Build with anchors

.drone.yml

@@ -28,6 +28,9 @@ name: Build badhouseplants.net
 trigger:
   event:
     - push
+builder: &builder
+  image: git.badhouseplants.net/badhouseplants/badhouseplants-builder:555262114ea81f6f286010474527f419b56d33a3
+
 clone:
   disable: true
 steps:
@@ -45,8 +48,8 @@ steps:
       - clone
     commands:
       - hugo -s ./src
-  - name: Build and push the docker image
+  - <<: *builder
-    image: git.badhouseplants.net/badhouseplants/badhouseplants-builder:9fabf0ce6eab3a9a9da15b2791e8282afc05ee0b
+    name: Build and push the docker image
     privileged: true
     depends_on:
       - Test a build
@@ -56,8 +59,8 @@ steps:
         from_secret: GITEA_TOKEN
     commands:
       - ./scripts/build-container.pl
-  - name: Sync pictures from lfs to Minio
+  - <<: *builder
-    image: git.badhouseplants.net/badhouseplants/badhouseplants-builder:9fabf0ce6eab3a9a9da15b2791e8282afc05ee0b
+    name: Sync pictures from lfs to Minio
     depends_on:
       - Test a build
     environment:
@@ -67,8 +70,8 @@ steps:
     commands:
       - echo "$RCLONE_CONFIG_CONTENT" > $RCLONE_CONFIG
       - ./scripts/upload-media.pl
-  - name: Deploy the application
+  - <<: *builder
-    image: git.badhouseplants.net/badhouseplants/badhouseplants-builder:9fabf0ce6eab3a9a9da15b2791e8282afc05ee0b
+    name: Deploy the application
     depends_on:
       - Build and push the docker image
       - Sync pictures from lfs to Minio
@@ -81,10 +84,11 @@ steps:
         from_secret: GITHUB_OAUTH_KEY
       ARGO_GOOGLE_OAUTH_KEY:
         from_secret: GOOGLE_OAUTH_KEY
+      DEPLOY_SCRIPT_DEBUG: true
     commands:
       - ./scripts/deploy-app.pl
-  - name: Cleanup everything
+  - <<: *builder
-    image: git.badhouseplants.net/badhouseplants/badhouseplants-builder:9fabf0ce6eab3a9a9da15b2791e8282afc05ee0b
+    name: Cleanup everything
     depends_on:
       - Deploy the application
     environment:

.sops.yaml

@@ -0,0 +1,5 @@
+creation_rules:
+  - path_regex: .*secrets\.values.*
+    key_groups:
+      - age:
+          - age155dykdtnkw9fke45pxkygyyx2eal0hwpdm0zz8qa92z5ludjqe5sfakqgs

.woodpecker.yaml

@@ -1,10 +0,0 @@
----
-when:
-  event: push
-steps:
-  spell-check:
-    name: Spell-Checker
-    image: node
-    commands:
-      - npm i markdown-spellcheck -g
-      - mdspell "src/content/**/*.md" -n -r

Containerfile

@@ -1,4 +1,4 @@
-FROM git.badhouseplants.net/badhouseplants/hugo-container:dd6475f3c99b450d334d3377f3c1a1474a341ba7
+FROM git.badhouseplants.net/badhouseplants/hugo-container:3daaf01c9811501f2b4c691f6910e3df285c2007
 WORKDIR /src
 COPY ./src /src
 ENTRYPOINT ["hugo"]

