A lowly tech priest's attempt to please Mars
feat: add a PDS
+299
+15
kubernetes/apps/at/ks.yaml
+15
kubernetes/apps/at/ks.yaml
···
1
+
# yaml-language-server: $schema=https://github.com/fluxcd-community/flux2-schemas/raw/refs/heads/main/all.json
2
+
apiVersion: kustomize.toolkit.fluxcd.io/v1
3
+
kind: Kustomization
4
+
metadata:
5
+
name: apps-at-pds
6
+
namespace: flux-system
7
+
spec:
8
+
interval: 10m
9
+
path: ./kubernetes/apps/at/pds
10
+
targetNamespace: at
11
+
prune: true
12
+
sourceRef:
13
+
kind: GitRepository
14
+
name: flux-system
15
+
---
+5
kubernetes/apps/at/kustomization.yaml
+5
kubernetes/apps/at/kustomization.yaml
+4
kubernetes/apps/at/namespace.yaml
+4
kubernetes/apps/at/namespace.yaml
+242
kubernetes/apps/at/pds/helmrelease.yaml
+242
kubernetes/apps/at/pds/helmrelease.yaml
···
1
+
apiVersion: helm.toolkit.fluxcd.io/v2
2
+
kind: HelmRelease
3
+
metadata:
4
+
name: pds
5
+
spec:
6
+
interval: 30m
7
+
chartRef:
8
+
kind: OCIRepository
9
+
namespace: global-shared
10
+
name: app-template
11
+
12
+
install:
13
+
remediation:
14
+
retries: 3
15
+
upgrade:
16
+
cleanupOnFail: true
17
+
remediation:
18
+
strategy: rollback
19
+
retries: 3
20
+
21
+
values:
22
+
controllers:
23
+
pds:
24
+
annotations:
25
+
reloader.stakater.com/auto: "true"
26
+
containers:
27
+
app:
28
+
image:
29
+
repository: ghcr.io/bluesky-social/pds
30
+
tag: 0.4.188@sha256:87881525ec7a5cd2411a71b81a70ee2af9b5d79d770f9d1d1b84f74f91da4a9f
31
+
env:
32
+
TZ: ${TIMEZONE}
33
+
LOG_ENABLED: true
34
+
35
+
# service
36
+
PDS_HOSTNAME: "pds.${ATPROTO_HOST}"
37
+
PDS_PORT: '3000'
38
+
# PDS_SERVICE_DID: ''
39
+
# PDS_SERVICE_NAME: ''
40
+
# PDS_VERSION: ''
41
+
# PDS_HOME_URL: ''
42
+
# PDS_LOGO_URL: ''
43
+
# PDS_PRIVACY_POLICY_URL: ''
44
+
# PDS_SUPPORT_URL: ''
45
+
# PDS_TERMS_OF_SERVICE_URL: ''
46
+
# PDS_CONTACT_EMAIL_ADDRESS: ''
47
+
# PDS_ACCEPTING_REPO_IMPORTS: ''
48
+
# PDS_MAX_REPO_IMPORT_SIZE: ''
49
+
PDS_BLOB_UPLOAD_LIMIT: 104857600
50
+
# PDS_DEV_MODE: ''
51
+
52
+
# hCaptcha
53
+
# PDS_HCAPTCHA_SITE_KEY: ''
54
+
# PDS_HCAPTCHA_SECRET_KEY: ''
55
+
# PDS_HCAPTCHA_TOKEN_SALT: ''
56
+
57
+
# OAuth
58
+
# PDS_OAUTH_TRUSTED_CLIENTS: ''
59
+
60
+
# branding
61
+
# PDS_LIGHT_COLOR: ''
62
+
# PDS_DARK_COLOR: ''
63
+
# PDS_PRIMARY_COLOR: ''
64
+
# PDS_PRIMARY_COLOR_CONTRAST: ''
65
+
# PDS_PRIMARY_COLOR_HUE: ''
66
+
# PDS_ERROR_COLOR: ''
67
+
