Sub2API

Web Page

sub2api web page (https://sub2api.72602.online)

Current State

  • ArgoCD Application: argocd/sub2api
  • Namespace: ai
  • Chart: ghcr.io/ben-wangz/k8s-at-home-charts/sub2api (0.1.1)
  • Ingress host: sub2api.72602.online
  • Ingress class: nginx
  • ClusterIssuer: lets-encrypt
  • External PostgreSQL: postgresql.database.svc.cluster.local:5432 (database/user: sub2api)

Docs

Subsections of Sub2API

Backup & Restore

Scope

  • Database: PostgreSQL (database/postgresql-0), DB sub2api
  • App config: ops-assets/sub2api-argocd.yaml + ai namespace secrets
  • Runtime data path: /app/data (mounted from PVC sub2api-data)

Database Backup

TS=$(date +%F-%H%M%S)
mkdir -p /home/aaron/Ops/backups/sub2api

kubectl -n database exec postgresql-0 -- \
  env PGPASSWORD='REPLACE_POSTGRES_PASSWORD' \
  pg_dump -U postgres -d sub2api -Fc \
  > /home/aaron/Ops/backups/sub2api/sub2api-${TS}.dump

Database Restore

# 1) create a restore database first (recommended)
kubectl -n database exec postgresql-0 -- \
  env PGPASSWORD='REPLACE_POSTGRES_PASSWORD' \
  psql -U postgres -d postgres -c "CREATE DATABASE sub2api_restore OWNER sub2api;"

# 2) restore dump to restore database
cat /home/aaron/Ops/backups/sub2api/sub2api-YYYY-MM-DD-HHMMSS.dump | \
kubectl -n database exec -i postgresql-0 -- \
  env PGPASSWORD='REPLACE_POSTGRES_PASSWORD' \
  pg_restore -U postgres -d sub2api_restore --clean --if-exists

# 3) verify key tables
kubectl -n database exec postgresql-0 -- \
  env PGPASSWORD='REPLACE_POSTGRES_PASSWORD' \
  psql -U postgres -d sub2api_restore -c "SELECT count(*) FROM users;"

Sub2API App-Level Backup

TS=$(date +%F-%H%M%S)
mkdir -p /home/aaron/Ops/backups/sub2api/${TS}

# 1) backup ArgoCD app manifest source
cp /home/aaron/Ops/docs/manifests/application/sub2api-argocd.yaml \
  /home/aaron/Ops/backups/sub2api/${TS}/sub2api-argocd.yaml

# 2) backup in-cluster objects
kubectl -n ai get deploy,svc,ingress,pvc sub2api -o yaml \
  > /home/aaron/Ops/backups/sub2api/${TS}/sub2api-k8s.yaml

kubectl -n ai get secret sub2api-auth -o yaml \
  > /home/aaron/Ops/backups/sub2api/${TS}/sub2api-auth.secret.yaml

kubectl -n ai get secret sub2api-external-postgresql -o yaml \
  > /home/aaron/Ops/backups/sub2api/${TS}/sub2api-external-postgresql.secret.yaml

Pre-Restore Safety Checklist

  • Confirm rollback target (sub2api or sub2api_restore) before switching DB.
  • Keep current dump before any restore/import.
  • After restore, verify login API and settings API:
curl -sk -o /dev/null -w '%{http_code}\n' https://sub2api.72602.online/api/v1/settings/public
kubectl -n ai logs deploy/sub2api --since=10m

Install (ArgoCD)

Preliminary

  • ArgoCD 已可访问: https://argocd.72602.online
  • cert-manager 与 lets-encrypt 已就绪
  • DNS 已解析: sub2api.72602.online -> 47.110.67.161
  • PostgreSQL(database ns) 可用

