sascha.dodenhoeft/expertfab-infra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Migrate Joplin to K3s and add existing k8s manifests

Browse Source 
- New k8s/joplin/ deployment for note.expertfab.de (Postgres + Server +
  Traefik ingress with cert-manager), replicas=2 to match cluster size
- coredns-custom.yaml: route note.expertfab.de internally to Traefik LB
- Commit previously-built k8s manifests (documenso, erpnext oauth2-proxy,
  paperless oauth2-proxy) that were running but not in git
- docs/access.md: add Joplin section and Documenso/Cloudflare entries

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Sascha Dodenhöft
2026-05-28 20:17:19 +02:00
parent 314a512231
commit c48ab60392
14 changed files with 849 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
k8s/coredns-custom.yaml Normal file
View File

@@ -0,0 +1,28 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: coredns-custom
namespace: kube-system
data:
expertfab.server: |
expertfab.de:53 {
hosts {
10.42.71.60 auth.expertfab.de
10.42.71.60 docs.expertfab.de
10.42.71.60 www.expertfab.de
10.42.71.60 expertfab.de
10.42.71.60 api.expertfab.de
10.42.71.60 signing.expertfab.de
10.42.71.60 note.expertfab.de
fallthrough
}
forward . 10.42.71.1
}
coworkbase.de:53 {
hosts {
10.42.71.60 coworkbase.de
10.42.71.60 www.coworkbase.de
fallthrough
}
forward . 10.42.71.1
}

112
k8s/documenso/documenso.yaml Normal file
View File

File diff suppressed because one or more lines are too long

37
k8s/documenso/ingress.yaml Normal file
View File

@@ -0,0 +1,37 @@
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: redirect-https
namespace: documenso
spec:
redirectScheme:
scheme: https
permanent: true
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: documenso
namespace: documenso
annotations:
cert-manager.io/cluster-issuer: letsencrypt
traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
traefik.ingress.kubernetes.io/router.middlewares: documenso-redirect-https@kubernetescrd
spec:
ingressClassName: traefik
rules:
- host: signing.expertfab.de
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: documenso
port:
number: 3000
tls:
- hosts:
- signing.expertfab.de
secretName: documenso-tls

19
k8s/documenso/namespace.yaml Normal file
View File

@@ -0,0 +1,19 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: documenso
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: longhorn-documenso
provisioner: driver.longhorn.io
reclaimPolicy: Retain
allowVolumeExpansion: true
volumeBindingMode: Immediate
parameters:
numberOfReplicas: "2"
staleReplicaTimeout: "30"
fromBackup: ""
fsType: "ext4"

96
k8s/documenso/postgres.yaml Normal file
View File

@@ -0,0 +1,96 @@
---
apiVersion: v1
kind: Secret
metadata:
name: documenso-postgres
namespace: documenso
type: Opaque
stringData:
POSTGRES_DB: documenso
POSTGRES_USER: documenso
POSTGRES_PASSWORD: "9QtScsD5IymypPxR2eMNFoMFYVUp7cL"
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: documenso-postgres-data
namespace: documenso
spec:
accessModes: ["ReadWriteOnce"]
storageClassName: longhorn-documenso
resources:
requests:
storage: 10Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: documenso-postgres
namespace: documenso
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: documenso-postgres
template:
metadata:
labels:
app: documenso-postgres
spec:
containers:
- name: postgres
image: postgres:16-alpine
ports:
- containerPort: 5432
envFrom:
- secretRef:
name: documenso-postgres
env:
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
volumeMounts:
- name: data
mountPath: /var/lib/postgresql/data
startupProbe:
exec:
command: ["pg_isready", "-U", "documenso", "-d", "documenso"]
initialDelaySeconds: 10
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 30
readinessProbe:
exec:
command: ["pg_isready", "-U", "documenso", "-d", "documenso"]
periodSeconds: 10
timeoutSeconds: 5
livenessProbe:
exec:
command: ["pg_isready", "-U", "documenso", "-d", "documenso"]
periodSeconds: 30
timeoutSeconds: 5
failureThreshold: 5
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
cpu: 1000m
memory: 1Gi
volumes:
- name: data
persistentVolumeClaim:
claimName: documenso-postgres-data
---
apiVersion: v1
kind: Service
metadata:
name: documenso-postgres
namespace: documenso
spec:
selector:
app: documenso-postgres
ports:
- port: 5432
targetPort: 5432

