Briefkasten - migrate (add acls) (#1863)

library/ix-dev/community/briefkasten/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: common
   repository: file://../../../common
-  version: 1.2.2
-digest: sha256:fb077cb81f6acecd5c9e6adc22a18e156f780cd78f27198cdb47810f95364b56
-generated: "2023-11-09T15:39:01.339042691+02:00"
+  version: 1.2.4
+digest: sha256:47ebfd41bc2ac33ab6989e7bd4d1d3aea662365fffa8b525a24cc56a2a35c174
+generated: "2023-12-12T17:56:32.656256853+02:00"

library/ix-dev/community/briefkasten/Chart.yaml

@@ -3,7 +3,7 @@ description: Briefkasten is a self hosted bookmarking app
 annotations:
   title: Briefkasten
 type: application
-version: 1.1.3
+version: 1.2.0
 apiVersion: v2
 appVersion: latest
 kubeVersion: '>=1.16.0-0'
@@ -14,7 +14,7 @@ maintainers:
 dependencies:
   - name: common
     repository: file://../../../common
-    version: 1.2.2
+    version: 1.2.4
 home: https://github.com/ndom91/briefkasten
 icon: https://media.sys.truenas.net/apps/briefkasten/icons/icon.svg
 sources:

library/ix-dev/community/briefkasten/ci/basic-values.yaml

@@ -10,8 +10,9 @@ briefkastenConfig:
 
 briefkastenStorage:
   pgData:
-    type: hostPath
-    hostPath: /mnt/{{ .Release.Namespace }}/pgData
+    type: pvc
   pgBackup:
-    type: hostPath
-    hostPath: /mnt/{{ .Release.Namespace }}/pgBackup
+    type: emptyDir
+    emptyDirConfig:
+      medium: ""
+      size: ""

library/ix-dev/community/briefkasten/ci/extra-values.yaml

@@ -10,15 +10,14 @@ briefkastenConfig:
 
 briefkastenStorage:
   pgData:
-    type: hostPath
-    hostPath: /mnt/{{ .Release.Namespace }}/pgData
+    type: pvc
   pgBackup:
-    type: hostPath
-    hostPath: /mnt/{{ .Release.Namespace }}/pgBackup
+    type: emptyDir
+    emptyDirConfig:
+      medium: ""
+      size: ""
   additionalStorages:
-  - type: hostPath
-    hostPath: /mnt/{{ .Release.Namespace }}/data1
+  - type: pvc
     mountPath: /data1
-  - type: hostPath
-    hostPath: /mnt/{{ .Release.Namespace }}/data2
+  - type: pvc
     mountPath: /data2

library/ix-dev/community/briefkasten/ci/hostNet-values.yaml

@@ -11,8 +11,9 @@ briefkastenConfig:
 
 briefkastenStorage:
   pgData:
-    type: hostPath
-    hostPath: /mnt/{{ .Release.Namespace }}/pgData
+    type: pvc
   pgBackup:
-    type: hostPath
-    hostPath: /mnt/{{ .Release.Namespace }}/pgBackup
+    type: emptyDir
+    emptyDirConfig:
+      medium: ""
+      size: ""

