From b0d1cb992c6ff05a5eb0bc2f70f3d51231f7db09 Mon Sep 17 00:00:00 2001 From: Chris Lovering Date: Thu, 12 Nov 2026 21:54:25 +0000 Subject: [PATCH 1/4] Add Barium to serve archived legacy Modmail logs Barium is a static nginx image built from an export of the legacy Modmail logs. It serves them at the original /logs/ URLs. The image is private because it contains the logs, and it needs no secrets. --- .../namespaces/modmail/barium/README.md | 8 ++++ .../namespaces/modmail/barium/deployment.yaml | 42 +++++++++++++++++++ .../namespaces/modmail/barium/service.yaml | 12 ++++++ 3 files changed, 62 insertions(+) create mode 100644 kubernetes/namespaces/modmail/barium/README.md create mode 100644 kubernetes/namespaces/modmail/barium/deployment.yaml create mode 100644 kubernetes/namespaces/modmail/barium/service.yaml diff --git a/kubernetes/namespaces/modmail/barium/README.md b/kubernetes/namespaces/modmail/barium/README.md new file mode 100644 index 00000000..29701422 --- /dev/null +++ b/kubernetes/namespaces/modmail/barium/README.md @@ -0,0 +1,8 @@ +# Barium +Static viewer for logs from the legacy Modmail bot. Serves pre-rendered logs at `/logs/` +(the original `modmail.pydis.wtf` URLs) and a SQLite index for client-side search. + +The image (`ghcr.io/owl-corp/barium`) is private, as it contains the archived logs, and is built +locally from a Modmail export (see the [barium repo](https://github.com/owl-corp/barium)). It needs +no secrets, and is exposed on `modmail.pydis.wtf` through the `modmail-pydis-wtf` route in +`nginx-gateway/routes/service-routes/`. diff --git a/kubernetes/namespaces/modmail/barium/deployment.yaml b/kubernetes/namespaces/modmail/barium/deployment.yaml new file mode 100644 index 00000000..e6c2e431 --- /dev/null +++ b/kubernetes/namespaces/modmail/barium/deployment.yaml @@ -0,0 +1,42 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: barium + namespace: modmail +spec: + replicas: 1 + selector: + matchLabels: + app: barium + template: + metadata: + labels: + app: barium + spec: + containers: + - name: barium + image: ghcr.io/owl-corp/barium:latest + imagePullPolicy: Always + resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 200m + memory: 128Mi + ports: + - containerPort: 8000 + volumeMounts: + - name: tmp + mountPath: /tmp + securityContext: + readOnlyRootFilesystem: true + volumes: + - name: tmp + emptyDir: {} + imagePullSecrets: + - name: ghcr-pull-secret + securityContext: + fsGroup: 2000 + runAsUser: 1000 + runAsNonRoot: true diff --git a/kubernetes/namespaces/modmail/barium/service.yaml b/kubernetes/namespaces/modmail/barium/service.yaml new file mode 100644 index 00000000..a5b57335 --- /dev/null +++ b/kubernetes/namespaces/modmail/barium/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: barium + namespace: modmail +spec: + selector: + app: barium + ports: + - protocol: TCP + port: 80 + targetPort: 8000 From 0296a518b96e8894e5a611402873d79f3e3912b0 Mon Sep 17 00:00:00 2001 From: Chris Lovering Date: Thu, 12 Nov 2026 21:54:25 +0000 Subject: [PATCH 2/4] Route modmail.pydis.wtf to Barium Point the existing route at the new service. The mTLS filter is unchanged, so access is the same as before. --- .../nginx-gateway/routes/service-routes/modmail-pydis-wtf.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kubernetes/namespaces/nginx-gateway/routes/service-routes/modmail-pydis-wtf.yaml b/kubernetes/namespaces/nginx-gateway/routes/service-routes/modmail-pydis-wtf.yaml index 8cdb645f..34ff6609 100644 --- a/kubernetes/namespaces/nginx-gateway/routes/service-routes/modmail-pydis-wtf.yaml +++ b/kubernetes/namespaces/nginx-gateway/routes/service-routes/modmail-pydis-wtf.yaml @@ -11,7 +11,7 @@ spec: namespace: nginx-gateway rules: - backendRefs: - - name: modmail-web + - name: barium namespace: modmail port: 80 filters: From e03a7b2b754cf0d5b738ff26b661a0d7febf195a Mon Sep 17 00:00:00 2001 From: Chris Lovering Date: Thu, 12 Nov 2026 21:54:25 +0000 Subject: [PATCH 3/4] Remove legacy Modmail bot and web logviewer The old bot is no longer used, as Polonium has replaced it. Barium now serves its logs. --- kubernetes/namespaces/modmail/bot/README.md | 7 --- .../namespaces/modmail/bot/deployment.yaml | 51 ------------------- kubernetes/namespaces/modmail/configmap.yaml | 13 ----- kubernetes/namespaces/modmail/web/README.md | 2 - .../namespaces/modmail/web/deployment.yaml | 39 -------------- .../namespaces/modmail/web/service.yaml | 12 ----- 6 files changed, 124 deletions(-) delete mode 100644 kubernetes/namespaces/modmail/bot/README.md delete mode 100644 kubernetes/namespaces/modmail/bot/deployment.yaml delete mode 100644 kubernetes/namespaces/modmail/configmap.yaml delete mode 100644 kubernetes/namespaces/modmail/web/README.md delete mode 100644 kubernetes/namespaces/modmail/web/deployment.yaml delete mode 100644 kubernetes/namespaces/modmail/web/service.yaml diff --git a/kubernetes/namespaces/modmail/bot/README.md b/kubernetes/namespaces/modmail/bot/README.md deleted file mode 100644 index ac29ac2b..00000000 --- a/kubernetes/namespaces/modmail/bot/README.md +++ /dev/null @@ -1,7 +0,0 @@ -# Modmail bot -These manifests will provision the resources for an