mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 16:04:31 +00:00
6318d232f0
- Introduced support for dynamic GitLab and Supabase domain and ingress configuration based on deployment mode (k8s vs local). - Default GitLab domain and ingress class aligned with `prole.cfg` deployment settings. - Expanded Supabase support: - Added configurable API and Studio hostnames with default fallbacks. - Introduced separate ingress class configuration for API and Studio. - Standardized public URL normalization for both services. - Updated tests to validate domain, ingress, and configuration behaviors across environments.
629 lines
23 KiB
Python
Executable File
629 lines
23 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""
|
|
Render a personalized Supabase Helm values file and pre-template manifests
|
|
using the local prole.cfg. Defaults are tailored for knoe's CNPG cluster
|
|
(knoe-db-rw Service) and unattended k8s ingress.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import base64
|
|
import configparser
|
|
import hashlib
|
|
import hmac
|
|
import json
|
|
import os
|
|
import secrets
|
|
import subprocess
|
|
import sys
|
|
import time
|
|
import urllib.parse
|
|
from pathlib import Path
|
|
from typing import Any, Dict
|
|
|
|
# Allow imports from the repo root
|
|
REPO_ROOT = Path(__file__).resolve().parents[2]
|
|
sys.path.insert(0, str(REPO_ROOT))
|
|
|
|
try:
|
|
from knoe.config import _resolve_secret_value # type: ignore
|
|
except Exception: # pragma: no cover - fallback for minimal environments
|
|
def _resolve_secret_value(value: str | None) -> str:
|
|
return value or ""
|
|
|
|
|
|
def _read_cfg(path: Path) -> configparser.ConfigParser:
|
|
parser = configparser.ConfigParser(interpolation=None)
|
|
try:
|
|
from knoe import prole_conf as prole_conf_mgr # type: ignore
|
|
|
|
files = [p for p in prole_conf_mgr.layered_cfg_files(path) if p.exists()]
|
|
if files:
|
|
parser.read([str(p) for p in files])
|
|
else:
|
|
parser.read(path)
|
|
except Exception:
|
|
parser.read(path)
|
|
return parser
|
|
|
|
|
|
def _cfg_get(cfg: configparser.ConfigParser, section: str, key: str, default: str = "") -> str:
|
|
try:
|
|
raw = cfg.get(section, key, fallback=default)
|
|
except Exception:
|
|
return default
|
|
return _resolve_secret_value((raw or "").strip())
|
|
|
|
|
|
def _first(*values: str, default: str = "") -> str:
|
|
for v in values:
|
|
if v:
|
|
return v
|
|
return default
|
|
|
|
|
|
def _is_placeholder(value: str) -> bool:
|
|
v = (value or "").strip()
|
|
return v.startswith("${") and v.endswith("}")
|
|
|
|
|
|
def _as_bool(value: str | bool | None, default: bool = False) -> bool:
|
|
if isinstance(value, bool):
|
|
return value
|
|
if value is None:
|
|
return default
|
|
normalized = str(value).strip().lower()
|
|
if not normalized:
|
|
return default
|
|
if normalized in {"1", "true", "yes", "on", "y"}:
|
|
return True
|
|
if normalized in {"0", "false", "no", "off", "n"}:
|
|
return False
|
|
return default
|
|
|
|
|
|
def _parse_hosts(raw_hosts: str, fallback: str = "db.0.knoe.dev") -> list[str]:
|
|
entries: list[str] = []
|
|
seen: set[str] = set()
|
|
for entry in (raw_hosts or "").split(","):
|
|
token = (entry or "").strip()
|
|
if not token or _is_placeholder(token):
|
|
continue
|
|
|
|
if "://" in token:
|
|
parsed = urllib.parse.urlparse(token)
|
|
host = (parsed.hostname or "").strip()
|
|
else:
|
|
host = token
|
|
|
|
if not host or host in seen:
|
|
continue
|
|
seen.add(host)
|
|
entries.append(host)
|
|
|
|
if entries:
|
|
return entries
|
|
return [fallback]
|
|
|
|
|
|
def _normalize_public_hosts(raw_hosts: str, fallback_host: str) -> tuple[list[str], str]:
|
|
raw_entries: list[str] = []
|
|
for entry in (raw_hosts or "").split(","):
