--wip-- [skipci]

Liana64 · Dec 28, 2024 · 8ed9065 · 8ed9065
1 parent 1cf315d
commit 8ed9065
Show file tree

Hide file tree

Showing 42 changed files with 884 additions and 65 deletions.
diff --git a/.archive/kubernetes-schemas/app/helmrelease.yaml b/.archive/kubernetes-schemas/app/helmrelease.yaml
@@ -0,0 +1,77 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app kubernetes-schemas
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      kubernetes-schemas:
+        containers:
+          app:
+            image:
+              repository: ghcr.io/budimanjojo/kubernetes-schemas-web
+              tag: latest@sha256:6798cb1435f9928d93398b5ea00c6dd5ecc0aae0889278e17db1fa1b14117b5b
+            resources:
+              requests:
+                cpu: 10m
+                memory: 50Mi
+              limits:
+                cpu: 200m
+                memory: 128Mi
+            probes:
+              startup:
+                enabled: true
+                spec:
+                  failureThreshold: 30
+                  periodSeconds: 5
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: 8080
+
+    ingress:
+      app:
+        enabled: true
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-production"
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/name: Kubernetes Schemas
+          gethomepage.dev/group: Tools
+          gethomepage.dev/icon: mdi-file-document
+        hosts:
+          - host: &host "k8s.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: main
+                  port: http
+        tls:
+          - secretName: "{{ .Release.Name }}-secret"
+            hosts: [*host]
diff --git a/kubernetes/main/apps/dev/kustomization.yaml → ...kubernetes-schemas/app/kustomization.yaml b/kubernetes/main/apps/dev/kustomization.yaml → ...kubernetes-schemas/app/kustomization.yaml
@@ -3,5 +3,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./namespace.yaml
-  #- ./windmill/ks.yaml
+  - ./helmrelease.yaml
diff --git a/.archive/kubernetes-schemas/ks.yaml b/.archive/kubernetes-schemas/ks.yaml
@@ -0,0 +1,26 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app kubernetes-schemas
+  namespace: flux-system
+spec:
+  targetNamespace: dev
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: traefik
+  path: ./kubernetes/main/apps/dev/kubernetes-schemas/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: k8s-gitops
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
diff --git a/.../apps/public/mataroa/app/helmrelease.yaml → .archive/mataroa/app/helmrelease.yaml b/.../apps/public/mataroa/app/helmrelease.yaml → .archive/mataroa/app/helmrelease.yaml
@@ -33,9 +33,8 @@ spec:
         initContainers:
           init-db:
             image:
-              repository: ghcr.io/onedr0p/postgres-init
+              repository: ghcr.io/liana64/postgres-init
               tag: 16
-            # https://github.com/onedr0p/containers/blob/main/apps/postgres-init/entrypoint.sh
             env:
               INIT_POSTGRES_HOST: &dbHost postgres-1-rw.database.svc.cluster.local
               INIT_POSTGRES_DBNAME: &dbName mataroa
@@ -62,7 +61,7 @@ spec:
               tag: rolling@sha256:702eae37414c0b492b766771a50b9c8490b4a34259699eae3a7bdf284f2abad6
             env:
               DEBUG: 1
-              DATABASE_URL: "postgres://${PGUSER}:${PGPASSWORD}@mataroa:5432/mataroa"
+              DATABASE_URL: "postgres://${PGUSER}:${PGPASSWORD}@postgres-1-rw.database.svc.cluster.local:5432/mataroa"
             envFrom:
               - secretRef:
                   name: *secret

diff --git a/...pps/public/mataroa/app/kustomization.yaml → .archive/mataroa/app/kustomization.yaml b/...pps/public/mataroa/app/kustomization.yaml → .archive/mataroa/app/kustomization.yaml
diff --git a/.../apps/public/mataroa/app/secret.sops.yaml → .archive/mataroa/app/secret.sops.yaml b/.../apps/public/mataroa/app/secret.sops.yaml → .archive/mataroa/app/secret.sops.yaml
diff --git a/kubernetes/main/apps/public/mataroa/ks.yaml → .archive/mataroa/ks.yaml b/kubernetes/main/apps/public/mataroa/ks.yaml → .archive/mataroa/ks.yaml
