Self hosting Firefox's syncserver-rs

RUST_LOG=trace
SYNC_HUMAN_LOGS="1"
SYNC_SYNCSTORAGE__DATABASE_URL=mysql://$(DB_USERNAME):$(DB_PASSWORD)@$(DB_HOST):3306/$(DB_NAME)
SYNC_SYNCSTORAGE__RUN_MIGRATIONS="true"
SYNC_HOST=0.0.0.0
SYNC_MASTER_SECRET=$(sync_key)
SYNC_SYNCSTORAGE__MASTER_SECRET=$(sync_key)
SYNC_TOKENSERVER__ENABLED="true"
SYNC_TOKENSERVER__RUN_MIGRATIONS="true"
SYNC_TOKENSERVER__NODE_TYPE=mysql
SYNC_TOKENSERVER__DATABASE_URL=mysql://$(USER_DB_USERNAME):$(USER_DB_PASSWORD)@$(DB_HOST):3306/$(USER_DB_NAME)
SYNC_TOKENSERVER__FXA_EMAIL_DOMAIN=api.accounts.firefox.com
SYNC_TOKENSERVER__FXA_OAUTH_SERVER_URL=https://oauth.accounts.firefox.com/v1
SYNC_TOKENSERVER__FXA_METRICS_HASH_SECRET=$(metrics_key)
SYNC_TOKENSERVER__ADDITIONAL_BLOCKING_THREADS_FOR_FXA_REQUESTS="10"

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: default-policy
spec:
  egress:
    - toEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: '53'
              protocol: UDP
          rules:
            dns:
              - matchPattern: '*'
    - toEndpoints:
        - {}
  endpointSelector: {}
  ingress:
    - fromEndpoints:
        - {}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mysql-data
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 50Gi
  storageClassName: truenas-encrypted-nfs
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: mariadb-conf
data:
  50-server.cnf: >
    #
    # These groups are read by MariaDB server.
    # Use it for options that only the server (but not clients) should see

    # this is read by the standalone daemon and embedded servers
    [server]

    # this is only for the mariadbd daemon
    [mariadbd]

    #
    # * Basic Settings
    #

    #user                    = mysql
    pid-file                = /run/mysqld/mysqld.pid
    basedir                 = /usr
    #datadir                 = /var/lib/mysql
    #tmpdir                  = /tmp

    # Broken reverse DNS slows down connections considerably and name resolve is
    # safe to skip if there are no "host by domain name" access grants
    skip-name-resolve

    # Instead of skip-networking the default is now to listen only on
    # localhost which is more compatible and is not less secure.
    #bind-address            = 127.0.0.1

    #
    # * Fine Tuning
    #

    #key_buffer_size        = 128M
    max_allowed_packet     = 1G
    #thread_stack           = 192K
    #thread_cache_size      = 8
    # This replaces the startup script and checks MyISAM tables if needed
    # the first time they are touched
    #myisam_recover_options = BACKUP
    #max_connections        = 100
    #table_cache            = 64

    #
    # * Logging and Replication
    #

    # Both location gets rotated by the cronjob.
    # Be aware that this log type is a performance killer.
    # Recommend only changing this at runtime for short testing periods if needed!
    #general_log_file       = /var/log/mysql/mysql.log
    #general_log            = 1

    # When running under systemd, error logging goes via stdout/stderr to journald
    # and when running legacy init error logging goes to syslog due to
    # /etc/mysql/conf.d/mariadb.conf.d/50-mariadb_safe.cnf
    # Enable this if you want to have error logging into a separate file
    #log_error = /var/log/mysql/error.log
    # Enable the slow query log to see queries with especially long duration
    #log_slow_query_file    = /var/log/mysql/mariadb-slow.log
    #log_slow_query_time    = 10
    #log_slow_verbosity     = query_plan,explain
    #log-queries-not-using-indexes
    #log_slow_min_examined_row_limit = 1000

    # The following can be used as easy to replay backup logs or for replication.
    # note: if you are setting up a replica, see README.Debian about other
    #       settings you may need to change.
    #server-id              = 1
    #log_bin                = /var/log/mysql/mysql-bin.log
    expire_logs_days        = 10
    #max_binlog_size        = 100M

