try plausible CE for web analytics

plausible/resources/configmap.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: plausible-config
+  namespace: tools
+# Doc: https://github.com/plausible/community-edition/wiki/Configuration
+data:
+  DB_HOST: pgbouncer.tools
+  DB_PORT: !!str 5432
+  DB_NAME: plausible
+
+  BASE_URL: https://analytics.arcodange.duckdns.org
+
+  CLICKHOUSE_DATABASE_URL: http://plausible:plausiblearcodange@plausible.tools:8123/plausible

plausible/resources/geoipsecret.yaml

@@ -0,0 +1,24 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: plausible-geoip
+  namespace: tools
+spec:
+  type: kv-v2
+
+  # mount path
+  mount: kvv2
+
+  # path of the secret
+  path: plausible/geoip
+
+  # dest k8s secret
+  destination:
+    name: plausible-geoip
+    create: true
+
+  # static secret refresh interval
+  refreshAfter: 30s
+
+  # Name of the CRD to authenticate to Vault
+  vaultAuthRef: plausible

plausible/resources/vaultauth.yaml

@@ -0,0 +1,14 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: plausible
+  namespace: tools
+spec:
+  vaultConnectionRef: default
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: plausible
+    serviceAccount: plausible
+    audiences:
+      - vault

plausible/resources/vaultdynamicsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultDynamicSecret
+metadata:
+  name: plausible-db-credentials
+  namespace: tools
+spec:
+
+  # Mount path of the secrets backend
+  mount: postgres
+
+  # Path to the secret
+  path: creds/plausible
+
+  # Where to store the secrets, VSO will create the secret
+  destination:
+    create: true
+    name: plausible-db-credentials
+
+  # Restart these pods when secrets rotated
+  rolloutRestartTargets:
+  - kind: Deployment
+    name: plausible
+
+  # Name of the CRD to authenticate to Vault
+  vaultAuthRef: plausible

plausible/resources/vaultsecret.yaml

@@ -0,0 +1,24 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: plausible
+  namespace: tools
+spec:
+  type: kv-v2
+
+  # mount path
+  mount: kvv2
+
+  # path of the secret
+  path: plausible/config
+
+  # dest k8s secret
+  destination:
+    name: plausible-config
+    create: true
+
+  # static secret refresh interval
+  refreshAfter: 30s
+
+  # Name of the CRD to authenticate to Vault
+  vaultAuthRef: plausible