Initial release: self-hosted client photo gallery

Rust (axum + sqlx) API and worker sharing a Postgres-backed job queue (SKIP LOCKED, heartbeat, reaper, typed statuses), S3 storage with derived keys and a fully private bucket, OIDC photographer login with per-request allowlist checks, client share links with argon2 passwords and lockout, cookie-based image authorization with sliding expiry, hand-rolled spec-compliant streaming ZIP downloads with exact Content-Length, React + Vite gallery frontend, single Docker image, Helm chart for external S3 + Postgres, and Gitea CI. Co-Authored-By: Claude <noreply@anthropic.com>
2026-07-17 13:12:42 +02:00
commit 16d2a56a78
55 changed files with 11962 additions and 0 deletions
@@ -0,0 +1,68 @@
+image:
+  repository: ghcr.io/CHANGE-ME/photos
+  tag: latest
+  pullPolicy: IfNotPresent
+
+api:
+  replicas: 1
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      memory: 1Gi
+
+worker:
+  replicas: 1
+  concurrency: 2
+  resources:
+    requests:
+      cpu: 200m
+      memory: 256Mi
+    limits:
+      memory: 2Gi
+
+# External base URL of the app; the OIDC redirect URI is <publicUrl>/api/auth/callback
+publicUrl: https://photos.example.com
+
+config:
+  s3:
+    # Leave endpoint empty for AWS S3; set for MinIO/Ceph/etc.
+    endpoint: ""
+    region: us-east-1
+    bucket: photos
+    forcePathStyle: false
+  oidcIssuer: https://auth.example.com
+  # Comma-separated photographer emails allowed to sign in
+  allowedEmails: you@example.com
+  logLevel: info,sqlx=warn
+
+# Sensitive settings. Either reference an existing Secret containing the keys
+# DATABASE_URL, S3_ACCESS_KEY, S3_SECRET_KEY, OIDC_CLIENT_ID,
+# OIDC_CLIENT_SECRET, SESSION_SECRET — or inline the values and the chart
+# creates the Secret for you.
+secrets:
+  existingSecret: ""
+  databaseUrl: ""
+  s3AccessKey: ""
+  s3SecretKey: ""
+  oidcClientId: ""
+  oidcClientSecret: ""
+  sessionSecret: ""
+
+service:
+  port: 80
+
+ingress:
+  enabled: true
+  className: traefik
+  host: photos.example.com
+  # Traefik needs nothing extra: no default body-size limit, streams uploads.
+  # For ingress-nginx set className: nginx and uncomment (multi-GB raw
+  # uploads hit nginx's 1MiB default limit otherwise):
+  #   nginx.ingress.kubernetes.io/proxy-body-size: "0"
+  #   nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
+  annotations: {}
+  tls:
+    enabled: true
+    secretName: photos-tls