AUTHENTICATION BABYYYY
This commit is contained in:
Aner Zakobar
@@ -1,32 +1,20 @@
|
||||
---
|
||||
{{- define "homey.lookuporgensecret" -}}
|
||||
{{- $secretObj := (lookup "v1" "Secret" .Release.Namespace .secretname ) | default dict -}}
|
||||
{{- $secretData := (get $secretObj "data") | default dict -}}
|
||||
{{- $ret := (get $secretData "password" | b64dec ) | default (randAlphaNum 32 ) -}}
|
||||
{{ $ret -}}
|
||||
{{- end -}}
|
||||
---
|
||||
{{- define "homey.randomsecret"}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ .secretname }}
|
||||
name: {{ (replace "\"" "" .secretname ) }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- $secretObj := (lookup "v1" "Secret" .Release.Namespace (.secretname | quote)) | default dict }}
|
||||
{{- $secretData := (get $secretObj "data") | default dict }}
|
||||
{{- $pass := (get $secretData "password") | default (randAlphaNum 32 | b64enc) }}
|
||||
password: {{ $pass | quote }}
|
||||
password: {{ .secretval | b64enc | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "homey.lookuprandomsecret" -}}
|
||||
{{- $secretObj := (lookup "v1" "Secret" .Release.Namespace (.secretname | quote)) | default dict -}}
|
||||
{{- $secretData := (get $secretObj "data") | default dict -}}
|
||||
{{- $pass := (get $secretData "password") | default "UNDEFINED" -}}
|
||||
{{- $pass | quote -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- /*
|
||||
Returns given number of random Hex characters.
|
||||
- randNumeric 4 | atoi generates a random number in [0, 10^4)
|
||||
This is a range range evenly divisble by 16, but even if off by one,
|
||||
that last partial interval offsetting randomness is only 1 part in 625.
|
||||
- mod N 16 maps to the range 0-15
|
||||
- printf "%x" represents a single number 0-15 as a single hex character
|
||||
*/}}
|
||||
---
|
||||
{{- define "homey.randHex"}}
|
||||
{{- $result := "" }}
|
||||
|
||||
+249
-187
@@ -1,4 +1,4 @@
|
||||
---
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
@@ -11,34 +11,23 @@ spec:
|
||||
storage: 100Mi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
{{- define "homey.auth.ingress.annotations" }}
|
||||
# nginx.ingress.kubernetes.io/auth-signin: "https://auth.zakobar.com"
|
||||
nginx.ingress.kubernetes.io/auth-url: "http://ldap-auth-internal.{{ .Release.Namespace }}.svc.cluster.local:80"
|
||||
nginx.ingress.kubernetes.io/auth-response-headers: Remote-User,Remote-Name,Remote-Email
|
||||
nginx.ingress.kubernetes.io/location-snippets: |-
|
||||
auth_request /auth
|
||||
nginx.ingress.kubernetes.io/configuration-snippet: |-
|
||||
location /auth {
|
||||
# proxy_pass http://ldap-auth-internal;
|
||||
proxy_pass_request_body off;
|
||||
proxy_set_header X-Target http://ldap-auth-internal.{{ .Release.Namespace }}.svc.cluster.local:80;
|
||||
proxy_set_header X-Ldap-URL "ldap://openldap";
|
||||
proxy_set_header X-Ldap-BaseDN "ou=users,{{ .Values.homey.url | replace "." ",dc=" | printf "dc=%s " | trim }}";
|
||||
proxy_set_header X-Ldap-BindDN "cn=readonly,{{ .Values.homey.url | replace "." ",dc=" | printf "dc=%s " | trim }}";
|
||||
proxy_set_header X-Ldap-BindPass {{ (get (get (lookup "v1" "Secret" .Release.Namespace "openldap-ro") "data") "password") | b64dec | quote}};
|
||||
proxy_set_header X-CookieName "homey.auth.cookie";
|
||||
proxy_set_header Cookie $cookie_homey.auth.cookie;
|
||||
proxy_set_header X-Remote-User $remote_user;
|
||||
proxy_set_header X-Forwarded-Method $request_method;
|
||||
proxy_set_header X-Ldap-Template "(uid=%(username)s)";
|
||||
}
|
||||
{{- end }}
|
||||
{{- $_ := set $ "homey_openldap_admin" (include "homey.lookuporgensecret" (merge (dict "secretname" "openldap-admin") $))}}
|
||||
{{ include "homey.randomsecret" (merge (dict "secretname" "openldap-admin" "secretval" .homey_openldap_admin) $) }}
|
||||
# ---
|
||||
{{- $_ := set $ "homey_openldap_config" (include "homey.lookuporgensecret" (merge (dict "secretname" "openldap-config") $))}}
|
||||