|
|
token = (entry or "").strip()
|
|
if token and not _is_placeholder(token):
|
|
raw_entries.append(token)
|
|
if not raw_entries:
|
|
raw_entries = [fallback_host]
|
|
|
|
host_entries = _parse_hosts(",".join(raw_entries), fallback=fallback_host)
|
|
primary_host = host_entries[0]
|
|
|
|
primary_raw = (raw_entries[0] or "").strip()
|
|
if "://" in primary_raw:
|
|
parsed = urllib.parse.urlparse(primary_raw)
|
|
primary_host = (parsed.hostname or "").strip() or primary_host
|
|
scheme = (parsed.scheme or "https").strip()
|
|
netloc = (parsed.netloc or primary_host).strip()
|
|
public_url = f"{scheme}://{netloc}"
|
|
else:
|
|
public_url = f"https://{primary_host}"
|
|
|
|
return host_entries, public_url
|
|
|
|
|
|
def _discover_k8s_service_namespace(service_name: str) -> str:
|
|
try:
|
|
raw = subprocess.check_output(["kubectl", "get", "svc", "-A", "-o", "json"], text=True)
|
|
data = json.loads(raw)
|
|
for item in data.get("items", []) or []:
|
|
md = item.get("metadata", {}) or {}
|
|
if md.get("name") == service_name and md.get("namespace"):
|
|
return str(md.get("namespace"))
|
|
except Exception:
|
|
return ""
|
|
return ""
|
|
|
|
|
|
def _ensure_dir(path: Path) -> Path:
|
|
path.mkdir(parents=True, exist_ok=True)
|
|
return path
|
|
|
|
|
|
def _load_or_create_secret(path: Path, length: int = 32) -> str:
|
|
if path.exists():
|
|
return path.read_text().strip()
|
|
val = secrets.token_hex(length)
|
|
path.write_text(val)
|
|
return val
|
|
|
|
|
|
def _b64url(data: bytes) -> str:
|
|
return base64.urlsafe_b64encode(data).rstrip(b"=").decode("utf-8")
|
|
|
|
|
|
def _jwt(payload: Dict[str, Any], secret: str) -> str:
|
|
header = {"alg": "HS256", "typ": "JWT"}
|
|
head = _b64url(json.dumps(header, separators=(",", ":")).encode())
|
|
body = _b64url(json.dumps(payload, separators=(",", ":")).encode())
|
|
signing_input = f"{head}.{body}".encode()
|
|
sig = hmac.new(secret.encode(), signing_input, hashlib.sha256).digest()
|
|
return f"{head}.{body}.{_b64url(sig)}"
|
|
|
|
|
|
def _build_overlay(cfg: configparser.ConfigParser, args: argparse.Namespace) -> tuple[dict, dict]:
|
|
db_service = os.environ.get("KNOE_DB_SERVICE", "knoe-db-rw")
|
|
|
|
db_ns = _first(
|
|
os.environ.get("KNOE_DB_NAMESPACE", ""),
|
|
os.environ.get("DATABASE_NAMESPACE", ""),
|
|
_cfg_get(cfg, "Global", "DATABASE_NAMESPACE"),
|
|
_cfg_get(cfg, "Global", "NAMESPACE"),
|
|
os.environ.get("NAMESPACE", ""),
|
|
default="",
|
|
)
|
|
if _is_placeholder(db_ns):
|
|
db_ns = ""
|
|
if not db_ns:
|
|
db_ns = _discover_k8s_service_namespace(db_service) or ""
|
|
if not db_ns:
|
|
db_ns = "default"
|
|
|
|
supabase_ns = _first(
|
|
_cfg_get(cfg, "Supabase", "NAMESPACE"),
|
|
os.environ.get("SUPABASE_NAMESPACE", ""),
|
|
"supabase",
|
|
)
|
|
db_host = _first(
|
|
os.environ.get("SUPABASE_DB_HOST", ""),
|
|
os.environ.get("DB_HOST", ""),
|
|
_cfg_get(cfg, "Supabase", "DB_HOST"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_DB_HOST"),
|
|
default=f"{db_service}.{db_ns}.svc.cluster.local",
|
|
).strip()
|
|
if _is_placeholder(db_host):
|
|
db_host = f"{db_service}.{db_ns}.svc.cluster.local"
|
|
db_port = _first(
|
|
_cfg_get(cfg, "Global", "DB_HOST_PORT"),
|
|
_cfg_get(cfg, "Inputs", "init_password.db_host_port"),
|
|
"5432",
|
|
)
|
|
db_name = _first(
|
|
_cfg_get(cfg, "Database Creation", "DB_NAME"),
|
|
_cfg_get(cfg, "Global", "DB_NAME"),
|
|
"postgres",
|
|
)
|
|
db_password = _first(
|
|
os.environ.get("DB_PASSWORD", ""), # live secret override takes highest priority
|
|
_cfg_get(cfg, "Inputs", "init_password.db_password"),
|
|
_cfg_get(cfg, "Global", "DB_PASSWORD"),
|
|
)
|
|
if not db_password:
|
|
raise SystemExit("Database password is required (init_password.db_password or DB_PASSWORD).")
