From ae627ed6eab5c50846d0d7029a8d59b576d0f931 Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Thu, 22 Oct 2026 17:48:56 +0200
Subject: [PATCH] Stage Mastodon Argo CD adoption with CloudNativePG

---
 apps/mastodon/resources/ceph-object-user.yaml |   8 +
 apps/mastodon/resources/kustomization.yaml    |   5 +
 apps/mastodon/resources/webfinger.yaml        |  41 +++++
 apps/mastodon/values.yaml                     | 151 ++++++++++++++++++
 ...-ingressroute-brunner-ninja-webfinger.json |   0
 .../mastodon-middleware-webfinger-cors.json   |   0
 ...astodon-middleware-webfinger-redirect.json |   0
 bootstrap/kustomization.yaml                  |   1 +
 bootstrap/mastodon.yaml                       |  29 ++++
 9 files changed, 235 insertions(+)
 create mode 100644 apps/mastodon/resources/ceph-object-user.yaml
 create mode 100644 apps/mastodon/resources/kustomization.yaml
 create mode 100644 apps/mastodon/resources/webfinger.yaml
 create mode 100644 apps/mastodon/values.yaml
 rename apps/traefik/routes/{ => _deleted}/mastodon-ingressroute-brunner-ninja-webfinger.json (100%)
 rename apps/traefik/routes/{ => _deleted}/mastodon-middleware-webfinger-cors.json (100%)
 rename apps/traefik/routes/{ => _deleted}/mastodon-middleware-webfinger-redirect.json (100%)
 create mode 100644 bootstrap/mastodon.yaml

diff --git a/apps/mastodon/resources/ceph-object-user.yaml b/apps/mastodon/resources/ceph-object-user.yaml
new file mode 100644
index 0000000..15240d1
--- /dev/null
+++ b/apps/mastodon/resources/ceph-object-user.yaml
@@ -0,0 +1,8 @@
+apiVersion: ceph.rook.io/v1
+kind: CephObjectStoreUser
+metadata:
+  name: mastodon
+  namespace: rook-ceph
+spec:
+  store: my-store
+  displayName: Mastodon media
diff --git a/apps/mastodon/resources/kustomization.yaml b/apps/mastodon/resources/kustomization.yaml
new file mode 100644
index 0000000..1b3d9f5
--- /dev/null
+++ b/apps/mastodon/resources/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ceph-object-user.yaml
+- webfinger.yaml
diff --git a/apps/mastodon/resources/webfinger.yaml b/apps/mastodon/resources/webfinger.yaml
new file mode 100644
index 0000000..2aa74d4
--- /dev/null
+++ b/apps/mastodon/resources/webfinger.yaml
@@ -0,0 +1,41 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: webfinger-cors
+  namespace: mastodon
+spec:
+  headers:
+    customResponseHeaders:
+      Access-Control-Allow-Origin: "*"
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: webfinger-redirect
+  namespace: mastodon
+spec:
+  redirectRegex:
+    regex: ^https://brunner\.ninja/(.*)
+    replacement: https://social.brunner.ninja/${1}
+    permanent: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: brunner-ninja-webfinger
+  namespace: mastodon
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      # Keep apex-domain Fediverse discovery on Mastodon, but leave the
+      # Matrix discovery namespace to Synapse.
+      match: Host(`brunner.ninja`) && PathPrefix(`/.well-known/`) && !PathPrefix(`/.well-known/matrix/`)
+      priority: 1000
+      middlewares:
+        - name: webfinger-cors
+        - name: webfinger-redirect
+      services:
+        - name: mastodon-web
+          port: http
diff --git a/apps/mastodon/values.yaml b/apps/mastodon/values.yaml
new file mode 100644
index 0000000..d6a2400
--- /dev/null
+++ b/apps/mastodon/values.yaml
@@ -0,0 +1,151 @@
+image:
+  repository: ghcr.io/mastodon/mastodon
+  tag: v4.7.3
+  pullPolicy: IfNotPresent
+
+mastodon:
+  locale: en
+  localDomain: brunner.ninja
+  webDomain: social.brunner.ninja
+  singleUserMode: true
+  authorizedFetch: false
+  limitedFederationMode: false
+
+  createAdmin:
+    enabled: false
+
+  secrets:
+    existingSecret: mastodon-secrets
+
+  s3:
+    enabled: true
+    hostname: s3.brunner.ninja
+    endpoint: http://rook-ceph-rgw-my-store.rook-ceph.svc.cluster.local
+    protocol: https
+    region: keller
+    bucket: mastodon
+    existingSecret: mastodon-s3
+    aliasHost: s3.brunner.ninja/mastodon
+    # Mastodon maps this legacy flag inversely to aws-sdk's force_path_style.
+    # "false" is required for an in-cluster Ceph RGW endpoint.
