deploy geopulse

Signed-off-by: Robert Günzler <r@gnzler.io>

5 files changed, 213 insertions, 0 deletions

diff --git a/bundles/geopulse/TODO b/bundles/geopulse/TODO
new file mode 100644
index 0000000..6affd5e
--- /dev/null
+++ b/bundles/geopulse/TODO
@@ -0,0 +1,2 @@
+https://github.com/tess1o/geopulse/blob/main/docker-compose.yml
+VERSINO=1.1.2
diff --git a/bundles/geopulse/files/kube.yaml b/bundles/geopulse/files/kube.yaml
new file mode 100644
index 0000000..b10bc7f
--- /dev/null
+++ b/bundles/geopulse/files/kube.yaml
@@ -0,0 +1,148 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: geopulse
+data:
+  GEOPULSE_UI_URL: https://where.gzr.im
+  GEOPULSE_AUTH_SECURE_COOKIES: true
+  GEOPULSE_AUTH_REGISTRATION_ENABLED: true
+  GEOPULSE_AUTH_OIDC_REGISTRATION_ENABLED: true
+  GEOPULSE_AUTH_PASSWORD_REGISTRATION_ENABLED: false
+  GEOPULSE_BACKEND_URL: http://localhost:8080
+  GEOPULSE_OIDC_ENABLED: true
+  GEOPULSE_OIDC_PROVIDER_GENERIC_ENABLED: true
+  GEOPULSE_OIDC_PROVIDER_GENERIC_NAME: login.gzr.im
+  GEOPULSE_OIDC_PROVIDER_GENERIC_DISCOVERY_URL: https://login.gzr.im/.well-known/openid-configuration
+  GEOPULSE_OIDC_PROVIDER_GENERIC_ICON: pi pi-lock
+  OSM_RESOLVER: 127.0.0.11 9.9.9.9
+  # GEOPULSE_GEOCODING_DELAY_MS: 1000
+  GEOPULSE_GEOCODING_PRIMARY_PROVIDER: nominatim
+  GEOPULSE_GEOCODING_FALLBACK_PROVIDER: photon
+  GEOPULSE_GEOCODING_PHOTON_ENABLED: true
+  GEOPULSE_GEOCODING_NOMINATIM_ENABLED: true
+  # GEOPULSE_SHARE_BASE_URL:
+  GEOPULSE_MQTT_ENABLED: false
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: geopulse
+  labels:
+    traefik.enable: true
+    traefik.http.routers.geopulse.tls: true
+    traefik.http.routers.geopulse.tls.certresolver: le
+    traefik.http.routers.geopulse.entrypoints: http,https
+    traefik.http.routers.geopulse.rule: Host(`where.gzr.im`)
+    traefik.http.routers.geopulse.service: geopulse
+    traefik.http.services.geopulse.loadbalancer.server.port: 80
+    # metrics
+    traefik.http.middlewares.replacepath-metrics-geopulse.replacepath.path: /api/prometheus/metrics
+    traefik.http.routers.geopulse-metrics.entrypoints: metrics
+    traefik.http.routers.geopulse-metrics.rule: Path(`/metrics/geopulse`)
+    traefik.http.routers.geopulse-metrics.middlewares: replacepath-metrics-geopulse
+spec:
+  restartPolicy: Never
+  dnsPolicy: Default
+  containers:
+    - name: backend
+      image: ghcr.io/tess1o/geopulse-backend:${version}-native
+      restartPolicy: OnFailure
+      envFrom:
+      - secretRef:
+          name: geopulse
+      - configMapRef:
+          name: geopulse
+      volumeMounts:
+        - name: keys
+          mountPath: /app/keys
+          readOnly: true
+      ports:
+        - containerPort: 8080
+          protocol: TCP
+      livenessProbe:
+        httpGet:
+          path: /api/health
+          port: 8080
+        initialDelaySeconds: 20
+      resources:
+        limits:
+          memory: 512Mi
+
+    - name: ui
+      image: ghcr.io/tess1o/geopulse-ui:${version}
+      envFrom:
+      - secretRef:
+          name: geopulse
+      - configMapRef:
+          name: geopulse
+      ports:
+        - containerPort: 80
+          protocol: TCP
+      livenessProbe:
+        httpGet:
+          path: /
+          port: 80
+        initialDelaySeconds: 5
+      resources:
+        limits:
+          memory: 256Mi
+
+    - name: postgres
+      image: index.docker.io/postgis/postgis:17-3.5
+      ports:
+        - containerPort: 5432
+          hostIP: 100.82.12.64
+          hostPort: 25432
+      volumeMounts:
+      - name: pg-data
+        mountPath: /var/lib/postgresql/data
+      envFrom:
+      - secretRef:
+          name: geopulse
+      - configMapRef:
+          name: geopulse
