diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000..32039e8 --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,25 @@ +creation_rules: + - path_regex: (environments/prd/.*) + key_groups: + - age: + - age18hnsrz7twfcecjgzu97gs6pcs5xe3vg3swfwz827833yx2qs6stsjer0aq # Mickael + - age1uhrgt2qzj4cj267xs9ff63yqdgqvtrz0szzwwr9c7m6glcst559qxh93kq # Alexandre + - age1wmt8s7nq7aut66npp7j9rysl7uszt6n7z8cm7q2fsxmext8pldus4nlh8a # Kevin + - age14slkhgu3zqjg3ljp8fre77ru9m83jd678nppdqfpkgpdr9en7etsl3ywr9 # Steven + - age1vtajxluy46cfx343e0kwssvrndu8sk2c3p5j8zmwzcg4j0f8rvnsv8l3ef # Erwan + - age1z2nhhjvvx708f86cdxmxn6j7waljdt2835vtv7lehy3q4tpttaxsvhyhuk # Oscar + - age1qa8rxew3h5txw5hshn099fa3r8h8ds27fr4pfsn45ya3ajnu2upqwfzaa4 # Loic + - age1taj6c5y8fep076sxzn0wyqxwwy8xfkgca2pswvsqmk9gx3p7psrqf77xn5 # Florian + - age1nef2pmuzen5zrgd5k2ek5tvtch43l22dektr5a274kyq5ts0yggs5e0xk6 # CI Argo prd + + - key_groups: + - age: + - age18hnsrz7twfcecjgzu97gs6pcs5xe3vg3swfwz827833yx2qs6stsjer0aq # Mickael + - age1uhrgt2qzj4cj267xs9ff63yqdgqvtrz0szzwwr9c7m6glcst559qxh93kq # Alexandre + - age1wmt8s7nq7aut66npp7j9rysl7uszt6n7z8cm7q2fsxmext8pldus4nlh8a # Kevin + - age14slkhgu3zqjg3ljp8fre77ru9m83jd678nppdqfpkgpdr9en7etsl3ywr9 # Steven + - age1vtajxluy46cfx343e0kwssvrndu8sk2c3p5j8zmwzcg4j0f8rvnsv8l3ef # Erwan + - age1z2nhhjvvx708f86cdxmxn6j7waljdt2835vtv7lehy3q4tpttaxsvhyhuk # Oscar + - age1qa8rxew3h5txw5hshn099fa3r8h8ds27fr4pfsn45ya3ajnu2upqwfzaa4 # Loic + - age1taj6c5y8fep076sxzn0wyqxwwy8xfkgca2pswvsqmk9gx3p7psrqf77xn5 # Florian + - age1xvckqrat9q6lfh24ax6y65qzde6krm4a2s0uc83ursr7gas8eavswf5kpl # CI Argo dev diff --git a/environments/poc/secrets.enc.yaml b/environments/poc/secrets.enc.yaml new file mode 100644 index 0000000..8bdf593 --- /dev/null +++ b/environments/poc/secrets.enc.yaml @@ -0,0 +1,103 @@ +s3: + auth: + accessKeyId: ENC[AES256_GCM,data:1gmrCVvQLBOYm8oU0fDz/NeGD0h5/D2bpQBMSK7/o2o=,iv:GcscH30c/jwu/9u+gaMgmPUqBiyePRdW/5W8Gof+9/o=,tag:DFF/KaE46V99W+SO9+5KGQ==,type:str] + secretAccessKey: ENC[AES256_GCM,data:WqJjCn10MvTnAXLCbzM9Huv5aj7BqTYC3YxhJVo3Whc=,iv:48cn5k75iSbbq93W+e/zdpIbubJHZRXbq9qpQF11J/Q=,tag:xCBgx0BNAx4jWtCpRPKZMA==,type:str] +openproject: + admin_user: + password: ENC[AES256_GCM,data:iWzrZHk=,iv:CvjYLes9T2oEnHGKBtB52NVxFc2517grk36g68nEGLI=,tag:HFFSJv3QBLmo2EX24u/lHQ==,type:str] +sops: + age: + - recipient: age1wg6z592fc3l6u8gceyqptqyy8l4eg76yq5987ffj8wn6hur0v39qdvvkd0 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4WUhERFVNdnkyckEzTDA0 + SWkxdHprZEp4VHdLN3k1dzgwdm1Mc2tmWXc4CjA4YjdUdjNXQ3lFbnpLM3M3Y0o2 + U1RHYVFCdzhtcWVVRXJSVEtsQllYN1kKLS0tIHoxckhLV0V0aURYRFp4RFdEVUgr + elh3MFFCQWl3eFFTN0hVSnd4S2hoM2sKL1B7PyfTs6feaLP3A4Qf0CWnYSN4Wiq/ + WvouHoQfwkJdqmYypjcAyW42vtcyRhWEncsgRs0DWXyqcKopM0H4Nw== + -----END