|
|
|
|
gen_dir = _ensure_dir(Path(args.output_dir))
|
|
secrets_dir = _ensure_dir(gen_dir / "secrets")
|
|
|
|
jwt_secret = _first(os.environ.get("SUPABASE_JWT_SECRET", "")) or _load_or_create_secret(
|
|
secrets_dir / "jwt.secret", length=32
|
|
)
|
|
now = int(time.time())
|
|
exp = now + 10 * 365 * 24 * 3600
|
|
anon_payload = {"role": "anon", "iss": "knoe-supabase", "iat": now, "exp": exp}
|
|
service_payload = {"role": "service_role", "iss": "knoe-supabase", "iat": now, "exp": exp}
|
|
anon_key = _jwt(anon_payload, jwt_secret)
|
|
service_key = _jwt(service_payload, jwt_secret)
|
|
|
|
legacy_supabase_hostname_raw = _first(
|
|
_cfg_get(cfg, "User", "supabase_hostname"),
|
|
_cfg_get(cfg, "Global", "supabase_hostname"),
|
|
_cfg_get(cfg, "User", "SUPABASE_HOSTNAME"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_HOSTNAME"),
|
|
os.environ.get("SUPABASE_HOSTNAME", ""),
|
|
os.environ.get("SUPABASE_HOST", ""),
|
|
default="db.0.knoe.dev",
|
|
).strip()
|
|
|
|
if _is_placeholder(legacy_supabase_hostname_raw):
|
|
legacy_supabase_hostname_raw = ""
|
|
if not legacy_supabase_hostname_raw:
|
|
legacy_supabase_hostname_raw = "db.0.knoe.dev"
|
|
|
|
studio_hostname_raw = _first(
|
|
os.environ.get("SUPABASE_STUDIO_URL", ""),
|
|
_cfg_get(cfg, "Inputs", "init_cluster.supabase_studio_url"),
|
|
os.environ.get("SUPABASE_STUDIO_HOSTNAME", ""),
|
|
_cfg_get(cfg, "User", "SUPABASE_STUDIO_HOSTNAME"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_STUDIO_HOSTNAME"),
|
|
legacy_supabase_hostname_raw,
|
|
default="db.0.knoe.dev",
|
|
).strip()
|
|
if _is_placeholder(studio_hostname_raw):
|
|
studio_hostname_raw = ""
|
|
if not studio_hostname_raw:
|
|
studio_hostname_raw = legacy_supabase_hostname_raw
|
|
|
|
api_hostname_raw = _first(
|
|
os.environ.get("SUPABASE_API_URL", ""),
|
|
_cfg_get(cfg, "Inputs", "init_cluster.supabase_api_url"),
|
|
os.environ.get("SUPABASE_API_HOSTNAME", ""),
|
|
_cfg_get(cfg, "User", "SUPABASE_API_HOSTNAME"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_API_HOSTNAME"),
|
|
studio_hostname_raw,
|
|
default="api.knoe.dev",
|
|
).strip()
|
|
if _is_placeholder(api_hostname_raw):
|
|
api_hostname_raw = ""
|
|
if not api_hostname_raw:
|
|
api_hostname_raw = studio_hostname_raw
|
|
|
|
studio_enabled = _as_bool(
|
|
_first(
|
|
os.environ.get("SUPABASE_STUDIO_ENABLED", ""),
|
|
_cfg_get(cfg, "Inputs", "init_cluster.supabase_studio_enabled"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_STUDIO_ENABLED"),
|
|
default="true",
|
|
),
|
|
default=True,
|
|
)
|
|