+    overridePathStyle: "false"
+
+  pvc:
+    enabled: false
+
+  smtp:
+    domain: brunner.ninja
+    fromAddress: social@brunner.ninja
+    replyTo: daniel@brunner.ninja
+    server: smtp-relay.gmail.com
+    port: 587
+    authMethod: none
+    enableStartTls: auto
+    opensslVerifyMode: peer
+    tls: false
+    existingSecret: mastodon-smtp
+
+  web:
+    replicas: 1
+    resources:
+      requests:
+        cpu: 250m
+        memory: 768Mi
+      limits:
+        cpu: "2"
+        memory: 2Gi
+
+  sidekiq:
+    workers:
+      - name: all-queues
+        replicas: 1
+        concurrency: 15
+        queues:
+          - default,8
+          - push,6
+          - ingress,4
+          - mailers,2
+          - pull
+          - scheduler
+          - fasp
+        resources:
+          requests:
+            cpu: 250m
+            memory: 768Mi
+          limits:
+            cpu: "2"
+            memory: 2Gi
+    readinessProbe:
+      enabled: true
+
+  streaming:
+    replicas: 1
+    workers: 1
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+      limits:
+        cpu: "1"
+        memory: 768Mi
+
+  extraEnvVars:
+    TZ: Europe/Vienna
+    ALLOW_UNSAFE_AUTH_PROVIDER_REATTACH: "true"
+    ONE_CLICK_SSO_LOGIN: "true"
+    # Ceph RGW maps this S3 storage class to my-store.rgw.buckets.ec.
+    S3_STORAGE_CLASS: STANDARD_IA
+
+service:
+  type: ClusterIP
+
+ingress:
+  enabled: true
+  className: traefik
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+  hosts:
+    - host: social.brunner.ninja
+      paths:
+        - path: /
+          pathType: Prefix
+  tls: []
+
+httproute:
+  enabled: false
+
+postgresql:
+  hostname: mastodon-postgresql-rw.mastodon.svc.cluster.local
+  port: 5432
+  database: mastodon
+  existingSecret: mastodon-postgresql-app
+
+redis:
+  hostname: valkey.mastodon.svc.cluster.local
+  port: 6379
+  existingSecret: valkey-auth
+
+elasticsearch:
+  enabled: false
+
+externalAuth:
+  oidc:
+    enabled: true
+    displayName: brunner.ninja Auth
+    issuer: https://auth.brunner.ninja/application/o/mastodon/
+    discovery: true
+    scope: openid,profile,email
+    uidField: preferred_username
+    existingSecret: mastodon-oidc
+    redirectUri: https://social.brunner.ninja/auth/auth/openid_connect/callback
+    assumeEmailIsVerified: true
+  oauthGlobal:
+    omniauthOnly: true
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+  limits:
+    cpu: "1"
+    memory: 1Gi
diff --git a/apps/traefik/routes/mastodon-ingressroute-brunner-ninja-webfinger.json b/apps/traefik/routes/_deleted/mastodon-ingressroute-brunner-ninja-webfinger.json
similarity index 100%
rename from apps/traefik/routes/mastodon-ingressroute-brunner-ninja-webfinger.json
rename to apps/traefik/routes/_deleted/mastodon-ingressroute-brunner-ninja-webfinger.json
diff --git a/apps/traefik/routes/mastodon-middleware-webfinger-cors.json b/apps/traefik/routes/_deleted/mastodon-middleware-webfinger-cors.json
similarity index 100%
rename from apps/traefik/routes/mastodon-middleware-webfinger-cors.json
rename to apps/traefik/routes/_deleted/mastodon-middleware-webfinger-cors.json
diff --git a/apps/traefik/routes/mastodon-middleware-webfinger-redirect.json b/apps/traefik/routes/_deleted/mastodon-middleware-webfinger-redirect.json
similarity index 100%
rename from apps/traefik/routes/mastodon-middleware-webfinger-redirect.json
rename to apps/traefik/routes/_deleted/mastodon-middleware-webfinger-redirect.json
diff --git a/bootstrap/kustomization.yaml b/bootstrap/kustomization.yaml
index 6e5b705..4c37b41 100644
--- a/bootstrap/kustomization.yaml
+++ b/bootstrap/kustomization.yaml
@@ -100,6 +100,7 @@ resources:
 - nextcloud.yaml
 - fediverse-project.yaml
 - mastodon-postgresql.yaml
+- mastodon.yaml
 - pixelfed.yaml
 - loops.yaml
 - nextcloud-whiteboard.yaml
diff --git a/bootstrap/mastodon.yaml b/bootstrap/mastodon.yaml
new file mode 100644
index 0000000..3f71881
--- /dev/null
+++ b/bootstrap/mastodon.yaml
@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: mastodon
+  namespace: argocd
+spec:
+  project: fediverse
+  sources:
+  - repoURL: https://mastodon.github.io/helm-charts/
+    chart: mastodon
+    targetRevision: 1.2.5
+    helm:
+      releaseName: mastodon
+      valueFiles:
+      - $values/apps/mastodon/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    path: apps/mastodon/resources
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: mastodon
+  syncPolicy:
+    automated:
+      enabled: false
+      prune: false
+      selfHeal: false