From a0b34750eed2257cd11b28e419a5f577c133b51f Mon Sep 17 00:00:00 2001 From: Viktor Barzin Date: Fri, 5 Jun 2026 20:11:31 +0000 Subject: [PATCH] storage: migrate hackmd uploads off proxmox-lvm-encrypted to NFS (LUN-cap relief) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit codimd is MySQL-backed; this PVC holds only pasted image uploads (subPath hackmd, 4.5M) — no embedded DB, NFS-safe. Drops LUKS-at-rest for these low-sensitivity images (accepted). Frees one proxmox-csi SCSI-LUN slot on node6. - swap hackmd-data-encrypted -> nfs_volume module (subPath preserved) - uploads copied + verified (20 files, HTTP 200, codimd listening) - block PVC removed; LV retained per SC policy (code-dfjn cleanup) Co-Authored-By: Claude Opus 4.8 --- stacks/hackmd/main.tf | 40 ++++++++++++---------------------------- 1 file changed, 12 insertions(+), 28 deletions(-) diff --git a/stacks/hackmd/main.tf b/stacks/hackmd/main.tf index 96b36801..3dd913b7 100644 --- a/stacks/hackmd/main.tf +++ b/stacks/hackmd/main.tf @@ -25,33 +25,17 @@ module "tls_secret" { tls_secret_name = var.tls_secret_name } -resource "kubernetes_persistent_volume_claim" "data_encrypted" { - wait_until_bound = false - metadata { - name = "hackmd-data-encrypted" - namespace = kubernetes_namespace.hackmd.metadata[0].name - annotations = { - "resize.topolvm.io/threshold" = "10%" - "resize.topolvm.io/increase" = "100%" - "resize.topolvm.io/storage_limit" = "5Gi" - } - } - spec { - access_modes = ["ReadWriteOnce"] - storage_class_name = "proxmox-lvm-encrypted" - resources { - requests = { - storage = "1Gi" - } - } - } - lifecycle { - # The autoresizer expands requests.storage up to storage_limit and - # PVCs can't shrink. Without this, every TF apply tries to revert - # to the spec value, K8s rejects the shrink, and the PVC ends up - # in Terminating-but-in-use limbo. - ignore_changes = [spec[0].resources[0].requests] - } +# Image uploads on NFS. Migrated off proxmox-lvm-encrypted 2026-06-05 for +# LUN-cap relief — codimd is MySQL-backed; this PVC holds only pasted image +# uploads (low-sensitivity), so dropping LUKS-at-rest for NFS is accepted. +# No embedded DB. See docs/plans/2026-06-05-block-storage-harden-nfs-design.md +module "nfs_hackmd" { + source = "../../modules/kubernetes/nfs_volume" + name = "hackmd-uploads-nfs" + namespace = kubernetes_namespace.hackmd.metadata[0].name + nfs_server = var.nfs_server + nfs_path = "/srv/nfs/hackmd" + storage = "5Gi" } resource "kubernetes_deployment" "hackmd" { @@ -166,7 +150,7 @@ resource "kubernetes_deployment" "hackmd" { volume { name = "data" persistent_volume_claim { - claim_name = kubernetes_persistent_volume_claim.data_encrypted.metadata[0].name + claim_name = module.nfs_hackmd.claim_name } } }