diff --git a/bootstrap/tasks/addons/discord_template_notifier.yaml b/bootstrap/tasks/addons/discord_template_notifier.yaml new file mode 100644 index 00000000..57c988c0 --- /dev/null +++ b/bootstrap/tasks/addons/discord_template_notifier.yaml @@ -0,0 +1,45 @@ +--- +- name: Set addon facts + ansible.builtin.set_fact: + addon_name: discord-template-notifier + addon_namespace: default + +- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }} + when: item.state == 'directory' + ansible.builtin.file: + path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}" + state: directory + mode: "0755" + with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] + +- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }} + when: item.state == 'file' and 'sops' not in item.path + ansible.builtin.template: + src: "{{ item.src }}" + dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" + mode: "0644" + with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] + +# https://github.com/ansible-collections/community.sops/issues/153 +- name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }} + block: + - name: Disable Sops config + ansible.builtin.include_tasks: + file: ../sops/disable.yaml + - name: Template encrypted files + when: item.state == 'file' and 'sops' in item.path + community.sops.sops_encrypt: + path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" + encrypted_regex: ^(data|stringData)$ + age: ["{{ bootstrap_age_public_key }}"] + content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}" + mode: "0644" + force: true + with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml + rescue: + - name: Enable Sops config + ansible.builtin.include_tasks: + file: ../sops/enable.yaml diff --git a/bootstrap/tasks/addons/main.yaml b/bootstrap/tasks/addons/main.yaml index c7ff626c..23e4092b 100644 --- a/bootstrap/tasks/addons/main.yaml +++ b/bootstrap/tasks/addons/main.yaml @@ -27,3 +27,7 @@ - name: Process addon weave-gitops when: weave_gitops.enabled | default(false) ansible.builtin.include_tasks: weave_gitops.yaml + +- name: Process addon discord-template-notifier + when: discord_template_notifier.enabled | default(false) + ansible.builtin.include_tasks: discord_template_notifier.yaml diff --git a/bootstrap/templates/addons/discord-template-notifier/app/helmrelease.yaml.j2 b/bootstrap/templates/addons/discord-template-notifier/app/helmrelease.yaml.j2 new file mode 100644 index 00000000..70837431 --- /dev/null +++ b/bootstrap/templates/addons/discord-template-notifier/app/helmrelease.yaml.j2 @@ -0,0 +1,55 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: discord-template-notifier + namespace: default +spec: + interval: 15m + chart: + spec: + chart: app-template + version: 1.5.1 + interval: 30m + sourceRef: + kind: HelmRepository + name: bjw-s + namespace: flux-system + maxHistory: 2 + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: + image: + repository: ghcr.io/morphy2k/rss-forwarder + tag: 0.6.1 + env: + TZ: "${TIMEZONE}" + service: + main: &disableSvc + enabled: false + ingress: + main: *disableSvc + probes: + liveness: *disableSvc + readiness: *disableSvc + startup: *disableSvc + persistence: + data: + enabled: true + type: secret + name: discord-template-notifier-secret + resources: + requests: + cpu: 15m + memory: 110M + limits: + cpu: 15m + memory: 110M diff --git a/bootstrap/templates/addons/discord-template-notifier/app/kustomization.yaml.j2 b/bootstrap/templates/addons/discord-template-notifier/app/kustomization.yaml.j2 new file mode 100644 index 00000000..9444f7fa --- /dev/null +++ b/bootstrap/templates/addons/discord-template-notifier/app/kustomization.yaml.j2 @@ -0,0 +1,7 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: default +resources: + - ./secret.sops.yaml + - ./helmrelease.yaml diff --git a/bootstrap/templates/addons/discord-template-notifier/app/secret.sops.yaml.j2 b/bootstrap/templates/addons/discord-template-notifier/app/secret.sops.yaml.j2 new file mode 100644 index 00000000..837d614d --- /dev/null +++ b/bootstrap/templates/addons/discord-template-notifier/app/secret.sops.yaml.j2 @@ -0,0 +1,15 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: discord-template-notifier-secret + namespace: default +type: Opaque +stringData: + config.toml: |- + [feeds.github-template] + url = "https://github.com/onedr0p/flux-cluster-template/commits/main/.atom" + interval = "10m" + retry_limit = 5 + sink.type = "discord" + sink.url = "{{ discord_template_notifier.webhook_url }}" diff --git a/bootstrap/templates/addons/discord-template-notifier/ks.yaml.j2 b/bootstrap/templates/addons/discord-template-notifier/ks.yaml.j2 new file mode 100644 index 00000000..55e19556 --- /dev/null +++ b/bootstrap/templates/addons/discord-template-notifier/ks.yaml.j2 @@ -0,0 +1,16 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: cluster-apps-discord-template-notifier + namespace: flux-system +spec: + path: ./kubernetes/apps/default/discord-template-notifier/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: false + interval: 30m + retryInterval: 1m + timeout: 5m diff --git a/bootstrap/templates/kubernetes/apps/default/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/default/kustomization.yaml.j2 index cfe96a37..23a8573e 100644 --- a/bootstrap/templates/kubernetes/apps/default/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/default/kustomization.yaml.j2 @@ -7,3 +7,6 @@ resources: {% if hajimari.enabled | default(false) %} - ./hajimari/ks.yaml {% endif %} + {% if discord_template_notifier.enabled | default(false) %} + - ./discord-template-notifier/ks.yaml + {% endif %} diff --git a/bootstrap/vars/addons.sample.yaml b/bootstrap/vars/addons.sample.yaml index 8c6bb684..83ab4826 100644 --- a/bootstrap/vars/addons.sample.yaml +++ b/bootstrap/vars/addons.sample.yaml @@ -42,3 +42,10 @@ system_upgrade_controller: # ansible configuration files. Running ansible against an already provisioned # cluster with this enabled might cause your cluster to be downgraded. enabled: false + +# https://github.com/morphy2k/rss-forwarder +discord_template_notifier: + # Will post commits from the template repository to the specified discord channel + # so it's easier to keep track of changes. + enabled: false + webhook_url: # Discord webhook url