    #
    # * SSL/TLS
    #

    # For documentation, please read
    # https://mariadb.com/kb/en/securing-connections-for-client-and-server/
    #ssl-ca = /etc/mysql/cacert.pem
    #ssl-cert = /etc/mysql/server-cert.pem
    #ssl-key = /etc/mysql/server-key.pem
    #require-secure-transport = on

    #
    # * Character sets
    #

    # MySQL/MariaDB default is Latin1, but in Debian we rather default to the full
    # utf8 4-byte character set. See also client.cnf
    character-set-server  = utf8mb4
    collation-server      = utf8mb4_general_ci

    #
    # * InnoDB
    #

    # InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.
    # Read the manual for more InnoDB related options. There are many!
    # Most important is to give InnoDB 80 % of the system RAM for buffer use:
    # https://mariadb.com/kb/en/innodb-system-variables/#innodb_buffer_pool_size
    #innodb_buffer_pool_size = 8G

    # this is only for embedded server
    [embedded]

    # This group is only read by MariaDB servers, not by MySQL.
    # If you use the same .cnf file for MySQL and MariaDB,
    # you can put MariaDB-only options here
    [mariadbd]

    # This group is only read by MariaDB-11.0 servers.
    # If you use the same .cnf file for MariaDB of different versions,
    # use this group for options that older servers don't understand
    [mariadb-11.0]
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    service: mysql
  name: mysql
spec:
  replicas: 1
  selector:
    matchLabels:
      service: mysql
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        service: mysql
        app.kubernetes.io/name: mysql
    spec:
      containers:
        - env:
            - name: MARIADB_USER
              value: firefox_sync
            - name: MARIADB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: firefox-sync
                  key: DB_PASSWORD
            - name: MARIADB_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: firefox-sync
                  key: ROOT_PASSWORD
            - name: MARIADB_DATABASE
              value: firefox_sync
          image: mariadb:11.0.2-jammy
          name: mysql
          ports:
            - containerPort: 3306
              name: mysql
          volumeMounts:
            - mountPath: /var/lib/mysql
              name: mysql-data
            - mountPath: /etc/mysql/mariadb.conf.d/50-server.cnf
              name: mariadb-conf
              subPath: 50-server.cnf
              readOnly: true
          resources:
            requests:
              cpu: 1m
              memory: 125Mi
            limits:
              memory: 125Mi
      restartPolicy: Always
      volumes:
        - name: mysql-data
          persistentVolumeClaim:
            claimName: mysql-data
        - name: mariadb-conf
          configMap:
            name: mariadb-conf
---
apiVersion: v1
kind: Service
metadata:
  name: mysql
spec:
  ports:
    - name: "mysql"
      port: 3306
      targetPort: mysql
  selector:
    service: mysql
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: firefox-sync-policy
spec:
  egress:
    - toFQDNs:
        - matchName: oauth.accounts.firefox.com
      toPorts:
        - ports:
            - port: "443"
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: firefox-sync
  ingress:
    - fromEndpoints:
        - matchLabels:
            app.kubernetes.io/name: traefik
            io.kubernetes.pod.namespace: traefik
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: firefox-sync
spec:
  replicas: 1
  selector:
    matchLabels:
      app: firefox-sync
  template:
    metadata:
      labels:
        app: firefox-sync
        app.kubernetes.io/name: firefox-sync
    spec:
      containers:
        - name: firefox-sync
          image: mozilla/syncstorage-rs:0.13.6
          env:
          - name: RUST_LOG
            value: trace
          - name: DB_USERNAME
            value: firefox_sync
          - name: DB_PASSWORD
            valueFrom:
              secretKeyRef:
                name: firefox-sync
                key: DB_PASSWORD
          - name: DB_NAME
            value: firefox_sync
          - name: DB_HOST
            value: mysql
          - name: SYNC_HUMAN_LOGS
            value: "1"
          - name: SYNC_SYNCSTORAGE__DATABASE_URL
            value: mysql://$(DB_USERNAME):$(DB_PASSWORD)@$(DB_HOST):3306/$(DB_NAME)
