feat(wireguard): move to stable and add docs (#3637)
This commit is contained in:
Stavros Kois
@@ -0,0 +1,30 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
# OWNERS file for Kubernetes
|
||||
OWNERS
|
||||
# helm-docs templates
|
||||
*.gotmpl
|
||||
# docs folder
|
||||
/docs
|
||||
# icon
|
||||
icon.png
|
||||
@@ -0,0 +1,28 @@
|
||||
# Changelog
|
||||
|
||||
|
||||
|
||||
## [wireguard-0.0.3](https://github.com/truecharts/charts/compare/wireguard-0.0.2...wireguard-0.0.3) (2022-08-30)
|
||||
|
||||
### Chore
|
||||
|
||||
- update helm chart common to v10.5.5 ([#3626](https://github.com/truecharts/charts/issues/3626))
|
||||
|
||||
|
||||
|
||||
|
||||
## [wireguard-0.0.2](https://github.com/truecharts/charts/compare/wireguard-0.0.1...wireguard-0.0.2) (2022-08-29)
|
||||
|
||||
### Chore
|
||||
|
||||
- Auto-update chart README [skip ci]
|
||||
- update helm general non-major ([#3619](https://github.com/truecharts/charts/issues/3619))
|
||||
|
||||
|
||||
|
||||
|
||||
## [wireguard-0.0.1]wireguard-0.0.1 (2022-08-28)
|
||||
|
||||
### Feat
|
||||
|
||||
- add standalone wireguard ([#3575](https://github.com/truecharts/charts/issues/3575))
|
||||
@@ -0,0 +1,27 @@
|
||||
apiVersion: v2
|
||||
appVersion: "1.0.202109"
|
||||
dependencies:
|
||||
- name: common
|
||||
repository: https://library-charts.truecharts.org
|
||||
version: 10.5.5
|
||||
description: WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography.
|
||||
home: https://truecharts.org/docs/charts/incubator/wireguard
|
||||
icon: https://truecharts.org/img/hotlink-ok/chart-icons/wireguard.png
|
||||
keywords:
|
||||
- wireguard
|
||||
- vpn
|
||||
kubeVersion: ">=1.16.0-0"
|
||||
maintainers:
|
||||
- email: info@truecharts.org
|
||||
name: TrueCharts
|
||||
url: https://truecharts.org
|
||||
name: wireguard
|
||||
sources:
|
||||
- https://github.com/truecharts/charts/tree/master/charts/incubator/wireguard
|
||||
- https://github.com/k8s-at-home/container-images/tree/main/apps/wireguard
|
||||
version: 1.0.0
|
||||
annotations:
|
||||
truecharts.org/catagories: |
|
||||
- network
|
||||
truecharts.org/SCALE-support: "true"
|
||||
truecharts.org/grade: U
|
||||
@@ -0,0 +1,108 @@
|
||||
# wireguard
|
||||
|
||||
 
|
||||
|
||||
WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography.
|
||||
|
||||
TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE.
|
||||
|
||||
This readme is just an automatically generated general guide on installing our Helm Charts and Apps.
|
||||
For more information, please click here: [wireguard](https://truecharts.org/docs/charts/incubator/wireguard)
|
||||
|
||||
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
|
||||
|
||||
## Source Code
|
||||
|
||||
* <https://github.com/truecharts/charts/tree/master/charts/incubator/wireguard>
|
||||
* <https://github.com/k8s-at-home/container-images/tree/main/apps/wireguard>
|
||||
|
||||
## Requirements
|
||||
|
||||
Kubernetes: `>=1.16.0-0`
|
||||
|
||||
## Dependencies
|
||||
|
||||
| Repository | Name | Version |
|
||||
|------------|------|---------|
|
||||
| https://library-charts.truecharts.org | common | 10.5.5 |
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
### TrueNAS SCALE
|
||||
|
||||
To install this Chart on TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/docs/manual/SCALE%20Apps/Quick-Start%20Guides/Installing-an-App).
