update

2026-01-14 12:37:31 +08:00
commit 01d1a49a59
22 changed files with 1037 additions and 0 deletions
--- a/pocketbase/.helmignore
+++ b/pocketbase/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
--- a/pocketbase/Chart.yaml
+++ b/pocketbase/Chart.yaml
@@ -0,0 +1,16 @@
+apiVersion: v2
+name: pocketbase
+description: PocketBase Helm Chart - Deploy multiple PocketBase instances with Traefik ingress
+type: application
+version: 0.1.0
+appVersion: "0.35.1"
+home: https://pocketbase.io/
+icon: https://pocketbase.io/images/logo.png
+keywords:
+  - pocketbase
+  - backend
+  - database
+  - traefik
+maintainers:
+  - name: datapod
+    email: admin@xiongxiao.me
--- a/pocketbase/README.md
+++ b/pocketbase/README.md
@@ -0,0 +1,71 @@
+# PocketBase Helm Chart
+
+部署多个 PocketBase 实例，支持 Traefik ingress。
+
+## 前置条件
+
+- Kubernetes 1.19+
+- Helm 3.2.0+
+- Traefik ingress 控制器
+- StorageClass（用于持久化存储）
+
+## 安装
+
+```bash
+helm install my-pocketbase ./pocketbase -f values.yaml
+```
+
+## 配置
+
+### instances
+
+部署的 PocketBase 实例列表：
+
+```yaml
+instances:
+  - id: "app1"
+    domain: "app1.pb.xiongxiao.me"
+    replicaCount: 1
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+      limits:
+        cpu: 500m
+        memory: 512Mi
+  - id: "app2"
+    domain: "app2.pb.xiongxiao.me"
+    replicaCount: 1
+```
+
+### persistence
+
+持久化配置：
+
+```yaml
+persistence:
+  enabled: true
+  storageClass: "local-path"
+  size: 5Gi
+  accessMode: ReadWriteOnce
+```
+
+## 升级
+
+```bash
+helm upgrade my-pocketbase ./pocketbase -f values.yaml
+```
+
+## 卸载
+
+```bash
+helm uninstall my-pocketbase
+```
+
+这将删除所有 PocketBase 实例及其 PVC。
+
+## 技术说明
+
+- **数据库**: 使用 SQLite 本地存储，数据保存在 `/pb/pb_data` 目录
+- **持久化**: 通过 PVC 实现数据持久化
+- **入口**: 使用 Traefik IngressRoute 配置路由
--- a/pocketbase/templates/NOTES.txt
+++ b/pocketbase/templates/NOTES.txt
@@ -0,0 +1,25 @@
+PocketBase Helm Chart
+
+{{- if not .Values.instances }}
+WARNING: No instances configured! Add instances to your values.yaml file.
+
+Example:
+instances:
+  - id: "app1"
+    domain: "app1.pb.xiongxiao.me"
+    replicaCount: 1
+{{- else }}
+{{- range .Values.instances }}
+PocketBase instance "{{ .id }}" has been deployed!
+
+Access it at: https://{{ .domain }}
+
+Admin UI: https://{{ .domain }}/_/
+  - Email: Check the secret: pocketbase-{{ .id }}-secrets
+  - Password: Check the secret: pocketbase-{{ .id }}-secrets
+
+To get the admin password:
+  kubectl get secret pocketbase-{{ .id }}-secrets -o jsonpath='{.data.admin-password}' | base64 -d
+
+{{- end }}
+{{- end }}
--- a/pocketbase/templates/_helpers.tpl
+++ b/pocketbase/templates/_helpers.tpl
@@ -0,0 +1,49 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "pocketbase.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+*/}}
+{{- define "pocketbase.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "pocketbase.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "pocketbase.labels" -}}
+helm.sh/chart: {{ include "pocketbase.chart" . }}
+{{ include "pocketbase.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "pocketbase.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "pocketbase.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
--- a/pocketbase/templates/configmap.yaml
+++ b/pocketbase/templates/configmap.yaml
@@ -0,0 +1,24 @@
+{{- /*
+  Generate config for each PocketBase instance
+*/ -}}
+{{- range .Values.instances }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pocketbase-{{ .id }}-config
+  labels:
+    app: pocketbase
+    instance: {{ .id }}
+    {{- include "pocketbase.labels" $ | nindent 4 }}
+data:
+  PB_DATA: /pb/pb_data
+  PB_STATIC: /pb/static
+  # SMTP Configuration (optional)
+  {{- if .smtp }}
+  PB_EMAIL_SMTP_HOST: {{ .smtp.host | quote }}
+  PB_EMAIL_SMTP_PORT: {{ .smtp.port | quote }}
+  PB_EMAIL_SMTP_USERNAME: {{ .smtp.username | quote }}
+  PB_EMAIL_SMTP_PASSWORD: {{ .smtp.password | quote }}
+  {{- end }}
+{{- end }}
--- a/pocketbase/templates/deployment.yaml
+++ b/pocketbase/templates/deployment.yaml
@@ -0,0 +1,185 @@
+{{- /*
+  Generate deployments for each PocketBase instance
+*/ -}}
+{{- $global := .Values.global }}
+{{- $image := .Values.image }}
+{{- $persistence := .Values.persistence }}
+{{- $securityContext := .Values.securityContext }}
