The-Nest/k3s
The-Nest/k3s
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Set up windmill and proton bridge

Browse source
This commit is contained in:
KnightArtorias 2026-07-24 18:33:23 -04:00
parent 5a9712c9a5
commit b1f5dedfda
15 changed files with 278 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
documentation/technical/backups-and-recovery.md
View file

@ -4,25 +4,6 @@ The Nest uses a two-tier backup strategy: **Longhorn volume snapshots** for appl
## Backup Architecture
┌─────────────┐ ┌──────────────────┐ ┌─────────────────┐
│ Longhorn │────▶│ Recurring Jobs │────▶│ Backblaze B2 │
│ Volumes │ │ (weekly) │ │ (offsite) │
└─────────────┘ └──────────────────┘ └─────────────────┘
┌─────────────┐ ┌──────────────────┐ ┌─────────────────┐
│ Nextcloud │────▶│ Restic CronJob │────▶│ Backblaze B2 │
│ User Data │ │ (daily) │ │ (offsite) │
└─────────────┘ └──────────────────┘ └─────────────────┘
## Longhorn Recurring Backups

0
monitoring/stack/monitoring-external-secrets.yaml → monitoring/monitoring-external-secrets.yaml
View file

0
monitoring/stack/monitoring-services.yaml → monitoring/monitoring-services.yaml
View file

0
monitoring/stack/monitoring-stack.yaml → monitoring/monitoring-stack.yaml
View file

49
services/proton-bridge/proton-bridge-deployment.yaml Normal file
View file

@ -0,0 +1,49 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: proton-bridge
annotations:
keel.sh/policy: "all"
keel.sh/match-tag: "true"
keel.sh/schedule: "0 3 * * *"
spec:
replicas: 1
selector:
matchLabels:
app: proton-bridge
template:
metadata:
labels:
app: proton-bridge
spec:
nodeSelector:
kubernetes.io/arch: amd64
# The initContainer runs first, scrubs the broken update, and locks the folder
initContainers:
- name: disable-auto-update
image: busybox:latest
command:
- "/bin/sh"
- "-c"
- |
mkdir -p /root/.local/share/protonmail/bridge-v3/updates
rm -rf /root/.local/share/protonmail/bridge-v3/updates/*
chmod 555 /root/.local/share/protonmail/bridge-v3/updates
volumeMounts:
- name: bridge-data
mountPath: /root
containers:
- name: bridge
image: shenxn/protonmail-bridge:latest
ports:
- containerPort: 25
name: smtp
- containerPort: 143
name: imap
volumeMounts:
- name: bridge-data
mountPath: /root
volumes:
- name: bridge-data
persistentVolumeClaim:
claimName: proton-bridge-data

32
services/proton-bridge/proton-bridge-monitor.yaml Normal file
View file

@ -0,0 +1,32 @@
apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
name: prometheus-blackbox-exporter
namespace: kube-system
spec:
chart: prometheus-blackbox-exporter
repo: https://prometheus-community.github.io/helm-charts
targetNamespace: monitoring
createNamespace: true
valuesContent: |-
config:
modules:
proton_smtp_auth:
prober: tcp
timeout: 10s
tcp:
query_response:
- expect: "^220"
- send: "EHLO blackbox\r\n"
- expect: "^250"
# --- Remove these 3 lines if Bridge Connection Mode is "None" ---
- send: "STARTTLS\r\n"
- expect: "^220"
- starttls: true
# ----------------------------------------------------------------
- send: "EHLO blackbox\r\n"
- expect: "^250"
# Insert your generated Base64 string below
- send: "AUTH PLAIN \AG5lc3RAbXluZXN0LmxvdmUAZ0pibVNBamdVaF83ejdUNEg4NGhxdw==r\n"
- expect: "^235" # 235 = Auth successful. Any 5xx error fails the probe.
- send: "QUIT\r\n"

14
services/proton-bridge/proton-bridge-pvcs.yaml Normal file
View file

@ -0,0 +1,14 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: proton-bridge-data
labels:
recurring-job.longhorn.io/source: "enabled"
recurring-job-group.longhorn.io/app-config-group: "enabled"
spec:
storageClassName: longhorn
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 5Gi