          - name: SYNC_SYNCSTORAGE__RUN_MIGRATIONS
            value: "true"
          - name: SYNC_HOST
            value: 0.0.0.0
          - name: SYNC_MASTER_SECRET
            valueFrom:
              secretKeyRef:
                name: firefox-sync
                key: SYNC_SECRET
          - name: SYNC_SYNCSTORAGE__HOST
            value: 0.0.0.0
          - name: SYNC_SYNCSTORAGE__MASTER_SECRET
            valueFrom:
              secretKeyRef:
                name: firefox-sync
                key: SYNC_SECRET
          - name: SYNC_TOKENSERVER__ENABLED
            value: "true"
          - name: SYNC_TOKENSERVER__RUN_MIGRATIONS
            value: "true"
          - name: SYNC_TOKENSERVER__NODE_TYPE
            value: mysql
          - name: USER_DB_USERNAME
            value: firefox_sync_user
          - name: USER_DB_PASSWORD
            valueFrom:
              secretKeyRef:
                name: firefox-sync
                key: USER_DB_PASSWORD
          - name: USER_DB_NAME
            value: firefox_sync_user
          - name: SYNC_TOKENSERVER__DATABASE_URL
            value: mysql://$(USER_DB_USERNAME):$(USER_DB_PASSWORD)@$(DB_HOST):3306/$(USER_DB_NAME)
          - name: SYNC_TOKENSERVER__FXA_EMAIL_DOMAIN
            value: api.accounts.firefox.com
          - name: SYNC_TOKENSERVER__FXA_OAUTH_SERVER_URL
            value: https://oauth.accounts.firefox.com/v1
          - name: SYNC_TOKENSERVER__FXA_METRICS_HASH_SECRET
            valueFrom:
              secretKeyRef:
                name: firefox-sync
                key: USER_SYNC_SECRET
          - name: SYNC_TOKENSERVER__ADDITIONAL_BLOCKING_THREADS_FOR_FXA_REQUESTS
            value: "10"
          ports:
            - name: http
              containerPort: 8000
              protocol: TCP
          resources:
            limits:
              memory: 200Mi
            requests:
              cpu: '1m'
              memory: 200Mi
          livenessProbe:
            httpGet:
              path: "/__heartbeat__"
              port: http
              scheme: HTTP
            initialDelaySeconds: 30
            timeoutSeconds: 8
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: "/__heartbeat__"
              port: http
              scheme: HTTP
            initialDelaySeconds: 30
            timeoutSeconds: 8
            periodSeconds: 10
            successThreshold: 5
            failureThreshold: 3
          imagePullPolicy: IfNotPresent
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app: firefox-sync
              topologyKey: kubernetes.io/hostname
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 100%
---
apiVersion: v1
kind: Service
metadata:
  name: firefox-sync
spec:
  ports:
    - name: http
      protocol: TCP
      port: 8000
      targetPort: http
  selector:
    app: firefox-sync
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: firefox-sync
spec:
  dnsNames:
    - firefox-sync.example.com
  issuerRef:
    kind: ClusterIssuer
    name: digital-ocean-production
  secretName: firefox-sync-tls
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: strip-prefix
spec:
  stripPrefix:
    prefixes:
      - /token
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: firefox-sync
spec:
  entryPoints:
    - tailscaletls
  routes:
    - kind: Rule
      match: Host(`firefox-sync.example.com`)
      middlewares:
        - name: strip-prefix
          namespace: firefox-sync
      services:
        - name: firefox-sync
          port: http
  tls:
    secretName: firefox-sync-tls

    CREATE DATABASE firefox_sync;
    CREATE USER 'firefox_sync'@'%' IDENTIFIED BY '{{password_in_secret}}';
    GRANT CREATE, ALTER, DROP, INSERT, UPDATE, DELETE, SELECT, REFERENCES on firefox_sync.* TO 'firefox_sync'@'%';

    CREATE DATABASE firefox_sync_user;
    CREATE USER 'firefox_sync_user'@'%' IDENTIFIED BY '{{password_in_secret}}';
    GRANT CREATE, ALTER, DROP, INSERT, UPDATE, DELETE, SELECT, REFERENCES on firefox_sync_user.* TO 'firefox_sync_user'@'%';

    USE firefox_sync_user;
    INSERT INTO `services` (`id`, `service`, `pattern`) VALUES ('1', 'sync-1.5', '{node}/1.5/{uid}');
INSERT INTO `nodes` (`id`, `service`, `node`, `available`, `current_load`, `capacity`, `downed`, `backoff`) VALUES ('1', '1', 'https://firefox-sync.example.com', '1', '0', '1', '0', '0');

    use firefox_sync;
    SELECT * FROM bso;