library/ix-dev/community/briefkasten/migrations/migrate

@@ -0,0 +1,73 @@
+#!/usr/bin/python3
+import json
+import os
+import sys
+
+
+def storage_migrate(storage):
+    delete_keys = []
+    if storage['type'] == 'hostPath':
+        # Check if the key exists, if not we have already migrated
+        if not storage.get('hostPath'):
+            return storage
+
+        storage['hostPathConfig'] = {'hostPath': storage['hostPath']}
+        delete_keys.append('hostPath')
+
+    elif storage['type'] == 'ixVolume':
+        # Check if the key exists, if not we have already migrated
+        if not storage.get('datasetName'):
+            return storage
+
+        storage['ixVolumeConfig'] = {'datasetName': storage['datasetName']}
+        delete_keys.append('datasetName')
+
+    elif storage['type'] == 'smb-pv-pvc':
+        # Check if the key exists, if not we have already migrated
+        if not storage.get('server'):
+            return storage
+
+        storage['smbConfig'] = {
+            'server': storage['server'],
+            'share': storage['share'],
+            'domain': storage['domain'],
+            'username': storage['username'],
+            'password': storage['password'],
+            'size': storage['size'],
+        }
+        delete_keys.extend(['server', 'share', 'domain', 'username', 'password', 'size'])
+
+    for key in delete_keys:
+        storage.pop(key, None)
+
+    return storage
+
+
+def migrate(values):
+    storage_key = 'briefkastenStorage'
+    storages = ['pgData', 'pgBackup']
+
+    for storage in storages:
+        check_val = values.get(storage_key, {}).get(storage, {})
+        if not isinstance(check_val, dict) or not check_val:
+            raise Exception(f'Storage section {storage} is malformed')
+
+        values[storage_key][storage] = storage_migrate(check_val)
+
+    additionalStorages = values.get(storage_key, {}).get('additionalStorages', [])
+    for idx, storage in enumerate(additionalStorages):
+        if not isinstance(storage, dict) or not storage:
+            raise Exception(f'Item {idx} in additionalStorages is malformed')
+
+        values[storage_key]['additionalStorages'][idx] = storage_migrate(storage)
+
+    return values
+
+
+if __name__ == '__main__':
+    if len(sys.argv) != 2:
+        exit(1)
+
+    if os.path.exists(sys.argv[1]):
+        with open(sys.argv[1], 'r') as f:
+            print(json.dumps(migrate(json.loads(f.read()))))