14
services/proton-bridge/proton-bridge-service.yaml Normal file
View file

@ -0,0 +1,14 @@
apiVersion: v1
kind: Service
metadata:
name: proton-bridge
spec:
ports:
- port: 25
targetPort: 25
name: smtp
- port: 143
targetPort: 143
name: imap
selector:
app: proton-bridge

3
services/vaultwarden/vaultwarden-deployment.yaml
View file

@ -23,6 +23,9 @@ spec:
value: "false"
- name: WEBSOCKET_ENABLED
value: "true"
envFrom:
- secretRef:
name: vaultwarden-secret
image: vaultwarden/server:latest
name: vaultwarden
ports:

18
services/vaultwarden/vaultwarden-external-secrets.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: vaultwarden-secret
namespace: default
spec:
refreshInterval: "1h"
secretStoreRef:
name: vault-external-secrets-store
kind: ClusterSecretStore
target:
name: vaultwarden-secret
creationPolicy: Owner
data:
- secretKey: ADMIN_TOKEN
remoteRef:
key: vaultwarden
property: admin-token

66
services/windmill/windmill-deployment.yaml Normal file
View file

@ -0,0 +1,66 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: windmill-server
annotations:
keel.sh/policy: "all"
keel.sh/match-tag: "true"
keel.sh/schedule: "0 3 * * *"
spec:
replicas: 1
selector:
matchLabels:
app: windmill-server
template:
metadata:
labels:
app: windmill-server
spec:
nodeSelector:
kubernetes.io/arch: amd64
containers:
- name: server
image: ghcr.io/windmill-labs/windmill:latest
env:
- name: MODE
value: "standalone"
- name: BASE_URL
value: "http://windmill.k3s.home.nest"
- name: DATABASE_URL
valueFrom:
secretKeyRef:
name: windmill-secret
key: DATABASE_URL
ports:
- containerPort: 8000
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: windmill-postgres
spec:
replicas: 1
selector:
matchLabels:
app: windmill-postgres
template:
metadata:
labels:
app: windmill-postgres
spec:
containers:
- name: postgres
image: postgres:16-alpine
ports:
- containerPort: 5432
envFrom:
- secretRef:
name: windmill-secret
volumeMounts:
- name: postgres-storage
mountPath: /var/lib/postgresql/data
subPath: windmill-data
volumes:
- name: postgres-storage
persistentVolumeClaim:
claimName: windmill-postgres-pvc

29
services/windmill/windmill-external-secrets.yaml Normal file
View file

@ -0,0 +1,29 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: windmill-secret
spec:
refreshInterval: "1h"
secretStoreRef:
name: vault-external-secrets-store
kind: ClusterSecretStore
target:
name: windmill-secret
creationPolicy: Owner
data:
- secretKey: POSTGRES_DB
remoteRef:
key: windmill
property: postgres-db
- secretKey: POSTGRES_USER
remoteRef:
key: windmill
property: postgres-user
- secretKey: POSTGRES_PASSWORD
remoteRef:
key: windmill
property: postgres-password
- secretKey: DATABASE_URL
remoteRef:
key: windmill
property: database-url

18
services/windmill/windmill-ingress.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: windmill-ingress
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: web
spec:
rules:
- host: windmill.k3s.home.nest
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: windmill-server
port:
number: 8000

14
services/windmill/windmill-pvcs.yaml Normal file
View file

@ -0,0 +1,14 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: windmill-postgres-pvc
labels:
recurring-job.longhorn.io/source: "enabled"
recurring-job-group.longhorn.io/app-config-group: "enabled"
spec:
storageClassName: longhorn
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 5Gi

21
services/windmill/windmill-service.yaml Normal file
View file

@ -0,0 +1,21 @@
apiVersion: v1
kind: Service
metadata:
name: windmill-server
spec:
ports:
- port: 8000
targetPort: 8000
selector:
app: windmill-server
---
apiVersion: v1
kind: Service
metadata:
name: windmill-postgres
spec:
ports:
- port: 5432
targetPort: 5432
selector:
app: windmill-postgres