From 8da806d657db79f46378059c54520318be897146 Mon Sep 17 00:00:00 2001 From: YuruC3 Date: Sun, 11 Jan 2026 16:21:29 +0100 Subject: [PATCH] Added filebrowser --- Datastore/deployment.yaml | 77 ++++++++++++++++++++++++++++++++++ Datastore/netPolicy.yaml | 68 ++++++++++++++++++++++++++++++ Datastore/pvc.yaml | 56 +++++++++++++++++++++++++ Datastore/service.yaml | 30 +++++++++++++ README.md | 88 ++++++++++++++++++++++++++++++++++++++- 5 files changed, 318 insertions(+), 1 deletion(-) create mode 100644 Datastore/deployment.yaml create mode 100644 Datastore/netPolicy.yaml create mode 100644 Datastore/pvc.yaml create mode 100644 Datastore/service.yaml diff --git a/Datastore/deployment.yaml b/Datastore/deployment.yaml new file mode 100644 index 0000000..3c62ddd --- /dev/null +++ b/Datastore/deployment.yaml @@ -0,0 +1,77 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: data-deployment + + labels: + project: data + + +spec: + replicas: 1 + selector: + matchLabels: + pod-project: data + template: + metadata: + labels: + pod-project: data + spec: + automountServiceAccountToken: false # Container doesn't need service account token + securityContext: + appArmorProfile: + type: RuntimeDefault + fsGroup: 101 + containers: + - name: filebrowser + image: filebrowser/filebrowser + imagePullPolicy: IfNotPresent + volumeMounts: + - name: data-the-data + mountPath: /srv + - name: fb-db + mountPath: /database + - name: fb-conf + mountPath: /config + securityContext: + runAsUser: 101 + runAsGroup: 101 + runAsNonRoot: true + - name: data + image: nginx:alpine + imagePullPolicy: IfNotPresent + ports: + - containerPort: 52345 + name: http + protocol: TCP + resources: + requests: + cpu: 10m + memory: 32Mi + volumeMounts: + - name: data-config + mountPath: /etc/nginx + - name: data-the-data + mountPath: /data + + volumes: + - name: data-config + persistentVolumeClaim: + claimName: data-config-pvc + readOnly: true + + - name: data-the-data + nfs: + server: 1.2.3.4 + path: /path/to/mount + readOnly: false + + + - name: fb-db + persistentVolumeClaim: + claimName: fb-db-pvc + readOnly: false + - name: fb-conf + persistentVolumeClaim: + claimName: fb-conf-pvc + readOnly: false diff --git a/Datastore/netPolicy.yaml b/Datastore/netPolicy.yaml new file mode 100644 index 0000000..e5c4704 --- /dev/null +++ b/Datastore/netPolicy.yaml @@ -0,0 +1,68 @@ +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: data-networkpolicy + + labels: + project: data +spec: + podSelector: + matchLabels: + pod-project: data + egress: + # Allow all egress + # - {} + # Allow egress only to public networks + # - to: + # - namespaceSelector: + # matchLabels: + # kubernetes.io/metadata.name: kube-system + # podSelector: + # matchLabels: + # k8s-app: kube-dns + # ports: + # - protocol: UDP + # port: 53 + # - protocol: TCP + # port: 53 + + # - to: + # - ipBlock: + # cidr: 0.0.0.0/0 + # except: + # - 10.0.0.0/8 + # - 172.16.0.0/12 + # - 192.168.0.0/16 + # ports: + # - protocol: + + + # ingress: + + # This port is for public facing nginx for downloading + # - from: + # - namespaceSelector: + # matchLabels: + # ns-name: + # podSelector: + # matchLabels: + # podDomain: + # ports: + # - protocol: TCP + # port: 52345 + + # This is only for internal data drop-in browser + # - from: + # - namespaceSelector: + # matchLabels: + # ns-name: + # podSelector: + # matchLabels: + # podDomain: + # ports: + # - protocol: TCP + # port: 80 + + policyTypes: + - Ingress + - Egress \ No newline at end of file diff --git a/Datastore/pvc.yaml b/Datastore/pvc.yaml new file mode 100644 index 0000000..d2450fa --- /dev/null +++ b/Datastore/pvc.yaml @@ -0,0 +1,56 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: data-config-pvc + + labels: + project: data +spec: + # https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes-1 + accessModes: + # - ReadOnlyMany + # - ReadWriteOnce + - ReadWriteMany + resources: + requests: + storage: 32Mi + + +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: fb-db-pvc + + labels: + project: data + +spec: + # https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes-1 + accessModes: + # - ReadOnlyMany + - ReadWriteOnce + # - ReadWriteMany + resources: + requests: + storage: 2Gi + +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: fb-conf-pvc + + labels: + project: data + +spec: + # https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes-1 + accessModes: + # - ReadOnlyMany + - ReadWriteOnce + # - ReadWriteMany + resources: + requests: + storage: 128Mi + diff --git a/Datastore/service.yaml b/Datastore/service.yaml new file mode 100644 index 0000000..cc97c4b --- /dev/null +++ b/Datastore/service.yaml @@ -0,0 +1,30 @@ +apiVersion: v1 +kind: Service +metadata: + name: data-service + labels: + project: data + +spec: + selector: + pod-project: data + # This isn't used as Ingress is doing TLS termination + # type: LoadBalancer + type: ClusterIP + ports: + - name: data-ngx + protocol: TCP + port: 52345 # <- port that will be exposed + # targetPort: 3000 + + # - name: anubis-data + # protocol: TCP + # port: 8080 # <- port that will be exposed + # targetPort: 8080 + # # targetPort: 3000 + + - name: filebrowser-webgui + protocol: TCP + port: 80 # <- port that will be exposed + # targetPort: 3000 + diff --git a/README.md b/README.md index 49a660f..3f4acb7 100644 --- a/README.md +++ b/README.md @@ -11,6 +11,7 @@ run ```kubectl apply -f /path/to/files/. -n ``` 3. [PiHole StatefullSet](#PiHole) 4. [Matrix Synapse](#MatrixSynapse) 5. [Element](#MatrixElement) +6. [Datastore](#Data) ### Unbound @@ -86,4 +87,89 @@ After doing that start temporary pod for copying over files with ``` kubectl -f After it starts run ```kubectl cp ./YourElementWebFolder/ YourNameSpace/uploader-matrix-landing-page:/data/``` -after that you can remove the copyFilesToPVCDeploy.yaml file and run ```kubectl apply -f /path/to/files/. -n ``` \ No newline at end of file +after that you can remove the copyFilesToPVCDeploy.yaml file and run ```kubectl apply -f /path/to/files/. -n ``` + + + +### Data + +You need to change NFS share for storing shared files. Do this in deployment.yaml on line 65 and 66 + +This is a combination of Nginx for serving static content like files or images, and filebrowser which is a container that has a webGUI for browsing, adding and/or removing images from a folder. + +Combined together webGUI for filebrowser can be placed behind an internal-only reverse proxy with internal-only domain. Nginx on the other hand can be published on the internet. + +Port 80 is used for filebrowser webGUI. Port 52345 is used for exposing Nginx to the internet. + +#### Data-nginx-config + +Here is how a nginx-config can look like + +´´´ +user nginx; +worker_processes auto; +worker_cpu_affinity auto; +pid /run/nginx.pid; +error_log /var/log/nginx/error.log; + +events { + worker_connections 4096; + multi_accept on; +} + +http { + ## + # Basic Settings + ## + + sendfile on; + tcp_nopush on; + types_hash_max_size 2048; + + include /etc/nginx/mime.types; + default_type application/octet-stream; + + ## + # SSL Settings + ## + + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers HIGH:!aNULL:!MD5; + ssl_prefer_server_ciphers on; + + ## + # Logging Settings + ## + + access_log /var/log/nginx/access.log; + + ## + # Gzip Settings + ## + gzip on; + + application/javascript text/xml application/xml application/xml+rss text/javascript; + + + server { + listen 52345; + server_name _; + + root /etc/nginx/html; + + + location / { + index index.html; + } + + location /assets { + alias /data/; + autoindex on; + autoindex_exact_size off; + autoindex_localtime on; + + } + } +} +´´´ +