futureporn
/
fp
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

dec 2024 progress
ci / build (push) Failing after 1s Details

This commit is contained in:
CJ_Clippy 2024-12-11 23:23:46 -08:00
parent 255503acb6
commit 140883a69c
185 changed files with 10435 additions and 2007 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
Tiltfile
View File

@ -116,6 +116,13 @@ k8s_yaml(helm(
'./charts/traefik/values-overrides.yaml' './charts/traefik/values-overrides.yaml'
] ]
)) ))
k8s_yaml(helm(
'./charts/keycloak/keycloak',
namespace='futureporn',
values=[
'./charts/keycloak/values-overrides.yaml'
]
))
k8s_yaml(helm( k8s_yaml(helm(
'./charts/fp', './charts/fp',
values=['./charts/fp/values.yaml'], values=['./charts/fp/values.yaml'],
@ -264,12 +271,13 @@ docker_build(
load('ext://uibutton', 'cmd_button') load('ext://uibutton', 'cmd_button')
cmd_button('supertokens:seed', cmd_button('keycloak:seed',
argv=['./scripts/supertokens-seed.sh'], argv=['./scripts/keycloak-seed.sh'],
resource='supertokens', resource='keycloak',
icon_name='start', icon_name='start',
text='create supertokens database', text='create keycloak database',
) )
cmd_button('postgres:restore', cmd_button('postgres:restore',
argv=['./scripts/postgres-restore.sh'], argv=['./scripts/postgres-restore.sh'],
resource='postgresql-primary', resource='postgresql-primary',
@ -332,6 +340,13 @@ docker_build(
dockerfile='dockerfiles/migrations.dockerfile', dockerfile='dockerfiles/migrations.dockerfile',
target='migrations', target='migrations',
pull=False, pull=False,
only=[
'./.npmrc',
'./package.json',
'./pnpm-lock.yaml',
'./pnpm-workspace.yaml',
'./services/migrations'
],
) )
## Uncomment the following for fp/next in dev mode ## Uncomment the following for fp/next in dev mode
@ -432,11 +447,11 @@ k8s_resource(
k8s_resource( k8s_resource(
workload='next', workload='next',
links=[ links=[
link('https://next.fp.sbtp.xyz'), link('https://next.fp.sbtp.xyz')
link('https://next.fp.sbtp.xyz/api/auth/dashboard'),
], ],
resource_deps=['postgrest', 'postgresql-primary'], resource_deps=['postgrest', 'postgresql-primary'],
labels=['frontend'], labels=['frontend'],
port_forwards=['3000'],
) )
@ -502,15 +517,25 @@ k8s_resource(
# labels=['database'], # labels=['database'],
# ) # )
# k8s_resource(
# workload='supertokens',
# links=[
# link('https://supertokens.fp.sbtp.xyz'),
# ],
# labels=['backend'],
# )
k8s_resource( k8s_resource(
workload='supertokens', workload='keycloak',
links=[ links=[
link('https://supertokens.fp.sbtp.xyz'), link('https://keycloak.fp.sbtp.xyz'),
], ],
port_forwards=['8080'],
labels=['backend'], labels=['backend'],
) )
# k8s_resource( # k8s_resource(
# workload='mailbox', # workload='mailbox',
# resource_deps=['postgresql-primary', 'postgrest'], # resource_deps=['postgresql-primary', 'postgrest'],
@ -596,7 +621,7 @@ k8s_resource(
) )
k8s_resource( k8s_resource(
workload='pgadmin4', workload='pgadmin4',
# port_forwards=['5050:80'], port_forwards=['5050:80'],
labels=['database'], labels=['database'],
) )
k8s_resource( k8s_resource(

5
charts/README.md
View File

@ -69,3 +69,8 @@ We override default values in the parent folder.
### phpmyadmin ### phpmyadmin
helm pull bitnami/phpmyadmin --version 17.0.7 --untar --destination ./charts/phpmyadmin helm pull bitnami/phpmyadmin --version 17.0.7 --untar --destination ./charts/phpmyadmin
### keycloak
helm pull bitnami/keycloak --version 24.2.2 --untar --destination ./charts/keycloak

3
charts/fp/templates/supertokens.yaml → charts/fp/templates-staging/supertokens.yaml
View File

@ -126,6 +126,8 @@ spec:
value: "true" value: "true"
- name: SUPERTOKENS_PORT - name: SUPERTOKENS_PORT
value: "{{ .Values.supertokens.port }}" value: "{{ .Values.supertokens.port }}"
- name: SUPERTOKENS_URL
value: {{ printf "https://%s" .Values.supertokens.hostname | quote }}
- name: POSTGRESQL_CONNECTION_URI - name: POSTGRESQL_CONNECTION_URI
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
@ -136,3 +138,4 @@ spec:
secretKeyRef: secretKeyRef:
name: supertokens name: supertokens
key: apiKeys key: apiKeys

9
charts/fp/templates/factory.yaml
View File

@ -44,8 +44,10 @@ spec:
secretKeyRef: secretKeyRef:
name: patreon name: patreon
key: creatorRefreshToken key: creatorRefreshToken
- name: SUPERTOKENS_URL
value: {{ printf "https://%s" .Values.supertokens.hostname | quote }}
- name: POSTGREST_URL - name: POSTGREST_URL
value: "{{ .Values.postgrest.url }}" value: {{ printf "https://%s" .Values.postgrest.hostname | quote }}
- name: SCOUT_URL - name: SCOUT_URL
value: "{{ .Values.scout.url }}" value: "{{ .Values.scout.url }}"
- name: CACHE_DIR - name: CACHE_DIR
@ -68,6 +70,11 @@ spec:
secretKeyRef: secretKeyRef:
name: capture name: capture
key: s3SecretAccessKey key: s3SecretAccessKey
- name: SUPERTOKENS_API_KEY
valueFrom:
secretKeyRef:
name: supertokens
key: apiKey
resources: resources:
limits: limits:
cpu: 250m cpu: 250m

44
charts/fp/templates/keycloak.yaml Normal file
View File

@ -0,0 +1,44 @@
## most of keycloak's config is done thru it's Helm Chart values-overrides.yaml in ../../keycloak
## however, there are some things that said Chart doesn't handle for us, such as Certificates and traefik HTTPRoutes.
## we handle those out-of-spec things here
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: keycloak-httproute
namespace: futureporn
spec:
parentRefs:
- name: traefik-gateway
hostnames:
- keycloak.fp.sbtp.xyz
rules:
- matches:
- path:
type: PathPrefix
value: /
filters:
- type: ResponseHeaderModifier
responseHeaderModifier:
add:
- name: x-cj-was-here
value: "true"
backendRefs:
- name: keycloak
port: 8080
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: keycloak
namespace: futureporn
spec:
secretName: keycloak-tls
issuerRef:
name: {{ .Values.certManager.issuer | quote }}
kind: ClusterIssuer
dnsNames:
- {{ .Values.keycloak.hostname | quote }}

20
charts/fp/templates/next.yaml
View File

@ -18,11 +18,20 @@ spec:
- name: NEXT_PUBLIC_UPPY_COMPANION_URL - name: NEXT_PUBLIC_UPPY_COMPANION_URL
value: "{{ .Values.uppy.url }}" value: "{{ .Values.uppy.url }}"
- name: NEXT_PUBLIC_POSTGREST_URL - name: NEXT_PUBLIC_POSTGREST_URL
value: "{{ .Values.postgrest.url }}" value: {{ printf "https://%s" .Values.postgrest.hostname | quote }}
- name: NEXT_PUBLIC_WEBSITE_DOMAIN - name: NEXT_PUBLIC_WEBSITE_DOMAIN
value: {{ printf "https://%s" .Values.next.hostname | quote }} value: {{ printf "https://%s" .Values.next.hostname | quote }}
- name: NEXT_PUBLIC_API_DOMAIN - name: NEXT_PUBLIC_API_DOMAIN
value: {{ .Values.next.hostname | quote }} value: {{ .Values.next.hostname | quote }}
- name: NEXTAUTH_URL
value: {{ printf "https://%s" .Values.next.hostname | quote }}
- name: NEXTAUTH_URL_INTERNAL
value: http://next.futureporn.svc.cluster.local
- name: NEXTAUTH_SECRET
valueFrom:
secretKeyRef:
name: next
key: nextAuthSecret
- name: PATREON_CLIENT_ID - name: PATREON_CLIENT_ID
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
@ -40,6 +49,15 @@ spec:
key: apiKeys key: apiKeys
- name: SUPERTOKENS_URL - name: SUPERTOKENS_URL
value: {{ printf "https://%s" .Values.supertokens.hostname | quote }} value: {{ printf "https://%s" .Values.supertokens.hostname | quote }}
- name: KEYCLOAK_CLIENT_ID
value: futureporn
- name: KEYCLOAK_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: keycloak
key: clientSecret
- name: KEYCLOAK_ISSUER
value: {{ .Values.keycloak.issuer | quote }}
ports: ports:
- name: web - name: web
containerPort: 3000 containerPort: 3000

4
charts/fp/values.yaml
View File

@ -96,6 +96,10 @@ supertokens:
port: 3348 port: 3348
hostname: supertokens.fp.sbtp.xyz hostname: supertokens.fp.sbtp.xyz
replicas: 1 replicas: 1
keycloak:
hostname: keycloak.fp.sbtp.xyz
replicas: 1
issuer: https://keycloak.fp.sbtp.xyz/realms/futureporn
logto: logto:
admin: admin:
port: 3002 port: 3002

25
charts/keycloak/keycloak/.helmignore Normal file
View File

@ -0,0 +1,25 @@
# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*~
# Various IDEs
.project
.idea/
*.tmproj
# img folder
img/
# Changelog
CHANGELOG.md

9
charts/keycloak/keycloak/Chart.lock Normal file
View File

@ -0,0 +1,9 @@
dependencies:
- name: postgresql
repository: oci://registry-1.docker.io/bitnamicharts
version: 16.2.2
- name: common
repository: oci://registry-1.docker.io/bitnamicharts
version: 2.27.0
digest: sha256:80a30494e1385f132dc70f43bf342dfbfc2250d4bea81ddea4de831617245d75
generated: "2024-11-22T07:51:44.565506689Z"

35
charts/keycloak/keycloak/Chart.yaml Normal file
View File

@ -0,0 +1,35 @@
annotations:
category: DeveloperTools
images: |
- name: keycloak
image: docker.io/bitnami/keycloak:26.0.6-debian-12-r0
- name: keycloak-config-cli
image: docker.io/bitnami/keycloak-config-cli:6.1.6-debian-12-r6
licenses: Apache-2.0
apiVersion: v2
appVersion: 26.0.6
dependencies:
- condition: postgresql.enabled
name: postgresql
repository: oci://registry-1.docker.io/bitnamicharts
version: 16.x.x
- name: common
repository: oci://registry-1.docker.io/bitnamicharts
tags:
- bitnami-common
version: 2.x.x
description: Keycloak is a high performance Java-based identity and access management
solution. It lets developers add an authentication layer to their applications with
minimum effort.
home: https://bitnami.com
icon: https://bitnami.com/assets/stacks/keycloak/img/keycloak-stack-220x234.png
keywords:
- keycloak
- access-management
maintainers:
- name: Broadcom, Inc. All Rights Reserved.
url: https://github.com/bitnami/charts
name: keycloak
sources:
- https://github.com/bitnami/charts/tree/main/bitnami/keycloak
version: 24.2.2