|
||||
|
||||
### Helm
|
||||
|
||||
To install the chart with the release name `wireguard`
|
||||
|
||||
```console
|
||||
helm repo add TrueCharts https://charts.truecharts.org
|
||||
helm repo update
|
||||
helm install wireguard TrueCharts/wireguard
|
||||
```
|
||||
|
||||
## Uninstall
|
||||
|
||||
### TrueNAS SCALE
|
||||
|
||||
**Upgrading, Rolling Back and Uninstalling the Chart**
|
||||
|
||||
To upgrade, rollback or delete this Chart from TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/docs/manual/SCALE%20Apps/Quick-Start%20Guides/Upgrade-rollback-delete-an-App).
|
||||
|
||||
### Helm
|
||||
|
||||
To uninstall the `wireguard` deployment
|
||||
|
||||
```console
|
||||
helm uninstall wireguard
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
### Helm
|
||||
|
||||
#### Available Settings
|
||||
|
||||
Read through the [values.yaml](./values.yaml) file. It has several commented out suggested values.
|
||||
Other values may be used from the [values.yaml](https://github.com/truecharts/library-charts/tree/main/charts/stable/common/values.yaml) from the [common library](https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common).
|
||||
|
||||
#### Configure using the command line
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
|
||||
|
||||
```console
|
||||
helm install wireguard \
|
||||
--set env.TZ="America/New York" \
|
||||
TrueCharts/wireguard
|
||||
```
|
||||
|
||||
#### Configure using a yaml file
|
||||
|
||||
Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart.
|
||||
|
||||
```console
|
||||
helm install wireguard TrueCharts/wireguard -f values.yaml
|
||||
```
|
||||
|
||||
#### Connecting to other charts
|
||||
|
||||
If you need to connect this Chart to other Charts on TrueNAS SCALE, please refer to our [Linking Charts Internally](https://truecharts.org/docs/manual/SCALE%20Apps/Quick-Start%20Guides/linking-apps) quick-start guide.
|
||||
|
||||
## Support
|
||||
|
||||
- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/docs/manual/SCALE%20Apps/Quick-Start%20Guides/Important-MUST-READ).
|
||||
- See the [Website](https://truecharts.org)
|
||||
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
||||
- Open a [issue](https://github.com/truecharts/apps/issues/new/choose)
|
||||
|
||||
---
|
||||
|
||||
## Sponsor TrueCharts
|
||||
|
||||
TrueCharts can only exist due to the incredible effort of our staff.
|
||||
Please consider making a [donation](https://truecharts.org/docs/about/sponsor) or contributing back to the project any way you can!
|
||||
|
||||
---
|
||||
|
||||
All Rights Reserved - The TrueCharts Project
|
||||
@@ -0,0 +1,12 @@
|
||||
wg:
|
||||
config:
|
||||
enabled: true
|
||||
data: |
|
||||
[Interface]
|
||||
Address = 10.0.0.1/24
|
||||
ListenPort = 51820
|
||||
PrivateKey = 0K6BMiX09qRMXhcuCnpjdEVlOlhEw8Q8jpB6edY0wmw=
|
||||
[Peer]
|
||||
PublicKey = KajDsFV6oJ04H/jeUzds23Lrybfr1YJvwm5rghcG7yM=
|
||||
AllowedIPs = 0.0.0.0/0
|
||||
Endpoint = 1.1.1.1:51820
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 42 KiB |
@@ -0,0 +1,63 @@
|
||||
# Installation Notes
|
||||
|
||||
## Scale App
|
||||
|
||||
TrueNAS Scale users, can configure this app from the easily from the UI.
|
||||
Store your wireguard config file in a directory, on one of your pools.