{{ include "homey.randomsecret" (merge (dict "secretname" "openldap-config" "secretval" .homey_openldap_config) $) }}
|
||||
# ---
|
||||
{{- $_ := set $ "homey_openldap_ro" (include "homey.lookuporgensecret" (merge (dict "secretname" "openldap-ro") $))}}
|
||||
{{ include "homey.randomsecret" (merge (dict "secretname" "openldap-ro" "secretval" .homey_openldap_ro) $) }}
|
||||
---
|
||||
{{ template "homey.randomsecret" (merge (dict "secretname" "openldap-admin") $) }}
|
||||
# ---
|
||||
{{ template "homey.randomsecret" (merge (dict "secretname" "openldap-config") $) }}
|
||||
# ---
|
||||
{{ template "homey.randomsecret" (merge (dict "secretname" "openldap-ro") $) }}
|
||||
{{- $_ := set $ "homey_authelia_jwt" (include "homey.lookuporgensecret" (merge (dict "secretname" "authelia-jwt") $))}}
|
||||
{{ include "homey.randomsecret" (merge (dict "secretname" "authelia-jwt" "secretval" .homey_authelia_jwt) $) }}
|
||||
---
|
||||
{{- $_ := set $ "homey_authelia_session" (include "homey.lookuporgensecret" (merge (dict "secretname" "authelia-session") $))}}
|
||||
{{ include "homey.randomsecret" (merge (dict "secretname" "authelia-session" "secretval" .homey_authelia_session) $) }}
|
||||
---
|
||||
{{- $_ := set $ "homey_authelia_encryption_key" (include "homey.lookuporgensecret" (merge (dict "secretname" "authelia-encryption-key") $))}}
|
||||
{{ include "homey.randomsecret" (merge (dict "secretname" "authelia-encryption-key" "secretval" .homey_authelia_encryption_key) $) }}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
@@ -121,163 +110,236 @@ spec:
|
||||
selector:
|
||||
app.kubernetes.io/name: openldap
|
||||
---
|
||||
# ---
|
||||
# apiVersion: v1
|
||||
# kind: ConfigMap
|
||||
# metadata:
|
||||
# name: keycloak-postgres-config
|
||||
# labels:
|
||||
# app: keycloak-postgres
|
||||
# data:
|
||||
# POSTGRES_DB: keycloak-db
|
||||
# POSTGRES_USER: keycloak-admin
|
||||
# ---
|
||||
# apiVersion: apps/v1
|
||||
# kind: Deployment
|
||||
# metadata:
|
||||
# name: keycloak-postgres
|
||||
# labels:
|
||||
# app: keycloak-postgres
|
||||
# spec:
|
||||
# replicas: 1
|
||||
# selector:
|
||||
# matchLabels:
|
||||
# app: keycloak-postgres
|
||||
# template:
|
||||
# metadata:
|
||||
# labels:
|
||||
# app: keycloak-postgres
|
||||
# name: keycloak-postgres
|
||||
# spec:
|
||||
# containers:
|
||||
# - name: postgres
|
||||
# image: postgres:10.4
|
||||
# imagePullPolicy: "IfNotPresent"
|
||||
# ports:
|
||||
# - containerPort: 5432
|
||||
# envFrom:
|
||||
# - configMapRef:
|
||||
# name: keycloak-postgres-config
|
||||
# env:
|
||||
# - name: POSTGRES_PASSWORD
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: keycloak-db-pass
|
||||
# key: password
|
||||
# volumeMounts:
|
||||
# - mountPath: /var/lib/postgresql/data
|
||||
# subPath: keycloak/db/data
|
||||
# name: keycloak-postgresdb
|
||||
# volumes:
|
||||
# - name: keycloak-postgresdb
|
||||
# persistentVolumeClaim:
|
||||
# claimName: homey-pvc-longhorn
|
||||
# ---
|
||||
# apiVersion: v1
|
||||
# kind: Service
|
||||
# metadata:
|
||||
# name: keycloak-postgres-service
|
||||
# labels:
|
||||
# app: keycloak-postgres
|
||||
# spec:
|
||||
# ports:
|
||||
# - port: 5432
|
||||
# selector:
|
||||
# app: keycloak-postgres
|
||||
# ---
|
||||
# apiVersion: apps/v1
|
||||
# kind: Deployment
|
||||
# metadata:
|
||||
# name: keycloak
|
||||
# labels:
|
||||
# app: keycloak
|
||||
# spec:
|
||||
# replicas: 1
|
||||
# selector:
|
||||
# matchLabels:
|
||||
# app: keycloak
|
||||
# template:
|
||||
# metadata:
|
||||
# labels:
|
||||
# app: keycloak
|
||||
# spec:
|
||||
# containers:
|
||||
# - name: keycloak
|
||||
# image: mihaibob/keycloak:18.0.2-legacy
|
||||
# env:
|
||||
# - name: KEYCLOAK_USER
|
||||
# value: "admin"
|
||||
# - name: KEYCLOAK_PASSWORD
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: keycloak-pass
|
||||
# key: password
|
||||
# - name: PROXY_ADDRESS_FORWARDING
|
||||
# value: "true"
|
||||
# - name: DB_ADDR
|
||||
# value: keycloak-postgres-service
|
||||
# - name: DB_DATABASE
|
||||
