From ea470bfb7578896039450cba2a5b7533488bf120 Mon Sep 17 00:00:00 2001 From: Kjeld Schouten Date: Tue, 5 Nov 2024 10:43:53 +0100 Subject: [PATCH] feat(cluster): add multiple TrueCharts hosted service prototypes --- .../apps/bitmagnet/app/helm-release.yaml | 78 +++++ .../apps/bitmagnet/app/kustomization.yaml | 6 + .../apps/bitmagnet/app/namespace.yaml | 4 + .../main/kubernetes/apps/bitmagnet/ks.yaml | 12 + .../apps/jackett/app/helm-release.yaml | 72 ++++ .../apps/jackett/app/kustomization.yaml | 6 + .../apps/jackett/app/namespace.yaml | 4 + clusters/main/kubernetes/apps/jackett/ks.yaml | 12 + .../main/kubernetes/apps/kustomization.yaml | 7 + .../apps/minecraft/app/helm-release.yaml | 321 ++++++++++++++++++ .../apps/minecraft/app/kustomization.yaml | 6 + .../apps/minecraft/app/namespace.yaml | 4 + .../main/kubernetes/apps/minecraft/ks.yaml | 12 + .../apps/vaultwarden/app/helm-release.yaml | 171 ++++++++++ .../apps/vaultwarden/app/kustomization.yaml | 6 + .../apps/vaultwarden/app/namespace.yaml | 6 + .../main/kubernetes/apps/vaultwarden/ks.yaml | 12 + clusters/main/kubernetes/flux-entry.yaml | 41 +++ clusters/main/kubernetes/kustomization.yaml | 4 + 19 files changed, 784 insertions(+) create mode 100644 clusters/main/kubernetes/apps/bitmagnet/app/helm-release.yaml create mode 100644 clusters/main/kubernetes/apps/bitmagnet/app/kustomization.yaml create mode 100644 clusters/main/kubernetes/apps/bitmagnet/app/namespace.yaml create mode 100644 clusters/main/kubernetes/apps/bitmagnet/ks.yaml create mode 100644 clusters/main/kubernetes/apps/jackett/app/helm-release.yaml create mode 100644 clusters/main/kubernetes/apps/jackett/app/kustomization.yaml create mode 100644 clusters/main/kubernetes/apps/jackett/app/namespace.yaml create mode 100644 clusters/main/kubernetes/apps/jackett/ks.yaml create mode 100644 clusters/main/kubernetes/apps/kustomization.yaml create mode 100644 clusters/main/kubernetes/apps/minecraft/app/helm-release.yaml create mode 100644 clusters/main/kubernetes/apps/minecraft/app/kustomization.yaml create mode 100644 clusters/main/kubernetes/apps/minecraft/app/namespace.yaml create mode 100644 clusters/main/kubernetes/apps/minecraft/ks.yaml create mode 100644 clusters/main/kubernetes/apps/vaultwarden/app/helm-release.yaml create mode 100644 clusters/main/kubernetes/apps/vaultwarden/app/kustomization.yaml create mode 100644 clusters/main/kubernetes/apps/vaultwarden/app/namespace.yaml create mode 100644 clusters/main/kubernetes/apps/vaultwarden/ks.yaml create mode 100644 clusters/main/kubernetes/flux-entry.yaml create mode 100644 clusters/main/kubernetes/kustomization.yaml diff --git a/clusters/main/kubernetes/apps/bitmagnet/app/helm-release.yaml b/clusters/main/kubernetes/apps/bitmagnet/app/helm-release.yaml new file mode 100644 index 00000000000..c05a329cae3 --- /dev/null +++ b/clusters/main/kubernetes/apps/bitmagnet/app/helm-release.yaml @@ -0,0 +1,78 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: bitmagnet + namespace: bitmagnet +spec: + interval: 15m + chart: + spec: + chart: bitmagnet + version: 3.3.0 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 15m + timeout: 20m + maxHistory: 3 + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: + credentials: + s3: + type: s3 + url: "${S3URL}" + bucket: "${S3PREFIX}-bitmagnet" + accessKey: "${S3ID}" + secretKey: "${S3KEY}" + encrKey: "${S3KEY}" + + global: + stopAll: false + workload: + main: + podSpec: + containers: + main: + env: + TMDB_API_KEY: ${TMDB_API_KEY} + + ingress: + main: + enabled: true + integrations: + traefik: + enabled: true + middlewares: + - name: local + namespace: traefik + - name: bouncer + namespace: traefik + certManager: + enabled: true + certificateIssuer: ks-le-prod + hosts: + - host: bitmagnet.