homelab-infrastructure-as-code/04-k8s-apps/index.ts

import * as pulumi from "@pulumi/pulumi";
import * as k8s from "@pulumi/kubernetes";

const config = new pulumi.Config();

const bootstrapRef = new pulumi.StackReference(
  `${pulumi.getOrganization()}/k8s-bootstrap/dev`,
);

const kubeconfig = bootstrapRef.requireOutput("kubeconfig");
export const domain = config.requireSecret("domain");

const k8sProvider = new k8s.Provider("k3s", { kubeconfig });
const opts = (extras?: pulumi.ResourceOptions): pulumi.ResourceOptions => ({
  provider: k8sProvider,
  ...extras,
});

const ns = new k8s.core.v1.Namespace(
  "heimdall",
  { metadata: { name: "heimdall" } },
  opts(),
);

const pvc = new k8s.core.v1.PersistentVolumeClaim(
  "heimdall-config",
  {
    metadata: { name: "heimdall-config", namespace: ns.metadata.name },
    spec: {
      accessModes: ["ReadWriteOnce"],
      storageClassName: "longhorn",
      resources: { requests: { storage: "50Mi" } },
    },
  },
  opts(),
);

const labels = { app: "heimdall" };

new k8s.apps.v1.Deployment(
  "heimdall",
  {
    metadata: {
      name: "heimdall",
      namespace: ns.metadata.name,
      annotations: { "pulumi.com/patchForce": "true" },
    },
    spec: {
      replicas: 1,
      selector: { matchLabels: labels },
      template: {
        metadata: { labels },
        spec: {
          containers: [
            {
              name: "heimdall",
              image: "lscr.io/linuxserver/heimdall:latest",
              env: [
                { name: "PUID", value: "1000" },
                { name: "PGID", value: "1000" },
              ],
              ports: [{ containerPort: 80 }],
              volumeMounts: [{ name: "config", mountPath: "/config" }],
            },
          ],
          volumes: [
            {
              name: "config",
              persistentVolumeClaim: { claimName: pvc.metadata.name },
            },
          ],
          terminationGracePeriodSeconds: 5,
        },
      },
    },
  },
  opts(),
);

const svc = new k8s.core.v1.Service(
  "heimdall",
  {
    metadata: { name: "heimdall", namespace: ns.metadata.name },
    spec: {
      selector: labels,
      ports: [{ port: 80, targetPort: 80 }],
      type: "ClusterIP",
    },
  },
  opts(),
);

const host = pulumi.interpolate`heimdall.${domain}`;

new k8s.networking.v1.Ingress(
  "heimdall",
  {
    metadata: {
      name: "heimdall",
      namespace: ns.metadata.name,
      annotations: {
        "cert-manager.io/cluster-issuer": "letsencrypt-prod",
      },
    },
    spec: {
      ingressClassName: "traefik",
      tls: [{ hosts: [host], secretName: "heimdall-tls" }],
      rules: [
        {
          host,
          http: {
            paths: [
              {
                path: "/",
                pathType: "Prefix",
                backend: {
                  service: {
                    name: svc.metadata.name,
                    port: { number: 80 },
                  },
                },
              },
            ],
          },
        },
      ],
    },
  },
  opts(),
);

export const ingressHost = host;