Aner Zakobar
559 lines
15 KiB
YAML
559 lines
15 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: ldap-pvc
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
resources:
|
|
requests:
|
|
storage: 100Mi
|
|
storageClassName: longhorn
|
|
---
|
|
{{- $_ := set $ "homey_openldap_admin" (include "homey.lookuporgensecret" (merge (dict "secretname" "openldap-admin") $))}}
|
|
{{ include "homey.randomsecret" (merge (dict "secretname" "openldap-admin" "secretval" .homey_openldap_admin) $) }}
|
|
# ---
|
|
{{- $_ := set $ "homey_openldap_config" (include "homey.lookuporgensecret" (merge (dict "secretname" "openldap-config") $))}}
|
|
{{ include "homey.randomsecret" (merge (dict "secretname" "openldap-config" "secretval" .homey_openldap_config) $) }}
|
|
# ---
|
|
{{- $_ := set $ "homey_openldap_ro" (include "homey.lookuporgensecret" (merge (dict "secretname" "openldap-ro") $))}}
|
|
{{ include "homey.randomsecret" (merge (dict "secretname" "openldap-ro" "secretval" .homey_openldap_ro) $) }}
|
|
---
|
|
{{- $_ := set $ "homey_authelia_jwt" (include "homey.lookuporgensecret" (merge (dict "secretname" "authelia-jwt") $))}}
|
|
{{ include "homey.randomsecret" (merge (dict "secretname" "authelia-jwt" "secretval" .homey_authelia_jwt) $) }}
|
|
---
|
|
{{- $_ := set $ "homey_authelia_session" (include "homey.lookuporgensecret" (merge (dict "secretname" "authelia-session") $))}}
|
|
{{ include "homey.randomsecret" (merge (dict "secretname" "authelia-session" "secretval" .homey_authelia_session) $) }}
|
|
---
|
|
{{- $_ := set $ "homey_authelia_encryption_key" (include "homey.lookuporgensecret" (merge (dict "secretname" "authelia-encryption-key") $))}}
|
|
{{ include "homey.randomsecret" (merge (dict "secretname" "authelia-encryption-key" "secretval" .homey_authelia_encryption_key) $) }}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: openldap
|
|
labels:
|
|
app.kubernetes.io/name: openldap
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: openldap
|
|
replicas: 1
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: openldap
|
|
spec:
|
|
# securityContext:
|
|
# fsGroup: 0
|
|
containers:
|
|
- name: openldap
|
|
image: osixia/openldap
|
|
env:
|
|
- name: LDAP_ORGANISATION
|
|
value: {{ .Values.homey.organization }}
|
|
- name: LDAP_DOMAIN
|
|
value: {{ .Values.homey.url | quote}}
|
|
- name: LDAP_ADMIN_USERNAME
|
|
value: "admin"
|
|
- name: LDAP_READONLY_USER
|
|
value: "true"
|
|
- name: LDAP_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: password
|
|
name: openldap-admin
|
|
- name: LDAP_CONFIG_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: password
|
|
name: openldap-config
|
|
- name: LDAP_READONLY_USER_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: password
|
|
name: openldap-ro
|
|
ports:
|
|
- name: tcp-ldap
|
|
containerPort: 389
|
|
- name: ssl-ldap
|
|
containerPort: 636
|
|
volumeMounts:
|
|
- mountPath: /etc/ldap/slapd.d
|
|
subPath: openldap/etc/ldap/slapd.d
|
|
name: openldap-volume
|
|
- mountPath: /var/lib/ldap
|
|
subPath: openldap/var/lib/ldap
|
|
name: openldap-volume
|
|
volumes:
|
|
- name: openldap-volume
|
|
persistentVolumeClaim:
|
|
claimName: ldap-pvc
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: openldap
|
|
labels:
|
|
app.kubernetes.io/name: openldap
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- name: tcp-ldap
|
|
port: 389
|
|
targetPort: tcp-ldap
|
|
- name: ssl-ldap
|
|
port: 636
|
|
targetPort: ssl-ldap
|
|
selector:
|
|
app.kubernetes.io/name: openldap
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: authelia-conf
|
|
data:
|
|
configuration.yml: |-
|