# PDS_ERROR_COLOR_CONTRAST: ''
68
+
# PDS_ERROR_COLOR_HUE: ''
69
+
# PDS_WARNING_COLOR: ''
70
+
# PDS_WARNING_COLOR_CONTRAST: ''
71
+
# PDS_WARNING_COLOR_HUE: ''
72
+
# PDS_SUCCESS_COLOR: ''
73
+
# PDS_SUCCESS_COLOR_CONTRAST: ''
74
+
# PDS_SUCCESS_COLOR_HUE: ''
75
+
76
+
# database
77
+
PDS_DATA_DIRECTORY: /pds
78
+
# PDS_SQLITE_DISABLE_WAL_AUTO_CHECKPOINT: ''
79
+
# PDS_ACCOUNT_DB_LOCATION: ''
80
+
# PDS_SEQUENCER_DB_LOCATION: ''
81
+
# PDS_DID_CACHE_DB_LOCATION: ''
82
+
83
+
# actor store
84
+
# PDS_ACTOR_STORE_DIRECTORY: ''
85
+
# PDS_ACTOR_STORE_CACHE_SIZE: ''
86
+
87
+
# blobstore: one required
88
+
# s3
89
+
# PDS_BLOBSTORE_S3_BUCKET: ''
90
+
# PDS_BLOBSTORE_S3_REGION: ''
91
+
# PDS_BLOBSTORE_S3_ENDPOINT: ''
92
+
# PDS_BLOBSTORE_S3_FORCE_PATH_STYLE: ''
93
+
# PDS_BLOBSTORE_S3_ACCESS_KEY_ID: ''
94
+
# PDS_BLOBSTORE_S3_SECRET_ACCESS_KEY: ''
95
+
# PDS_BLOBSTORE_S3_UPLOAD_TIMEOUT_MS: ''
96
+
# disk
97
+
PDS_BLOBSTORE_DISK_LOCATION: /blobstore
98
+
# PDS_BLOBSTORE_DISK_TMP_LOCATION: ''
99
+
100
+
# identity
101
+
PDS_DID_PLC_URL: https://plc.directory
102
+
# PDS_DID_CACHE_STALE_TTL: ''
103
+
# PDS_DID_CACHE_MAX_TTL: ''
104
+
# PDS_ID_RESOLVER_TIMEOUT: ''
105
+
# PDS_RECOVERY_DID_KEY: ''
106
+
# PDS_SERVICE_HANDLE_DOMAINS: ''
107
+
# PDS_HANDLE_BACKUP_NAMESERVERS: ''
108
+
# PDS_ENABLE_DID_DOC_WITH_SESSION: ''
109
+
110
+
# entryway
111
+
# PDS_ENTRYWAY_URL: ''
112
+
# PDS_ENTRYWAY_DID: ''
113
+
# PDS_ENTRYWAY_JWT_VERIFY_KEY_K256_PUBLIC_KEY_HEX: ''
114
+
# PDS_ENTRYWAY_PLC_ROTATION_KEY: ''
115
+
116
+
# invites
117
+
# PDS_INVITE_REQUIRED: ''
118
+
# PDS_INVITE_INTERVAL: ''
119
+
# PDS_INVITE_EPOCH: ''
120
+
121
+
# email
122
+
# PDS_EMAIL_SMTP_URL: ''
123
+
# PDS_EMAIL_FROM_ADDRESS: ''
124
+
# PDS_MODERATION_EMAIL_SMTP_URL: ''
125
+
# PDS_MODERATION_EMAIL_ADDRESS: ''
126
+
127
+
# subscription
128
+
# PDS_MAX_SUBSCRIPTION_BUFFER: ''
129
+
# PDS_REPO_BACKFILL_LIMIT_MS: ''
130
+
131
+
# appview
132
+
PDS_BSKY_APP_VIEW_URL: https://api.bsky.app
133
+
PDS_BSKY_APP_VIEW_DID: did:web:api.bsky.app
134
+
# PDS_BSKY_APP_VIEW_CDN_URL_PATTERN: ''
135
+
136
+
# mod service
137
+
# PDS_MOD_SERVICE_URL: ''
138
+
# PDS_MOD_SERVICE_DID: ''
139
+
140
+
# report service
141
+
PDS_REPORT_SERVICE_URL: https://mod.bsky.app
142
+
PDS_REPORT_SERVICE_DID: did:plc:ar7c4by46qjdydhdevvrndac
143
+
144
+
# rate limits
145
+
# PDS_RATE_LIMITS_ENABLED: ''
146
+
