8 files changed, 147 insertions, 0 deletions
diff --git a/kubernetes/namespaces/default/modmail/README.md b/kubernetes/namespaces/default/modmail/README.md
new file mode 100644
index 0000000..92ac16b
--- /dev/null
+++ b/kubernetes/namespaces/default/modmail/README.md
@@ -0,0 +1,19 @@
+# Modmail
+
+This folder contains the manifests for our Modmail service.
+
+## Secrets
+
+The services require one shared secret called `modmail` containing the following:
+
+| Key                     | Value                            | Description                                                  |
+| ------------------------| ---------------------------------|--------------------------------------------------------------|
+| `CONNECTION_URI`        | MongoDB connection URI           | Used for storing data                                        |
+| `DATABASE_TYPE`         | `mongodb`                        | The type of database to use, only supports mongodb right now |
+| `DATA_COLLECTION`       | `False`                          | Disable bot metadata collection by modmail devs              |
+| `DISABLE_AUTOUPDATES`   | `yes`                            | Auto-updates breaks in production                            |
+| `GUILD_ID`              | Snowflake of Discord guild       | Guild to respond to commands in                              |
+| `LOG_URL`               | URL of the web portal            | Used for generating links on the bot                         |
+| `OWNERS`                | Comma separated list of user IDs | Used for granting high permissions on the bot                |
+| `REGISTRY_PLUGINS_ONLY` | `false`                          | Allows the usage of plugins outside of the official registry |
+| `TOKEN`                 | Discord Token                    | Used to connect to Discord                                   |
diff --git a/kubernetes/namespaces/default/modmail/bot/README.md b/kubernetes/namespaces/default/modmail/bot/README.md
new file mode 100644
index 0000000..ac29ac2
--- /dev/null
+++ b/kubernetes/namespaces/default/modmail/bot/README.md
@@ -0,0 +1,7 @@
+# Modmail bot
+These manifests will provision the resources for an instance of our Modmail bot.
+
+To deploy this bot simply run:
+```
+kubectl apply -f deployment.yaml
+```
diff --git a/kubernetes/namespaces/default/modmail/bot/deployment.yaml b/kubernetes/namespaces/default/modmail/bot/deployment.yaml
new file mode 100644
index 0000000..e640fdc
--- /dev/null
+++ b/kubernetes/namespaces/default/modmail/bot/deployment.yaml
@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: modmail-bot
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: modmail-bot
+  template:
+    metadata:
+      labels:
+        app: modmail-bot
+    spec:
+      containers:
+        - name: modmail-bot
+          image: ghcr.io/python-discord/modmail:latest
+          resources:
+            requests:
+              cpu: 75m
+              memory: 500Mi
+            limits:
+              cpu: 125m
+              memory: 750Mi
+          imagePullPolicy: "Always"
+          volumeMounts:
+          - mountPath: /modmailbot/plugins
+            name: plugins-vol
+          - mountPath: /modmailbot/temp
+            name: temp-vol
+          env:
+          - name: TMPDIR
+            value: /modmailbot/temp
+          envFrom:
+            - secretRef:
+                name: modmail
+          securityContext:
+            readOnlyRootFilesystem: true
+      volumes:
+      - name: plugins-vol
+        emptyDir: {}
+      - name: temp-vol
+        emptyDir:
+          medium: Memory
+      securityContext:
+        fsGroup: 2000
+        runAsUser: 1000
+        runAsNonRoot: true
diff --git a/kubernetes/namespaces/default/modmail/secrets.yaml b/kubernetes/namespaces/default/modmail/secrets.yaml
new file mode 100644
index 0000000..f2d5d5d
--- /dev/null
+++ b/kubernetes/namespaces/default/modmail/secrets.yaml
diff --git a/kubernetes/namespaces/default/modmail/web/README.md b/kubernetes/namespaces/default/modmail/web/README.md
new file mode 100644
index 0000000..7b7e19e
--- /dev/null
+++ b/kubernetes/namespaces/default/modmail/web/README.md
@@ -0,0 +1,2 @@
+# Modmail web
+These manifests provision an instance of the web logviewer for our Modmail system.
diff --git a/kubernetes/namespaces/default/modmail/web/deployment.yaml b/kubernetes/namespaces/default/modmail/web/deployment.yaml
new file mode 100644
index 0000000..1070e22
--- /dev/null
+++ b/kubernetes/namespaces/default/modmail/web/deployment.yaml
@@ -0,0 +1,36 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: modmail-web
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: modmail-web
+  template:
+    metadata:
+      labels:
+        app: modmail-web
+    spec:
+      containers:
+        - name: modmail-web
+          image: ghcr.io/python-discord/logviewer:latest
+          imagePullPolicy: Always
+          resources:
+            requests:
+              cpu: 50m
+              memory: 100Mi
+            limits:
+              cpu: 100m
+              memory: 150Mi
+          ports:
+            - containerPort: 8000
+          envFrom:
+            - secretRef:
+                name: modmail
+          securityContext:
+            readOnlyRootFilesystem: true
+      securityContext:
+        fsGroup: 2000
+        runAsUser: 1000
+        runAsNonRoot: true
diff --git a/kubernetes/namespaces/default/modmail/web/ingress.yaml b/kubernetes/namespaces/default/modmail/web/ingress.yaml
new file mode 100644
index 0000000..a5990cf
--- /dev/null
+++ b/kubernetes/namespaces/default/modmail/web/ingress.yaml
@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
+    nginx.ingress.kubernetes.io/auth-tls-secret: "kube-system/mtls-client-crt-bundle"
+    nginx.ingress.kubernetes.io/auth-tls-error-page: "https://www.youtube.com/watch?v=dQw4w9WgXcQ"
+  name: modmail-web
+spec:
+  tls:
+  - hosts:
+      - "*.pythondiscord.com"
+    secretName: pythondiscord.com-tls
+  rules:
+  - host: modmail.pythondiscord.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: modmail-web
+            port:
+              number: 80
diff --git a/kubernetes/namespaces/default/modmail/web/service.yaml b/kubernetes/namespaces/default/modmail/web/service.yaml
new file mode 100644
index 0000000..384e638
--- /dev/null
+++ b/kubernetes/namespaces/default/modmail/web/service.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: modmail-web
+spec:
+  selector:
+    app: modmail-web
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 8000