|
{{ tpl (.Files.Get "files/authelia-config.yaml" | indent 4) . }}
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: authelia-pvc
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
resources:
|
|
requests:
|
|
storage: 100Mi
|
|
storageClassName: longhorn
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: authelia
|
|
labels:
|
|
app.kubernetes.io/name: authelia
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: authelia
|
|
replicas: 1
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: authelia
|
|
spec:
|
|
enableServiceLinks: false
|
|
containers:
|
|
- name: authelia
|
|
image: authelia/authelia
|
|
imagePullPolicy: "IfNotPresent"
|
|
env:
|
|
- name: TZ
|
|
value: "Jerusalem/Israel"
|
|
ports:
|
|
- name: tcp
|
|
containerPort: 9091
|
|
volumeMounts:
|
|
- mountPath: /config/configuration.yml
|
|
name: authelia-conf
|
|
subPath: configuration.yml
|
|
readOnly: true
|
|
- mountPath: /config
|
|
subPath: authelia/config
|
|
name: authelia-volume
|
|
volumes:
|
|
- name: authelia-conf
|
|
configMap:
|
|
name: authelia-conf
|
|
items:
|
|
- key: configuration.yml
|
|
path: configuration.yml
|
|
- name: authelia-volume
|
|
persistentVolumeClaim:
|
|
claimName: authelia-pvc
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: authelia
|
|
labels:
|
|
app.kubernetes.io/name: authelia
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- name: tcp
|
|
port: 9091
|
|
targetPort: tcp
|
|
selector:
|
|
app.kubernetes.io/name: authelia
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: authelia
|
|
spec:
|
|
ingressClassName: {{ .Values.homey.ingress_class }}
|
|
tls:
|
|
- hosts:
|
|
- auth.{{ .Values.homey.url }}
|
|
secretName: {{ .Values.homey.certname }}
|
|
rules:
|
|
- host: auth.{{ .Values.homey.url }}
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: authelia
|
|
port:
|
|
number: 9091
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: gitea-pvc
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
resources:
|
|
requests:
|
|
storage: 5Gi
|
|
storageClassName: longhorn
|
|
---
|
|
{{- $_ := set $ "homey_gitea_admin_pass" (include "homey.lookuporgensecret" (merge (dict "secretname" "gitea-admin-pass") $))}}
|
|
{{ include "homey.randomsecret" (merge (dict "secretname" "gitea-admin-pass" "secretval" .homey_gitea_admin_pass) $) }}
|
|
---
|
|
{{- $_ := set $ "homey_gitea_lfs_jwt_secret" (include "homey.lookuporgensecret" (merge (dict "secretname" "gitea-lfs-jwt-secret") $))}}
|
|
{{ include "homey.randomsecret" (merge (dict "secretname" "gitea-lfs-jwt-secret" "secretval" .homey_gitea_lfs_jwt_secret) $) }}
|
|
---
|
|
{{- $_ := set $ "homey_gitea_oauth2_jwt_secret" (include "homey.lookuporgensecret" (merge (dict "secretname" "gitea-oauth2-jwt-secret") $))}}
|
|
{{ include "homey.randomsecret" (merge (dict "secretname" "gitea-oauth2-jwt-secret" "secretval" .homey_gitea_oauth2_jwt_secret) $) }}
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: gitea-random-internal-token
|
|
annotations:
|
|
"helm.sh/resource-policy": "keep"
|
|
type: Opaque
|
|
data:
|
|
{{- $secretObj := (lookup "v1" "Secret" .Release.Namespace "gitea-random-internal-token") | default dict -}}
|
|
{{- $secretData := (get $secretObj "data") | default dict -}}
|
|
{{- $pass := (get $secretData "password") | default (randAlphaNum 100 | b64enc) -}}
|
|
{{- $_ := set $ "homey_gitea_random_internal_token" ($pass | b64dec) }}
|
|
password: {{ $pass | quote }}
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: gitea-conf
|
|
data:
|
|
app.ini: |-
|
|
{{ tpl (.Files.Get "files/gitea-app.ini" | indent 4) . }}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: gitea