|
||||
Example `/mnt/pool/vpn.conf` (Name can be any name. eg `wg0.conf`, `x-site.conf`, etc)
|
||||
Example config content:
|
||||
|
||||
```conf
|
||||
[Interface]
|
||||
Address = 10.0.0.1/24
|
||||
ListenPort = 51820
|
||||
PrivateKey = PRIVATE_KEY
|
||||
|
||||
[Peer]
|
||||
PublicKey = PUBLIC_KEY
|
||||
AllowedIPs = 0.0.0.0/0
|
||||
Endpoint = wg.example:51820
|
||||
```
|
||||
|
||||
UI Configuration is simple as that:
|
||||
|
||||
|
||||
|
||||
Tick `Killswitch` if you want to kill traffic when VPN is down.
|
||||
Add networks in `Excluded IPv{4,6} Networks` that you want to continue their traffic when VPN is down.
|
||||
|
||||
That's it!
|
||||
|
||||
## Native Helm
|
||||
|
||||
Native helm users can modify `values.yaml` and add their wireguard config directly in there.
|
||||
|
||||
Example:
|
||||
|
||||
```yaml
|
||||
wg:
|
||||
# Set to true if you want to enable killswitch
|
||||
killswitch: false
|
||||
# If you want to exclude networks, do like so
|
||||
excludedIP4networks:
|
||||
- "10.10.10.0/24"
|
||||
- "192.168.1.0/24"
|
||||
excludedIP6networks: []
|
||||
# Leave empty if you going to use the paste your config bellow
|
||||
configFileHostPath: ""
|
||||
# Paste your config bellow.
|
||||
# Indentation matters!
|
||||
config:
|
||||
enabled: false
|
||||
# Your wg config here eg:
|
||||
data: |
|
||||
[Interface]
|
||||
Address = 10.0.0.1/24
|
||||
ListenPort = 51820
|
||||
PrivateKey = PRIVATE_KEY
|
||||
|
||||
[Peer]
|
||||
PublicKey = PUBLIC_KEY
|
||||
AllowedIPs = 0.0.0.0/0
|
||||
Endpoint = wg.example:51820
|
||||
```
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 31 KiB |
@@ -0,0 +1,151 @@
|
||||
# Include{groups}
|
||||
portals:
|
||||
open:
|
||||
# Include{portalLink}
|
||||
questions:
|
||||
# Include{global}
|
||||
# Include{controller}
|
||||
# Include{controllerDeployment}
|
||||
# Include{replicas}
|
||||
# Include{replica1}
|
||||
# Include{strategy}
|
||||
# Include{recreate}
|
||||
# Include{controllerExpert}
|
||||
# Include{controllerExpertExtraArgs}
|
||||
- variable: wg
|
||||
group: Container Configuration
|
||||
label: Wireguard Configuration
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: configFileHostPath
|
||||
label: Config File Host Path
|
||||
schema:
|
||||
type: string
|
||||
required: true
|
||||
default: ""
|
||||
- variable: killswitch
|
||||
label: Killswitch
|
||||
description: Enable a killswitch that kills all traffic when the VPN is not connected
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: excludedIP4networks
|
||||
label: Killswitch Excluded IPv4 networks
|
||||
description: List of Killswitch Excluded IPv4 Addresses
|
||||
schema:
|
||||
type: list
|
||||
default: []
|
||||
items:
|
||||
- variable: networkv4
|
||||
label: IPv4 Network
|
||||
schema:
|
||||
type: string
|
||||
required: true
|
||||
- variable: excludedIP6networks
|
||||
label: Killswitch Excluded IPv6 networks
|
||||
description: List of Killswitch Excluded IPv6 Addresses
|
||||
schema:
|
||||
type: list
|
||||
default: []
|
||||
items:
|
||||
- variable: networkv6
|
||||
label: IPv6 Network
|
||||
schema:
|
||||
type: string
|
||||
required: true
|
||||
# Include{containerConfig}
|
||||
# Include{serviceRoot}
|
||||
- variable: main
|
||||
label: "Main Service"
|
||||
