jklein
8df1913c5c
BentoPDF computes entirely in the visitor's browser; the container only serves static files through nginx. The chart is therefore close to cyberchef - same nginx-unprivileged base, uid 101, port 8080, probes on "/" - with four differences that shaped the design. Runtime config.json. The one setting reachable at runtime is the tool list. It is a static file in the middle of the web root, so it is mounted by subPath: a directory mount would hide the whole application. subPath mounts are never refreshed by the kubelet, which makes the checksum/config annotation (#82) load-bearing rather than decorative. bentopdf.config is passed through verbatim, like searxng's settings, so a key upstream adds tomorrow is a values change and not a chart change. Three env switches that would kill the pod. PORT, DISABLE_IPV6 and ROBOTS_NOINDEX are implemented as "sed -i" against files in the image, run under "set -e" in /docker-entrypoint.d/, and the base image's entrypoint aborts when one of them fails. With readOnlyRootFilesystem: true the pod therefore never starts instead of ignoring the switch - measured in k3d as CrashLoopBackOff, exit 1, "sed: can't create temp file '/etc/nginx/nginx.confXXXXXX': Read-only file system". None of the three is offered as a first-class value; values.yaml names the failure picture and the escape hatch (env block plus readOnlyRootFilesystem: false). Writable paths were measured, not copied from the upstream chart. /etc/nginx/tmp holds the pid file and /var/cache/nginx is where nginx creates its temp directories at startup - without it the master aborts with 'mkdir() "/var/cache/nginx/client_temp" failed'. /var/run is deliberately not mounted: the running pod proves it is unnecessary. Everything else about BentoPDF is a build-time argument and out of reach for any chart; values.yaml says so explicitly rather than leaving it to be discovered. Two accepted consequences are named there too: some tools fetch WASM modules from a public CDN at runtime, and the served pages carry a canonical link to the vendor's site. Fixes #174
104 lines
3.8 KiB
YAML
104 lines
3.8 KiB
YAML
name: Change App-Version
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
app-version:
|
|
required: true
|
|
type: string
|
|
description: "change the version of the underlying application"
|
|
chart-location:
|
|
required: false
|
|
type: string
|
|
default: "."
|
|
description: "location of the helm chart"
|
|
chart-name:
|
|
required: true
|
|
type: choice
|
|
description: "helm chart to be updated"
|
|
options:
|
|
- zipline
|
|
- calibre-web-automated
|
|
- samba
|
|
- teamspeak-server
|
|
- urlaubsverwaltung
|
|
- apache-tika
|
|
- gotenberg
|
|
- homeassistant
|
|
- satisfactory
|
|
- cyberchef
|
|
- matrix-synapse
|
|
- outline
|
|
- paperless-ngx
|
|
- patchmon
|
|
- rallly
|
|
- voucher-vault
|
|
- minecraft-router
|
|
- minecraft-server
|
|
- rss-bridge
|
|
- searxng
|
|
- bentopdf
|
|
# freesailarr is deliberately absent: none of its nine images takes
|
|
# its tag from appVersion (they are all pinned in its values.yaml),
|
|
# so this workflow would rewrite appVersion and republish the chart
|
|
# without changing a single deployed image. Update its images through
|
|
# a Renovate PR, and its appVersion by hand.
|
|
workflow_call:
|
|
inputs:
|
|
app-version:
|
|
required: true
|
|
type: string
|
|
description: "change the version of the underlying application"
|
|
chart-location:
|
|
required: false
|
|
type: string
|
|
default: "."
|
|
description: "location of the helm chart"
|
|
chart-name:
|
|
required: true
|
|
type: string
|
|
description: "name of the helm chart"
|
|
|
|
jobs:
|
|
change-app-version:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: "Configure OP-Connect"
|
|
uses: 1password/load-secrets-action/configure@v5
|
|
with:
|
|
connect-host: https://op-connect.jk-dev.de
|
|
- name: "Load GitHub Credentials"
|
|
id: load-jk-cluster-bot-creds
|
|
uses: 1password/load-secrets-action@v5
|
|
env:
|
|
OP_CONNECT_TOKEN: ${{ secrets.OP_CONNECT_TOKEN }}
|
|
JK_CLUSTER_BOT_TOKEN: op://GitHub-Actions/github-helm-charts-push-token/credential
|
|
JK_CLUSTER_USERNAME: op://GitHub-Actions/github-helm-charts-push-token/username
|
|
JK_CLUSTER_EMAIL: op://GitHub-Actions/github-helm-charts-push-token/email
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
token: ${{ env.JK_CLUSTER_BOT_TOKEN }}
|
|
- name: "Get Chart Version"
|
|
run: |
|
|
CHART_VERSION=$(grep '^version:' ${{ inputs.chart-name }}/Chart.yaml | awk '{print $2}')
|
|
CHART_PART=$(echo $CHART_VERSION | cut -d'+' -f1)
|
|
echo "CHART_VERSION=$CHART_PART" >> $GITHUB_ENV
|
|
working-directory: ${{ inputs.chart-location }}
|
|
- name: "Get new Chart Version"
|
|
run: |
|
|
APP_VERSION_NORMALIZED=$(echo "${{ inputs.app-version }}" | tr '-' '.')
|
|
NEW_VERSION="${CHART_VERSION}+up${APP_VERSION_NORMALIZED}"
|
|
sed -i "s/^version:.*/version: $NEW_VERSION/" ${{ inputs.chart-name }}/Chart.yaml
|
|
sed -i "s/^appVersion:.*/appVersion: ${{ inputs.app-version }}/" ${{ inputs.chart-name }}/Chart.yaml
|
|
working-directory: ${{ inputs.chart-location }}
|
|
- name: "View chart-directory contents"
|
|
run: ls -al
|
|
working-directory: ${{ inputs.chart-location }}
|
|
- name: "View helm-chart.yaml"
|
|
run: cat Chart.yaml
|
|
working-directory: ${{ inputs.chart-location }}/${{ inputs.chart-name }}
|
|
- name: Commit and Push Changes
|
|
run: |
|
|
git config --global user.name '${{ env.JK_CLUSTER_USERNAME }}'
|
|
git config --global user.email '${{ env.JK_CLUSTER_EMAIL }}'
|
|
git commit -am "Updated ${{ inputs.chart-name }} application version to ${{ inputs.app-version }}"
|
|
git push |