823
charts/keycloak/keycloak/README.md Normal file
View File

@ -0,0 +1,823 @@
<!--- app-name: Keycloak -->
# Bitnami package for Keycloak
Keycloak is a high performance Java-based identity and access management solution. It lets developers add an authentication layer to their applications with minimum effort.
[Overview of Keycloak](https://www.keycloak.org/)
Trademarks: This software listing is packaged by Bitnami. The respective trademarks mentioned in the offering are owned by the respective companies, and use of them does not imply any affiliation or endorsement.
## TL;DR
```console
helm install my-release oci://registry-1.docker.io/bitnamicharts/keycloak
```
Looking to use Keycloak in production? Try [VMware Tanzu Application Catalog](https://bitnami.com/enterprise), the commercial edition of the Bitnami catalog.
## Introduction
Bitnami charts for Helm are carefully engineered, actively maintained and are the quickest and easiest way to deploy containers on a Kubernetes cluster that are ready to handle production workloads.
This chart bootstraps a [Keycloak](https://github.com/bitnami/containers/tree/main/bitnami/keycloak) deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters.
## Prerequisites
- Kubernetes 1.23+
- Helm 3.8.0+
## Installing the Chart
To install the chart with the release name `my-release`:
```console
helm install my-release oci://REGISTRY_NAME/REPOSITORY_NAME/keycloak
```
> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`.
These commands deploy a Keycloak application on the Kubernetes cluster in the default configuration.
> **Tip**: List all releases using `helm list`
## Configuration and installation details
### Resource requests and limits
Bitnami charts allow setting resource requests and limits for all containers inside the chart deployment. These are inside the `resources` value (check parameter table). Setting requests is essential for production workloads and these should be adapted to your specific use case.
To make this process easier, the chart contains the `resourcesPreset` values, which automatically sets the `resources` section according to different presets. Check these presets in [the bitnami/common chart](https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15). However, in production workloads using `resourcePreset` is discouraged as it may not fully adapt to your specific needs. Find more information on container resource management in the [official Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
### [Rolling vs Immutable tags](https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-understand-rolling-tags-containers-index.html)
It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image.
Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist.
### Use an external database
Sometimes, you may want to have Keycloak connect to an external PostgreSQL database rather than a database within your cluster - for example, when using a managed database service, or when running a single database server for all your applications. To do this, set the `postgresql.enabled` parameter to `false` and specify the credentials for the external database using the `externalDatabase.*` parameters. Here is an example:
```text
postgresql.enabled=false
externalDatabase.host=myexternalhost
externalDatabase.user=myuser
externalDatabase.password=mypassword
externalDatabase.database=mydatabase
externalDatabase.port=5432
```
> NOTE: Only PostgreSQL database server is supported as external database
It is not supported but possible to run Keycloak with an external MSSQL database with the following settings:
```yaml
externalDatabase:
host: "mssql.example.com"
port: 1433
user: keycloak
database: keycloak
existingSecret: passwords
extraEnvVars:
- name: KC_DB # override values from the conf file
value: 'mssql'
- name: KC_DB_URL
value: 'jdbc:sqlserver://mssql.example.com:1433;databaseName=keycloak;'
```
### Importing and exporting a realm
#### Importing a realm
You can import a realm by setting the `KEYCLOAK_EXTRA_ARGS` to contain the `--import-realm` argument.
This will import all `*.json` under `/opt/bitnami/keycloak/data/import` files as a realm into keycloak as per the
official documentation [here](https://www.keycloak.org/server/importExport#_importing_a_realm_from_a_directory). You
can supply the files by mounting a volume e.g. with docker compose as follows:
```yaml
keycloak:
image: bitnami/keycloak:latest
volumes:
- /local/path/to/realms/folder:/opt/bitnami/keycloak/data/import
```
#### Exporting a realm
You can export a realm through the GUI but it will not export users even the option is set, this is a known keycloak
[bug](https://github.com/keycloak/keycloak/issues/23970).
By using the `kc.sh` script you can export a realm with users. Be sure to mount the export folder to a local folder:
```yaml
keycloak:
image: bitnami/keycloak:latest
volumes:
- /local/path/to/export/folder:/export
```
Then open a terminal in the running keycloak container and run:
```bash
kc.sh export --dir /export/ --users realm_file
````
This will export the all the realms with users to the `/export` folder.
### Configure Ingress
This chart provides support for Ingress resources. If you have an ingress controller installed on your cluster, such as [nginx-ingress-controller](https://github.com/bitnami/charts/tree/main/bitnami/nginx-ingress-controller) or [contour](https://github.com/bitnami/charts/tree/main/bitnami/contour) you can utilize the ingress controller to serve your application.To enable Ingress integration, set `ingress.enabled` to `true`.
The most common scenario is to have one host name mapped to the deployment. In this case, the `ingress.hostname` property can be used to set the host name. The `ingress.tls` parameter can be used to add the TLS configuration for this host.
However, it is also possible to have more than one host. To facilitate this, the `ingress.extraHosts` parameter (if available) can be set with the host names specified as an array. The `ingress.extraTLS` parameter (if available) can also be used to add the TLS configuration for extra hosts.
> NOTE: For each host specified in the `ingress.extraHosts` parameter, it is necessary to set a name, path, and any annotations that the Ingress controller should know about. Not all annotations are supported by all Ingress controllers, but [this annotation reference document](https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md) lists the annotations supported by many popular Ingress controllers.
Adding the TLS parameter (where available) will cause the chart to generate HTTPS URLs, and the application will be available on port 443. The actual TLS secrets do not have to be generated by this chart. However, if TLS is enabled, the Ingress record will not work until the TLS secret exists.
[Learn more about Ingress controllers](https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/).
### Configure admin Ingress
In addition to the Ingress resource described above, this chart also provides the ability to define an Ingress for the admin area of Keycloak, for example the `master` realm.
For this scenario, you can use the Keycloak Config CLI integration with the following values, where `keycloak-admin.example.com` is to be replaced by the actual hostname:
```yaml
adminIngress:
enabled: true
hostname: keycloak-admin.example.com
keycloakConfigCli:
enabled: true
configuration:
master.json: |
{
"realm" : "master",
"attributes": {
"frontendUrl": "https://keycloak-admin.example.com"
}
}
```
### Configure TLS Secrets for use with Ingress
This chart facilitates the creation of TLS secrets for use with the Ingress controller (although this is not mandatory). There are several common use cases:
- Generate certificate secrets based on chart parameters.
- Enable externally generated certificates.
- Manage application certificates via an external service (like [cert-manager](https://github.com/jetstack/cert-manager/)).
- Create self-signed certificates within the chart (if supported).
In the first two cases, a certificate and a key are needed. Files are expected in `.pem` format.
Here is an example of a certificate file:
> NOTE: There may be more than one certificate if there is a certificate chain.
```text
-----BEGIN CERTIFICATE-----
MIID6TCCAtGgAwIBAgIJAIaCwivkeB5EMA0GCSqGSIb3DQEBCwUAMFYxCzAJBgNV
...
jScrvkiBO65F46KioCL9h5tDvomdU1aqpI/CBzhvZn1c0ZTf87tGQR8NK7v7
-----END CERTIFICATE-----
```
Here is an example of a certificate key:
```text
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAvLYcyu8f3skuRyUgeeNpeDvYBCDcgq+LsWap6zbX5f8oLqp4
...
wrj2wDbCDCFmfqnSJ+dKI3vFLlEz44sAV8jX/kd4Y6ZTQhlLbYc=
-----END RSA PRIVATE KEY-----
```
- If using Helm to manage the certificates based on the parameters, copy these values into the `certificate` and `key` values for a given `*.ingress.secrets` entry.
- If managing TLS secrets separately, it is necessary to create a TLS secret with name `INGRESS_HOSTNAME-tls` (where INGRESS_HOSTNAME is a placeholder to be replaced with the hostname you set using the `*.ingress.hostname` parameter).
- If your cluster has a [cert-manager](https://github.com/jetstack/cert-manager) add-on to automate the management and issuance of TLS certificates, add to `*.ingress.annotations` the [corresponding ones](https://cert-manager.io/docs/usage/ingress/#supported-annotations) for cert-manager.
- If using self-signed certificates created by Helm, set both `*.ingress.tls` and `*.ingress.selfSigned` to `true`.
### Use with ingress offloading SSL
If your ingress controller has the SSL Termination, you should set `proxy` to `edge`.
### Manage secrets and passwords
This chart provides several ways to manage passwords:
- Values passed to the chart: In this scenario, a new secret including all the passwords will be created during the chart installation. When upgrading, it is necessary to provide the secrets to the chart as shown below. Replace the KEYCLOAK_ADMIN_PASSWORD, POSTGRESQL_PASSWORD and POSTGRESQL_PVC placeholders with the correct passwords and PVC name.
```console
helm upgrade keycloak bitnami/keycloak \
--set auth.adminPassword=KEYCLOAK_ADMIN_PASSWORD \
--set postgresql.postgresqlPassword=POSTGRESQL_PASSWORD \
--set postgresql.persistence.existingClaim=POSTGRESQL_PVC
```
- An existing secret with all the passwords via the `existingSecret` parameter.
### Add extra environment variables
In case you want to add extra environment variables (useful for advanced operations like custom init scripts), you can use the `extraEnvVars` property.
```yaml
extraEnvVars:
- name: KEYCLOAK_LOG_LEVEL
value: DEBUG
```
Alternatively, you can use a ConfigMap or a Secret with the environment variables. To do so, use the `extraEnvVarsCM` or the `extraEnvVarsSecret` values.
### Use Sidecars and Init Containers
If additional containers are needed in the same pod (such as additional metrics or logging exporters), they can be defined using the `sidecars` config parameter.
```yaml
sidecars:
- name: your-image-name
image: your-image
imagePullPolicy: Always
ports:
- name: portname
containerPort: 1234
```
If these sidecars export extra ports, extra port definitions can be added using the `service.extraPorts` parameter (where available), as shown in the example below:
```yaml
service:
extraPorts:
- name: extraPort
port: 11311
targetPort: 11311
```
> NOTE: This Helm chart already includes sidecar containers for the Prometheus exporters (where applicable). These can be activated by adding the `--enable-metrics=true` parameter at deployment time. The `sidecars` parameter should therefore only be used for any extra sidecar containers.
If additional init containers are needed in the same pod, they can be defined using the `initContainers` parameter. Here is an example:
```yaml
initContainers:
- name: your-image-name
image: your-image
imagePullPolicy: Always
ports:
- name: portname
containerPort: 1234
```
Learn more about [sidecar containers](https://kubernetes.io/docs/concepts/workloads/pods/) and [init containers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/).
### Initialize a fresh instance
The [Bitnami Keycloak](https://github.com/bitnami/containers/tree/main/bitnami/keycloak) image allows you to use your custom scripts to initialize a fresh instance. In order to execute the scripts, you can specify custom scripts using the `initdbScripts` parameter as dict.
In addition to this option, you can also set an external ConfigMap with all the initialization scripts. This is done by setting the `initdbScriptsConfigMap` parameter. Note that this will override the previous option.
The allowed extensions is `.sh`.
### Deploy extra resources
There are cases where you may want to deploy extra objects, such a ConfigMap containing your app's configuration or some extra deployment with a micro service used by your app. For covering this case, the chart allows adding the full specification of other objects using the `extraDeploy` parameter.
### Set Pod affinity
This chart allows you to set your custom affinity using the `affinity` parameter. Find more information about Pod's affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity).
As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/main/bitnami/common#affinities) chart. To do so, set the `podAffinityPreset`, `podAntiAffinityPreset`, or `nodeAffinityPreset` parameters.
## Parameters
### Global parameters
| Name | Description | Value |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ |
| `global.imageRegistry` | Global Docker image registry | `""` |
| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` |
| `global.defaultStorageClass` | Global default StorageClass for Persistent Volume(s) | `""` |
| `global.storageClass` | DEPRECATED: use global.defaultStorageClass instead | `""` |
| `global.compatibility.openshift.adaptSecurityContext` | Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) | `auto` |
### Common parameters
| Name | Description | Value |
| ------------------------ | --------------------------------------------------------------------------------------- | --------------- |
| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` |
| `nameOverride` | String to partially override common.names.fullname | `""` |
| `fullnameOverride` | String to fully override common.names.fullname | `""` |
| `namespaceOverride` | String to fully override common.names.namespace | `""` |
| `commonLabels` | Labels to add to all deployed objects | `{}` |
| `enableServiceLinks` | If set to false, disable Kubernetes service links in the pod spec | `true` |
| `commonAnnotations` | Annotations to add to all deployed objects | `{}` |
| `dnsPolicy` | DNS Policy for pod | `""` |
| `dnsConfig` | DNS Configuration pod | `{}` |
| `clusterDomain` | Default Kubernetes cluster domain | `cluster.local` |
| `extraDeploy` | Array of extra objects to deploy with the release | `[]` |
| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` |
| `diagnosticMode.command` | Command to override all containers in the the statefulset | `["sleep"]` |
| `diagnosticMode.args` | Args to override all containers in the the statefulset | `["infinity"]` |
### Keycloak parameters
| Name | Description | Value |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------- |
| `image.registry` | Keycloak image registry | `REGISTRY_NAME` |
| `image.repository` | Keycloak image repository | `REPOSITORY_NAME/keycloak` |
| `image.digest` | Keycloak image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
| `image.pullPolicy` | Keycloak image pull policy | `IfNotPresent` |
| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` |
| `image.debug` | Specify if debug logs should be enabled | `false` |
| `auth.adminUser` | Keycloak administrator user | `user` |
| `auth.adminPassword` | Keycloak administrator password for the new user | `""` |
| `auth.existingSecret` | Existing secret containing Keycloak admin password | `""` |
| `auth.passwordSecretKey` | Key where the Keycloak admin password is being stored inside the existing secret. | `""` |
| `auth.annotations` | Additional custom annotations for Keycloak auth secret object | `{}` |
| `customCaExistingSecret` | Name of the secret containing the Keycloak custom CA certificates. The secret will be mounted as a directory and configured using KC_TRUSTSTORE_PATHS. | `""` |
| `tls.enabled` | Enable TLS encryption. Required for HTTPs traffic. | `false` |
| `tls.autoGenerated` | Generate automatically self-signed TLS certificates. Currently only supports PEM certificates | `false` |
| `tls.existingSecret` | Existing secret containing the TLS certificates per Keycloak replica | `""` |
| `tls.usePem` | Use PEM certificates as input instead of PKS12/JKS stores | `false` |
| `tls.truststoreFilename` | Truststore filename inside the existing secret | `keycloak.truststore.jks` |
| `tls.keystoreFilename` | Keystore filename inside the existing secret | `keycloak.keystore.jks` |
| `tls.keystorePassword` | Password to access the keystore when it's password-protected | `""` |
| `tls.truststorePassword` | Password to access the truststore when it's password-protected | `""` |
| `tls.passwordsSecret` | Secret containing the Keystore and Truststore passwords. | `""` |
| `spi.existingSecret` | Existing secret containing the Keycloak truststore for SPI connection over HTTPS/TLS | `""` |
| `spi.truststorePassword` | Password to access the truststore when it's password-protected | `""` |
| `spi.truststoreFilename` | Truststore filename inside the existing secret | `keycloak-spi.truststore.jks` |
| `spi.passwordsSecret` | Secret containing the SPI Truststore passwords. | `""` |
| `spi.hostnameVerificationPolicy` | Verify the hostname of the server's certificate. Allowed values: "ANY", "WILDCARD", "STRICT". | `""` |
| `adminRealm` | Name of the admin realm | `master` |
| `production` | Run Keycloak in production mode. TLS configuration is required except when using proxy=edge. | `false` |
| `proxyHeaders` | Set Keycloak proxy headers | `""` |
| `proxy` | reverse Proxy mode edge, reencrypt, passthrough or none | `""` |
| `httpRelativePath` | Set the path relative to '/' for serving resources. Useful if you are migrating from older version which were using '/auth/' | `/` |
| `configuration` | Keycloak Configuration. Auto-generated based on other parameters when not specified | `""` |
| `existingConfigmap` | Name of existing ConfigMap with Keycloak configuration | `""` |
| `extraStartupArgs` | Extra default startup args | `""` |
| `enableDefaultInitContainers` | Deploy default init containers | `true` |
| `initdbScripts` | Dictionary of initdb scripts | `{}` |
| `initdbScriptsConfigMap` | ConfigMap with the initdb scripts (Note: Overrides `initdbScripts`) | `""` |
| `command` | Override default container command (useful when using custom images) | `[]` |
| `args` | Override default container args (useful when using custom images) | `[]` |
| `extraEnvVars` | Extra environment variables to be set on Keycloak container | `[]` |
| `extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars | `""` |
| `extraEnvVarsSecret` | Name of existing Secret containing extra env vars | `""` |
### Keycloak statefulset parameters
| Name | Description | Value |
| --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- |
| `replicaCount` | Number of Keycloak replicas to deploy | `1` |
| `revisionHistoryLimitCount` | Number of controller revisions to keep | `10` |
| `containerPorts.http` | Keycloak HTTP container port | `8080` |
| `containerPorts.https` | Keycloak HTTPS container port | `8443` |
| `containerPorts.metrics` | Keycloak metrics container port | `9000` |
| `extraContainerPorts` | Optionally specify extra list of additional port-mappings for Keycloak container | `[]` |
| `statefulsetAnnotations` | Optionally add extra annotations on the statefulset resource | `{}` |
| `podSecurityContext.enabled` | Enabled Keycloak pods' Security Context | `true` |
| `podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` |
| `podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` |
| `podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` |
| `podSecurityContext.fsGroup` | Set Keycloak pod's Security Context fsGroup | `1001` |
| `containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
| `containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` |
| `containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
| `containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` |
| `containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
| `containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
| `containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` |
| `containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` |
| `containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` |
| `containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
| `resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production). | `small` |
| `resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
| `livenessProbe.enabled` | Enable livenessProbe on Keycloak containers | `true` |
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `300` |
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `1` |
| `livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
| `livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` |
| `livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
| `readinessProbe.enabled` | Enable readinessProbe on Keycloak containers | `true` |
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `30` |
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
| `readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
| `readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
| `readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
| `startupProbe.enabled` | Enable startupProbe on Keycloak containers | `false` |
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `30` |
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `5` |
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` |
| `startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` |
| `startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
| `customLivenessProbe` | Custom Liveness probes for Keycloak | `{}` |
| `customReadinessProbe` | Custom Rediness probes Keycloak | `{}` |
| `customStartupProbe` | Custom Startup probes for Keycloak | `{}` |
| `lifecycleHooks` | LifecycleHooks to set additional configuration at startup | `{}` |
| `automountServiceAccountToken` | Mount Service Account token in pod | `true` |
| `hostAliases` | Deployment pod host aliases | `[]` |
| `podLabels` | Extra labels for Keycloak pods | `{}` |
| `podAnnotations` | Annotations for Keycloak pods | `{}` |
| `podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
| `podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` |
| `nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
| `nodeAffinityPreset.key` | Node label key to match. Ignored if `affinity` is set. | `""` |
| `nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set. | `[]` |
| `affinity` | Affinity for pod assignment | `{}` |
| `nodeSelector` | Node labels for pod assignment | `{}` |
| `tolerations` | Tolerations for pod assignment | `[]` |
| `topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `[]` |
| `podManagementPolicy` | Pod management policy for the Keycloak statefulset | `Parallel` |
| `priorityClassName` | Keycloak pods' Priority Class Name | `""` |
| `schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` |
| `terminationGracePeriodSeconds` | Seconds Keycloak pod needs to terminate gracefully | `""` |
| `updateStrategy.type` | Keycloak statefulset strategy type | `RollingUpdate` |
| `updateStrategy.rollingUpdate` | Keycloak statefulset rolling update configuration parameters | `{}` |
| `minReadySeconds` | How many seconds a pod needs to be ready before killing the next, during update | `0` |
| `extraVolumes` | Optionally specify extra list of additional volumes for Keycloak pods | `[]` |
| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for Keycloak container(s) | `[]` |
| `initContainers` | Add additional init containers to the Keycloak pods | `[]` |
| `sidecars` | Add additional sidecar containers to the Keycloak pods | `[]` |
### Exposure parameters
| Name | Description | Value |
| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
| `service.type` | Kubernetes service type | `ClusterIP` |
| `service.http.enabled` | Enable http port on service | `true` |
| `service.ports.http` | Keycloak service HTTP port | `80` |
| `service.ports.https` | Keycloak service HTTPS port | `443` |
| `service.nodePorts` | Specify the nodePort values for the LoadBalancer and NodePort service types. | `{}` |
| `service.sessionAffinity` | Control where client requests go, to the same pod or round-robin | `None` |
| `service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` |
| `service.clusterIP` | Keycloak service clusterIP IP | `""` |
| `service.loadBalancerIP` | loadBalancerIP for the SuiteCRM Service (optional, cloud specific) | `""` |
| `service.loadBalancerSourceRanges` | Address that are allowed when service is LoadBalancer | `[]` |
| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` |
| `service.annotations` | Additional custom annotations for Keycloak service | `{}` |
| `service.extraPorts` | Extra port to expose on Keycloak service | `[]` |
| `service.extraHeadlessPorts` | Extra ports to expose on Keycloak headless service | `[]` |
| `service.headless.annotations` | Annotations for the headless service. | `{}` |
| `service.headless.extraPorts` | Extra ports to expose on Keycloak headless service | `[]` |
| `ingress.enabled` | Enable ingress record generation for Keycloak | `false` |
| `ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `""` |
| `ingress.pathType` | Ingress path type | `ImplementationSpecific` |
| `ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` |
| `ingress.controller` | The ingress controller type. Currently supports `default` and `gce` | `default` |
| `ingress.hostname` | Default host for the ingress record (evaluated as template) | `keycloak.local` |
| `ingress.hostnameStrict` | Disables dynamically resolving the hostname from request headers. | `false` |
| `ingress.path` | Default path for the ingress record (evaluated as template) | `""` |
| `ingress.servicePort` | Backend service port to use | `http` |
| `ingress.annotations` | Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. | `{}` |
| `ingress.labels` | Additional labels for the Ingress resource. | `{}` |
| `ingress.tls` | Enable TLS configuration for the host defined at `ingress.hostname` parameter | `false` |
| `ingress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` |
| `ingress.extraHosts` | An array with additional hostname(s) to be covered with the ingress record | `[]` |
| `ingress.extraPaths` | Any additional arbitrary paths that may need to be added to the ingress under the main host. | `[]` |
| `ingress.extraTls` | The tls configuration for additional hostnames to be covered with this ingress record. | `[]` |
| `ingress.secrets` | If you're providing your own certificates, please use this to add the certificates as secrets | `[]` |
| `ingress.extraRules` | Additional rules to be covered with this ingress record | `[]` |
| `adminIngress.enabled` | Enable admin ingress record generation for Keycloak | `false` |
| `adminIngress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `""` |
| `adminIngress.pathType` | Ingress path type | `ImplementationSpecific` |
| `adminIngress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` |
| `adminIngress.controller` | The ingress controller type. Currently supports `default` and `gce` | `default` |
| `adminIngress.hostname` | Default host for the admin ingress record (evaluated as template) | `keycloak.local` |
| `adminIngress.path` | Default path for the admin ingress record (evaluated as template) | `""` |
| `adminIngress.servicePort` | Backend service port to use | `http` |
| `adminIngress.annotations` | Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. | `{}` |
| `adminIngress.labels` | Additional labels for the Ingress resource. | `{}` |
| `adminIngress.tls` | Enable TLS configuration for the host defined at `adminIngress.hostname` parameter | `false` |
| `adminIngress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` |
| `adminIngress.extraHosts` | An array with additional hostname(s) to be covered with the admin ingress record | `[]` |
| `adminIngress.extraPaths` | Any additional arbitrary paths that may need to be added to the admin ingress under the main host. | `[]` |
| `adminIngress.extraTls` | The tls configuration for additional hostnames to be covered with this ingress record. | `[]` |
| `adminIngress.secrets` | If you're providing your own certificates, please use this to add the certificates as secrets | `[]` |
| `adminIngress.extraRules` | Additional rules to be covered with this ingress record | `[]` |
| `networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `networkPolicy.kubeAPIServerPorts` | List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security) | `[]` |
| `networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` |
| `networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` |
### RBAC parameter
| Name | Description | Value |
| --------------------------------------------- | --------------------------------------------------------- | ------- |
| `serviceAccount.create` | Enable the creation of a ServiceAccount for Keycloak pods | `true` |
| `serviceAccount.name` | Name of the created ServiceAccount | `""` |
| `serviceAccount.automountServiceAccountToken` | Auto-mount the service account token in the pod | `false` |
| `serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` |
| `serviceAccount.extraLabels` | Additional labels for the ServiceAccount | `{}` |
| `rbac.create` | Whether to create and use RBAC resources or not | `false` |
| `rbac.rules` | Custom RBAC rules | `[]` |
### Other parameters
| Name | Description | Value |
| ----------------------------------------------------------- | -------------------------------------------------------------------------------------------- | ------- |
| `pdb.create` | Enable/disable a Pod Disruption Budget creation | `true` |
| `pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` |
| `pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable | `""` |
| `autoscaling.enabled` | Enable autoscaling for Keycloak | `false` |
| `autoscaling.minReplicas` | Minimum number of Keycloak replicas | `1` |
| `autoscaling.maxReplicas` | Maximum number of Keycloak replicas | `11` |
| `autoscaling.targetCPU` | Target CPU utilization percentage | `""` |
| `autoscaling.targetMemory` | Target Memory utilization percentage | `""` |
| `autoscaling.behavior.scaleUp.stabilizationWindowSeconds` | The number of seconds for which past recommendations should be considered while scaling up | `120` |
| `autoscaling.behavior.scaleUp.selectPolicy` | The priority of policies that the autoscaler will apply when scaling up | `Max` |
| `autoscaling.behavior.scaleUp.policies` | HPA scaling policies when scaling up | `[]` |
| `autoscaling.behavior.scaleDown.stabilizationWindowSeconds` | The number of seconds for which past recommendations should be considered while scaling down | `300` |
| `autoscaling.behavior.scaleDown.selectPolicy` | The priority of policies that the autoscaler will apply when scaling down | `Max` |
| `autoscaling.behavior.scaleDown.policies` | HPA scaling policies when scaling down | `[]` |
### Metrics parameters
| Name | Description | Value |
| ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- | --------- |
| `metrics.enabled` | Enable exposing Keycloak statistics | `false` |
| `metrics.service.ports.http` | Metrics service HTTP port | `8080` |
| `metrics.service.ports.https` | Metrics service HTTPS port | `8443` |
| `metrics.service.ports.metrics` | Metrics service Metrics port | `9000` |
| `metrics.service.annotations` | Annotations for enabling prometheus to access the metrics endpoints | `{}` |
| `metrics.service.extraPorts` | Add additional ports to the keycloak metrics service (i.e. admin port 9000) | `[]` |
| `metrics.serviceMonitor.enabled` | Create ServiceMonitor Resource for scraping metrics using PrometheusOperator | `false` |
| `metrics.serviceMonitor.port` | Metrics service HTTP port | `metrics` |
| `metrics.serviceMonitor.scheme` | Metrics service scheme | `http` |
| `metrics.serviceMonitor.tlsConfig` | Metrics service TLS configuration | `{}` |
| `metrics.serviceMonitor.endpoints` | The endpoint configuration of the ServiceMonitor. Path is mandatory. Port, scheme, tlsConfig, interval, timeout and labellings can be overwritten. | `[]` |
| `metrics.serviceMonitor.path` | Metrics service HTTP path. Deprecated: Use @param metrics.serviceMonitor.endpoints instead | `""` |
| `metrics.serviceMonitor.namespace` | Namespace which Prometheus is running in | `""` |
| `metrics.serviceMonitor.interval` | Interval at which metrics should be scraped | `30s` |
| `metrics.serviceMonitor.scrapeTimeout` | Specify the timeout after which the scrape is ended | `""` |
| `metrics.serviceMonitor.labels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}` |
| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` |
| `metrics.serviceMonitor.relabelings` | RelabelConfigs to apply to samples before scraping | `[]` |
| `metrics.serviceMonitor.metricRelabelings` | MetricRelabelConfigs to apply to samples before ingestion | `[]` |
| `metrics.serviceMonitor.honorLabels` | honorLabels chooses the metric's labels on collisions with target labels | `false` |
| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in prometheus. | `""` |
| `metrics.prometheusRule.enabled` | Create PrometheusRule Resource for scraping metrics using PrometheusOperator | `false` |
| `metrics.prometheusRule.namespace` | Namespace which Prometheus is running in | `""` |
| `metrics.prometheusRule.labels` | Additional labels that can be used so PrometheusRule will be discovered by Prometheus | `{}` |
| `metrics.prometheusRule.groups` | Groups, containing the alert rules. | `[]` |
### keycloak-config-cli parameters
| Name | Description | Value |
| --------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------- |
| `keycloakConfigCli.enabled` | Whether to enable keycloak-config-cli job | `false` |
| `keycloakConfigCli.image.registry` | keycloak-config-cli container image registry | `REGISTRY_NAME` |
| `keycloakConfigCli.image.repository` | keycloak-config-cli container image repository | `REPOSITORY_NAME/keycloak-config-cli` |
| `keycloakConfigCli.image.digest` | keycloak-config-cli container image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
| `keycloakConfigCli.image.pullPolicy` | keycloak-config-cli container image pull policy | `IfNotPresent` |
| `keycloakConfigCli.image.pullSecrets` | keycloak-config-cli container image pull secrets | `[]` |
| `keycloakConfigCli.annotations` | Annotations for keycloak-config-cli job | `{}` |
| `keycloakConfigCli.command` | Command for running the container (set to default if not set). Use array form | `[]` |
| `keycloakConfigCli.args` | Args for running the container (set to default if not set). Use array form | `[]` |
| `keycloakConfigCli.automountServiceAccountToken` | Mount Service Account token in pod | `true` |
| `keycloakConfigCli.hostAliases` | Job pod host aliases | `[]` |
| `keycloakConfigCli.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if keycloakConfigCli.resources is set (keycloakConfigCli.resources is recommended for production). | `small` |
| `keycloakConfigCli.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
| `keycloakConfigCli.containerSecurityContext.enabled` | Enabled keycloak-config-cli Security Context | `true` |
| `keycloakConfigCli.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` |
| `keycloakConfigCli.containerSecurityContext.runAsUser` | Set keycloak-config-cli Security Context runAsUser | `1001` |
| `keycloakConfigCli.containerSecurityContext.runAsGroup` | Set keycloak-config-cli Security Context runAsGroup | `1001` |
| `keycloakConfigCli.containerSecurityContext.runAsNonRoot` | Set keycloak-config-cli Security Context runAsNonRoot | `true` |
| `keycloakConfigCli.containerSecurityContext.privileged` | Set keycloak-config-cli Security Context privileged | `false` |
| `keycloakConfigCli.containerSecurityContext.readOnlyRootFilesystem` | Set keycloak-config-cli Security Context readOnlyRootFilesystem | `true` |
| `keycloakConfigCli.containerSecurityContext.allowPrivilegeEscalation` | Set keycloak-config-cli Security Context allowPrivilegeEscalation | `false` |
| `keycloakConfigCli.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` |
| `keycloakConfigCli.containerSecurityContext.seccompProfile.type` | Set keycloak-config-cli Security Context seccomp profile | `RuntimeDefault` |
| `keycloakConfigCli.podSecurityContext.enabled` | Enabled keycloak-config-cli pods' Security Context | `true` |
| `keycloakConfigCli.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` |
| `keycloakConfigCli.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` |
| `keycloakConfigCli.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` |
| `keycloakConfigCli.podSecurityContext.fsGroup` | Set keycloak-config-cli pod's Security Context fsGroup | `1001` |
| `keycloakConfigCli.backoffLimit` | Number of retries before considering a Job as failed | `1` |
| `keycloakConfigCli.podLabels` | Pod extra labels | `{}` |
| `keycloakConfigCli.podAnnotations` | Annotations for job pod | `{}` |
| `keycloakConfigCli.extraEnvVars` | Additional environment variables to set | `[]` |
| `keycloakConfigCli.nodeSelector` | Node labels for pod assignment | `{}` |
| `keycloakConfigCli.podTolerations` | Tolerations for job pod assignment | `[]` |
| `keycloakConfigCli.extraEnvVarsCM` | ConfigMap with extra environment variables | `""` |
| `keycloakConfigCli.extraEnvVarsSecret` | Secret with extra environment variables | `""` |
| `keycloakConfigCli.extraVolumes` | Extra volumes to add to the job | `[]` |
| `keycloakConfigCli.extraVolumeMounts` | Extra volume mounts to add to the container | `[]` |
| `keycloakConfigCli.initContainers` | Add additional init containers to the Keycloak config cli pod | `[]` |
| `keycloakConfigCli.sidecars` | Add additional sidecar containers to the Keycloak config cli pod | `[]` |
| `keycloakConfigCli.configuration` | keycloak-config-cli realms configuration | `{}` |
| `keycloakConfigCli.existingConfigmap` | ConfigMap with keycloak-config-cli configuration | `""` |
| `keycloakConfigCli.cleanupAfterFinished.enabled` | Enables Cleanup for Finished Jobs | `false` |
| `keycloakConfigCli.cleanupAfterFinished.seconds` | Sets the value of ttlSecondsAfterFinished | `600` |
### Database parameters
| Name | Description | Value |
| -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | ------------------ |
| `postgresql.enabled` | Switch to enable or disable the PostgreSQL helm chart | `true` |
| `postgresql.auth.postgresPassword` | Password for the "postgres" admin user. Ignored if `auth.existingSecret` with key `postgres-password` is provided | `""` |
| `postgresql.auth.username` | Name for a custom user to create | `bn_keycloak` |
| `postgresql.auth.password` | Password for the custom user to create | `""` |
| `postgresql.auth.database` | Name for a custom database to create | `bitnami_keycloak` |
| `postgresql.auth.existingSecret` | Name of existing secret to use for PostgreSQL credentials | `""` |
| `postgresql.auth.secretKeys.userPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. | `password` |
| `postgresql.architecture` | PostgreSQL architecture (`standalone` or `replication`) | `standalone` |
| `externalDatabase.host` | Database host | `""` |
| `externalDatabase.port` | Database port number | `5432` |
| `externalDatabase.user` | Non-root username for Keycloak | `bn_keycloak` |
| `externalDatabase.password` | Password for the non-root username for Keycloak | `""` |
| `externalDatabase.database` | Keycloak database name | `bitnami_keycloak` |
| `externalDatabase.existingSecret` | Name of an existing secret resource containing the database credentials | `""` |
| `externalDatabase.existingSecretHostKey` | Name of an existing secret key containing the database host name | `""` |
| `externalDatabase.existingSecretPortKey` | Name of an existing secret key containing the database port | `""` |
| `externalDatabase.existingSecretUserKey` | Name of an existing secret key containing the database user | `""` |
| `externalDatabase.existingSecretDatabaseKey` | Name of an existing secret key containing the database name | `""` |
| `externalDatabase.existingSecretPasswordKey` | Name of an existing secret key containing the database credentials | `""` |
| `externalDatabase.annotations` | Additional custom annotations for external database secret object | `{}` |
### Keycloak Cache parameters
| Name | Description | Value |
| ----------------- | -------------------------------------------------------------------------- | ------------ |
| `cache.enabled` | Switch to enable or disable the keycloak distributed cache for kubernetes. | `true` |
| `cache.stackName` | Set infinispan cache stack to use | `kubernetes` |
| `cache.stackFile` | Set infinispan cache stack filename to use | `""` |
### Keycloak Logging parameters
| Name | Description | Value |
| ---------------- | ------------------------------------------------------------------------------ | --------- |
| `logging.output` | Alternates between the default log output format or json format | `default` |
| `logging.level` | Allowed values as documented: FATAL, ERROR, WARN, INFO, DEBUG, TRACE, ALL, OFF | `INFO` |
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
```console
helm install my-release --set auth.adminPassword=secretpassword oci://REGISTRY_NAME/REPOSITORY_NAME/keycloak
```
> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`.
The above command sets the Keycloak administrator password to `secretpassword`.
> NOTE: Once this chart is deployed, it is not possible to change the application's access credentials, such as usernames or passwords, using Helm. To change these application credentials after deployment, delete any persistent volumes (PVs) used by the chart and re-deploy it, or use the application's built-in administrative tools if available.
Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,
```console
helm install my-release -f values.yaml oci://REGISTRY_NAME/REPOSITORY_NAME/keycloak
```
> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`.
> **Tip**: You can use the default [values.yaml](https://github.com/bitnami/charts/tree/main/bitnami/keycloak/values.yaml)
Keycloak realms, users and clients can be created from the Keycloak administration panel.
## Troubleshooting
Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues).
## Upgrading
### To 24.1.0
With this update the metrics service listening port is switched to 9000, the same as the keycloak management endpoint is using.
This can be changed by setting `metrics.service.ports.http` to a different value, e.g. 8080 like before this change.
### To 23.0.0
This major updates the PostgreSQL subchart to its newest major, 16.0.0, which uses PostgreSQL 17.x. Follow the [official instructions](https://www.postgresql.org/docs/17/upgrading.html) to upgrade to 17.x.
### To 21.0.0
This major release updates the keycloak branch to its newest major, 24.x.x. Follow the [upstream documentation](https://www.keycloak.org/docs/latest/upgrading/index.html#migrating-to-24-0-0) for upgrade instructions.
### To 20.0.0
This major bump changes the following security defaults:
- `runAsGroup` is changed from `0` to `1001`
- `readOnlyRootFilesystem` is set to `true`
- `resourcesPreset` is changed from `none` to the minimum size working in our test suites (NOTE: `resourcesPreset` is not meant for production usage, but `resources` adapted to your use case).
- `global.compatibility.openshift.adaptSecurityContext` is changed from `disabled` to `auto`.
This could potentially break any customization or init scripts used in your deployment. If this is the case, change the default values to the previous ones.
### To 19.0.0
This major release bumps the PostgreSQL chart version to [14.x.x](https://github.com/bitnami/charts/pull/22750); no major issues are expected during the upgrade.
### To 17.0.0
This major updates the PostgreSQL subchart to its newest major, 13.0.0. [Here](https://github.com/bitnami/charts/tree/master/bitnami/postgresql#to-1300) you can find more information about the changes introduced in that version.
### To 15.0.0
This major updates the default serviceType from `LoadBalancer` to `ClusterIP` to avoid inadvertently exposing Keycloak directly to the internet without an Ingress.
### To 12.0.0
This major updates the PostgreSQL subchart to its newest major, 12.0.0. [Here](https://github.com/bitnami/charts/tree/master/bitnami/postgresql#to-1200) you can find more information about the changes introduced in that version.
### To 10.0.0
This major release updates Keycloak to its major version `19`. Please, refer to the official [Keycloak migration documentation](https://www.keycloak.org/docs/latest/upgrading/index.html#migrating-to-19-0-0) for a complete list of changes and further information.
### To 9.0.0
This major release updates Keycloak to its major version `18`. Please, refer to the official [Keycloak migration documentation](https://www.keycloak.org/docs/latest/upgrading/index.html#migrating-to-18-0-0) for a complete list of changes and further information.
### To 8.0.0
This major release updates Keycloak to its major version `17`. Among other features, this new version has deprecated WildFly in favor of Quarkus, which introduces breaking changes like:
- Removal of `/auth` from the default context path.
- Changes in the configuration and deployment of custom providers.
- Significant changes in configuring Keycloak.
Please, refer to the official [Keycloak migration documentation](https://www.keycloak.org/docs/latest/upgrading/index.html#migrating-to-17-0-0) and [Migrating to Quarkus distribution document](https://www.keycloak.org/migration/migrating-to-quarkus) for a complete list of changes and further information.
### To 7.0.0
This major release updates the PostgreSQL subchart to its newest major *11.x.x*, which contain several changes in the supported values (check the [upgrade notes](https://github.com/bitnami/charts/tree/master/bitnami/postgresql#to-1100) to obtain more information).
#### Upgrading Instructions
To upgrade to *7.0.0* from *6.x*, it should be done reusing the PVC(s) used to hold the data on your previous release. To do so, follow the instructions below (the following example assumes that the release name is *keycloak* and the release namespace *default*):
1. Obtain the credentials and the names of the PVCs used to hold the data on your current release:
```console
export KEYCLOAK_PASSWORD=$(kubectl get secret --namespace default keycloak -o jsonpath="{.data.admin-password}" | base64 --decode)
export POSTGRESQL_PASSWORD=$(kubectl get secret --namespace default keycloak-postgresql -o jsonpath="{.data.postgresql-password}" | base64 --decode)
export POSTGRESQL_PVC=$(kubectl get pvc -l app.kubernetes.io/instance=keycloak,app.kubernetes.io/name=postgresql,role=primary -o jsonpath="{.items[0].metadata.name}")
```
1. Delete the PostgreSQL statefulset (notice the option *--cascade=false*) and secret:
```console
kubectl delete statefulsets.apps --cascade=false keycloak-postgresql
kubectl delete secret keycloak-postgresql --namespace default
```
1. Upgrade your release using the same PostgreSQL version:
```console
CURRENT_PG_VERSION=$(kubectl exec keycloak-postgresql-0 -- bash -c 'echo $BITNAMI_IMAGE_VERSION')
helm upgrade keycloak bitnami/keycloak \
--set auth.adminPassword=$KEYCLOAK_PASSWORD \
--set postgresql.image.tag=$CURRENT_PG_VERSION \
--set postgresql.auth.password=$POSTGRESQL_PASSWORD \
--set postgresql.persistence.existingClaim=$POSTGRESQL_PVC
```
1. Delete the existing PostgreSQL pods and the new statefulset will create a new one:
```console
kubectl delete pod keycloak-postgresql-0
```
### To 1.0.0
[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL.
#### What changes were introduced in this major version?
- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field.
- Move dependency information from the *requirements.yaml* to the *Chart.yaml*
- After running *helm dependency update*, a *Chart.lock* file is generated containing the same structure used in the previous *requirements.lock*
- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Chart.
#### Considerations when upgrading to this version
- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version does not support Helm v2 anymore.
- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3.
#### Useful links
- [Bitnami Tutorial](https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-resolve-helm2-helm3-post-migration-issues-index.html)
- [Helm docs](https://helm.sh/docs/topics/v2_v3_migration)
- [Helm Blog](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3)
## License
Copyright &copy; 2024 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
<http://www.apache.org/licenses/LICENSE-2.0>
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

104
charts/keycloak/keycloak/templates/NOTES.txt Normal file
View File

@ -0,0 +1,104 @@
CHART NAME: {{ .Chart.Name }}
CHART VERSION: {{ .Chart.Version }}
APP VERSION: {{ .Chart.AppVersion }}
** Please be patient while the chart is being deployed **
Keycloak can be accessed through the following DNS name from within your cluster:
{{ include "common.names.fullname" . }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }} (port {{ coalesce .Values.service.ports.http .Values.service.port }})
To access Keycloak from outside the cluster execute the following commands:
{{- if .Values.ingress.enabled }}
1. Get the Keycloak URL and associate its hostname to your cluster external IP:
export CLUSTER_IP=$(minikube ip) # On Minikube. Use: `kubectl cluster-info` on others K8s clusters
echo "Keycloak URL: http{{ if .Values.ingress.tls }}s{{ end }}://{{ (tpl .Values.ingress.hostname .) }}/"
echo "$CLUSTER_IP {{ (tpl .Values.ingress.hostname .) }}" | sudo tee -a /etc/hosts
{{- if .Values.adminIngress.enabled }}
The admin area of Keycloak has been configured to point to a different domain ({{ .Values.adminIngress.hostname }}). Please remember to update the `frontendUrl` property of the `{{ .Values.adminRealm | default "master" }}` (or any other) realm for it to work properly (see README for an example) :
echo "Keycloak admin URL: http{{ if .Values.adminIngress.tls }}s{{ end }}://{{ (tpl .Values.adminIngress.hostname .) }}/"
echo "$CLUSTER_IP {{ (tpl .Values.adminIngress.hostname .) }}" | sudo tee -a /etc/hosts
{{- end }}
{{- else }}
1. Get the Keycloak URL by running these commands:
{{- if contains "NodePort" .Values.service.type }}
export HTTP_NODE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='http')].nodePort}" services {{ include "common.names.fullname" . }})
{{- if .Values.tls.enabled }}
export HTTPS_NODE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='https')].nodePort}" services {{ include "common.names.fullname" . }})
{{- end }}
export NODE_IP=$(kubectl get nodes --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
echo "http://${NODE_IP}:${HTTP_NODE_PORT}/"
{{- if .Values.tls.enabled }}
echo "https://${NODE_IP}:${HTTPS_NODE_PORT}/"
{{- end }}
{{- else if contains "LoadBalancer" .Values.service.type }}
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
You can watch its status by running 'kubectl get --namespace {{ include "common.names.namespace" . }} svc -w {{ include "common.names.fullname" . }}'
export HTTP_SERVICE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='http')].port}" services {{ include "common.names.fullname" . }})
{{- if .Values.tls.enabled }}
export HTTPS_SERVICE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='https')].port}" services {{ include "common.names.fullname" . }})
{{- end }}
export SERVICE_IP=$(kubectl get svc --namespace {{ include "common.names.namespace" . }} {{ include "common.names.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
echo "http://${SERVICE_IP}:${HTTP_SERVICE_PORT}/"
{{- if .Values.tls.enabled }}
echo "https://${SERVICE_IP}:${HTTPS_SERVICE_PORT}/"
{{- end }}
{{- else if contains "ClusterIP" .Values.service.type }}
export HTTP_SERVICE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='http')].port}" services {{ include "common.names.fullname" . }})
{{- if .Values.tls.enabled }}
export HTTPS_SERVICE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='https')].port}" services {{ include "common.names.fullname" . }})
kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ include "common.names.fullname" . }} ${HTTP_SERVICE_PORT}:${HTTP_SERVICE_PORT} ${HTTPS_SERVICE_PORT}:${HTTPS_SERVICE_PORT} &
{{- else }}
kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ include "common.names.fullname" . }} ${HTTP_SERVICE_PORT}:${HTTP_SERVICE_PORT} &
{{- end }}
echo "http://127.0.0.1:${HTTP_SERVICE_PORT}/"
{{- if .Values.tls.enabled }}
echo "https://127.0.0.1:${HTTPS_SERVICE_PORT}/"
{{- end }}
{{- end }}
{{- end }}
2. Access Keycloak using the obtained URL.
{{- if and .Values.auth.adminUser .Values.auth.adminPassword }}
3. Access the Administration Console using the following credentials:
echo Username: {{ .Values.auth.adminUser }}
echo Password: $(kubectl get secret --namespace {{ include "common.names.namespace" . }} {{ include "keycloak.secretName" . }} -o jsonpath="{.data.{{ include "keycloak.secretKey" .}}}" | base64 -d)
{{- end }}
{{- if .Values.metrics.enabled }}
You can access the Prometheus metrics following the steps below:
1. Get the Keycloak Prometheus metrics URL by running:
{{- $metricsPort := coalesce .Values.metrics.service.ports.metrics .Values.metrics.service.port | toString }}
kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ printf "%s-metrics" (include "common.names.fullname" .) }} {{ $metricsPort }}:{{ $metricsPort }} &
echo "Keycloak Prometheus metrics URL: http://127.0.0.1:{{ $metricsPort }}/metrics"
2. Open a browser and access Keycloak Prometheus metrics using the obtained URL.
{{- end }}
{{- include "keycloak.validateValues" . }}
{{- include "common.warnings.rollingTag" .Values.image }}
{{- include "common.warnings.rollingTag" .Values.keycloakConfigCli.image }}
{{- include "common.warnings.resources" (dict "sections" (list "keycloakConfigCli" "") "context" $) }}
{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.keycloakConfigCli.image) "context" $) }}

