helmrelease.yaml

# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/app-template-3.6.0/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: mosquitto
  namespace: mosquitto
spec:
  chart:
    spec:
      chart: app-template
      version: 3.6.0
      reconcileStrategy: ChartVersion
      sourceRef:
        kind: HelmRepository
        namespace: flux-system
        name: bjw-s
  interval: 1h
  driftDetection:
    mode: enabled
  values:
    controllers:
      mosquitto:
        annotations:
          secret.reloader.stakater.com/reload: mosquitto-auth
        initContainers:
          split-ca-crt:
            image:
              repository: alpine
              tag: 3.21.0@sha256:21dc6063fd678b478f57c0e13f47560d0ea4eeba26dfc947b2a4f81f686b9f45
              pullPolicy: IfNotPresent
            command:
              - sh
              - -c
              - |
                set -eux
                apk add --no-cache coreutils
                csplit -f /tls/ca/tls- -b "%1d.crt" -s -z /tls/tls.crt '/-----BEGIN CERTIFICATE-----/' '{1}'
        containers:
          app:
            image:
              repository: eclipse-mosquitto
              tag: 2.0.20@sha256:8b396cec28cd5e8e1a3aba1d9abdbddd42c454c80f703e77c1bec56e152fa54e
              pullPolicy: IfNotPresent
            command: [mosquitto, -c, /mosquitto/config/mosquitto.conf]
            env:
              TZ: America/Chicago
            probes:
              liveness: &probe
                enabled: true
                port: 1883
              readiness: *probe
              startup:
                <<: *probe
                spec:
                  failureThreshold: 30
                  periodSeconds: 5
            securityContext:
              readOnlyRootFilesystem: true
        pod:
          labels:
            policy.gabe565.com/egress-world: "true"
            policy.gabe565.com/ingress-ingress: "true"
            policy.gabe565.com/ingress-world: "true"

    service:
      mosquitto:
        controller: mosquitto
        type: LoadBalancer
        loadBalancerIP: 192.168.1.226
        externalTrafficPolicy: Local
        annotations:
          external-dns.alpha.kubernetes.io/hostname: ${app_url}
        ports:
          mqtt:
            primary: true
            port: 1883
          mqtts:
            port: 8883

    persistence:
      data:
        enabled: true
        storageClass: longhorn-ssd
        accessMode: ReadWriteOnce
        size: 64Mi
        advancedMounts:
          mosquitto:
            app:
              - path: /mosquitto/data
      config:
        enabled: true
        type: configMap
        name: mosquitto-config
        advancedMounts:
          mosquitto:
            app:
              - path: /mosquitto/config/mosquitto.conf
                subPath: mosquitto.conf
      auth:
        enabled: true
        type: secret
        name: mosquitto-auth
        advancedMounts:
          mosquitto:
            app:
              - path: /mosquitto/config/passwd
                subPath: passwd
              - path: /mosquitto/config/acl
                subPath: acl
      tls:
        enabled: true
        type: secret
        name: ${certificate_name}
        globalMounts:
          - path: /tls
      ca:
        enabled: true
        type: emptyDir
        globalMounts:
          - path: /tls/ca

    configMaps:
      config:
        enabled: true
        data:
          mosquitto.conf: |
            per_listener_settings false

            listener 1883
            listener 8883

            allow_anonymous false

            persistence true
            persistence_location /mosquitto/data
            autosave_interval 1800

            cafile /tls/ca/tls-1.crt
            certfile /tls/ca/tls-0.crt
            keyfile /tls/tls.key

            log_dest stderr
            log_type error
            log_type warning

            password_file /mosquitto/config/passwd
            acl_file /mosquitto/config/acl