diff --git a/...in/apps/dev/windmill/app/helmrelease.yaml → .archive/windmill/app/helmrelease.yaml b/...in/apps/dev/windmill/app/helmrelease.yaml → .archive/windmill/app/helmrelease.yaml
@@ -74,6 +74,7 @@ spec:
       enabled: true
       className: traefik
       annotations:
+        cert-manager.io/cluster-issuer: "letsencrypt-production"
         gethomepage.dev/enabled: "true"
         gethomepage.dev/name: Windmill
         gethomepage.dev/description: Workflow engine

diff --git a/.../apps/dev/windmill/app/kustomization.yaml → .archive/windmill/app/kustomization.yaml b/.../apps/dev/windmill/app/kustomization.yaml → .archive/windmill/app/kustomization.yaml
diff --git a/...in/apps/dev/windmill/app/secret.sops.yaml → .archive/windmill/app/secret.sops.yaml b/...in/apps/dev/windmill/app/secret.sops.yaml → .archive/windmill/app/secret.sops.yaml
diff --git a/kubernetes/main/apps/dev/windmill/ks.yaml → .archive/windmill/ks.yaml b/kubernetes/main/apps/dev/windmill/ks.yaml → .archive/windmill/ks.yaml
diff --git a/kubernetes/main/apps/auth/authelia/app/secret.sops.yaml b/kubernetes/main/apps/auth/authelia/app/secret.sops.yaml
diff --git a/kubernetes/main/apps/bitwarden/bitwarden/app/helmrelease.yaml b/kubernetes/main/apps/bitwarden/bitwarden/app/helmrelease.yaml
@@ -0,0 +1,205 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2beta2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: bitwarden
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: self-host
+      version: 2024.11.0
+      sourceRef:
+        kind: HelmRepository
+        name: bitwarden
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  values:
+    sharedStorageClassName: "cluster-nvme"
+    general:
+      admins: "${SECRET_ADMIN_EMAIL}"
+      disableUserRegistration: "false"
+      cloudRegion: US
+      enableCloudCommunication: true
+      sharedStorageClassName: "cluster-nvme"
+      volumeAccessMode: "ReadWriteOnce"
+      domain: "bitwarden.${SECRET_EXTERNAL_DOMAIN}"
+      ingress:
+        enabled: true
+        className: traefik
+        annotations:
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/group: Home
+          gethomepage.dev/name: Bitwarden
+          gethomepage.dev/description: Password management
+          gethomepage.dev/icon: bitwarden
+        tls:
+          name: bitwarden-tls
+          clusterIssuer: letsencrypt-production
+        paths:
+          web:
+            path: /
+            pathType: ImplementationSpecific
+          attachments:
+            path: /attachments/
+            pathType: ImplementationSpecific
+          api:
+            path: /api/
+            pathType: ImplementationSpecific
+          icons:
+            path: /icons/
+            pathType: ImplementationSpecific
+          notifications:
+            path: /notifications/
+            pathType: ImplementationSpecific
+          events:
+            path: /events/
+            pathType: ImplementationSpecific
+          scim:
+            path: /scim/
+            pathType: ImplementationSpecific
+          sso:
+            path: /sso/
+            pathType: ImplementationSpecific
+          identity:
+            path: /identity/
+            pathType: ImplementationSpecific
+          admin:
+            path: /admin/
+            pathType: ImplementationSpecific
+      email:
+        smtpSsl: "false"
+        smtpPort: "465"
+        smtpHost: "${SECRET_SMTP_HOST}"
+        replyToEmail: "${SECRET_SMTP_FROM}"
+    secrets:
+      secretName: bitwarden-secret
+    database:
+      enabled: false
+      #volume:
+      #  backups:
+      #    storageClass: "cluster-nvme"
+      #  data:
+      #    storageClass: "cluster-nvme"
+      #  log:
+      #    storageClass: "cluster-nvme"
+    volume:
+      dataprotection:
+        storageClass: "cluster-nvme"
+      attachments:
+        storageClass: "cluster-nvme"
+      licenses:
+        storageClass: "cluster-nvme"
+      logs:
+        enabled: true
+        storageClass: "cluster-nvme"
+    #    rawManifests:
+    #      preInstall: []
+    #      postInstall:
+    #        - apiVersion: traefik.io/v1alpha1
+    #          kind: Middleware
+    #          metadata:
+    #            name: "bitwarden-self-host-middleware-stripprefix"
+    #          spec:
+    #            stripPrefix:
+    #              prefixes:
+    #                - /api
+    #                - /attachements
+    #                - /icons
+    #                - /notifications
+    #                - /events
+    #                - /scim
+    #                ##### NOTE:  Admin, Identity, and SSO will not function correctly with path strip middleware
+    #        - apiVersion: traefik.io/v1alpha1
+    #          kind: IngressRoute
+    #          metadata:
+    #            name: "bitwarden-self-host-ingress"
+    #          spec:
+    #            entryPoints:
+    #              - websecure
+    #            routes:
+    #              - kind: Rule
+    #                match: Host(`bitwarden.${SECRET_EXTERNAL_DOMAIN}`) && PathPrefix(`/`)
+    #                services:
+    #                  - kind: Service
+    #                    name: bitwarden-self-host-web
+    #                    passHostHeader: true
+    #                    port: 5000
+    #              - kind: Rule
+    #                match: Host(`bitwarden.${SECRET_EXTERNAL_DOMAIN}`) && PathPrefix(`/api/`)
+    #                services:
+    #                  - kind: Service
+    #                    name: bitwarden-self-host-api
+    #                    port: 5000
+    #                middlewares:
+    #                  - name: "bitwarden-self-host-middleware-stripprefix"
+    #              - kind: Rule
+    #                match: Host(`bitwarden.${SECRET_EXTERNAL_DOMAIN}`) && PathPrefix(`/attachments/`)
+    #                services:
+    #                  - kind: Service
+    #                    name: bitwarden-self-host-api
+    #                    port: 5000
+    #                middlewares:
+    #                  - name: "bitwarden-self-host-middleware-stripprefix"
+    #              - kind: Rule
+    #                match: Host(`bitwarden.${SECRET_EXTERNAL_DOMAIN}`) && PathPrefix(`/icons/`)
+    #                services:
+    #                  - kind: Service
+    #                    name: bitwarden-self-host-icons
+    #                    port: 5000
+    #                middlewares:
+    #                  - name: "bitwarden-self-host-middleware-stripprefix"
+    #              - kind: Rule
+    #                match: Host(`bitwarden.${SECRET_EXTERNAL_DOMAIN}`) && PathPrefix(`/notifications/`)
+    #                services:
+    #                  - kind: Service
+    #                    name: bitwarden-self-host-notifications
+    #                    port: 5000
+    #                middlewares:
+    #                  - name: "bitwarden-self-host-middleware-stripprefix"
+    #              - kind: Rule
+    #                match: Host(`bitwarden.${SECRET_EXTERNAL_DOMAIN}`) && PathPrefix(`/events/`)
+    #                services:
+    #                  - kind: Service
+    #                    name: bitwarden-self-host-events
+    #                    port: 5000
+    #                middlewares:
+    #                  - name: "bitwarden-self-host-middleware-stripprefix"
+    #              - kind: Rule
+    #                match: Host(`bitwarden.${SECRET_EXTERNAL_DOMAIN}`) && PathPrefix(`/scim/`)
+    #                services:
+    #                  - kind: Service
+    #                    name: bitwarden-self-host-scim
+    #                    port: 5000
+    #                middlewares:
+    #                  - name: "bitwarden-self-host-middleware-stripprefix"
+    #              ##### NOTE:  SSO will not function correctly with path strip middleware
+    #              - kind: Rule
+    #                match: Host(`bitwarden.${SECRET_EXTERNAL_DOMAIN}`) && PathPrefix(`/sso/`)
+    #                services:
+    #                  - kind: Service
+    #                    name: bitwarden-self-host-sso