+{{- $podSecurityContext := .Values.podSecurityContext }}
+{{- $resources := .Values.resources }}
+{{- range .Values.instances }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pocketbase-{{ .id }}
+  labels:
+    app: pocketbase
+    instance: {{ .id }}
+    {{- include "pocketbase.labels" $ | nindent 4 }}
+spec:
+  replicas: {{ .replicaCount | default 1 }}
+  selector:
+    matchLabels:
+      app: pocketbase
+      instance: {{ .id }}
+  template:
+    metadata:
+      labels:
+        app: pocketbase
+        instance: {{ .id }}
+        {{- include "pocketbase.labels" $ | nindent 8 }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") $ | sha256sum }}
+    spec:
+      {{- $instanceId := .id }}
+      {{- with $.Values.serviceAccount }}
+      {{- $serviceAccountName := $.Values.serviceAccount.name }}
+      {{- if not $serviceAccountName }}
+      {{- $serviceAccountName = printf "pocketbase-%s" $instanceId }}
+      {{- end }}
+      serviceAccountName: {{ $serviceAccountName }}
+      {{- end }}
+      {{- with $global.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml $podSecurityContext | nindent 8 }}
+      containers:
+        - name: pocketbase
+          image: {{ $image.repository }}:{{ $image.tag }}
+          imagePullPolicy: {{ $image.pullPolicy }}
+          command:
+            - /pocketbase
+            - serve
+            - --http=0.0.0.0:8090
+          ports:
+            - name: http
+              containerPort: 8090
+              protocol: TCP
+          env:
+            # Admin email (optional - set via admin creation API)
+            - name: PB_ADMIN_EMAIL
+              value: "admin@{{ .domain }}"
+            - name: PB_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: pocketbase-{{ .id }}-secrets
+                  key: admin-password
+          {{- if $persistence.enabled }}
+          volumeMounts:
+            - name: data
+              mountPath: /pb/pb_data
+            - name: static
+              mountPath: /pb/static
+          {{- end }}
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+          {{- if .resources }}
+          resources:
+            {{- toYaml .resources | nindent 12 }}
+          {{- else }}
+          resources:
+            {{- toYaml $resources | nindent 12 }}
+          {{- end }}
+          securityContext:
+            {{- toYaml $securityContext | nindent 12 }}
+      {{- if $persistence.enabled }}
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: pocketbase-{{ .id }}-pvc
+        - name: static
+          persistentVolumeClaim:
+            claimName: pocketbase-{{ .id }}-static-pvc
+      {{- end }}
+      {{- with $.Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $.Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $.Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $.Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+---
+{{- /*
+  Create Secret for each instance
+*/ -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: pocketbase-{{ .id }}-secrets
+  labels:
+    app: pocketbase
+    instance: {{ .id }}
+    {{- include "pocketbase.labels" $ | nindent 4 }}
+type: Opaque
+stringData:
+  admin-password: {{ randAlphaNum 16 | quote }}
+---
+{{- /*
+  Create PVC for each instance
+*/ -}}
+{{- if $persistence.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pocketbase-{{ .id }}-pvc
+  labels:
+    app: pocketbase
+    instance: {{ .id }}
+    type: data
+    {{- include "pocketbase.labels" $ | nindent 4 }}
+spec:
+  accessModes:
+    - {{ $persistence.accessMode | default "ReadWriteOnce" }}
+  resources:
+    requests:
+      storage: {{ $persistence.size | default "1Gi" }}
+  {{- if $persistence.storageClass }}
+  storageClassName: {{ $persistence.storageClass }}
+  {{- end }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pocketbase-{{ .id }}-static-pvc
+  labels:
+    app: pocketbase
+    instance: {{ .id }}
+    type: static
+    {{- include "pocketbase.labels" $ | nindent 4 }}
+spec:
+  accessModes:
+    - {{ $persistence.accessMode | default "ReadWriteOnce" }}
+  resources:
+    requests:
+      storage: 100Mi
+  {{- if $persistence.storageClass }}
+  storageClassName: {{ $persistence.storageClass }}
+  {{- end }}
+{{- end }}
+{{- end }}
