obsidian deployment

2026-10-06 13:49:13 -05:00
1 parent ffc8feddff
commit 8b81c090f6
@@ -0,0 +1,94 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: obsidian-vault
+  labels:
+    app.kubernetes.io/name: obsidian-vault
+  annotations:
+    argocd.argoproj.io/sync-wave: "8"
+spec:
+  replicas: 1                # exactly one sync "device" per vault copy
+  strategy:
+    type: Recreate           # never two sync clients on the same folder
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: obsidian-vault
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: obsidian-vault
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10000
+        runAsGroup: 10000
+        fsGroup: 10000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: ob
+          image: ghcr.io/CHANGE_ME/obsidian-headless:0.0.13   # build from ./image
+          env:
+            - name: SYNC_MODE          # mirror-remote = download only, revert local changes
+              value: mirror-remote
+            - name: DEBUG              # "1" = idle instead of syncing, then kubectl exec in
+              value: "0"
+            - name: VAULT_PATH
+              value: /vault
+            - name: DEVICE_NAME        # shows up in Obsidian's sync version history
+              value: k8s-obsidian
+            - name: EXCLUDED_FOLDERS   # comma-separated folders that must never reach the cluster
+              value: ""
+            - name: HOME
+              value: /state
+            - name: XDG_CONFIG_HOME
+              value: /state/config
+            - name: VAULT_NAME
+              valueFrom:
+                secretKeyRef:
+                  name: obsidian-vault
+                  key: vault_name
+            - name: E2EE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: obsidian-vault
+                  key: e2ee_password
+                  optional: true
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              memory: 512Mi
+          volumeMounts:
+            - name: vault
+              mountPath: /vault
+            - name: state
+              mountPath: /state
+            - name: auth
+              mountPath: /secrets
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: vault
+          persistentVolumeClaim:
+            claimName: obsidian-vault
+        - name: state
+          persistentVolumeClaim:
+            claimName: obsidian-sync-state
+        - name: auth
+          secret:
+            secretName: obsidian-sync
+            items:
+              - key: auth_token
+                path: auth_token
+        - name: tmp
+          emptyDir: {}