description: "The Primary service on which the healthcheck runs, often the webUI"
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{serviceSelector}
|
||||
- variable: main
|
||||
label: "Main Service Port Configuration"
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
- variable: port
|
||||
label: "Port"
|
||||
description: "This port exposes the container port on the service"
|
||||
schema:
|
||||
type: int
|
||||
default: 51820
|
||||
required: true
|
||||
# Include{advancedPortUDP}
|
||||
- variable: targetPort
|
||||
label: "Target Port"
|
||||
description: "The internal(!) port on the container the Application runs on"
|
||||
schema:
|
||||
type: int
|
||||
default: 51820
|
||||
# Include{serviceExpertRoot}
|
||||
default: false
|
||||
# Include{serviceExpert}
|
||||
# Include{serviceList}
|
||||
# Include{persistenceList}
|
||||
# Include{ingressRoot}
|
||||
- variable: main
|
||||
label: "Main Ingress"
|
||||
schema:
|
||||
additional_attrs: true
|
||||
type: dict
|
||||
attrs:
|
||||
# Include{ingressDefault}
|
||||
# Include{ingressTLS}
|
||||
# Include{ingressTraefik}
|
||||
# Include{ingressExpert}
|
||||
# Include{ingressList}
|
||||
# Include{security}
|
||||
# Include{securityContextAdvancedRoot}
|
||||
- variable: privileged
|
||||
label: "Privileged mode"
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: readOnlyRootFilesystem
|
||||
label: "ReadOnly Root Filesystem"
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: allowPrivilegeEscalation
|
||||
label: "Allow Privilege Escalation"
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
- variable: runAsNonRoot
|
||||
label: "runAsNonRoot"
|
||||
schema:
|
||||
type: boolean
|
||||
default: false
|
||||
# Include{securityContextAdvanced}
|
||||
# Include{podSecurityContextRoot}
|
||||
- variable: runAsUser
|
||||
label: "runAsUser"
|
||||
description: "The UserID of the user running the application"
|
||||
schema:
|
||||
type: int
|
||||
default: 0
|
||||
- variable: runAsGroup
|
||||
label: "runAsGroup"
|
||||
description: "The groupID this App of the user running the application"
|
||||
schema:
|
||||
type: int
|
||||
default: 0
|
||||
- variable: fsGroup
|
||||
label: "fsGroup"
|
||||
description: "The group that should own ALL storage."
|
||||
schema:
|
||||
type: int
|
||||
default: 568
|
||||
# Include{podSecurityContextAdvanced}
|
||||
# Include{resources}
|
||||
# Include{advanced}
|
||||
# Include{addons}
|
||||
# Include{documentation}
|
||||
@@ -0,0 +1,23 @@
|
||||
{{- define "wireguard.configfile" -}}
|
||||
{{- if and .Values.wg.configFileHostPath ( not .Values.wg.config.enable ) }}
|
||||
enabled: true
|
||||
type: hostPath
|
||||
readOnly: true
|
||||
hostPathType: File
|
||||
hostPath: {{ .Values.wg.configFileHostPath }}
|
||||
mountPath: /etc/wireguard/wg0.conf
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.wg.config.enabled }}
|
||||
enabled: true
|
||||
type: secret
|
||||
readOnly: true
|
||||
defaultMode: "0600"
|
||||
objectName: '{{ printf "%s-wg-config-secret" (include "tc.common.names.fullname" .) }}'
|
||||
mountPath: /etc/wireguard
|
||||
items:
|
||||
- key: wg0.conf
|
||||
path: wg0.conf
|
||||
{{- end }}
|
||||
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,28 @@
|
||||
{{/* Define the secrets */}}
|
||||