--- a/pocketbase/templates/hpa.yaml
+++ b/pocketbase/templates/hpa.yaml
@@ -0,0 +1,40 @@
+{{- /*
+  Generate HPA for each PocketBase instance
+*/ -}}
+{{- if .Values.autoscaling.enabled }}
+{{- range .Values.instances }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: pocketbase-{{ .id }}
+  labels:
+    app: pocketbase
+    instance: {{ .id }}
+    {{- include "pocketbase.labels" $ | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: pocketbase-{{ .id }}
+  minReplicas: {{ .replicaCount | default 1 }}
+  maxReplicas: {{ $.Values.autoscaling.maxReplicas }}
+  metrics:
+    {{- if $.Values.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ $.Values.autoscaling.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if $.Values.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: {{ $.Values.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- end }}
+{{- end }}
+{{- end }}
--- a/pocketbase/templates/httproute.yaml
+++ b/pocketbase/templates/httproute.yaml
@@ -0,0 +1,29 @@
+{{- /*
+  HTTPRoute for Gateway API (alternative to IngressRoute)
+  Unused when Traefik IngressRoute is enabled
+*/ -}}
+{{- /*
+{{- range .Values.instances }}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: pocketbase-{{ .id }}
+  labels:
+    app: pocketbase
+    instance: {{ .id }}
+    {{- include "pocketbase.labels" $ | nindent 4 }}
+spec:
+  parentRefs:
+    - name: {{ $.Values.httpRoute.gatewayName | default "traefik-gateway" }}
+  hostnames:
+    - {{ .domain }}
+  rules:
+    - matches:
+        - path:
+            value: /
+      backendRefs:
+        - name: pocketbase-{{ .id }}
+          port: 80
+{{- end }}
+*/ -}}
--- a/pocketbase/templates/ingress.yaml
+++ b/pocketbase/templates/ingress.yaml
@@ -0,0 +1,54 @@
+{{- /*
+  Generate IngressRoute for Traefik for each PocketBase instance
+*/ -}}
+{{- $ingress := .Values.ingress }}
+{{- range .Values.instances }}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: pocketbase-{{ .id }}
+  labels:
+    app: pocketbase
+    instance: {{ .id }}
+    {{- include "pocketbase.labels" $ | nindent 4 }}
+  {{- with $ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  entryPoints:
+    - web
+    - websecure
+  routes:
+    - match: Host(`{{ .domain }}`)
+      kind: Rule
+      services:
+        - name: pocketbase-{{ .id }}
+          port: 80
+      middlewares:
+        - name: pocketbase-{{ .id }}-headers
+          namespace: default
+---
+{{- /*
+  Middleware for security headers
+*/ -}}
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: pocketbase-{{ .id }}-headers
+  labels:
+    app: pocketbase
+    instance: {{ .id }}
+    {{- include "pocketbase.labels" $ | nindent 4 }}
+spec:
+  headers:
+    stsSeconds: 31536000
+    stsIncludeSubdomains: true
+    stsPreload: true
+    forceSTSHeader: true
+    contentTypeNosniff: true
+    browserXssFilter: true
+    referrerPolicy: "strict-origin-when-cross-origin"
+    customFrameOptionsValue: "SAMEORIGIN"
+{{- end }}
--- a/pocketbase/templates/service.yaml
+++ b/pocketbase/templates/service.yaml
@@ -0,0 +1,27 @@
+{{- /*
+  Generate services for each PocketBase instance
+*/ -}}
+{{- $root := . }}
+{{- range .Values.instances }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pocketbase-{{ .id }}
+  labels:
+    app: pocketbase
+    instance: {{ .id }}
+    {{- include "pocketbase.labels" $root | nindent 4 }}
+  annotations:
+    {{- toYaml $root.Values.ingress.annotations | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    app: pocketbase
+    instance: {{ .id }}
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP
+{{- end }}
--- a/pocketbase/templates/serviceaccount.yaml
+++ b/pocketbase/templates/serviceaccount.yaml
@@ -0,0 +1,23 @@
+{{- /*
+  Generate ServiceAccount for each PocketBase instance
+*/ -}}
+{{- if .Values.serviceAccount.create }}
+{{- range .Values.instances }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: pocketbase-{{ .id }}
+  labels:
+    app: pocketbase
+    instance: {{ .id }}
+    {{- include "pocketbase.labels" $ | nindent 4 }}
+  {{- with $.Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- if $.Values.serviceAccount.automount }}
+automountServiceAccountToken: {{ $.Values.serviceAccount.automount }}
+  {{- end }}
+{{- end }}
+{{- end }}