348
charts/keycloak/keycloak/templates/_helpers.tpl Normal file
View File

@ -0,0 +1,348 @@
{{/*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{/*
Return the proper Keycloak image name
*/}}
{{- define "keycloak.image" -}}
{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }}
{{- end -}}
{{/*
Return the proper keycloak-config-cli image name
*/}}
{{- define "keycloak.keycloakConfigCli.image" -}}
{{ include "common.images.image" (dict "imageRoot" .Values.keycloakConfigCli.image "global" .Values.global) }}
{{- end -}}
{{/*
Return the keycloak-config-cli configuration configmap.
*/}}
{{- define "keycloak.keycloakConfigCli.configmapName" -}}
{{- if .Values.keycloakConfigCli.existingConfigmap -}}
{{- printf "%s" (tpl .Values.keycloakConfigCli.existingConfigmap $) -}}
{{- else -}}
{{- printf "%s-keycloak-config-cli-configmap" (include "common.names.fullname" .) -}}
{{- end -}}
{{- end -}}
{{/*
Return true if a configmap object should be created for keycloak-config-cli
*/}}
{{- define "keycloak.keycloakConfigCli.createConfigmap" -}}
{{- if and .Values.keycloakConfigCli.enabled .Values.keycloakConfigCli.configuration (not .Values.keycloakConfigCli.existingConfigmap) -}}
{{- true -}}
{{- end -}}
{{- end -}}
{{/*
Return the proper Docker Image Registry Secret Names
*/}}
{{- define "keycloak.imagePullSecrets" -}}
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.image .Values.keycloakConfigCli.image) "context" $) -}}
{{- end -}}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "keycloak.postgresql.fullname" -}}
{{- include "common.names.dependency.fullname" (dict "chartName" "postgresql" "chartValues" .Values.postgresql "context" $) -}}
{{- end -}}
{{/*
Create the name of the service account to use
*/}}
{{- define "keycloak.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
{{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
{{- else -}}
{{ default "default" .Values.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the path Keycloak is hosted on. This looks at httpRelativePath and returns it with a trailing slash. For example:
/ -> / (the default httpRelativePath)
/auth -> /auth/ (trailing slash added)
/custom/ -> /custom/ (unchanged)
*/}}
{{- define "keycloak.httpPath" -}}
{{ ternary .Values.httpRelativePath (printf "%s%s" .Values.httpRelativePath "/") (hasSuffix "/" .Values.httpRelativePath) }}
{{- end -}}
{{/*
Return the Keycloak configuration configmap
*/}}
{{- define "keycloak.configmapName" -}}
{{- if .Values.existingConfigmap -}}
{{- printf "%s" (tpl .Values.existingConfigmap $) -}}
{{- else -}}
{{- printf "%s-configuration" (include "common.names.fullname" .) -}}
{{- end -}}
{{- end -}}
{{/*
Return true if a configmap object should be created
*/}}
{{- define "keycloak.createConfigmap" -}}
{{- if and .Values.configuration (not .Values.existingConfigmap) }}
{{- true -}}
{{- end -}}
{{- end -}}
{{/*
Return the Database hostname
*/}}
{{- define "keycloak.databaseHost" -}}
{{- if eq .Values.postgresql.architecture "replication" }}
{{- ternary (include "keycloak.postgresql.fullname" .) (tpl .Values.externalDatabase.host $) .Values.postgresql.enabled -}}-primary
{{- else -}}
{{- ternary (include "keycloak.postgresql.fullname" .) (tpl .Values.externalDatabase.host $) .Values.postgresql.enabled -}}
{{- end -}}
{{- end -}}
{{/*
Return the Database port
*/}}
{{- define "keycloak.databasePort" -}}
{{- ternary "5432" .Values.externalDatabase.port .Values.postgresql.enabled | quote -}}
{{- end -}}
{{/*
Return the Database database name
*/}}
{{- define "keycloak.databaseName" -}}
{{- if .Values.postgresql.enabled }}
{{- if .Values.global.postgresql }}
{{- if .Values.global.postgresql.auth }}
{{- coalesce .Values.global.postgresql.auth.database .Values.postgresql.auth.database -}}
{{- else -}}
{{- .Values.postgresql.auth.database -}}
{{- end -}}
{{- else -}}
{{- .Values.postgresql.auth.database -}}
{{- end -}}
{{- else -}}
{{- .Values.externalDatabase.database -}}
{{- end -}}
{{- end -}}
{{/*
Return the Database user
*/}}
{{- define "keycloak.databaseUser" -}}
{{- if .Values.postgresql.enabled -}}
{{- if .Values.global.postgresql -}}
{{- if .Values.global.postgresql.auth -}}
{{- coalesce .Values.global.postgresql.auth.username .Values.postgresql.auth.username -}}
{{- else -}}
{{- .Values.postgresql.auth.username -}}
{{- end -}}
{{- else -}}
{{- .Values.postgresql.auth.username -}}
{{- end -}}
{{- else -}}
{{- .Values.externalDatabase.user -}}
{{- end -}}
{{- end -}}
{{/*
Return the Database encrypted password
*/}}
{{- define "keycloak.databaseSecretName" -}}
{{- if .Values.postgresql.enabled -}}
{{- if .Values.global.postgresql -}}
{{- if .Values.global.postgresql.auth -}}
{{- if .Values.global.postgresql.auth.existingSecret -}}
{{- tpl .Values.global.postgresql.auth.existingSecret $ -}}
{{- else -}}
{{- default (include "keycloak.postgresql.fullname" .) (tpl .Values.postgresql.auth.existingSecret $) -}}
{{- end -}}
{{- else -}}
{{- default (include "keycloak.postgresql.fullname" .) (tpl .Values.postgresql.auth.existingSecret $) -}}
{{- end -}}
{{- else -}}
{{- default (include "keycloak.postgresql.fullname" .) (tpl .Values.postgresql.auth.existingSecret $) -}}
{{- end -}}
{{- else -}}
{{- default (printf "%s-externaldb" .Release.Name) (tpl .Values.externalDatabase.existingSecret $) -}}
{{- end -}}
{{- end -}}
{{/*
Add environment variables to configure database values
*/}}
{{- define "keycloak.databaseSecretPasswordKey" -}}
{{- if .Values.postgresql.enabled -}}
{{- printf "%s" (.Values.postgresql.auth.secretKeys.userPasswordKey | default "password") -}}
{{- else -}}
{{- if .Values.externalDatabase.existingSecret -}}
{{- if .Values.externalDatabase.existingSecretPasswordKey -}}
{{- printf "%s" .Values.externalDatabase.existingSecretPasswordKey -}}
{{- else -}}
{{- print "db-password" -}}
{{- end -}}
{{- else -}}
{{- print "db-password" -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{- define "keycloak.databaseSecretHostKey" -}}
{{- if .Values.externalDatabase.existingSecretHostKey -}}
{{- printf "%s" .Values.externalDatabase.existingSecretHostKey -}}
{{- else -}}
{{- print "db-host" -}}
{{- end -}}
{{- end -}}
{{- define "keycloak.databaseSecretPortKey" -}}
{{- if .Values.externalDatabase.existingSecretPortKey -}}
{{- printf "%s" .Values.externalDatabase.existingSecretPortKey -}}
{{- else -}}
{{- print "db-port" -}}
{{- end -}}
{{- end -}}
{{- define "keycloak.databaseSecretUserKey" -}}
{{- if .Values.externalDatabase.existingSecretUserKey -}}
{{- printf "%s" .Values.externalDatabase.existingSecretUserKey -}}
{{- else -}}
{{- print "db-user" -}}
{{- end -}}
{{- end -}}
{{- define "keycloak.databaseSecretDatabaseKey" -}}
{{- if .Values.externalDatabase.existingSecretDatabaseKey -}}
{{- printf "%s" .Values.externalDatabase.existingSecretDatabaseKey -}}
{{- else -}}
{{- print "db-database" -}}
{{- end -}}
{{- end -}}
{{/*
Return the Keycloak initdb scripts configmap
*/}}
{{- define "keycloak.initdbScriptsCM" -}}
{{- if .Values.initdbScriptsConfigMap -}}
{{- printf "%s" .Values.initdbScriptsConfigMap -}}
{{- else -}}
{{- printf "%s-init-scripts" (include "common.names.fullname" .) -}}
{{- end -}}
{{- end -}}
{{/*
Return the secret containing the Keycloak admin password
*/}}
{{- define "keycloak.secretName" -}}
{{- $secretName := .Values.auth.existingSecret -}}
{{- if $secretName -}}
{{- printf "%s" (tpl $secretName $) -}}
{{- else -}}
{{- printf "%s" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{/*
Return the secret key that contains the Keycloak admin password
*/}}
{{- define "keycloak.secretKey" -}}
{{- $secretName := .Values.auth.existingSecret -}}
{{- if and $secretName .Values.auth.passwordSecretKey -}}
{{- printf "%s" .Values.auth.passwordSecretKey -}}
{{- else -}}
{{- print "admin-password" -}}
{{- end -}}
{{- end -}}
{{/*
Return the secret containing Keycloak HTTPS/TLS certificates
*/}}
{{- define "keycloak.tlsSecretName" -}}
{{- $secretName := .Values.tls.existingSecret -}}
{{- if $secretName -}}
{{- printf "%s" (tpl $secretName $) -}}
{{- else -}}
{{- printf "%s-crt" (include "common.names.fullname" .) -}}
{{- end -}}
{{- end -}}
{{/*
Return the secret containing Keycloak HTTPS/TLS keystore and truststore passwords
*/}}
{{- define "keycloak.tlsPasswordsSecretName" -}}
{{- $secretName := .Values.tls.passwordsSecret -}}
{{- if $secretName -}}
{{- printf "%s" (tpl $secretName $) -}}
{{- else -}}
{{- printf "%s-tls-passwords" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{/*
Return the secret containing Keycloak SPI TLS certificates
*/}}
{{- define "keycloak.spiPasswordsSecretName" -}}
{{- $secretName := .Values.spi.passwordsSecret -}}
{{- if $secretName -}}
{{- printf "%s" (tpl $secretName $) -}}
{{- else -}}
{{- printf "%s-spi-passwords" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{/*
Return true if a TLS secret object should be created
*/}}
{{- define "keycloak.createTlsSecret" -}}
{{- if and .Values.tls.enabled .Values.tls.autoGenerated (not .Values.tls.existingSecret) }}
{{- true -}}
{{- end -}}
{{- end -}}
{{/*
Compile all warnings into a single message.
*/}}
{{- define "keycloak.validateValues" -}}
{{- $messages := list -}}
{{- $messages := append $messages (include "keycloak.validateValues.database" .) -}}
{{- $messages := append $messages (include "keycloak.validateValues.tls" .) -}}
{{- $messages := append $messages (include "keycloak.validateValues.production" .) -}}
{{- $messages := without $messages "" -}}
{{- $message := join "\n" $messages -}}
{{- if $message -}}
{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}}
{{- end -}}
{{- end -}}
{{/* Validate values of Keycloak - database */}}
{{- define "keycloak.validateValues.database" -}}
{{- if and (not .Values.postgresql.enabled) (not .Values.externalDatabase.host) (and (not .Values.externalDatabase.password) (not .Values.externalDatabase.existingSecret)) -}}
keycloak: database
You disabled the PostgreSQL sub-chart but did not specify an external PostgreSQL host.
Either deploy the PostgreSQL sub-chart (--set postgresql.enabled=true),
or set a value for the external database host (--set externalDatabase.host=FOO)
and set a value for the external database password (--set externalDatabase.password=BAR)
or existing secret (--set externalDatabase.existingSecret=BAR).
{{- end -}}
{{- end -}}
{{/* Validate values of Keycloak - TLS enabled */}}
{{- define "keycloak.validateValues.tls" -}}
{{- if and .Values.tls.enabled (not .Values.tls.autoGenerated) (not .Values.tls.existingSecret) }}
keycloak: tls.enabled
In order to enable TLS, you also need to provide
an existing secret containing the Keystore and Truststore or
enable auto-generated certificates.
{{- end -}}
{{- end -}}
{{/* Validate values of Keycloak - Production mode enabled */}}
{{- define "keycloak.validateValues.production" -}}
{{- if and .Values.production (not .Values.tls.enabled) (not (eq .Values.proxy "edge")) (empty .Values.proxyHeaders) -}}
keycloak: production
In order to enable Production mode, you also need to enable HTTPS/TLS
using the value 'tls.enabled' and providing an existing secret containing the Keystore and Trustore.
{{- end -}}
{{- end -}}

61
charts/keycloak/keycloak/templates/admin-ingress.yaml Normal file
View File

@ -0,0 +1,61 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.adminIngress.enabled }}
apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }}
kind: Ingress
metadata:
name: {{ include "common.names.fullname" . }}-admin
namespace: {{ include "common.names.namespace" . | quote }}
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.adminIngress.labels .Values.commonLabels ) "context" . ) }}
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if or .Values.adminIngress.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.adminIngress.annotations .Values.commonAnnotations ) "context" . ) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
{{- end }}
spec:
{{- if and .Values.adminIngress.ingressClassName (eq "true" (include "common.ingress.supportsIngressClassname" .)) }}
ingressClassName: {{ .Values.adminIngress.ingressClassName | quote }}
{{- end }}
rules:
{{- if .Values.adminIngress.hostname }}
- host: {{ (tpl .Values.adminIngress.hostname .) | quote }}
http:
paths:
{{- if .Values.adminIngress.extraPaths }}
{{- toYaml .Values.adminIngress.extraPaths | nindent 10 }}
{{- end }}
- path: {{ include "common.tplvalues.render" ( dict "value" .Values.adminIngress.path "context" $) }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.adminIngress.pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" .) "servicePort" .Values.adminIngress.servicePort "context" $) | nindent 14 }}
{{- end }}
{{- range .Values.adminIngress.extraHosts }}
- host: {{ (tpl .name $) }}
http:
paths:
- path: {{ default "/" .path }}
{{- if eq "true" (include "common.ingress.supportsPathType" $) }}
pathType: {{ default "ImplementationSpecific" .pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" $) "servicePort" $.Values.adminIngress.servicePort "context" $) | nindent 14 }}
{{- end }}
{{- if .Values.adminIngress.extraRules }}
{{- include "common.tplvalues.render" (dict "value" .Values.adminIngress.extraRules "context" $) | nindent 4 }}
{{- end }}
{{- if or (and .Values.adminIngress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.adminIngress.annotations )) .Values.adminIngress.selfSigned .Values.adminIngress.secrets )) .Values.adminIngress.extraTls }}
tls:
{{- if and .Values.adminIngress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.adminIngress.annotations )) .Values.adminIngress.secrets .Values.adminIngress.selfSigned) }}
- hosts:
- {{ (tpl .Values.adminIngress.hostname .) | quote }}
secretName: {{ printf "%s-tls" (tpl .Values.adminIngress.hostname .) }}
{{- end }}
{{- if .Values.adminIngress.extraTls }}
{{- include "common.tplvalues.render" (dict "value" .Values.adminIngress.extraTls "context" $) | nindent 4 }}
{{- end }}
{{- end }}
{{- end }}

106
charts/keycloak/keycloak/templates/configmap-env-vars.yaml Normal file
View File

@ -0,0 +1,106 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ printf "%s-env-vars" (include "common.names.fullname" .) }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
data:
KEYCLOAK_ADMIN: {{ .Values.auth.adminUser | quote }}
KEYCLOAK_HTTP_PORT: {{ .Values.containerPorts.http | quote }}
{{- if and .Values.proxy (empty .Values.proxyHeaders) }}
KEYCLOAK_PROXY_HEADERS: {{ ternary "" "xforwarded" (eq .Values.proxy "passthrough") }}
{{- else }}
KEYCLOAK_PROXY_HEADERS: {{ .Values.proxyHeaders | quote }}
{{- end }}
{{- if and .Values.adminIngress.enabled .Values.adminIngress.hostname }}
KEYCLOAK_HOSTNAME_ADMIN: |-
{{ ternary "https://" "http://" ( or .Values.adminIngress.tls (eq .Values.proxy "edge") (not (empty .Values.proxyHeaders)) ) -}}
{{- include "common.tplvalues.render" (dict "value" .Values.adminIngress.hostname "context" $) -}}
{{- if eq .Values.adminIngress.controller "default" }}
{{- include "common.tplvalues.render" (dict "value" .Values.adminIngress.path "context" $) }}
{{- else if eq .Values.adminIngress.controller "gce" }}
{{- $path := .Values.adminIngress.path -}}
{{- if hasSuffix "*" $path -}}
{{- $path = trimSuffix "*" $path -}}
{{- end -}}
{{- include "common.tplvalues.render" (dict "value" $path "context" $) }}
{{- end }}
{{- end }}
{{- if and .Values.ingress.enabled .Values.ingress.hostname }}
KEYCLOAK_HOSTNAME: |-
{{ ternary "https://" "http://" ( or .Values.ingress.tls (eq .Values.proxy "edge") (not (empty .Values.proxyHeaders)) ) -}}
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.hostname "context" $) -}}
{{- if eq .Values.ingress.controller "default" }}
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.path "context" $) }}
{{- else if eq .Values.ingress.controller "gce" }}
{{- $path := .Values.ingress.path -}}
{{- if hasSuffix "*" $path -}}
{{- $path = trimSuffix "*" $path -}}
{{- end -}}
{{- include "common.tplvalues.render" (dict "value" $path "context" $) }}
{{- end }}
{{- end }}
{{- if .Values.ingress.enabled }}
KEYCLOAK_HOSTNAME_STRICT: {{ ternary "true" "false" .Values.ingress.hostnameStrict | quote }}
{{- end }}
KEYCLOAK_ENABLE_STATISTICS: {{ ternary "true" "false" .Values.metrics.enabled | quote }}
{{- if not .Values.externalDatabase.existingSecretHostKey }}
KEYCLOAK_DATABASE_HOST: {{ include "keycloak.databaseHost" . | quote }}
{{- end }}
{{- if not .Values.externalDatabase.existingSecretPortKey }}
KEYCLOAK_DATABASE_PORT: {{ include "keycloak.databasePort" . }}
{{- end }}
{{- if not .Values.externalDatabase.existingSecretDatabaseKey }}
KEYCLOAK_DATABASE_NAME: {{ include "keycloak.databaseName" . | quote }}
{{- end }}
{{- if not .Values.externalDatabase.existingSecretUserKey }}
KEYCLOAK_DATABASE_USER: {{ include "keycloak.databaseUser" . | quote }}
{{- end }}
KEYCLOAK_PRODUCTION: {{ ternary "true" "false" .Values.production | quote }}
KEYCLOAK_ENABLE_HTTPS: {{ ternary "true" "false" .Values.tls.enabled | quote }}
{{- if .Values.customCaExistingSecret }}
KC_TRUSTSTORE_PATHS: "/opt/bitnami/keycloak/custom-ca"
{{- end }}
{{- if .Values.tls.enabled }}
KEYCLOAK_HTTPS_PORT: {{ .Values.containerPorts.https | quote }}
KEYCLOAK_HTTPS_USE_PEM: {{ ternary "true" "false" (or .Values.tls.usePem .Values.tls.autoGenerated) | quote }}
{{- if or .Values.tls.usePem .Values.tls.autoGenerated }}
KEYCLOAK_HTTPS_CERTIFICATE_FILE: "/opt/bitnami/keycloak/certs/tls.crt"
KEYCLOAK_HTTPS_CERTIFICATE_KEY_FILE: "/opt/bitnami/keycloak/certs/tls.key"
{{- else }}
KEYCLOAK_HTTPS_KEY_STORE_FILE: {{ printf "/opt/bitnami/keycloak/certs/%s" .Values.tls.keystoreFilename | quote }}
KEYCLOAK_HTTPS_TRUST_STORE_FILE: {{ printf "/opt/bitnami/keycloak/certs/%s" .Values.tls.truststoreFilename | quote }}
{{- end }}
{{- end }}
{{- if .Values.spi.existingSecret }}
{{- if .Values.spi.hostnameVerificationPolicy }}
KEYCLOAK_SPI_TRUSTSTORE_FILE_HOSTNAME_VERIFICATION_POLICY: {{ .Values.spi.hostnameVerificationPolicy | quote }}
{{- end }}
KEYCLOAK_SPI_TRUSTSTORE_FILE: {{ printf "/opt/bitnami/keycloak/spi-certs/%s" .Values.spi.truststoreFilename }}
{{- end }}
{{- if .Values.cache.enabled }}
KEYCLOAK_CACHE_TYPE: "ispn"
{{- if .Values.cache.stackName }}
KEYCLOAK_CACHE_STACK: {{ .Values.cache.stackName | quote }}
{{- end }}
{{- if .Values.cache.stackFile }}
KEYCLOAK_CACHE_CONFIG_FILE: {{ .Values.cache.stackFile | quote }}
{{- end }}
JAVA_OPTS_APPEND: {{ printf "-Djgroups.dns.query=%s-headless.%s.svc.%s" (include "common.names.fullname" .) (include "common.names.namespace" .) .Values.clusterDomain | quote }}
{{- else }}
KEYCLOAK_CACHE_TYPE: "local"
{{- end }}
{{- if .Values.logging }}
KEYCLOAK_LOG_OUTPUT: {{ .Values.logging.output | quote }}
KEYCLOAK_LOG_LEVEL: {{ .Values.logging.level | quote }}
{{- end }}

20
charts/keycloak/keycloak/templates/configmap.yaml Normal file
View File

@ -0,0 +1,20 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if (include "keycloak.createConfigmap" .) }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ printf "%s-configuration" (include "common.names.fullname" .) }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
data:
keycloak.conf: |-
{{- .Values.configuration | nindent 4 }}
{{- end }}

9
charts/keycloak/keycloak/templates/extra-list.yaml Normal file
View File

@ -0,0 +1,9 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- range .Values.extraDeploy }}
---
{{ include "common.tplvalues.render" (dict "value" . "context" $) }}
{{- end }}

40
charts/keycloak/keycloak/templates/headless-service.yaml Normal file
View File

@ -0,0 +1,40 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
apiVersion: v1
kind: Service
metadata:
name: {{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if or .Values.commonAnnotations .Values.service.headless.annotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.annotations .Values.commonAnnotations ) "context" . ) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
{{- end }}
spec:
type: ClusterIP
clusterIP: None
ports:
- name: http
port: {{ .Values.containerPorts.http }}
protocol: TCP
targetPort: http
{{- if .Values.tls.enabled }}
- name: https
port: {{ .Values.containerPorts.https }}
protocol: TCP
targetPort: https
{{- end }}
{{- if .Values.service.extraHeadlessPorts }}
{{- include "common.tplvalues.render" (dict "value" .Values.service.extraHeadlessPorts "context" $) | nindent 4 }}
{{- end }}
{{- if .Values.service.headless.extraPorts }}
{{- include "common.tplvalues.render" (dict "value" .Values.service.headless.extraPorts "context" $) | nindent 4 }}
{{- end }}
publishNotReadyAddresses: true
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak

66
charts/keycloak/keycloak/templates/hpa.yaml Normal file
View File

@ -0,0 +1,66 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.autoscaling.enabled }}
apiVersion: {{ include "common.capabilities.hpa.apiVersion" ( dict "context" $ ) }}
kind: HorizontalPodAutoscaler
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
scaleTargetRef:
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
kind: StatefulSet
name: {{ template "common.names.fullname" . }}
minReplicas: {{ .Values.autoscaling.minReplicas }}
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
metrics:
{{- if .Values.autoscaling.targetCPU }}
- type: Resource
resource:
name: cpu
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
targetAverageUtilization: {{ .Values.autoscaling.targetCPU }}
{{- else }}
target:
type: Utilization
averageUtilization: {{ .Values.autoscaling.targetCPU }}
{{- end }}
{{- end }}
{{- if .Values.autoscaling.targetMemory }}
- type: Resource
resource:
name: memory
{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
targetAverageUtilization: {{ .Values.autoscaling.targetMemory }}
{{- else }}
target:
type: Utilization
averageUtilization: {{ .Values.autoscaling.targetMemory }}
{{- end }}
{{- end }}
{{- if or .Values.autoscaling.behavior.scaleDown.policies .Values.autoscaling.behavior.scaleUp.policies }}
behavior:
{{- if .Values.autoscaling.behavior.scaleDown.policies }}
scaleDown:
stabilizationWindowSeconds: {{ .Values.autoscaling.behavior.scaleDown.stabilizationWindowSeconds }}
selectPolicy: {{ .Values.autoscaling.behavior.scaleDown.selectPolicy }}
policies:
{{- toYaml .Values.autoscaling.behavior.scaleDown.policies | nindent 8 }}
{{- end }}
{{- if .Values.autoscaling.behavior.scaleUp.policies }}
scaleUp:
stabilizationWindowSeconds: {{ .Values.autoscaling.behavior.scaleUp.stabilizationWindowSeconds }}
selectPolicy: {{ .Values.autoscaling.behavior.scaleUp.selectPolicy }}
policies:
{{- toYaml .Values.autoscaling.behavior.scaleUp.policies | nindent 8 }}
{{- end }}
{{- end }}
{{- end }}

61
charts/keycloak/keycloak/templates/ingress.yaml Normal file
View File

@ -0,0 +1,61 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.ingress.enabled }}
apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }}
kind: Ingress
metadata:
name: {{ include "common.names.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.ingress.labels .Values.commonLabels ) "context" . ) }}
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if or .Values.ingress.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.ingress.annotations .Values.commonAnnotations ) "context" . ) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
{{- end }}
spec:
{{- if and .Values.ingress.ingressClassName (eq "true" (include "common.ingress.supportsIngressClassname" .)) }}
ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
{{- end }}
rules:
{{- if .Values.ingress.hostname }}
- host: {{ (tpl .Values.ingress.hostname .) | quote }}
http:
paths:
{{- if .Values.ingress.extraPaths }}
{{- toYaml .Values.ingress.extraPaths | nindent 10 }}
{{- end }}
- path: {{ include "common.tplvalues.render" ( dict "value" .Values.ingress.path "context" $) }}
{{- if eq "true" (include "common.ingress.supportsPathType" .) }}
pathType: {{ .Values.ingress.pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" .) "servicePort" .Values.ingress.servicePort "context" $) | nindent 14 }}
{{- end }}
{{- range .Values.ingress.extraHosts }}
- host: {{ (tpl .name $) }}
http:
paths:
- path: {{ default "/" .path }}
{{- if eq "true" (include "common.ingress.supportsPathType" $) }}
pathType: {{ default "ImplementationSpecific" .pathType }}
{{- end }}
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" $) "servicePort" $.Values.ingress.servicePort "context" $) | nindent 14 }}
{{- end }}
{{- if .Values.ingress.extraRules }}
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraRules "context" $) | nindent 4 }}
{{- end }}
{{- if or (and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.annotations )) .Values.ingress.selfSigned .Values.ingress.secrets )) .Values.ingress.extraTls }}
tls:
{{- if and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.annotations )) .Values.ingress.secrets .Values.ingress.selfSigned) }}
- hosts:
- {{ (tpl .Values.ingress.hostname .) | quote }}
secretName: {{ printf "%s-tls" (tpl .Values.ingress.hostname .) }}
{{- end }}
{{- if .Values.ingress.extraTls }}
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraTls "context" $) | nindent 4 }}
{{- end }}
{{- end }}
{{- end }}

19
charts/keycloak/keycloak/templates/init-scripts-configmap.yaml Normal file
View File

@ -0,0 +1,19 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if and .Values.initdbScripts (not .Values.initdbScriptsConfigMap) }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ printf "%s-init-scripts" (include "common.names.fullname" .) }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
data:
{{- include "common.tplvalues.render" (dict "value" .Values.initdbScripts "context" .) | nindent 2 }}
{{ end }}

23
charts/keycloak/keycloak/templates/keycloak-config-cli-configmap.yaml Normal file
View File