AGE ENCRYPTED FILE----- + - recipient: age18hnsrz7twfcecjgzu97gs6pcs5xe3vg3swfwz827833yx2qs6stsjer0aq + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByc2Z1RS91czVGV3ptSHRZ + SVlaa0tvMEJHeGFEczlmOXcrTks4c1M2eHlrCjMyOGg1R0dnTVFBTS9iYWlrMUk3 + TXZFY2ZIQytCRlBZQ0hlYUIvc0NSRkEKLS0tIDAzQ1dIazdDMk5YcWtSZFBEdjVW + T0pmaytxRXVlcnZXajBqYld2TGlwK28Ke43EzrL7zBSwrfzjDE+oNmo0JEbbDVmS + 3KZYYDYM6VDLxO0lKKyqmC8Yx9EVFUw1UuOQh9SWvcGOK7ld4xEPBQ== + -----END AGE ENCRYPTED FILE----- + - recipient: age1uhrgt2qzj4cj267xs9ff63yqdgqvtrz0szzwwr9c7m6glcst559qxh93kq + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6WUw5YUVLU2h2Y2lEUkE3 + TVNScjFwTnAxVExrNXBKRzdTL0xrT1l5bjBnCjkxSmM5cWpHWE1NQmZ6TjVUazRF + U2swbWw2OW1DaVE3WFFsZldSOGRXK0kKLS0tIEhKNXpkc2huMi9DMmxWU1RnSmhp + Q29tYllyYlhvSDZRVDlDMXpsK2dMVDgKHNxbAUWscCS7iIeD/dyRimteWg/9QPba + 5xHx+Fn3/yozmavJAx+acRwdP6FeXnPbfWjMGUTb6SXS0G6uEFURvg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1wmt8s7nq7aut66npp7j9rysl7uszt6n7z8cm7q2fsxmext8pldus4nlh8a + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNeWJYdFNSZkx2MGhSUUxQ + ZmxDSW5RNmxCRGZQa1hlQlMwNHQ2WUs3eFhJClZJc0tEVHYyeVcrT2JrbStrVzIv + UVdRRFZaTlhWc1RUZkE1V01CT3c3MW8KLS0tIFRVQy8zRFBWMnVMZ2I2WHI1M1p4 + WUxDK0xRa2FlYXRGMklzR2V2QnMwbm8K3kXv0a9H/HWEVFCSB0uzsGWJAio3S6bU + dHWvo0qS4oL5yT4OQKz/OkyAUfMnz32jINe6FJihGsyQc/yb4YsrXQ== + -----END AGE ENCRYPTED FILE----- + - recipient: age14slkhgu3zqjg3ljp8fre77ru9m83jd678nppdqfpkgpdr9en7etsl3ywr9 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2U1hoSFBOOEp4anVwYmh1 + TzdQWVJjM1JhbGRlUng0bnV1TnE2aXUra21RCjVWYUlWY0RFUWxLZDJpSk9aQ2Ur + VUJzbE1yM1AwMm4ybmtKMzhBWk9oZW8KLS0tIFZjdnVrK0ZxdUY5Rld6bzZJeWk2 + aE1BSkpXeHFFejNtQW5neThSejk1dkEKfr5AMzx6gdsCd4ZZlTQEnI0fskbaGvdx + OKmfk8kRvUr7vxJ2H8euyCUZBR5R71FaPYd0u4BH9AwQ79A50a78dQ== + -----END AGE ENCRYPTED FILE----- + - recipient: age1vtajxluy46cfx343e0kwssvrndu8sk2c3p5j8zmwzcg4j0f8rvnsv8l3ef + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6Szk4c2hpOXJHTXEydzhn + UlBUZjlVOG9zVEx0a3p4cUdoWHFuQ3dKZEhzCjFoSXoraVNWMHVveldDSXFZcmRr + c3Z4Z2UwM2VIVnFqcXNxMk9CRk9nZU0KLS0tIDlOUkJhYVppeGpEcUtSd2lrNVo2 + blN5d0Voc2FtMGZFem9KTjUwdWNOS0UKSdgEFil5QUss+NijaZYng1VR4IthZPSn + h33UvGS+nT1UMBLk5MJKi+a/L/k7eWNXZfcBXw6RmT6Cs+5mLXLHaw== + -----END AGE ENCRYPTED FILE----- + - recipient: age1z2nhhjvvx708f86cdxmxn6j7waljdt2835vtv7lehy3q4tpttaxsvhyhuk + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5TzZ3U3g0cGdkYVp5R2tT + L09JaGZMZXJiSHdIeUNYRmNwUHFLeFE2cHhZCjZYUVR6Sk9TMmpIdlBrNEV2d3JR + ZDZaS0Vub0syTjVrY1dKakRkMnhSdVkKLS0tIHpUMDFtV1lQOEZTS3RUd2VlamZX + S3ZsU0NVZkxGRThybnVMYzdWSFJ1RTQKvZaV8eQ7zMJvCFlTLY2jkz4Jk/vBC5b3 + 8wJPHdaNybnOIY2QoVoUGJfwHN/Qj3VhaOcTjy0hx4DORKiaUVOCQg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1qa8rxew3h5txw5hshn099fa3r8h8ds27fr4pfsn45ya3ajnu2upqwfzaa4 