+    #                    port: 5000
+    #              ##### NOTE:  Identity will not function correctly with path strip middleware
+    #              - kind: Rule
+    #                match: Host(`bitwarden.${SECRET_EXTERNAL_DOMAIN}`) && PathPrefix(`/identity/`)
+    #                services:
+    #                  - kind: Service
+    #                    name: bitwarden-self-host-identity
+    #                    port: 5000
+    #              ##### NOTE:  Admin will not function correctly with path strip middleware
+    #              - kind: Rule
+    #                match: Host(`bitwarden.${SECRET_EXTERNAL_DOMAIN}`) && PathPrefix(`/admin`)
+    #                services:
+    #                  - kind: Service
+    #                    name: bitwarden-self-host-admin
+    #                    port: 5000
+    #            tls:
+    #              certResolver: letsencrypt-production
diff --git a/kubernetes/main/apps/bitwarden/bitwarden/app/kustomization.yaml b/kubernetes/main/apps/bitwarden/bitwarden/app/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./secret.sops.yaml
+  - ./helmrelease.yaml
diff --git a/kubernetes/main/apps/bitwarden/bitwarden/app/secret.sops.yaml b/kubernetes/main/apps/bitwarden/bitwarden/app/secret.sops.yaml
@@ -0,0 +1,34 @@
+# yamllint disable
+kind: Secret
+apiVersion: v1
+type: Opaque
+metadata:
+  name: bitwarden-secret
+stringData:
+  replyToEmail: ENC[AES256_GCM,data:7NR/XlAqsO4PtCNKQ890Njv6Qh2Jp6W/t0Lc8px7,iv:VznXZaMbwLda8LkrJDTc2UKurHRWqGTJ1T0/1C3VMus=,tag:Z+Wkfb7DqcaPam7AFrvWUw==,type:str]
+  globalSettings__installation__id: ENC[AES256_GCM,data:U091rHP2N4UjYgSdGrkDvSBZHQu9w8s75xWPCp6gfZ0773gW,iv:PZ2hBlqta/sclVQUtO6LYD/ZhL6e+Q+yDESxrt6CYjQ=,tag:1A/9gKzuflMqOktyoZ5adQ==,type:str]
+  globalSettings__installation__key: ENC[AES256_GCM,data:/pWJt9ElR+mgiv5m8I0Gdb5Z6H8=,iv:31bd6uhc45WMi41iACel8/YOjDjVTDxoR3Ok19+U43A=,tag:xtI3eCRActaFajUqVdxemw==,type:str]
+  globalSettings__mail__smtp__username: ENC[AES256_GCM,data:wGph7iTpKhvYXjsFKnPIFevGsJvgovvfNnIJPjFf,iv:o7l19Onw6PHMmk19e++zTArLmZrwSIAXgDpuwaDhjuo=,tag:ojY3lQFiP3G3oYeVQXri7A==,type:str]
+  globalSettings__mail__smtp__password: ENC[AES256_GCM,data:OQ3mROVpRAZ2MNFZtvRV0N74EPOaSdSvmaOJas1JCgEbHHNq0laLg5r2ufTYz9vA0aM=,iv:vB9ElILgqKyvY6wgQ8Nesg2pygGK9mcjIhEYGsHVWEQ=,tag:l84bsTR3twb3Al19FKezqA==,type:str]
+  globalSettings__sqlServer__connectionString: ENC[AES256_GCM,data:mJxp4MXvqV4T+/J7O0XX6+Z4kmo4IVFYvUPEBU0uaJ3w0YNcqPps+LH9pgFNOjwBWCAQ8QxvCH9ul2uSiYGhy41YjLsQD4X/UF1Hhimezc3IrexCDFkXXl4WIACAZjpQf6morvx9+/v0EvdxofP7auWQ2BGcid4lHYxO78gEAvPaueS+L0TerqEpEnxS26r2uMLOe2w5L0hxBKGQyWmWPx8mTAJXTgTaXAvKLT2G97JNa9a5EQSAPuBoi95F+CkQBEwbo6uwrcJS6DTWQmNefEdZ1D7Abp50zlpJfC7Tuf54tjnHyGya9EWEwc32mTadqCto047ySvDNNB2jgrG97HXvnqOo4LGpZn9jYGJsJZjVFibiy2+WHzgxDmU=,iv:Nq4LIbSDzk9WurGEPojUfRe8WqEOGO4t7WnfyYoupVo=,tag:yV7w9j9gRKuAsgsnxncUtA==,type:str]
+  #ENC[AES256_GCM,data:r7/63ugBvNNcFQGkau56LkG5lNH0NwvuA0OiRj0FOjAWlbf6sR7v5JOgIy97uMC+mBWy8A+OGZFO8p4bosrdrmzuomArHNnM4oWN498=,iv:2TaG5UkIEjLwPQpEZjOJdEviNNnSVi/e1lUUckJ+KqM=,tag:BPd/IOSUJvS1/mgPqqSlyQ==,type:comment]
+sops:
+  kms: []
+  gcp_kms: []
+  azure_kv: []
+  hc_vault: []
+  age:
+    - recipient: age19nu7uf8dageqlmzk23x7vl24fpn0l7cq20l3l4xxf2sk2xd5h98qss437p
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFRGFTc01qRmdlMzZ0WE53
+        OWtoUzBaMUp4T3FoYnJuVGhGODVna1RHYkRZCk0xWEVjOWp2YW9NZmE0MnNFYnJX
+        OEdHbkdsOWM4Tk44aTRVZ0VoNWorWDAKLS0tIHp2SE9Wd1lmTmV2eUFYRmRYNDZn
+        NFR5QkpIaFQ5Tk1FdGV3aUtzNTZsRXcKyNl9cFicgjcTiGkoQK/StLd7FEHGUVWD
+        hs8+h4ak+r++3+KpUay4aNqY09RtAzvUd4Vl3VQ2tYt/TOlDrgErHQ==
+        -----END AGE ENCRYPTED FILE-----
+  lastmodified: "2024-11-29T17:22:46Z"
+  mac: ENC[AES256_GCM,data:+KthNzUdXl/XgnupjWiEdk8EHvHldUvUwfWT7FNpR+Pysl/fdI1fAK02rXOlY0ABCKpejSIobHipy3RkxTXiF6PPGTC4R0aoqxRvZjyXDCUaHc3F4KdYBH4vkGoBchosHJnOX0qymSEGbzJERRSjxEZ3JDg0JRIEB8jQtObGivs=,iv:w7XSWHs1RaDAuxsImvxDHo96T6qwaaYlXGZUP2nfqLg=,tag:QNSjFrABn8tf8nQlu5MXkw==,type:str]
+  pgp: []
+  encrypted_regex: ^(data|stringData)$
+  version: 3.9.1