@ -0,0 +1,23 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if (include "keycloak.keycloakConfigCli.createConfigmap" .) }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "keycloak.keycloakConfigCli.configmapName" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak-config-cli
data:
{{- range $fileName, $fileContent := .Values.keycloakConfigCli.configuration }}
{{- if $fileContent }}
{{ $fileName }}: |
{{- include "common.tplvalues.render" (dict "value" $fileContent "context" $) | nindent 4 }}
{{- else }}
{{- ($.Files.Glob $fileName).AsConfig | nindent 2 }}
{{- end }}
{{- end }}
{{- end }}

138
charts/keycloak/keycloak/templates/keycloak-config-cli-job.yaml Normal file
View File

@ -0,0 +1,138 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.keycloakConfigCli.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
name: {{ printf "%s-keycloak-config-cli" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak-config-cli
{{- if or .Values.keycloakConfigCli.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.keycloakConfigCli.annotations .Values.commonAnnotations ) "context" . ) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
{{- end }}
spec:
backoffLimit: {{ .Values.keycloakConfigCli.backoffLimit }}
{{- if .Values.keycloakConfigCli.cleanupAfterFinished.enabled }}
ttlSecondsAfterFinished: {{ .Values.keycloakConfigCli.cleanupAfterFinished.seconds }}
{{- end }}
template:
metadata:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.keycloakConfigCli.podLabels .Values.commonLabels ) "context" . ) }}
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
app.kubernetes.io/component: keycloak-config-cli
annotations:
{{- if (include "keycloak.keycloakConfigCli.createConfigmap" .) }}
checksum/configuration: {{ include (print $.Template.BasePath "/keycloak-config-cli-configmap.yaml") . | sha256sum }}
{{- end }}
{{- if .Values.keycloakConfigCli.podAnnotations }}
{{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.podAnnotations "context" $) | nindent 8 }}
{{- end }}
spec:
serviceAccountName: {{ template "keycloak.serviceAccountName" . }}
{{- include "keycloak.imagePullSecrets" . | nindent 6 }}
restartPolicy: Never
{{- if .Values.keycloakConfigCli.podSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.keycloakConfigCli.podSecurityContext "context" $) | nindent 8 }}
{{- end }}
automountServiceAccountToken: {{ .Values.keycloakConfigCli.automountServiceAccountToken }}
{{- if .Values.keycloakConfigCli.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.keycloakConfigCli.nodeSelector }}
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.nodeSelector "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.keycloakConfigCli.podTolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.podTolerations "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.keycloakConfigCli.initContainers }}
initContainers:
{{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.initContainers "context" $) | nindent 8 }}
{{- end }}
containers:
- name: keycloak-config-cli
image: {{ template "keycloak.keycloakConfigCli.image" . }}
imagePullPolicy: {{ .Values.keycloakConfigCli.image.pullPolicy }}
{{- if .Values.keycloakConfigCli.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.command "context" $) | nindent 12 }}
{{- else }}
command:
- java
- -jar
- /opt/bitnami/keycloak-config-cli/keycloak-config-cli.jar
{{- end }}
{{- if .Values.keycloakConfigCli.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.args "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.keycloakConfigCli.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.keycloakConfigCli.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
env:
- name: KEYCLOAK_URL
value: {{ printf "http://%s-headless:%d%s" (include "common.names.fullname" .) (.Values.containerPorts.http | int) (.Values.httpRelativePath) }}
- name: KEYCLOAK_USER
value: {{ .Values.auth.adminUser | quote }}
- name: KEYCLOAK_PASSWORD
valueFrom:
secretKeyRef:
name: {{ include "keycloak.secretName" . }}
key: {{ include "keycloak.secretKey" . }}
{{- if or .Values.keycloakConfigCli.configuration .Values.keycloakConfigCli.existingConfigmap }}
- name: IMPORT_FILES_LOCATIONS
value: /config/*
{{- end }}
- name: KEYCLOAK_AVAILABILITYCHECK_ENABLED
value: "true"
{{- if .Values.keycloakConfigCli.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
{{- if or .Values.keycloakConfigCli.extraEnvVarsCM .Values.keycloakConfigCli.extraEnvVarsSecret }}
envFrom:
{{- if .Values.keycloakConfigCli.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.extraEnvVarsCM "context" $) }}
{{- end }}
{{- if .Values.keycloakConfigCli.extraEnvVarsSecret }}
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.extraEnvVarsSecret "context" $) }}
{{- end }}
{{- end }}
{{- if or .Values.keycloakConfigCli.configuration .Values.keycloakConfigCli.existingConfigmap .Values.keycloakConfigCli.extraVolumeMounts }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- if or .Values.keycloakConfigCli.configuration .Values.keycloakConfigCli.existingConfigmap }}
- name: config-volume
mountPath: /config
{{- end }}
{{- if .Values.keycloakConfigCli.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
{{- end }}
{{- if .Values.keycloakConfigCli.resources }}
resources: {{- toYaml .Values.keycloakConfigCli.resources | nindent 12 }}
{{- else if ne .Values.keycloakConfigCli.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.keycloakConfigCli.resourcesPreset) | nindent 12 }}
{{- end }}
{{- if .Values.keycloakConfigCli.sidecars }}
{{- include "common.tplvalues.render" ( dict "value" .Values.keycloakConfigCli.sidecars "context" $) | nindent 8 }}
{{- end }}
{{- if or .Values.keycloakConfigCli.configuration .Values.keycloakConfigCli.existingConfigmap .Values.keycloakConfigCli.extraVolumes }}
volumes:
- name: empty-dir
emptyDir: {}
{{- if or .Values.keycloakConfigCli.configuration .Values.keycloakConfigCli.existingConfigmap }}
- name: config-volume
configMap:
name: {{ include "keycloak.keycloakConfigCli.configmapName" . }}
{{- end }}
{{- if .Values.keycloakConfigCli.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.extraVolumes "context" $) | nindent 8 }}
{{- end }}
{{- end }}
{{- end }}

41
charts/keycloak/keycloak/templates/metrics-service.yaml Normal file
View File

@ -0,0 +1,41 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.metrics.enabled }}
apiVersion: v1
kind: Service
metadata:
name: {{ printf "%s-metrics" (include "common.names.fullname" .) }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: metrics
{{- if or .Values.metrics.service.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.service.annotations .Values.commonAnnotations ) "context" . ) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
{{- end }}
spec:
type: ClusterIP
ports:
- name: metrics
port: {{ .Values.metrics.service.ports.metrics }}
protocol: TCP
targetPort: {{ .Values.containerPorts.metrics }}
- name: http
port: {{ .Values.metrics.service.ports.http }}
protocol: TCP
targetPort: {{ .Values.containerPorts.http }}
{{- if .Values.tls.enabled }}
- name: https
port: {{ .Values.metrics.service.ports.https }}
protocol: TCP
targetPort: {{ .Values.containerPorts.https }}
{{- end }}
{{- if .Values.metrics.service.extraPorts }}
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.service.extraPorts "context" $) | nindent 4 }}
{{- end }}
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- end }}

102
charts/keycloak/keycloak/templates/networkpolicy.yaml Normal file
View File

@ -0,0 +1,102 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.networkPolicy.enabled }}
kind: NetworkPolicy
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/component: keycloak
policyTypes:
- Ingress
- Egress
{{- if .Values.networkPolicy.allowExternalEgress }}
egress:
- {}
{{- else }}
egress:
- ports:
# Allow dns resolution
- port: 53
protocol: UDP
- port: 53
protocol: TCP
{{- range $port := .Values.networkPolicy.kubeAPIServerPorts }}
- port: {{ $port }}
{{- end }}
# Allow connection to PostgreSQL
- ports:
- port: {{ include "keycloak.databasePort" . | trimAll "\"" | int }}
{{- if .Values.postgresql.enabled }}
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: postgresql
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
# Allow connection to other keycloak nodes
- ports:
{{- /* Constant in code: https://github.com/keycloak/keycloak/blob/ce8e925c1ad9bf7a3180d1496e181aeea0ab5f8a/operator/src/main/java/org/keycloak/operator/Constants.java#L60 */}}
- port: 7800
- port: {{ .Values.containerPorts.http }}
{{- if .Values.tls.enabled }}
- port: {{ .Values.containerPorts.https }}
{{- end }}
to:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
app.kubernetes.io/component: keycloak
{{- if .Values.networkPolicy.extraEgress }}
{{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}
ingress:
- ports:
{{- /* Constant in code: https://github.com/keycloak/keycloak/blob/ce8e925c1ad9bf7a3180d1496e181aeea0ab5f8a/operator/src/main/java/org/keycloak/operator/Constants.java#L60 */}}
- port: 7800
{{- if and (.Values.metrics.enabled) (not (eq (.Values.containerPorts.http | int) (.Values.containerPorts.metrics | int) )) }}
- port: {{ .Values.containerPorts.metrics }} # metrics and health
{{- end }}
- port: {{ .Values.containerPorts.http }}
{{- if .Values.tls.enabled }}
- port: {{ .Values.containerPorts.https }}
{{- end }}
{{- if not .Values.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
- podSelector:
matchLabels:
{{ template "common.names.fullname" . }}-client: "true"
{{- if .Values.networkPolicy.ingressNSMatchLabels }}
- namespaceSelector:
matchLabels:
{{- range $key, $value := .Values.networkPolicy.ingressNSMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- if .Values.networkPolicy.ingressNSPodMatchLabels }}
podSelector:
matchLabels:
{{- range $key, $value := .Values.networkPolicy.ingressNSPodMatchLabels }}
{{ $key | quote }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- $extraIngress := coalesce .Values.networkPolicy.additionalRules .Values.networkPolicy.extraIngress }}
{{- if $extraIngress }}
{{- include "common.tplvalues.render" ( dict "value" $extraIngress "context" $ ) | nindent 4 }}
{{- end }}
{{- end }}

28
charts/keycloak/keycloak/templates/pdb.yaml Normal file
View File

@ -0,0 +1,28 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.pdb.create }}
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
kind: PodDisruptionBudget
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if .Values.pdb.minAvailable }}
minAvailable: {{ .Values.pdb.minAvailable }}
{{- end }}
{{- if or .Values.pdb.maxUnavailable ( not .Values.pdb.minAvailable ) }}
maxUnavailable: {{ .Values.pdb.maxUnavailable | default 1 }}
{{- end }}
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
selector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/component: keycloak
{{- end }}

20
charts/keycloak/keycloak/templates/prometheusrule.yaml Normal file
View File

@ -0,0 +1,20 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled .Values.metrics.prometheusRule.groups}}
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ default (include "common.names.namespace" .) .Values.metrics.prometheusRule.namespace }}
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.prometheusRule.labels .Values.commonLabels ) "context" . ) }}
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
groups: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.prometheusRule.groups "context" .) | nindent 4 }}
{{- end }}

28
charts/keycloak/keycloak/templates/role.yaml Normal file
View File

@ -0,0 +1,28 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if and .Values.serviceAccount.create .Values.rbac.create }}
kind: Role
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
rules:
{{- if .Values.rbac.rules }}
{{- include "common.tplvalues.render" ( dict "value" .Values.rbac.rules "context" $ ) | nindent 2 }}
{{- end }}
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
{{- end }}

25
charts/keycloak/keycloak/templates/rolebinding.yaml Normal file
View File

@ -0,0 +1,25 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if and .Values.serviceAccount.create .Values.rbac.create }}
kind: RoleBinding
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "common.names.fullname" . }}
subjects:
- kind: ServiceAccount
name: {{ template "keycloak.serviceAccountName" . }}
namespace: {{ include "common.names.namespace" . | quote }}
{{- end }}

19
charts/keycloak/keycloak/templates/secret-external-db.yaml Normal file
View File

@ -0,0 +1,19 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if and (not .Values.postgresql.enabled) (not .Values.externalDatabase.existingSecret) (not .Values.postgresql.existingSecret) }}
apiVersion: v1
kind: Secret
metadata:
name: {{ printf "%s-externaldb" .Release.Name }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
{{- if or .Values.externalDatabase.annotations .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.merge" (dict "values" (list .Values.externalDatabase.annotations .Values.commonAnnotations) "context" $) | nindent 4 }}
{{- end }}
type: Opaque
data:
db-password: {{ include "common.secrets.passwords.manage" (dict "secret" (printf "%s-externaldb" .Release.Name) "key" "db-password" "length" 10 "providedValues" (list "externalDatabase.password") "context" $) }}
{{- end }}

20
charts/keycloak/keycloak/templates/secrets.yaml Normal file
View File

@ -0,0 +1,20 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if not .Values.auth.existingSecret }}
apiVersion: v1
kind: Secret
metadata:
name: {{ printf "%s" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if or .Values.auth.annotations .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.merge" (dict "values" (list .Values.auth.annotations .Values.commonAnnotations) "context" $) | nindent 4 }}
{{- end }}
type: Opaque
data:
admin-password: {{ include "common.secrets.passwords.manage" (dict "secret" (printf "%s" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-") "key" "admin-password" "length" 10 "providedValues" (list "auth.adminPassword") "context" $) }}
{{- end }}

65
charts/keycloak/keycloak/templates/service.yaml Normal file
View File

@ -0,0 +1,65 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
apiVersion: v1
kind: Service
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if or .Values.service.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
{{- end }}
spec:
type: {{ .Values.service.type }}
{{- if and .Values.service.clusterIP (eq .Values.service.type "ClusterIP") }}
clusterIP: {{ .Values.service.clusterIP }}
{{- end }}
{{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort") }}
externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }}
{{- end }}
{{- if and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerSourceRanges)) }}
loadBalancerSourceRanges: {{ .Values.service.loadBalancerSourceRanges }}
{{- end }}
{{- if and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerIP)) }}
loadBalancerIP: {{ .Values.service.loadBalancerIP }}
{{- end }}
{{- if .Values.service.sessionAffinity }}
sessionAffinity: {{ .Values.service.sessionAffinity }}
{{- end }}
{{- if .Values.service.sessionAffinityConfig }}
sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.service.sessionAffinityConfig "context" $) | nindent 4 }}
{{- end }}
ports:
{{- if .Values.service.http.enabled }}
- name: http
port: {{ coalesce .Values.service.ports.http .Values.service.port }}
protocol: TCP
targetPort: http
{{- if (and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.http))) }}
nodePort: {{ .Values.service.nodePorts.http }}
{{- else if eq .Values.service.type "ClusterIP" }}
nodePort: null
{{- end }}
{{- end }}
{{- if .Values.tls.enabled }}
- name: https
port: {{ coalesce .Values.service.ports.https .Values.service.httpsPort }}
protocol: TCP
targetPort: https
{{- if (and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.https))) }}
nodePort: {{ .Values.service.nodePorts.https }}
{{- else if eq .Values.service.type "ClusterIP" }}
nodePort: null
{{- end }}
{{- end }}
{{- if .Values.service.extraPorts }}
{{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
{{- end }}
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak

22
charts/keycloak/keycloak/templates/serviceaccount.yaml Normal file
View File

@ -0,0 +1,22 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ template "keycloak.serviceAccountName" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if .Values.serviceAccount.extraLabels }}
{{- include "common.tplvalues.render" (dict "value" .Values.serviceAccount.extraLabels "context" $) | nindent 4 }}
{{- end }}
{{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
{{- end }}

58
charts/keycloak/keycloak/templates/servicemonitor.yaml Normal file
View File

@ -0,0 +1,58 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ default (include "common.names.namespace" .) .Values.metrics.serviceMonitor.namespace }}
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }}
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if .Values.metrics.serviceMonitor.jobLabel }}
jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }}
{{- end }}
endpoints:
{{- $defaultEndpoint := pick .Values.metrics.serviceMonitor "port" "scheme" "tlsConfig" "interval" "scrapeTimeout" "relabelings" "metricRelabelings" "honorLabels" }}
{{- $endpoints := ternary (.Values.metrics.serviceMonitor.endpoints) (list (dict "path" .Values.metrics.serviceMonitor.path)) (empty .Values.metrics.serviceMonitor.path) }}
{{- range $endpoints }}
{{- $endpoint := merge . $defaultEndpoint }}
- port: {{ $endpoint.port | quote }}
scheme: {{ $endpoint.scheme | quote }}
{{- if $endpoint.tlsConfig }}
tlsConfig: {{- include "common.tplvalues.render" ( dict "value" $endpoint.tlsConfig "context" $) | nindent 8 }}
{{- end }}
path: {{ include "common.tplvalues.render" ( dict "value" $endpoint.path "context" $) }}
{{- if $endpoint.interval }}
interval: {{ $endpoint.interval }}
{{- end }}
{{- if $endpoint.scrapeTimeout }}
scrapeTimeout: {{ $endpoint.scrapeTimeout }}
{{- end }}
{{- if $endpoint.relabelings }}
relabelings: {{- include "common.tplvalues.render" ( dict "value" $endpoint.relabelings "context" $) | nindent 6 }}
{{- end }}
{{- if $endpoint.metricRelabelings }}
metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" $endpoint.metricRelabelings "context" $) | nindent 6 }}
{{- end }}
{{- if $endpoint.honorLabels }}
honorLabels: {{ $endpoint.honorLabels }}
{{- end }}
{{- end }}
namespaceSelector:
matchNames:
- {{ include "common.names.namespace" . | quote }}
selector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }}
{{- if .Values.metrics.serviceMonitor.selector }}
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }}
{{- end }}
app.kubernetes.io/component: metrics
{{- end }}

371
charts/keycloak/keycloak/templates/statefulset.yaml Normal file
View File

@ -0,0 +1,371 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
kind: StatefulSet
metadata:
name: {{ template "common.names.fullname" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if or .Values.statefulsetAnnotations .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.merge" ( dict "values" ( list .Values.statefulsetAnnotations .Values.commonAnnotations ) "context" $ ) | nindent 4 }}
{{- end }}
spec:
{{- if not .Values.autoscaling.enabled }}
replicas: {{ .Values.replicaCount }}
{{- end }}
revisionHistoryLimit: {{ .Values.revisionHistoryLimitCount }}
podManagementPolicy: {{ .Values.podManagementPolicy }}
serviceName: {{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
updateStrategy:
{{- include "common.tplvalues.render" (dict "value" .Values.updateStrategy "context" $ ) | nindent 4 }}
{{- if .Values.minReadySeconds }}
minReadySeconds: {{ .Values.minReadySeconds }}
{{- end }}
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
selector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/component: keycloak
template:
metadata:
annotations:
checksum/configmap-env-vars: {{ include (print $.Template.BasePath "/configmap-env-vars.yaml") . | sha256sum }}
{{- if not .Values.auth.existingSecret }}
checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
{{- end }}
{{- if (include "keycloak.createConfigmap" .) }}
checksum/configuration: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
{{- end }}
{{- if .Values.podAnnotations }}
{{- include "common.tplvalues.render" (dict "value" .Values.podAnnotations "context" $) | nindent 8 }}
{{- end }}
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
app.kubernetes.io/component: keycloak
spec:
serviceAccountName: {{ template "keycloak.serviceAccountName" . }}
{{- include "keycloak.imagePullSecrets" . | nindent 6 }}
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
{{- if .Values.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.affinity }}
affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.affinity "context" $) | nindent 8 }}
{{- else }}
affinity:
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values) | nindent 10 }}
{{- end }}
{{- if .Values.nodeSelector }}
nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.nodeSelector "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.topologySpreadConstraints "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName | quote }}
{{- end }}
{{- if .Values.schedulerName }}
schedulerName: {{ .Values.schedulerName }}
{{- end }}
{{- if .Values.podSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.podSecurityContext "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.dnsPolicy }}
dnsPolicy: {{ .Values.dnsPolicy }}
{{- end }}
{{- if .Values.dnsConfig }}
dnsConfig: {{- include "common.tplvalues.render" (dict "value" .Values.dnsConfig "context" .) | nindent 8 }}
{{- end }}
{{- if semverCompare ">= 1.13" (include "common.capabilities.kubeVersion" .) }}
enableServiceLinks: {{ .Values.enableServiceLinks }}
{{- end }}
{{- if .Values.terminationGracePeriodSeconds }}
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
{{- end }}
{{- if or .Values.enableDefaultInitContainers .Values.initContainers }}
initContainers:
{{- if .Values.enableDefaultInitContainers }}
- name: prepare-write-dirs
image: {{ template "keycloak.image" . }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
command:
- /bin/bash
args:
- -ec
- |
. /opt/bitnami/scripts/liblog.sh
info "Copying writable dirs to empty dir"
# In order to not break the application functionality we need to make some
# directories writable, so we need to copy it to an empty dir volume
cp -r --preserve=mode /opt/bitnami/keycloak/lib/quarkus /emptydir/app-quarkus-dir
cp -r --preserve=mode /opt/bitnami/keycloak/data /emptydir/app-data-dir
cp -r --preserve=mode /opt/bitnami/keycloak/providers /emptydir/app-providers-dir
info "Copy operation completed"
{{- if .Values.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.resources }}
resources: {{- toYaml .Values.resources | nindent 12 }}
{{- else if ne .Values.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.resourcesPreset) | nindent 12 }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /emptydir
{{- end }}
{{- if .Values.initContainers }}
{{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }}
{{- end }}
{{- end }}
containers:
- name: keycloak
image: {{ template "keycloak.image" . }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
{{- if .Values.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
{{- end }}
env:
- name: KUBERNETES_NAMESPACE
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.namespace
- name: BITNAMI_DEBUG
value: {{ ternary "true" "false" .Values.image.debug | quote }}
- name: KEYCLOAK_ADMIN_PASSWORD
valueFrom:
secretKeyRef:
name: {{ include "keycloak.secretName" . }}
key: {{ include "keycloak.secretKey" . }}
- name: KEYCLOAK_DATABASE_PASSWORD
valueFrom:
secretKeyRef:
name: {{ include "keycloak.databaseSecretName" . }}
key: {{ include "keycloak.databaseSecretPasswordKey" . }}
{{- if .Values.externalDatabase.existingSecretHostKey }}
- name: KEYCLOAK_DATABASE_HOST
valueFrom:
secretKeyRef:
name: {{ include "keycloak.databaseSecretName" . }}
key: {{ include "keycloak.databaseSecretHostKey" . }}
{{- end }}
{{- if .Values.externalDatabase.existingSecretPortKey }}
- name: KEYCLOAK_DATABASE_PORT
valueFrom:
secretKeyRef:
name: {{ include "keycloak.databaseSecretName" . }}
key: {{ include "keycloak.databaseSecretPortKey" . }}
{{- end }}
{{- if .Values.externalDatabase.existingSecretUserKey }}
- name: KEYCLOAK_DATABASE_USER
valueFrom:
secretKeyRef:
name: {{ include "keycloak.databaseSecretName" . }}
key: {{ include "keycloak.databaseSecretUserKey" . }}
{{- end }}
{{- if .Values.externalDatabase.existingSecretDatabaseKey }}
- name: KEYCLOAK_DATABASE_NAME
valueFrom:
secretKeyRef:
name: {{ include "keycloak.databaseSecretName" . }}
key: {{ include "keycloak.databaseSecretDatabaseKey" . }}
{{- end }}
{{- if and .Values.tls.enabled (or .Values.tls.keystorePassword .Values.tls.passwordsSecret) }}
- name: KEYCLOAK_HTTPS_KEY_STORE_PASSWORD
valueFrom:
secretKeyRef:
name: {{ include "keycloak.tlsPasswordsSecretName" . }}
key: "tls-keystore-password"
{{- end }}
{{- if and .Values.tls.enabled (or .Values.tls.truststorePassword .Values.tls.passwordsSecret) }}
- name: KEYCLOAK_HTTPS_TRUST_STORE_PASSWORD
valueFrom:
secretKeyRef:
name: {{ include "keycloak.tlsPasswordsSecretName" . }}
key: "tls-truststore-password"
{{- end }}
{{- if and .Values.spi.existingSecret (or .Values.spi.truststorePassword .Values.spi.passwordsSecret) }}
- name: KEYCLOAK_SPI_TRUSTSTORE_PASSWORD
valueFrom:
secretKeyRef:
name: {{ include "keycloak.spiPasswordsSecretName" . }}
key: "spi-truststore-password"
{{- end }}
- name: KEYCLOAK_HTTP_RELATIVE_PATH
value: {{ .Values.httpRelativePath | quote }}
{{- if .Values.extraStartupArgs }}
- name: KEYCLOAK_EXTRA_ARGS
value: {{ .Values.extraStartupArgs | quote }}
{{- end }}
{{- if .Values.adminRealm }}
- name: KC_SPI_ADMIN_REALM
value: "{{ .Values.adminRealm }}"
{{- end }}
{{- if .Values.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
envFrom:
- configMapRef:
name: {{ printf "%s-env-vars" (include "common.names.fullname" .) }}
{{- if .Values.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsCM "context" $) }}
{{- end }}
{{- if .Values.extraEnvVarsSecret }}
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsSecret "context" $) }}
{{- end }}
{{- if .Values.resources }}
resources: {{- toYaml .Values.resources | nindent 12 }}
{{- else if ne .Values.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.resourcesPreset) | nindent 12 }}
{{- end }}
ports:
- name: http
containerPort: {{ .Values.containerPorts.http }}
protocol: TCP
{{- if .Values.tls.enabled }}
- name: https
containerPort: {{ .Values.containerPorts.https }}
protocol: TCP
{{- end }}
{{- if and (.Values.metrics.enabled) (not (eq (.Values.containerPorts.http | int) (.Values.containerPorts.metrics | int) )) }}
- name: metrics
containerPort: {{ .Values.containerPorts.metrics }}
protocol: TCP
{{- end}}
{{- /* Constant in code: https://github.com/keycloak/keycloak/blob/ce8e925c1ad9bf7a3180d1496e181aeea0ab5f8a/operator/src/main/java/org/keycloak/operator/Constants.java#L60 */}}
- name: discovery
containerPort: 7800
{{- if .Values.extraContainerPorts }}
{{- include "common.tplvalues.render" (dict "value" .Values.extraContainerPorts "context" $) | nindent 12 }}
{{- end }}
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }}
{{- else if .Values.startupProbe.enabled }}
startupProbe: {{- omit .Values.startupProbe "enabled" | toYaml | nindent 12 }}
httpGet:
path: {{ .Values.httpRelativePath }}
port: http
{{- end }}
{{- if .Values.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
{{- else if .Values.livenessProbe.enabled }}
livenessProbe: {{- omit .Values.livenessProbe "enabled" | toYaml | nindent 12 }}
tcpSocket:
port: http
{{- end }}
{{- if .Values.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
{{- else if .Values.readinessProbe.enabled }}
readinessProbe: {{- omit .Values.readinessProbe "enabled" | toYaml | nindent 12 }}
httpGet:
path: {{ .Values.httpRelativePath }}realms/{{ .Values.adminRealm | default "master" }}
port: http
{{- end }}
{{- end }}
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
- name: empty-dir
mountPath: /bitnami/keycloak
subPath: app-volume-dir
- name: empty-dir
mountPath: /opt/bitnami/keycloak/conf
subPath: app-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/keycloak/lib/quarkus
subPath: app-quarkus-dir
- name: empty-dir
mountPath: /opt/bitnami/keycloak/data
subPath: app-data-dir
- name: empty-dir
mountPath: /opt/bitnami/keycloak/providers
subPath: app-providers-dir
{{- if or .Values.configuration .Values.existingConfigmap }}
- name: keycloak-config
mountPath: /bitnami/keycloak/conf/keycloak.conf
subPath: keycloak.conf
{{- end }}
{{- if .Values.tls.enabled }}
- name: certificates
mountPath: /opt/bitnami/keycloak/certs
readOnly: true
{{- end }}
{{- if .Values.customCaExistingSecret }}
- name: custom-ca
mountPath: /opt/bitnami/keycloak/custom-ca
readOnly: true
{{- end }}
{{- if .Values.spi.existingSecret }}
- name: spi-certificates
mountPath: /opt/bitnami/keycloak/spi-certs
readOnly: true
{{- end }}
{{- if or .Values.initdbScriptsConfigMap .Values.initdbScripts }}
- name: custom-init-scripts
mountPath: /docker-entrypoint-initdb.d
{{- end }}
{{- if .Values.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.sidecars }}
{{- include "common.tplvalues.render" ( dict "value" .Values.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: empty-dir
emptyDir: {}
{{- if or .Values.configuration .Values.existingConfigmap }}
- name: keycloak-config
configMap:
name: {{ include "keycloak.configmapName" . }}
{{- end }}
{{- if .Values.tls.enabled }}
- name: certificates
secret:
secretName: {{ include "keycloak.tlsSecretName" . }}
defaultMode: 420
{{- end }}
{{- if .Values.customCaExistingSecret }}
- name: custom-ca
secret:
secretName: {{ .Values.customCaExistingSecret }}
defaultMode: 420
{{- end }}
{{- if .Values.spi.existingSecret }}
- name: spi-certificates
secret:
secretName: {{ .Values.spi.existingSecret }}
defaultMode: 420
{{- end }}
{{- if or .Values.initdbScriptsConfigMap .Values.initdbScripts }}
- name: custom-init-scripts
configMap:
name: {{ include "keycloak.initdbScriptsCM" . }}
{{- end }}
{{- if .Values.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
{{- end }}

