Erich Blume
fcac8e5a72
Migrate paperless, teslamate, and mealie off the OOM-saturated minikube-indri node onto ringtail k3s, shedding ~1.1 GiB of resident load. Second chain in the indri-k8s decommission after immich. **Containers ported to Nix (default.nix), build-verified on ringtail:** - paperless → wraps nixpkgs paperless-ngx 2.20.15 (pinned unstable); runs as web/worker/beat/consumer - mealie → wraps nixpkgs mealie 3.16.0 (forward 4-minor bump, breaking-change reviewed); single gunicorn, SQLite - teslamate → from-scratch beamPackages mixRelease (not in nixpkgs); erlang_27+elixir_1_18, npm assets, ex_cldr locales pre-fetched **Data:** cold downtime-tolerant cutover. paperless+teslamate postgres dump/restore from quiesced source into a new ringtail blumeops-pg CNPG cluster; mealie SQLite PVC copied. Source DBs untouched until verified (rollback = repoint). **Also:** ringtail blumeops-pg cluster + ExternalSecrets scaffold; fixes pre-existing shower version-check drift. Runbook: docs/how-to/ringtail/migrate-wave1-ringtail.md. Deploy-from-branch + cutover happens before merge; container images rebuilt from main after merge. Reviewed-on: #363
133 lines
4.2 KiB
YAML
133 lines
4.2 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: paperless
|
|
namespace: paperless
|
|
spec:
|
|
# Migrated to ringtail (paperless-ringtail). Scaled to 0 to prevent
|
|
# double-writing the now-ringtail-owned database; manifest retained for
|
|
# rollback until the decommission PR. See [[migrate-wave1-ringtail]].
|
|
replicas: 0
|
|
selector:
|
|
matchLabels:
|
|
app: paperless
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: paperless
|
|
spec:
|
|
securityContext:
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: paperless
|
|
image: registry.ops.eblu.me/blumeops/paperless:kustomized
|
|
ports:
|
|
- containerPort: 8000
|
|
name: http
|
|
env:
|
|
- name: PAPERLESS_URL
|
|
value: "https://paperless.ops.eblu.me"
|
|
- name: PAPERLESS_REDIS
|
|
value: "redis://localhost:6379"
|
|
- name: PAPERLESS_DBHOST
|
|
value: "pg.ops.eblu.me"
|
|
- name: PAPERLESS_DBPORT
|
|
value: "5432"
|
|
- name: PAPERLESS_DBNAME
|
|
value: "paperless"
|
|
# Explicit port to override k8s-injected PAPERLESS_PORT env var
|
|
# (k8s sets PAPERLESS_PORT=tcp://... for a service named 'paperless')
|
|
- name: PAPERLESS_PORT
|
|
value: "8000"
|
|
- name: PAPERLESS_DBUSER
|
|
value: "paperless"
|
|
- name: PAPERLESS_DBPASS
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-secrets
|
|
key: db-password
|
|
- name: PAPERLESS_SECRET_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-secrets
|
|
key: secret-key
|
|
- name: PAPERLESS_TIME_ZONE
|
|
value: "America/Los_Angeles"
|
|
- name: PAPERLESS_OCR_LANGUAGE
|
|
value: "eng"
|
|
- name: PAPERLESS_TASK_WORKERS
|
|
value: "1"
|
|
# Admin account (created on first startup)
|
|
- name: PAPERLESS_ADMIN_USER
|
|
value: "eblume"
|
|
- name: PAPERLESS_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-secrets
|
|
key: admin-password
|
|
- name: PAPERLESS_ADMIN_MAIL
|
|
value: "blume.erich@gmail.com"
|
|
# OIDC via Authentik
|
|
# Full JSON blob pulled from 1Password (includes client secret)
|
|
- name: PAPERLESS_APPS
|
|
value: "allauth.socialaccount.providers.openid_connect"
|
|
- name: PAPERLESS_SOCIALACCOUNT_PROVIDERS
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-secrets
|
|
key: socialaccount-providers
|
|
- name: PAPERLESS_SOCIALACCOUNT_ALLOW_SIGNUPS
|
|
value: "true"
|
|
- name: PAPERLESS_SOCIAL_AUTO_SIGNUP
|
|
value: "true"
|
|
- name: PAPERLESS_ACCOUNT_ALLOW_SIGNUPS
|
|
value: "false"
|
|
- name: PAPERLESS_REDIRECT_LOGIN_TO_SSO
|
|
value: "false"
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /usr/src/paperless/data
|
|
- name: media
|
|
mountPath: /usr/src/paperless/media
|
|
- name: consume
|
|
mountPath: /usr/src/paperless/consume
|
|
resources:
|
|
requests:
|
|
memory: "256Mi"
|
|
cpu: "100m"
|
|
limits:
|
|
memory: "2Gi"
|
|
cpu: "1000m"
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 8000
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 30
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 8000
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
|
|
- name: redis
|
|
image: docker.io/library/redis:kustomized
|
|
ports:
|
|
- containerPort: 6379
|
|
resources:
|
|
requests:
|
|
memory: "32Mi"
|
|
cpu: "10m"
|
|
limits:
|
|
memory: "128Mi"
|
|
|
|
volumes:
|
|
- name: data
|
|
emptyDir: {}
|
|
- name: media
|
|
persistentVolumeClaim:
|
|
claimName: paperless-media
|
|
- name: consume
|
|
emptyDir: {}
|