instance of our Modmail bot. - -To deploy this bot simply run: -``` -kubectl apply -f deployment.yaml -``` diff --git a/kubernetes/namespaces/modmail/bot/deployment.yaml b/kubernetes/namespaces/modmail/bot/deployment.yaml deleted file mode 100644 index 3e1ea9b6..00000000 --- a/kubernetes/namespaces/modmail/bot/deployment.yaml +++ /dev/null @@ -1,51 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: modmail-bot - namespace: modmail -spec: - replicas: 1 - selector: - matchLabels: - app: modmail-bot - template: - metadata: - labels: - app: modmail-bot - spec: - containers: - - name: modmail-bot - image: ghcr.io/python-discord/modmail:latest - resources: - requests: - cpu: 75m - memory: 600Mi - limits: - cpu: 125m - memory: 1000Mi - imagePullPolicy: "Always" - volumeMounts: - - mountPath: /opt/modmail/plugins - name: plugins-vol - - mountPath: /opt/modmail/temp - name: temp-vol - env: - - name: TMPDIR - value: /opt/modmail/temp - envFrom: - - secretRef: - name: modmail - - configMapRef: - name: modmail-config-env - securityContext: - readOnlyRootFilesystem: true - volumes: - - name: plugins-vol - emptyDir: {} - - name: temp-vol - emptyDir: - medium: Memory - securityContext: - fsGroup: 2000 - runAsUser: 1000 - runAsNonRoot: true diff --git a/kubernetes/namespaces/modmail/configmap.yaml b/kubernetes/namespaces/modmail/configmap.yaml deleted file mode 100644 index 5d5d8506..00000000 --- a/kubernetes/namespaces/modmail/configmap.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: modmail-config-env - namespace: modmail -data: - DATABASE_TYPE: 'mongodb' # The type of database to use, only supports mongodb right now - DATA_COLLECTION: 'false' # Disable bot metadata collection by modmail devs - DISABLE_AUTOUPDATES: 'yes' - GUILD_ID: '267624335836053506' - LOG_URL: https://modmail.pydis.wtf/ - OWNERS: 165023948638126080,95872159741644800,336843820513755157 - REGISTRY_PLUGINS_ONLY: 'false' # Allow the usage of plugins outside of the official registry diff --git a/kubernetes/namespaces/modmail/web/README.md b/kubernetes/namespaces/modmail/web/README.md deleted file mode 100644 index 7b7e19e0..00000000 --- a/kubernetes/namespaces/modmail/web/README.md +++ /dev/null @@ -1,2 +0,0 @@ -# Modmail web -These manifests provision an instance of the web logviewer for our Modmail system. diff --git a/kubernetes/namespaces/modmail/web/deployment.yaml b/kubernetes/namespaces/modmail/web/deployment.yaml deleted file mode 100644 index 877e9459..00000000 --- a/kubernetes/namespaces/modmail/web/deployment.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: modmail-web - namespace: modmail -spec: - replicas: 1 - selector: - matchLabels: - app: modmail-web - template: - metadata: - labels: - app: modmail-web - spec: - containers: - - name: modmail-web - image: ghcr.io/python-discord/logviewer:latest - imagePullPolicy: Always - resources: - requests: - cpu: 50m - memory: 100Mi - limits: - cpu: 100m - memory: 150Mi - ports: - - containerPort: 8000 - envFrom: - - secretRef: - name: modmail - - configMapRef: - name: modmail-config-env - securityContext: - readOnlyRootFilesystem: true - securityContext: - fsGroup: 2000 - runAsUser: 1000 - runAsNonRoot: true diff --git a/kubernetes/namespaces/modmail/web/service.yaml b/kubernetes/namespaces/modmail/web/service.yaml deleted file mode 100644 index 2ea2e7da..00000000 --- a/kubernetes/namespaces/modmail/web/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: modmail-web - namespace: modmail -spec: - selector: - app: modmail-web - ports: - - protocol: TCP - port: 80 - targetPort: 8000 From 9acabef4352fbd616d8455a0e37cd16bd25933cc Mon Sep 17 00:00:00 2001 From: Chris Lovering Date: Thu, 12 Nov 2026 21:54:25 +0000 Subject: [PATCH 4/4] Update Modmail namespace README Describe Polonium as the current bot and Barium as the legacy log viewer. --- kubernetes/namespaces/modmail/README.md | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/kubernetes/namespaces/modmail/README.md b/kubernetes/namespaces/modmail/README.md index b78857be..f9a09d2d 100644 --- a/kubernetes/namespaces/modmail/README.md +++ b/kubernetes/namespaces/modmail/README.md @@ -1,12 +1,15 @@ # Modmail -This folder contains the manifests for our Modmail service. +This namespace runs our Modmail system. -## Secrets +| Component | Description | +| --------- | ----------- | +| Polonium (`polonium-api`, `polonium-bot`) | The current Modmail bot. Its manifests are not in this directory. | +| [`barium/`](./barium) | Read-only viewer for logs from the **legacy** Modmail bot, so old `modmail.pydis.wtf/logs/` links keep working. | + +The legacy Modmail bot and its web logviewer have been retired. Their logs were exported from MongoDB +and are now served statically by Barium. -The services require one shared secret called `modmail` containing the following: +## Secrets -| Key | Value | Description | -| ------------------------| ---------------------------------|--------------------------------------------------------------| -| `CONNECTION_URI` | MongoDB connection URI | Used for storing data | -| `TOKEN` | Discord Token | Used to connect to Discord | +The `modmail` secret is shared by the Polonium deployments.