feat(umami): Add umami (#3717)

* add test

* add question

* clean up

* fix

* add salt

* add end

* fix

* secrets

* test

* lint

* low

* test

* bump

* Update _secrets.tpl

* Let users fill in their own encryption salt

* Let users fill in their own encryption salt

* make some changes

* some typos

* some typos

* update questions

* rofs

* updatequestions

* see users

* 1001

* rofs

* update questions

Co-authored-by: Stavros kois <s.kois@outlook.com>

charts/incubator/umami/.helmignore

@@ -0,0 +1,30 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+# OWNERS file for Kubernetes
+OWNERS
+# helm-docs templates
+*.gotmpl
+# docs folder
+/docs
+# icon
+icon.png

charts/incubator/umami/Chart.yaml

@@ -0,0 +1,31 @@
+apiVersion: v2
+appVersion: "1.38.0"
+dependencies:
+  - name: common
+    repository: https://library-charts.truecharts.org
+    version: 10.5.6
+  - condition: postgresql.enabled
+    name: postgresql
+    repository: https://charts.truecharts.org/
+    version: 8.0.69
+description: Umami is a simple, fast, privacy-focused alternative to Google Analytics.
+home: https://truecharts.org/docs/charts/stable/umami
+icon: https://truecharts.org/img/hotlink-ok/chart-icons/umami.png
+keywords:
+  - umami
+  - google analytics
+kubeVersion: ">=1.16.0-0"
+maintainers:
+  - email: info@truecharts.org
+    name: TrueCharts
+    url: https://truecharts.org
+name: umami
+sources:
+  - https://github.com/truecharts/charts/tree/master/charts/incubator/umami
+  - https://github.com/umami-software/umami
+version: 0.0.1
+annotations:
+  truecharts.org/catagories: |
+    - website
+  truecharts.org/SCALE-support: "true"
+  truecharts.org/grade: U

charts/incubator/umami/questions.yaml

@@ -0,0 +1,183 @@
+# Include{groups}
+portals:
+  open:
+# Include{portalLink}
+questions:
+# Include{global}
+# Include{controller}
+# Include{controllerDeployment}
+# Include{replicas}
+# Include{replica1}
+# Include{strategy}
+# Include{recreate}
+# Include{controllerExpert}
+# Include{controllerExpertExtraArgs}
+  - variable: umami
+    group: Container Configuration
+    label: Umami Configuration
+    schema:
+      additional_attrs: true
+      type: dict
+      attrs:
+        - variable: force_ssl
+          label: Force SSL
+          description: This will redirect all requests from http to https in the Umami application. Note, this does not apply to the tracking script.
+          schema:
+            type: boolean
+            default: true
+        - variable: hostname
+          label: Hostname
+          description: Sets HOSTNAME environment variable
+          schema:
+            type: string
+            default: ""
+        - variable: client_ip_header
+          label: Client IP Header
+          description: HTTP header to check for the client's IP address. This is useful when you're behind a proxy that uses non-standard headers.
+          schema:
+            type: string
+            default: ""
+        - variable: remove_trailing_slash
+          label: Remove Trailing Slash
+          description: Removes the trailing slash from all incoming urls.
+          schema:
+            type: boolean
+            default: true
+        - variable: tracker_script_name
+          label: Tracker Script Name
+          description: Allows you to assign a custom name to the tracker script different from the default umami. This is to help you avoid some ad-blockers. (Requires update to tracking code on your website)
+          schema:
+            type: string
+            default: "umami"
+        - variable: collect_api_endpoint
+          label: Collect API Endpoint
+          description: Allows you to send metrics to a location different than the default. This is to help you avoid some ad-blockers.
+          schema:
+            type: string
+            default: "/api/collect"
+        - variable: disable_updates
+          label: Disable Updates
+          description: Disables the check for new versions of Umami.
+          schema:
+            type: boolean
+            default: true
+        - variable: disable_login
+          label: Disable Login
+          description: Disables the login page for the application.
+          schema:
+            type: boolean
+            default: false
+        - variable: disable_telemetry
+          label: Disable Telemetry
+          description: Umami collects completely anonymous telemetry data in order help improve the application. You can choose to disable this if you don't want to participate.
+          schema:
+            type: boolean
+            default: false
+        - variable: ignore_ip
+          label: Ignore IP
+          description: You can provide a list of IP address to exclude from data collection.
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: ipEntry
+                label: IP Entry
+                schema:
+                  type: string
+                  required: true
+                  default: ""
+# Include{containerConfig}
+# Include{serviceRoot}
+        - variable: main
+          label: Main Service
+          description: The Primary service on which the healthcheck runs, often the webUI
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+# Include{serviceSelectorSimple}
+# Include{serviceSelectorExtras}
+                    - variable: main
+                      label: Main Service Port Configuration
+                      schema:
+                        additional_attrs: true
+                        type: dict
+                        attrs:
+                          - variable: port
+                            label: Port
+                            description: This port exposes the container port on the service
+                            schema:
+                              type: int
+                              default: 10381
+                              required: true
+# Include{advancedPortHTTP}
+                                - variable: targetPort
+                                  label: Target Port
+                                  description: The internal(!) port on the container the Application runs on
+                                  schema:
+                                    type: int
+                                    default: 10381
+# Include{serviceExpertRoot}
+            default: false
+# Include{serviceExpert}
+# Include{serviceList}
+# Include{persistenceList}
+# Include{ingressRoot}
+        - variable: main
+          label: Main Ingress
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+# Include{ingressDefault}
+# Include{ingressTLS}
+# Include{ingressTraefik}
+# Include{ingressExpert}
+# Include{ingressList}
+# Include{security}
+# Include{securityContextAdvancedRoot}
+              - variable: privileged
+                label: Privileged mode
+                schema:
+                  type: boolean
+                  default: false
+              - variable: readOnlyRootFilesystem
+                label: ReadOnly Root Filesystem
+                schema:
+                  type: boolean
+                  default: false
+              - variable: allowPrivilegeEscalation
+                label: Allow Privilege Escalation
+                schema:
+                  type: boolean
+                  default: false
+              - variable: runAsNonRoot
+                label: runAsNonRoot
+                schema:
+                  type: boolean
+                  default: true
+# Include{securityContextAdvanced}
+# Include{podSecurityContextRoot}
+        - variable: runAsUser
+          label: runAsUser
+          description: The UserID of the user running the application
+          schema:
+            type: int
+            default: 1001
+        - variable: runAsGroup
+          label: runAsGroup
+          description: The groupID this App of the user running the application
+          schema:
+            type: int
+            default: 1001
+        - variable: fsGroup
+          label: fsGroup
+          description: The group that should own ALL storage.
+          schema:
+            type: int
+            default: 568
+# Include{podSecurityContextAdvanced}
+# Include{resources}
+# Include{advanced}
+# Include{addons}
+# Include{documentation}

