From 6c57c81082f5ac03de10c2bd5ace08e8cf40b3a6 Mon Sep 17 00:00:00 2001 From: Stavros Kois <47820033+stavros-k@users.noreply.github.com> Date: Sun, 27 Mar 2022 13:44:54 +0300 Subject: [PATCH] feat(technitium): add technitium (#2299) * feat(technitium): add technitium * move to incubator * lint * memo for more services * gui and ports * add 3 more ports and ingress for dns-https-proxy --- charts/incubator/technitium/Chart.yaml | 29 + charts/incubator/technitium/questions.yaml | 767 +++++++++++++++++ .../technitium/templates/common.yaml | 1 + charts/incubator/technitium/values.yaml | 94 +++ docs/_static/img/appicons/technitium.png | Bin 0 -> 995 bytes docs/manual/default-ports.md | 791 +++++++++--------- 6 files changed, 1290 insertions(+), 392 deletions(-) create mode 100644 charts/incubator/technitium/Chart.yaml create mode 100644 charts/incubator/technitium/questions.yaml create mode 100644 charts/incubator/technitium/templates/common.yaml create mode 100644 charts/incubator/technitium/values.yaml create mode 100644 docs/_static/img/appicons/technitium.png diff --git a/charts/incubator/technitium/Chart.yaml b/charts/incubator/technitium/Chart.yaml new file mode 100644 index 00000000000..12094ea91a9 --- /dev/null +++ b/charts/incubator/technitium/Chart.yaml @@ -0,0 +1,29 @@ +apiVersion: v2 +appVersion: "2022.02.1" +dependencies: +- name: common + repository: https://library-charts.truecharts.org + version: 9.1.15 +deprecated: false +description: Technitium DNS Server is an open source authoritative as well as recursive DNS server that can be used for self hosting a DNS server for privacy & security. +home: https://github.com/truecharts/apps/tree/master/charts/stable/technitium +icon: https://truecharts.org/_static/img/appicons/technitium.png +keywords: +- DNS +kubeVersion: '>=1.16.0-0' +maintainers: +- email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org +name: technitium +sources: +- https://github.com/TechnitiumSoftware/DnsServer +- https://technitium.com/ +- https://hub.docker.com/r/technitium/dns-server +type: application +version: 0.0.1 +annotations: + truecharts.org/catagories: | + - networking + truecharts.org/SCALE-support: "true" + truecharts.org/grade: U diff --git a/charts/incubator/technitium/questions.yaml b/charts/incubator/technitium/questions.yaml new file mode 100644 index 00000000000..9c5308029a7 --- /dev/null +++ b/charts/incubator/technitium/questions.yaml @@ -0,0 +1,767 @@ +# Include{groups} +portals: + open: + protocols: + - "$kubernetes-resource_configmap_portal_protocol" + host: + - "$kubernetes-resource_configmap_portal_host" + ports: + - "$kubernetes-resource_configmap_portal_port" + path: "/" + admin: + protocols: + - "$kubernetes-resource_configmap_portal_protocol" + host: + - "$kubernetes-resource_configmap_portal_host" + ports: + - "$kubernetes-resource_configmap_portal_port" + path: "/admin/" +questions: + - variable: portal + group: "Container Image" + label: "Configure Portal Button" + schema: + type: dict + hidden: true + attrs: + - variable: enabled + label: "Enable" + description: "enable the portal button" + schema: + hidden: true + editable: false + type: boolean + default: true +# Include{global} + - variable: controller + group: "Controller" + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: advanced + label: "Show Advanced Controller Settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: type + description: "Please specify type of workload to deploy" + label: "(Advanced) Controller Type" + schema: + type: string + default: "deployment" + required: true + enum: + - value: "deployment" + description: "Deployment" + - value: "statefulset" + description: "Statefulset" + - value: "daemonset" + description: "Daemonset" + - variable: replicas + description: "Number of desired pod replicas" + label: "Desired Replicas" + schema: + type: int + default: 1 + required: true + - variable: strategy + description: "Please specify type of workload to deploy" + label: "(Advanced) Update Strategy" + schema: + type: string + default: "Recreate" + required: true + enum: + - value: "Recreate" + description: "Recreate: Kill existing pods before creating new ones" + - value: "RollingUpdate" + description: "RollingUpdate: Create new pods and then kill old ones" + - value: "OnDelete" + description: "(Legacy) OnDelete: ignore .spec.template changes" +# Include{controllerExpert} + - variable: secret + group: "Container Configuration" + label: "Image Secrets" + schema: + additional_attrs: true + type: dict + attrs: + - variable: DNS_SERVER_ADMIN_PASSWORD + label: "DNS_SERVER_ADMIN_PASSWORD" + description: "DNS web console admin user password." + schema: + type: string + default: "" + private: true + required: true + - variable: env + group: "Container Configuration" + label: "Image Environment" + schema: + additional_attrs: true + type: dict + attrs: + - variable: DNS_SERVER_DOMAIN + label: "DNS_SERVER_DOMAIN" + description: "The primary domain name used by this DNS Server to identify itself." + schema: + type: string + default: "dns-server" + required: true + - variable: DNS_SERVER_PREFER_IPV6 + label: "DNS_SERVER_PREFER_IPV6" + description: "DNS Server will use IPv6 for querying whenever possible with this option enabled." + schema: + type: boolean + default: false + - variable: DNS_SERVER_OPTIONAL_PROTOCOL_DNS_OVER_HTTP + label: "DNS_SERVER_OPTIONAL_PROTOCOL_DNS_OVER_HTTP" + description: "Enables DNS server optional protocol DNS-over-HTTP on TCP port 8053 to be used with a TLS terminating reverse proxy like nginx." + schema: + type: boolean + default: false + - variable: DNS_SERVER_RECURSION + label: "DNS_SERVER_RECURSION" + schema: + type: string + default: "AllowOnlyForPrivateNetworks" + enum: + - value: "AllowOnlyForPrivateNetworks" + description: "AllowOnlyForPrivateNetworks" + - value: "UseSpecifiedNetworks" + description: "UseSpecifiedNetworks" + - value: "Allow" + description: "Allow" + - value: "Deny" + description: "Deny" + - variable: DNS_SERVER_RECURSION_DENIED_NETWORKS + label: "DNS_SERVER_RECURSION_DENIED_NETWORKS" + description: "Comma separated list of IP addresses or network addresses to deny recursion. Valid only for UseSpecifiedNetworks recursion option." + schema: + show_if: [["DNS_SERVER_RECURSION", "=", "UseSpecifiedNetworks"]] + type: string + default: "1.1.1.0/24" + - variable: DNS_SERVER_RECURSION_ALLOWED_NETWORKS + label: "DNS_SERVER_RECURSION_ALLOWED_NETWORKS" + description: "Comma separated list of IP addresses or network addresses to allow recursion. Valid only for `UseSpecifiedNetworks` recursion option." + schema: + show_if: [["DNS_SERVER_RECURSION", "=", "UseSpecifiedNetworks"]] + type: string + default: "127.0.0.1, 192.168.1.0/24" + - variable: DNS_SERVER_ENABLE_BLOCKING + label: "DNS_SERVER_ENABLE_BLOCKING" + description: "Sets the DNS server to block domain names using Blocked Zone and Block List Zone." + schema: + type: boolean + default: false + - variable: DNS_SERVER_ALLOW_TXT_BLOCKING_REPORT + label: "DNS_SERVER_ALLOW_TXT_BLOCKING_REPORT" + description: "Specifies if the DNS Server should respond with TXT records containing a blocked domain report for TXT type requests." + schema: + type: boolean + default: false + - variable: DNS_SERVER_FORWARDERS + label: "DNS_SERVER_FORWARDERS" + description: "Comma separated list of forwarder addresses." + schema: + type: string + default: "1.1.1.1, 8.8.8.8" + - variable: DNS_SERVER_FORWARDER_PROTOCOL + label: "DNS_SERVER_FORWARDER_PROTOCOL" + description: "Forwarder protocol options: Udp, Tcp, Tls, Https, HttpsJson." + schema: + type: string + default: "Tcp" + enum: + - value: "AllowOnlyForPrivateNetworks" + description: "AllowOnlyForPrivateNetworks" + - value: "Udp" + description: "Udp" + - value: "Tcp" + description: "Tcp" + - value: "Tls" + description: "Tls" + - value: "Https" + description: "Https" + - value: "HttpsJson" + description: "HttpsJson" +# Include{containerConfig} + + - variable: service + group: "Networking and Services" + label: "Configure Service(s)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Service" + description: "The Primary service on which the healthcheck runs, often the webUI" + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: main + label: "Main Service Port Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "Port" + description: "This port exposes the container port on the service" + schema: + type: int + default: 5380 + required: true + - variable: advanced + label: "Show Advanced settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: protocol + label: "Port Type" + schema: + type: string + default: "HTTP" + enum: + - value: HTTP + description: "HTTP" + - value: "HTTPS" + description: "HTTPS" + - value: TCP + description: "TCP" + - value: "UDP" + description: "UDP" + - variable: nodePort + label: "Node Port (Optional)" + description: "This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer" + schema: + type: int + min: 9000 + max: 65535 + - variable: targetPort + label: "Target Port" + description: "The internal(!) port on the container the Application runs on" + schema: + type: int + default: 5380 + + - variable: dns-udp + label: "DNS-UDP Service" + description: "DNS-UDP Service" + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: dns-udp + label: "DNS-UDP Service Port Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "Port" + description: "This port exposes the container port on the service" + schema: + type: int + default: 53 + required: true + - variable: advanced + label: "Show Advanced settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: protocol + label: "Port Type" + schema: + type: string + default: "UDP" + enum: + - value: HTTP + description: "HTTP" + - value: "HTTPS" + description: "HTTPS" + - value: TCP + description: "TCP" + - value: "UDP" + description: "UDP" + - variable: nodePort + label: "Node Port (Optional)" + description: "This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer" + schema: + type: int + min: 9000 + max: 65535 + - variable: targetPort + label: "Target Port" + description: "The internal(!) port on the container the Application runs on" + schema: + type: int + default: 53 + + - variable: dns-tcp + label: "DNS-TCP Service" + description: "DNS-TCP Service" + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: dns-tcp + label: "DNS-TCP Service Port Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "Port" + description: "This port exposes the container port on the service" + schema: + type: int + default: 53 + required: true + - variable: advanced + label: "Show Advanced settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: protocol + label: "Port Type" + schema: + type: string + default: "TCP" + enum: + - value: HTTP + description: "HTTP" + - value: "HTTPS" + description: "HTTPS" + - value: TCP + description: "TCP" + - value: "UDP" + description: "UDP" + - variable: nodePort + label: "Node Port (Optional)" + description: "This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer" + schema: + type: int + min: 9000 + max: 65535 + - variable: targetPort + label: "Target Port" + description: "The internal(!) port on the container the Application runs on" + schema: + type: int + default: 53 + + - variable: dns-tls + label: "DNS-TLS Service" + description: "DNS-TLS Service" + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: dns-tls + label: "DNS-TLS Service Port Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "Port" + description: "This port exposes the container port on the service" + schema: + type: int + default: 853 + required: true + - variable: advanced + label: "Show Advanced settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: protocol + label: "Port Type" + schema: + type: string + default: "TCP" + enum: + - value: HTTP + description: "HTTP" + - value: "HTTPS" + description: "HTTPS" + - value: TCP + description: "TCP" + - value: "UDP" + description: "UDP" + - variable: nodePort + label: "Node Port (Optional)" + description: "This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer" + schema: + type: int + min: 9000 + max: 65535 + - variable: targetPort + label: "Target Port" + description: "The internal(!) port on the container the Application runs on" + schema: + type: int + default: 853 + - variable: dns-cert + label: "DNS-over-HTTPS Certbot Service" + description: "DNS-over-HTTPS Certbot Service" + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: dns-cert + label: "DNS-over-HTTPS Certbot Service Port Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "Port" + description: "This port exposes the container port on the service" + schema: + type: int + default: 10202 + required: true + - variable: advanced + label: "Show Advanced settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: protocol + label: "Port Type" + schema: + type: string + default: "TCP" + enum: + - value: HTTP + description: "HTTP" + - value: "HTTPS" + description: "HTTPS" + - value: TCP + description: "TCP" + - value: "UDP" + description: "UDP" + - variable: nodePort + label: "Node Port (Optional)" + description: "This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer" + schema: + type: int + min: 9000 + max: 65535 + - variable: targetPort + label: "Target Port" + description: "The internal(!) port on the container the Application runs on" + schema: + type: int + default: 80 + - variable: dns-https + label: "DNS-over-HTTPS Service" + description: "DNS-over-HTTPS Service" + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: dns-https + label: "DNS-over-HTTPS Service Port Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "Port" + description: "This port exposes the container port on the service" + schema: + type: int + default: 10203 + required: true + - variable: advanced + label: "Show Advanced settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: protocol + label: "Port Type" + schema: + type: string + default: "TCP" + enum: + - value: HTTP + description: "HTTP" + - value: "HTTPS" + description: "HTTPS" + - value: TCP + description: "TCP" + - value: "UDP" + description: "UDP" + - variable: nodePort + label: "Node Port (Optional)" + description: "This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer" + schema: + type: int + min: 9000 + max: 65535 + - variable: targetPort + label: "Target Port" + description: "The internal(!) port on the container the Application runs on" + schema: + type: int + default: 443 + - variable: dns-https-proxy + label: "DNS-over-HTTPS Reverse Proxy Service" + description: "DNS-over-HTTPS Reverse Proxy Service" + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: dns-https-proxy + label: "DNS-over-HTTPS Reverse Proxy Service Port Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "Port" + description: "This port exposes the container port on the service" + schema: + type: int + default: 10204 + required: true + - variable: advanced + label: "Show Advanced settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: protocol + label: "Port Type" + schema: + type: string + default: "TCP" + enum: + - value: HTTP + description: "HTTP" + - value: "HTTPS" + description: "HTTPS" + - value: TCP + description: "TCP" + - value: "UDP" + description: "UDP" + - variable: nodePort + label: "Node Port (Optional)" + description: "This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer" + schema: + type: int + min: 9000 + max: 65535 + - variable: targetPort + label: "Target Port" + description: "The internal(!) port on the container the Application runs on" + schema: + type: int + default: 8053 + - variable: serviceexpert + group: "Networking and Services" + label: "Show Expert Config" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hostNetwork + group: "Networking and Services" + label: "Host-Networking (Complicated)" + schema: + type: boolean + default: false + +# Include{serviceExpert} + +# Include{serviceList} + + - variable: persistence + label: "Integrated Persistent Storage" + description: "Integrated Persistent Storage" + group: "Storage and Persistence" + schema: + additional_attrs: true + type: dict + attrs: + - variable: config + label: "App Config Storage" + description: "Stores the Application Configuration." + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: "Type of Storage" + description: "Sets the persistence type, Anything other than PVC could break rollback!" + schema: + type: string + default: "simplePVC" + enum: + - value: "simplePVC" + description: "PVC (simple)" + - value: "simpleHP" + description: "HostPath (simple)" + - value: "emptyDir" + description: "emptyDir" + - value: "pvc" + description: "pvc" + - value: "hostPath" + description: "hostPath" +# Include{persistenceBasic} + - variable: hostPath + label: "hostPath" + description: "Path inside the container the storage is mounted" + schema: + show_if: [["type", "=", "hostPath"]] + type: hostpath + - variable: medium + label: "EmptyDir Medium" + schema: + show_if: [["type", "=", "emptyDir"]] + type: string + default: "" + enum: + - value: "" + description: "Default" + - value: "Memory" + description: "Memory" +# Include{persistenceAdvanced} + +# Include{persistenceList} + + - variable: ingress + label: "" + group: "Ingress" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Ingress" + schema: + additional_attrs: true + type: dict + attrs: +# Include{ingressDefault} + +# Include{ingressTLS} + +# Include{ingressTraefik} + +# Include{ingressExpert} + - variable: dns-https-proxy + label: "DNS-over-HTTPS Reverse Proxy" + schema: + additional_attrs: true + type: dict + attrs: +# Include{ingressDefault} + +# Include{ingressTLS} + +# Include{ingressTraefik} + +# Include{ingressExpert} + +# Include{ingressList} + +# Include{security} + + - variable: advancedSecurity + label: "Show Advanced Security Settings" + group: "Security and Permissions" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: securityContext + label: "Security Context" + schema: + additional_attrs: true + type: dict + attrs: + - variable: privileged + label: "Privileged mode" + schema: + type: boolean + default: false + - variable: readOnlyRootFilesystem + label: "ReadOnly Root Filesystem" + schema: + type: boolean + default: false + - variable: allowPrivilegeEscalation + label: "Allow Privilege Escalation" + schema: + type: boolean + default: true + - variable: runAsNonRoot + label: "runAsNonRoot" + schema: + type: boolean + default: false +# Include{securityContextAdvanced} + + - variable: podSecurityContext + group: "Security and Permissions" + label: "Pod Security Context" + schema: + additional_attrs: true + type: dict + attrs: + - variable: runAsUser + label: "runAsUser" + description: "The UserID of the user running the application" + schema: + type: int + default: 0 + - variable: runAsGroup + label: "runAsGroup" + description: The groupID this App of the user running the application" + schema: + type: int + default: 0 + - variable: fsGroup + label: "fsGroup" + description: "The group that should own ALL storage." + schema: + type: int + default: 568 +# Include{podSecurityContextAdvanced} + +# Include{resources} + +# Include{advanced} + +# Include{addons} diff --git a/charts/incubator/technitium/templates/common.yaml b/charts/incubator/technitium/templates/common.yaml new file mode 100644 index 00000000000..a17e923ef88 --- /dev/null +++ b/charts/incubator/technitium/templates/common.yaml @@ -0,0 +1 @@ +{{- include "common.all" . }} diff --git a/charts/incubator/technitium/values.yaml b/charts/incubator/technitium/values.yaml new file mode 100644 index 00000000000..340e2200bc5 --- /dev/null +++ b/charts/incubator/technitium/values.yaml @@ -0,0 +1,94 @@ +image: + repository: technitium/dns-server + pullPolicy: IfNotPresent + tag: 8.0@sha256:37edc3d3cc4521559f5738d5152926750a498294ccef9fe264369746be87febc + +securityContext: + readOnlyRootFilesystem: false + runAsNonRoot: false + allowPrivilegeEscalation: true + +podSecurityContext: + runAsUser: 0 + runAsGroup: 0 + +secret: + DNS_SERVER_ADMIN_PASSWORD: "password" + +env: + DNS_SERVER_DOMAIN: "dns-server" + DNS_SERVER_PREFER_IPV6: false + DNS_SERVER_OPTIONAL_PROTOCOL_DNS_OVER_HTTP: false + DNS_SERVER_RECURSION: "AllowOnlyForPrivateNetworks" + DNS_SERVER_RECURSION_DENIED_NETWORKS: "1.1.1.0/24" + DNS_SERVER_RECURSION_ALLOWED_NETWORKS: "127.0.0.1, 192.168.1.0/24" + DNS_SERVER_ENABLE_BLOCKING: false + DNS_SERVER_ALLOW_TXT_BLOCKING_REPORT: false + DNS_SERVER_FORWARDERS: "1.1.1.1, 8.8.8.8" + DNS_SERVER_FORWARDER_PROTOCOL: "Tcp" + +service: + main: + ports: + main: + port: 5380 + targetPort: 5380 + dns-tcp: + enabled: true + ports: + dns-tcp: + enabled: true + port: 53 + targetPort: 53 + dns-udp: + enabled: true + ports: + dns-udp: + enabled: true + protocol: UDP + port: 53 + targetPort: 53 + dns-tls: + enabled: true + ports: + dns-tls: + enabled: true + protocol: TCP + port: 853 + targetPort: 853 + dns-cert: + enabled: true + ports: + dns-cert: + enabled: true + protocol: TCP + port: 10202 + targetPort: 80 + dns-https: + enabled: true + ports: + dns-https: + enabled: true + protocol: TCP + port: 10203 + targetPort: 443 + dns-https-proxy: + enabled: true + ports: + dns-https-proxy: + enabled: true + protocol: TCP + port: 10204 + targetPort: 8053 + + +# Not sure if those will work on k8s + # - "443:443/tcp" #DNS-over-HTTPS service + # - "80:80/tcp" #DNS-over-HTTPS service certbot certificate renewal +# Note sure if this will work with traefik + # - "8053:8053/tcp" #DNS-over-HTTPS using reverse proxy + +persistence: + config: + enabled: true + mountPath: "/etc/dns/config" diff --git a/docs/_static/img/appicons/technitium.png b/docs/_static/img/appicons/technitium.png new file mode 100644 index 0000000000000000000000000000000000000000..5c14e4fa848574de000c4fcf8ee4f2bc53f7d330 GIT binary patch literal 995 zcmeAS@N?(olHy`uVBq!ia0y~yU<5K5893O0R7}x|GzJFdRh}-6Ar*0N?;7?UG7xaM zcvkM(9L<<(x1$4Gv;}AWkF%Vrdgi*w1ewQkKC^rLie-0bXKXjqH`&Xp)0i6!7>Pw2yw5Y=cv*jL zy@fq%_`8|B42M`~hWZN6?c}?^^Y`B`;rFWloqG2?o!|Pdu{1*qC()=wkY!oWmfXMl_mMC3oQN^LGCopKLeMJQ*uqNWdG2 a8|