80
k8s/erpnext/ingress-auth.yaml Normal file
View File

@@ -0,0 +1,80 @@
---
# /app/* — Zitadel Auth via oauth2-proxy (beide Domains)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: erpnext-app-auth
namespace: erpnext
annotations:
cert-manager.io/cluster-issuer: letsencrypt
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.priority: "100"
spec:
ingressClassName: traefik
rules:
- host: expertfab.de
http:
paths:
- path: /app
pathType: Prefix
backend:
service:
name: oauth2-proxy
port:
number: 4180
- host: www.expertfab.de
http:
paths:
- path: /app
pathType: Prefix
backend:
service:
name: oauth2-proxy
port:
number: 4180
tls:
- hosts:
- expertfab.de
- www.expertfab.de
secretName: expertfab-tls
---
# /oauth2/* — OIDC Callback-Handling (beide Domains)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: erpnext-oauth2
namespace: erpnext
annotations:
cert-manager.io/cluster-issuer: letsencrypt
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.priority: "100"
spec:
ingressClassName: traefik
rules:
- host: expertfab.de
http:
paths:
- path: /oauth2
pathType: Prefix
backend:
service:
name: oauth2-proxy
port:
number: 4180
- host: www.expertfab.de
http:
paths:
- path: /oauth2
pathType: Prefix
backend:
service:
name: oauth2-proxy
port:
number: 4180
tls:
- hosts:
- expertfab.de
- www.expertfab.de
secretName: expertfab-tls

82
k8s/erpnext/oauth2-proxy.yaml Normal file
View File

@@ -0,0 +1,82 @@
---
apiVersion: v1
kind: Secret
metadata:
name: oauth2-proxy-secrets
namespace: erpnext
type: Opaque
stringData:
OAUTH2_PROXY_CLIENT_ID: "371747520893682044"
OAUTH2_PROXY_CLIENT_SECRET: "Wka1L8RYFYeKHrzMOadDfQRXWlCnM6x2JKL2QBTmV3WHdaYY2OiodVZgK0MYdiFl"
OAUTH2_PROXY_COOKIE_SECRET: "st_biHMwZOrFbrigSmnEdRG5ZCoULrktjAvPGcUrqw0"
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: oauth2-proxy
namespace: erpnext
spec:
replicas: 1
selector:
matchLabels:
app: oauth2-proxy
template:
metadata:
labels:
app: oauth2-proxy
spec:
containers:
- name: oauth2-proxy
image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1
args:
- --provider=oidc
- --oidc-issuer-url=https://auth.expertfab.de
- --upstream=http://erpnext:8080
- --http-address=0.0.0.0:4180
- --email-domain=*
- --scope=openid profile email
- --skip-provider-button=true
- --cookie-secure=true
- --cookie-samesite=lax
- --cookie-domain=expertfab.de
- --whitelist-domain=expertfab.de
- --whitelist-domain=www.expertfab.de
- --reverse-proxy=true
- --set-xauthrequest=true
env:
- name: OAUTH2_PROXY_CLIENT_ID
valueFrom:
secretKeyRef:
name: oauth2-proxy-secrets
key: OAUTH2_PROXY_CLIENT_ID
- name: OAUTH2_PROXY_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: oauth2-proxy-secrets
key: OAUTH2_PROXY_CLIENT_SECRET
- name: OAUTH2_PROXY_COOKIE_SECRET
valueFrom:
secretKeyRef:
name: oauth2-proxy-secrets
key: OAUTH2_PROXY_COOKIE_SECRET
ports:
- containerPort: 4180
resources:
requests:
cpu: 50m
memory: 64Mi
limits:
cpu: 100m
memory: 128Mi
---
apiVersion: v1
kind: Service
metadata:
name: oauth2-proxy
namespace: erpnext
spec:
selector:
app: oauth2-proxy
ports:
- port: 4180
targetPort: 4180