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBudzVPUWZVa1N2WW15SUZv + RUZ6ZzNkcnR1bmVUMWs5dDRTN1R2djdQTkVNCjNmaVA5QjBJQTQ1MlZFdnZETDM1 + VzBKT3JHWUc2YmJIaGwzYThKbkpBNXcKLS0tIElNdjBndi9ON0ZjS0dJOUNSRXVl + WnVrUWNoRHVWYk4wRlZ2NGozUTkwdlEK2n2MbiEr/MDMru1PX4ZtQd+yPRQ6Lb9u + WppiRQmNqh2x+zW/ka3enXTQ8lnrK6+YFxHpPm1PzzOM5lKIwnU0TA== + -----END AGE ENCRYPTED FILE----- + - recipient: age1taj6c5y8fep076sxzn0wyqxwwy8xfkgca2pswvsqmk9gx3p7psrqf77xn5 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrV0JWS3BuempDOEpZNXFi + Slh0K1A0dFI2QlB0ZnhocUNMV1JNa3I3a1dVClZ1ZG5ZbDFhWVhwR1Y5TU8xRzFE + RXZua3Q0bnJ0d25iSDMyUEFwaklMVDgKLS0tIHUxL1ZMN0xqT1lEdDFUUlZGRTV5 + ajRxMmFqZDk1cWlhU3hpQlNOZE9XU0kKJ3EsHo3maDaKkMXRCidnJlxYiEAwbYqw + 7TjJ0W9SF30KOtaItmucgsrA4nZ5wkmReMak3kBqYD7NROz3hn8nUA== + -----END AGE ENCRYPTED FILE----- + - recipient: age1xvckqrat9q6lfh24ax6y65qzde6krm4a2s0uc83ursr7gas8eavswf5kpl + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxZ3pNZDkvaDR3cGVEcGt5 + aWN5Q1NEUk1QejNOMktyWGpVZFVkTkwwNUc4CnR0RFBSRERCd0ZpdzN1VFRSVDZq + YXNXS1lUOStwN2hRcTdZSUl0WUk5Z2MKLS0tIE5LOFdqa0xLb1d4T1pGVWQ0bEVG + RGFhS1UzT3FxVERwdm5QQXdoS2N1WU0KtGk2AlToWgQc2KCVPewSF8x7J0qTvQsr + AgaoZwTYAhgerdhOnZusIDeMA/IQKu2tK9YE6t6psHnzpMbsdqbDnA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-08-24T12:40:20Z" + mac: ENC[AES256_GCM,data:CCJimuAbPiFLiMx03l92CRXT4kSh2Md7GNEdvUcAZwwZGyNvuzGv0MTY0P9h6B7vxkONEDeRnDtS53gxr3BimURVIcyyG52Z4eTaGE40Nv/yFewB+XnE8U+vIvslLBmrecPTeNi2+6ZJGk1G+//mbwBF9IOtSTLS8EmUEUkFxPE=,iv:yrqf25QHeMuN1tsBN7zESv+hAqi6oa5UBwTRWCVmg+s=,tag:5RnM8SDmkKb0fIZsJHmPTQ==,type:str] + unencrypted_suffix: _unencrypted + version: 3.10.2 diff --git a/environments/poc/values.yaml b/environments/poc/values.yaml new file mode 100644 index 0000000..4a9b1a0 --- /dev/null +++ b/environments/poc/values.yaml @@ -0,0 +1,173 @@ +# see https://github.com/opf/helm-charts/blob/main/charts/openproject/values.yaml + +global: {} + # imagePullSecrets: + # - regcred-opicloud + +dbInit: + resources: + requests: + cpu: "50m" + memory: "128Mi" + limits: + cpu: "1" + memory: "256Mi" + +appInit: + resources: + requests: + cpu: "100m" + memory: "256Mi" + limits: + cpu: "1" + memory: "1Gi" + +ingress: + enabled: true + ingressClassName: nginx + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production + nginx.ingress.kubernetes.io/whitelist-source-range: "92.171.69.105,100.65.103.101/32,100.67.22.185/32,100.67.72.140/32,100.67.23.180/32,100.67.65.200/32,142.44.63.86/32,185.24.186.4/32" + host: "openproject-poc.dev.opicloud.fr" + tls: + enabled: true + secretName: "openproject-poc-dev-opicloud-fr-tls" + +networkPolicy: + enabled: false + +# imagePullSecrets: [] + +memcached: + bundled: true + image: + repository: bitnamilegacy/memcached + tag: 1.6.24-debian-12-r0 + resources: + requests: + memory: "256Mi" + cpu: "250m" + limits: + memory: "1Gi" + cpu: "2" + networkPolicy: + enabled: false + metrics: + enabled: true + image: + repository: bitnamilegacy/memcached-exporter + tag: 0.14.2-debian-12-r10 + resources: + requests: + memory: "64Mi" + cpu: "100m" + limits: + memory: "1Gi" + cpu: "2" + serviceMonitor: + enabled: true + +hocuspocus: + resources: + requests: + memory: "256Mi" + cpu: "250m" + limits: + memory: "1Gi" + cpu: "2" + +openproject: + https: true + hsts: true + + admin_user: + # password is encrypted in environments/poc/secrets.enc.yaml + password_reset: "true" + name: "admin" + mail: "admin@example.net" + + useTmpVolumes: true + tmpVolumesStorage: "10Gi" + tmpVolumesStorageClassName: "bsu-gp2" + +persistence: + enabled: false + accessModes: + - ReadWriteOnce + storageClassName: "bsu-gp2" + size: 5Gi + +s3: + # S3 is required for attachment storage when storageClass does not + # support ReadWriteMany + enabled: true + + region: eu-west-par + bucketName: openproject-poc + + endpoint: https://s3.eu-west-par.io.cloud.ovh.net/ + host: s3.eu-west-par.io.cloud.ovh.net + port: 443 + pathStyle: true + signatureVersion: 4 + enableSignatureV4Streaming: false + + directUploads: false + +podSecurityContext: + enabled: true + fsGroup: 1000 + +containerSecurityContext: + enabled: true + runAsUser: 1000 + runAsGroup: 1000 + allowPrivilegeEscalation: false + capabilities: + drop: + - "ALL" + seccompProfile: + type: "RuntimeDefault" + readOnlyRootFilesystem: false + runAsNonRoot: true + +postgresql: + bundled: true + primary: + resources: + requests: + cpu: "250m" + memory: "256Mi" + limits: + cpu: "1" + memory: "1Gi" + +autoscaling: + enabled: true + minReplicas: 1 + maxReplicas: 5 + targetCPUUtilizationPercentage: 70 + +metrics: + enabled: true + path: "/metrics" + port: 9394 + serviceMonitor: + enabled: true + +seederJob: + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "1" + memory: "1Gi" + +resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: "4" + memory: 4Gi diff --git a/helmfile.yaml.gotmpl b/helmfile.yaml.gotmpl new file mode 100644 index 0000000..55a54a9 --- /dev/null +++ b/helmfile.yaml.gotmpl @@ -0,0 +1,20 @@ +environments: + {{ .Environment.Name }}: + values: [] + +--- +repositories: +- name: openproject + url: https://charts.openproject.org + +releases: + - name: opr-poc + namespace: opr-poc + chart: openproject/openproject + version: 13.10.2 + installed: true + createNamespace: false + values: + - environments/{{ .Environment.Name }}/values.yaml + secrets: + - environments/{{ .Environment.Name }}/secrets.enc.yaml