From 5341253573357ab04791592707f2bfacb025c9d5 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 26 Sep 2026 20:56:51 +1000 Subject: [PATCH 1/2] Add Ceph RGW bucket for the shared Go build cache (#489) Go builds on CI and laptops each rebuild the same packages from scratch. A GOCACHEPROG backend needs an S3 bucket plus credentials before anything can point at it, so provision those first. The bucket lives in the woodpecker namespace because CI is the primary consumer and reads the Secret there. - add Bucket and ObjectStoreUser for the shared Go build cache - use default (replicated) placement rather than the ec target, since a build cache is millions of small objects - purge and drop the bucket and user on delete; the cache is disposable Nothing consumes the bucket yet. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/489 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- apps/base/woodpecker/gocache_bucket.yaml | 33 ++++++++++++++++++++++++ apps/base/woodpecker/kustomization.yaml | 1 + 2 files changed, 34 insertions(+) create mode 100644 apps/base/woodpecker/gocache_bucket.yaml diff --git a/apps/base/woodpecker/gocache_bucket.yaml b/apps/base/woodpecker/gocache_bucket.yaml new file mode 100644 index 0000000..8541b60 --- /dev/null +++ b/apps/base/woodpecker/gocache_bucket.yaml @@ -0,0 +1,33 @@ +--- +# Shared Go build cache (GOCACHEPROG) for CI and developer laptops. Lives in the +# woodpecker namespace because CI is the primary consumer and reads the Secret here. +apiVersion: ceph.unkin.net/v1alpha1 +kind: ObjectStoreUser +metadata: + name: gocache + namespace: woodpecker +spec: + displayName: "Go build cache owner" + uid: gocache + maxBuckets: 1 + secretName: gocache-s3 + retainOnDelete: false +--- +apiVersion: ceph.unkin.net/v1alpha1 +kind: Bucket +metadata: + name: gocache + namespace: woodpecker +spec: + bucketName: gocache + ownerRef: gocache + versioning: false + # No placementTarget: default (replicated) placement, not the ec target the + # backup buckets use — a build cache is millions of small objects. + tags: + app: gocache + purpose: go-build-cache + retainOnDelete: false + # A cache bucket is never empty, and the operator refuses to delete a + # non-empty bucket without this, wedging the finalizer. + purgeOnDelete: true diff --git a/apps/base/woodpecker/kustomization.yaml b/apps/base/woodpecker/kustomization.yaml index 627a499..ae394e2 100644 --- a/apps/base/woodpecker/kustomization.yaml +++ b/apps/base/woodpecker/kustomization.yaml @@ -7,6 +7,7 @@ resources: - cnpg_cluster.yaml - cnpg_backup.yaml - cnpg_pooler.yaml + - gocache_bucket.yaml - serviceaccount_arrproxy_ci.yaml - serviceaccount_autobackup_operator_ci.yaml - serviceaccount_ghp.yaml From 426a399f31de768f7883bd2f5f8a7987ff0a9cdc Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 26 Sep 2026 21:25:49 +1000 Subject: [PATCH 2/2] Drop stalwart mail proxying from the haproxy edge (#491) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Stalwart was only ever a test deployment. The daemon is dead on all three backend VMs and nothing public depends on it — `unkin.net` MX points at Google — so the edge is proxying mail to nowhere and the tcp frontends make `defaults` emit 20 spurious HTTP-mode warnings. - Drop the `fe_smtp`, `fe_submission`, `fe_imap` and `fe_imaps` frontends. - Drop the five `be_stalwart_*` backends and their map entries in `fe_http.map`/`fe_https.map`. - Drop the now-unused 25/143/587/993 Service and container ports. `haproxy -c` on the rendered config: exit 0, 0 warnings (was 20), 0 alerts. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/491 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- apps/base/haproxy/configmap.yaml | 122 ------------------------------ apps/base/haproxy/deployment.yaml | 14 +--- apps/base/haproxy/service.yaml | 18 +---- 3 files changed, 2 insertions(+), 152 deletions(-) diff --git a/apps/base/haproxy/configmap.yaml b/apps/base/haproxy/configmap.yaml index e1ad1eb..9f3e1c4 100644 --- a/apps/base/haproxy/configmap.yaml +++ b/apps/base/haproxy/configmap.yaml @@ -23,9 +23,6 @@ data: git.unkin.net be_gitea grafana.unkin.net be_grafana dashboard.ceph.unkin.net be_ceph_dashboard - mail-webadmin.main.unkin.net be_stalwart_webadmin - autoconfig.main.unkin.net be_stalwart_webadmin - autodiscovery.main.unkin.net be_stalwart_webadmin auth.unkin.net be_k8s_kanidm fe_https.map: | @@ -40,9 +37,6 @@ data: git.unkin.net be_gitea grafana.unkin.net be_grafana dashboard.ceph.unkin.net be_ceph_dashboard - mail-webadmin.main.unkin.net be_stalwart_webadmin - autoconfig.main.unkin.net be_stalwart_webadmin - autodiscovery.main.unkin.net be_stalwart_webadmin auth.unkin.net be_k8s_kanidm haproxy.cfg: | @@ -101,26 +95,6 @@ data: use_backend be_letsencrypt if acl-letsencrypt use_backend %[req.hdr(host),lower,map(/usr/local/etc/haproxy/fe_https.map,be_default)] - frontend fe_imap - bind 0.0.0.0:143 - mode tcp - description Frontend for Stalwart IMAP (STARTTLS) - default_backend be_stalwart_imap - log global - option tcplog - tcp-request inspect-delay 5s - tcp-request content accept if { req_len 0 } - - frontend fe_imaps - bind 0.0.0.0:993 - mode tcp - description Frontend for Stalwart IMAPS (implicit TLS) - default_backend be_stalwart_imaps - log global - option tcplog - tcp-request inspect-delay 5s - tcp-request content accept if { req_len 0 } - frontend fe_metrics bind 0.0.0.0:8405 mode http @@ -129,26 +103,6 @@ data: http-request set-header X-Real-IP %[src] http-request use-service prometheus-exporter if { path /metrics } - frontend fe_smtp - bind 0.0.0.0:25 - mode tcp - description Frontend for Stalwart SMTP - default_backend be_stalwart_smtp - log global - option tcplog - tcp-request inspect-delay 5s - tcp-request content accept if { req_len 0 } - - frontend fe_submission - bind 0.0.0.0:587 - mode tcp - description Frontend for Stalwart SMTP Submission - default_backend be_stalwart_submission - log global - option tcplog - tcp-request inspect-delay 5s - tcp-request content accept if { req_len 0 } - backend be_ceph_dashboard description Backend for Ceph Dashboard from Mgr instances balance roundrobin @@ -332,82 +286,6 @@ data: redirect scheme https if !{ ssl_fc } server ausyd1nxvm2046 198.18.26.161:443 check cookie ausyd1nxvm2046 fall 2 inter 2s rise 3 ssl verify none - backend be_stalwart_imap - description Backend for Stalwart IMAP (STARTTLS) - balance roundrobin - mode tcp - option tcp-check - option prefer-last-server - stick on src - stick-table type ip size 200k expire 30m - tcp-check connect port 143 send-proxy - tcp-check expect string "* OK" - tcp-check send "A001 STARTTLS\r\n" - tcp-check expect rstring "A001 (OK|2.0.0)" - server ausyd1nxvm2124 198.18.28.76:143 check fall 3 inter 3s rise 2 send-proxy-v2 - server ausyd1nxvm2125 198.18.29.44:143 check fall 3 inter 3s rise 2 send-proxy-v2 - server ausyd1nxvm2126 198.18.25.160:143 check fall 3 inter 3s rise 2 send-proxy-v2 - - backend be_stalwart_imaps - description Backend for Stalwart IMAPS (implicit TLS) - balance roundrobin - mode tcp - option tcp-check - option prefer-last-server - stick on src - stick-table type ip size 200k expire 30m - tcp-check connect ssl send-proxy - tcp-check expect string "* OK" - server ausyd1nxvm2124 198.18.28.76:993 check fall 3 inter 3s rise 2 send-proxy-v2 ssl verify none - server ausyd1nxvm2125 198.18.29.44:993 check fall 3 inter 3s rise 2 send-proxy-v2 ssl verify none - server ausyd1nxvm2126 198.18.25.160:993 check fall 3 inter 3s rise 2 send-proxy-v2 ssl verify none - - backend be_stalwart_smtp - description Backend for Stalwart SMTP - balance roundrobin - mode tcp - option tcp-check - option prefer-last-server - stick on src - stick-table type ip size 200k expire 30m - tcp-check connect port 25 send-proxy - tcp-check expect string "220 " - server ausyd1nxvm2124 198.18.28.76:25 check fall 3 inter 3s rise 2 send-proxy-v2 - server ausyd1nxvm2125 198.18.29.44:25 check fall 3 inter 3s rise 2 send-proxy-v2 - server ausyd1nxvm2126 198.18.25.160:25 check fall 3 inter 3s rise 2 send-proxy-v2 - - backend be_stalwart_submission - description Backend for Stalwart SMTP Submission - balance roundrobin - mode tcp - option tcp-check - option prefer-last-server - stick on src - stick-table type ip size 200k expire 30m - tcp-check connect port 587 send-proxy - tcp-check expect string "220 " - server ausyd1nxvm2124 198.18.28.76:587 check fall 3 inter 3s rise 2 send-proxy-v2 - server ausyd1nxvm2125 198.18.29.44:587 check fall 3 inter 3s rise 2 send-proxy-v2 - server ausyd1nxvm2126 198.18.25.160:587 check fall 3 inter 3s rise 2 send-proxy-v2 - - backend be_stalwart_webadmin - description Backend for Stalwart Webadmin - balance roundrobin - cookie SRVNAME insert indirect nocache - http-check expect status 200 - http-request set-header X-Forwarded-Port %[dst_port] - http-request add-header X-Forwarded-Proto https if { dst_port 9443 } - http-reuse always - option httpchk GET / - option forwardfor - option http-keep-alive - option prefer-last-server - redirect scheme https if !{ ssl_fc } - stick-table type ip size 200k expire 30m - server ausyd1nxvm2124 198.18.28.76:443 check cookie ausyd1nxvm2124 fall 2 inter 2s rise 3 send-proxy-v2 ssl verify none - server ausyd1nxvm2125 198.18.29.44:443 check cookie ausyd1nxvm2125 fall 2 inter 2s rise 3 send-proxy-v2 ssl verify none - server ausyd1nxvm2126 198.18.25.160:443 check cookie ausyd1nxvm2126 fall 2 inter 2s rise 3 send-proxy-v2 ssl verify none - # The `peers au-syd1-prod` section is dropped: peer names must be static and a # Deployment cannot provide them. Service sessionAffinity: ClientIP pins a # client to one replica so the per-replica stick-tables behave as before. diff --git a/apps/base/haproxy/deployment.yaml b/apps/base/haproxy/deployment.yaml index 4a1f11e..a44724a 100644 --- a/apps/base/haproxy/deployment.yaml +++ b/apps/base/haproxy/deployment.yaml @@ -50,7 +50,7 @@ spec: readOnlyRootFilesystem: true capabilities: drop: [ALL] - # Frontends bind 25/80/143/443/587; the dst_port ACLs need the real ports. + # Frontends bind 80 and 443; the dst_port ACLs need the real ports. add: [NET_BIND_SERVICE] ports: - name: http @@ -59,18 +59,6 @@ spec: - name: https containerPort: 443 protocol: TCP - - name: smtp - containerPort: 25 - protocol: TCP - - name: imap - containerPort: 143 - protocol: TCP - - name: submission - containerPort: 587 - protocol: TCP - - name: imaps - containerPort: 993 - protocol: TCP - name: health containerPort: 8404 protocol: TCP diff --git a/apps/base/haproxy/service.yaml b/apps/base/haproxy/service.yaml index 388401c..a1f7d54 100644 --- a/apps/base/haproxy/service.yaml +++ b/apps/base/haproxy/service.yaml @@ -10,7 +10,7 @@ metadata: spec: type: LoadBalancer loadBalancerIP: "198.18.199.1" - # Source IP must survive for acl_internalsubnets, X-Real-IP and SMTP. + # Source IP must survive for X-Real-IP. externalTrafficPolicy: Local # Pins a client to one replica, standing in for the dropped stick-table peers. sessionAffinity: ClientIP @@ -25,19 +25,3 @@ spec: port: 443 protocol: TCP targetPort: https - - name: smtp - port: 25 - protocol: TCP - targetPort: smtp - - name: imap - port: 143 - protocol: TCP - targetPort: imap - - name: submission - port: 587 - protocol: TCP - targetPort: submission - - name: imaps - port: 993 - protocol: TCP - targetPort: imaps