${BASE_DOMAIN} + paths: + - path: / + pathType: Prefix + cnpg: + main: + backups: + enabled: false + credentials: s3 + + recovery: + method: object_store + credentials: s3 diff --git a/clusters/main/kubernetes/apps/bitmagnet/app/kustomization.yaml b/clusters/main/kubernetes/apps/bitmagnet/app/kustomization.yaml new file mode 100644 index 00000000000..4c6cb03f05b --- /dev/null +++ b/clusters/main/kubernetes/apps/bitmagnet/app/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helm-release.yaml + - namespace.yaml diff --git a/clusters/main/kubernetes/apps/bitmagnet/app/namespace.yaml b/clusters/main/kubernetes/apps/bitmagnet/app/namespace.yaml new file mode 100644 index 00000000000..e0a7449336b --- /dev/null +++ b/clusters/main/kubernetes/apps/bitmagnet/app/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: bitmagnet diff --git a/clusters/main/kubernetes/apps/bitmagnet/ks.yaml b/clusters/main/kubernetes/apps/bitmagnet/ks.yaml new file mode 100644 index 00000000000..a40b4fbdf14 --- /dev/null +++ b/clusters/main/kubernetes/apps/bitmagnet/ks.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: bitmagnet + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/apps/bitmagnet/app + prune: true + sourceRef: + kind: GitRepository + name: truecharts diff --git a/clusters/main/kubernetes/apps/jackett/app/helm-release.yaml b/clusters/main/kubernetes/apps/jackett/app/helm-release.yaml new file mode 100644 index 00000000000..a30f7c3ba97 --- /dev/null +++ b/clusters/main/kubernetes/apps/jackett/app/helm-release.yaml @@ -0,0 +1,72 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: jackett + namespace: jackett +spec: + interval: 15m + chart: + spec: + chart: jackett + version: 22.2.0 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 15m + timeout: 20m + maxHistory: 3 + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: + credentials: + s3: + type: s3 + url: "${S3URL}" + bucket: "${S3PREFIX}-jackett" + accessKey: "${S3ID}" + secretKey: "${S3KEY}" + encrKey: "${S3KEY}" + + persistence: + config: + volsync: + - name: b2 + type: restic + credentials: s3 + dest: + enabled: true + cacheCapacity: 10Gi + src: + enabled: true + cacheCapacity: 10Gi + + ingress: + main: + enabled: true + integrations: + traefik: + enabled: true + middlewares: + - name: local + namespace: traefik + - name: bouncer + namespace: traefik + certManager: + enabled: true + certificateIssuer: ks-le-prod + hosts: + - host: jackett.${BASE_DOMAIN} + paths: + - path: / + pathType: Prefix diff --git a/clusters/main/kubernetes/apps/jackett/app/kustomization.yaml b/clusters/main/kubernetes/apps/jackett/app/kustomization.yaml new file mode 100644 index 00000000000..4c6cb03f05b --- /dev/null +++ b/clusters/main/kubernetes/apps/jackett/app/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helm-release.yaml + - namespace.yaml diff --git a/clusters/main/kubernetes/apps/jackett/app/namespace.yaml b/clusters/main/kubernetes/apps/jackett/app/namespace.yaml new file mode 100644 index 00000000000..ce571b1e53a --- /dev/null +++ b/clusters/main/kubernetes/apps/jackett/app/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: jackett diff --git a/clusters/main/kubernetes/apps/jackett/ks.yaml b/clusters/main/kubernetes/apps/jackett/ks.yaml new file mode 100644 index 00000000000..5f4c3a74bdc --- /dev/null +++ b/clusters/main/kubernetes/apps/jackett/ks.