diff options
Diffstat (limited to 'f3s/shuriken/helm-chart/templates')
| -rw-r--r-- | f3s/shuriken/helm-chart/templates/configmap.yaml | 50 | ||||
| -rw-r--r-- | f3s/shuriken/helm-chart/templates/cronjob.yaml | 91 | ||||
| -rw-r--r-- | f3s/shuriken/helm-chart/templates/persistent-volumes.yaml | 38 |
3 files changed, 179 insertions, 0 deletions
diff --git a/f3s/shuriken/helm-chart/templates/configmap.yaml b/f3s/shuriken/helm-chart/templates/configmap.yaml new file mode 100644 index 0000000..489e53e --- /dev/null +++ b/f3s/shuriken/helm-chart/templates/configmap.yaml @@ -0,0 +1,50 @@ +# Per-site shuriken.conf files, mounted read-only at /configs inside the +# CronJob container. The image entrypoint runs `shuriken --generate --config +# <conf>` once per *.conf here (alphabetical), so both albums are regenerated +# sequentially in a single daily run. +# +# Notes: +# - INCOMING_DIR uses `readlink -f` on the symlink under /data/shuriken.sh/ +# incoming/ so shuriken's `find` descends into the real syncthing tree +# (find does not follow a symlinked start directory). The resolved path +# contains spaces; shuriken handles that (see the existing alt conf). +# - DIST_DIR is a regular subdirectory under the NFS mount (NOT a mount +# point), so shuriken's staging atomic-swap rename works. +# - IMAGE_JOBS is set to 1 for documentation, but the container entrypoint +# also passes --image-jobs 1 (overridable via SHURIKEN_IMAGE_JOBS), so a +# single ImageMagick process runs at a time -- the N100 hosts are +# passively cooled and this batch job has no latency budget. +# - No SYNC_* settings: the container only generates the static site into +# dist/. Publishing to fishfinger/blowfish stays a separate concern. +apiVersion: v1 +kind: ConfigMap +metadata: + name: shuriken-config + namespace: services +data: + irregular-ninja.conf: | + TITLE='Irregular Ninja' + THUMBHEIGHT=400 + HEIGHT=1800 + MAXPREVIEWS=40 + IMAGE_JOBS=1 + SHUFFLE=yes + SPLASH_PAGE=yes + STATS_PAGE=yes + INCOMING_DIR=$(readlink -f /data/shuriken.sh/incoming/irregular.ninja) + DIST_DIR=/data/shuriken.sh/irregular.ninja/dist + TEMPLATE_DIR=/usr/share/shuriken/templates/default + TARBALL_INCLUDE=no + alt-irregular-ninja.conf: | + TITLE='Alternative Irregular Ninja' + THUMBHEIGHT=400 + HEIGHT=1800 + MAXPREVIEWS=40 + IMAGE_JOBS=1 + SHUFFLE=yes + SPLASH_PAGE=yes + STATS_PAGE=yes + INCOMING_DIR=$(readlink -f /data/shuriken.sh/incoming/alt.irregular.ninja) + DIST_DIR=/data/shuriken.sh/alt.irregular.ninja/dist + TEMPLATE_DIR=/usr/share/shuriken/templates/default + TARBALL_INCLUDE=no
\ No newline at end of file diff --git a/f3s/shuriken/helm-chart/templates/cronjob.yaml b/f3s/shuriken/helm-chart/templates/cronjob.yaml new file mode 100644 index 0000000..ddb97b8 --- /dev/null +++ b/f3s/shuriken/helm-chart/templates/cronjob.yaml @@ -0,0 +1,91 @@ +# shuriken: nightly regeneration of the irregular.ninja and alt.irregular.ninja +# static photo albums. The container entrypoint runs `shuriken --generate +# --config <conf>` once per /configs/*.conf (alphabetical), writing each site +# into /data/shuriken.sh/<site>/dist on the shared NFS export. +# +# Design: +# - concurrencyPolicy: Forbid -- a long generate run (large photo library, +# single image job) must not stack a second worker on top of it; shuriken's +# staging directories would race and the NFS write load would double. +# - backoffLimit: 0 -- a failed nightly run surfaces in the Job history and +# gets retried by the next night's schedule; spamming retries would just +# re-burn ImageMagick CPU on a persistent failure (e.g. NFS