# value: "keycloak-db"
|
||||
# - name: DB_VENDOR
|
||||
# value: postgres
|
||||
# - name: DB_USER
|
||||
# value: keycloak-admin
|
||||
# - name: DB_PASSWORD
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: keycloak-db-pass
|
||||
# key: password
|
||||
# ports:
|
||||
# - name: http
|
||||
# containerPort: 8080
|
||||
# readinessProbe:
|
||||
# failureThreshold: 3
|
||||
# httpGet:
|
||||
# path: /auth/realms/master/
|
||||
# port: http
|
||||
# initialDelaySeconds: 240
|
||||
# timeoutSeconds: 240
|
||||
# livenessProbe:
|
||||
# failureThreshold: 3
|
||||
# httpGet:
|
||||
# path: /auth/
|
||||
# port: http
|
||||
# initialDelaySeconds: 240
|
||||
# timeoutSeconds: 240
|
||||
# ---
|
||||
# apiVersion: v1
|
||||
# kind: Service
|
||||
# metadata:
|
||||
# name: keycloak-web
|
||||
# labels:
|
||||
# app: keycloak
|
||||
# spec:
|
||||
# ports:
|
||||
# - name: http
|
||||
# port: 8080
|
||||
# targetPort: http
|
||||
# selector:
|
||||
# app: keycloak
|
||||
# ---
|
||||
# apiVersion: networking.k8s.io/v1
|
||||
# kind: Ingress
|
||||
# metadata:
|
||||
# name: keycloak
|
||||
# spec:
|
||||
# ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
# tls:
|
||||
# - hosts:
|
||||
# - keycloak.{{ .Values.homey.url }}
|
||||
# secretName: {{ .Values.homey.certname }}
|
||||
# rules:
|
||||
# - host: keycloak.{{ .Values.homey.url }}
|
||||
# http:
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
# backend:
|
||||
# service:
|
||||
# name: keycloak-web
|
||||
# port:
|
||||
# number: 8080
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: authelia-conf
|
||||
data:
|
||||
configuration.yml: |-
|
||||
{{ tpl (.Files.Get "files/authelia-config.yaml" | indent 4) . }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: authelia-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 100Mi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: authelia
|
||||
labels:
|
||||
app.kubernetes.io/name: authelia
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: authelia
|
||||
replicas: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: authelia
|
||||
spec:
|
||||
enableServiceLinks: false
|
||||
containers:
|
||||
- name: authelia
|
||||
image: authelia/authelia
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
env:
|
||||
- name: TZ
|
||||
value: "Jerusalem/Israel"
|
||||
ports:
|
||||
- name: tcp
|
||||
containerPort: 9091
|
||||
volumeMounts:
|
||||
- mountPath: /config/configuration.yml
|
||||
name: authelia-conf
|
||||
subPath: configuration.yml
|
||||
readOnly: true
|
||||
- mountPath: /config
|
||||
subPath: authelia/config
|
||||
name: authelia-volume
|
||||
volumes:
|
||||
- name: authelia-conf
|
||||
configMap:
|
||||
name: authelia-conf
|
||||
items:
|
||||
- key: configuration.yml
|
||||
path: configuration.yml
|
||||
- name: authelia-volume
|
||||
persistentVolumeClaim:
|
||||
claimName: authelia-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: authelia
|
||||
labels:
|
||||
app.kubernetes.io/name: authelia
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: tcp
|
||||
port: 9091
|
||||
targetPort: tcp
|
||||
selector:
|
||||
app.kubernetes.io/name: authelia
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: authelia
|
||||
spec:
|
||||
ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
tls:
|
||||
- hosts:
|
||||
- auth.{{ .Values.homey.url }}
|
||||
secretName: {{ .Values.homey.certname }}
|
||||
rules:
|
||||
- host: auth.{{ .Values.homey.url }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: authelia
|
||||
port:
|
||||
number: 9091
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: gitea-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
{{- $_ := set $ "homey_gitea_admin_pass" (include "homey.lookuporgensecret" (merge (dict "secretname" "gitea-admin-pass") $))}}
|
||||
{{ include "homey.randomsecret" (merge (dict "secretname" "gitea-admin-pass" "secretval" .homey_gitea_admin_pass) $) }}
|
||||
---
|
||||
{{- $_ := set $ "homey_gitea_lfs_jwt_secret" (include "homey.lookuporgensecret" (merge (dict "secretname" "gitea-lfs-jwt-secret") $))}}