43
charts/keycloak/keycloak/templates/tls-pass-secret.yaml Normal file
View File

@ -0,0 +1,43 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if and (or .Values.tls.keystorePassword .Values.tls.truststorePassword) (not .Values.tls.passwordsSecret) }}
apiVersion: v1
kind: Secret
metadata:
name: {{ printf "%s-tls-passwords" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: Opaque
data:
{{- if .Values.tls.keystorePassword }}
tls-keystore-password: {{ .Values.tls.keystorePassword | b64enc | quote }}
{{- end }}
{{- if .Values.tls.truststorePassword }}
tls-truststore-password: {{ .Values.tls.truststorePassword | b64enc | quote }}
{{- end }}
---
{{- end }}
{{- if and .Values.spi.truststorePassword (not .Values.spi.passwordsSecret) }}
apiVersion: v1
kind: Secret
metadata:
name: {{ printf "%s-spi-passwords" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: Opaque
data:
{{- if .Values.spi.truststorePassword }}
spi-truststore-password: {{ .Values.spi.truststorePassword | b64enc | quote }}
{{- end }}
{{- end }}

71
charts/keycloak/keycloak/templates/tls-secret.yaml Normal file
View File

@ -0,0 +1,71 @@
{{- /*
Copyright Broadcom, Inc. All Rights Reserved.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.ingress.enabled }}
{{- if .Values.ingress.secrets }}
{{- range .Values.ingress.secrets }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "common.tplvalues.render" ( dict "value" .name "context" $ ) }}
namespace: {{ include "common.names.namespace" $ | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
{{- if $.Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ include "common.tplvalues.render" ( dict "value" .certificate "context" $ ) | b64enc }}
tls.key: {{ include "common.tplvalues.render" ( dict "value" .key "context" $ ) | b64enc }}
---
{{- end }}
{{- end }}
{{- if and .Values.ingress.tls .Values.ingress.selfSigned }}
{{- $secretName := printf "%s-tls" .Values.ingress.hostname }}
{{- $ca := genCA "keycloak-ca" 365 }}
{{- $cert := genSignedCert (tpl .Values.ingress.hostname .) nil (list (tpl .Values.ingress.hostname .)) 365 $ca }}
apiVersion: v1
kind: Secret
metadata:
name: {{ $secretName }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
{{- end }}
{{- end }}
{{- if (include "keycloak.createTlsSecret" $) }}
{{- $secretName := printf "%s-crt" (include "common.names.fullname" .) }}
{{- $ca := genCA "keycloak-ca" 365 }}
{{- $releaseNamespace := include "common.names.namespace" . }}
{{- $clusterDomain := .Values.clusterDomain }}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ $secretName }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: keycloak
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: Opaque
data:
{{- $replicaCount := int .Values.replicaCount }}
{{- $svcName := include "common.names.fullname" . }}
{{- $altNames := list (printf "%s.%s.svc.%s" $svcName $releaseNamespace $clusterDomain) (printf "%s.%s" $svcName $releaseNamespace) $svcName }}
{{- $cert := genSignedCert $svcName nil $altNames 365 $ca }}
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
{{- end }}

1383
charts/keycloak/keycloak/values.yaml Normal file
View File

File diff suppressed because it is too large Load Diff

50
charts/keycloak/values-overrides.yaml Normal file
View File

@ -0,0 +1,50 @@
fullnameOverride: keycloak
namespaceOverride: futureporn
postgresql:
enabled: false
externalDatabase:
host: postgresql-primary.futureporn.svc.cluster.local
user: postgres
existingSecret: postgresql
port: 5432
database: keycloak
logging:
level: INFO # INFO is default
service:
type: LoadBalancer
http:
enabled: true
ports:
http: 8080
annotations:
external-dns.alpha.kubernetes.io/hostname: keycloak.fp.sbtp.xyz
global:
defaultStorageClass: standard
proxy: edge
# curl -o /emptydir/app-providers-dir/patreon-provider.jar -Ls https://github.com/insanity54/keycloak-patreon-provider/releases/download/$tag/keycloak-patreon-provider-$tag.jar
#curl -H "X-Pinggy-No-Screen: 1" -o /emptydir/app-providers-dir/patreon-provider.jar -Ls http://a.free.pinggy.link/keycloak-patreon-provider-$tag.jar
initContainers:
- name: keycloak-patreon-provider-installer
image: alpine/curl:latest
imagePullPolicy: IfNotPresent
command:
- sh
- -c
- |
set -e
tag=1.3.0-SNAPSHOT
echo "Downloading $tag"
curl --max-time 60 -o /emptydir/app-providers-dir/patreon-provider.jar -Ls https://github.com/insanity54/keycloak-patreon-provider/releases/download/$tag/keycloak-patreon-provider-$tag.jar
chown 1001:1001 /emptydir/app-providers-dir/patreon-provider.jar
echo "Download completed with exit code $?"
volumeMounts:
- name: empty-dir
mountPath: /emptydir

2
dockerfiles/next.dockerfile
View File

@ -25,8 +25,8 @@ RUN pnpm fetch
COPY ./services/next ./services/next COPY ./services/next ./services/next
COPY ./packages/types ./packages/types COPY ./packages/types ./packages/types
COPY ./packages/fetchers ./packages/fetchers COPY ./packages/fetchers ./packages/fetchers
COPY ./packages/utils ./packages/utils
# COPY ./packages/strapi ./packages/strapi # COPY ./packages/strapi ./packages/strapi
# COPY ./packages/utils ./packages/utils
RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store pnpm install --recursive --frozen-lockfile --prefer-offline RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store pnpm install --recursive --frozen-lockfile --prefer-offline

2
packages/fetchers/src/findOrCreateVtuber.ts
View File

@ -23,7 +23,7 @@ const columns = [
'pornhub' 'pornhub'
]; ];
// greetz https://bobbyhadz.com/blog/javascript-remove-trailing-slash-from-string // @see https://bobbyhadz.com/blog/javascript-remove-trailing-slash-from-string
function removeTrailingSlash(url: string) { function removeTrailingSlash(url: string) {
return url.replace(/\/+$/, ''); return url.replace(/\/+$/, '');
} }

124
packages/types/src/index.ts
View File

@ -252,17 +252,15 @@ export interface SegmentResponse {
export interface MuxAssetRecord { export interface MuxAssetRecord {
id: number; id: number;
playbackId: string; playback_id: string;
assetId: string; asset_id: string;
} }
export interface IMuxAsset { export interface IMuxAsset {
id: number; id: number;
attributes: { playback_id: string;
playbackId: string; asset_id: string;
assetId: string;
}
} }
export interface IPagination { export interface IPagination {
@ -285,13 +283,11 @@ export interface IMeta {
export interface IPlatformNotification { export interface IPlatformNotification {
id: number; id: number;
attributes: { source: string;
source: string; platform: string;
platform: string; date: string;
date: string; date_2: string;
date2: string; vtuber: number;
vtuber: number;
}
} }
export interface IPlatformNotificationResponse { export interface IPlatformNotificationResponse {
@ -309,80 +305,52 @@ export interface IVod {
id: string id: string
} }
export interface ITweetResponse {
id: string
}
export interface IStream { export interface IStream {
id: number; id: number;
attributes: { date: string;
date: string; date_2: string;
date2: string; archive_status: ArchiveStatus;
archiveStatus: ArchiveStatus; vods: IVod[];
vods: IVodsResponse; cuid: string;
cuid: string; vtuber: IVtuber;
vtuber: IVtuberResponse; is_chaturbate_stream: boolean;
tweet: ITweetResponse; is_fansly_stream: boolean;
isChaturbateStream: boolean; platform_notifications: IPlatformNotification[];
isFanslyStream: boolean;
platformNotifications: IPlatformNotification[];
}
} }
export interface IStreamResponse {
data: IStream;
meta: IMeta;
error?: any;
}
export interface IStreamsResponse {
data: IStream[];
meta: IMeta;
}
export interface IVtuber { export interface IVtuber {
id: number; id: number;
attributes: { slug: string;
slug: string; display_name: string;
displayName: string; chaturbate?: string;
chaturbate?: string; twitter?: string;
twitter?: string; patreon?: string;
patreon?: string; twitch?: string;
twitch?: string; tiktok?: string;
tiktok?: string; onlyfans?: string;
onlyfans?: string; youtube?: string;
youtube?: string; linktree?: string;
linktree?: string; carrd?: string;
carrd?: string; fansly?: string;
fansly?: string; pornhub?: string;
pornhub?: string; discord?: string;
discord?: string; reddit?: string;
reddit?: string; throne?: string;
throne?: string; instagram?: string;
instagram?: string; facebook?: string;
facebook?: string; merch?: string;
merch?: string; vods: IVod[];
vods: IVod[]; description_1: string;
description1: string; description_2?: string;
description2?: string; image: string;
image: string; image_blur?: string;
imageBlur?: string; theme_color: string;
themeColor: string; fansly_id?: string;
fanslyId?: string; chaturbate_id?: string;
chaturbateId?: string; twitter_id?: string;
twitterId?: string;
}
}
export interface IVtuberResponse {
data: IVtuber;
meta: IMeta;
}
export interface IVtubersResponse {
data: IVtuber[];
meta: IMeta;
} }
export type NotificationData = { export type NotificationData = {

3
packages/utils/src/file.ts
View File

@ -37,7 +37,6 @@ export function getTmpFile(str: string): string {
* @returns {String} filePath * @returns {String} filePath
* *
* @see https://stackoverflow.com/a/74722818/1004931 * @see https://stackoverflow.com/a/74722818/1004931
* greetz chatgpt
*/ */
export async function download({ export async function download({
url, url,
@ -84,7 +83,7 @@ export const tmpFileRegex = /^\/tmp\/.*\.jpg$/;
/** /**
* getFileChecksum * getFileChecksum
* greetz https://stackoverflow.com/a/44643479/1004931 * @see https://stackoverflow.com/a/44643479/1004931
*/ */
export async function getFileChecksum(filePath: string, algorithm = 'md5') { export async function getFileChecksum(filePath: string, algorithm = 'md5') {
return new Promise((resolve, reject) => { return new Promise((resolve, reject) => {

2
packages/utils/src/image.spec.ts
View File

@ -30,7 +30,7 @@ describe('image', function () {
describe('getStoryboard', function () { describe('getStoryboard', function () {
this.timeout(1000*60*15) this.timeout(1000*60*15)
it('should accept a URL and return a path to image on disk', async function () { it('should accept a URL and return a path to image on disk', async function () {
const url = 'https://futureporn-b2.b-cdn.net/projektmelody-chaturbate-2024-10-31.mp4' const url = 'https://futureporn-b2.b-cdn.net/projektmelody-chaturbate-2024-12-10.mp4'
const imagePath = await getStoryboard(url) const imagePath = await getStoryboard(url)
expect(imagePath).to.match(/\.png/) expect(imagePath).to.match(/\.png/)
}) })

180
packages/utils/src/patron.ts Normal file
View File

@ -0,0 +1,180 @@
export function formatPatronUsername (first_name: string, last_name: string) {
return `${first_name || ''} ${last_name || ''}`.trim()
}
export interface Reward {
id: string;
type: "reward";
attributes: {
amount_cents: number;
created_at: string;
description: string;
discord_role_ids: any | null;
edited_at: string;
image_url: string | null;
patron_count: number;
post_count: number | null;
published: boolean;
published_at: string;
remaining: number | null;
requires_shipping: boolean;
title: string;
unpublished_at: string | null;
url: string;
user_limit: number | null;
};
}
export interface Patron {
id: string;
full_name: string;
}
export type PublicPatron = {
id: string; // User ID of the patron
full_name: string; // Full name of the patron, pulled from included data
link?: string;
};
namespace Patreon {
export interface APIResponse {
data: {
id: string;
relationships: {
currently_entitled_tiers: {
data: { id: string; type: string }[];
};
user: {
data: { id: string; type: string };
};
};
type: string;
}[];
included: {
id: string;
type: string;
attributes: {
full_name?: string;
};
}[];
meta: {
count: number;
pagination: {
cursors: {
next?: string;
}
}
};
}
export interface Pledge {
id: string;
type: "pledge";
attributes: {
amount_cents: number;
created_at: string;
declined_since: string | null;
patron_pays_fees: boolean;
pledge_cap_cents: number | null;
};
relationships: {
patron: {
data: {
id: string;
type: "user";
};
links: {
related: string;
};
};
reward: {
data: {
id: string;
type: "reward";
};
links: {
related: string;
};
};
};
}
export interface User {
id: string;
type: "user";
attributes: {
about: string;
created: string;
email: string;
facebook: string | null;
first_name: string;
full_name: string;
gender: number;
image_url: string;
is_email_verified: boolean;
last_name: string;
social_connections: SocialConnections;
thumb_url: string;
twitch: string | null;
twitter: string | null;
url: string;
vanity: string;
youtube: string | null;
};
}
export interface SocialConnections {
deviantart: string | null;
discord: string | null;
facebook: string | null;
reddit: string | null;
spotify: string | null;
twitch: string | null;
twitter: string | null;
youtube: string | null;
}
export interface Reward {
id: string;
type: "reward";
attributes: {
amount_cents: number;
created_at: string;
description: string;
discord_role_ids: any | null;
edited_at: string;
image_url: string | null;
patron_count: number;
post_count: number | null;
published: boolean;
published_at: string;
remaining: number | null;
requires_shipping: boolean;
title: string;
unpublished_at: string | null;
url: string;
user_limit: number | null;
};
}
}
export const cjClippyPatreonCampaignId = '8012692'
export const tiers = {
everyone: '-1',
free: '10620388',
archiveSupporter: '8154170',
stealthSupporter: '9561793',
tuneItUp: '9184994',
maxQ: '22529959',
archiveCollector: '8154171',
advancedArchiveSupporter: '8686045',
quantumSupporter: '8694826',
sneakyQuantumSupporter: '9560538',
luberPlusPlus: '8686022'
}

1
scripts/data-migrations/.gitignore vendored Normal file
View File

@ -0,0 +1 @@
2024-10-25-from-strapi-to-postgrest-mk2.sql

79
scripts/data-migrations/2024-10-18-drupal.php
View File

@ -1,79 +0,0 @@
<?php
namespace Drupal\mymodule\Plugin\migrate\source;
use Drupal\migrate\Annotation\MigrateSource;
use Drupal\migrate\Plugin\migrate\source\SqlBase;
use Drupal\migrate\Row;
/**
* Minimalistic example for a SqlBase source plugin.
*
* @MigrateSource(
* id = "games",
* source_module = "mymodule",
* )
*/
class Games extends SqlBase {
/**
* {@inheritdoc}
*/
public function query() {
// Source data is queried from 'curling_games' table.
$query = $this->select('curling_games', 'g')
->fields('g', [
'game_id',
'title',
'date',
'time',
'place',
]);
return $query;
}
/**
* {@inheritdoc}
*/
public function fields() {
$fields = [
'game_id' => $this->t('game_id' ),
'title' => $this->t('title' ),
'date' => $this->t('date'),
'time' => $this->t('time'),
'place' => $this->t('place' ),
];
return $fields;
}
/**
* {@inheritdoc}
*/
public function getIds() {
return [
'game_id' => [
'type' => 'integer',
'alias' => 'g',
],
];
}
/**
* {@inheritdoc}
*/
public function prepareRow(Row $row) {
// This example shows how source properties can be added in
// prepareRow(). The source dates are stored as 2017-12-17
// and times as 16:00. Drupal 8 saves date and time fields
// in ISO8601 format 2017-01-15T16:00:00 on UTC.
// We concatenate source date and time and add the seconds.
// The same result could also be achieved using the 'concat'
// and 'format_date' process plugins in the migration
// definition.
$date = $row->getSourceProperty('date');
$time = $row->getSourceProperty('time');
$datetime = $date . 'T' . $time . ':00';
$row->setSourceProperty('datetime', $datetime);
return parent::prepareRow($row);
}
}

1018
scripts/data-migrations/2024-10-25-from-strapi-to-postgrest-mk2.sql
View File

File diff suppressed because it is too large Load Diff

19
scripts/data-migrations/2024-11-21-relate-vtubers-to-vods.sql Normal file
View File

@ -0,0 +1,19 @@
BEGIN;
-- SELECT * FROM api.vods AS vods
-- INNER JOIN api.vods_vtuber_links AS links
-- ON vods.id = links.vtuber_id
-- INSERT INTO api.vods (vtuber)
-- SELECT vtuber
-- FROM api.vods_vtuber_links
-- WHERE api.vods.id = api.vods_vtuber_links.vtuber_id;
UPDATE api.vods
SET vtuber_id = links.vtuber_id
FROM api.vods_vtuber_links links
WHERE api.vods.id = links.vod_id;
COMMIT;

11
scripts/data-migrations/2024-11-22-relate-mux_asset_id-to-vods.sql Normal file
View File

@ -0,0 +1,11 @@
BEGIN;
UPDATE api.vods
SET mux_asset_id = links.mux_asset_id
FROM api.vods_mux_asset_links links
WHERE api.vods.id = links.vod_id;
COMMIT;

11
scripts/data-migrations/2024-11-22-relate-thumbnails-to-vods.sql Normal file
View File

@ -0,0 +1,11 @@
BEGIN;
UPDATE api.vods
SET thumbnail_id = links.b_2_file_id
FROM api.vods_thumbnail_links links
WHERE api.vods.id = links.vod_id;
COMMIT;

11
scripts/data-migrations/2024-11-22-rename-vtuber_num-to-vtuber_id.sql Normal file
View File

@ -0,0 +1,11 @@
BEGIN;
UPDATE api.streams
SET vtuber_id = vtuber_num
WHERE vtuber_num IS NOT NULL;
COMMIT;
-- @TODO api.streams.vtuber_num is deprecated in favor of api.streams.vtuber_Id

2
scripts/data-migrations/README.md
View File

@ -1,7 +1,7 @@
# Futureporn data migrations # Futureporn data migrations
This directory is for data migrations ONLY. This directory is for data migrations ONLY.
For schema migrations, see ./services/migrations For schema migrations, see ../services/migrations node package
## Usage ## Usage

14
scripts/k8s-secrets.sh
View File

@ -42,6 +42,16 @@ EOF
# --from-literal=b2Key=${UPPY_B2_KEY} \ # --from-literal=b2Key=${UPPY_B2_KEY} \
# --from-literal=b2Secret=${UPPY_B2_SECRET}\ # --from-literal=b2Secret=${UPPY_B2_SECRET}\
kubectl --namespace futureporn delete secret next --ignore-not-found
kubectl --namespace futureporn create secret generic next \
--from-literal=nextAuthSecret=${NEXTAUTH_SECRET}
kubectl --namespace futureporn delete secret keycloak --ignore-not-found
kubectl --namespace futureporn create secret generic keycloak \
--from-literal=adminPassword=${KEYCLOAK_ADMIN_PASSWORD} \
--from-literal=clientId=${KEYCLOAK_CLIENT_ID} \
--from-literal=clientSecret=${KEYCLOAK_CLIENT_SECRET}
kubectl --namespace futureporn delete secret traefik-dashboard-auth --ignore-not-found kubectl --namespace futureporn delete secret traefik-dashboard-auth --ignore-not-found
kubectl --namespace futureporn create secret generic traefik-dashboard-auth \ kubectl --namespace futureporn create secret generic traefik-dashboard-auth \
--type=kubernetes.io/basic-auth \ --type=kubernetes.io/basic-auth \
@ -58,6 +68,7 @@ kubectl --namespace futureporn create secret generic logto \
kubectl --namespace futureporn delete secret supertokens --ignore-not-found kubectl --namespace futureporn delete secret supertokens --ignore-not-found
kubectl --namespace futureporn create secret generic supertokens \ kubectl --namespace futureporn create secret generic supertokens \
--from-literal=apiKeys=${SUPERTOKENS_API_KEYS} \ --from-literal=apiKeys=${SUPERTOKENS_API_KEYS} \
--from-literal=apiKey=${SUPERTOKENS_API_KEY} \
--from-literal=postgresqlUri=${SUPERTOKENS_POSTGRESQL_URI} --from-literal=postgresqlUri=${SUPERTOKENS_POSTGRESQL_URI}
kubectl --namespace futureporn delete secret patreon --ignore-not-found kubectl --namespace futureporn delete secret patreon --ignore-not-found
@ -188,7 +199,8 @@ kubectl --namespace futureporn delete secret postgresql --ignore-not-found
kubectl --namespace futureporn create secret generic postgresql \ kubectl --namespace futureporn create secret generic postgresql \
--from-literal=replication-password=${POSTGRES_PASSWORD} \ --from-literal=replication-password=${POSTGRES_PASSWORD} \
--from-literal=postgres-password=${POSTGRES_PASSWORD} \ --from-literal=postgres-password=${POSTGRES_PASSWORD} \
--from-literal=password=${POSTGRES_PASSWORD} --from-literal=password=${POSTGRES_PASSWORD} \
--from-literal=db-password=${POSTGRES_PASSWORD}
kubectl --namespace futureporn delete secret pgadmin --ignore-not-found kubectl --namespace futureporn delete secret pgadmin --ignore-not-found
kubectl --namespace futureporn create secret generic pgadmin \ kubectl --namespace futureporn create secret generic pgadmin \

4
scripts/keycloak-seed.sh Executable file
View File

@ -0,0 +1,4 @@
#!/bin/bash
kubectl -n futureporn exec postgresql-primary-0 -- env PGPASSWORD=${POSTGRES_PASSWORD} psql -U postgres --command "CREATE DATABASE keycloak;"
echo "Done."

2
services/bot/src/utils/loader.ts
View File

@ -1,4 +1,4 @@
// greetz https://github.com/discordeno/discordeno/blob/main/examples/advanced/src/utils/loader.ts // @see https://github.com/discordeno/discordeno/blob/main/examples/advanced/src/utils/loader.ts
import { readdir } from 'node:fs/promises' import { readdir } from 'node:fs/promises'
import { logger } from '@discordeno/bot' import { logger } from '@discordeno/bot'

6
services/factory/README.md
View File

@ -9,3 +9,9 @@ factory has a big disk and lots of RAM in order to do transcoding tasks
## 240p encodes ## 240p encodes
ffmpeg -i ./pmel-cb-2023-03-04.mp4 -vf scale=-2:240 -b:v 368k -b:a 45k ./projektmelody-chaturbatep2023-03-04_240p.mp4 ffmpeg -i ./pmel-cb-2023-03-04.mp4 -vf scale=-2:240 -b:v 368k -b:a 45k ./projektmelody-chaturbatep2023-03-04_240p.mp4
## potential helpful tools
* https://github.com/superstreamerapp/superstreamer
* https://github.com/StreamPot/StreamPot

4
services/factory/crontab
View File

@ -13,5 +13,5 @@
# * * * * * task ?opts {payload} # * * * * * task ?opts {payload}
## every 12 hours, we update the patrons table, synchronizing it with Patreon API. ## every n minutes, we update the patrons table to contain patron names who have opted-in to the Website Shoutout perk
* */12 * * * synchronize_patrons_list ?max=1 */1 * * * * synchronize_patrons_list ?max=1

28
services/factory/pnpm-lock.yaml
View File

@ -67,34 +67,6 @@ importers:
specifier: ^4.19.0 specifier: ^4.19.0
version: 4.19.0 version: 4.19.0
../..: {}
../../packages/fetchers: {}
../../packages/infra: {}
../../packages/storage: {}
../../packages/types: {}
../../packages/utils: {}
../bot: {}
../capture: {}
../mailbox: {}
../migrations: {}
../next: {}
../scout: {}
../strapi: {}
../uppy: {}
packages: packages:
'@aws-crypto/crc32@5.2.0': '@aws-crypto/crc32@5.2.0':

8
services/factory/src/config.ts
View File

@ -17,6 +17,8 @@ if (!process.env.S3_USC_BUCKET) throw new Error('Missing S3_USC_BUCKET env var')
if (!process.env.CACHE_DIR) throw new Error('Missing CACHE_DIR env var'); if (!process.env.CACHE_DIR) throw new Error('Missing CACHE_DIR env var');
if (!process.env.PATREON_CREATOR_ACCESS_TOKEN) throw new Error('Missing PATREON_CREATOR_ACCESS_TOKEN env var'); if (!process.env.PATREON_CREATOR_ACCESS_TOKEN) throw new Error('Missing PATREON_CREATOR_ACCESS_TOKEN env var');
if (!process.env.PATREON_CREATOR_REFRESH_TOKEN) throw new Error('Missing PATREON_CREATOR_REFRESH_TOKEN env var'); if (!process.env.PATREON_CREATOR_REFRESH_TOKEN) throw new Error('Missing PATREON_CREATOR_REFRESH_TOKEN env var');
if (!process.env.SUPERTOKENS_URL) throw new Error('Missing SUPERTOKENS_URL env var');
if (!process.env.SUPERTOKENS_API_KEY) throw new Error('Missing SUPERTOKENS_API_KEY env var');
const postgrestUrl = process.env.POSTGREST_URL! const postgrestUrl = process.env.POSTGREST_URL!
const automationUserJwt = process.env.AUTOMATION_USER_JWT! const automationUserJwt = process.env.AUTOMATION_USER_JWT!
const connectionString = process.env.WORKER_CONNECTION_STRING! const connectionString = process.env.WORKER_CONNECTION_STRING!
@ -29,6 +31,8 @@ const s3UscBucket = process.env.S3_USC_BUCKET!
const cacheDir = process.env.CACHE_DIR! const cacheDir = process.env.CACHE_DIR!
const patreonCreatorAccessToken = process.env.PATREON_CREATOR_ACCESS_TOKEN! const patreonCreatorAccessToken = process.env.PATREON_CREATOR_ACCESS_TOKEN!
const patreonCreatorRefreshToken = process.env.PATREON_CREATOR_REFRESH_TOKEN! const patreonCreatorRefreshToken = process.env.PATREON_CREATOR_REFRESH_TOKEN!
const supertokensUrl = process.env.SUPERTOKENS_URL!
const supertokensApiKey = process.env.SUPERTOKENS_API_KEY!
export interface Config { export interface Config {
postgrestUrl: string; postgrestUrl: string;
@ -43,6 +47,8 @@ export interface Config {
cacheDir: string; cacheDir: string;
patreonCreatorAccessToken: string; patreonCreatorAccessToken: string;
patreonCreatorRefreshToken: string; patreonCreatorRefreshToken: string;
supertokensUrl: string;
supertokensApiKey: string;
} }
@ -59,4 +65,6 @@ export const configs: Config = {
cacheDir, cacheDir,
patreonCreatorAccessToken, patreonCreatorAccessToken,
patreonCreatorRefreshToken, patreonCreatorRefreshToken,
supertokensUrl,
supertokensApiKey,
} }

20
services/factory/src/tasks/generate_thumbnail.ts
View File

@ -25,8 +25,18 @@ async function doIntegratedRequest(vodId: string): Promise<void> {
// we need to get a CDN url to the vod so we can download chunks of the file in order for Prevvy to create the storyboard image. // we need to get a CDN url to the vod so we can download chunks of the file in order for Prevvy to create the storyboard image.
const cdnUrl = getCdnUrl(configs.s3MainBucket, s3_file.s3_key) const cdnUrl = getCdnUrl(configs.s3MainBucket, s3_file.s3_key)
const tmpImagePath = await getStoryboard(cdnUrl) const thumbnailCdnUrl = await getThumbnailCdnUrl(cdnUrl)
await patchVodInDatabase(vodId, { thumbnail: thumbnailCdnUrl })
}
async function getThumbnailCdnUrl(videoUrl: string): Promise<string> {
const tmpImagePath = await getStoryboard(videoUrl)
// we need to upload the image to S3 // we need to upload the image to S3
const uploadArgs: S3FileArgs = { const uploadArgs: S3FileArgs = {
@ -44,15 +54,13 @@ async function doIntegratedRequest(vodId: string): Promise<void> {
// we need to create a S3 file in the db // we need to create a S3 file in the db
const thumbnail = getCdnUrl(configs.s3MainBucket, upload.Key) const thumbnail = getCdnUrl(configs.s3MainBucket, upload.Key)
await patchVodInDatabase(vodId, { thumbnail })
return thumbnail
} }
async function doSoloRequest(videoUrl: string): Promise<string> { async function doSoloRequest(videoUrl: string): Promise<string> {
return await getThumbnailUrl(videoUrl) await getThumbnailCdnUrl(videoUrl)
} }
@ -74,7 +82,7 @@ export const generate_thumbnail: Task = async function (payload: unknown, helper
if (integratedRequest) { if (integratedRequest) {
await doIntegratedRequest(vod_id) await doIntegratedRequest(vod_id)
} else if (soloRequest) { } else if (soloRequest) {
await getThumbnailUrl(video_url) await getThumbnailCdnUrl(video_url)
} else { } else {
throw new Error(`unsupported ambiguous request!`) throw new Error(`unsupported ambiguous request!`)
} }

