deploy copyparty

Signed-off-by: Robert Günzler <r@gnzler.io>

6 files changed, 183 insertions, 0 deletions

diff --git a/bundles/authelia/files/configuration.yml b/bundles/authelia/files/configuration.yml
index e84d7e4..377f480 100644
--- a/bundles/authelia/files/configuration.yml
+++ b/bundles/authelia/files/configuration.yml
@@ -16,6 +16,13 @@ access_control:
     - domain: 'paper.gzr.im'
       resources: ['^/api/']
       policy: 'bypass'
+    # bypass for public resources
+    # - domain: 'cp.gzr.im'
+    #   resources: ['^/$', '^/public/']
+    #   policy: 'bypass'
+    # group-based access restrictions
+    - domain: 'cp.gzr.im'
+      subject: ['group:copyparty', 'group:admins']
       policy: 'one_factor'
     - domain: 'photos.gzr.im'
       subject: ['group:immich', 'group:admins']
diff --git a/bundles/copyparty/files/copyparty.conf b/bundles/copyparty/files/copyparty.conf
new file mode 100644
index 0000000..a087c38
--- /dev/null
+++ b/bundles/copyparty/files/copyparty.conf
@@ -0,0 +1,67 @@
+# vim: ft=ini et sw=2:
+
+[global]
+  # enable colors in log messages (both in logfiles and stdout)
+  # ansi
+  # disable logging for more performance
+  q
+
+  # trust traefik
+  rproxy: 1
+  xff-src: 10.89.0.0/16
+
+  # use user/group from authelia middleware
+  idp-h-usr: remote-user
+  idp-h-grp: remote-groups
+  idp-login: https://login.gzr.im/?rd=https://cp.gzr.im{dst}
+
+
+  # df: 16           # stop accepting uploads if less than 16 GB free disk space
+  # ver              # show copyparty version in the controlpanel
+  # grid             # show thumbnails/grid-view by default
+  # theme: 2         # monokai
+  # name: datasaver  # change the server-name that's displayed in the browser
+
+  # enable the prometheus endpoint, but disable the dupes counter (too slow)
+  stats, nos-dup
+
+  # make it harder for search engines to read your server
+  no-robots, force-js
+
+  # panic and shutdown instead of just showing the warning
+  vc-exit
+
+  html-head: <link rel="stylesheet" href="/custom.css">
+
+[/]
+  /w
+  accs:
+    # read-write-move-delete-admin
+    rwmda: @admins
+  flags:
+    e2ds       # enable file indexing & filesystem-scanning
+    e2ts       # enable metadata indexing
+
+[/public]
+  /w/public
+  accs:
+    r: *
+    rw: nobody
+    # read-write-move-delete-admin
+    rwmda: @admins
+
+[/u]
+  /w/u
+  accs:
+    rwmda: @admins
+
+[/u/${u}]
+  /w/u/${u}
+  accs:
+    r: *
+    rwmda: ${u}, @admins
+
+[/www]
+  /var/www
+  accs:
+    rwmda: @admins
diff --git a/bundles/copyparty/files/custom.css b/bundles/copyparty/files/custom.css
new file mode 100644
index 0000000..686b6b2
--- /dev/null
+++ b/bundles/copyparty/files/custom.css
@@ -0,0 +1,7 @@
+:root {
+	--font-main: sans-serif;
+	--font-serif: serif;
+	--font-mono: monospace;
+}
+
+.EasyMDEContainer .CodeMirror { font-family: var(--font-mono) }
diff --git a/bundles/copyparty/files/kube.yaml b/bundles/copyparty/files/kube.yaml
new file mode 100644
index 0000000..1ea4adf
--- /dev/null
+++ b/bundles/copyparty/files/kube.yaml
@@ -0,0 +1,64 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: copyparty
+  labels:
+    traefik.enable: true
+    traefik.http.routers.copyparty.tls: true
+    traefik.http.routers.copyparty.tls.certresolver: le
+    traefik.http.routers.copyparty.entrypoints: http,https
+    traefik.http.routers.copyparty.rule: Host(`cp.gzr.im`)
+    traefik.http.routers.copyparty.service: copyparty
+    traefik.http.routers.copyparty.middlewares: tls-redirect@file,authelia@file
+    traefik.http.services.copyparty.loadbalancer.server.port: 3923
+spec:
+  dnsPolicy: Default
+  containers:
+    - name: copyparty
+      image: ghcr.io/9001/copyparty-${edition}:${version}
+      env:
+        - name: LD_PRELOAD
+          value: /usr/lib/libmimalloc-secure.so.2
+        - name: PYTHONUNBUFFERED
+          value: 1
+        - name: PRTY_NO_CFSSL
+          value: 1
+        - name: PRTY_NO_PARAMIKO
+          value: 1
+        - name: PRTY_NO_PARTFTPY
+          value: 1
+        - name: PRTY_NO_PYFTPD
+          value: 1
+      volumeMounts:
+        - name: config
+          mountPath: /cfg
+        - name: webroot
+          mountPath: /w
+        # mount host paths we want to expose
+        - name: var-www
+          mountPath: /var/www
+      ports:
+        - containerPort: 3923
+          protocol: TCP
+      # livenessProbe:
+      #   exec:
+      #     command: ["wget", "--spider", "-q", "127.0.0.1:3923/?reset=/._"]
+      #     initialDelaySeconds: 15s
+      resources:
+        limits:
+          cpu: 100m
+          memory: 128Mi
+  volumes:
+    - name: config
+      hostPath:
+        path: /var/lib/copyparty/cfg
+        type: DirectoryOrCreate
+    - name: webroot
+      hostPath:
+        path: /var/www/copyparty
+        type: DirectoryOrCreate
+    # other host paths
+    - name: var-www
+      hostPath:
+        path: /var/www
+        type: Directory
diff --git a/bundles/copyparty/items.py b/bundles/copyparty/items.py
new file mode 100644
index 0000000..2054a5e
--- /dev/null
+++ b/bundles/copyparty/items.py
@@ -0,0 +1,21 @@
+directories = {
+    "/var/www/copyparty": {
+        "mode": "0775",
+        "group": "www-data",
+        "owner": "webdeploy",
+    },
+}
+
+files = {
+    "/etc/deployments/copyparty/kube.yaml": {
+        "content_type": "mako",
+        "context": node.metadata.get("containers")["copyparty"],
+        "triggers": {"svc_s6rc:copyparty:restart"},
+    },
+    "/var/lib/copyparty/cfg/copyparty.conf": {
+        "triggers": {"svc_s6rc:copyparty:restart"},
+    },
+    "/var/www/copyparty/custom.css": {
+        "triggers": {"svc_s6rc:copyparty:restart"},
+    },
+}
diff --git a/bundles/copyparty/metadata.py b/bundles/copyparty/metadata.py
new file mode 100644
index 0000000..a52c2f0
--- /dev/null
+++ b/bundles/copyparty/metadata.py
@@ -0,0 +1,17 @@
+defaults = {
+    "containers": {
+        "copyparty": {
+            "version": "1.20.12",
+            "edition": "iv",
+        },
+    },
+    # "backup": {
+    #     "/var/lib/copyparty": {},
+    # },
+    # "metrics": {
+    #     "copyparty": {},
+    # },
+    # "go": {
+    #     "copyparty": "https://copyparty.gzr.im",
+    # },
+}