kube/secrets.values-main.yaml

@@ -0,0 +1,21 @@
+values: ENC[AES256_GCM,data:qQTaz7Ab1+2udnxTNRfRKALV93SNBX1l+po11ZPV/RRstwuaBqkrp/zRMllPj6O6p62Y9N9BknSJsuavH62wqAOmN0qVP1XQtzHMLMKMIOe4ut29NtcR7XM54Cq1glqTk2LRfCaCdYSzOsXFscGI/x2bx7G8LjKXWEPtHGXVU+lU3OZFWZ7Ioz02lPl3FnidXBQrCQnY1Wc4qS0T/haCq0cXYk+SA4jMY5vxn3+WwaCfq//50EZOebNFCPnGHR5kRmMmG32u918lt/jv2GEu066Vjd0J67S8HGiykFi6RHZwIry0V65YH7X/L4LtEqKok+WAu3ssNRsgXaEhvWclpn0Jq30Z2qsaSFVItbSC7oiUEixlRc1oxOm0ytWZmlFJbzfpA9JdHw1Dpw0q8kIY2eqmAM/W3omZy+4tmPttHbnWyoKSPJi4CflDMToMkkujGqfnOx0OVQ85fXpr0cKkYJuyLz7YQtAyIGGqGyHtqqicWCqt9B25If1Cv+91gu1If0fpEb77ITIjRHaeEcLkBqb9cCGJnV+a6bdVTtDvH2sS9kBS+oWK+cgsAWD3BVDIpOlV0jwJyAB+++PwmsZuFc9MEkE8DSMK2P64J4ceyV6M4Eb8YNGljdxTRZAl9m6SaKLMC8KiggiHs3JPg69n1OsFWN7EcCKtErTq0+XbiHidkYbg+xnxnez3cCbMvTeNZvbKU2bVllqie4ZMe4q0TzQEnTlMeuqeGtVIgPn9an2N2foTHZUboAysM2MKKeWB2isABtv59SXyzhfQmvC08Cgf9Jj3cJpqWm2/Am3RIYcsXW8NwkxM+lPQ6+IYx87Wd3FvPDTTS+wSO700uzFWXfwsaE7AY1uQBXK7bL61jPQ3HpQYWDS11+1zX30iUaDm3m3u6t6gVlGeICAvxqoBxOiruX/jcAOzU/dSeSTjjPmvDO829kB6rFugAvRDYXetoI09EugdnPHTaC/xFejV,iv:/7k4rjpiuCJev6B/GJu9eyb/RMWJfyfjrRuVRTdybDM=,tag:G1eRy4i6+59wZuGqx9bDPQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age155dykdtnkw9fke45pxkygyyx2eal0hwpdm0zz8qa92z5ludjqe5sfakqgs
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEMWthSXdncUI0U0tSdkk4
+            d1lyQWJ2M0NQSjRQRWViQ0RLVWlSK3FsczB3Cks1V1BaZmFlUVRCdUpBS2kzekxK
+            RlRlQ1daTGdMODlEenVUOVNDOVhNUWsKLS0tIERxeG1BRlh0T0hKSlNXeHI0eUVO
+            V1N2YWIvWXpDckhzampIVUx4YU50Q2cKRyx2G5ki4yhhzpTVjjCBPKvI1C208HJb
+            Qb9Kpd2HkJaVllL5mUsXOAWtugceaSvidK1t3Hz0NXrVvFVUxDh8Rg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-12-07T09:10:13Z"
+    mac: ENC[AES256_GCM,data:gsbIyJU7T6wRj5CFbG2nyeawvCzp/BtOSOIsapC0AF6a2IIqau1IaH+vd2O7mbT5ClurC0zfR5k5g/pRE8AWc85kbdBhzLBe4Kkx5DXy9N/JQaNh8RlJ1HKzvipVK46zF+6PZYjsrb1S+9WL9p/aV226XkhdcHWcMWrKUaAWVOg=,iv:H5YcSg5gVHNEt7gFLuF8OQtTMq88HdZwlMfMTxxL7iQ=,tag:66qP18m69BBEIuHKJMa1Cw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

kube/values-preview.yaml

@@ -1,33 +1,32 @@
 ---
-values: |
+namespace:
-  namespace:
+  name: badhouseplants-$BH_APP_BRANCH
-    name: badhouseplants-$ARGO_APP_BRANCH
   labels:
     istio-injection: disabled
-  istio:
+istio:
   hosts:
-      - $ARGO_APP_HOSTNAME
+    - $BH_APP_HOSTNAME
   annotations:
-      link.argocd.argoproj.io/env: https://$ARGO_APP_HOSTNAME/
+    link.argocd.argoproj.io/env: https://$BH_APP_HOSTNAME/
-      link.argocd.argoproj.io/remark42: https://remark42-$ARGO_APP_HOSTNAME/web
+    link.argocd.argoproj.io/remark42: https://remark42-$BH_APP_HOSTNAME/web
     link.argocd.argoproj.io/build: $DRONE_BUILD_LINK
-  hugo:
+hugo:
   image:
-      tag: $ARGO_APP_IMAGE_TAG
+    tag: $BH_APP_IMAGE_TAG
-    baseURL: https://$ARGO_APP_HOSTNAME/
+  baseURL: https://$BH_APP_HOSTNAME/
   buildDrafts: true
   env:
-      HUGO_PARAMS_GITBRANCH: $ARGO_APP_BRANCH
+    HUGO_PARAMS_GITBRANCH: $BH_APP_BRANCH
-      HUGO_PARAMS_REMARK42URL: https://remark42-$ARGO_APP_HOSTNAME
+    HUGO_PARAMS_REMARK42URL: https://remark42-$BH_APP_HOSTNAME
-      HUGO_PARAMS_GITCOMMIT: $ARGO_APP_IMAGE_TAG
+    HUGO_PARAMS_GITCOMMIT: $BH_APP_IMAGE_TAG
-  remark42:
+remark42:
   istio:
     hosts:
-        - remark42-$ARGO_APP_HOSTNAME
+      - remark42-$BH_APP_HOSTNAME
   settings:
-      url: https://remark42-$ARGO_APP_HOSTNAME/
+    url: https://remark42-$BH_APP_HOSTNAME/
     auth:
       anonymous: true
-      secretKey: $ARGO_REMARK_SECRET
+    secretKey: $BH_REMARK_SECRET
-  rclone:
+rclone:
-    command: 'rclone copy -P badhouseplants-public:/badhouseplants-net/$ARGO_APP_IMAGE_TAG /static'
+  command: 'rclone copy -P badhouseplants-public:/badhouseplants-net/$BH_APP_IMAGE_TAG /static'

