.gitea/workflows/05-deploy-monitoring.yaml

@@ -0,0 +1,87 @@
+name: Deploy Monitoring
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - "05-monitoring/**"
+      - ".gitea/workflows/**"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "05-monitoring/**"
+      - ".gitea/workflows/**"
+
+jobs:
+  preview:
+    name: Pulumi Preview
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - name: Restore Stack Config
+        run: echo "${{ secrets.MONITORING_PULUMI_DEV_YAML }}" | base64 -d > 05-monitoring/Pulumi.dev.yaml
+
+      - name: Install Dependencies
+        run: npm install
+        working-directory: 05-monitoring
+
+      - name: Preview
+        uses: pulumi/actions@v5
+        with:
+          command: preview
+          stack-name: dev
+          work-dir: 05-monitoring
+          cloud-url: ${{ secrets.PULUMI_BACKEND_URL }}
+        env:
+          PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }}
+
+  deploy:
+    name: Pulumi Deploy
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - name: Restore Stack Config
+        run: echo "${{ secrets.MONITORING_PULUMI_DEV_YAML }}" | base64 -d > 05-monitoring/Pulumi.dev.yaml
+
+      - name: Install Dependencies
+        run: npm install
+        working-directory: 05-monitoring
+
+      - name: Refresh State
+        uses: pulumi/actions@v5
+        with:
+          command: refresh
+          stack-name: dev
+          work-dir: 05-monitoring
+          cloud-url: ${{ secrets.PULUMI_BACKEND_URL }}
+        env:
+          PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }}
+
+      - name: Deploy
+        uses: pulumi/actions@v5
+        with:
+          command: up
+          stack-name: dev
+          work-dir: 05-monitoring
+          cloud-url: ${{ secrets.PULUMI_BACKEND_URL }}
+        env:
+          PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }}

01-proxmox-infra/index.ts

@@ -222,7 +222,7 @@ const nodeConfigs: NodeConfig[] = [
     template: pveBckpTemplate,
     diskDatastore: "local",
     ip: worker2Ip,
-    longhornDiskSize: 20,
+    longhornDiskSize: 35,
   },
 ];
 
@@ -254,7 +254,7 @@ const k3sVms = nodeConfigs.map(
           {
             interface: "scsi0",
             datastoreId: node.diskDatastore,
-            size: 20,
+            size: 35,
             ssd: true,
             discard: "on",
           },

04-k8s-apps/index.ts

@@ -9,7 +9,7 @@ const bootstrapRef = new pulumi.StackReference(
 );
 
 const kubeconfig = bootstrapRef.requireOutput("kubeconfig");
-const domain = config.requireSecret("domain");
+export const domain = config.requireSecret("domain");
 
 const k8sProvider = new k8s.Provider("k3s", { kubeconfig });
 const opts = (extras?: pulumi.ResourceOptions): pulumi.ResourceOptions => ({

05-monitoring/Pulumi.yaml

@@ -0,0 +1,6 @@
+name: Monitoring
+description: Monitoring stack (Prometheus + Grafana via kube-prometheus-stack)
+runtime:
+  name: nodejs
+  options:
+    packagemanager: npm

05-monitoring/index.ts

@@ -0,0 +1,74 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+
+const config = new pulumi.Config();
+
+const bootstrapRef = new pulumi.StackReference(
+  `${pulumi.getOrganization()}/k8s-bootstrap/dev`,
+);
+const appsRef = new pulumi.StackReference(
+  `${pulumi.getOrganization()}/k8s-apps/dev`,
+);
+
+const kubeconfig = bootstrapRef.requireOutput("kubeconfig");
+const domain = appsRef.requireOutput("domain");
+const grafanaAdminPassword = config.requireSecret("grafanaAdminPassword");
+
+const k8sProvider = new k8s.Provider("k3s", { kubeconfig });
+const opts = (extras?: pulumi.ResourceOptions): pulumi.ResourceOptions => ({
+  provider: k8sProvider,
+  ...extras,
+});
+
+const ns = new k8s.core.v1.Namespace(
+  "monitoring",
+  { metadata: { name: "monitoring" } },
+  opts(),
+);
+
+const grafanaHost = pulumi.interpolate`grafana.${domain}`;
+
+new k8s.helm.v3.Release(
+  "kube-prometheus-stack",
+  {
+    name: "kube-prometheus-stack",
+    chart: "kube-prometheus-stack",
+    version: "86.2.0",
+    namespace: ns.metadata.name,
+    repositoryOpts: {
+      repo: "https://prometheus-community.github.io/helm-charts",
+    },
+    timeout: 600,
+    values: {
+      grafana: {
+        adminPassword: grafanaAdminPassword,
+        ingress: {
+          enabled: true,
+          ingressClassName: "traefik",
+          annotations: { "cert-manager.io/cluster-issuer": "letsencrypt-prod" },
+          hosts: [grafanaHost],
+          tls: [{ secretName: "grafana-tls", hosts: [grafanaHost] }],
+        },
+        persistence: {
+          enabled: true,
+          storageClassName: "longhorn",
+          size: "2Gi",
+        },
+      },
+      prometheus: {
+        prometheusSpec: {
+          storageSpec: {
+            volumeClaimTemplate: {
+              spec: {
+                storageClassName: "longhorn",
+                resources: { requests: { storage: "20Gi" } },
+              },
+            },
+          },
+        },
+      },
+      alertmanager: { enabled: false },
+    },
+  },
+  opts(),
+);

05-monitoring/package.json

@@ -0,0 +1,12 @@
+{
+    "name": "k8s-monitoring",
+    "main": "index.ts",
+    "devDependencies": {
+        "@types/node": "^24.0.0",
+        "typescript": "^6.0.0"
+    },
+    "dependencies": {
+        "@pulumi/kubernetes": "^4.31.1",
+        "@pulumi/pulumi": "^3.244.0"
+    }
+}

05-monitoring/tsconfig.json

@@ -0,0 +1,18 @@
+{
+    "compilerOptions": {
+        "strict": true,
+        "outDir": "bin",
+        "target": "ES2024",
+        "module": "nodenext",
+        "moduleResolution": "nodenext",
+        "sourceMap": true,
+        "experimentalDecorators": true,
+        "pretty": true,
+        "noFallthroughCasesInSwitch": true,
+        "noImplicitReturns": true,
+        "forceConsistentCasingInFileNames": true
+    },
+    "files": [
+        "index.ts"
+    ]
+}