charts/incubator/umami/templates/_secret.tpl

@@ -0,0 +1,23 @@
+{{/* Define the secret */}}
+{{- define "umami.secret" -}}
+
+{{- $secretName := printf "%s-secret" (include "tc.common.names.fullname" .) }}
+
+---
+
+{{/* This secrets are loaded on both main authentik container and worker */}}
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ $secretName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+data:
+  {{/* Secret Key */}}
+  {{- with (lookup "v1" "Secret" .Release.Namespace $secretName) }}
+  HASH_SALT: {{ index .data "HASH_SALT" }}
+  {{- else }}
+  HASH_SALT: {{ randAlphaNum 32 | b64enc }}
+  {{- end }}
+{{- end }}

charts/incubator/umami/templates/common.yaml

@@ -0,0 +1,8 @@
+{{/* Make sure all variables are set properly */}}
+{{- include "tc.common.loader.init" . }}
+
+{{/* Render secret */}}
+{{- include "umami.secret" . }}
+
+{{/* Render the templates */}}
+{{ include "tc.common.loader.apply" . }}

charts/incubator/umami/values.yaml

@@ -0,0 +1,63 @@
+image:
+  repository: tccr.io/truecharts/umami
+  tag: v1.38.0@sha256:67f016d7fc4af69b0a25f057dab533fef0aacf457b280516f652d8b5de54bc36
+  pullPolicy: IfNotPresent
+
+securityContext:
+  readOnlyRootFilesystem: false
+
+podSecurityContext:
+  runAsUser: 1001
+  runAsGroup: 1001
+
+envFrom:
+  - secretRef:
+      name: '{{ include "tc.common.names.fullname" . }}-secret'
+
+umami:
+  force_ssl: true
+  hostname: ""
+  client_ip_header: ""
+  remove_trailing_slash: true
+  tracker_script_name: umami
+  collect_api_endpoint: /api/collect
+  disable_updates: true
+  disable_login: false
+  disable_telemetry: true
+  ignore_ip:
+    - "1.1.1.1"
+    - "2.2.2.2"
+
+env:
+  PORT: "{{ .Values.service.main.ports.main.port }}"
+  DATABASE_TYPE: postgresql
+  DATABASE_URL:
+    secretKeyRef:
+      name: dbcreds
+      key: url
+  FORCE_SSL: '{{ ternary "1" "0" .Values.umami.force_ssl }}'
+  HOSTNAME: "{{ .Values.umami.hostname }}"
+  CLIENT_IP_HEADER: "{{ .Values.umami.client_ip_header }}"
+  REMOVE_TRAILING_SLASH: '{{ ternary "1" "0" .Values.umami.remove_trailing_slash }}'
+  TRACKER_SCRIPT_NAME: "{{ .Values.umami.tracker_script_name }}"
+  COLLECT_API_ENDPOINT: "{{ .Values.umami.collect_api_endpoint }}"
+  DISABLE_UPDATES: '{{ ternary "1" "0" .Values.umami.disable_updates }}'
+  DISABLE_LOGIN: '{{ ternary "1" "0" .Values.umami.disable_login }}'
+  DISABLE_TELEMETRY: '{{ ternary "1" "0" .Values.umami.disable_telemetry }}'
+  IGNORE_IP: '{{ join "," .Values.umami.ignore_ip }}'
+
+service:
+  main:
+    ports:
+      main:
+        port: 10381
+        protocol: HTTP
+
+postgresql:
+  enabled: true
+  existingSecret: "dbcreds"
+  postgresqlUsername: umami
+  postgresqlDatabase: umami
+
+portal:
+  enabled: true

cspell.config.yaml

@@ -203,6 +203,7 @@ words:
   - truecharts
   - truenas
   - truetool
+  - umami
   - unet
   - unifi
   - userspace