318
services/factory/src/tasks/synchronize_patrons_list.ts
View File

@ -1,244 +1,132 @@
import type { Task, Helpers } from "graphile-worker"; import type { Task, Helpers } from "graphile-worker";
import type { IPatron } from '@futureporn/types'
import { configs } from '../config.ts' import { configs } from '../config.ts'
import { formatPatronUsername } from "@futureporn/utils/patron.ts";
interface Patron { import { PublicPatron } from "@futureporn/utils/patron.ts";
id: string;
full_name: string;
}
type SimplePatron = {
id: string; // User ID of the patron
full_name: string; // Full name of the patron, pulled from included data
entitled_tier_ids: string[]; // List of tier IDs the patron is currently entitled to
};
namespace Patreon {
export interface APIResponse { // async function fetchAllPages(url: string, headers: HeadersInit = {}): Promise<Patreon.APIResponse[]> {
data: { // const responses: Patreon.APIResponse[] = [];
id: string; // let cursor: string | null = null;
relationships: {
currently_entitled_tiers: { // do {
data: { id: string; type: string }[]; // const fetchUrl = cursor ? `${url}&page[cursor]=${cursor}` : url;
}; // const response = await fetch(fetchUrl, { headers });
user: { // const jsonResponse: Patreon.APIResponse = await response.json();
data: { id: string; type: string };
}; // responses.push(jsonResponse);
}; // cursor = jsonResponse.meta?.pagination?.cursors?.next || null;
type: string; // } while (cursor);
}[];
included: { // return responses;
id: string; // }
type: string;
attributes: {
full_name?: string; /**
}; * getOptInPatrons
}[]; *
meta: { * Get a list of users who have the 'patron' role and have opted-in to having their username displayed on the site
count: number; *
pagination: { * @see https://app.swaggerhub.com/apis/supertokens/CDI/5.1.1#/User%20Roles%20Recipe/getRoleUsers
cursors: { *
next?: string; * @todo this rapid-fires 600+ fetch() requests to supertokens. Do we need to throttle this?
} */
async function getPublicPatrons(): Promise<PublicPatron[]> {
const allPatrons = await getPatronIds()
let publicPatrons = []
for (const patronId of allPatrons) {
const res = await fetch(`${configs.supertokensUrl}/recipe/user/metadata?userId=${patronId}`, {
method: 'GET',
headers: {
'rid': 'usermetadata',
'Authorization': configs.supertokensApiKey,
'cdi-version': '5.1',
} }
}; })
if (!res.ok) {
throw new Error(`failed to fetch usermetadata from supertokens. res.status=${res.status}, res.statusText=${res.statusText}`)
}
const data = await res.json()
const metadata = data.metadata
const isUsernamePublic = metadata?.isUsernamePublic
if (isUsernamePublic) {
const patron: PublicPatron = {
full_name: formatPatronUsername(metadata.first_name, metadata.last_name),
id: patronId,
link: metadata?.vanityLink
}
publicPatrons.push(patron)
}
} }
return publicPatrons
}
export interface Pledge {
id: string; /**
type: "pledge"; * getPatronIds
attributes: { *
amount_cents: number; * get the UUIDs of all patrons
created_at: string; */
declined_since: string | null; async function getPatronIds(): Promise<string[]> {
patron_pays_fees: boolean; const res = await fetch(`${configs.supertokensUrl}/recipe/role/users?role=patron`, {
pledge_cap_cents: number | null; method: 'GET',
}; headers: {
relationships: { 'rid': 'userroles',
patron: { 'Authorization': configs.supertokensApiKey,
data: { 'cdi-version': '5.1'
id: string; }
type: "user"; })
}; if (!res.ok) {
links: { throw new Error(`failed to getPublicPatrons() with res.status=${res.status} res.statusText=${res.statusText}`)
related: string;
};
};
reward: {
data: {
id: string;
type: "reward";
};
links: {
related: string;
};
};
};
}
export interface User {
id: string;
type: "user";
attributes: {
about: string;
created: string;
email: string;
facebook: string | null;
first_name: string;
full_name: string;
gender: number;
image_url: string;
is_email_verified: boolean;
last_name: string;
social_connections: SocialConnections;
thumb_url: string;
twitch: string | null;
twitter: string | null;
url: string;
vanity: string;
youtube: string | null;
};
}
export interface SocialConnections {
deviantart: string | null;
discord: string | null;
facebook: string | null;
reddit: string | null;
spotify: string | null;
twitch: string | null;
twitter: string | null;
youtube: string | null;
}
export interface Reward {
id: string;
type: "reward";
attributes: {
amount_cents: number;
created_at: string;
description: string;
discord_role_ids: any | null;
edited_at: string;
image_url: string | null;
patron_count: number;
post_count: number | null;
published: boolean;
published_at: string;
remaining: number | null;
requires_shipping: boolean;
title: string;
unpublished_at: string | null;
url: string;
user_limit: number | null;
};
} }
const data = await res.json()
const patrons = data?.users
return patrons
} }
const tiers = { const updatePatronsTable = async function (patronsList: PublicPatron[]): Promise<void> {
free: '10620388', console.log(`Syncronizing ${patronsList.length} patron name to the public db`)
archiveSupporter: '8154170', // console.log(patronsList)
stealthSupporter: '9561793',
tuneItUp: '9184994',
maxQ: '22529959',
archiveCollector: '8154171',
advancedArchiveSupporter: '8686045',
quantumSupporter: '8694826',
sneakyQuantumSupporter: '9560538',
luberPlusPlus: '8686022'
}
async function fetchAllPages(url: string, headers: HeadersInit = {}): Promise<Patreon.APIResponse[]> {
const responses: Patreon.APIResponse[] = [];
let cursor: string | null = null;
do {
const fetchUrl = cursor ? `${url}&page[cursor]=${cursor}` : url;
const response = await fetch(fetchUrl, { headers });
const jsonResponse: Patreon.APIResponse = await response.json();
responses.push(jsonResponse);
cursor = jsonResponse.meta?.pagination?.cursors?.next || null;
} while (cursor);
return responses;
}
function transformApiResponse(responses: Patreon.APIResponse[]): SimplePatron[] {
const usersMap: Record<string, string> = {};
// Build a map of user ID -> full_name from the included data
responses.forEach(response => {
response.included
.filter(item => item.type === 'user')
.forEach(user => {
usersMap[user.id] = user.attributes.full_name || '';
});
});
// Map through `data` to create a unified array of SimplePatron
return responses.flatMap(response =>
response.data.map(datum => ({
id: datum.relationships.user.data.id,
full_name: usersMap[datum.relationships.user.data.id] || '',
entitled_tier_ids: datum.relationships.currently_entitled_tiers.data.map(tier => tier.id),
}))
);
}
function filterActivePatrons(patrons: SimplePatron[]): SimplePatron[] {
const acceptedTiers = new Set(Object.values(tiers))
acceptedTiers.delete(tiers.free);
return patrons.filter(patron =>
patron.entitled_tier_ids.some(tierId => acceptedTiers.has(tierId))
);
}
async function getActivePatrons(url: string, headers: HeadersInit = {}): Promise<SimplePatron[]> {
// Step 1: Fetch all pages of raw data
const rawResponses = await fetchAllPages(url, headers);
// Step 2: Transform raw responses into a unified data format
const allPatrons = transformApiResponse(rawResponses);
// Step 3: Filter patrons by accepted tiers
return filterActivePatrons(allPatrons);
}
const updatePatronsTable = async function (patronsList: SimplePatron[]): Promise<void> {
// @todo
console.log(`@todo Syncronizing ${patronsList.length} patrons to the db`)
const res = await fetch(`${configs.postgrestUrl}/patrons`, { const res = await fetch(`${configs.postgrestUrl}/patrons`, {
method: 'POST', method: 'POST',
headers: { headers: {
'Authorization': `Bearer ${configs.automationUserJwt}`, 'Authorization': `Bearer ${configs.automationUserJwt}`,
'Prefer': 'return=representation', 'Prefer': 'resolution=merge-duplicates,return=representation',
'Content-Type': 'application/json', 'Content-Type': 'application/json',
} },
body: JSON.stringify(patronsList)
}) })
const data = await res.json() if (!res.ok) {
const body = await res.text()
throw new Error(`failed to update patrons. res.status=${res.status} res.statusText=${res.statusText} body=${body}`);
}
} }
const deleteExpiredPatrons = async function (activePatronIds: string[]): Promise<void> {
const res = await fetch(`${configs.postgrestUrl}/patrons?id=not.in.(${activePatronIds.join(',')})`, {
method: 'DELETE',
headers: {
'Authorization': `Bearer ${configs.automationUserJwt}`,
'Prefer': 'return=representation',
}
});
if (!res.ok) {
const body = await res.text();
throw new Error(`Failed to delete expired patrons. res.status=${res.status} res.statusText=${res.statusText} body=${body}`);
}
};
const synchronize_patrons_list: Task = async function (payload: unknown, helpers: Helpers) { const synchronize_patrons_list: Task = async function (payload: unknown, helpers: Helpers) {
try { try {
const patrons = await getActivePatrons( const patrons = await getPublicPatrons()
'https://api.patreon.com/api/oauth2/v2/campaigns/8012692/members?include=currently_entitled_tiers,user&fields[user]=full_name,vanity',
{ 'Authorization': `Bearer ${configs.patreonCreatorAccessToken}` }
)
await updatePatronsTable(patrons) await updatePatronsTable(patrons)
await deleteExpiredPatrons(patrons.map((p) => p.id))
} catch (e) { } catch (e) {
helpers.logger.error('failed to synchronize_patrons_list') helpers.logger.error('failed to synchronize_patrons_list')

2
services/factory/src/utils/importDirectory.ts
View File

@ -1,4 +1,4 @@
// greetz https://github.com/discordeno/discordeno/blob/main/examples/advanced/src/utils/loader.ts // @see https://github.com/discordeno/discordeno/blob/main/examples/advanced/src/utils/loader.ts
import { readdir } from 'node:fs/promises' import { readdir } from 'node:fs/promises'
import { join } from 'node:path' import { join } from 'node:path'

15
services/htmx/README.md Normal file
View File

@ -0,0 +1,15 @@
# bright.futureporn.net
An htmx experiment. The goal here is to see if htmx can improve Futureporn performance.
## Design requirements
* [ ] performant
* [ ] serve FP video
* [ ] optimize for humans
* [ ] [HATEOAS](https://intercoolerjs.org/2016/05/08/hatoeas-is-for-humans.html)
* [ ] auth via supertokens
## Based on
[htmx-ts-starter-kit](https://github.com/claudioc/fastify-htmx-ts-starter-kit/tree/main)

0
services/htmx/app/index.ts Normal file
View File

26
services/htmx/app/vods/index.ts Normal file
View File

@ -0,0 +1,26 @@
fastify.route({
method: 'GET',
url: '/',
schema: {
querystring: {
type: 'object',
properties: {
name: { type: 'string' },
excitement: { type: 'integer' }
}
},
response: {
200: {
type: 'object',
properties: {
hello: { type: 'string' }
}
}
}
},
handler: function (request, reply) {
reply.send({ hello: 'world' })
}
})

0
services/htmx/app/vods/view.njk Normal file
View File

20
services/htmx/config.ts Normal file
View File

@ -0,0 +1,20 @@
const requiredEnvVars = [
'PORT'
] as const;
const getEnvVar = (key: typeof requiredEnvVars[number]): string => {
const value = process.env[key];
if (!value) {
throw new Error(`Missing ${key} env var`);
}
return value;
};
export interface Config {
port: number;
}
export const configs: Config = {
port: parseInt(getEnvVar('PORT'))
}

21
services/htmx/index.ts Normal file
View File

@ -0,0 +1,21 @@
import { configs } from './config.ts'
import Fastify from 'fastify'
const fastify = Fastify({
logger: true
})
// Declare a route
fastify.get('/', function (request, reply) {
reply.send({ hello: 'world' })
})
// Run the server!
fastify.listen({ port: configs.port }, function (err, address) {
if (err) {
fastify.log.error(err)
process.exit(1)
}
// Server is now listening on ${address}
})

23
services/htmx/package.json Normal file
View File

@ -0,0 +1,23 @@
{
"name": "htmx",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1",
"start": "node index.ts",
"dev": "pnpm run dev.nodemon # yes this is crazy to have nodemon execute tsx, but it's the only way I have found to get live reloading in TS/ESM/docker with Graphile Worker's way of loading tasks",
"dev.nodemon": "nodemon --ext ts --exec \"pnpm run dev.tsx\"",
"dev.tsx": "tsx ./app/index.ts"
},
"keywords": [],
"author": "",
"license": "Unlicense",
"dependencies": {
"fastify": "^4.28.1"
},
"devDependencies": {
"nodemon": "^3.1.4",
"tsx": "^4.19.0"
}
}