auth_enabled = _as_bool(
|
|
_first(
|
|
os.environ.get("SUPABASE_AUTH_ENABLED", ""),
|
|
_cfg_get(cfg, "Inputs", "init_cluster.supabase_auth_enabled"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_AUTH_ENABLED"),
|
|
default="true",
|
|
),
|
|
default=True,
|
|
)
|
|
realtime_enabled = _as_bool(
|
|
_first(
|
|
os.environ.get("SUPABASE_REALTIME_ENABLED", ""),
|
|
_cfg_get(cfg, "Inputs", "init_cluster.supabase_realtime_enabled"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_REALTIME_ENABLED"),
|
|
default="true",
|
|
),
|
|
default=True,
|
|
)
|
|
meta_enabled = _as_bool(
|
|
_first(
|
|
os.environ.get("SUPABASE_META_ENABLED", ""),
|
|
_cfg_get(cfg, "Inputs", "init_cluster.supabase_meta_enabled"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_META_ENABLED"),
|
|
default="true",
|
|
),
|
|
default=True,
|
|
)
|
|
analytics_enabled = _as_bool(
|
|
_first(
|
|
os.environ.get("SUPABASE_ANALYTICS_ENABLED", ""),
|
|
_cfg_get(cfg, "Inputs", "init_cluster.supabase_analytics_enabled"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_ANALYTICS_ENABLED"),
|
|
default="true",
|
|
),
|
|
default=True,
|
|
)
|
|
|
|
studio_host_entries, studio_public_url = _normalize_public_hosts(
|
|
studio_hostname_raw,
|
|
fallback_host="db.0.knoe.dev",
|
|
)
|
|
api_host_entries, api_public_url = _normalize_public_hosts(
|
|
api_hostname_raw,
|
|
fallback_host=studio_host_entries[0],
|
|
)
|
|
|
|
mode = _first(
|
|
os.environ.get("PROLE_MODE", ""),
|
|
_cfg_get(cfg, "Global", "DEPLOYMENT_MODE"),
|
|
_cfg_get(cfg, "globals", "prole.mode"),
|
|
default="",
|
|
).strip().lower()
|
|
default_ingress_class = "gce" if mode == "k8s" else "traefik"
|
|
api_ingress_class = _first(
|
|
os.environ.get("SUPABASE_API_INGRESS_CLASS", ""),
|
|
os.environ.get("SUPABASE_INGRESS_CLASS", ""),
|
|
_cfg_get(cfg, "User", "SUPABASE_API_INGRESS_CLASS"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_API_INGRESS_CLASS"),
|
|
_cfg_get(cfg, "User", "SUPABASE_INGRESS_CLASS"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_INGRESS_CLASS"),
|
|
default=default_ingress_class,
|
|
).strip()
|
|
if not api_ingress_class or _is_placeholder(api_ingress_class):
|
|
api_ingress_class = default_ingress_class
|
|
studio_ingress_class = _first(
|
|
os.environ.get("SUPABASE_STUDIO_INGRESS_CLASS", ""),
|
|
_cfg_get(cfg, "User", "SUPABASE_STUDIO_INGRESS_CLASS"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_STUDIO_INGRESS_CLASS"),
|
|
api_ingress_class,
|
|
).strip()
|
|
if not studio_ingress_class or _is_placeholder(studio_ingress_class):