|
||||
{{ include "homey.randomsecret" (merge (dict "secretname" "gitea-lfs-jwt-secret" "secretval" .homey_gitea_lfs_jwt_secret) $) }}
|
||||
---
|
||||
{{- $_ := set $ "homey_gitea_oauth2_jwt_secret" (include "homey.lookuporgensecret" (merge (dict "secretname" "gitea-oauth2-jwt-secret") $))}}
|
||||
{{ include "homey.randomsecret" (merge (dict "secretname" "gitea-oauth2-jwt-secret" "secretval" .homey_gitea_oauth2_jwt_secret) $) }}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: gitea-random-internal-token
|
||||
annotations:
|
||||
"helm.sh/resource-policy": "keep"
|
||||
type: Opaque
|
||||
data:
|
||||
{{- $secretObj := (lookup "v1" "Secret" .Release.Namespace "gitea-random-internal-token") | default dict -}}
|
||||
{{- $secretData := (get $secretObj "data") | default dict -}}
|
||||
{{- $pass := (get $secretData "password") | default (randAlphaNum 100 | b64enc) -}}
|
||||
{{- $_ := set $ "homey_gitea_random_internal_token" ($pass | b64dec) }}
|
||||
password: {{ $pass | quote }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: gitea-conf
|
||||
data:
|
||||
app.ini: |-
|
||||
{{ tpl (.Files.Get "files/gitea-app.ini" | indent 4) . }}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: gitea
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: gitea
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: gitea
|
||||
spec:
|
||||
containers:
|
||||
- name: gitea
|
||||
image: gitea/gitea:latest
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
volumeMounts:
|
||||
- name: gitea-persistent-storage
|
||||
mountPath: /data
|
||||
subPath: gitea/gitea/data
|
||||
- name: gitea-conf
|
||||
mountPath: /data/gitea/conf/app.ini
|
||||
subPath: app.ini
|
||||
readOnly: true
|
||||
# startProbe:
|
||||
# httpGet:
|
||||
# path: /
|
||||
# port: 3000
|
||||
# initialDelaySeconds: 15
|
||||
# lifecycle:
|
||||
# postStart:
|
||||
# exec:
|
||||
# {{- $gitea_cmd := (printf "gitea admin auth add-ldap --name ldap --security-protocol unencrypted --host ldap --port 389 --user-search-base ou=users,%s --user-filter \\\"(&(objectClass=inetOrgPerson)(|(uid=%[1]s)(mail=%[1]s)))\\\" --email-attribute mail --bind-dn=\\\"cn=readonly,%s\\\" --bind-password=\\\"%s\\\"" ( .Values.homey.url | replace "." ",dc=" | printf "dc=%s " | trim) ( .Values.homey.url | replace "." ",dc=" | printf "dc=%s " | trim) (.homey_openldap_ro | replace "\"" ""))}}
|
||||
# command: ["/bin/sh", "-c", "{{$gitea_cmd}}"]
|
||||
volumes:
|
||||
- name: gitea-persistent-storage
|
||||
persistentVolumeClaim:
|
||||
claimName: gitea-pvc
|
||||
- name: gitea-conf
|
||||
configMap:
|
||||
name: gitea-conf
|
||||
items:
|
||||
- key: app.ini
|
||||
path: app.ini
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: gitea-svc
|
||||
spec:
|
||||
selector:
|
||||
app: gitea
|
||||
ports:
|
||||
- name: http-port
|
||||
protocol: TCP
|
||||
port: 3000
|
||||
targetPort: http
|
||||
selector:
|
||||
app: gitea
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: gitea-ingress
|
||||
spec:
|
||||
ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
tls:
|
||||
- hosts:
|
||||
- git.{{ .Values.homey.url }}
|
||||
secretName: {{ .Values.homey.certname }}
|
||||
rules:
|
||||
- host: git.{{ .Values.homey.url }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: gitea-svc
|
||||
port:
|
||||
number: 3000
|
||||
---
|
||||
|
||||
@@ -1,92 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: gitea-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: gitea-admin-pass
|
||||
annotations:
|
||||
"helm.sh/resource-policy": "keep"
|
||||
type: Opaque
|
||||
data:
|
||||
{{- $secretObj := (lookup "v1" "Secret" .Release.Namespace "gitea-admin-pass") | default dict -}}
|
||||
{{- $secretData := (get $secretObj "data") | default dict -}}
|
||||
{{- $pass := (get $secretData "password") | default (randAlphaNum 32 | b64enc) -}}
|
||||
password: {{ $pass | quote }}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: gitea
