freescout to kustomize

mail pull/push secrets were broken before and now

freescout/application.yaml

@@ -0,0 +1,233 @@
+---
+apiVersion: codemowers.cloud/v1beta1
+kind: OIDCMiddlewareClient
+metadata:
+  name: freescout
+  namespace: freescout
+spec:
+  displayName: Freescout Middleware
+  uri: 'https://freescout.k-space.ee'
+  allowedGroups:
+    - k-space:floor
+  headerMapping:
+    email: Remote-Email
+    groups: Remote-Groups
+    name: Remote-Name
+    user: Remote-User
+---
+apiVersion: codemowers.cloud/v1beta1
+kind: OIDCClient
+metadata:
+  name: freescout
+  namespace: freescout
+spec:
+  displayName: Freescout
+  uri: https://freescout.k-space.ee
+  redirectUris:
+    - https://freescout.k-space.ee/oauth_callback
+    - https://freescout.k-space.ee/oauth-login/callback/mlz500opr
+  allowedGroups:
+    - k-space:floor
+  grantTypes:
+    - authorization_code
+    - refresh_token
+  responseTypes:
+    - code
+  availableScopes:
+    - openid
+    - profile
+  pkce: false
+  secretRefreshPod:
+    apiVersion: v1
+    kind: Pod
+    spec:
+      volumes:
+        - name: tmp
+          emptyDir: {}
+      initContainers:
+        - name: jq
+          image: mirror.gcr.io/alpine/k8s:1.31.76@sha256:2a3fdd639c71c6cad69fbc8cac2467648855dac29961efec3b155466cc4fa730
+          command:
+            - /bin/bash
+            - '-c'
+            - >-
+              rm -fv /tmp/update.sql; jq
+              '{"name":"oauth.client_id","value":$ENV.OIDC_CLIENT_ID} | "UPDATE
+              options SET value=\(.value|tostring|@sh) WHERE
+              name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql; jq
+              '{"name":"oauth.client_secret","value":$ENV.OIDC_CLIENT_SECRET} |
+              "UPDATE options SET value=\(.value|tostring|@sh) WHERE
+              name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql; jq
+              '{"name":"oauth.auth_url","value":$ENV.OIDC_IDP_AUTH_URI} |
+              "UPDATE options SET value=\(.value + "?scope=openid+profile"
+              |tostring|@sh) WHERE name=\(.name|tostring|@sh) LIMIT 1;"' -n -r
+              >> /tmp/update.sql; jq
+              '{"name":"oauth.token_url","value":$ENV.OIDC_IDP_TOKEN_URI} |
+              "UPDATE options SET value=\(.value|tostring|@sh) WHERE
+              name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql; jq
+              '{"name":"oauth.user_url","value":$ENV.OIDC_IDP_USERINFO_URI}
+              | "UPDATE options SET value=\(.value|tostring|@sh) WHERE
+              name=\(.name|tostring|@sh) LIMIT 1;"' -n -r >> /tmp/update.sql;
+              cat /tmp/update.sql
+          envFrom:
+            - secretRef:
+                name: oidc-client-freescout-owner-secrets
+          resources: {}
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          imagePullPolicy: IfNotPresent
+      containers:
+        - name: mysql
+          image: mirror.gcr.io/library/mysql:latest
+          command:
+            - /bin/bash
+            - '-c'
+            - >-
+              mysql -u freescout freescout -h mariadb
+              -p${MYSQL_PWD} < /tmp/update.sql
+          env:
+            - name: MYSQL_PWD
+              valueFrom:
+                secretKeyRef:
+                  name: mariadb-secrets
+                  key: MYSQL_PASSWORD
+          resources: {}
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          imagePullPolicy: IfNotPresent
+      restartPolicy: OnFailure
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: freescout
+  namespace: freescout
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    external-dns.alpha.kubernetes.io/target: traefik.k-space.ee
+    traefik.ingress.kubernetes.io/router.middlewares: freescout-freescout@kubernetescrd
+spec:
+  rules:
+    - host: freescout.k-space.ee
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: freescout
+                port:
+                  number: 80
+  tls:
+    - hosts:
+        - "*.k-space.ee"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: freescout
+  namespace: freescout
+spec:
+  type: ClusterIP
+  selector:
+    app: freescout
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 80
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: freescout
+  namespace: freescout
+  labels:
+    app: freescout
+spec:
+  revisionHistoryLimit: 0
+  selector:
+    matchLabels:
+      app: freescout
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: freescout
+    spec:
+      containers: 
+        - name: freescout
+          image: ghcr.io/tiredofit/docker-freescout:php8.3-1.17.135
+          ports:
+            - containerPort: 80
+          env:
+            - name: DISPLAY_ERRORS
+              value: 'false'
+            - name: APP_DEBUG
+              value: 'false'
+            - name: SITE_URL
+              value: 'https://freescout.k-space.ee'
+            - name: APP_URL
+              value: 'https://freescout.k-space.ee'
+            - name: DB_HOST
+              value: mariadb
+            - name: DB_PORT
+              value: "3306"
+            - name: DB_NAME
+              value: freescout
+            - name: DB_USER
+              value: freescout
+            - name: TIMEZONE
+              value: Europe/Tallinn
+            - name: DB_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: mariadb-secrets
+                  key: MYSQL_PASSWORD
+          volumeMounts:
+            - name: freescout-attachments
+              mountPath: /www/html/storage/app/attachment   
+              subPath: attachment
+            - name: freescout-attachments
+              mountPath: /www/html/Modules
+              subPath: Modules   
+      volumes:
+        - name: freescout-attachments
+          persistentVolumeClaim:
+            claimName: freescout-attachments
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: freescout-attachments
+  namespace: freescout
+spec:
+  storageClassName: ceph-rbd
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi 
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: freescout
+  namespace: freescout
+spec:
+  groups:
+    - name: freescout
+      rules:
+        - alert: FreescoutSyncBroken
+          expr: time() - wildduck_last_login{email=~"(info|accounting)@k-space.ee"} > 300
+          for: 10m
+          labels:
+            severity: warning
+          annotations:
+            summary: Freescout mailbox synchronization is broken