obsidian deployment

cluster/applications/obsidian-vault/image/Dockerfile

@@ -0,0 +1,9 @@
+# No official image exists. Pin the npm version: `npm view obsidian-headless version`
+FROM node:22-bookworm-slim
+ARG OBSIDIAN_HEADLESS_VERSION=0.0.13
+RUN npm install -g obsidian-headless@${OBSIDIAN_HEADLESS_VERSION} \
+ && useradd -u 10000 -m -d /state ob
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod 0755 /usr/local/bin/entrypoint.sh
+USER 10000
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

cluster/applications/obsidian-vault/image/entrypoint.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+set -eu
+: "${VAULT_PATH:=/vault}"
+: "${SYNC_MODE:=mirror-remote}"
+: "${DEVICE_NAME:=k8s-obsidian}"
+: "${VAULT_NAME:?VAULT_NAME is required}"
+
+CFG_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/obsidian-headless"
+mkdir -p "$CFG_DIR"
+install -m 0600 /secrets/auth_token "$CFG_DIR/auth_token"
+
+# Debug mode: token is in place, but don't sync. Exec in and run `ob ...` by hand.
+if [ "${DEBUG:-0}" = "1" ]; then
+  echo "DEBUG=1: idling. kubectl exec -it deploy/obsidian-sync -- sh"
+  exec sleep infinity
+fi
+
+# Link the folder to the remote vault once. UNTESTED assumption: sync-status exits
+# non-zero when the folder isn't configured yet; verify on your obsidian-headless version.
+if ! ob sync-status --path "$VAULT_PATH" >/dev/null 2>&1; then
+  set -- --vault "$VAULT_NAME" --path "$VAULT_PATH" --device-name "$DEVICE_NAME"
+  if [ -n "${E2EE_PASSWORD:-}" ]; then
+    set -- "$@" --password "$E2EE_PASSWORD"
+  fi
+  ob sync-setup "$@"
+fi
+
+# --configs "" = don't sync .obsidian app/plugin settings from this device
+ob sync-config --path "$VAULT_PATH" \
+  --mode "$SYNC_MODE" \
+  --conflict-strategy merge \
+  --configs "" \
+  --excluded-folders "${EXCLUDED_FOLDERS:-}"
+
+exec ob sync --path "$VAULT_PATH" --continuous