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: gitea
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: gitea
|
||||
spec:
|
||||
containers:
|
||||
- name: gitea
|
||||
image: gitea/gitea:latest
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
volumeMounts:
|
||||
- name: gitea-persistent-storage
|
||||
mountPath: /data
|
||||
subPath: gitea/gitea/data
|
||||
volumes:
|
||||
- name: gitea-persistent-storage
|
||||
persistentVolumeClaim:
|
||||
claimName: gitea-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: gitea-svc
|
||||
spec:
|
||||
selector:
|
||||
app: gitea
|
||||
ports:
|
||||
- name: http-port
|
||||
protocol: TCP
|
||||
port: 3000
|
||||
targetPort: http
|
||||
selector:
|
||||
app: gitea
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: gitea-ingress
|
||||
spec:
|
||||
ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
tls:
|
||||
- hosts:
|
||||
- git.{{ .Values.homey.url }}
|
||||
secretName: {{ .Values.homey.certname }}
|
||||
rules:
|
||||
- host: git.{{ .Values.homey.url }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: gitea-svc
|
||||
port:
|
||||
number: 3000
|
||||
---
|
||||
@@ -1,70 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: ldap-auth
|
||||
labels:
|
||||
app: ldap-auth
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ldap-auth
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: ldap-auth
|
||||
name: ldap-auth
|
||||
spec:
|
||||
containers:
|
||||
- name: ldap-auth
|
||||
image: linuxserver/ldap-auth
|
||||
imagePullPolicy: Always
|
||||
---
|
||||
#https://stackoverflow.com/questions/51149921/how-to-authenticate-nginx-with-ldap
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ldap-auth
|
||||
spec:
|
||||
selector:
|
||||
app: ldap-auth
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 9000
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ldap-auth-internal
|
||||
spec:
|
||||
selector:
|
||||
app: ldap-auth
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 8888
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: ldap-auth-ingress
|
||||
annotations:
|
||||
spec:
|
||||
ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
tls:
|
||||
- hosts:
|
||||
- auth.{{ .Values.homey.url }}
|
||||
secretName: {{ .Values.homey.certname }}
|
||||
rules:
|
||||
- host: auth.{{ .Values.homey.url }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: ldap-auth
|
||||
port:
|
||||
number: 80
|
||||
---
|
||||
|
||||
@@ -1,206 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: nextcloud-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 30Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: nextcloud-postgres-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: nextcloud-data-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 30Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: nextcloud-postgres-pass
|
||||
annotations:
|
||||
"helm.sh/resource-policy": "keep"
|
||||
type: Opaque
|
||||
data:
|
||||
{{- $secretObj := (lookup "v1" "Secret" .Release.Namespace "nextcloud-postgres-pass") | default dict }}
|
||||
{{- $secretData := (get $secretObj "data") | default dict }}
|
||||
{{- $pass := (get $secretData "password") | default (randAlphaNum 32 | b64enc) }}
|
||||
password: {{ $pass | quote }}
|
||||
---
|
||||
# apiVersion: extensions/v1beta1
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: nextcloud-postgres-config
|
||||
labels:
|
||||
app: nextcloud-postgres
|
||||
data:
|
||||
POSTGRES_DB: nextcloud_db
|
||||
POSTGRES_USER: postgres
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: nextcloud-postgres
|
||||
labels:
|
||||
app: nextcloud-postgres
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: nextcloud-postgres
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: nextcloud-postgres
|
||||
name: nextcloud-postgres
|
||||
spec:
|
||||
containers:
|
||||
- name: nextcloud-postgres
|
||||
image: postgres:10.4
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: nextcloud-postgres-config
|
||||
env:
