discourse.yml

#
# Haiku's forums
#
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: discourse
  labels:
    app: discourse
spec:
  replicas: 1
  selector:
    matchLabels:
      app: discourse
  strategy:
    # RollingUpgrade can't be used because of RWO storage and gerrit lock files
    type: Recreate
  template:
    metadata:
      labels:
        app: discourse
    spec:
      containers:
      - name: discourse
        image: ghcr.io/haiku/discourse:3.3.2
        resources:
          limits:
            cpu: "2.0"
            memory: 4Gi
          requests:
            cpu: "1.0"
            memory: 2Gi
        env:
        - name: LANG
          value: "en_US.UTF-8"
        - name: RAILS_ENV
          value: "production"
        - name: UNICORN_WORKERS
          value: "6"
        - name: UNICORN_SIDEKIQS
          value: "1"
        - name: DOCKER_USE_HOSTNAME
          value: "true"
        - name: RUBY_GLOBAL_METHOD_CACHE_SIZE
          value: "131072"
        - name: DISCOURSE_DEVELOPER_EMAILS
          value: "contact@haiku-os.org"
        - name: DISCOURSE_HOSTNAME
          value: "discuss.haiku-os.org"
        - name: DISCOURSE_SMTP_PORT
          value: "25"
        - name: DISCOURSE_SMTP_ADDRESS
          value: "smtp"
        - name: DISCOURSE_SMTP_ENABLE_START_TLS
          value: "false"
        - name: DISCOURSE_SMTP_AUTHENTICATION
          value: "none"
        - name: DISCOURSE_REDIS_HOST
          value: "redis"
        - name: DISCOURSE_DB_HOST
          value: "postgres"
        - name: DISCOURSE_DB_PORT
          value: "5432"
        - name: DISCOURSE_DB_USERNAME
          valueFrom:
            secretKeyRef:
              name: discourse-pg
              key: username
        - name: DISCOURSE_DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: discourse-pg
              key: password
        volumeMounts:
        - name: discourse-data
          mountPath: /shared
      volumes:
      - name: discourse-data
        persistentVolumeClaim:
          claimName: discourse-data-pvc
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: discourse-data-pvc
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 16Gi
---
apiVersion: v1
kind: Service
metadata:
  name: discourse
spec:
  selector:
    app: discourse
  ports:
  - name: www
    port: 80
    targetPort: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: discourse
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-production
    traefik.ingress.kubernetes.io/router.entrypoints: web,webs
spec:
  tls:
  - hosts:
    - discuss.haiku-os.org
    secretName: tls-cert-discourse
  rules:
  - host: discuss.haiku-os.org
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: discourse
            port:
              name: www
---
# Backup Persistent Volume
apiVersion: batch/v1
kind: CronJob
metadata:
  name: discourse-pvbackup
spec:
  schedule: "0 3 * * 3"
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      template:
        spec:
          # volumes are attached to a single physical node (RWO), this ensures the backup
          # job always starts on the same physical node where discourse is running
          affinity:
            podAffinity:
              requiredDuringSchedulingIgnoredDuringExecution:
              - labelSelector:
                  matchExpressions:
                  - key: app
                    operator: In
                    values:
                    - discourse
                topologyKey: kubernetes.io/hostname
          containers:
            - name: pvbackup
              image: ghcr.io/haiku/pvbackup:1.3
              args: ["backup", "discourse-data"]
              env:
              - name: S3_HOST
                value: "https://s3.eu-west-1.wasabisys.com"
              - name: S3_BUCKET
                value: haiku-backups
              - name: S3_MAX_AGE
                value: 14d
              - name: S3_KEY
                valueFrom:
                  secretKeyRef:
                    name: s3-backup
                    key: s3_key
              - name: S3_SECRET
                valueFrom:
                  secretKeyRef:
                    name: s3-backup
                    key: s3_secret
              - name: TWOSECRET
                valueFrom:
                  secretKeyRef:
                    name: s3-backup
                    key: twosecret
              volumeMounts:
              - name: discourse-data
                mountPath: /pvs/discourse-data
          volumes:
          - name: discourse-data
            persistentVolumeClaim:
              claimName: discourse-data-pvc
          restartPolicy: Never
---
# Backup postgresql
apiVersion: batch/v1
kind: CronJob
metadata:
  name: discourse-pgbackup
spec:
  schedule: "0 0 * * 1,4"
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: Never
          containers:
            - name: pgbackup
              image: ghcr.io/haiku/pgbackup:1.1
              args: ["backup", "discourse"]
              env:
              - name: S3_HOST
                value: "https://s3.eu-west-1.wasabisys.com"
              - name: S3_BUCKET
                value: haiku-backups
              - name: S3_MAX_AGE
                value: 15d
              - name: S3_KEY
                valueFrom:
                  secretKeyRef:
                    name: s3-backup
                    key: s3_key
              - name: S3_SECRET
                valueFrom:
                  secretKeyRef:
                    name: s3-backup
                    key: s3_secret
              - name: TWOSECRET
                valueFrom:
                  secretKeyRef:
                    name: s3-backup
                    key: twosecret
              - name: PG_HOSTNAME
                value: postgres
              - name: PG_USERNAME
                valueFrom:
                  secretKeyRef:
                    name: postgres-admin
                    key: username
              - name: PG_PASSWORD
                valueFrom:
                  secretKeyRef:
                    name: postgres-admin
                    key: password