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: gitea
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: gitea
|
|
spec:
|
|
containers:
|
|
- name: gitea
|
|
image: gitea/gitea:latest
|
|
ports:
|
|
- containerPort: 3000
|
|
name: http
|
|
volumeMounts:
|
|
- name: gitea-persistent-storage
|
|
mountPath: /data
|
|
subPath: gitea/gitea/data
|
|
- name: gitea-conf
|
|
mountPath: /data/gitea/conf/app.ini
|
|
subPath: app.ini
|
|
readOnly: true
|
|
# startProbe:
|
|
# httpGet:
|
|
# path: /
|
|
# port: 3000
|
|
# initialDelaySeconds: 15
|
|
# lifecycle:
|
|
# postStart:
|
|
# exec:
|
|
# {{- $gitea_cmd := (printf "gitea admin auth add-ldap --name ldap --security-protocol unencrypted --host ldap --port 389 --user-search-base ou=users,%s --user-filter \\\"(&(objectClass=inetOrgPerson)(|(uid=%[1]s)(mail=kk[1]s)))\\\" --email-attribute mail --bind-dn=\\\"cn=readonly,%s\\\" --bind-password=\\\"%s\\\"" ( .Values.homey.url | replace "." ",dc=" | printf "dc=%s " | trim) ( .Values.homey.url | replace "." ",dc=" | printf "dc=%s " | trim) (.homey_openldap_ro | replace "\"" ""))}}
|
|
# command: ["/bin/sh", "-c", "{{$gitea_cmd}}"]
|
|
volumes:
|
|
- name: gitea-persistent-storage
|
|
persistentVolumeClaim:
|
|
claimName: gitea-pvc
|
|
- name: gitea-conf
|
|
configMap:
|
|
name: gitea-conf
|
|
items:
|
|
- key: app.ini
|
|
path: app.ini
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: gitea-svc
|
|
spec:
|
|
selector:
|
|
app: gitea
|
|
ports:
|
|
- name: http-port
|
|
protocol: TCP
|
|
port: 3000
|
|
targetPort: http
|
|
selector:
|
|
app: gitea
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: gitea-ingress
|
|
spec:
|
|
ingressClassName: {{ .Values.homey.ingress_class }}
|
|
tls:
|
|
- hosts:
|
|
- git.{{ .Values.homey.url }}
|
|
secretName: {{ .Values.homey.certname }}
|
|
rules:
|
|
- host: git.{{ .Values.homey.url }}
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: gitea-svc
|
|
port:
|
|
number: 3000
|
|
---
|
|
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: davical-postgres-pvc
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
resources:
|
|
requests:
|
|
storage: 1Gi
|
|
storageClassName: longhorn
|
|
|
|
---
|
|
{{- $_ := set $ "homey_davical_postgres_pass" (include "homey.lookuporgensecret" (merge (dict "secretname" "davical-postgres-pass") $))}}
|
|
{{ include "homey.randomsecret" (merge (dict "secretname" "davical-postgres-pass" "secretval" .homey_davical_postgres_pass) $) }}
|
|
---
|
|
# apiVersion: extensions/v1beta1
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: davical-postgres-config
|
|
labels:
|
|
app: davical-postgres
|
|
data:
|
|
POSTGRES_DB: postgres
|
|
POSTGRES_USER: postgres
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: davical-postgres
|
|
labels:
|
|
app: davical-postgres
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: davical-postgres
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: davical-postgres
|
|
name: davical-postgres
|
|
spec:
|
|
containers:
|
|
- name: davical-postgres
|
|
image: postgres:10.4
|
|
imagePullPolicy: "IfNotPresent"
|
|
ports:
|
|
- containerPort: 5432
|
|
envFrom:
|
|
- configMapRef:
|
|
name: davical-postgres-config
|
|
env:
|
|
- name: POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: davical-postgres-pass
|
|
key: password
|
|
volumeMounts:
|
|
- mountPath: /var/lib/postgresql/data
|
|
subPath: data
|
|
name: davical-postgredb
|
|
volumes:
|
|
- name: davical-postgredb
|
|
persistentVolumeClaim:
|
|
claimName: davical-postgres-pvc
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: davical-postgres
