feat: add Listmonk newsletter platform on Legion k3s

- Namespace, ExternalSecrets (Vault), DB init job, deployment, service, PVC, ingress - Routes newsletter.harmonic-framework.com via existing Cloudflare tunnel - Uses shared platform postgres with dedicated listmonk DB/user - Credentials stored at secret/data/listmonk in Vault
2026-04-04 18:43:44 -05:00
parent eefaeafcfc
commit bf40bd7f15
7 changed files with 301 additions and 0 deletions
@@ -0,0 +1,121 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: listmonk
+  namespace: listmonk
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: listmonk
+  template:
+    metadata:
+      labels:
+        app: listmonk
+    spec:
+      initContainers:
+        # Run `--install` on first boot to create the schema; no-op on subsequent starts
+        - name: listmonk-install
+          image: listmonk/listmonk:v4.1.0
+          args: ["--install", "--yes", "--idempotent"]
+          env:
+            - name: LISTMONK_db__host
+              value: "postgres-postgresql.platform.svc.cluster.local"
+            - name: LISTMONK_db__port
+              value: "5432"
+            - name: LISTMONK_db__name
+              valueFrom:
+                secretKeyRef:
+                  name: listmonk-secrets
+                  key: db_name
+            - name: LISTMONK_db__user
+              valueFrom:
+                secretKeyRef:
+                  name: listmonk-secrets
+                  key: db_user
+            - name: LISTMONK_db__password
+              valueFrom:
+                secretKeyRef:
+                  name: listmonk-secrets
+                  key: db_password
+            - name: LISTMONK_db__ssl_mode
+              value: "disable"
+            - name: LISTMONK_app__admin_username
+              value: "admin"
+            - name: LISTMONK_app__admin_password
+              valueFrom:
+                secretKeyRef:
+                  name: listmonk-secrets
+                  key: admin_password
+      containers:
+        - name: listmonk
+          image: listmonk/listmonk:v4.1.0
+          ports:
+            - containerPort: 9000
+          env:
+            - name: LISTMONK_db__host
+              value: "postgres-postgresql.platform.svc.cluster.local"
+            - name: LISTMONK_db__port
+              value: "5432"
+            - name: LISTMONK_db__name
+              valueFrom:
+                secretKeyRef:
+                  name: listmonk-secrets
+                  key: db_name
+            - name: LISTMONK_db__user
+              valueFrom:
+                secretKeyRef:
+                  name: listmonk-secrets
+                  key: db_user
+            - name: LISTMONK_db__password
+              valueFrom:
+                secretKeyRef:
+                  name: listmonk-secrets
+                  key: db_password
+            - name: LISTMONK_db__ssl_mode
+              value: "disable"
+            - name: LISTMONK_app__admin_username
+              value: "admin"
+            - name: LISTMONK_app__admin_password
+              valueFrom:
+                secretKeyRef:
+                  name: listmonk-secrets
+                  key: admin_password
+            - name: LISTMONK_app__secret_key
+              valueFrom:
+                secretKeyRef:
+                  name: listmonk-secrets
+                  key: app_key
+          volumeMounts:
+            - name: uploads
+              mountPath: /listmonk/uploads
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9000
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+      volumes:
+        - name: uploads
+          persistentVolumeClaim:
+            claimName: listmonk-uploads
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: listmonk
+  namespace: listmonk
+spec:
+  selector:
+    app: listmonk
+  ports:
+    - port: 9000
+      targetPort: 9000