helm-charts/ci/paperless-ngx/fixtures.yaml

# Fixtures for the paperless-ngx install-test: a throwaway postgres, the
# secrets the 1Password operator would otherwise materialize (release name:
# ci), and storage plumbing. The chart hardcodes storageClassName
# "longhorn" (RWX for the consume PVC), which does not exist in k3d: a
# no-provisioner StorageClass named "longhorn" plus pre-bound hostPath PVs
# stand in for it. Paperless runs as uid 1000 with a read-only rootfs and
# hostPath volumes do not support fsGroup, so a node-setup Job pre-creates
# the exact subPath directories world-writable.
#
# THERE IS NO THROWAWAY REDIS HERE ANY MORE, and that is the change this file
# carries: the release brings its own Valkey through the subchart
# (ci/paperless-ngx/test-values.yaml says what that proves), so the broker under
# test is the chart's own object rather than a Deployment next to it. Leaving a
# redis Deployment in place would have been the worse of the two: the url would
# have had to name one of them, and whichever it named, the other would have sat
# there making the run look like it covered something it did not.
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: longhorn
provisioner: kubernetes.io/no-provisioner
---
apiVersion: batch/v1
kind: Job
metadata:
  name: node-setup
spec:
  backoffLimit: 2
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: setup
          image: public.ecr.aws/docker/library/busybox:1.36
          command:
            - sh
            - -c
            - >
              mkdir -p /pv/paperless-ngx/data/data /pv/paperless-ngx/data/media
              /pv/paperless-ngx/data/export /pv/paperless-ngx/consume &&
              chmod -R 0777 /pv/paperless-ngx
          volumeMounts:
            - name: pv
              mountPath: /pv
      volumes:
        - name: pv
          hostPath:
            path: /var/lib/ci-pv
            type: DirectoryOrCreate
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: ci-paperless-data
spec:
  capacity:
    storage: 20Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: longhorn
  claimRef:
    namespace: default
    name: ci-paperless-ngx-volume-claim
  hostPath:
    path: /var/lib/ci-pv/paperless-ngx/data
    type: DirectoryOrCreate
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: ci-paperless-consume
spec:
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  storageClassName: longhorn
  claimRef:
    namespace: default
    name: ci-paperless-ngx-consume-volume-claim
  hostPath:
    path: /var/lib/ci-pv/paperless-ngx/consume
    type: DirectoryOrCreate
---
# The two Secrets below stand in for ONE 1Password item. Both the chart's
# redis OnePasswordItem and the subchart's auth OnePasswordItem point at
# op://ci/paperless-redis, and a OnePasswordItem materializes EVERY field of the
# item it names - so in a real cluster both Secrets carry all three fields. They
# are written out that way here rather than trimmed to what each consumer reads,
# because the trimmed version would have been a fixture that is tidier than
# reality and would have hidden the only thing worth knowing: the extra keys are
# unused, not a leak and not a bug.
apiVersion: v1
kind: Secret
metadata:
  name: ci-paperless-ngx-redis-secret
stringData:
  # Names the SUBCHART's Service, which is the mandatory vault step of this
  # configuration (NOTES.txt prints it). A wrong name here is the failure this
  # install-test exists to catch: paperless would come up healthy and process
  # nothing.
  redis-connection-url: redis://:cipass@ci-valkey-service:6379
  key-prefix: ci
  # Same password as in the url above - that duplication is the chart's
  # documented trap 1, and the fixture is the cheapest place to keep it honest:
  # let the two drift and the run goes red on authentication.
  auth-conf: requirepass cipass
---
# What the subchart's own OnePasswordItem (ci-valkey-secret) would become. The
# key the Valkey actually mounts is "auth-conf", and its value has to be a
# COMPLETE configuration line, because the Valkey configuration includes the
# file: give it anything that is not "requirepass <password>" and the init
# container refuses to start the pod, which is the failure that chart exists to
# make loud.
apiVersion: v1
kind: Secret
metadata:
  name: ci-valkey-secret
stringData:
  auth-conf: requirepass cipass
  redis-connection-url: redis://:cipass@ci-valkey-service:6379
  key-prefix: ci
---
apiVersion: v1
kind: Secret
metadata:
  name: ci-paperless-ngx-db-secret
stringData:
  server: postgres
  port: "5432"
  database: paperless
  username: ci
  password: ci
---
apiVersion: v1
kind: Secret
metadata:
  name: ci-paperless-ngx-secret
stringData:
  username: admin
  password: ci-admin-password
  paperless-secret-key: paperless-ci-secret-key-0123456789abcdef0123456789abcdef
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres
  labels:
    app: postgres
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
        - name: postgres
          image: public.ecr.aws/docker/library/postgres:16-alpine
          env:
            - name: POSTGRES_USER
              value: ci
            - name: POSTGRES_PASSWORD
              value: ci
            - name: POSTGRES_DB
              value: paperless
          ports:
            - containerPort: 5432
          readinessProbe:
            exec:
              command: ["pg_isready", "-U", "ci"]
            periodSeconds: 5
          volumeMounts:
            - name: data
              mountPath: /var/lib/postgresql/data
      volumes:
        - name: data
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: postgres
spec:
  selector:
    app: postgres
  ports:
    - port: 5432
      targetPort: 5432