|
|
labels:
|
|
app: davical-postgres
|
|
spec:
|
|
ports:
|
|
- port: 5432
|
|
selector:
|
|
app: davical-postgres
|
|
---
|
|
{{- $_ := set $ "homey_davical_admin_pass" (include "homey.lookuporgensecret" (merge (dict "secretname" "davical-admin-pass") $))}}
|
|
{{ include "homey.randomsecret" (merge (dict "secretname" "davical-admin-pass" "secretval" .homey_davical_admin_pass) $) }}
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: davical-conf
|
|
data:
|
|
config.php: |-
|
|
{{ tpl (.Files.Get "files/davical-config.php" | indent 4) . }}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: davical
|
|
labels:
|
|
app: davical
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: davical
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: davical
|
|
spec:
|
|
containers:
|
|
- name: davical
|
|
image: anerisgreat/davical-multiarch-docker:latest
|
|
imagePullPolicy: "Always"
|
|
ports:
|
|
- containerPort: 80
|
|
name: dav
|
|
env:
|
|
- name: PGHOST
|
|
value: "davical-postgres"
|
|
- name: PGUSER
|
|
value: "postgres"
|
|
- name: PGPASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: davical-postgres-pass
|
|
key: password
|
|
- name: PGDATABASE
|
|
value: "davical"
|
|
- name: PGPORT
|
|
value: "5432"
|
|
- name: HOST_NAME
|
|
value:
|
|
"dav.{{ .Values.homey.url }}"
|
|
- name: DAVICAL_ADMIN_PASS
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: davical-admin-pass
|
|
key: password
|
|
- name: ROOT_PGUSER
|
|
value: "postgres"
|
|
- name: ROOT_PGPASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: davical-postgres-pass
|
|
key: password
|
|
- name: RUN_MIGRATIONS_AT_STARTUP
|
|
value: "true"
|
|
volumeMounts:
|
|
- name: davical-conf
|
|
mountPath: /etc/davical/config.php
|
|
subPath: config.php
|
|
readOnly: true
|
|
volumes:
|
|
- name: davical-conf
|
|
configMap:
|
|
name: davical-conf
|
|
items:
|
|
- key: config.php
|
|
path: config.php
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: davical
|
|
spec:
|
|
selector:
|
|
app: davical
|
|
ports:
|
|
- name: dav
|
|
protocol: TCP
|
|
port: 80
|
|
targetPort: 80
|
|
selector:
|
|
app: davical
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: davical
|
|
annotations:
|
|
kubernetes.io/ingress.allow-http: "false"
|
|
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
|
nginx.ingress.kubernetes.io/auth-method: GET
|
|
nginx.ingress.kubernetes.io/auth-url: http://authelia.{{ .Release.Namespace }}.svc.cluster.local:9091/api/verify
|
|
nginx.ingress.kubernetes.io/auth-signin: https://auth.{{ .Values.homey.url }}?rm=$request_method
|
|
nginx.ingress.kubernetes.io/auth-response-headers: Remote-User,Remote-Name,Remote-Groups,Remote-Email
|
|
nginx.ingress.kubernetes.io/auth-snippet: |
|
|
proxy_set_header X-Forwarded-Method $request_method;
|
|
auth_request_set $user $upstream_http_remote_user;
|
|
auth_request_set $groups $upstream_http_remote_groups;
|
|
auth_request_set $name $upstream_http_remote_name;
|
|
auth_request_set $email $upstream_http_remote_email;
|
|
proxy_set_header Remote-User $user;
|
|
proxy_set_header Remote-Fullname $name;
|
|
proxy_set_header Remote-Email $email;
|
|
proxy_set_header Redirect-Remote-User $user;
|
|
proxy_set_header Redirect-Remote-Fullname $name;
|
|
proxy_set_header Redirect-Remote-Email $email;
|
|
spec:
|
|
ingressClassName: {{ .Values.homey.ingress_class }}
|
|
tls:
|
|
- hosts:
|
|
- dav.{{ .Values.homey.url }}
|
|
secretName: {{ .Values.homey.certname }}
|
|
rules:
|
|
- host: dav.{{ .Values.homey.url }}
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: davical
|
|
port:
|
|
number: 80
|
|
---
|