Stage Mastodon Argo CD adoption with CloudNativePG

apps/mastodon/resources/ceph-object-user.yaml

@@ -0,0 +1,8 @@
+apiVersion: ceph.rook.io/v1
+kind: CephObjectStoreUser
+metadata:
+  name: mastodon
+  namespace: rook-ceph
+spec:
+  store: my-store
+  displayName: Mastodon media

apps/mastodon/resources/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ceph-object-user.yaml
+- webfinger.yaml

apps/mastodon/resources/webfinger.yaml

@@ -0,0 +1,41 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: webfinger-cors
+  namespace: mastodon
+spec:
+  headers:
+    customResponseHeaders:
+      Access-Control-Allow-Origin: "*"
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: webfinger-redirect
+  namespace: mastodon
+spec:
+  redirectRegex:
+    regex: ^https://brunner\.ninja/(.*)
+    replacement: https://social.brunner.ninja/${1}
+    permanent: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: brunner-ninja-webfinger
+  namespace: mastodon
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      # Keep apex-domain Fediverse discovery on Mastodon, but leave the
+      # Matrix discovery namespace to Synapse.
+      match: Host(`brunner.ninja`) && PathPrefix(`/.well-known/`) && !PathPrefix(`/.well-known/matrix/`)
+      priority: 1000
+      middlewares:
+        - name: webfinger-cors
+        - name: webfinger-redirect
+      services:
+        - name: mastodon-web
+          port: http

apps/mastodon/values.yaml

@@ -0,0 +1,151 @@
+image:
+  repository: ghcr.io/mastodon/mastodon
+  tag: v4.7.3
+  pullPolicy: IfNotPresent
+
+mastodon:
+  locale: en
+  localDomain: brunner.ninja
+  webDomain: social.brunner.ninja
+  singleUserMode: true
+  authorizedFetch: false
+  limitedFederationMode: false
+
+  createAdmin:
+    enabled: false
+
+  secrets:
+    existingSecret: mastodon-secrets
+
+  s3:
+    enabled: true
+    hostname: s3.brunner.ninja
+    endpoint: http://rook-ceph-rgw-my-store.rook-ceph.svc.cluster.local
+    protocol: https
+    region: keller
+    bucket: mastodon
+    existingSecret: mastodon-s3
+    aliasHost: s3.brunner.ninja/mastodon
+    # Mastodon maps this legacy flag inversely to aws-sdk's force_path_style.
+    # "false" is required for an in-cluster Ceph RGW endpoint.
+    overridePathStyle: "false"
+
+  pvc:
+    enabled: false
+
+  smtp:
+    domain: brunner.ninja
+    fromAddress: social@brunner.ninja
+    replyTo: daniel@brunner.ninja
+    server: smtp-relay.gmail.com
+    port: 587
+    authMethod: none
+    enableStartTls: auto
+    opensslVerifyMode: peer
+    tls: false
+    existingSecret: mastodon-smtp
+
+  web:
+    replicas: 1
+    resources:
+      requests:
+        cpu: 250m
+        memory: 768Mi
+      limits:
+        cpu: "2"
+        memory: 2Gi
+
+  sidekiq:
+    workers:
+      - name: all-queues
+        replicas: 1
+        concurrency: 15
+        queues:
+          - default,8
+          - push,6
+          - ingress,4
+          - mailers,2
+          - pull
+          - scheduler
+          - fasp
+        resources:
+          requests:
+            cpu: 250m
+            memory: 768Mi
+          limits:
+            cpu: "2"
+            memory: 2Gi
+    readinessProbe:
+      enabled: true
+
+  streaming:
+    replicas: 1
+    workers: 1
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+      limits:
+        cpu: "1"
+        memory: 768Mi
+
+  extraEnvVars:
+    TZ: Europe/Vienna
+    ALLOW_UNSAFE_AUTH_PROVIDER_REATTACH: "true"
+    ONE_CLICK_SSO_LOGIN: "true"
+    # Ceph RGW maps this S3 storage class to my-store.rgw.buckets.ec.
+    S3_STORAGE_CLASS: STANDARD_IA
+
+service:
+  type: ClusterIP
+
+ingress:
+  enabled: true
+  className: traefik
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+  hosts:
+    - host: social.brunner.ninja
+      paths:
+        - path: /
+          pathType: Prefix
+  tls: []
+
+httproute:
+  enabled: false
+
+postgresql:
+  hostname: mastodon-postgresql-rw.mastodon.svc.cluster.local
+  port: 5432
+  database: mastodon
+  existingSecret: mastodon-postgresql-app
+
+redis:
+  hostname: valkey.mastodon.svc.cluster.local
+  port: 6379
+  existingSecret: valkey-auth
+
+elasticsearch:
+  enabled: false
+
+externalAuth:
+  oidc:
+    enabled: true
+    displayName: brunner.ninja Auth
+    issuer: https://auth.brunner.ninja/application/o/mastodon/
+    discovery: true
+    scope: openid,profile,email
+    uidField: preferred_username
+    existingSecret: mastodon-oidc
+    redirectUri: https://social.brunner.ninja/auth/auth/openid_connect/callback
+    assumeEmailIsVerified: true
+  oauthGlobal:
+    omniauthOnly: true
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+  limits:
+    cpu: "1"
+    memory: 1Gi

bootstrap/kustomization.yaml

@@ -100,6 +100,7 @@ resources:
 - nextcloud.yaml
 - fediverse-project.yaml
 - mastodon-postgresql.yaml
+- mastodon.yaml
 - pixelfed.yaml
 - loops.yaml
 - nextcloud-whiteboard.yaml

bootstrap/mastodon.yaml

@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: mastodon
+  namespace: argocd
+spec:
+  project: fediverse
+  sources:
+  - repoURL: https://mastodon.github.io/helm-charts/
+    chart: mastodon
+    targetRevision: 1.2.5
+    helm:
+      releaseName: mastodon
+      valueFiles:
+      - $values/apps/mastodon/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    path: apps/mastodon/resources
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: mastodon
+  syncPolicy:
+    automated:
+      enabled: false
+      prune: false
+      selfHeal: false