feat: addon rss forwarder (#876)

Co-authored-by: Devin Buhl <onedr0p@users.noreply.github.com>

bootstrap/tasks/addons/discord_template_notifier.yaml

@@ -0,0 +1,45 @@
+---
+- name: Set addon facts
+  ansible.builtin.set_fact:
+    addon_name: discord-template-notifier
+    addon_namespace: default
+
+- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }}
+  when: item.state == 'directory'
+  ansible.builtin.file:
+    path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}"
+    state: directory
+    mode: "0755"
+  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+
+- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }}
+  when: item.state == 'file' and 'sops' not in item.path
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
+    mode: "0644"
+  with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+
+# https://github.com/ansible-collections/community.sops/issues/153
+- name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }}
+  block:
+    - name: Disable Sops config
+      ansible.builtin.include_tasks:
+        file: ../sops/disable.yaml
+    - name: Template encrypted files
+      when: item.state == 'file' and 'sops' in item.path
+      community.sops.sops_encrypt:
+        path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}"
+        encrypted_regex: ^(data|stringData)$
+        age: ["{{ bootstrap_age_public_key }}"]
+        content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}"
+        mode: "0644"
+        force: true
+      with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
+    - name: Enable Sops config
+      ansible.builtin.include_tasks:
+        file: ../sops/enable.yaml
+  rescue:
+    - name: Enable Sops config
+      ansible.builtin.include_tasks:
+        file: ../sops/enable.yaml

bootstrap/tasks/addons/main.yaml

@@ -27,3 +27,7 @@
 - name: Process addon weave-gitops
   when: weave_gitops.enabled | default(false)
   ansible.builtin.include_tasks: weave_gitops.yaml
+
+- name: Process addon discord-template-notifier
+  when: discord_template_notifier.enabled | default(false)
+  ansible.builtin.include_tasks: discord_template_notifier.yaml

bootstrap/templates/addons/discord-template-notifier/app/helmrelease.yaml.j2

@@ -0,0 +1,55 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: discord-template-notifier
+  namespace: default
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.5.1
+      interval: 30m
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    image:
+      repository: ghcr.io/morphy2k/rss-forwarder
+      tag: 0.6.1
+    env:
+      TZ: "${TIMEZONE}"
+    service:
+      main: &disableSvc
+        enabled: false
+    ingress:
+      main: *disableSvc
+    probes:
+      liveness: *disableSvc
+      readiness: *disableSvc
+      startup: *disableSvc
+    persistence:
+      data:
+        enabled: true
+        type: secret
+        name: discord-template-notifier-secret
+    resources:
+      requests:
+        cpu: 15m
+        memory: 110M
+      limits:
+        cpu: 15m
+        memory: 110M

bootstrap/templates/addons/discord-template-notifier/app/kustomization.yaml.j2

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: default
+resources:
+  - ./secret.sops.yaml
+  - ./helmrelease.yaml

bootstrap/templates/addons/discord-template-notifier/app/secret.sops.yaml.j2

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: discord-template-notifier-secret
+  namespace: default
+type: Opaque
+stringData:
+  config.toml: |-
+    [feeds.github-template]
+    url = "https://github.com/onedr0p/flux-cluster-template/commits/main/.atom"
+    interval = "10m"
+    retry_limit = 5
+    sink.type = "discord"
+    sink.url = "{{ discord_template_notifier.webhook_url }}"

bootstrap/templates/addons/discord-template-notifier/ks.yaml.j2

@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-apps-discord-template-notifier
+  namespace: flux-system
+spec:
+  path: ./kubernetes/apps/default/discord-template-notifier/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m

bootstrap/templates/kubernetes/apps/default/kustomization.yaml.j2

@@ -7,3 +7,6 @@ resources:
   {% if hajimari.enabled | default(false) %}
   - ./hajimari/ks.yaml
   {% endif %}
+  {% if discord_template_notifier.enabled | default(false) %}
+  - ./discord-template-notifier/ks.yaml
+  {% endif %}

bootstrap/vars/addons.sample.yaml

@@ -42,3 +42,10 @@ system_upgrade_controller:
   # ansible configuration files. Running ansible against an already provisioned
   # cluster with this enabled might cause your cluster to be downgraded.
   enabled: false
+
+# https://github.com/morphy2k/rss-forwarder
+discord_template_notifier:
+  # Will post commits from the template repository to the specified discord channel
+  # so it's easier to keep track of changes.
+  enabled: false
+  webhook_url: # Discord webhook url