library/ix-dev/community/briefkasten/questions.yaml

@@ -91,6 +91,7 @@ questions:
                       schema:
                         type: string
                         default: ""
+                        private: true
                         required: true
         - variable: google
           label: Google Auth Provider
@@ -119,6 +120,7 @@ questions:
                       schema:
                         type: string
                         default: ""
+                        private: true
                         required: true
         - variable: keycloak
           label: Keycloak Auth Provider
@@ -154,6 +156,7 @@ questions:
                       schema:
                         type: string
                         default: ""
+                        private: true
                         required: true
                     - variable: issuer
                       label: Keycloak Issuer
@@ -196,6 +199,7 @@ questions:
                       schema:
                         type: string
                         default: ""
+                        private: true
                         required: true
                     - variable: issuer
                       label: Authentik Issuer
@@ -256,123 +260,6 @@ questions:
     schema:
       type: dict
       attrs:
-        - variable: avatars
-          label: Briefkasten Avatars Storage
-          description: The path to store Briefkasten Avatars.
-          schema:
-            type: dict
-            attrs:
-              - variable: type
-                label: Type
-                description: |
-                  ixVolume: Is dataset created automatically by the system.</br>
-                  Host Path: Is a path that already exists on the system.
-                schema:
-                  type: string
-                  required: true
-                  immutable: true
-                  default: "ixVolume"
-                  enum:
-                    - value: "hostPath"
-                      description: Host Path (Path that already exists on the system)
-                    - value: "ixVolume"
-                      description: ixVolume (Dataset created automatically by the system)
-              - variable: datasetName
-                label: Dataset Name
-                schema:
-                  type: string
-                  show_if: [["type", "=", "ixVolume"]]
-                  required: true
-                  hidden: true
-                  immutable: true
-                  default: "avatars"
-                  $ref:
-                    - "normalize/ixVolume"
-              - variable: hostPath
-                label: Host Path
-                schema:
-                  type: hostpath
-                  show_if: [["type", "=", "hostPath"]]
-                  immutable: true
-                  required: true
-        - variable: backgroundImages
-          label: Briefkasten Background Images Storage
-          description: The path to store Briefkasten Background Images.
-          schema:
-            type: dict
-            attrs:
-              - variable: type
-                label: Type
-                description: |
-                  ixVolume: Is dataset created automatically by the system.</br>
-                  Host Path: Is a path that already exists on the system.
-                schema:
-                  type: string
-                  required: true
-                  immutable: true
-                  default: "ixVolume"
-                  enum:
-                    - value: "hostPath"
-                      description: Host Path (Path that already exists on the system)
-                    - value: "ixVolume"
-                      description: ixVolume (Dataset created automatically by the system)
-              - variable: datasetName
-                label: Dataset Name
-                schema:
-                  type: string
-                  show_if: [["type", "=", "ixVolume"]]
-                  required: true
-                  hidden: true
-                  immutable: true
-                  default: "bg-img"
-                  $ref:
-                    - "normalize/ixVolume"
-              - variable: hostPath
-                label: Host Path
-                schema:
-                  type: hostpath
-                  show_if: [["type", "=", "hostPath"]]
-                  immutable: true
-                  required: true
-        - variable: attachments
-          label: Briefkasten Attachments Storage
-          description: The path to store Briefkasten Attachments.
-          schema:
-            type: dict
-            attrs:
-              - variable: type
-                label: Type
-                description: |
-                  ixVolume: Is dataset created automatically by the system.</br>
-                  Host Path: Is a path that already exists on the system.
-                schema:
-                  type: string
-                  required: true
-                  immutable: true
-                  default: "ixVolume"
-                  enum:
-                    - value: "hostPath"
-                      description: Host Path (Path that already exists on the system)
-                    - value: "ixVolume"
-                      description: ixVolume (Dataset created automatically by the system)
-              - variable: datasetName
-                label: Dataset Name
-                schema:
-                  type: string
-                  show_if: [["type", "=", "ixVolume"]]
-                  required: true
-                  hidden: true
-                  immutable: true
-                  default: "attachments"
-                  $ref:
-                    - "normalize/ixVolume"
-              - variable: hostPath
-                label: Host Path
-                schema:
-                  type: hostpath
-                  show_if: [["type", "=", "hostPath"]]
-                  immutable: true
-                  required: true
         - variable: pgData
           label: Postgres Data Storage
           description: The path to store Postgres Data.
@@ -394,24 +281,72 @@ questions:
                       description: Host Path (Path that already exists on the system)
                     - value: "ixVolume"
                       description: ixVolume (Dataset created automatically by the system)
-              - variable: datasetName
-                label: Dataset Name
+              - variable: ixVolumeConfig
+                label: ixVolume Configuration
+                description: The configuration for the ixVolume dataset.
                 schema:
-                  type: string
-                  show_if: [["type", "=", "ixVolume"]]
-                  required: true
+                  type: dict
+                  # Nothing to show for the user
                   hidden: true
-                  immutable: true
-                  default: "pgData"
+                  show_if: [["type", "=", "ixVolume"]]
                   $ref:
                     - "normalize/ixVolume"
-              - variable: hostPath
-                label: Host Path
+                  attrs:
+                    - variable: aclEnable
