helmrelease.yaml

# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/app-template-3.6.0/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: tandoor
  namespace: tandoor
spec:
  chart:
    spec:
      chart: app-template
      version: 3.6.0
      reconcileStrategy: ChartVersion
      sourceRef:
        kind: HelmRepository
        namespace: flux-system
        name: bjw-s
  interval: 1h
  driftDetection:
    mode: enabled
  values:
    controllers:
      tandoor:
        strategy: RollingUpdate
        containers:
          app:
            image:
              repository: ghcr.io/tandoorrecipes/recipes
              tag: 1.5.27@sha256:05561e2f4b0f808337477bfdf5db087e4e21e7bea77ad05e13ada589bd76701d

            env:
              TZ: America/Chicago
              SECRET_KEY: ${secret_key}
              GUNICORN_WORKERS: "1"
              FRACTION_PREF_DEFAULT: "1"
              DEBUG: "0"

              DB_ENGINE: django.db.backends.postgresql
              POSTGRES_HOST: postgresql-rw
              POSTGRES_DB: tandoor
              POSTGRES_USER: tandoor
              POSTGRES_PASSWORD:
                secretKeyRef:
                  name: postgresql-app
                  key: password

              S3_ENDPOINT_URL: ${s3_url}
              S3_ACCESS_KEY: ${s3_access_key}
              S3_SECRET_ACCESS_KEY: ${s3_secret_key}
              S3_BUCKET_NAME: tandoor
              S3_REGION_NAME: us-central-1

              OAUTH_ID: authentik
              OAUTH_NAME: Authentik
              OAUTH_SERVER_URL: https://${oauth_host}/application/o/tandoor-recipes/.well-known/openid-configuration
              OAUTH_CLIENT_ID: ${oauth_client_id}
              OAUTH_CLIENT_SECRET: ${oauth_client_secret}
              SOCIAL_PROVIDERS: allauth.socialaccount.providers.openid_connect
              # language=json
              SOCIALACCOUNT_PROVIDERS:
                value: |-
                  {"openid_connect":{"SERVERS":[{"id": "$(OAUTH_ID)","name": "$(OAUTH_NAME)","server_url": "$(OAUTH_SERVER_URL)","token_auth_method": "client_secret_basic","APP": {"client_id": "$(OAUTH_CLIENT_ID)","secret": "$(OAUTH_CLIENT_SECRET)"}}]}}
                dependsOn: OAUTH_ID

            probes:
              startup:
                enabled: true
                spec:
                  failureThreshold: 30
                  periodSeconds: 5
              liveness:
                enabled: true
              readiness:
                enabled: true
            securityContext:
              readOnlyRootFilesystem: true
        pod:
          enableServiceLinks: false
          labels:
            policy.gabe565.com/egress-namespace: "true"
            policy.gabe565.com/egress-world: "true"
            policy.gabe565.com/ingress-ingress: "true"
          securityContext:
            runAsUser: 65534
            runAsGroup: 65534
            fsGroup: 65534

    service:
      tandoor:
        controller: tandoor
        ports:
          http:
            port: 8080

    persistence:
      static:
        enabled: true
        type: emptyDir
        globalMounts:
          - path: /opt/recipes/staticfiles
            subPath: staticfiles
          - path: /opt/recipes/cookbook/static/django_js_reverse
            subPath: django_js_reverse
      tmp:
        enabled: true
        type: emptyDir

    ingress:
      tandoor:
        enabled: true
        hosts:
          - host: ${app_url}
            paths:
              - path: /
                service: &svc
                  identifier: tandoor
                  port: http
        tls: &tls
          - secretName: ${certificate_name}
            hosts:
              - ${app_url}
      redirect-login:
        enabled: true
        annotations:
          nginx.ingress.kubernetes.io/temporal-redirect: https://${app_url}/accounts/oidc/authentik/login
        hosts:
          - host: ${app_url}
            paths:
              - path: /accounts/login
                service: *svc
        tls: *tls