|
|
studio_ingress_class = api_ingress_class
|
|
|
|
# Additional origins/redirect URLs allowed by GoTrue (comma-separated hostnames or URLs).
|
|
# Needed when a service at a different hostname (e.g. svc.knoe.dev) uses Supabase auth.
|
|
_extra_redirect_raw = _first(
|
|
os.environ.get("SUPABASE_ADDITIONAL_REDIRECT_URLS", ""),
|
|
_cfg_get(cfg, "Global", "SUPABASE_ADDITIONAL_REDIRECT_URLS"),
|
|
_cfg_get(cfg, "Supabase", "ADDITIONAL_REDIRECT_URLS"),
|
|
default="",
|
|
).strip()
|
|
_allow_list_entries: list[str] = []
|
|
for _base_url in (studio_public_url, api_public_url):
|
|
if not _base_url:
|
|
continue
|
|
_candidate = _base_url.rstrip("/") + "/**"
|
|
if _candidate not in _allow_list_entries:
|
|
_allow_list_entries.append(_candidate)
|
|
for _entry in _extra_redirect_raw.split(","):
|
|
_entry = _entry.strip()
|
|
if not _entry or _is_placeholder(_entry):
|
|
continue
|
|
if "://" not in _entry:
|
|
_entry = f"https://{_entry}"
|
|
if not _entry.endswith("/**"):
|
|
_entry = _entry.rstrip("/") + "/**"
|
|
if _entry not in _allow_list_entries:
|
|
_allow_list_entries.append(_entry)
|
|
_gotrue_uri_allow_list = ",".join(_allow_list_entries)
|
|
|
|
# Placement: pin Supabase pods to the configured primary node (default: pi.knoe.dev)
|
|
supabase_primary_node = _first(
|
|
os.environ.get("SUPABASE_PRIMARY_NODE", ""),
|
|
os.environ.get("SUPABASE_NODE_SELECTOR", ""),
|
|
os.environ.get("SUPABASE_PV_NODE", ""),
|
|
_cfg_get(cfg, "Global", "SUPABASE_PRIMARY_NODE"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_NODE_SELECTOR"),
|
|
_cfg_get(cfg, "Global", "SUPABASE_PV_NODE"),
|
|
_cfg_get(cfg, "Supabase", "PRIMARY_NODE"),
|
|
default="gandalf.knoe.dev",
|
|
).strip()
|
|
if _is_placeholder(supabase_primary_node):
|
|
supabase_primary_node = ""
|
|
supabase_node_selector = (
|
|
{"kubernetes.io/hostname": supabase_primary_node} if supabase_primary_node else {}
|
|
)
|
|
supabase_storage_class = _first(
|
|
os.environ.get("SUPABASE_STORAGE_CLASS", ""),
|
|
_cfg_get(cfg, "Global", "SUPABASE_STORAGE_CLASS"),
|
|
_cfg_get(cfg, "Supabase", "STORAGE_CLASS"),
|
|
default="synology-iscsi",
|
|
).strip()
|
|
if _is_placeholder(supabase_storage_class):
|
|
supabase_storage_class = "merlin-local-iscsi-d002"
|
|
|
|
storage_backend = _first(
|
|
os.environ.get("SUPABASE_STORAGE_BACKEND", ""),
|
|
os.environ.get("STORAGE_BACKEND", ""),
|
|
_cfg_get(cfg, "Supabase", "STORAGE_BACKEND"),
|
|
_cfg_get(cfg, "Global", "STORAGE_BACKEND"),
|
|
default="s3",
|
|
).strip().lower()
|
|
if _is_placeholder(storage_backend):
|
|
storage_backend = ""
|
|
|
|
global_s3_endpoint = _first(
|
|
os.environ.get("SUPABASE_GLOBAL_S3_ENDPOINT", ""),
|
|
os.environ.get("GLOBAL_S3_ENDPOINT", ""),
|
|
_cfg_get(cfg, "Supabase", "GLOBAL_S3_ENDPOINT"),
|
|
_cfg_get(cfg, "Global", "GLOBAL_S3_ENDPOINT"),
|
|
default="http://garage.knoe-system.svc.cluster.local:3900",
|
|
).strip()
|
|
if _is_placeholder(global_s3_endpoint):
|
|
global_s3_endpoint = ""
|
|
|
|
garage_s3_key_id = _first(
|
|
os.environ.get("GARAGE_S3_KEY_ID", ""),
|
|
_cfg_get(cfg, "Supabase", "GARAGE_S3_KEY_ID"),
|
|
_cfg_get(cfg, "Global", "GARAGE_S3_KEY_ID"),
|
|
default="",
|
|
).strip()
|
|
garage_s3_access_key = _first(
|
|
os.environ.get("GARAGE_S3_ACCESS_KEY", ""),
|
|
_cfg_get(cfg, "Supabase", "GARAGE_S3_ACCESS_KEY"),
|
|
_cfg_get(cfg, "Global", "GARAGE_S3_ACCESS_KEY"),
|
|
default="",
|
|
).strip()
|
|
if _is_placeholder(garage_s3_key_id):
|
|
garage_s3_key_id = ""
|
|
if _is_placeholder(garage_s3_access_key):
|
|
garage_s3_access_key = ""
|
|
|
|
use_garage_s3 = storage_backend == "s3" and "garage" in global_s3_endpoint.lower()
|
|
if use_garage_s3 and (not garage_s3_key_id or not garage_s3_access_key):
|
|
raise SystemExit(
|
|
"Garage S3 credentials are required for Supabase storage. "
|
|
"Set GARAGE_S3_KEY_ID and GARAGE_S3_ACCESS_KEY in [Supabase] or [Global], "
|
|
"or via environment variables."
