tweak resource requests/limits, fix drone persistence

kustomize/bases/drone/drone-runner-deployment.yaml

@@ -38,11 +38,11 @@ spec:
               containerPort: 3000
           resources:
             requests:
-              cpu: 1000m
-              memory: 1Gi
+              cpu: 250m
+              memory: 250Mi
             limits:
-              cpu: 2000m
-              memory: 2Gi
+              cpu: 500m
+              memory: 500Mi
 ---
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1

kustomize/bases/drone/drone-server-deployment.yaml

@@ -6,6 +6,9 @@ metadata:
     app.kubernetes.io/name: drone
     app.kubernetes.io/component: server
 spec:
+  replicas: 1
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app.kubernetes.io/name: drone
@@ -43,16 +46,39 @@ spec:
                 secretKeyRef:
                   name: drone-secret
                   key: rpc_secret
+            - name: DRONE_DATABASE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: drone-secret
+                  key: database_secret
           ports:
             - name: http
               containerPort: 80
           resources:
             requests:
-              cpu: 500m
+              cpu: 250m
               memory: 250Mi
             limits:
               cpu: 500m
               memory: 500Mi
+          volumeMounts:
+            - mountPath: /data
+              name: drone-server-pv
+      volumes:
+        - name: drone-server-pv
+          persistentVolumeClaim:
+            claimName: drone-server-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: drone-server-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
 ---
 apiVersion: v1
 kind: Service

kustomize/bases/drone/kustomization.yaml

@@ -8,6 +8,7 @@ secretGenerator:
     type: Opaque
     literals:
       - rpc_secret=changeme
+      - database_secret=changeme
   - name: drone-gitea-oauth-secret
     type: Opaque
     literals:

kustomize/bases/nextcloud/nextcloud-deployment.yaml

@@ -66,11 +66,11 @@ spec:
               containerPort: 80
           resources:
             requests:
-              cpu: 750m
-              memory: 1Gi
+              cpu: 1500m
+              memory: 1.5Gi
             limits:
-              cpu: 1000m
-              memory: 1Gi
+              cpu: 2000m
+              memory: 2Gi
           volumeMounts:
             - name: nextcloud-pv
               mountPath: /var/www/html

kustomize/bases/traefik/traefik-helmchartconfig.yaml

@@ -6,6 +6,7 @@ spec:
   valuesContent: |-
     additionalArguments:
       - '--entryPoints.web.forwardedHeaders.insecure'
+      - '--entryPoints.websecure.forwardedHeaders.insecure'
       - '--serversTransport.insecureSkipVerify=true'
       - '--metrics.prometheus=true'
     ports:

kustomize/overlays/prod/kustomization.yaml

@@ -31,6 +31,7 @@ secretGenerator:
     behavior: replace
     literals:
       - rpc_secret=${ssm:/k3s/prod/drone/gitea/rpc_secret}
+      - database_secret=${ssm:/k3s/prod/drone/gitea/database_secret}
   # https://docs.drone.io/server/provider/gitea/
   - name: drone-gitea-oauth-secret
     type: Opaque