37
k8s/joplin/ingress.yaml Normal file
View File

@@ -0,0 +1,37 @@
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: redirect-https
namespace: joplin
spec:
redirectScheme:
scheme: https
permanent: true
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: joplin
namespace: joplin
annotations:
cert-manager.io/cluster-issuer: letsencrypt
traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
traefik.ingress.kubernetes.io/router.middlewares: joplin-redirect-https@kubernetescrd
spec:
ingressClassName: traefik
rules:
- host: note.expertfab.de
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: joplin
port:
number: 22300
tls:
- hosts:
- note.expertfab.de
secretName: joplin-tls

92
k8s/joplin/joplin.yaml Normal file
View File

@@ -0,0 +1,92 @@
---
apiVersion: v1
kind: Secret
metadata:
name: joplin-env
namespace: joplin
type: Opaque
stringData:
APP_BASE_URL: "https://note.expertfab.de"
APP_PORT: "22300"
DB_CLIENT: "pg"
POSTGRES_HOST: "joplin-postgres"
POSTGRES_PORT: "5432"
POSTGRES_DATABASE: "joplin"
POSTGRES_USER: "joplin"
POSTGRES_PASSWORD: "TXIlCX4DUdKZuqbYt2lTaxMXvz6cJi"
MAILER_ENABLED: "1"
MAILER_HOST: "smtprelay.expertfab.de"
MAILER_PORT: "587"
MAILER_SECURITY: "starttls"
MAILER_AUTH_USER: "it-admin@expertfab.de"
MAILER_AUTH_PASSWORD: "Relay22$$"
MAILER_NOREPLY_NAME: "ExpertFab Joplin"
MAILER_NOREPLY_EMAIL: "it-admin@expertfab.de"
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: joplin
namespace: joplin
spec:
replicas: 1
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 1
maxUnavailable: 0
selector:
matchLabels:
app: joplin
template:
metadata:
labels:
app: joplin
spec:
containers:
- name: joplin
image: joplin/server:latest
ports:
- containerPort: 22300
envFrom:
- secretRef:
name: joplin-env
readinessProbe:
httpGet:
path: /api/ping
port: 22300
httpHeaders:
- name: Host
value: note.expertfab.de
initialDelaySeconds: 30
periodSeconds: 10
failureThreshold: 6
livenessProbe:
httpGet:
path: /api/ping
port: 22300
httpHeaders:
- name: Host
value: note.expertfab.de
initialDelaySeconds: 90
periodSeconds: 30
failureThreshold: 5
resources:
requests:
cpu: 100m
memory: 512Mi
limits:
cpu: 1000m
memory: 1500Mi
---
apiVersion: v1
kind: Service
metadata:
name: joplin
namespace: joplin
spec:
selector:
app: joplin
ports:
- port: 22300
targetPort: 22300

19
k8s/joplin/namespace.yaml Normal file
View File

@@ -0,0 +1,19 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: joplin
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: longhorn-joplin
provisioner: driver.longhorn.io
reclaimPolicy: Retain
allowVolumeExpansion: true
volumeBindingMode: Immediate
parameters:
numberOfReplicas: "2"
staleReplicaTimeout: "30"
fromBackup: ""
fsType: "ext4"