--- a/pocketbase/templates/tests/test-connection.yaml
+++ b/pocketbase/templates/tests/test-connection.yaml
@@ -0,0 +1,24 @@
+{{- /*
+  Test connection to PocketBase instances
+  Run with: helm test <release-name>
+*/ -}}
+{{- range .Values.instances }}
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ $.Release.Name }}-test-connection-{{ .id }}"
+  labels:
+    app: pocketbase
+    instance: {{ .id }}
+    {{- include "pocketbase.labels" $ | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: wget
+      image: busybox
+      command: ['wget']
+      args: ['-q', '--spider', 'http://pocketbase-{{ .id }}/api/health']
+  restartPolicy: Never
+{{- end }}
--- a/pocketbase/values-production.yaml
+++ b/pocketbase/values-production.yaml
@@ -0,0 +1,82 @@
+# Production values.yaml example
+# Copy this file and modify as needed
+
+global:
+  domainSuffix: "pb.xiongxiao.me"
+
+image:
+  repository: pocketbase/pocketbase
+  tag: "0.22.21"
+  pullPolicy: IfNotPresent
+
+# List of PocketBase instances
+instances:
+  - id: "app1"
+    domain: "app1.pb.xiongxiao.me"
+    replicaCount: 2
+    resources:
+      requests:
+        cpu: 200m
+        memory: 512Mi
+      limits:
+        cpu: 1000m
+        memory: 1Gi
+  - id: "app2"
+    domain: "app2.pb.xiongxiao.me"
+    replicaCount: 1
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+      limits:
+        cpu: 500m
+        memory: 512Mi
+  - id: "test"
+    domain: "test.pb.xiongxiao.me"
+    replicaCount: 1
+
+# Resource settings for instances without explicit resources
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi
+
+# Persistence
+persistence:
+  enabled: true
+  storageClass: "local-path"
+  size: 5Gi
+  accessMode: ReadWriteOnce
+
+# PostgreSQL
+postgresql:
+  enabled: false
+  host: "postgresql.postgres.svc.cluster.local"
+  port: 5432
+  database: "pocketbase"
+  username: "postgres"
+  passwordSecret:
+    name: "postgresql-credentials"
+    key: "password"
+
+# Traefik Ingress
+ingress:
+  className: "traefik"
+  enabled: true
+  annotations: {}
+
+# Security
+podSecurityContext:
+  runAsUser: 1000
+  runAsGroup: 1000
+  fsGroup: 1000
+
+securityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: false
+  capabilities:
+    drop:
+      - ALL
--- a/pocketbase/values.yaml
+++ b/pocketbase/values.yaml
@@ -0,0 +1,101 @@
+# Default configuration for PocketBase instances
+# Customize this file or override with your own values.yaml
+
+# Global settings
+global:
+  imageRegistry: ""
+  imagePullSecrets: []
+  storageClass: ""
+  domainSuffix: "pb.xiongxiao.me"
+
+# Image configuration
+image:
+  repository: pocketbase/pocketbase
+  tag: "0.35.1"
+  pullPolicy: IfNotPresent
+
+# Service account configuration
+serviceAccount:
+  create: true
+  name: ""
+  annotations: {}
+
+# List of PocketBase instances to deploy
+# instances: []
+# Example:
+# - id: "app1"
+#   domain: "app1.pb.xiongxiao.me"
+#   replicaCount: 1
+#   resources:
+#     requests:
+#       cpu: 100m
+#       memory: 256Mi
+#     limits:
+#       cpu: 500m
+#       memory: 512Mi
+# - id: "app2"
+#   domain: "app2.pb.xiongxiao.me"
+#   replicaCount: 1
+instances:
+  - id: "app1"
+    domain: "app1.pb.xiongxiao.me"
+    replicaCount: 1
+  - id: "app2"
+    domain: "app2.pb.xiongxiao.me"
+    replicaCount: 1
+
+# Default resource settings (applied to all instances unless overridden)
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi
+
+# Persistence configuration (SQLite data storage)
+persistence:
+  enabled: false
+  storageClass: ""
+  size: 1Gi
+  accessMode: ReadWriteOnce
+
+# Traefik IngressRoute configuration
+ingress:
+  className: "traefik"
+  enabled: true
+  annotations: {}
+
+# Pod security context
+podSecurityContext:
+  runAsUser: 1000
+  runAsGroup: 1000
+  fsGroup: 1000
+
+# Container security context
+securityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: false
+  capabilities:
+    drop:
+      - ALL
+
+# Node selector
+nodeSelector: {}
+
+# Tolerations
+tolerations: []
+
+# Affinity
+affinity: {}
+
+# Topology spread constraints
+topologySpreadConstraints: []
+
+# Autoscaling configuration
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 10
+  targetCPUUtilizationPercentage: 80
+  targetMemoryUtilizationPercentage: 80