876
services/htmx/pnpm-lock.yaml Normal file
View File

@ -0,0 +1,876 @@
lockfileVersion: '9.0'
settings:
autoInstallPeers: true
excludeLinksFromLockfile: false
importers:
.:
dependencies:
fastify:
specifier: ^4.28.1
version: 4.28.1
devDependencies:
nodemon:
specifier: ^3.1.4
version: 3.1.7
tsx:
specifier: ^4.19.0
version: 4.19.2
packages:
'@esbuild/aix-ppc64@0.23.1':
resolution: {integrity: sha512-6VhYk1diRqrhBAqpJEdjASR/+WVRtfjpqKuNw11cLiaWpAT/Uu+nokB+UJnevzy/P9C/ty6AOe0dwueMrGh/iQ==}
engines: {node: '>=18'}
cpu: [ppc64]
os: [aix]
'@esbuild/android-arm64@0.23.1':
resolution: {integrity: sha512-xw50ipykXcLstLeWH7WRdQuysJqejuAGPd30vd1i5zSyKK3WE+ijzHmLKxdiCMtH1pHz78rOg0BKSYOSB/2Khw==}
engines: {node: '>=18'}
cpu: [arm64]
os: [android]
'@esbuild/android-arm@0.23.1':
resolution: {integrity: sha512-uz6/tEy2IFm9RYOyvKl88zdzZfwEfKZmnX9Cj1BHjeSGNuGLuMD1kR8y5bteYmwqKm1tj8m4cb/aKEorr6fHWQ==}
engines: {node: '>=18'}
cpu: [arm]
os: [android]
'@esbuild/android-x64@0.23.1':
resolution: {integrity: sha512-nlN9B69St9BwUoB+jkyU090bru8L0NA3yFvAd7k8dNsVH8bi9a8cUAUSEcEEgTp2z3dbEDGJGfP6VUnkQnlReg==}
engines: {node: '>=18'}
cpu: [x64]
os: [android]
'@esbuild/darwin-arm64@0.23.1':
resolution: {integrity: sha512-YsS2e3Wtgnw7Wq53XXBLcV6JhRsEq8hkfg91ESVadIrzr9wO6jJDMZnCQbHm1Guc5t/CdDiFSSfWP58FNuvT3Q==}
engines: {node: '>=18'}
cpu: [arm64]
os: [darwin]
'@esbuild/darwin-x64@0.23.1':
resolution: {integrity: sha512-aClqdgTDVPSEGgoCS8QDG37Gu8yc9lTHNAQlsztQ6ENetKEO//b8y31MMu2ZaPbn4kVsIABzVLXYLhCGekGDqw==}
engines: {node: '>=18'}
cpu: [x64]
os: [darwin]
'@esbuild/freebsd-arm64@0.23.1':
resolution: {integrity: sha512-h1k6yS8/pN/NHlMl5+v4XPfikhJulk4G+tKGFIOwURBSFzE8bixw1ebjluLOjfwtLqY0kewfjLSrO6tN2MgIhA==}
engines: {node: '>=18'}
cpu: [arm64]
os: [freebsd]
'@esbuild/freebsd-x64@0.23.1':
resolution: {integrity: sha512-lK1eJeyk1ZX8UklqFd/3A60UuZ/6UVfGT2LuGo3Wp4/z7eRTRYY+0xOu2kpClP+vMTi9wKOfXi2vjUpO1Ro76g==}
engines: {node: '>=18'}
cpu: [x64]
os: [freebsd]
'@esbuild/linux-arm64@0.23.1':
resolution: {integrity: sha512-/93bf2yxencYDnItMYV/v116zff6UyTjo4EtEQjUBeGiVpMmffDNUyD9UN2zV+V3LRV3/on4xdZ26NKzn6754g==}
engines: {node: '>=18'}
cpu: [arm64]
os: [linux]
'@esbuild/linux-arm@0.23.1':
resolution: {integrity: sha512-CXXkzgn+dXAPs3WBwE+Kvnrf4WECwBdfjfeYHpMeVxWE0EceB6vhWGShs6wi0IYEqMSIzdOF1XjQ/Mkm5d7ZdQ==}
engines: {node: '>=18'}
cpu: [arm]
os: [linux]
'@esbuild/linux-ia32@0.23.1':
resolution: {integrity: sha512-VTN4EuOHwXEkXzX5nTvVY4s7E/Krz7COC8xkftbbKRYAl96vPiUssGkeMELQMOnLOJ8k3BY1+ZY52tttZnHcXQ==}
engines: {node: '>=18'}
cpu: [ia32]
os: [linux]
'@esbuild/linux-loong64@0.23.1':
resolution: {integrity: sha512-Vx09LzEoBa5zDnieH8LSMRToj7ir/Jeq0Gu6qJ/1GcBq9GkfoEAoXvLiW1U9J1qE/Y/Oyaq33w5p2ZWrNNHNEw==}
engines: {node: '>=18'}
cpu: [loong64]
os: [linux]
'@esbuild/linux-mips64el@0.23.1':
resolution: {integrity: sha512-nrFzzMQ7W4WRLNUOU5dlWAqa6yVeI0P78WKGUo7lg2HShq/yx+UYkeNSE0SSfSure0SqgnsxPvmAUu/vu0E+3Q==}
engines: {node: '>=18'}
cpu: [mips64el]
os: [linux]
'@esbuild/linux-ppc64@0.23.1':
resolution: {integrity: sha512-dKN8fgVqd0vUIjxuJI6P/9SSSe/mB9rvA98CSH2sJnlZ/OCZWO1DJvxj8jvKTfYUdGfcq2dDxoKaC6bHuTlgcw==}
engines: {node: '>=18'}
cpu: [ppc64]
os: [linux]
'@esbuild/linux-riscv64@0.23.1':
resolution: {integrity: sha512-5AV4Pzp80fhHL83JM6LoA6pTQVWgB1HovMBsLQ9OZWLDqVY8MVobBXNSmAJi//Csh6tcY7e7Lny2Hg1tElMjIA==}
engines: {node: '>=18'}
cpu: [riscv64]
os: [linux]
'@esbuild/linux-s390x@0.23.1':
resolution: {integrity: sha512-9ygs73tuFCe6f6m/Tb+9LtYxWR4c9yg7zjt2cYkjDbDpV/xVn+68cQxMXCjUpYwEkze2RcU/rMnfIXNRFmSoDw==}
engines: {node: '>=18'}
cpu: [s390x]
os: [linux]
'@esbuild/linux-x64@0.23.1':
resolution: {integrity: sha512-EV6+ovTsEXCPAp58g2dD68LxoP/wK5pRvgy0J/HxPGB009omFPv3Yet0HiaqvrIrgPTBuC6wCH1LTOY91EO5hQ==}
engines: {node: '>=18'}
cpu: [x64]
os: [linux]
'@esbuild/netbsd-x64@0.23.1':
resolution: {integrity: sha512-aevEkCNu7KlPRpYLjwmdcuNz6bDFiE7Z8XC4CPqExjTvrHugh28QzUXVOZtiYghciKUacNktqxdpymplil1beA==}
engines: {node: '>=18'}
cpu: [x64]
os: [netbsd]
'@esbuild/openbsd-arm64@0.23.1':
resolution: {integrity: sha512-3x37szhLexNA4bXhLrCC/LImN/YtWis6WXr1VESlfVtVeoFJBRINPJ3f0a/6LV8zpikqoUg4hyXw0sFBt5Cr+Q==}
engines: {node: '>=18'}
cpu: [arm64]
os: [openbsd]
'@esbuild/openbsd-x64@0.23.1':
resolution: {integrity: sha512-aY2gMmKmPhxfU+0EdnN+XNtGbjfQgwZj43k8G3fyrDM/UdZww6xrWxmDkuz2eCZchqVeABjV5BpildOrUbBTqA==}
engines: {node: '>=18'}
cpu: [x64]
os: [openbsd]
'@esbuild/sunos-x64@0.23.1':
resolution: {integrity: sha512-RBRT2gqEl0IKQABT4XTj78tpk9v7ehp+mazn2HbUeZl1YMdaGAQqhapjGTCe7uw7y0frDi4gS0uHzhvpFuI1sA==}
engines: {node: '>=18'}
cpu: [x64]
os: [sunos]
'@esbuild/win32-arm64@0.23.1':
resolution: {integrity: sha512-4O+gPR5rEBe2FpKOVyiJ7wNDPA8nGzDuJ6gN4okSA1gEOYZ67N8JPk58tkWtdtPeLz7lBnY6I5L3jdsr3S+A6A==}
engines: {node: '>=18'}
cpu: [arm64]
os: [win32]
'@esbuild/win32-ia32@0.23.1':
resolution: {integrity: sha512-BcaL0Vn6QwCwre3Y717nVHZbAa4UBEigzFm6VdsVdT/MbZ38xoj1X9HPkZhbmaBGUD1W8vxAfffbDe8bA6AKnQ==}
engines: {node: '>=18'}
cpu: [ia32]
os: [win32]
'@esbuild/win32-x64@0.23.1':
resolution: {integrity: sha512-BHpFFeslkWrXWyUPnbKm+xYYVYruCinGcftSBaa8zoF9hZO4BcSCFUvHVTtzpIY6YzUnYtuEhZ+C9iEXjxnasg==}
engines: {node: '>=18'}
cpu: [x64]
os: [win32]
'@fastify/ajv-compiler@3.6.0':
resolution: {integrity: sha512-LwdXQJjmMD+GwLOkP7TVC68qa+pSSogeWWmznRJ/coyTcfe9qA05AHFSe1eZFwK6q+xVRpChnvFUkf1iYaSZsQ==}
'@fastify/error@3.4.1':
resolution: {integrity: sha512-wWSvph+29GR783IhmvdwWnN4bUxTD01Vm5Xad4i7i1VuAOItLvbPAb69sb0IQ2N57yprvhNIwAP5B6xfKTmjmQ==}
'@fastify/fast-json-stringify-compiler@4.3.0':
resolution: {integrity: sha512-aZAXGYo6m22Fk1zZzEUKBvut/CIIQe/BapEORnxiD5Qr0kPHqqI69NtEMCme74h+at72sPhbkb4ZrLd1W3KRLA==}
'@fastify/merge-json-schemas@0.1.1':
resolution: {integrity: sha512-fERDVz7topgNjtXsJTTW1JKLy0rhuLRcquYqNR9rF7OcVpCa2OVW49ZPDIhaRRCaUuvVxI+N416xUoF76HNSXA==}
abstract-logging@2.0.1:
resolution: {integrity: sha512-2BjRTZxTPvheOvGbBslFSYOUkr+SjPtOnrLP33f+VIWLzezQpZcqVg7ja3L4dBXmzzgwT+a029jRx5PCi3JuiA==}
ajv-formats@2.1.1:
resolution: {integrity: sha512-Wx0Kx52hxE7C18hkMEggYlEifqWZtYaRgouJor+WMdPnQyEK13vgEWyVNup7SoeeoLMsr4kf5h6dOW11I15MUA==}
peerDependencies:
ajv: ^8.0.0
peerDependenciesMeta:
ajv:
optional: true
ajv-formats@3.0.1:
resolution: {integrity: sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==}
peerDependencies:
ajv: ^8.0.0
peerDependenciesMeta:
ajv:
optional: true
ajv@8.17.1:
resolution: {integrity: sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g==}
anymatch@3.1.3:
resolution: {integrity: sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==}
engines: {node: '>= 8'}
atomic-sleep@1.0.0:
resolution: {integrity: sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==}
engines: {node: '>=8.0.0'}
avvio@8.4.0:
resolution: {integrity: sha512-CDSwaxINFy59iNwhYnkvALBwZiTydGkOecZyPkqBpABYR1KqGEsET0VOOYDwtleZSUIdeY36DC2bSZ24CO1igA==}
balanced-match@1.0.2:
resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
binary-extensions@2.3.0:
resolution: {integrity: sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==}
engines: {node: '>=8'}
brace-expansion@1.1.11:
resolution: {integrity: sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==}
braces@3.0.3:
resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
engines: {node: '>=8'}
chokidar@3.6.0:
resolution: {integrity: sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==}
engines: {node: '>= 8.10.0'}
concat-map@0.0.1:
resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
cookie@0.7.2:
resolution: {integrity: sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==}
engines: {node: '>= 0.6'}
debug@4.3.7:
resolution: {integrity: sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ==}
engines: {node: '>=6.0'}
peerDependencies:
supports-color: '*'
peerDependenciesMeta:
supports-color:
optional: true
esbuild@0.23.1:
resolution: {integrity: sha512-VVNz/9Sa0bs5SELtn3f7qhJCDPCF5oMEl5cO9/SSinpE9hbPVvxbd572HH5AKiP7WD8INO53GgfDDhRjkylHEg==}
engines: {node: '>=18'}
hasBin: true
fast-content-type-parse@1.1.0:
resolution: {integrity: sha512-fBHHqSTFLVnR61C+gltJuE5GkVQMV0S2nqUO8TJ+5Z3qAKG8vAx4FKai1s5jq/inV1+sREynIWSuQ6HgoSXpDQ==}
fast-decode-uri-component@1.0.1:
resolution: {integrity: sha512-WKgKWg5eUxvRZGwW8FvfbaH7AXSh2cL+3j5fMGzUMCxWBJ3dV3a7Wz8y2f/uQ0e3B6WmodD3oS54jTQ9HVTIIg==}
fast-deep-equal@3.1.3:
resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
fast-json-stringify@5.16.1:
resolution: {integrity: sha512-KAdnLvy1yu/XrRtP+LJnxbBGrhN+xXu+gt3EUvZhYGKCr3lFHq/7UFJHHFgmJKoqlh6B40bZLEv7w46B0mqn1g==}
fast-querystring@1.1.2:
resolution: {integrity: sha512-g6KuKWmFXc0fID8WWH0jit4g0AGBoJhCkJMb1RmbsSEUNvQ+ZC8D6CUZ+GtF8nMzSPXnhiePyyqqipzNNEnHjg==}
fast-redact@3.5.0:
resolution: {integrity: sha512-dwsoQlS7h9hMeYUq1W++23NDcBLV4KqONnITDV9DjfS3q1SgDGVrBdvvTLUotWtPSD7asWDV9/CmsZPy8Hf70A==}
engines: {node: '>=6'}
fast-uri@2.4.0:
resolution: {integrity: sha512-ypuAmmMKInk5q7XcepxlnUWDLWv4GFtaJqAzWKqn62IpQ3pejtr5dTVbt3vwqVaMKmkNR55sTT+CqUKIaT21BA==}
fast-uri@3.0.3:
resolution: {integrity: sha512-aLrHthzCjH5He4Z2H9YZ+v6Ujb9ocRuW6ZzkJQOrTxleEijANq4v1TsaPaVG1PZcuurEzrLcWRyYBYXD5cEiaw==}
fastify@4.28.1:
resolution: {integrity: sha512-kFWUtpNr4i7t5vY2EJPCN2KgMVpuqfU4NjnJNCgiNB900oiDeYqaNDRcAfeBbOF5hGixixxcKnOU4KN9z6QncQ==}
fastq@1.17.1:
resolution: {integrity: sha512-sRVD3lWVIXWg6By68ZN7vho9a1pQcN/WBFaAAsDDFzlJjvoGx0P8z7V1t72grFJfJhu3YPZBuu25f7Kaw2jN1w==}
fill-range@7.1.1:
resolution: {integrity: sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==}
engines: {node: '>=8'}
find-my-way@8.2.2:
resolution: {integrity: sha512-Dobi7gcTEq8yszimcfp/R7+owiT4WncAJ7VTTgFH1jYJ5GaG1FbhjwDG820hptN0QDFvzVY3RfCzdInvGPGzjA==}
engines: {node: '>=14'}
forwarded@0.2.0:
resolution: {integrity: sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==}
engines: {node: '>= 0.6'}
fsevents@2.3.3:
resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
os: [darwin]
get-tsconfig@4.8.1:
resolution: {integrity: sha512-k9PN+cFBmaLWtVz29SkUoqU5O0slLuHJXt/2P+tMVFT+phsSGXGkp9t3rQIqdz0e+06EHNGs3oM6ZX1s2zHxRg==}
glob-parent@5.1.2:
resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
engines: {node: '>= 6'}
has-flag@3.0.0:
resolution: {integrity: sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==}
engines: {node: '>=4'}
ignore-by-default@1.0.1:
resolution: {integrity: sha512-Ius2VYcGNk7T90CppJqcIkS5ooHUZyIQK+ClZfMfMNFEF9VSE73Fq+906u/CWu92x4gzZMWOwfFYckPObzdEbA==}
ipaddr.js@1.9.1:
resolution: {integrity: sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==}
engines: {node: '>= 0.10'}
is-binary-path@2.1.0:
resolution: {integrity: sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==}
engines: {node: '>=8'}
is-extglob@2.1.1:
resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
engines: {node: '>=0.10.0'}
is-glob@4.0.3:
resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
engines: {node: '>=0.10.0'}
is-number@7.0.0:
resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
engines: {node: '>=0.12.0'}
json-schema-ref-resolver@1.0.1:
resolution: {integrity: sha512-EJAj1pgHc1hxF6vo2Z3s69fMjO1INq6eGHXZ8Z6wCQeldCuwxGK9Sxf4/cScGn3FZubCVUehfWtcDM/PLteCQw==}
json-schema-traverse@1.0.0:
resolution: {integrity: sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==}
light-my-request@5.14.0:
resolution: {integrity: sha512-aORPWntbpH5esaYpGOOmri0OHDOe3wC5M2MQxZ9dvMLZm6DnaAn0kJlcbU9hwsQgLzmZyReKwFwwPkR+nHu5kA==}
minimatch@3.1.2:
resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==}
ms@2.1.3:
resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
nodemon@3.1.7:
resolution: {integrity: sha512-hLj7fuMow6f0lbB0cD14Lz2xNjwsyruH251Pk4t/yIitCFJbmY1myuLlHm/q06aST4jg6EgAh74PIBBrRqpVAQ==}
engines: {node: '>=10'}
hasBin: true
normalize-path@3.0.0:
resolution: {integrity: sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==}
engines: {node: '>=0.10.0'}
on-exit-leak-free@2.1.2:
resolution: {integrity: sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==}
engines: {node: '>=14.0.0'}
picomatch@2.3.1:
resolution: {integrity: sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==}
engines: {node: '>=8.6'}
pino-abstract-transport@2.0.0:
resolution: {integrity: sha512-F63x5tizV6WCh4R6RHyi2Ml+M70DNRXt/+HANowMflpgGFMAym/VKm6G7ZOQRjqN7XbGxK1Lg9t6ZrtzOaivMw==}
pino-std-serializers@7.0.0:
resolution: {integrity: sha512-e906FRY0+tV27iq4juKzSYPbUj2do2X2JX4EzSca1631EB2QJQUqGbDuERal7LCtOpxl6x3+nvo9NPZcmjkiFA==}
pino@9.5.0:
resolution: {integrity: sha512-xSEmD4pLnV54t0NOUN16yCl7RIB1c5UUOse5HSyEXtBp+FgFQyPeDutc+Q2ZO7/22vImV7VfEjH/1zV2QuqvYw==}
hasBin: true
process-warning@3.0.0:
resolution: {integrity: sha512-mqn0kFRl0EoqhnL0GQ0veqFHyIN1yig9RHh/InzORTUiZHFRAur+aMtRkELNwGs9aNwKS6tg/An4NYBPGwvtzQ==}
process-warning@4.0.0:
resolution: {integrity: sha512-/MyYDxttz7DfGMMHiysAsFE4qF+pQYAA8ziO/3NcRVrQ5fSk+Mns4QZA/oRPFzvcqNoVJXQNWNAsdwBXLUkQKw==}
proxy-addr@2.0.7:
resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==}
engines: {node: '>= 0.10'}
pstree.remy@1.1.8:
resolution: {integrity: sha512-77DZwxQmxKnu3aR542U+X8FypNzbfJ+C5XQDk3uWjWxn6151aIMGthWYRXTqT1E5oJvg+ljaa2OJi+VfvCOQ8w==}
quick-format-unescaped@4.0.4:
resolution: {integrity: sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg==}
readdirp@3.6.0:
resolution: {integrity: sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==}
engines: {node: '>=8.10.0'}
real-require@0.2.0:
resolution: {integrity: sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg==}
engines: {node: '>= 12.13.0'}
require-from-string@2.0.2:
resolution: {integrity: sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==}
engines: {node: '>=0.10.0'}
resolve-pkg-maps@1.0.0:
resolution: {integrity: sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==}
ret@0.4.3:
resolution: {integrity: sha512-0f4Memo5QP7WQyUEAYUO3esD/XjOc3Zjjg5CPsAq1p8sIu0XPeMbHJemKA0BO7tV0X7+A0FoEpbmHXWxPyD3wQ==}
engines: {node: '>=10'}
reusify@1.0.4:
resolution: {integrity: sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==}
engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
rfdc@1.4.1:
resolution: {integrity: sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA==}
safe-regex2@3.1.0:
resolution: {integrity: sha512-RAAZAGbap2kBfbVhvmnTFv73NWLMvDGOITFYTZBAaY8eR+Ir4ef7Up/e7amo+y1+AH+3PtLkrt9mvcTsG9LXug==}
safe-stable-stringify@2.5.0:
resolution: {integrity: sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==}
engines: {node: '>=10'}
secure-json-parse@2.7.0:
resolution: {integrity: sha512-6aU+Rwsezw7VR8/nyvKTx8QpWH9FrcYiXXlqC4z5d5XQBDRqtbfsRjnwGyqbi3gddNtWHuEk9OANUotL26qKUw==}
semver@7.6.3:
resolution: {integrity: sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A==}
engines: {node: '>=10'}
hasBin: true
set-cookie-parser@2.7.1:
resolution: {integrity: sha512-IOc8uWeOZgnb3ptbCURJWNjWUPcO3ZnTTdzsurqERrP6nPyv+paC55vJM0LpOlT2ne+Ix+9+CRG1MNLlyZ4GjQ==}
simple-update-notifier@2.0.0:
resolution: {integrity: sha512-a2B9Y0KlNXl9u/vsW6sTIu9vGEpfKu2wRV6l1H3XEas/0gUIzGzBoP/IouTcUQbm9JWZLH3COxyn03TYlFax6w==}
engines: {node: '>=10'}
sonic-boom@4.2.0:
resolution: {integrity: sha512-INb7TM37/mAcsGmc9hyyI6+QR3rR1zVRu36B0NeGXKnOOLiZOfER5SA+N7X7k3yUYRzLWafduTDvJAfDswwEww==}
split2@4.2.0:
resolution: {integrity: sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==}
engines: {node: '>= 10.x'}
supports-color@5.5.0:
resolution: {integrity: sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==}
engines: {node: '>=4'}
thread-stream@3.1.0:
resolution: {integrity: sha512-OqyPZ9u96VohAyMfJykzmivOrY2wfMSf3C5TtFJVgN+Hm6aj+voFhlK+kZEIv2FBh1X6Xp3DlnCOfEQ3B2J86A==}
to-regex-range@5.0.1:
resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
engines: {node: '>=8.0'}
toad-cache@3.7.0:
resolution: {integrity: sha512-/m8M+2BJUpoJdgAHoG+baCwBT+tf2VraSfkBgl0Y00qIWt41DJ8R5B8nsEw0I58YwF5IZH6z24/2TobDKnqSWw==}
engines: {node: '>=12'}
touch@3.1.1:
resolution: {integrity: sha512-r0eojU4bI8MnHr8c5bNo7lJDdI2qXlWWJk6a9EAFG7vbhTjElYhBVS3/miuE0uOuoLdb8Mc/rVfsmm6eo5o9GA==}
hasBin: true
tsx@4.19.2:
resolution: {integrity: sha512-pOUl6Vo2LUq/bSa8S5q7b91cgNSjctn9ugq/+Mvow99qW6x/UZYwzxy/3NmqoT66eHYfCVvFvACC58UBPFf28g==}
engines: {node: '>=18.0.0'}
hasBin: true
undefsafe@2.0.5:
resolution: {integrity: sha512-WxONCrssBM8TSPRqN5EmsjVrsv4A8X12J4ArBiiayv3DyyG3ZlIg6yysuuSYdZsVz3TKcTg2fd//Ujd4CHV1iA==}
snapshots:
'@esbuild/aix-ppc64@0.23.1':
optional: true
'@esbuild/android-arm64@0.23.1':
optional: true
'@esbuild/android-arm@0.23.1':
optional: true
'@esbuild/android-x64@0.23.1':
optional: true
'@esbuild/darwin-arm64@0.23.1':
optional: true
'@esbuild/darwin-x64@0.23.1':
optional: true
'@esbuild/freebsd-arm64@0.23.1':
optional: true
'@esbuild/freebsd-x64@0.23.1':
optional: true
'@esbuild/linux-arm64@0.23.1':
optional: true
'@esbuild/linux-arm@0.23.1':
optional: true
'@esbuild/linux-ia32@0.23.1':
optional: true
'@esbuild/linux-loong64@0.23.1':
optional: true
'@esbuild/linux-mips64el@0.23.1':
optional: true
'@esbuild/linux-ppc64@0.23.1':
optional: true
'@esbuild/linux-riscv64@0.23.1':
optional: true
'@esbuild/linux-s390x@0.23.1':
optional: true
'@esbuild/linux-x64@0.23.1':
optional: true
'@esbuild/netbsd-x64@0.23.1':
optional: true
'@esbuild/openbsd-arm64@0.23.1':
optional: true
'@esbuild/openbsd-x64@0.23.1':
optional: true
'@esbuild/sunos-x64@0.23.1':
optional: true
'@esbuild/win32-arm64@0.23.1':
optional: true
'@esbuild/win32-ia32@0.23.1':
optional: true
'@esbuild/win32-x64@0.23.1':
optional: true
'@fastify/ajv-compiler@3.6.0':
dependencies:
ajv: 8.17.1
ajv-formats: 2.1.1(ajv@8.17.1)
fast-uri: 2.4.0
'@fastify/error@3.4.1': {}
'@fastify/fast-json-stringify-compiler@4.3.0':
dependencies:
fast-json-stringify: 5.16.1
'@fastify/merge-json-schemas@0.1.1':
dependencies:
fast-deep-equal: 3.1.3
abstract-logging@2.0.1: {}
ajv-formats@2.1.1(ajv@8.17.1):
optionalDependencies:
ajv: 8.17.1
ajv-formats@3.0.1(ajv@8.17.1):
optionalDependencies:
ajv: 8.17.1
ajv@8.17.1:
dependencies:
fast-deep-equal: 3.1.3
fast-uri: 3.0.3
json-schema-traverse: 1.0.0
require-from-string: 2.0.2
anymatch@3.1.3:
dependencies:
normalize-path: 3.0.0
picomatch: 2.3.1
atomic-sleep@1.0.0: {}
avvio@8.4.0:
dependencies:
'@fastify/error': 3.4.1
fastq: 1.17.1
balanced-match@1.0.2: {}
binary-extensions@2.3.0: {}
brace-expansion@1.1.11:
dependencies:
balanced-match: 1.0.2
concat-map: 0.0.1
braces@3.0.3:
dependencies:
fill-range: 7.1.1
chokidar@3.6.0:
dependencies:
anymatch: 3.1.3
braces: 3.0.3
glob-parent: 5.1.2
is-binary-path: 2.1.0
is-glob: 4.0.3
normalize-path: 3.0.0
readdirp: 3.6.0
optionalDependencies:
fsevents: 2.3.3
concat-map@0.0.1: {}
cookie@0.7.2: {}
debug@4.3.7(supports-color@5.5.0):
dependencies:
ms: 2.1.3
optionalDependencies:
supports-color: 5.5.0
esbuild@0.23.1:
optionalDependencies:
'@esbuild/aix-ppc64': 0.23.1
'@esbuild/android-arm': 0.23.1
'@esbuild/android-arm64': 0.23.1
'@esbuild/android-x64': 0.23.1
'@esbuild/darwin-arm64': 0.23.1
'@esbuild/darwin-x64': 0.23.1
'@esbuild/freebsd-arm64': 0.23.1
'@esbuild/freebsd-x64': 0.23.1
'@esbuild/linux-arm': 0.23.1
'@esbuild/linux-arm64': 0.23.1
'@esbuild/linux-ia32': 0.23.1
'@esbuild/linux-loong64': 0.23.1
'@esbuild/linux-mips64el': 0.23.1
'@esbuild/linux-ppc64': 0.23.1
'@esbuild/linux-riscv64': 0.23.1
'@esbuild/linux-s390x': 0.23.1
'@esbuild/linux-x64': 0.23.1
'@esbuild/netbsd-x64': 0.23.1
'@esbuild/openbsd-arm64': 0.23.1
'@esbuild/openbsd-x64': 0.23.1
'@esbuild/sunos-x64': 0.23.1
'@esbuild/win32-arm64': 0.23.1
'@esbuild/win32-ia32': 0.23.1
'@esbuild/win32-x64': 0.23.1
fast-content-type-parse@1.1.0: {}
fast-decode-uri-component@1.0.1: {}
fast-deep-equal@3.1.3: {}
fast-json-stringify@5.16.1:
dependencies:
'@fastify/merge-json-schemas': 0.1.1
ajv: 8.17.1
ajv-formats: 3.0.1(ajv@8.17.1)
fast-deep-equal: 3.1.3
fast-uri: 2.4.0
json-schema-ref-resolver: 1.0.1
rfdc: 1.4.1
fast-querystring@1.1.2:
dependencies:
fast-decode-uri-component: 1.0.1
fast-redact@3.5.0: {}
fast-uri@2.4.0: {}
fast-uri@3.0.3: {}
fastify@4.28.1:
dependencies:
'@fastify/ajv-compiler': 3.6.0
'@fastify/error': 3.4.1
'@fastify/fast-json-stringify-compiler': 4.3.0
abstract-logging: 2.0.1
avvio: 8.4.0
fast-content-type-parse: 1.1.0
fast-json-stringify: 5.16.1
find-my-way: 8.2.2
light-my-request: 5.14.0
pino: 9.5.0
process-warning: 3.0.0
proxy-addr: 2.0.7
rfdc: 1.4.1
secure-json-parse: 2.7.0
semver: 7.6.3
toad-cache: 3.7.0
fastq@1.17.1:
dependencies:
reusify: 1.0.4
fill-range@7.1.1:
dependencies:
to-regex-range: 5.0.1
find-my-way@8.2.2:
dependencies:
fast-deep-equal: 3.1.3
fast-querystring: 1.1.2
safe-regex2: 3.1.0
forwarded@0.2.0: {}
fsevents@2.3.3:
optional: true
get-tsconfig@4.8.1:
dependencies:
resolve-pkg-maps: 1.0.0
glob-parent@5.1.2:
dependencies:
is-glob: 4.0.3
has-flag@3.0.0: {}
ignore-by-default@1.0.1: {}
ipaddr.js@1.9.1: {}
is-binary-path@2.1.0:
dependencies:
binary-extensions: 2.3.0
is-extglob@2.1.1: {}
is-glob@4.0.3:
dependencies:
is-extglob: 2.1.1
is-number@7.0.0: {}
json-schema-ref-resolver@1.0.1:
dependencies:
fast-deep-equal: 3.1.3
json-schema-traverse@1.0.0: {}
light-my-request@5.14.0:
dependencies:
cookie: 0.7.2
process-warning: 3.0.0
set-cookie-parser: 2.7.1
minimatch@3.1.2:
dependencies:
brace-expansion: 1.1.11
ms@2.1.3: {}
nodemon@3.1.7:
dependencies:
chokidar: 3.6.0
debug: 4.3.7(supports-color@5.5.0)
ignore-by-default: 1.0.1
minimatch: 3.1.2
pstree.remy: 1.1.8
semver: 7.6.3
simple-update-notifier: 2.0.0
supports-color: 5.5.0
touch: 3.1.1
undefsafe: 2.0.5
normalize-path@3.0.0: {}
on-exit-leak-free@2.1.2: {}
picomatch@2.3.1: {}
pino-abstract-transport@2.0.0:
dependencies:
split2: 4.2.0
pino-std-serializers@7.0.0: {}
pino@9.5.0:
dependencies:
atomic-sleep: 1.0.0
fast-redact: 3.5.0
on-exit-leak-free: 2.1.2
pino-abstract-transport: 2.0.0
pino-std-serializers: 7.0.0
process-warning: 4.0.0
quick-format-unescaped: 4.0.4
real-require: 0.2.0
safe-stable-stringify: 2.5.0
sonic-boom: 4.2.0
thread-stream: 3.1.0
process-warning@3.0.0: {}
process-warning@4.0.0: {}
proxy-addr@2.0.7:
dependencies:
forwarded: 0.2.0
ipaddr.js: 1.9.1
pstree.remy@1.1.8: {}
quick-format-unescaped@4.0.4: {}
readdirp@3.6.0:
dependencies:
picomatch: 2.3.1
real-require@0.2.0: {}
require-from-string@2.0.2: {}
resolve-pkg-maps@1.0.0: {}
ret@0.4.3: {}
reusify@1.0.4: {}
rfdc@1.4.1: {}
safe-regex2@3.1.0:
dependencies:
ret: 0.4.3
safe-stable-stringify@2.5.0: {}
secure-json-parse@2.7.0: {}
semver@7.6.3: {}
set-cookie-parser@2.7.1: {}
simple-update-notifier@2.0.0:
dependencies:
semver: 7.6.3
sonic-boom@4.2.0:
dependencies:
atomic-sleep: 1.0.0
split2@4.2.0: {}
supports-color@5.5.0:
dependencies:
has-flag: 3.0.0
thread-stream@3.1.0:
dependencies:
real-require: 0.2.0
to-regex-range@5.0.1:
dependencies:
is-number: 7.0.0
toad-cache@3.7.0: {}
touch@3.1.1: {}
tsx@4.19.2:
dependencies:
esbuild: 0.23.1
get-tsconfig: 4.8.1
optionalDependencies:
fsevents: 2.3.3
undefsafe@2.0.5: {}

26
services/htmx/src/routes.ts Normal file
View File

@ -0,0 +1,26 @@
fastify.route({
method: 'GET',
url: '/',
schema: {
querystring: {
type: 'object',
properties: {
name: { type: 'string' },
excitement: { type: 'integer' }
}
},
response: {
200: {
type: 'object',
properties: {
hello: { type: 'string' }
}
}
}
},
handler: function (request, reply) {
reply.send({ hello: 'world' })
}
})

4
services/migrations/migrations/00096_add-id_num-to-s3_files.sql Normal file
View File

@ -0,0 +1,4 @@
-- for strapi to postgrest migration. this col is meant to be deleted later
ALTER TABLE IF EXISTS api.s3_files
ADD COLUMN IF NOT EXISTS id_num INT;

4
services/migrations/migrations/00097_add-id_num-to-mux-assets.sql Normal file
View File

@ -0,0 +1,4 @@
-- for strapi to postgrest migration. this col is meant to be deleted later
ALTER TABLE IF EXISTS api.mux_assets
ADD COLUMN IF NOT EXISTS id_num INT;

6
services/migrations/migrations/00098_add-id_num-to-streams.sql Normal file
View File

@ -0,0 +1,6 @@
-- for strapi to postgrest migration. this col is meant to be deleted later
ALTER TABLE IF EXISTS api.streams
ADD COLUMN IF NOT EXISTS id_num INT;
ALTER TABLE IF EXISTS api.vtubers
ADD COLUMN IF NOT EXISTS id_num INT;

6
services/migrations/migrations/00099_add-vtuber_num.sql Normal file
View File

@ -0,0 +1,6 @@
-- adding an INT col to make it compatible with the strapi migration
-- this is meant to be deleted after migration to UUID
ALTER TABLE IF EXISTS api.streams
ADD COLUMN IF NOT EXISTS vtuber_num INT;

2
services/migrations/migrations/00100_add-id_num-to-tags.sql Normal file
View File

@ -0,0 +1,2 @@
ALTER TABLE IF EXISTS api.tags
ADD COLUMN IF NOT EXISTS id_num INT;

11
services/migrations/migrations/00101_add-missing-cols-to-tags.sql Normal file
View File

@ -0,0 +1,11 @@
ALTER TABLE IF EXISTS api.tags
ADD COLUMN IF NOT EXISTS created_at TIMESTAMP WITHOUT TIME ZONE;
ALTER TABLE IF EXISTS api.tags
ADD COLUMN IF NOT EXISTS updated_at TIMESTAMP WITHOUT TIME ZONE;
ALTER TABLE IF EXISTS api.tags
ADD COLUMN IF NOT EXISTS created_by_id INT;
ALTER TABLE IF EXISTS api.tags
ADD COLUMN IF NOT EXISTS updated_by_id INT;

3
services/migrations/migrations/00102_add-toy_id_num-to-tags.sql Normal file
View File

@ -0,0 +1,3 @@
ALTER TABLE IF EXISTS api.tags
ADD COLUMN IF NOT EXISTS toy_id_num INT;

21
services/migrations/migrations/00103_add-toy_num.sql Normal file
View File

@ -0,0 +1,21 @@
ALTER TABLE IF EXISTS api.toys
ADD COLUMN IF NOT EXISTS toy_id_num INT;
ALTER TABLE IF EXISTS api.toys
ADD COLUMN IF NOT EXISTS created_at TIMESTAMP WITHOUT TIME ZONE;
ALTER TABLE IF EXISTS api.toys
ADD COLUMN IF NOT EXISTS updated_at TIMESTAMP WITHOUT TIME ZONE;
ALTER TABLE IF EXISTS api.toys
ADD COLUMN IF NOT EXISTS created_by_id_num INT;
ALTER TABLE IF EXISTS api.toys
ADD COLUMN IF NOT EXISTS updated_by_id_num INT;
ALTER TABLE IF EXISTS api.toys
ADD COLUMN IF NOT EXISTS created_by_id UUID;
ALTER TABLE IF EXISTS api.toys
ADD COLUMN IF NOT EXISTS updated_by_id UUID;

7
services/migrations/migrations/00104_add-toy_num-fix.sql Normal file
View File

@ -0,0 +1,7 @@
ALTER TABLE IF EXISTS api.toys
DROP COLUMN IF EXISTS toy_id_num;
ALTER TABLE IF EXISTS api.toys
ADD COLUMN IF NOT EXISTS id_num INT;

18
services/migrations/migrations/00105_add-id_num-to-vods_links.sql Normal file
View File

@ -0,0 +1,18 @@
ALTER TABLE IF EXISTS api.vods_mux_asset_links
ADD COLUMN IF NOT EXISTS id_num INT;
ALTER TABLE IF EXISTS api.vods_stream_links
ADD COLUMN IF NOT EXISTS id_num INT;
ALTER TABLE IF EXISTS api.vods_thumbnail_links
ADD COLUMN IF NOT EXISTS id_num INT;
ALTER TABLE IF EXISTS api.vods_uploader_links
ADD COLUMN IF NOT EXISTS id_num INT;
ALTER TABLE IF EXISTS api.vods_video_src_b_2_links
ADD COLUMN IF NOT EXISTS id_num INT;
ALTER TABLE IF EXISTS api.vods_vtuber_links
ADD COLUMN IF NOT EXISTS id_num INT;

2
services/migrations/migrations/00106_add-id_num-to-vods.sql Normal file
View File

@ -0,0 +1,2 @@
ALTER TABLE IF EXISTS api.vods
ADD COLUMN IF NOT EXISTS id_num INT;

125
services/migrations/migrations/00107_remove-uuid.sql Normal file
View File

@ -0,0 +1,125 @@
-- I was planning on migrating strapi database to postgrest and also migrating from INT to UUID.
-- Doing both at once proved far too complex, so I'm reverting the schmea to use INT ids in order to migrate.
-- Once that is done we can switch to uuids, but the two steps should be separate
DO $$
BEGIN
-- api.builds
ALTER TABLE api.builds DROP COLUMN id CASCADE;
ALTER TABLE api.builds ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
ALTER TABLE api.builds DROP COLUMN vod_id CASCADE;
ALTER TABLE api.builds ADD COLUMN vod_id INT;
-- api.contributors
ALTER TABLE api.contributors DROP COLUMN id CASCADE;
ALTER TABLE api.contributors ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
-- api.discord_interactions
ALTER TABLE api.discord_interactions DROP COLUMN id CASCADE;
ALTER TABLE api.discord_interactions ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
-- api.mux_assets
ALTER TABLE api.mux_assets DROP COLUMN id CASCADE;
ALTER TABLE api.mux_assets ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
-- api.patrons
ALTER TABLE api.patrons DROP COLUMN id CASCADE;
ALTER TABLE api.patrons ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
-- api.recordings
ALTER TABLE api.recordings DROP COLUMN id CASCADE;
ALTER TABLE api.recordings ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
ALTER TABLE api.recordings DROP COLUMN discord_interaction_id CASCADE;
ALTER TABLE api.recordings ADD COLUMN discord_interaction_id INT;
-- api.s3_files
ALTER TABLE api.s3_files DROP COLUMN id CASCADE;
ALTER TABLE api.s3_files ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
-- api.segments
ALTER TABLE api.segments DROP COLUMN id CASCADE;
ALTER TABLE api.segments ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
ALTER TABLE api.segments DROP COLUMN vod_id CASCADE;
ALTER TABLE api.segments ADD COLUMN vod_id INT;
-- api.segments_vod_links
ALTER TABLE api.segments_vod_links DROP COLUMN id CASCADE;
ALTER TABLE api.segments_vod_links ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
ALTER TABLE api.segments_vod_links DROP COLUMN segment_id CASCADE;
ALTER TABLE api.segments_vod_links ADD COLUMN segment_id INT;
ALTER TABLE api.segments_vod_links DROP COLUMN vod_id CASCADE;
ALTER TABLE api.segments_vod_links ADD COLUMN vod_id INT;
-- api.streams
ALTER TABLE api.streams DROP COLUMN id CASCADE;
ALTER TABLE api.streams ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
ALTER TABLE api.streams DROP COLUMN vtuber CASCADE;
ALTER TABLE api.streams ADD COLUMN vtuber INT;
-- api.tags
ALTER TABLE api.tags DROP COLUMN id CASCADE;
ALTER TABLE api.tags ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
ALTER TABLE api.tags DROP COLUMN toy_id CASCADE;
ALTER TABLE api.tags ADD COLUMN toy_id INT;
-- api.tags_vods
ALTER TABLE api.tags_vods DROP COLUMN id CASCADE;
ALTER TABLE api.tags_vods ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
ALTER TABLE api.tags_vods DROP COLUMN tag_id CASCADE;
ALTER TABLE api.tags_vods ADD COLUMN tag_id INT;
ALTER TABLE api.tags_vods DROP COLUMN vod_id CASCADE;
ALTER TABLE api.tags_vods ADD COLUMN vod_id INT;
-- api.toys
ALTER TABLE api.toys DROP COLUMN id CASCADE;
ALTER TABLE api.toys ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
ALTER TABLE api.toys DROP COLUMN created_by_id CASCADE;
ALTER TABLE api.toys ADD COLUMN created_by_id INT;
ALTER TABLE api.toys DROP COLUMN updated_by_id CASCADE;
ALTER TABLE api.toys ADD COLUMN updated_by_id INT;
-- api.toys_tags
ALTER TABLE api.toys_tags DROP COLUMN id CASCADE;
ALTER TABLE api.toys_tags ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
ALTER TABLE api.toys_tags DROP COLUMN tag_id CASCADE;
ALTER TABLE api.toys_tags ADD COLUMN tag_id INT;
ALTER TABLE api.toys_tags DROP COLUMN toy_id CASCADE;
ALTER TABLE api.toys_tags ADD COLUMN toy_id INT;
-- api.toys_vtubers
ALTER TABLE api.toys_vtubers DROP COLUMN id CASCADE;
ALTER TABLE api.toys_vtubers ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
ALTER TABLE api.toys_vtubers DROP COLUMN toy_id CASCADE;
ALTER TABLE api.toys_vtubers ADD COLUMN toy_id INT;
ALTER TABLE api.toys_vtubers DROP COLUMN vtuber_id CASCADE;
ALTER TABLE api.toys_vtubers ADD COLUMN vtuber_id INT;
-- api.vods
ALTER TABLE api.vods DROP COLUMN id CASCADE;
ALTER TABLE api.vods ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
ALTER TABLE api.vods DROP COLUMN mux_asset CASCADE;
ALTER TABLE api.vods ADD COLUMN mux_asset INT;
ALTER TABLE api.vods DROP COLUMN recording_id CASCADE;
ALTER TABLE api.vods ADD COLUMN recording_id INT;
ALTER TABLE api.vods DROP COLUMN s3_file CASCADE;
ALTER TABLE api.vods ADD COLUMN s3_file INT;
ALTER TABLE api.vods DROP COLUMN stream_id CASCADE;
ALTER TABLE api.vods ADD COLUMN stream_id INT;
ALTER TABLE api.vods DROP COLUMN thumbnail CASCADE;
ALTER TABLE api.vods ADD COLUMN thumbnail INT;
ALTER TABLE api.vods DROP COLUMN vtuber CASCADE;
ALTER TABLE api.vods ADD COLUMN vtuber INT;
-- api.vods_s3_files_joins
ALTER TABLE api.vods_s3_files_joins DROP COLUMN id CASCADE;
ALTER TABLE api.vods_s3_files_joins ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
ALTER TABLE api.vods_s3_files_joins DROP COLUMN s3_file_id CASCADE;
ALTER TABLE api.vods_s3_files_joins ADD COLUMN s3_file_id INT;
ALTER TABLE api.vods_s3_files_joins DROP COLUMN vod_id CASCADE;
ALTER TABLE api.vods_s3_files_joins ADD COLUMN vod_id INT;
-- api.vtubers
ALTER TABLE api.vtubers DROP COLUMN id CASCADE;
ALTER TABLE api.vtubers ADD COLUMN id INT GENERATED ALWAYS AS IDENTITY PRIMARY KEY;
END $$;