|
|
)
|
|
|
|
overlay: dict[str, Any] = {
|
|
"nameOverride": "supabase",
|
|
"fullnameOverride": "supabase",
|
|
"deployment": {
|
|
"db": {"enabled": False},
|
|
"functions": {"enabled": True, "fullnameOverride": "supabase-functions"},
|
|
"vector": {"enabled": True, "fullnameOverride": "supabase-vector"},
|
|
"kong": {"enabled": True, "fullnameOverride": "supabase-kong"},
|
|
"storage": {"enabled": True, "fullnameOverride": "supabase-storage"},
|
|
"minio": {"enabled": not use_garage_s3, "fullnameOverride": "supabase-minio"},
|
|
"imgproxy": {"enabled": True, "fullnameOverride": "supabase-imgproxy"},
|
|
# Explicit fullnameOverride per component strips the chart name
|
|
# from pod names (avoids 'supabase-knoe-supabase-<component>').
|
|
"analytics": {"enabled": analytics_enabled, "fullnameOverride": "supabase-analytics"},
|
|
"auth": {"enabled": auth_enabled, "fullnameOverride": "supabase-auth"},
|
|
"meta": {"enabled": meta_enabled, "fullnameOverride": "supabase-meta"},
|
|
"realtime": {"enabled": realtime_enabled, "fullnameOverride": "supabase-realtime"},
|
|
"rest": {"enabled": True, "fullnameOverride": "supabase-rest"},
|
|
"studio": {"enabled": studio_enabled, "fullnameOverride": "supabase-studio"},
|
|
},
|
|
"externalDatabase": {
|
|
"enabled": True,
|
|
"host": db_host,
|
|
"port": int(str(db_port)),
|
|
"database": db_name,
|
|
"ssl": "disable",
|
|
"createAliasService": True,
|
|
"aliasServiceName": "db",
|
|
},
|
|
"environment": {
|
|
"auth": {
|
|
"DB_HOST": db_host,
|
|
"DB_PORT": str(db_port),
|
|
"DB_SSL": "disable",
|
|
"API_EXTERNAL_URL": api_public_url,
|
|
"GOTRUE_SITE_URL": studio_public_url,
|
|
**( {"GOTRUE_URI_ALLOW_LIST": _gotrue_uri_allow_list} if _gotrue_uri_allow_list else {} ),
|
|
},
|
|
"analytics": {"DB_HOST": db_host, "DB_PORT": str(db_port)},
|
|
"meta": {"DB_HOST": db_host, "DB_PORT": str(db_port)},
|
|
"studio": {"SUPABASE_PUBLIC_URL": studio_public_url},
|
|
},
|
|
"secret": {
|
|
"db": {"password": db_password, "database": db_name},
|
|
"jwt": {"secret": jwt_secret, "anonKey": anon_key, "serviceKey": service_key},
|
|
"s3": {"keyId": garage_s3_key_id, "accessKey": garage_s3_access_key},
|
|
},
|
|
"ingress": {
|
|
"enabled": True,
|
|
"className": api_ingress_class,
|
|
"hosts": [{"host": host, "paths": [{"path": "/", "pathType": "Prefix"}]} for host in api_host_entries],
|
|
},
|
|
"studioIngress": {
|
|
"enabled": True,
|
|
"className": studio_ingress_class,
|
|
"hosts": [{"host": host, "paths": [{"path": "/", "pathType": "Prefix"}]} for host in studio_host_entries],
|
|
},
|
|
}
|
|
|
|
if supabase_storage_class:
|
|
# Validate: must be a synology/merlin mount — refuse pi/local SD card classes
|
|
if not any(supabase_storage_class.startswith(p) for p in
|
|
("synology", "merlin-local-iscsi", "myrddin-local-iscsi")):
|
|
raise SystemExit(
|
|
f"SUPABASE_STORAGE_CLASS '{supabase_storage_class}' is not a synology mount. "
|
|
"Supabase must run on iSCSI/NFS storage (merlin-local-iscsi-d002 or synology-iscsi). "
|
|
"Refusing deploy to prevent SD-card crash."
