feat(scrypted): initial chart config (#1)

- updated workflow to release package on merge
- initial deployment suport for host network and node affinity
- initial support for persistent volumes
- values support for all required container env values
- readme's updated with basic instructions

.github/workflows/helm-charts.yaml

@@ -1,36 +1,32 @@
-# This is a basic workflow to help you get started with Actions
+name: Release Helm Charts
 
-name: CI
-
-# Controls when the workflow will run
 on:
-  # Triggers the workflow on push or pull request events but only for the "main" branch
   push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-
-  # Allows you to run this workflow manually from the Actions tab
-  workflow_dispatch:
+    branches:
+      - main
 
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
-  # This workflow contains a single job called "build"
-  build:
-    # The type of runner that the job will run on
+  release:
+    # depending on default permission settings for your org (contents being read-only or read-write for workloads), you will have to add permissions
+    # see: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
-
-    # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
 
-      # Runs a single command using the runners shell
-      - name: Run a one-line script
-        run: echo Hello, world!
-
-      # Runs a set of commands using the runners shell
-      - name: Run a multi-line script
+      - name: Configure Git
         run: |
-          echo Add other actions to build,
-          echo test, and deploy your project.
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "[email protected]"
+
+      - name: Install Helm
+        uses: azure/setup-helm@v3
+
+      - name: Run chart-releaser
+        uses: helm/[email protected]
+        env:
+          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

.gitignore

@@ -32,3 +32,5 @@ override.tf.json
 # Ignore CLI configuration files
 .terraformrc
 terraform.rc
+
+.vscode/*

CONTRIBUTING.md

@@ -0,0 +1 @@
+# How to contribute

README.md

@@ -1,2 +1,13 @@
-# homelab-helm-charts
-collection of helm charts
+# Homelab Helm Charts
+
+Collection of Helm Charts I support for my homelab.
+
+## [Scrypted](./charts/scrypted)
+
+[Scrypted](https://scrypted.app) can bridge most cameras to the three major home hubs: HomeKit (including HomeKit Secure Video), Google Home, and Alexa. Scrypted streams are fast, low latency, and have rock solid reliability.
+
+```bash
+helm repo add scrypted https://charts.chriskirby.net/scrypted
+# deploy to your cluster
+helm upgrade --install cameras scrypted
+```

charts/README.md

@@ -0,0 +1,3 @@
+# Charts
+
+* [Scrypted](./scrypted/README.md)

charts/scrypted/Chart.yaml

@@ -0,0 +1,12 @@
+apiVersion: v2
+name: "scrypted"
+description: "A Helm chart for deploying Scrypted (scrypted.app) on Kubernetes"
+home: "https://github.com/sirkirby/helm-charts"
+type: application
+version: "1.0.0"
+appVersion: "latest"
+icon: "https://www.scrypted.app/images/web_hi_res_512.png"
+maintainers:
+  - name: "sirkirby"
+    email: "[email protected]"
+    url: "https://chriskirby.net"

charts/scrypted/README.md

@@ -0,0 +1,48 @@
+# Scrypted Helm Chart
+
+## Example usage
+
+```bash
+helm upgrade --install my-cameras scrypted -f myvalues.yaml
+```
+
+```yaml
+# myvalues.yaml
+image:
+  repository: koush/scrypted
+  tag: latest
+  pullPolicy: Always
+
+env:
+  securePort: 9443
+  insecurePort: 11080
+  timezone: "America/Detroit"
+
+service:
+  type: ClusterIP
+  port: 11080
+  securePort: 9443
+
+hostNetwork: true
+
+nodeAffinity:
+  requiredDuringSchedulingIgnoredDuringExecution:
+    nodeSelectorTerms:
+    - matchExpressions:
+      - key: smarthome
+        operator: In
+        values:
+        - scrypted
+
+ingress:
+  enabled: true
+  hosts:
+    - host: scrypted.mylocaldomain.org
+      paths: ["/"]
+
+persistence:
+  enabled: true
+  storageClass: "longhorn"
+  accessMode: ReadWriteMany
+  size: 1Gi
+```

charts/scrypted/templates/_helpers.tpl

@@ -0,0 +1,42 @@
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "scrypted.fullname" -}}
+{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+The name of the chart
+*/}}
+{{- define "scrypted.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "scrypted.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "scrypted.labels" -}}
+helm.sh/chart: {{ include "scrypted.chart" . }}
+{{ include "scrypted.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "scrypted.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "scrypted.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}

