Set up windmill and proton bridge

documentation/technical/backups-and-recovery.md

@@ -3,26 +3,7 @@
 The Nest uses a two-tier backup strategy: **Longhorn volume snapshots** for application configuration data (backed up to Backblaze B2 weekly), and **Restic** for Nextcloud user data (backed up daily). Media storage is not backed up.
 
 ## Backup Architecture
-                                                                                                                             
-┌─────────────┐     ┌──────────────────┐     ┌─────────────────┐                                                             
-                                                                                                                             
 
-│  Longhorn   │────▶│  Recurring Jobs  │────▶│  Backblaze B2   │                                                             
-                                                                                                                             
-│  Volumes    │     │  (weekly)        │     │  (offsite)      │                                                             
-                                                                                                                             
-
-└─────────────┘     └──────────────────┘     └─────────────────┘                                                             
-                                                                                                                             
-                                                                                                                             
-┌─────────────┐     ┌──────────────────┐     ┌─────────────────┐                                                             
-                                                                                                                             
-
-│ Nextcloud   │────▶│  Restic CronJob  │────▶│  Backblaze B2   │                                                             
-                                                                                                                             
-│ User Data   │     │  (daily)         │     │  (offsite)      │                                                             
-                                                                                                                             
-└─────────────┘     └──────────────────┘     └─────────────────┘
 
 ## Longhorn Recurring Backups
 

services/proton-bridge/proton-bridge-deployment.yaml

@@ -0,0 +1,49 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: proton-bridge
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: proton-bridge
+  template:
+    metadata:
+      labels:
+        app: proton-bridge
+    spec:
+      nodeSelector:
+        kubernetes.io/arch: amd64
+      # The initContainer runs first, scrubs the broken update, and locks the folder
+      initContainers:
+        - name: disable-auto-update
+          image: busybox:latest
+          command: 
+            - "/bin/sh"
+            - "-c"
+            - |
+              mkdir -p /root/.local/share/protonmail/bridge-v3/updates
+              rm -rf /root/.local/share/protonmail/bridge-v3/updates/*
+              chmod 555 /root/.local/share/protonmail/bridge-v3/updates
+          volumeMounts:
+            - name: bridge-data
+              mountPath: /root
+      containers:
+        - name: bridge
+          image: shenxn/protonmail-bridge:latest
+          ports:
+            - containerPort: 25
+              name: smtp
+            - containerPort: 143
+              name: imap
+          volumeMounts:
+            - name: bridge-data
+              mountPath: /root
+      volumes:
+        - name: bridge-data
+          persistentVolumeClaim:
+            claimName: proton-bridge-data

services/proton-bridge/proton-bridge-monitor.yaml

@@ -0,0 +1,32 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: prometheus-blackbox-exporter
+  namespace: kube-system
+spec:
+  chart: prometheus-blackbox-exporter
+  repo: https://prometheus-community.github.io/helm-charts
+  targetNamespace: monitoring
+  createNamespace: true
+  valuesContent: |-
+    config:
+      modules:
+        proton_smtp_auth:
+          prober: tcp
+          timeout: 10s
+          tcp:
+            query_response:
+              - expect: "^220"
+              - send: "EHLO blackbox\r\n"
+              - expect: "^250"
+              # --- Remove these 3 lines if Bridge Connection Mode is "None" ---
+              - send: "STARTTLS\r\n"
+              - expect: "^220"
+              - starttls: true
+              # ----------------------------------------------------------------
+              - send: "EHLO blackbox\r\n"
+              - expect: "^250"
+              # Insert your generated Base64 string below
+              - send: "AUTH PLAIN \AG5lc3RAbXluZXN0LmxvdmUAZ0pibVNBamdVaF83ejdUNEg4NGhxdw==r\n"
+              - expect: "^235" # 235 = Auth successful. Any 5xx error fails the probe.
+              - send: "QUIT\r\n"

services/proton-bridge/proton-bridge-pvcs.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: proton-bridge-data
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  storageClassName: longhorn
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi

services/proton-bridge/proton-bridge-service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: proton-bridge
+spec:
+  ports:
+    - port: 25
+      targetPort: 25
+      name: smtp
+    - port: 143
+      targetPort: 143
+      name: imap
+  selector:
+    app: proton-bridge

services/vaultwarden/vaultwarden-deployment.yaml

@@ -23,6 +23,9 @@ spec:
               value: "false"
             - name: WEBSOCKET_ENABLED
               value: "true"
+          envFrom:
+            - secretRef:
+                name: vaultwarden-secret
           image: vaultwarden/server:latest
           name: vaultwarden
           ports:

services/vaultwarden/vaultwarden-external-secrets.yaml

@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vaultwarden-secret
+  namespace: default
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-external-secrets-store
+    kind: ClusterSecretStore
+  target:
+    name: vaultwarden-secret
+    creationPolicy: Owner
+  data:
+  - secretKey: ADMIN_TOKEN
+    remoteRef:
+      key: vaultwarden
+      property: admin-token

services/windmill/windmill-deployment.yaml

@@ -0,0 +1,66 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: windmill-server
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: windmill-server
+  template:
+    metadata:
+      labels:
+        app: windmill-server
+    spec:
+      nodeSelector:
+        kubernetes.io/arch: amd64
+      containers:
+        - name: server
+          image: ghcr.io/windmill-labs/windmill:latest
+          env:
+            - name: MODE
+              value: "standalone"
+            - name: BASE_URL
+              value: "http://windmill.k3s.home.nest"
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: windmill-secret
+                  key: DATABASE_URL
+          ports:
+            - containerPort: 8000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: windmill-postgres
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: windmill-postgres
+  template:
+    metadata:
+      labels:
+        app: windmill-postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:16-alpine
+          ports:
+            - containerPort: 5432
+          envFrom:
+            - secretRef:
+                name: windmill-secret
+          volumeMounts:
+            - name: postgres-storage
+              mountPath: /var/lib/postgresql/data
+              subPath: windmill-data
+      volumes:
+        - name: postgres-storage
+          persistentVolumeClaim:
+            claimName: windmill-postgres-pvc

services/windmill/windmill-external-secrets.yaml

@@ -0,0 +1,29 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: windmill-secret
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-external-secrets-store
+    kind: ClusterSecretStore
+  target:
+    name: windmill-secret
+    creationPolicy: Owner
+  data:
+  - secretKey: POSTGRES_DB
+    remoteRef:
+      key: windmill
+      property: postgres-db
+  - secretKey: POSTGRES_USER
+    remoteRef:
+      key: windmill
+      property: postgres-user
+  - secretKey: POSTGRES_PASSWORD
+    remoteRef:
+      key: windmill
+      property: postgres-password
+  - secretKey: DATABASE_URL
+    remoteRef:
+      key: windmill
+      property: database-url

services/windmill/windmill-ingress.yaml

@@ -0,0 +1,18 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: windmill-ingress
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  rules:
+    - host: windmill.k3s.home.nest
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: windmill-server
+                port:
+                  number: 8000

services/windmill/windmill-pvcs.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: windmill-postgres-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  storageClassName: longhorn
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi

services/windmill/windmill-service.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: windmill-server
+spec:
+  ports:
+    - port: 8000
+      targetPort: 8000
+  selector:
+    app: windmill-server
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: windmill-postgres
+spec:
+  ports:
+    - port: 5432
+      targetPort: 5432
+  selector:
+    app: windmill-postgres