helmrelease.yaml

# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/app-template-5.0.1/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: shlink
  namespace: shlink
spec:
  chart:
    spec:
      chart: app-template
      version: 5.0.1
      reconcileStrategy: ChartVersion
      sourceRef:
        kind: HelmRepository
        namespace: flux-system
        name: bjw-s
  interval: 1h
  driftDetection:
    mode: enabled
  values:
    controllers:
      api:
        strategy: RollingUpdate
        initContainers:
          geoip:
            image: &image
              repository: ghcr.io/shlinkio/shlink
              tag: 5.1.5-roadrunner@sha256:7c619c8fd121a7a3943932bdae2fc91b5391b49e233400b24f6f43260be20dfb
              pullPolicy: IfNotPresent
            command:
              - sh
              - -c
              - |
                set -eux
                cp -a ./vendor/shlinkio/shlink-ip-geolocation/src/GeoLite2/* /geoip
                sed -i 's|https://download.maxmind.com|http://geoip-download.geoip|' \
                  /geoip/GeoLite2Options.php
        containers:
          app:
            image: *image

            env:
              TZ: America/Chicago
              DEFAULT_DOMAIN: ${app_url}
              SHORT_DOMAIN_HOST: ${app_url}
              SHORT_DOMAIN_SCHEMA: https
              TRUSTED_PROXIES: 10.42.0.0/16
              VALIDATE_URLS: "true"
              ANONYMIZE_REMOTE_ADDR: "false"
              ENABLE_PERIODIC_VISIT_LOCATE: "true"
              # AUTO_RESOLVE_TITLES: "true"
              GEOLITE_LICENSE_KEY: stub

              DB_DRIVER: postgres
              DB_HOST: postgresql-rw
              DB_NAME: shlink
              DB_USER: shlink
              DB_PASSWORD:
                secretKeyRef:
                  name: postgresql-app
                  key: password

              WEB_WORKER_NUM: "4"
              TASK_WORKER_NUM: "4"

              SKIP_INITIAL_GEOLITE_DOWNLOAD: "true"
            securityContext:
              readOnlyRootFilesystem: true
        pod:
          labels:
            policy.gabe565.com/egress-geoip: "true"
            policy.gabe565.com/egress-namespace: "true"
            policy.gabe565.com/egress-world: "true"
            policy.gabe565.com/ingress-envoy-public: "true"
          terminationGracePeriodSeconds: 1
      frontend:
        strategy: RollingUpdate
        containers:
          app:
            image:
              repository: ghcr.io/shlinkio/shlink-web-client
              tag: 4.8.0@sha256:ec804a7f9dc8d5f64615c780106d4d954ec81648dc2a1393442c68da8e48e102
              pullPolicy: IfNotPresent
            securityContext:
              readOnlyRootFilesystem: true
        pod:
          labels:
            policy.gabe565.com/ingress-envoy-public: "true"

    persistence:
      data:
        type: emptyDir
        advancedMounts:
          api:
            app:
              - path: /etc/shlink/data
      tmp:
        type: emptyDir
        medium: Memory
        sizeLimit: 128Mi
      geolite2:
        type: emptyDir
        advancedMounts:
          api:
            geoip:
              - path: /geoip
            app:
              - path: /etc/shlink/vendor/shlinkio/shlink-ip-geolocation/src/GeoLite2
                readOnly: true

    service:
      api:
        controller: api
        ports:
          http:
            port: 8080
      frontend:
        controller: frontend
        ports:
          http:
            port: 8080

    route:
      api:
        parentRefs: &parentRefs
          - namespace: envoy-gateway-system
            name: public
        hostnames:
          - ${app_url}
        rules:
          - backendRefs:
              - identifier: api
      frontend:
        parentRefs: *parentRefs
        hostnames:
          - ${admin_url}
        rules:
          - name: private
            backendRefs:
              - identifier: frontend
          - name: servers-json
            matches:
              - path:
                  type: Exact
                  value: /servers.json
            filters:
              - type: ExtensionRef
                extensionRef:
                  group: gateway.envoyproxy.io
                  kind: HTTPRouteFilter
                  name: shlink-servers-json
          - name: service-worker
            matches:
              - path:
                  type: Exact
                  value: /service-worker.js
            filters:
              - type: ExtensionRef
                extensionRef:
                  group: gateway.envoyproxy.io
                  kind: HTTPRouteFilter
                  name: shlink-service-worker

    rawResources:
      auth:
        manifest:
          apiVersion: gateway.envoyproxy.io/v1alpha1
          kind: SecurityPolicy
          spec:
            mergeType: StrategicMerge
            targetRefs:
              - group: gateway.networking.k8s.io
                kind: HTTPRoute
                name: "{{ .Release.Name }}-frontend"
                sectionName: private
              - group: gateway.networking.k8s.io
                kind: HTTPRoute
                name: "{{ .Release.Name }}-frontend"
                sectionName: servers-json
            oidc:
              cookieConfig:
                sameSite: Lax
              provider:
                issuer: https://${oidc_host}/application/o/shlink/
                authorizationEndpoint: https://${oidc_host}/application/o/authorize/
                tokenEndpoint: https://${oidc_host}/application/o/token/
              clientIDRef:
                name: oidc
              clientSecret:
                name: oidc
              scopes: [openid, offline_access, shlink:token]
              forwardAccessToken: true
            jwt:
              providers:
                - name: extract-user-info
                  remoteJWKS:
                    uri: https://${oidc_host}/application/o/shlink/jwks/
                  claimToHeaders:
                    - claim: shlink_token
                      header: X-Shlink-Token
      no-geoblock:
        suffix: no-geoblock
        manifest:
          apiVersion: gateway.envoyproxy.io/v1alpha1
          kind: SecurityPolicy
          spec:
            targetRefs:
              - group: gateway.networking.k8s.io
                kind: HTTPRoute
                name: "{{ .Release.Name }}-api"
            authorization:
              defaultAction: Allow
      servers-json:
        manifest:
          apiVersion: gateway.envoyproxy.io/v1alpha1
          kind: HTTPRouteFilter
          spec:
            directResponse:
              statusCode: 200
              contentType: application/json
              body:
                type: Inline
                # language=json
                inline: '[{"name":"${app_url}", "url":"https://${app_url}", "apiKey":"%REQ(x-shlink-token)%"}]'
      service-worker:
        manifest:
          apiVersion: gateway.envoyproxy.io/v1alpha1
          kind: HTTPRouteFilter
          spec:
            directResponse:
              statusCode: 200
              contentType: application/javascript
              body:
                type: Inline
                # language=javascript
                inline: self.addEventListener('install', event => { event.waitUntil(self.skipWaiting()) });