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: jackett + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/apps/jackett/app + prune: true + sourceRef: + kind: GitRepository + name: truecharts diff --git a/clusters/main/kubernetes/apps/kustomization.yaml b/clusters/main/kubernetes/apps/kustomization.yaml new file mode 100644 index 00000000000..9d5ebee7aaf --- /dev/null +++ b/clusters/main/kubernetes/apps/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - minecraft/ks.yaml + - vaultwarden/ks.yaml + - jackett/ks.yaml + - bitmagnet/ks.yaml diff --git a/clusters/main/kubernetes/apps/minecraft/app/helm-release.yaml b/clusters/main/kubernetes/apps/minecraft/app/helm-release.yaml new file mode 100644 index 00000000000..79baf1884c4 --- /dev/null +++ b/clusters/main/kubernetes/apps/minecraft/app/helm-release.yaml @@ -0,0 +1,321 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: minecraft + namespace: minecraft +spec: + interval: 15m + chart: + spec: + chart: minecraft-java + version: 11.0.2 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 15m + timeout: 20m + maxHistory: 3 + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: + credentials: + s3: + type: s3 + url: "${S3URL}" + bucket: "${S3PREFIX}-minecraft" + accessKey: "${S3ID}" + secretKey: "${S3KEY}" + encrKey: "${S3KEY}" + service: + main: + enabled: true + loadBalancerIP: ${MINECRAFT_IP} + type: LoadBalancer + ports: + main: + enabled: true + protocol: tcp + port: 25565 + query: + enabled: true + protocol: udp + port: 25565 + rcon: + enabled: true + loadBalancerIP: ${MINECRAFT_IP} + type: LoadBalancer + ports: + rcon: + enabled: true + port: 25575 + dynmap: + enabled: true + loadBalancerIP: ${MINECRAFT_IP} + type: LoadBalancer + ports: + dynmap: + enabled: true + port: 8123 + + mcbackup: + # White spaced separated list + zstd_params: + - --long=25 + - --single-thread + # comma separated list + excludes: + - "*.jar" + - "cache" + - "logs" + - "*.tmp" + podOptions: + terminationGracePeriodSeconds: 120 + workload: + main: + podSpec: + containers: + main: + imageSelector: j17alpineImage + env: + ENABLE_QUERY: "true" + OVERRIDE_SERVER_PROPERTIES: true + VERSION: "1.20.1" + TYPE: "AUTO_CURSEFORGE" + FORGEVERSION: "forge-47.3.7" + CF_SLUG: "sixcraft" + # CF_MODPACK_ZIP: "/customdata/SixCraft-4.1.0.zip" + DIFFICULTY: hard + MAX_PLAYERS: 20 + MAX_WORLD_SIZE: 1000000 + ALLOW_NETHER: true + ANNOUNCE_PLAYER_ACHIEVEMENTS: true + ENABLE_COMMAND_BLOCK: false + FORCE_GAMEMODE: true + STOP_SERVER_ANNOUNCE_DELAY: 60 + GENERATE_STRUCTURES: true + HARDCORE: false + MAX_BUILD_HEIGHT: 300 + MAX_TICK_TIME: 90000 + SPAWN_ANIMALS: true + SPAWN_MONSTERS: true + SPAWN_NPCS: true + VIEW_DISTANCE: 32 + SPAWN_PROTECTION: 5 + MODE: survival + MOTD: "Welcome to Six-Shooter Minecraft" + PVP: false + LEVEL_TYPE: DEFAULT + LEVEL: world + ONLINE_MODE: true + MAX_MEMORY: 12228M + INIT_MEMORY: 8096M + JVM_XX_OPTS: "-XX:MaxRAMPercentage=75" + RCON_PASSWORD: ${MC_RCON_PASS} + BROADCAST_CONSOLE_TO_OPS: true + USE_AIKAR_FLAGS: true + OPS: "99093856-888c-49e5-b7ea-6849c4012469,6253eb28-5be7-4c94-8936-701b9e257f0c" + WHITELIST: "99093856-888c-49e5-b7ea-6849c4012469,6253eb28-5be7-4c94-8936-701b9e257f0c,06fd4434-f41d-45bb-84a7-16c1138b62a8,497d6257-d336-4922-b5e0-3ee0fbe2b3d3" + EXISTING_OPS_FILE: "SYNCHRONIZE" + EXISTING_WHITELIST_FILE: "SYNCHRONIZE" + # PACKWIZ_URL: "" + # CUSTOM_SERVER: "" + # QUILT_LOADER_VERSION: "" + # QUILT_LAUNCHER: "" + # QUILT_LAUNCHER_URL: "" + # PUFFERFISH_BUILD: "lastSuccessfulBuild" + # FORGE_INSTALLER: "" + # FORGE_INSTALLER_URL: "" + # FABRIC_LOADER_VERSION: "" + # FABRIC_INSTALLER: "" + # FABRIC_INSTALLER_URL: "" + # SPIGOT_DOWNLOAD_URL: "" + # BUILD_FROM_SOURCE: false + # BUKKIT_DOWNLOAD_URL: "" + # PAPERBUILD: "" + # PAPER_DOWNLOAD_URL: "" + # AIRPLANE_BUILD: "lastSuccessfulBuild" + # MAGMA_CHANNEL: "stable" + # MOHIST_BUILD: "" + # CANYON_BUILD: "" + # SPONGEBRANCH: "STABLE" + # SPONGEVERSION: "" + # LIMBO_BUILD: "LATEST" + # LIMBO_SCHEMA_FILENAME: "default.schem" + # CRUCIBLE_RELEASE: "latest" + # FTB_MODPACK_ID: "" + # FTB_MODPACK_VERSION_ID: "" + # CF_SERVER_MOD: "" + # CF_BASE_DIR: "" + # USE_MODPACK_START_SCRIPT: true + # FTB_LEGACYJAVAFIXER: false + # WHITELIST: "" + # OPS: "" + # ICON: "" + SEED: "-1412583731547517931" + # GENERATOR_SETTINGS: "" + # WORLD: "" + # FORCE_REDOWNLOAD: false + # USE_FLARE_FLAGS: false + # USE_AIKAR_FLAGS: true + # USE_SIMD_FLAGS: false + # JVM_OPTS: "" + # JVM_XX_OPTS: "" + CF_API_KEY: "$2a$10$/${MINECRAFT_CF_API_KEY}" + # CF_PAGE_URL + # CF_SLUG + # CF_EXCLUDE_INCLUDE_FILE + # CF_EXCLUDE_MODS + # CF_FORCE_INCLUDE_MODS + # CF_FORCE_SYNCHRONIZE + # CF_OVERRIDES_SKIP_EXISTING + # CF_PARALLEL_DOWNLOADS + # CF_SET_LEVEL_FROM + mcbackup: + enabled: true + + persistence: + data: + volsync: + - name: b2 + type: restic + credentials: s3 + dest: + accessModes: + - ReadWriteOnce + enabled: true + src: + enabled: true + enabled: true + size: 500Gi + targetSelector: + main: + main: + mountPath: /data + mcbackup: + mcbackup: + mountPath: /data + readOnly: true + dynmap: + enabled: true + storageClass: ceph-nvme2 + size: 250Gi + targetSelector: + main: + main: + mountPath: /data/dynmap/web + #customdata: + # existingClaim: minecraft-serverdata-pvc + # enabled: true + # targetSelector: + # main: + # main: + # mountPath: /customdata + backups: + volsync: + - name: b2 + type: restic + credentials: s3 + dest: + accessModes: + - ReadWriteOnce + enabled: true + src: + enabled: true + enabled: true + storageClass: ceph-nvme2 + size: 250Gi + targetSelector: + mcbackup: + mcbackup: + mountPath: /backups + resources: + limits: + cpu: 10000m + memory: 14Gi + requests: + cpu: 1000m + memory: 5Gi + + ingress: + main: + enabled: true + primary: true + targetSelector: + dynmap: dynmap + hosts: + - host: dynmap.sixcraft.org + paths: + - path: / + pathType: Prefix + integrations: + certManager: + enabled: true + certificateIssuer: sc-le-prod + traefik: + enabled: true + middlewares: + - name: bouncer + namespace: traefik + #- name: auth + # namespace: traefik + entrypoints: + - websecure + enableFixedMiddlewares: true + forceTLS: true + allowCors: false + fixedMiddlewares: + - name: chain-basic + namespace: "" + + cnpg: + main: + enabled: false + primary: true + # -- Puts the cnpg cluster in hibernation mode + hibernate: false + pgVersion: 16 + mode: standalone + + # Database details + database: “dynmap” + user: “dynmap + password: “minecraftdynmapPASSWORD" + + # Database cluster configuration + cluster: + + # Number of instances + instances: 1 + + # set to true on single-node clusters to allow PVCs to be kept on instance restart + singleNode: true + # # -- storage size for the data pvc's + # # Follows the same spec as .Values.Persistence type=PVC + storage: + storageClass: “ceph-nvme2” + # # -- storage size for the wal pvc's + # # Follows the same spec as .Values.Persistence type=PVC + walStorage: + storageClass: “ceph-nvme2” + + + # The instances' log level, one of the following values: error, warning, info (default), debug, trace + logLevel: info + + backups: + enabled: true + credentials: s3 + recovery: + method: object_store + credentials: s3 diff --git a/clusters/main/kubernetes/apps/minecraft/app/kustomization.yaml b/clusters/main/kubernetes/apps/minecraft/app/kustomization.yaml new file mode 100644 index 00000000000..1b2b2dc29f5 --- /dev/null +++ b/clusters/main/kubernetes/apps/minecraft/app/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - helm-release.yaml diff --git a/clusters/main/kubernetes/apps/minecraft/app/namespace.yaml b/clusters/main/kubernetes/apps/minecraft/app/namespace.yaml new file mode 100644 index 00000000000..0b6e4de6447 --- /dev/null +++ b/clusters/main/kubernetes/apps/minecraft/app/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: minecraft diff --git a/clusters/main/kubernetes/apps/minecraft/ks.yaml b/clusters/main/kubernetes/apps/minecraft/ks.yaml new file mode 100644 index 00000000000..c3d47784c99 --- /dev/null +++ b/clusters/main/kubernetes/apps/minecraft/ks.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: minecraft + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/apps/minecraft/app + prune: true + sourceRef: + kind: GitRepository + name: six-shooter diff --git a/clusters/main/kubernetes/apps/vaultwarden/app/helm-release.yaml b/clusters/main/kubernetes/apps/vaultwarden/app/helm-release.yaml new file mode 100644 index 00000000000..5d51cdb479b --- /dev/null +++ b/clusters/main/kubernetes/apps/vaultwarden/app/helm-release.yaml @@ -0,0 +1,171 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: vaultwarden + namespace: vaultwarden +spec: + interval: 15m + chart: + spec: + chart: vaultwarden + version: 28.4.2 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 15m + timeout: 20m + maxHistory: 3 + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: + credentials: + s3: + type: s3 + url: "${S3URL}" + bucket: "${S3PREFIX}-vaultwarden" + accessKey: "${S3ID}" + secretKey: "${S3KEY}" + encrKey: "${S3KEY}" + workload: + main: + replicas: 2 + vaultwarden: + allowSignups: true + signupDomains: + - truecharts.org + - kjeldschouten.nl + verifySignup: true + requireEmail: true + allowInvitation: true + defaultInviteName: "TrueCharts" + showPasswordHint: true + enableWebVault: true + # Restrict creation of orgs. Options are: 'all', 'none' or a comma-separated list of users. + orgCreationUsers: all + ## Limit attachment disk usage per organization. + # attachmentLimitOrg: + ## Limit attachment disk usage per user. + # attachmentLimitUser: + ## HaveIBeenPwned API Key. Can be purchased at https://haveibeenpwned.com/API/Key. + # hibpApiKey: + + admin: + enabled: true + disableAdminToken: false + token: ${VWADMIN} + smtp: + enabled: true + host: "${SMTP}" + from: "noreply@truecharts.org" + fromName: "TrueCharts Vaultwarden" + security: starttls + port: 587 + # authMechanism: Plain + # heloName: "" + user: "${ICLOGIN}" + password: "${ICPASS}" + yubico: + enabled: false + ## Yubico server. Defaults to YubiCloud. + # server: + ## Yubico ID and Secret Key. + # clientId: + # secretKey: + push: + enabled: true + installationId: ${BWPUSHID} + installationKey: ${BWPUSHKEY} + log: + # Log level. Options are "trace", "debug", "info", "warn", "error" or "off". + level: "trace" + icons: + cache: 0 + + persistence: + data: + accessModes: + - ReadWriteMany + storageClass: ceph-filesystem-nvme-3 + volsync: + - name: b2 + type: restic + credentials: s3 + dest: + volumeSnapshotClassName: csi-ceph-filesystem + storageClassName: ceph-filesystem-nvme-3 + enabled: true + src: + volumeSnapshotClassName: csi-ceph-filesystem + storageClassName: ceph-filesystem-nvme-3 + enabled: true + + ingress: + main: + enabled: true + integrations: + certManager: + enabled: true + certificateIssuer: tc-le-prod + traefik: + enabled: true + middlewares: + - name: bouncer + namespace: traefik + hosts: + - host: vaultwarden.