Deployment

Deploy
Details
PG_PASSWORD=$(kubectl -n database get secret postgresql-credentials -o jsonpath='{.data.postgres-password}' | base64 -d)
JWT_SECRET=$(openssl rand -hex 32)
TOTP_KEY=$(openssl rand -hex 32)

kubectl get ns application > /dev/null 2>&1 || kubectl create namespace application

kubectl -n application create secret generic sub2api-auth \
  --from-literal=admin-password='CHANGE_ME_STRONG_PASSWORD' \
  --from-literal=jwt-secret="$JWT_SECRET" \
  --from-literal=totp-encryption-key="$TOTP_KEY" \
  --dry-run=client -o yaml | kubectl apply -f -

kubectl -n application create secret generic sub2api-external-postgresql \
  --from-literal=postgres-password="$PG_PASSWORD" \
  --dry-run=client -o yaml | kubectl apply -f -

kubectl -n application create secret generic sub2api-redis \
  --from-literal=redis-password='CHANGE_ME_REDIS_PASSWORD' \
  --dry-run=client -o yaml | kubectl apply -f -
Details
ARGOCD_PASS=$(kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d)
argocd login --insecure --username admin argocd.72602.online --password $ARGOCD_PASS

kubectl apply -f /home/aaron/Ops/docs/manifests/application/sub2api-argocd.yaml
argocd app sync sub2api
argocd app wait sub2api --health --timeout 300

Verify

argocd app get sub2api
kubectl -n application get pods,svc,ingress
kubectl -n application get certificate,certificaterequest,order,challenge
curl -vkI https://sub2api.72602.online

Ops

Web Page

sub2api web page (https://sub2api.72602.online)

Health Check

argocd app get sub2api
kubectl -n ai get pods
kubectl -n ai logs deploy/sub2api --tail=80

Ingress and TLS

kubectl -n ai get ingress sub2api -o wide
kubectl -n ai get certificate,certificaterequest,order,challenge
curl -vkI https://sub2api.72602.online

Restart

kubectl -n ai rollout restart deploy/sub2api
kubectl -n ai rollout status deploy/sub2api

Rotate Auth Secrets

kubectl -n ai create secret generic sub2api-auth \
  --from-literal=admin-password='CHANGE_ME_STRONG_PASSWORD' \
  --from-literal=jwt-secret="$(openssl rand -hex 32)" \
  --from-literal=totp-encryption-key="$(openssl rand -hex 32)" \
  --dry-run=client -o yaml | kubectl apply -f -

kubectl -n ai rollout restart deploy/sub2api

Sync From ArgoCD

ARGOCD_PASS=$(kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d)
argocd login --insecure --username admin argocd.72602.online --password $ARGOCD_PASS

argocd app sync sub2api
argocd app wait sub2api --health --timeout 300

Backup and Restore

  • Database + app-level backup runbook: Ops/Sub2API/Backup & Restore
  • File path: /home/aaron/Ops/docs/content/Installation/Application/Sub2API/backup.md

Troubleshooting: column settings.id does not exist

Symptom: GET /api/v1/settings/public or admin settings APIs return 500, logs show pq: column settings.id does not exist.

Root cause: sub2api is pointed to a shared/legacy database schema (for example n8n DB) where settings table structure is incompatible.

Fix (minimal):

# 1) use dedicated DB/user for sub2api
# update /home/aaron/Ops/docs/manifests/application/sub2api-argocd.yaml
# externalPostgresql.username= sub2api
# externalPostgresql.database= sub2api

# 2) create DB/user in PostgreSQL and rotate secret
# (run with postgres superuser)

# 3) apply and rollout
kubectl apply -f /home/aaron/Ops/docs/manifests/application/sub2api-argocd.yaml
kubectl -n ai rollout restart deploy/sub2api
kubectl -n ai rollout status deploy/sub2api

Troubleshooting: Redis WRONGPASS

Symptom: kubectl -n ai logs deploy/sub2api shows WRONGPASS invalid username-password pair.

Root cause: Redis password changed (for example chart regenerated secret), but sub2api pod still used old REDIS_PASSWORD env var.

Fix:

# 1) ensure ArgoCD values pin Redis secret (in sub2api-argocd.yaml)
# redis.auth.existingSecret: sub2api-redis
# redis.auth.existingSecretPasswordKey: redis-password

# 2) apply and restart sub2api to reload env
kubectl apply -f /home/aaron/Ops/docs/manifests/application/sub2api-argocd.yaml
kubectl -n ai rollout restart deploy/sub2api
kubectl -n ai rollout status deploy/sub2api

# 3) verify
kubectl -n ai logs deploy/sub2api --tail=120

Verify:

curl -sk -o /dev/null -w '%{http_code}\n' https://sub2api.72602.online/api/v1/settings/public
kubectl -n ai logs deploy/sub2api --since=10m