+      livenessProbe:
+        exec:
+          command: ["pg_isready", "-U", "geopulse"]
+        initialDelaySeconds: 5
+      resources:
+        limits:
+          memory: 128Mi
+      # Conservative PostgreSQL settings optimized for minimal resource usage
+      # Suitable for small deployments and idle GPS tracking workloads
+      args:
+        - -c
+        - shared_buffers=256MB
+        - -c
+        - work_mem=8MB
+        - -c
+        - maintenance_work_mem=64MB
+        - -c
+        - effective_cache_size=1GB
+        - -c
+        - max_wal_size=512MB
+        - -c
+        - checkpoint_completion_target=0.9
+        - -c
+        - wal_buffers=16MB
+        - -c
+        - random_page_cost=1.1
+        - -c
+        - effective_io_concurrency=100
+        - -c
+        - autovacuum_naptime=60s
+        - -c
+        - autovacuum_vacuum_scale_factor=0.2
+        - -c
+        - log_min_duration_statement=5000
+        - -c
+        - track_io_timing=on
+  volumes:
+  - name: keys
+    hostPath:
+      path: /var/lib/geopulse/keys
+      type: Directory
+  - name: pg-data
+    hostPath:
+      path: /var/lib/geopulse/data
+      type: DirectoryOrCreate
diff --git a/bundles/geopulse/files/secret.yaml b/bundles/geopulse/files/secret.yaml
new file mode 100644
index 0000000..29de6fb
--- /dev/null
+++ b/bundles/geopulse/files/secret.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: geopulse
+data:
+  POSTGRES_USER: ${repo.libs.util.base64("geopulse")}
+  POSTGRES_PASSWORD: ${repo.vault.password_for("geopulse_db_pw").b64encode().value}
+  POSTGRES_DB: ${repo.libs.util.base64("geopulse")}
+  GEOPULSE_OIDC_PROVIDER_GENERIC_CLIENT_ID: ${repo.libs.util.base64("geopulse")}
+  GEOPULSE_OIDC_PROVIDER_GENERIC_CLIENT_SECRET: ${repo.vault.password_for("authelia_client_secret_geopulse").b64encode().value}
+  GEOPULSE_POSTGRES_USERNAME: ${repo.libs.util.base64("geopulse")}
+  GEOPULSE_POSTGRES_PASSWORD: ${repo.vault.password_for("geopulse_db_pw").b64encode().value}
+  GEOPULSE_POSTGRES_URL: ${repo.libs.util.base64(f"jdbc:postgresql://localhost/geopulse")}
diff --git a/bundles/geopulse/items.py b/bundles/geopulse/items.py
new file mode 100644
index 0000000..f9fa882
--- /dev/null
+++ b/bundles/geopulse/items.py
@@ -0,0 +1,37 @@
+directories = {
+    "/var/lib/geopulse": {},
+}
+
+files = {
+    "/etc/deployments/geopulse/kube.yaml": {
+        "content_type": "mako",
+        "context": node.metadata.get("containers")["geopulse"],
+        "triggers": {"svc_s6rc:geopulse:restart"},
+    },
+    "/etc/deployments/geopulse/secret.yaml": {
+        "content_type": "mako",
+        "mode": "0600",
+        "triggers": {"svc_s6rc:geopulse:restart"},
+    },
+}
+
+actions = {
+    "keygen": {
+        "command": """
+            set -ex
+            cd /var/lib/geopulse/
+            curl -sSfL https://raw.githubusercontent.com/tess1o/geopulse/refs/tags/1.2.0/generate-keys.sh |
+                sed -e 's|KEYS_DIR="/keys"|KEYS_DIR="./keys"|' |
+                sh -
+        """,
+        "unless": """
+            cd /var/lib/geopulse/keys &&
+            test -f jwt-private-key.pem &&
+            test -f jwt-public-key.pem &&
+            test -f ai-encryption-key.txt
+        """,
+        "needs": {
+            "directory:/var/lib/geopulse",
+        },
+    },
+}
diff --git a/bundles/geopulse/metadata.py b/bundles/geopulse/metadata.py
new file mode 100644
index 0000000..21a55f6
--- /dev/null
+++ b/bundles/geopulse/metadata.py
@@ -0,0 +1,13 @@
+defaults = {
+    "backup": {
+        "includes": {
+            "/var/lib/geopulse",
+        }
+    },
+    "containers": {
+        "geopulse": {
+            "version": "1.3.0",
+        },
+    },
+    "metrics": {"geopulse": {}},
+}