|
|
)
|
|
# Write to persistence.*.storageClassName — the path the Helm chart actually uses
|
|
persistence = overlay.setdefault("persistence", {})
|
|
for pvc_key in ("functions", "snippets", "deno", "imgproxy", "minio", "storage"):
|
|
persistence.setdefault(pvc_key, {})["storageClassName"] = supabase_storage_class
|
|
|
|
if mode == "k3s" and supabase_node_selector:
|
|
deployment = overlay.setdefault("deployment", {})
|
|
for component in (
|
|
"analytics",
|
|
"auth",
|
|
"functions",
|
|
"imgproxy",
|
|
"kong",
|
|
"meta",
|
|
"minio",
|
|
"realtime",
|
|
"rest",
|
|
"storage",
|
|
"studio",
|
|
"vector",
|
|
):
|
|
component_cfg = deployment.setdefault(component, {})
|
|
component_cfg.setdefault("nodeSelector", {})
|
|
component_cfg["nodeSelector"].update(supabase_node_selector)
|
|
|
|
meta = {
|
|
"supabase_namespace": supabase_ns,
|
|
"db_namespace": db_ns,
|
|
"db_host": db_host,
|
|
}
|
|
return overlay, meta
|
|
|
|
|
|
def render(args: argparse.Namespace) -> None:
|
|
cfg_path = Path(args.config)
|
|
if cfg_path.is_dir():
|
|
cfg_path = cfg_path / "prole.cfg"
|
|
if not cfg_path.exists():
|
|
raise SystemExit(f"Config not found: {cfg_path}")
|
|
|
|
cfg = _read_cfg(cfg_path)
|
|
overlay, meta = _build_overlay(cfg, args)
|
|
|
|
gen_dir = _ensure_dir(Path(args.output_dir))
|
|
values_path = gen_dir / "values.generated.json"
|
|
values_path.write_text(json.dumps(overlay, indent=2))
|
|
|
|
# Write Namespace manifest for Supabase
|
|
k8s_dir = _ensure_dir(Path(args.manifests_dir))
|
|
namespace_manifest = {
|
|
"apiVersion": "v1",
|
|
"kind": "Namespace",
|
|
"metadata": {"name": meta["supabase_namespace"]},
|
|
}
|
|
(k8s_dir / "namespace.yaml").write_text(json.dumps(namespace_manifest))
|
|
|
|
# Render chart to a single manifest file (Helm accepts JSON values)
|
|
rendered_path = k8s_dir / "supabase-helm.yaml"
|
|
cmd = [
|
|
"helm",
|
|
"template",
|
|
"supabase",
|
|
str(REPO_ROOT / "supabase" / "helm" / "knoe-supabase"),
|
|
"-n",
|
|
meta["supabase_namespace"],
|
|
"-f",
|
|
str(values_path),
|
|
]
|
|
proc = subprocess.run(cmd, capture_output=True, text=True)
|
|
if proc.returncode != 0:
|
|
sys.stderr.write(proc.stderr)
|
|
raise SystemExit(f"Helm template failed (code {proc.returncode})")
|
|
rendered_path.write_text(proc.stdout)
|
|
|
|
summary = {
|
|
"values": str(values_path),
|
|
"manifests": str(rendered_path),
|
|
"db_host": meta["db_host"],
|
|
"supabase_namespace": meta["supabase_namespace"],
|
|
}
|
|
(gen_dir / "manifest-summary.json").write_text(json.dumps(summary, indent=2))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
parser = argparse.ArgumentParser(description="Render Supabase Helm chart from prole.cfg")
|
|
parser.add_argument(
|
|
"--config",
|
|
"-c",
|
|
default=os.environ.get("PROLE_CONF", str(REPO_ROOT / "conf")),
|
|
help="Path to prole.cfg or its directory",
|
|
)
|
|
parser.add_argument(
|
|
"--output-dir",
|
|
default=str(REPO_ROOT / "supabase" / "helm" / "generated"),
|
|
help="Directory to write generated values and metadata",
|
|
)
|
|
parser.add_argument(
|
|
"--manifests-dir",
|
|
default=str(REPO_ROOT / "supabase" / "k8s"),
|
|
help="Directory to write rendered Kubernetes manifests",
|
|
)
|
|
args = parser.parse_args()
|
|
render(args)
|