scripts/deploy-app.pl

@@ -15,11 +15,11 @@ my $values = "";
 my $remark_secret = `openssl rand -hex 12`;
 chomp($remark_secret);
 
-$ENV{'ARGO_APP_CHART_VERSION'} = $chart_version;
+$ENV{'BH_APP_CHART_VERSION'} = $chart_version;
-$ENV{'ARGO_APP_BRANCH'} = $git_branch;
+$ENV{'BH_APP_BRANCH'} = $git_branch;
-$ENV{'ARGO_APP_HOSTNAME'} = "$git_branch-dev.badhouseplants.net";
+$ENV{'BH_APP_HOSTNAME'} = "$git_branch-dev.badhouseplants.net";
-$ENV{'ARGO_APP_IMAGE_TAG'} = $git_commit_sha;
+$ENV{'BH_APP_IMAGE_TAG'} = $git_commit_sha;
-$ENV{'ARGO_REMARK_SECRET'} = $remark_secret;
+$ENV{'BH_REMARK_SECRET'} = $remark_secret;
 
 # ----------------------------------
 # -- Fill the Application manifest
@@ -37,6 +37,7 @@ print `envsubst < ./kube/application.yaml > /tmp/application.yaml` or die $!;
 print `yq -i '.spec.source.helm.values = load_str("/tmp/values.yaml")' /tmp/application.yaml` or die $!;
 
 if(!defined $ENV{DEPLOY_SCRIPT_DEBUG}){
+	print `helm upgrade --install `
 	print `argocd app create -f /tmp/application.yaml --upsert` or die $!;
 	print `argocd app sync --prune -l application=badhouseplants -l branch=$git_branch` or die $!; 
 	print `argocd app wait -l application=badhouseplants -l branch=$git_branch` or die $!;

src/config.yaml

@@ -34,7 +34,7 @@ params:
   profileMode:
     enabled: true
     title: "Bad Houseplants"
-    subtitle: Easy DevOps by allanger
+    subtitle: ... by allanger.
     imageUrl: "main-logo.png"
     imageWidth: 150
     imageHeight: 150

src/content/about/_index.md

@@ -4,19 +4,7 @@ date: 2023-01-24T09:26:52+01:00
 draft: false
 ---
 
-## Welcome
+Oi! 
-
-Oi! Welcome to Bad Houseplants.
-
-This is a blog about DevOps, self-hosting, Kubernetes, and stuff like that.
-
-I'm allanger and I believe that DevOps should be easy to understand, and when saying DevOps, I also mean SRE and Ops in general. I see/hear it very often that teams working with GitOps and Kubernetes are making it increadbly hard, and I don't know the reasons for sure.
-
-Here, I'll try do describe how things can be deployed to K8s, what one could do with that, and how to keep it maintainable. My main focus is self-hosted k8s, because it's the one I'm using on my own, but it doesn't mean that what you'll read here can't be applied to cloud providers and different k8s-as-a-service solutions.
-
-
-
-
 I'm allanger and currently I'm working as full time SRE, but recently I've found out that I'd like to spend more time doing things related to music and sound. So I'm currently looking for project to add to my portfolio. So if you want somebody do a decent (I hope) mix for you without asking for any money, just let shoot me a message.
 
 I'm not a pro mixing engineer of course, but it's what I'm aiming for.