{{- define "wg.env.configmap" -}}
|
||||
|
||||
{{- $configName := printf "%s-wg-env-config" (include "tc.common.names.fullname" .) }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ $configName }}
|
||||
labels:
|
||||
{{- include "tc.common.labels" . | nindent 4 }}
|
||||
data:
|
||||
SEPARATOR: ";"
|
||||
IPTABLES_BACKEND: nft
|
||||
KILLSWITCH: {{ .Values.wg.killswitch | quote }}
|
||||
{{- if .Values.wg.killswitch }}
|
||||
{{- $excludedIP4net := "172.16.0.0/12" }}
|
||||
{{- range .Values.wg.excludedIP4networks }}
|
||||
{{- $excludedIP4net = ( printf "%v;%v" $excludedIP4net . ) }}
|
||||
{{- end }}
|
||||
KILLSWITCH_EXCLUDEDNETWORKS_IPV4: {{ $excludedIP4net | quote }}
|
||||
{{- $excludedIP6net := "" }}
|
||||
{{- range .Values.wg.excludedIP6networks }}
|
||||
{{- $excludedIP6net = ( printf "%v;%v" $excludedIP6net . ) }}
|
||||
{{- end }}
|
||||
KILLSWITCH_EXCLUDEDNETWORKS_IPV6: {{ $excludedIP4net | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,16 @@
|
||||
{{/* Define the secrets */}}
|
||||
{{- define "wg.config-secret" -}}
|
||||
|
||||
{{- $secretName := printf "%s-wg-config-secret" (include "tc.common.names.fullname" .) }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
type: Opaque
|
||||
metadata:
|
||||
name: {{ $secretName }}
|
||||
labels:
|
||||
{{- include "tc.common.labels" . | nindent 4 }}
|
||||
data:
|
||||
wg0.conf: |
|
||||
{{ .Values.wg.config.data | b64enc | indent 4 }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{/* Make sure all variables are set properly */}}
|
||||
{{- include "tc.common.loader.init" . }}
|
||||
|
||||
{{/* Render config */}}
|
||||
{{- include "wg.env.configmap" . }}
|
||||
{{/* Render secret */}}
|
||||
{{- include "wg.config-secret" . }}
|
||||
|
||||
{{- $_ := set .Values.persistence "configfile" (include "wireguard.configfile" . | fromYaml) -}}
|
||||
|
||||
{{/* Render the templates */}}
|
||||
{{ include "tc.common.loader.apply" . }}
|
||||
@@ -0,0 +1,59 @@
|
||||
image:
|
||||
repository: tccr.io/truecharts/wireguard
|
||||
tag: v1.0.20210914@sha256:9f56e5660e8df8d4d38521ed73a4cc29fa24bf578007bfbe633e00184e2ebfbc
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
podSecurityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
|
||||
securityContext:
|
||||
runAsNonRoot: false
|
||||
readOnlyRootFilesystem: false
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- SYS_MODULE
|
||||
|
||||
wg:
|
||||
killswitch: false
|
||||
excludedIP4networks: []
|
||||
excludedIP6networks: []
|
||||
# Leave empty if you going to use the paste your config bellow
|
||||
configFileHostPath: ""
|
||||
config:
|
||||
enabled: false
|
||||
# Your wg config here eg:
|
||||
data: |
|
||||
[Interface]
|
||||
Address = 10.0.0.1/24
|
||||
ListenPort = 51820
|
||||
PrivateKey = PRIVATE_KEY
|
||||
|
||||
[Peer]
|
||||
PublicKey = PUBLIC_KEY
|
||||
AllowedIPs = 0.0.0.0/0
|
||||
Endpoint = wg.example:51820
|
||||
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: '{{ include "tc.common.names.fullname" . }}-wg-env-config'
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
startup:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
main:
|
||||
port: 51820
|
||||
targetPort: 51820
|
||||
protocol: UDP
|
||||
|
||||
portal:
|
||||
enabled: false
|
||||
Reference in New Issue
Block a user