${BASE_DOMAIN2} + paths: + - path: / + pathType: Prefix + admin: + enabled: true + primary: false + targetSelector: + main: main + hosts: + - host: vaultwarden.${BASE_DOMAIN2} + paths: + - path: /admin + pathType: Prefix + integrations: + certManager: + enabled: true + certificateIssuer: tc-le-prod + traefik: + enabled: true + middlewares: + - name: local + namespace: traefik + - name: bouncer + namespace: traefik + - name: auth + namespace: traefik + entrypoints: + - websecure + enableFixedMiddlewares: true + forceTLS: true + allowCors: false + fixedMiddlewares: + - name: chain-basic + namespace: "" + + + cnpg: + main: + # mode: recovery + backups: + enabled: true + credentials: s3 + recovery: + method: object_store + credentials: s3 diff --git a/clusters/main/kubernetes/apps/vaultwarden/app/kustomization.yaml b/clusters/main/kubernetes/apps/vaultwarden/app/kustomization.yaml new file mode 100644 index 00000000000..1b2b2dc29f5 --- /dev/null +++ b/clusters/main/kubernetes/apps/vaultwarden/app/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - helm-release.yaml diff --git a/clusters/main/kubernetes/apps/vaultwarden/app/namespace.yaml b/clusters/main/kubernetes/apps/vaultwarden/app/namespace.yaml new file mode 100644 index 00000000000..fb678cf2279 --- /dev/null +++ b/clusters/main/kubernetes/apps/vaultwarden/app/namespace.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: vaultwarden + labels: + pod-security.kubernetes.io/enforce: privileged diff --git a/clusters/main/kubernetes/apps/vaultwarden/ks.yaml b/clusters/main/kubernetes/apps/vaultwarden/ks.yaml new file mode 100644 index 00000000000..69fcbdfe4dd --- /dev/null +++ b/clusters/main/kubernetes/apps/vaultwarden/ks.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: vaultwarden + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/apps/vaultwarden/app + prune: true + sourceRef: + kind: GitRepository + name: truecharts diff --git a/clusters/main/kubernetes/flux-entry.yaml b/clusters/main/kubernetes/flux-entry.yaml new file mode 100644 index 00000000000..fd5bb126191 --- /dev/null +++ b/clusters/main/kubernetes/flux-entry.yaml @@ -0,0 +1,41 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: six-shooter-flux-entry + namespace: flux-system +spec: + interval: 10m + path: ./clusters/main/kubernetes + prune: true + sourceRef: + kind: GitRepository + name: six-shooter + decryption: + provider: sops + secretRef: + name: sops-age + postBuild: + substituteFrom: + - kind: ConfigMap + name: cluster-config + patches: + - patch: |- + apiVersion: kustomize.toolkit.fluxcd.io/v1 + kind: Kustomization + metadata: + name: not-used + spec: + decryption: + provider: sops + secretRef: + name: sops-age + postBuild: + substituteFrom: + - kind: ConfigMap + name: cluster-config + target: + group: kustomize.toolkit.fluxcd.io + kind: Kustomization + labelSelector: substitution.flux.home.arpa/disabled notin (true) diff --git a/clusters/main/kubernetes/kustomization.yaml b/clusters/main/kubernetes/kustomization.yaml new file mode 100644 index 00000000000..f0cc0f8a397 --- /dev/null +++ b/clusters/main/kubernetes/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - apps