96
k8s/joplin/postgres.yaml Normal file
View File

@@ -0,0 +1,96 @@
---
apiVersion: v1
kind: Secret
metadata:
name: joplin-postgres
namespace: joplin
type: Opaque
stringData:
POSTGRES_DB: joplin
POSTGRES_USER: joplin
POSTGRES_PASSWORD: "TXIlCX4DUdKZuqbYt2lTaxMXvz6cJi"
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: joplin-postgres-data
namespace: joplin
spec:
accessModes: ["ReadWriteOnce"]
storageClassName: longhorn-joplin
resources:
requests:
storage: 10Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: joplin-postgres
namespace: joplin
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: joplin-postgres
template:
metadata:
labels:
app: joplin-postgres
spec:
containers:
- name: postgres
image: postgres:16-alpine
ports:
- containerPort: 5432
envFrom:
- secretRef:
name: joplin-postgres
env:
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
volumeMounts:
- name: data
mountPath: /var/lib/postgresql/data
startupProbe:
exec:
command: ["pg_isready", "-U", "joplin", "-d", "joplin"]
initialDelaySeconds: 10
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 30
readinessProbe:
exec:
command: ["pg_isready", "-U", "joplin", "-d", "joplin"]
periodSeconds: 10
timeoutSeconds: 5
livenessProbe:
exec:
command: ["pg_isready", "-U", "joplin", "-d", "joplin"]
periodSeconds: 30
timeoutSeconds: 5
failureThreshold: 5
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
cpu: 1000m
memory: 1Gi
volumes:
- name: data
persistentVolumeClaim:
claimName: joplin-postgres-data
---
apiVersion: v1
kind: Service
metadata:
name: joplin-postgres
namespace: joplin
spec:
selector:
app: joplin-postgres
ports:
- port: 5432
targetPort: 5432

27
k8s/paperless/ingress.yaml Normal file
View File

@@ -0,0 +1,27 @@
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: paperless
namespace: paperless
annotations:
cert-manager.io/cluster-issuer: letsencrypt
traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
traefik.ingress.kubernetes.io/router.middlewares: paperless-redirect-https@kubernetescrd
spec:
ingressClassName: traefik
rules:
- host: docs.expertfab.de
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: oauth2-proxy
port:
number: 4180
tls:
- hosts:
- docs.expertfab.de
secretName: paperless-tls

83
k8s/paperless/oauth2-proxy.yaml Normal file
View File

@@ -0,0 +1,83 @@
---
apiVersion: v1
kind: Secret
metadata:
name: oauth2-proxy-secrets
namespace: paperless
type: Opaque
stringData:
OAUTH2_PROXY_CLIENT_ID: "371736929185563308"
OAUTH2_PROXY_CLIENT_SECRET: "2WVS5uGOKOYozY0T6QLi854vihLrNbchqkPhEZxKS74b5iRQeeLH8EMhUiZIHWPH"
OAUTH2_PROXY_COOKIE_SECRET: "NcF3zVJcPIpBYpLL4TIqpmBAcESddly-LVHAKw--xl8"
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: oauth2-proxy
namespace: paperless
spec:
replicas: 1
selector:
matchLabels:
app: oauth2-proxy
template:
metadata:
labels:
app: oauth2-proxy
spec:
containers:
- name: oauth2-proxy
image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1
args:
- --provider=oidc
- --oidc-issuer-url=https://auth.expertfab.de
- --redirect-url=https://docs.expertfab.de/oauth2/callback
- --upstream=http://paperless:8000
- --http-address=0.0.0.0:4180
- --email-domain=*
- --scope=openid profile email
- --skip-provider-button=true
- --skip-auth-regex=^/api/
- --skip-auth-regex=^/api-auth/
- --cookie-secure=true
- --cookie-samesite=lax
- --reverse-proxy=true
- --pass-access-token=true
- --set-xauthrequest=true
env:
- name: OAUTH2_PROXY_CLIENT_ID
valueFrom:
secretKeyRef:
name: oauth2-proxy-secrets
key: OAUTH2_PROXY_CLIENT_ID
- name: OAUTH2_PROXY_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: oauth2-proxy-secrets
key: OAUTH2_PROXY_CLIENT_SECRET
- name: OAUTH2_PROXY_COOKIE_SECRET
valueFrom:
secretKeyRef:
name: oauth2-proxy-secrets
key: OAUTH2_PROXY_COOKIE_SECRET
ports:
- containerPort: 4180
resources:
requests:
cpu: 50m
memory: 64Mi
limits:
cpu: 100m
memory: 128Mi
---
apiVersion: v1
kind: Service
metadata:
name: oauth2-proxy
namespace: paperless
spec:
selector:
app: oauth2-proxy
ports:
- port: 4180
targetPort: 4180