down). +# - activeDeadlineSeconds: 6h -- caps a runaway first-run backfill of a large +# library; steady state is far shorter. +# - runAsUser: 0 -- the syncthing source tree is mode 750 root:wheel on the +# NFS server, and the dist output is written as root to match the existing +# irregular.ninja layout. +# - Single image job by default (entrypoint --image-jobs 1); raise via the +# SHURIKEN_IMAGE_JOBS env if a faster one-off run is needed. +apiVersion: batch/v1 +kind: CronJob +metadata: + name: shuriken + namespace: services +spec: + # 04:00 local daily -- off-peak, and doesn't collide with the beets-art + # noon sweep. timeZone is GA in k8s 1.27+; k3s 1.32 supports it. + schedule: "0 4 * * *" + timeZone: Europe/Sofia + concurrencyPolicy: Forbid + startingDeadlineSeconds: 300 + successfulJobsHistoryLimit: 3 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + spec: + restartPolicy: Never + initContainers: + - name: nfs-check + image: busybox:stable + command: + - sh + - -c + - | + test -f /mnt/shuriken.sh/.nfs-sentinel || ( + echo "ERROR: NFS sentinel missing at /mnt/shuriken.sh/.nfs-sentinel" + echo "refusing to start; node likely has NFS unmounted" + echo "pod would otherwise write into a stale local-XFS shadow" + exit 1 + ) + volumeMounts: + - name: data + mountPath: /mnt + readOnly: true + containers: + - name: shuriken + image: registry.lan.buetow.org:30001/shuriken:0.13.2 + imagePullPolicy: Always + env: + # Default 1 image job (single-threaded); override here if a + # faster one-off run is acceptable. The entrypoint passes this + # to shuriken as --image-jobs. + - name: SHURIKEN_IMAGE_JOBS + value: "1" + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: "1" + memory: 1Gi + securityContext: + allowPrivilegeEscalation: false + runAsUser: 0 + runAsGroup: 0 + volumeMounts: + - name: data + mountPath: /data + - name: configs + mountPath: /configs + readOnly: true + volumes: + - name: data + persistentVolumeClaim: + claimName: shuriken-data-pvc + - name: configs + configMap: + name: shuriken-config
\ No newline at end of file diff --git a/f3s/shuriken/helm-chart/templates/persistent-volumes.yaml b/f3s/shuriken/helm-chart/templates/persistent-volumes.yaml new file mode 100644 index 0000000..4906714 --- /dev/null +++ b/f3s/shuriken/helm-chart/templates/persistent-volumes.yaml @@ -0,0 +1,38 @@ +# shuriken-data: the shared NFS export (/data/nfs/k3svolumes) mounted into the +# CronJob at /data. The whole tree is mounted (not just shuriken.sh/) because +# the incoming directories under shuriken.sh/incoming/ are relative symlinks +# into ../../syncthing/... -- they only resolve when /data exposes the full +# k3svolumes layout. The job writes only under /data/shuriken.sh/<site>/dist; +# everything else it reads. +# +# RWX (shared NFS) so the job may land on any r-node; the nfs-mount-monitor on +# each r-node keeps the mount healthy and the initContainer sentinel check +# refuses to start if NFS is down (avoids writing into a stale local-XFS +# shadow). The sentinel lives at shuriken.sh/.nfs-sentinel on the NFS server. +apiVersion: v1 +kind: PersistentVolume +metadata: + name: shuriken-data-pv +spec: + capacity: + storage: 20Gi + volumeMode: Filesystem + accessModes: + - ReadWriteMany + persistentVolumeReclaimPolicy: Retain + hostPath: + path: /data/nfs/k3svolumes + type: Directory +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: shuriken-data-pvc + namespace: services +spec: + storageClassName: "" + accessModes: + - ReadWriteMany + resources: + requests: + storage: 20Gi
\ No newline at end of file |