# PDS_RATE_LIMIT_BYPASS_KEY: ''
147
+
# PDS_RATE_LIMIT_BYPASS_IPS: ''
148
+
149
+
# redis
150
+
# PDS_REDIS_SCRATCH_ADDRESS: ''
151
+
# PDS_REDIS_SCRATCH_PASSWORD: ''
152
+
153
+
# crawlers
154
+
PDS_CRAWLERS: https://bsky.network
155
+
156
+
# secrets
157
+
# PDS_DPOP_SECRET: set via secret
158
+
# PDS_JWT_SECRET: set via secret
159
+
# PDS_ADMIN_PASSWORD: set via secret
160
+
# PDS_ENTRYWAY_ADMIN_TOKEN: ''
161
+
162
+
# kms
163
+
# PDS_PLC_ROTATION_KEY_KMS_KEY_ID: ''
164
+
# memory
165
+
# PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: set via secret
166
+
167
+
# user provided url http requests
168
+
# PDS_DISABLE_SSRF_PROTECTION: ''
169
+
170
+
# fetch
171
+
# PDS_FETCH_MAX_RESPONSE_SIZE: ''
172
+
173
+
# proxy
174
+
# PDS_PROXY_ALLOW_HTTP2: ''
175
+
# PDS_PROXY_HEADERS_TIMEOUT: ''
176
+
# PDS_PROXY_BODY_TIMEOUT: ''
177
+
# PDS_PROXY_MAX_RESPONSE_SIZE: ''
178
+
# PDS_PROXY_MAX_RETRIES: ''
179
+
# PDS_PROXY_PREFER_COMPRESSED: ''
180
+
envFrom:
181
+
- secretRef:
182
+
name: pds-secrets
183
+
probes:
184
+
liveness: &probe
185
+
enabled: true
186
+
path: /xrpc/_health
187
+
readiness: *probe
188
+
startup: *probe
189
+
securityContext:
190
+
allowPrivilegeEscalation: false
191
+
capabilities: { drop: ["ALL"] }
192
+
resources:
193
+
requests:
194
+
cpu: 10m
195
+
limits:
196
+
memory: 512Mi
197
+
198
+
defaultPodOptions:
199
+
securityContext:
200
+
runAsNonRoot: true
201
+
runAsUser: 10001
202
+
runAsGroup: 10001
203
+
fsGroup: 10001
204
+
fsGroupChangePolicy: OnRootMismatch
205
+
seccompProfile: { type: RuntimeDefault }
206
+
207
+
service:
208
+
pds:
209
+
primary: true
210
+
controller: pds
211
+
ports:
212
+
http:
213
+
primary: true
214
+
port: &port 3000
215
+
protocol: HTTP
216
+
217
+
route:
218
+
pds:
219
+
annotations:
220
+
route.proteus/redirect-http: 'true'
221
+
parentRefs:
222
+
- name: ingress-gateway
223
+
namespace: ingress
224
+
sectionName: atproto-https
225
+
hostnames:
226
+
- "pds.${ATPROTO_HOST}"
227
+
rules:
228
+
- backendRefs:
229
+
- identifier: pds
230
+
port: *port
231
+
232
+
persistence:
233
+
pds:
234
+
type: persistentVolumeClaim
235
+
accessMode: ReadWriteOncePod
236
+
size: 2Gi
237
+
blobstore:
238
+
type: persistentVolumeClaim
239
+
accessMode: ReadWriteOncePod
240
+
size: 10Gi
241
+
tmp:
242
+
type: emptyDir
+33
kubernetes/apps/at/pds/secrets.yaml
+33
kubernetes/apps/at/pds/secrets.yaml