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: nextcloud-postgres-pass
|
||||
key: password
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/postgresql/data
|
||||
subPath: nextcloud/db
|
||||
name: nextcloud-postgredb
|
||||
volumes:
|
||||
- name: nextcloud-postgredb
|
||||
persistentVolumeClaim:
|
||||
claimName: nextcloud-postgres-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: nextcloud-postgres
|
||||
labels:
|
||||
app: nextcloud-postgres
|
||||
spec:
|
||||
ports:
|
||||
- port: 5432
|
||||
selector:
|
||||
app: nextcloud-postgres
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: nextcloud
|
||||
labels:
|
||||
app: nextcloud
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: nextcloud
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: nextcloud
|
||||
name: nextcloud
|
||||
spec:
|
||||
containers:
|
||||
- name: nextcloud
|
||||
image: nextcloud
|
||||
imagePullPolicy: Always
|
||||
volumeMounts:
|
||||
- name: nextcloud-volume
|
||||
mountPath: "/var/www/html"
|
||||
subPath: nextcloud/html
|
||||
- name: nextcloud-media
|
||||
mountPath: "/var/www/html/data"
|
||||
subPath: nextcloud/html/data
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: nextcloud-postgres-config
|
||||
env:
|
||||
- name: POSTGRES_HOST
|
||||
value: "nextcloud-postgres"
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: nextcloud-postgres-pass
|
||||
key: password
|
||||
- name: OVERWRITEPROTOCOL
|
||||
value: "https"
|
||||
volumes:
|
||||
- name: nextcloud-volume
|
||||
persistentVolumeClaim:
|
||||
claimName: nextcloud-pvc
|
||||
- name: nextcloud-media
|
||||
persistentVolumeClaim:
|
||||
claimName: nextcloud-data-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: nextcloud
|
||||
spec:
|
||||
selector:
|
||||
app: nextcloud
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 80
|
||||
name: nextcloud
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: nextcloud-ingress
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: 5g
|
||||
nginx.ingress.kubernetes.io/server-snippet: |
|
||||
# Make a regex exception for `/.well-known` so that clients can still
|
||||
# access it despite the existence of the regex rule
|
||||
# `location ~ /(\.|autotest|...)` which would otherwise handle requests
|
||||
# for `/.well-known`.
|
||||
location = /.well-known/carddav { return 301 https://nextcloud.zakobar.com/remote.php/dav/; }
|
||||
location = /.well-known/caldav { return 301 https://nextcloud.zakobar.com/remote.php/dav/; }
|
||||
spec:
|
||||
ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
tls:
|
||||
- hosts:
|
||||
- nextcloud.{{ .Values.homey.url }}
|
||||
secretName: {{ .Values.homey.certname }}
|
||||
rules:
|
||||
- host: nextcloud.{{ .Values.homey.url }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: nextcloud
|
||||
port:
|
||||
number: 80
|
||||
---
|
||||
@@ -43,6 +43,22 @@ apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: phpldapadmin
|
||||
annotations:
|
||||
kubernetes.io/ingress.allow-http: "false"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/auth-method: GET
|
||||
nginx.ingress.kubernetes.io/auth-url: http://authelia.{{ .Release.Namespace }}.svc.cluster.local:9091/api/verify
|
||||
nginx.ingress.kubernetes.io/auth-signin: https://auth.{{ .Values.homey.url }}?rm=$request_method
|
||||
nginx.ingress.kubernetes.io/auth-response-headers: Remote-User,Remote-Name,Remote-Groups,Remote-Email
|
||||
nginx.ingress.kubernetes.io/auth-snippet: |
|
||||
proxy_set_header X-Forwarded-Method $request_method;
|
||||
auth_request_set $user $upstream_http_remote_user;
|
||||
auth_request_set $groups $upstream_http_remote_groups;
|
||||
auth_request_set $name $upstream_http_remote_name;
|
||||
auth_request_set $email $upstream_http_remote_email;
|
||||
proxy_set_header X-Webauth-User $user;
|
||||
proxy_set_header X-Webauth-Fullname $name;
|
||||
proxy_set_header X-Webauth-Email $email;
|
||||
spec:
|
||||
ingressClassName: {{ .Values.homey.ingress_class }}
|
||||
tls:
|
||||
|
||||
Reference in New Issue
Block a user