emergency-promotion scenario; add a real Redis at
|
||||
# promotion time if desired.
|
||||
replicaCount: 0
|
||||
|
||||
nextcloud:
|
||||
host: nextcloud.kube.huskypup.net
|
||||
username: ""
|
||||
password: ""
|
||||
|
||||
phpConfigs:
|
||||
upload.ini: |
|
||||
upload_tmp_dir = /var/www/tmp
|
||||
sys_temp_dir = /var/www/tmp
|
||||
|
||||
extraEnv:
|
||||
- name: TMPDIR
|
||||
value: /var/www/tmp
|
||||
- name: PHP_MEMORY_LIMIT
|
||||
value: "2G"
|
||||
- name: PHP_UPLOAD_LIMIT
|
||||
value: "10G"
|
||||
|
||||
configs:
|
||||
proxy.config.php: |-
|
||||
<?php
|
||||
$CONFIG = array (
|
||||
'trusted_proxies' => array(
|
||||
0 => '10.0.0.0/8',
|
||||
1 => '172.16.0.0/12',
|
||||
),
|
||||
'overwriteprotocol' => 'https',
|
||||
'overwrite.cli.url' => 'https://nextcloud.kube.huskypup.net',
|
||||
'allow_local_remote_servers' => true,
|
||||
);
|
||||
temp.config.php: |-
|
||||
<?php
|
||||
$CONFIG = array (
|
||||
'tempdirectory' => '/var/www/tmp',
|
||||
);
|
||||
|
||||
existingSecret:
|
||||
enabled: true
|
||||
secretName: nextcloud-admin-secret
|
||||
usernameKey: username
|
||||
passwordKey: password
|
||||
|
||||
ingress:
|
||||
enabled: false
|
||||
|
||||
externalDatabase:
|
||||
enabled: true
|
||||
type: postgresql
|
||||
host: pg-nextcloud-rw
|
||||
port: 5432
|
||||
user: nextcloud
|
||||
database: nextcloud
|
||||
existingSecret:
|
||||
enabled: true
|
||||
secretName: pg-nextcloud-app
|
||||
passwordKey: password
|
||||
usernameKey: username
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClass: local-path
|
||||
accessMode: ReadWriteOnce
|
||||
size: 30Gi
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
|
||||
redis:
|
||||
enabled: false
|
||||
|
||||
externalRedis:
|
||||
enabled: false
|
||||
|
||||
metrics:
|
||||
enabled: false
|
||||
Reference in New Issue
Block a user