+                      label: Enable ACL
+                      description: Enable ACL for the dataset.
+                      schema:
+                        type: boolean
+                        # Postgres does a CHMOD at startup
+                        # Which fails with ACL
+                        hidden: true
+                        default: false
+                    - variable: datasetName
+                      label: Dataset Name
+                      description: The name of the dataset to use for storage.
+                      schema:
+                        type: string
+                        required: true
+                        immutable: true
+                        hidden: true
+                        default: "pgData"
+                    - variable: aclEntries
+                      label: ACL Configuration
+                      schema:
+                        type: dict
+                        show_if: [["aclEnable", "=", true]]
+                        attrs: []
+              - variable: hostPathConfig
+                label: Host Path Configuration
                 schema:
-                  type: hostpath
+                  type: dict
                   show_if: [["type", "=", "hostPath"]]
-                  immutable: true
-                  required: true
+                  attrs:
+                    - variable: aclEnable
+                      label: Enable ACL
+                      description: Enable ACL for the dataset.
+                      schema:
+                        type: boolean
+                        # Postgres does a CHMOD at startup
+                        # Which fails with ACL
+                        hidden: true
+                        default: false
+                    - variable: acl
+                      label: ACL Configuration
+                      schema:
+                        type: dict
+                        show_if: [["aclEnable", "=", true]]
+                        attrs: []
+                        $ref:
+                          - "normalize/acl"
+                    - variable: hostPath
+                      label: Host Path
+                      description: The host path to use for storage.
+                      schema:
+                        type: hostpath
+                        show_if: [["aclEnable", "=", false]]
+                        required: true
+
         - variable: pgBackup
           label: Postgres Backup Storage
           description: The path to store Postgres Backup.
@@ -433,24 +368,73 @@ questions:
                       description: Host Path (Path that already exists on the system)
                     - value: "ixVolume"
                       description: ixVolume (Dataset created automatically by the system)
-              - variable: datasetName
-                label: Dataset Name
+              - variable: ixVolumeConfig
+                label: ixVolume Configuration
+                description: The configuration for the ixVolume dataset.
                 schema:
-                  type: string
-                  show_if: [["type", "=", "ixVolume"]]
-                  required: true
+                  type: dict
+                  # Nothing to show for the user
                   hidden: true
-                  immutable: true
-                  default: "pgBackup"
+                  show_if: [["type", "=", "ixVolume"]]
                   $ref:
                     - "normalize/ixVolume"
-              - variable: hostPath
-                label: Host Path
+                  attrs:
+                    - variable: aclEnable
+                      label: Enable ACL
+                      description: Enable ACL for the dataset.
+                      schema:
+                        type: boolean
+                        # Postgres does a CHMOD at startup
+                        # Which fails with ACL
+                        hidden: true
+                        default: false
+                    - variable: datasetName
+                      label: Dataset Name
+                      description: The name of the dataset to use for storage.
+                      schema:
+                        type: string
+                        required: true
+                        immutable: true
+                        hidden: true
+                        default: "pgBackup"
+                    - variable: aclEntries
+                      label: ACL Configuration
+                      schema:
+                        type: dict
+                        show_if: [["aclEnable", "=", true]]
+                        attrs: []
+              - variable: hostPathConfig
+                label: Host Path Configuration
                 schema:
-                  type: hostpath
+                  type: dict
                   show_if: [["type", "=", "hostPath"]]
-                  immutable: true
-                  required: true
+                  attrs:
+                    - variable: aclEnable
+                      label: Enable ACL
+                      description: Enable ACL for the dataset.
+                      schema:
+                        type: boolean
+                        # Postgres does a CHMOD at startup
+                        # Which fails with ACL
+                        hidden: true
+                        default: false
+                    - variable: acl
+                      label: ACL Configuration
+                      schema:
+                        type: dict
+                        show_if: [["aclEnable", "=", true]]
+                        attrs: []
+                        $ref:
+                          - "normalize/acl"
+                    - variable: hostPath
+                      label: Host Path
+                      description: The host path to use for storage.
+                      schema:
+                        type: hostpath
+                        show_if: [["aclEnable", "=", false]]
+                        required: true
+
+
         - variable: additionalStorages
           label: Additional Storage
           description: Additional storage for Briefkasten.
@@ -481,74 +465,120 @@ questions:
                             description: ixVolume (Dataset created automatically by the system)
                           - value: "smb-pv-pvc"
                             description: SMB Share (Mounts a persistent volume claim to a SMB share)
+                    - variable: readOnly
+                      label: Read Only
+                      description: Mount the volume as read only.
+                      schema:
+                        type: boolean
+                        default: false
                     - variable: mountPath
                       label: Mount Path
                       description: The path inside the container to mount the storage.
                       schema:
                         type: path
                         required: true
-                    - variable: hostPath
-                      label: Host Path
-                      description: The host path to use for storage.
+                    - variable: hostPathConfig