47
services/migrations/migrations/00108_add-strapi-tables.sql Normal file
View File

@ -0,0 +1,47 @@
CREATE TABLE IF NOT EXISTS api.streams_vtuber_links
(
id integer NOT NULL,
stream_id integer,
vtuber_id integer,
stream_order double precision,
CONSTRAINT streams_vtuber_links_pkey PRIMARY KEY (id),
CONSTRAINT streams_vtuber_links_unique UNIQUE (stream_id, vtuber_id),
CONSTRAINT streams_vtuber_links_fk FOREIGN KEY (stream_id)
REFERENCES api.streams (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE,
CONSTRAINT streams_vtuber_links_inv_fk FOREIGN KEY (vtuber_id)
REFERENCES api.vtubers (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.streams_vtuber_links
OWNER to postgres;
-- Index: streams_vtuber_links_fk
-- DROP INDEX IF EXISTS api.streams_vtuber_links_fk;
CREATE INDEX IF NOT EXISTS streams_vtuber_links_fk
ON api.streams_vtuber_links USING btree
(stream_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: streams_vtuber_links_inv_fk
-- DROP INDEX IF EXISTS api.streams_vtuber_links_inv_fk;
CREATE INDEX IF NOT EXISTS streams_vtuber_links_inv_fk
ON api.streams_vtuber_links USING btree
(vtuber_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: streams_vtuber_links_order_inv_fk
-- DROP INDEX IF EXISTS api.streams_vtuber_links_order_inv_fk;
CREATE INDEX IF NOT EXISTS streams_vtuber_links_order_inv_fk
ON api.streams_vtuber_links USING btree
(stream_order ASC NULLS LAST)
TABLESPACE pg_default;

5
services/migrations/migrations/00109_use-consistent-description_1.sql Normal file
View File

@ -0,0 +1,5 @@
ALTER TABLE api.vtubers DROP COLUMN description1;
ALTER TABLE api.vtubers DROP COLUMN description2;
ALTER TABLE api.vtubers ADD COLUMN description_1 TEXT;
ALTER TABLE api.vtubers ADD COLUMN description_2 TEXT;

5
services/migrations/migrations/00110_unseed-vtubers.sql Normal file
View File

@ -0,0 +1,5 @@
-- we are removing vtuber rows because vtubers are data.
-- data is not supposed to be part of schema migrations
-- @see https://github.com/thomwright/postgres-migrations?tab=readme-ov-file#schema-migrations-vs-data-migrations
DELETE FROM api.vtubers;

33
services/migrations/migrations/00111_create-strapi-tables-tvr.sql Normal file
View File

@ -0,0 +1,33 @@
CREATE TABLE IF NOT EXISTS api.tag_vod_relations
(
id integer NOT NULL,
votes integer,
creator_id integer,
created_at timestamp(6) without time zone,
updated_at timestamp(6) without time zone,
created_by_id integer,
updated_by_id integer,
CONSTRAINT tag_vod_relations_pkey PRIMARY KEY (id)
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.tag_vod_relations
OWNER to postgres;
-- Index: tag_vod_relations_created_by_id_fk
-- DROP INDEX IF EXISTS api.tag_vod_relations_created_by_id_fk;
CREATE INDEX IF NOT EXISTS tag_vod_relations_created_by_id_fk
ON api.tag_vod_relations USING btree
(created_by_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: tag_vod_relations_updated_by_id_fk
-- DROP INDEX IF EXISTS api.tag_vod_relations_updated_by_id_fk;
CREATE INDEX IF NOT EXISTS tag_vod_relations_updated_by_id_fk
ON api.tag_vod_relations USING btree
(updated_by_id ASC NULLS LAST)
TABLESPACE pg_default;

38
services/migrations/migrations/00112_create-tvr_tag_links.sql Normal file
View File

@ -0,0 +1,38 @@
CREATE TABLE IF NOT EXISTS api.tag_vod_relations_tag_links
(
id integer NOT NULL,
tag_vod_relation_id integer,
tag_id integer,
CONSTRAINT tag_vod_relations_tag_links_pkey PRIMARY KEY (id),
CONSTRAINT tag_vod_relations_tag_links_unique UNIQUE (tag_vod_relation_id, tag_id),
CONSTRAINT tag_vod_relations_tag_links_fk FOREIGN KEY (tag_vod_relation_id)
REFERENCES api.tag_vod_relations (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE,
CONSTRAINT tag_vod_relations_tag_links_inv_fk FOREIGN KEY (tag_id)
REFERENCES api.tags (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.tag_vod_relations_tag_links
OWNER to postgres;
-- Index: tag_vod_relations_tag_links_fk
-- DROP INDEX IF EXISTS api.tag_vod_relations_tag_links_fk;
CREATE INDEX IF NOT EXISTS tag_vod_relations_tag_links_fk
ON api.tag_vod_relations_tag_links USING btree
(tag_vod_relation_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: tag_vod_relations_tag_links_inv_fk
-- DROP INDEX IF EXISTS api.tag_vod_relations_tag_links_inv_fk;
CREATE INDEX IF NOT EXISTS tag_vod_relations_tag_links_inv_fk
ON api.tag_vod_relations_tag_links USING btree
(tag_id ASC NULLS LAST)
TABLESPACE pg_default;

47
services/migrations/migrations/00113_create-tvr_vod_links.sql Normal file
View File

@ -0,0 +1,47 @@
CREATE TABLE IF NOT EXISTS api.tag_vod_relations_vod_links
(
id integer NOT NULL,
tag_vod_relation_id integer,
vod_id integer,
tag_vod_relation_order double precision,
CONSTRAINT tag_vod_relations_vod_links_pkey PRIMARY KEY (id),
CONSTRAINT tag_vod_relations_vod_links_unique UNIQUE (tag_vod_relation_id, vod_id),
CONSTRAINT tag_vod_relations_vod_links_fk FOREIGN KEY (tag_vod_relation_id)
REFERENCES api.tag_vod_relations (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE,
CONSTRAINT tag_vod_relations_vod_links_inv_fk FOREIGN KEY (vod_id)
REFERENCES api.vods (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.tag_vod_relations_vod_links
OWNER to postgres;
-- Index: tag_vod_relations_vod_links_fk
-- DROP INDEX IF EXISTS api.tag_vod_relations_vod_links_fk;
CREATE INDEX IF NOT EXISTS tag_vod_relations_vod_links_fk
ON api.tag_vod_relations_vod_links USING btree
(tag_vod_relation_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: tag_vod_relations_vod_links_inv_fk
-- DROP INDEX IF EXISTS api.tag_vod_relations_vod_links_inv_fk;
CREATE INDEX IF NOT EXISTS tag_vod_relations_vod_links_inv_fk
ON api.tag_vod_relations_vod_links USING btree
(vod_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: tag_vod_relations_vod_links_order_inv_fk
-- DROP INDEX IF EXISTS api.tag_vod_relations_vod_links_order_inv_fk;
CREATE INDEX IF NOT EXISTS tag_vod_relations_vod_links_order_inv_fk
ON api.tag_vod_relations_vod_links USING btree
(tag_vod_relation_order ASC NULLS LAST)
TABLESPACE pg_default;

47
services/migrations/migrations/00114_create-tags_toy_links.sql Normal file
View File

@ -0,0 +1,47 @@
CREATE TABLE IF NOT EXISTS api.tags_toy_links
(
id integer NOT NULL,
tag_id integer,
toy_id integer,
tag_order double precision,
CONSTRAINT tags_toy_links_pkey PRIMARY KEY (id),
CONSTRAINT tags_toy_links_unique UNIQUE (tag_id, toy_id),
CONSTRAINT tags_toy_links_fk FOREIGN KEY (tag_id)
REFERENCES api.tags (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE,
CONSTRAINT tags_toy_links_inv_fk FOREIGN KEY (toy_id)
REFERENCES api.toys (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.tags_toy_links
OWNER to postgres;
-- Index: tags_toy_links_fk
-- DROP INDEX IF EXISTS api.tags_toy_links_fk;
CREATE INDEX IF NOT EXISTS tags_toy_links_fk
ON api.tags_toy_links USING btree
(tag_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: tags_toy_links_inv_fk
-- DROP INDEX IF EXISTS api.tags_toy_links_inv_fk;
CREATE INDEX IF NOT EXISTS tags_toy_links_inv_fk
ON api.tags_toy_links USING btree
(toy_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: tags_toy_links_order_inv_fk
-- DROP INDEX IF EXISTS api.tags_toy_links_order_inv_fk;
CREATE INDEX IF NOT EXISTS tags_toy_links_order_inv_fk
ON api.tags_toy_links USING btree
(tag_order ASC NULLS LAST)
TABLESPACE pg_default;

55
services/migrations/migrations/00115_create-tags_vods_links.sql Normal file
View File

@ -0,0 +1,55 @@
CREATE TABLE IF NOT EXISTS api.tags_vods_links
(
id integer NOT NULL,
tag_id integer,
vod_id integer,
vod_order double precision,
tag_order double precision,
CONSTRAINT tags_vods_links_pkey PRIMARY KEY (id),
CONSTRAINT tags_vods_links_unique UNIQUE (tag_id, vod_id),
CONSTRAINT tags_vods_links_fk FOREIGN KEY (tag_id)
REFERENCES api.tags (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE,
CONSTRAINT tags_vods_links_inv_fk FOREIGN KEY (vod_id)
REFERENCES api.vods (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.tags_vods_links
OWNER to postgres;
-- Index: tags_vods_links_fk
-- DROP INDEX IF EXISTS api.tags_vods_links_fk;
CREATE INDEX IF NOT EXISTS tags_vods_links_fk
ON api.tags_vods_links USING btree
(tag_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: tags_vods_links_inv_fk
-- DROP INDEX IF EXISTS api.tags_vods_links_inv_fk;
CREATE INDEX IF NOT EXISTS tags_vods_links_inv_fk
ON api.tags_vods_links USING btree
(vod_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: tags_vods_links_order_fk
-- DROP INDEX IF EXISTS api.tags_vods_links_order_fk;
CREATE INDEX IF NOT EXISTS tags_vods_links_order_fk
ON api.tags_vods_links USING btree
(vod_order ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: tags_vods_links_order_inv_fk
-- DROP INDEX IF EXISTS api.tags_vods_links_order_inv_fk;
CREATE INDEX IF NOT EXISTS tags_vods_links_order_inv_fk
ON api.tags_vods_links USING btree
(tag_order ASC NULLS LAST)
TABLESPACE pg_default;

210
services/migrations/migrations/00116_create-timestamps.sql Normal file
View File

@ -0,0 +1,210 @@
-- Table: api.timestamps
-- DROP TABLE IF EXISTS api.timestamps;
CREATE TABLE IF NOT EXISTS api.timestamps
(
id integer NOT NULL,
"time" integer,
creator_id integer,
created_at timestamp(6) without time zone,
updated_at timestamp(6) without time zone,
created_by_id integer,
updated_by_id integer,
CONSTRAINT timestamps_pkey PRIMARY KEY (id)
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.timestamps
OWNER to postgres;
-- Index: timestamps_created_by_id_fk
-- DROP INDEX IF EXISTS api.timestamps_created_by_id_fk;
CREATE INDEX IF NOT EXISTS timestamps_created_by_id_fk
ON api.timestamps USING btree
(created_by_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: timestamps_updated_by_id_fk
-- DROP INDEX IF EXISTS api.timestamps_updated_by_id_fk;
CREATE INDEX IF NOT EXISTS timestamps_updated_by_id_fk
ON api.timestamps USING btree
(updated_by_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Table: api.timestamps
-- DROP TABLE IF EXISTS api.timestamps;
CREATE TABLE IF NOT EXISTS api.timestamps
(
id integer NOT NULL,
"time" integer,
creator_id integer,
created_at timestamp(6) without time zone,
updated_at timestamp(6) without time zone,
created_by_id integer,
updated_by_id integer,
CONSTRAINT timestamps_pkey PRIMARY KEY (id)
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.timestamps
OWNER to postgres;
-- Index: timestamps_created_by_id_fk
-- DROP INDEX IF EXISTS api.timestamps_created_by_id_fk;
CREATE INDEX IF NOT EXISTS timestamps_created_by_id_fk
ON api.timestamps USING btree
(created_by_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: timestamps_updated_by_id_fk
-- DROP INDEX IF EXISTS api.timestamps_updated_by_id_fk;
CREATE INDEX IF NOT EXISTS timestamps_updated_by_id_fk
ON api.timestamps USING btree
(updated_by_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Table: api.timestamps
-- DROP TABLE IF EXISTS api.timestamps;
CREATE TABLE IF NOT EXISTS api.timestamps
(
id integer NOT NULL,
"time" integer,
creator_id integer,
created_at timestamp(6) without time zone,
updated_at timestamp(6) without time zone,
created_by_id integer,
updated_by_id integer,
CONSTRAINT timestamps_pkey PRIMARY KEY (id)
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.timestamps
OWNER to postgres;
-- Index: timestamps_created_by_id_fk
-- DROP INDEX IF EXISTS api.timestamps_created_by_id_fk;
CREATE INDEX IF NOT EXISTS timestamps_created_by_id_fk
ON api.timestamps USING btree
(created_by_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: timestamps_updated_by_id_fk
-- DROP INDEX IF EXISTS api.timestamps_updated_by_id_fk;
CREATE INDEX IF NOT EXISTS timestamps_updated_by_id_fk
ON api.timestamps USING btree
(updated_by_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Table: api.timestamps_upvoters_links
-- DROP TABLE IF EXISTS api.timestamps_upvoters_links;
CREATE TABLE IF NOT EXISTS api.timestamps_upvoters_links
(
id integer NOT NULL,
timestamp_id integer,
user_id integer,
user_order double precision,
CONSTRAINT timestamps_upvoters_links_pkey PRIMARY KEY (id),
CONSTRAINT timestamps_upvoters_links_unique UNIQUE (timestamp_id, user_id),
CONSTRAINT timestamps_upvoters_links_fk FOREIGN KEY (timestamp_id)
REFERENCES api.timestamps (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.timestamps_upvoters_links
OWNER to postgres;
-- Index: timestamps_upvoters_links_fk
-- DROP INDEX IF EXISTS api.timestamps_upvoters_links_fk;
CREATE INDEX IF NOT EXISTS timestamps_upvoters_links_fk
ON api.timestamps_upvoters_links USING btree
(timestamp_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: timestamps_upvoters_links_inv_fk
-- DROP INDEX IF EXISTS api.timestamps_upvoters_links_inv_fk;
CREATE INDEX IF NOT EXISTS timestamps_upvoters_links_inv_fk
ON api.timestamps_upvoters_links USING btree
(user_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: timestamps_upvoters_links_order_fk
-- DROP INDEX IF EXISTS api.timestamps_upvoters_links_order_fk;
CREATE INDEX IF NOT EXISTS timestamps_upvoters_links_order_fk
ON api.timestamps_upvoters_links USING btree
(user_order ASC NULLS LAST)
TABLESPACE pg_default;
-- Table: api.timestamps_upvoters_links
-- DROP TABLE IF EXISTS api.timestamps_upvoters_links;
CREATE TABLE IF NOT EXISTS api.timestamps_upvoters_links
(
id integer NOT NULL,
timestamp_id integer,
user_id integer,
user_order double precision,
CONSTRAINT timestamps_upvoters_links_pkey PRIMARY KEY (id),
CONSTRAINT timestamps_upvoters_links_unique UNIQUE (timestamp_id, user_id),
CONSTRAINT timestamps_upvoters_links_fk FOREIGN KEY (timestamp_id)
REFERENCES api.timestamps (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.timestamps_upvoters_links
OWNER to postgres;
-- Index: timestamps_upvoters_links_fk
-- DROP INDEX IF EXISTS api.timestamps_upvoters_links_fk;
CREATE INDEX IF NOT EXISTS timestamps_upvoters_links_fk
ON api.timestamps_upvoters_links USING btree
(timestamp_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: timestamps_upvoters_links_inv_fk
-- DROP INDEX IF EXISTS api.timestamps_upvoters_links_inv_fk;
CREATE INDEX IF NOT EXISTS timestamps_upvoters_links_inv_fk
ON api.timestamps_upvoters_links USING btree
(user_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: timestamps_upvoters_links_order_fk
-- DROP INDEX IF EXISTS api.timestamps_upvoters_links_order_fk;
CREATE INDEX IF NOT EXISTS timestamps_upvoters_links_order_fk
ON api.timestamps_upvoters_links USING btree
(user_order ASC NULLS LAST)
TABLESPACE pg_default;

41
services/migrations/migrations/00117_create-timestamps_tag_links.sql Normal file
View File

@ -0,0 +1,41 @@
-- Table: api.timestamps_tag_links
-- DROP TABLE IF EXISTS api.timestamps_tag_links;
CREATE TABLE IF NOT EXISTS api.timestamps_tag_links
(
id integer NOT NULL,
timestamp_id integer,
tag_id integer,
CONSTRAINT timestamps_tag_links_pkey PRIMARY KEY (id),
CONSTRAINT timestamps_tag_links_unique UNIQUE (timestamp_id, tag_id),
CONSTRAINT timestamps_tag_links_fk FOREIGN KEY (timestamp_id)
REFERENCES api.timestamps (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE,
CONSTRAINT timestamps_tag_links_inv_fk FOREIGN KEY (tag_id)
REFERENCES api.tags (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.timestamps_tag_links
OWNER to postgres;
-- Index: timestamps_tag_links_fk
-- DROP INDEX IF EXISTS api.timestamps_tag_links_fk;
CREATE INDEX IF NOT EXISTS timestamps_tag_links_fk
ON api.timestamps_tag_links USING btree
(timestamp_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: timestamps_tag_links_inv_fk
-- DROP INDEX IF EXISTS api.timestamps_tag_links_inv_fk;
CREATE INDEX IF NOT EXISTS timestamps_tag_links_inv_fk
ON api.timestamps_tag_links USING btree
(tag_id ASC NULLS LAST)
TABLESPACE pg_default;

50
services/migrations/migrations/00118_create-timestamps_vod_links.sql Normal file
View File

@ -0,0 +1,50 @@
-- Table: api.timestamps_vod_links
-- DROP TABLE IF EXISTS api.timestamps_vod_links;
CREATE TABLE IF NOT EXISTS api.timestamps_vod_links
(
id integer NOT NULL,
timestamp_id integer,
vod_id integer,
timestamp_order double precision,
CONSTRAINT timestamps_vod_links_pkey PRIMARY KEY (id),
CONSTRAINT timestamps_vod_links_unique UNIQUE (timestamp_id, vod_id),
CONSTRAINT timestamps_vod_links_fk FOREIGN KEY (timestamp_id)
REFERENCES api.timestamps (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE,
CONSTRAINT timestamps_vod_links_inv_fk FOREIGN KEY (vod_id)
REFERENCES api.vods (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.timestamps_vod_links
OWNER to postgres;
-- Index: timestamps_vod_links_fk
-- DROP INDEX IF EXISTS api.timestamps_vod_links_fk;
CREATE INDEX IF NOT EXISTS timestamps_vod_links_fk
ON api.timestamps_vod_links USING btree
(timestamp_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: timestamps_vod_links_inv_fk
-- DROP INDEX IF EXISTS api.timestamps_vod_links_inv_fk;
CREATE INDEX IF NOT EXISTS timestamps_vod_links_inv_fk
ON api.timestamps_vod_links USING btree
(vod_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: timestamps_vod_links_order_inv_fk
-- DROP INDEX IF EXISTS api.timestamps_vod_links_order_inv_fk;
CREATE INDEX IF NOT EXISTS timestamps_vod_links_order_inv_fk
ON api.timestamps_vod_links USING btree
(timestamp_order ASC NULLS LAST)
TABLESPACE pg_default;

41
services/migrations/migrations/00119_create-toys_link_tag_links.sql Normal file
View File

@ -0,0 +1,41 @@
-- Table: api.toys_link_tag_links
-- DROP TABLE IF EXISTS api.toys_link_tag_links;
CREATE TABLE IF NOT EXISTS api.toys_link_tag_links
(
id integer NOT NULL,
toy_id integer,
tag_id integer,
CONSTRAINT toys_link_tag_links_pkey PRIMARY KEY (id),
CONSTRAINT toys_link_tag_links_unique UNIQUE (toy_id, tag_id),
CONSTRAINT toys_link_tag_links_fk FOREIGN KEY (toy_id)
REFERENCES api.toys (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE,
CONSTRAINT toys_link_tag_links_inv_fk FOREIGN KEY (tag_id)
REFERENCES api.tags (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.toys_link_tag_links
OWNER to postgres;
-- Index: toys_link_tag_links_fk
-- DROP INDEX IF EXISTS api.toys_link_tag_links_fk;
CREATE INDEX IF NOT EXISTS toys_link_tag_links_fk
ON api.toys_link_tag_links USING btree
(toy_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: toys_link_tag_links_inv_fk
-- DROP INDEX IF EXISTS api.toys_link_tag_links_inv_fk;
CREATE INDEX IF NOT EXISTS toys_link_tag_links_inv_fk
ON api.toys_link_tag_links USING btree
(tag_id ASC NULLS LAST)
TABLESPACE pg_default;

41
services/migrations/migrations/00120_create-vods_mux_asset_links.sql Normal file
View File

@ -0,0 +1,41 @@
-- Table: api.vods_mux_asset_links
-- DROP TABLE IF EXISTS api.vods_mux_asset_links;
CREATE TABLE IF NOT EXISTS api.vods_mux_asset_links
(
id integer NOT NULL,
vod_id integer,
mux_asset_id integer,
CONSTRAINT vods_mux_asset_links_pkey PRIMARY KEY (id),
CONSTRAINT vods_mux_asset_links_unique UNIQUE (vod_id, mux_asset_id),
CONSTRAINT vods_mux_asset_links_fk FOREIGN KEY (vod_id)
REFERENCES api.vods (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE,
CONSTRAINT vods_mux_asset_links_inv_fk FOREIGN KEY (mux_asset_id)
REFERENCES api.mux_assets (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.vods_mux_asset_links
OWNER to postgres;
-- Index: vods_mux_asset_links_fk
-- DROP INDEX IF EXISTS api.vods_mux_asset_links_fk;
CREATE INDEX IF NOT EXISTS vods_mux_asset_links_fk
ON api.vods_mux_asset_links USING btree
(vod_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: vods_mux_asset_links_inv_fk
-- DROP INDEX IF EXISTS api.vods_mux_asset_links_inv_fk;
CREATE INDEX IF NOT EXISTS vods_mux_asset_links_inv_fk
ON api.vods_mux_asset_links USING btree
(mux_asset_id ASC NULLS LAST)
TABLESPACE pg_default;

50
services/migrations/migrations/00121_create-vods_stream_links.sql Normal file
View File

@ -0,0 +1,50 @@
-- Table: api.vods_stream_links
-- DROP TABLE IF EXISTS api.vods_stream_links;
CREATE TABLE IF NOT EXISTS api.vods_stream_links
(
id integer NOT NULL,
vod_id integer,
stream_id integer,
vod_order double precision,
CONSTRAINT vods_stream_links_pkey PRIMARY KEY (id),
CONSTRAINT vods_stream_links_unique UNIQUE (vod_id, stream_id),
CONSTRAINT vods_stream_links_fk FOREIGN KEY (vod_id)
REFERENCES api.vods (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE,
CONSTRAINT vods_stream_links_inv_fk FOREIGN KEY (stream_id)
REFERENCES api.streams (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.vods_stream_links
OWNER to postgres;
-- Index: vods_stream_links_fk
-- DROP INDEX IF EXISTS api.vods_stream_links_fk;
CREATE INDEX IF NOT EXISTS vods_stream_links_fk
ON api.vods_stream_links USING btree
(vod_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: vods_stream_links_inv_fk
-- DROP INDEX IF EXISTS api.vods_stream_links_inv_fk;
CREATE INDEX IF NOT EXISTS vods_stream_links_inv_fk
ON api.vods_stream_links USING btree
(stream_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: vods_stream_links_order_inv_fk
-- DROP INDEX IF EXISTS api.vods_stream_links_order_inv_fk;
CREATE INDEX IF NOT EXISTS vods_stream_links_order_inv_fk
ON api.vods_stream_links USING btree
(vod_order ASC NULLS LAST)
TABLESPACE pg_default;

87
services/migrations/migrations/00122_create-vods_thumbnail_links.sql Normal file
View File

@ -0,0 +1,87 @@
-- Table: api.b2_files
-- DROP TABLE IF EXISTS api.b2_files;
CREATE TABLE IF NOT EXISTS api.b2_files
(
id integer NOT NULL,
url character varying(255) COLLATE pg_catalog."default",
key character varying(255) COLLATE pg_catalog."default",
upload_id character varying(255) COLLATE pg_catalog."default",
created_at timestamp(6) without time zone,
updated_at timestamp(6) without time zone,
created_by_id integer,
updated_by_id integer,
cdn_url character varying(255) COLLATE pg_catalog."default",
CONSTRAINT b2_files_pkey PRIMARY KEY (id)
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.b2_files
OWNER to postgres;
-- Index: b2_files_created_by_id_fk
-- DROP INDEX IF EXISTS api.b2_files_created_by_id_fk;
CREATE INDEX IF NOT EXISTS b2_files_created_by_id_fk
ON api.b2_files USING btree
(created_by_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: b2_files_updated_by_id_fk
-- DROP INDEX IF EXISTS api.b2_files_updated_by_id_fk;
CREATE INDEX IF NOT EXISTS b2_files_updated_by_id_fk
ON api.b2_files USING btree
(updated_by_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Table: api.vods_thumbnail_links
-- DROP TABLE IF EXISTS api.vods_thumbnail_links;
CREATE TABLE IF NOT EXISTS api.vods_thumbnail_links
(
id integer NOT NULL,
vod_id integer,
b_2_file_id integer,
CONSTRAINT vods_thumbnail_links_pkey PRIMARY KEY (id),
CONSTRAINT vods_thumbnail_links_unique UNIQUE (vod_id, b_2_file_id),
CONSTRAINT vods_thumbnail_links_fk FOREIGN KEY (vod_id)
REFERENCES api.vods (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE,
CONSTRAINT vods_thumbnail_links_inv_fk FOREIGN KEY (b_2_file_id)
REFERENCES api.b2_files (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.vods_thumbnail_links
OWNER to postgres;
-- Index: vods_thumbnail_links_fk
-- DROP INDEX IF EXISTS api.vods_thumbnail_links_fk;
CREATE INDEX IF NOT EXISTS vods_thumbnail_links_fk
ON api.vods_thumbnail_links USING btree
(vod_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: vods_thumbnail_links_inv_fk
-- DROP INDEX IF EXISTS api.vods_thumbnail_links_inv_fk;
CREATE INDEX IF NOT EXISTS vods_thumbnail_links_inv_fk
ON api.vods_thumbnail_links USING btree
(b_2_file_id ASC NULLS LAST)
TABLESPACE pg_default;

37
services/migrations/migrations/00123_create-vods_uploader_links.sql Normal file
View File

@ -0,0 +1,37 @@
-- Table: api.vods_uploader_links
-- DROP TABLE IF EXISTS api.vods_uploader_links;
CREATE TABLE IF NOT EXISTS api.vods_uploader_links
(
id integer NOT NULL,
vod_id integer,
user_id integer,
CONSTRAINT vods_uploader_links_pkey PRIMARY KEY (id),
CONSTRAINT vods_uploader_links_unique UNIQUE (vod_id, user_id),
CONSTRAINT vods_uploader_links_fk FOREIGN KEY (vod_id)
REFERENCES api.vods (id) MATCH SIMPLE
ON UPDATE NO ACTION
ON DELETE CASCADE
)
TABLESPACE pg_default;
ALTER TABLE IF EXISTS api.vods_uploader_links
OWNER to postgres;
-- Index: vods_uploader_links_fk
-- DROP INDEX IF EXISTS api.vods_uploader_links_fk;
CREATE INDEX IF NOT EXISTS vods_uploader_links_fk
ON api.vods_uploader_links USING btree
(vod_id ASC NULLS LAST)
TABLESPACE pg_default;
-- Index: vods_uploader_links_inv_fk
-- DROP INDEX IF EXISTS api.vods_uploader_links_inv_fk;
CREATE INDEX IF NOT EXISTS vods_uploader_links_inv_fk
ON api.vods_uploader_links USING btree
(user_id ASC NULLS LAST)
TABLESPACE pg_default;

Some files were not shown because too many files have changed in this diff Show More