charts/scrypted/templates/deployment.yaml

@@ -0,0 +1,60 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "scrypted.fullname" . }}
+  labels:
+    {{- include "scrypted.labels" . | nindent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "scrypted.selectorLabels" . | nindent 6 }}
+      {{- if .Values.podLabels }}
+        {{- toYaml .Values.podLabels | nindent 6 }}
+      {{- end }}
+  template:
+    metadata:
+      labels:
+        {{- include "scrypted.selectorLabels" . | nindent 8 }}
+        {{- if .Values.podLabels }}
+          {{- toYaml .Values.podLabels | nindent 8 }}
+        {{- end }}
+    spec:
+      affinity:
+        {{- if .Values.nodeAffinity }}
+          {{- toYaml .Values.nodeAffinity | nindent 8 }}
+        {{- end }}
+      hostNetwork: {{ .Values.hostNetwork }}
+      containers:
+      - name: {{ .Chart.Name }}
+        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        env:
+        - name: SCRYPTED_SECURE_PORT
+          value: "{{ .Values.env.securePort }}"
+        - name: SCRYPTED_INSECURE_PORT
+          value: "{{ .Values.env.insecurePort }}"
+        - name: TZ
+          value: "{{ .Values.env.timezone }}"
+        ports:
+        - containerPort: {{ .Values.env.insecurePort }}
+          protocol: TCP
+          name: insecure
+        - containerPort: {{ .Values.env.securePort }}
+          protocol: TCP
+          name: secure
+        volumeMounts:
+        - name: scrypted-persistent-storage
+          mountPath: /server/volume
+        {{- if .Values.readinessProbe.enabled }}
+        readinessProbe:
+          httpGet:
+            path: /
+            port: {{ .Values.env.insecurePort }}
+            scheme: HTTP
+          initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds}}
+        {{- end }}
+      volumes:
+      - name: scrypted-persistent-storage
+        persistentVolumeClaim:
+          claimName: {{ include "scrypted.fullname" . }}-pvc

charts/scrypted/templates/ingress.yaml

@@ -0,0 +1,26 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "scrypted.fullname" . }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  rules:
+  {{- range .Values.ingress.hosts }}
+    - host: {{ .host }}
+      http:
+        paths:
+        {{- range .paths }}
+          - path: {{ . }}
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: {{ include "scrypted.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+        {{- end }}
+  {{- end }}
+{{- end }}

charts/scrypted/templates/pvc.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.persistence.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "scrypted.fullname" . }}-pvc
+spec:
+  storageClassName: {{ .Values.persistence.storageClass }}
+  accessModes:
+    - {{ .Values.persistence.accessMode }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size }}
+{{- end }}

charts/scrypted/templates/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "scrypted.fullname" . }}
+  labels:
+    {{- include "scrypted.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: {{ .Values.service.port }}
+      name: http
+  selector:
+    {{- include "scrypted.selectorLabels" . | nindent 4 }}

charts/scrypted/values.yaml

@@ -0,0 +1,65 @@
+image:
+  repository: koush/scrypted
+  tag: latest
+  pullPolicy: Always
+
+env:
+  securePort: 9443
+  insecurePort: 11080
+  timezone: "America/Detroit"
+
+service:
+  type: ClusterIP
+  port: 11080
+  securePort: 9443
+
+podAnnotations: {}
+podLabels: {}
+
+# if using host network (recommended), combine with nodeAffinity below
+hostNetwork: true
+# supply a node selector to run on a specific node
+# nodeAffinity:
+#   requiredDuringSchedulingIgnoredDuringExecution:
+#     nodeSelectorTerms:
+#     # looks for a node with the label smarthome=scrypted
+#     - matchExpressions:
+#       - key: smarthome
+#         operator: In
+#         values:
+#         - scrypted
+
+ingress:
+  enabled: true
+  annotations:
+    # nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    # nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+    # nginx.ingress.kubernetes.io/server-snippets: |
+    #   location / {
+    #     proxy_set_header Upgrade $http_upgrade;
+    #     proxy_http_version 1.1;
+    #     proxy_set_header X-Forwarded-Host $http_host;
+    #     proxy_set_header X-Forwarded-Proto $scheme;
+    #     proxy_set_header X-Forwarded-For $remote_addr;
+    #     proxy_set_header Host $host;
+    #     proxy_set_header Connection "upgrade";
+    #     proxy_set_header X-Real-IP $remote_addr;
+    #     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    #     proxy_set_header   Upgrade $http_upgrade;
+    #     proxy_cache_bypass $http_upgrade;
+    #   }
+  # supply a host name to use for the ingress
+  hosts:
+    - host: scrypted.local
+      paths: ["/"]
+
+# recommended to use a persistent volume provider like NFS or Longhorn
+persistence:
+  enabled: false
+#  storageClass: "longhorn"
+#  accessMode: ReadWriteMany
+#  size: 1Gi
+
+readinessProbe:
+  enabled: false
+  initialDelaySeconds: 5