+                      label: Host Path Configuration
                       schema:
-                        type: hostpath
+                        type: dict
                         show_if: [["type", "=", "hostPath"]]
-                        required: true
-                    - variable: datasetName
-                      label: Dataset Name
-                      description: The name of the dataset to use for storage.
+                        attrs:
+                          - variable: aclEnable
+                            label: Enable ACL
+                            description: Enable ACL for the dataset.
+                            schema:
+                              type: boolean
+                              default: false
+                          - variable: acl
+                            label: ACL Configuration
+                            schema:
+                              type: dict
+                              show_if: [["aclEnable", "=", true]]
+                              attrs: []
+                              $ref:
+                                - "normalize/acl"
+                          - variable: hostPath
+                            label: Host Path
+                            description: The host path to use for storage.
+                            schema:
+                              type: hostpath
+                              show_if: [["aclEnable", "=", false]]
+                              immutable: true
+                              required: true
+                    - variable: ixVolumeConfig
+                      label: ixVolume Configuration
+                      description: The configuration for the ixVolume dataset.
                       schema:
-                        type: string
+                        type: dict
                         show_if: [["type", "=", "ixVolume"]]
-                        required: true
-                        immutable: true
-                        default: "storage_entry"
                         $ref:
                           - "normalize/ixVolume"
-                    - variable: server
-                      label: Server
-                      description: The server for the SMB share.
-                      schema:
-                        type: string
-                        show_if: [["type", "=", "smb-pv-pvc"]]
-                        required: true
-                    - variable: share
-                      label: Share
-                      description: The share name for the SMB share.
+                        attrs:
+                          - variable: aclEnable
+                            label: Enable ACL
+                            description: Enable ACL for the dataset.
+                            schema:
+                              type: boolean
+                              default: false
+                          - variable: datasetName
+                            label: Dataset Name
+                            description: The name of the dataset to use for storage.
+                            schema:
+                              type: string
+                              required: true
+                              immutable: true
+                              default: "storage_entry"
+                          - variable: aclEntries
+                            label: ACL Configuration
+                            schema:
+                              type: dict
+                              show_if: [["aclEnable", "=", true]]
+                              attrs: []
+                    - variable: smbConfig
+                      label: SMB Share Configuration
+                      description: The configuration for the SMB Share.
                       schema:
-                        type: string
-                        show_if: [["type", "=", "smb-pv-pvc"]]
-                        required: true
-                    - variable: domain
-                      label: Domain (Optional)
-                      description: The domain for the SMB share.
-                      schema:
-                        type: string
+                        type: dict
                         show_if: [["type", "=", "smb-pv-pvc"]]
-                    - variable: username
-                      label: Username
-                      description: The username for the SMB share.
-                      schema:
-                        type: string
-                        show_if: [["type", "=", "smb-pv-pvc"]]
-                        required: true
-                    - variable: password
-                      label: Password
-                      description: The password for the SMB share.
-                      schema:
-                        type: string
-                        show_if: [["type", "=", "smb-pv-pvc"]]
-                        required: true
-                        private: true
-                    - variable: size
-                      label: Size (in Gi)
-                      description: The size of the volume quota.
-                      schema:
-                        type: int
-                        show_if: [["type", "=", "smb-pv-pvc"]]
-                        required: true
-                        min: 1
-                        default: 1
+                        attrs:
+                          - variable: server
+                            label: Server
+                            description: The server for the SMB share.
+                            schema:
+                              type: string
+                              required: true
+                          - variable: share
+                            label: Share
+                            description: The share name for the SMB share.
+                            schema:
+                              type: string
+                              required: true
+                          - variable: domain
+                            label: Domain (Optional)
+                            description: The domain for the SMB share.
+                            schema:
+                              type: string
+                          - variable: username
+                            label: Username
+                            description: The username for the SMB share.
+                            schema:
+                              type: string
+                              required: true
+                          - variable: password
+                            label: Password
+                            description: The password for the SMB share.
+                            schema:
+                              type: string
+                              required: true
+                              private: true
+                          - variable: size
+                            label: Size (in Gi)
+                            description: The size of the volume quota.
+                            schema:
+                              type: int
+                              required: true
+                              min: 1
+                              default: 1
 