···
1
+
apiVersion: v1
2
+
kind: Secret
3
+
metadata:
4
+
name: pds-secrets
5
+
stringData:
6
+
PDS_DPOP_SECRET: ENC[AES256_GCM,data:g5E5hwsDU/3/kF1NMa7PlhK35Qxu1JQ9zvKPWWbFL/lLxuAs2BUi+FASNmU5C7sxSu7MM4j8/iZROZGbjppRjA==,iv:MZ0BQZk/wafkBy/cXn+kVLLWcHzikhz3QbyEhOXxaK4=,tag:MZPmVpcjTh8aRiOXIEOKgA==,type:str]
7
+
PDS_JWT_SECRET: ENC[AES256_GCM,data:fP4HMcaHNGjCndEDkBvC90lNRP1VD1AZ+3N5pLxMHng=,iv:VPljOatCXsy5EE5XzlTzQHMr5woQfxwH+buLz9BLF9E=,tag:wq608dHdf82jEye0L5E1xw==,type:str]
8
+
PDS_ADMIN_PASSWORD: ENC[AES256_GCM,data:pP4KqRXe+aWjOfGhXtALXssQJXwMsqRaSQy6e1MxBLs=,iv:LeQ8jgMLjA9Crav1DBs0sD4UKSfCwimN5LbiUw1LnDo=,tag:6nTY43Y/iVW/QQh7tCcT9Q==,type:str]
9
+
PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: ENC[AES256_GCM,data:7tYJX2JInpw1ddtiC4WDs5472p1Rn5U630NM8aJ/UUXoqvUKbWp8JwTl8Sce8wOiE2ZQZjOXNYW4BNNW8Za/yA==,iv:jhjfs5rrNhObn7kf70gEh+m70bKX5kHUp6ZZdgRw+Jo=,tag:BScxQo9DQ4eUmoShCLY2SQ==,type:str]
10
+
sops:
11
+
age:
12
+
- recipient: age13u6nqs8jgp268mya8rht9gyhu86cc53j74f5va65077rsrvkr9gsjeqk88
13
+
enc: |
14
+
-----BEGIN AGE ENCRYPTED FILE-----
15
+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzUDU4RUYvZ0JHUG5HeVlE
16
+
cmZ5YUhMQ0k1TFhSUDVaTXcvR0R1VHNXOFY0Ck1WbG9yRlU3U1RjUCtmYUs1NGFh
17
+
Q3VqUkJqS21HdDRLM1VZcit2MjlTeFEKLS0tIGNaQW5xR1ppSnJvRWppMzZ4RXYz
18
+
Ynl4NTJzdE5yY296bktWNHh2K2pCZ00K9SSFhatky5xXldG3/fZqUUoT98MT3juP
19
+
/pLi389UP9+sphwhEQpIwqh8ZHeXY1GgaTzHd2b5v7cnydGCPsWV/A==
20
+
-----END AGE ENCRYPTED FILE-----
21
+
- recipient: age16tv9zf54wf4txwjx39wz9phw7zggtxe7k0p2lkhtx59u4he72erq4d9xh9
22
+
enc: |
23
+
-----BEGIN AGE ENCRYPTED FILE-----
24
+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBdG1CeXU0V0N6eWZtRlQw
25
+
TkxPVHIzL0c5cjFJcTFkZ1NENEdQMkhtYW5NClVzMHZZNjhaWFAwQXFRSDRxYW1X
26
+
RWZ1T3dySFBjem1DU1ZQVkxmeXFhbW8KLS0tIE9UalNMSFkwZksyZnBqa21iZElH
27
+
T0NvQ0p3SHlNZm5ETmo1VitzRWhobWsKDL26hIDYVlyUhMUZ/T4zASdLSZp6ZOTs
28
+
57TRvz73ueG4h9EKq3zIrQBmofE33tBUa8edL4k5Udg2IAE/7phTSw==
29
+
-----END AGE ENCRYPTED FILE-----
30
+
lastmodified: "2025-11-09T21:37:51Z"
31
+
mac: ENC[AES256_GCM,data:wi59VE4/+aWJEJXyJnCZPJrnMd9Uk0wssZE9QkYULqhQ/YBhPVecm+IMVh8G5mQhqoXmPZm32gmnSR1jbxpJYzlhXN5PyJS0GPcv2HODUiZ3uUMg8ooIsmH4VcLmjaFdwwddR1tlfszrYzg65mDHZ0XEDz3AxJ32bZh6d2wq1Bo=,iv:zZWnhZAjDfllfrRqV7W5C2FhcvThfIBVoOimIRrStTE=,tag:UhBvYBSnls4WBVK5Vfo2Fw==,type:str]
32
+
encrypted_regex: ^(data|stringData)$
33
+
version: 3.11.0