   - variable: resources
     group: Resources Configuration

library/ix-dev/community/briefkasten/templates/_briefkasten.tpl

@@ -44,7 +44,12 @@ workload:
               port: {{ .Values.briefkastenNetwork.webPort }}
               path: /
       initContainers:
-      {{- include "ix.v1.common.app.postgresWait" (dict "name" "01-postgres-wait"
+      {{- include "ix.v1.common.app.permissions" (dict "containerName" "01-permissions"
+                                                        "UID" 1001
+                                                        "GID" 1001
+                                                        "mode" "check"
+                                                        "type" "install") | nindent 8 }}
+      {{- include "ix.v1.common.app.postgresWait" (dict "name" "02-postgres-wait"
                                                         "secretName" "postgres-creds") | nindent 8 }}
         02-migrate-db:
           enabled: true

library/ix-dev/community/briefkasten/templates/_persistence.tpl

@@ -8,33 +8,34 @@ persistence:
         briefkasten:
           mountPath: /tmp
   {{- range $idx, $storage := .Values.briefkastenStorage.additionalStorages }}
-  {{ printf "briefkasten-%v" (int $idx) }}:
-    {{- $size := "" -}}
-    {{- if $storage.size -}}
-      {{- $size = (printf "%vGi" $storage.size) -}}
-    {{- end }}
+  {{ printf "briefkasten-%v:" (int $idx) }}
     enabled: true
-    type: {{ $storage.type }}
-    datasetName: {{ $storage.datasetName | default "" }}
-    hostPath: {{ $storage.hostPath | default "" }}
-    server: {{ $storage.server | default "" }}
-    share: {{ $storage.share | default "" }}
-    domain: {{ $storage.domain | default "" }}
-    username: {{ $storage.username | default "" }}
-    password: {{ $storage.password | default "" }}
-    size: {{ $size }}
-    {{- if eq $storage.type "smb-pv-pvc" }}
-    mountOptions:
-      - key: noperm
-    {{- end }}
+    {{- include "briefkasten.storage.ci.migration" (dict "storage" $storage) }}
+    {{- include "ix.v1.common.app.storageOptions" (dict "storage" $storage) | nindent 4 }}
     targetSelector:
       briefkasten:
         briefkasten:
           mountPath: {{ $storage.mountPath }}
+        {{- if eq $storage.type "ixVolume" }}
+        01-permissions:
+          mountPath: /mnt/directories{{ $storage.mountPath }}
+        {{- end }}
   {{- end -}}
 
+  {{- include "briefkasten.storage.ci.migration" (dict "storage" .Values.briefkastenStorage.pgData) }}
+  {{- include "briefkasten.storage.ci.migration" (dict "storage" .Values.briefkastenStorage.pgBackup) }}
   {{- include "ix.v1.common.app.postgresPersistence"
       (dict "pgData" .Values.briefkastenStorage.pgData
             "pgBackup" .Values.briefkastenStorage.pgBackup
       ) | nindent 2 }}
 {{- end -}}
+
+{{/* TODO: Remove on the next version bump, eg 1.2.0+ */}}
+{{- define "briefkasten.storage.ci.migration" -}}
+  {{- $storage := .storage -}}
+
+  {{- if $storage.hostPath -}}
+    {{- $_ := set $storage "hostPathConfig" dict -}}
+    {{- $_ := set $storage.hostPathConfig "hostPath" $storage.hostPath -}}
+  {{- end -}}
+{{- end -}}

library/ix-dev/community/briefkasten/values.yaml

@@ -45,10 +45,12 @@ briefkastenStorage:
   additionalStorages: []
   pgData:
     type: ixVolume
-    datasetName: pgData
+    ixVolumeConfig:
+      datasetName: pgData
   pgBackup:
     type: ixVolume
-    datasetName: pgBackup
+    ixVolumeConfig:
+      datasetName: pgBackup
 
 notes:
   custom: |