diff --git a/charts/incubator/wireguard/.helmignore b/charts/incubator/wireguard/.helmignore new file mode 100644 index 00000000000..77ca5567b26 --- /dev/null +++ b/charts/incubator/wireguard/.helmignore @@ -0,0 +1,30 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# OWNERS file for Kubernetes +OWNERS +# helm-docs templates +*.gotmpl +# docs folder +/docs +# icon +icon.png diff --git a/charts/incubator/wireguard/Chart.yaml b/charts/incubator/wireguard/Chart.yaml new file mode 100644 index 00000000000..26d56c7df70 --- /dev/null +++ b/charts/incubator/wireguard/Chart.yaml @@ -0,0 +1,26 @@ +apiVersion: v2 +appVersion: "10.6.2" +dependencies: + - name: common + repository: https://library-charts.truecharts.org + version: 10.5.0 +description: WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. +home: https://truecharts.org/docs/charts/stable/wireguard +icon: https://truecharts.org/img/hotlink-ok/chart-icons/wireguard.png +keywords: + - wireguard + - vpn +kubeVersion: ">=1.16.0-0" +maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org +name: wireguard +sources: + - https://github.com/k8s-at-home/container-images/tree/main/apps/wireguard +version: 0.0.1 +annotations: + truecharts.org/catagories: | + - network + truecharts.org/SCALE-support: "true" + truecharts.org/grade: U diff --git a/charts/incubator/wireguard/README.md b/charts/incubator/wireguard/README.md new file mode 100644 index 00000000000..e69de29bb2d diff --git a/charts/incubator/wireguard/icon.png b/charts/incubator/wireguard/icon.png new file mode 100644 index 00000000000..7bc3b43223a Binary files /dev/null and b/charts/incubator/wireguard/icon.png differ diff --git a/charts/incubator/wireguard/questions.yaml b/charts/incubator/wireguard/questions.yaml new file mode 100644 index 00000000000..3ab1cc0db7f --- /dev/null +++ b/charts/incubator/wireguard/questions.yaml @@ -0,0 +1,151 @@ +# Include{groups} +portals: + open: +# Include{portalLink} +questions: +# Include{global} +# Include{controller} +# Include{controllerDeployment} +# Include{replicas} +# Include{replica1} +# Include{strategy} +# Include{recreate} +# Include{controllerExpert} +# Include{controllerExpertExtraArgs} + - variable: wg + group: Container Configuration + label: Wireguard Configuration + schema: + additional_attrs: true + type: dict + attrs: + - variable: configFileHostPath + label: Config File Host Path + schema: + type: string + required: true + default: "" + - variable: killswitch + label: Killswitch + description: Enable a killswitch that kills all traffic when the VPN is not connected + schema: + type: boolean + default: false + - variable: excludedIP4networks + label: Killswitch Excluded IPv4 networks + description: List of Killswitch Excluded IPv4 Addresses + schema: + type: list + default: [] + items: + - variable: networkv4 + label: IPv4 Network + schema: + type: string + required: true + - variable: excludedIP6networks + label: Killswitch Excluded IPv6 networks + description: List of Killswitch Excluded IPv6 Addresses + schema: + type: list + default: [] + items: + - variable: networkv6 + label: IPv6 Network + schema: + type: string + required: true +# Include{containerConfig} +# Include{serviceRoot} + - variable: main + label: "Main Service" + description: "The Primary service on which the healthcheck runs, often the webUI" + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: main + label: "Main Service Port Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "Port" + description: "This port exposes the container port on the service" + schema: + type: int + default: 51820 + required: true +# Include{advancedPortUDP} + - variable: targetPort + label: "Target Port" + description: "The internal(!) port on the container the Application runs on" + schema: + type: int + default: 51820 +# Include{serviceExpertRoot} + default: false +# Include{serviceExpert} +# Include{serviceList} +# Include{persistenceList} +# Include{ingressRoot} + - variable: main + label: "Main Ingress" + schema: + additional_attrs: true + type: dict + attrs: +# Include{ingressDefault} +# Include{ingressTLS} +# Include{ingressTraefik} +# Include{ingressExpert} +# Include{ingressList} +# Include{security} +# Include{securityContextAdvancedRoot} + - variable: privileged + label: "Privileged mode" + schema: + type: boolean + default: false + - variable: readOnlyRootFilesystem + label: "ReadOnly Root Filesystem" + schema: + type: boolean + default: false + - variable: allowPrivilegeEscalation + label: "Allow Privilege Escalation" + schema: + type: boolean + default: false + - variable: runAsNonRoot + label: "runAsNonRoot" + schema: + type: boolean + default: false +# Include{securityContextAdvanced} +# Include{podSecurityContextRoot} + - variable: runAsUser + label: "runAsUser" + description: "The UserID of the user running the application" + schema: + type: int + default: 0 + - variable: runAsGroup + label: "runAsGroup" + description: "The groupID this App of the user running the application" + schema: + type: int + default: 0 + - variable: fsGroup + label: "fsGroup" + description: "The group that should own ALL storage." + schema: + type: int + default: 568 +# Include{podSecurityContextAdvanced} +# Include{resources} +# Include{advanced} +# Include{addons} +# Include{documentation} diff --git a/charts/incubator/wireguard/templates/_configfilemount.tpl b/charts/incubator/wireguard/templates/_configfilemount.tpl new file mode 100644 index 00000000000..bd325e64249 --- /dev/null +++ b/charts/incubator/wireguard/templates/_configfilemount.tpl @@ -0,0 +1,23 @@ +{{- define "wireguard.configfile" -}} +{{- if and .Values.wg.configFileHostPath ( not .Values.wg.config.enable ) }} +enabled: true +type: hostPath +readOnly: true +hostPathType: File +hostPath: {{ .Values.wg.configFileHostPath }} +mountPath: /etc/wireguard/wg0.conf +{{- end }} + +{{- if .Values.wg.config.enabled }} +enabled: true +type: secret +readOnly: true +defaultMode: "0600" +objectName: '{{ printf "%s-wg-config-secret" (include "tc.common.names.fullname" .) }}' +mountPath: /etc/wireguard +items: + - key: wg0.conf + path: wg0.conf +{{- end }} + +{{- end -}} diff --git a/charts/incubator/wireguard/templates/_configmap.tpl b/charts/incubator/wireguard/templates/_configmap.tpl new file mode 100644 index 00000000000..ec2e5a1c2a6 --- /dev/null +++ b/charts/incubator/wireguard/templates/_configmap.tpl @@ -0,0 +1,28 @@ +{{/* Define the secrets */}} +{{- define "wg.env.configmap" -}} + +{{- $configName := printf "%s-wg-env-config" (include "tc.common.names.fullname" .) }} +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ $configName }} + labels: + {{- include "tc.common.labels" . | nindent 4 }} +data: + SEPARATOR: ";" + IPTABLES_BACKEND: nft + KILLSWITCH: {{ .Values.wg.killswitch | quote }} + {{- if .Values.wg.killswitch }} + {{- $excludedIP4net := "172.16.0.0/12" }} + {{- range .Values.wg.excludedIP4networks }} + {{- $excludedIP4net = ( printf "%v;%v" $excludedIP4net . ) }} + {{- end }} + KILLSWITCH_EXCLUDEDNETWORKS_IPV4: {{ $excludedIP4net | quote }} + {{- $excludedIP6net := "" }} + {{- range .Values.wg.excludedIP6networks }} + {{- $excludedIP6net = ( printf "%v;%v" $excludedIP6net . ) }} + {{- end }} + KILLSWITCH_EXCLUDEDNETWORKS_IPV6: {{ $excludedIP4net | quote }} + {{- end }} +{{- end -}} diff --git a/charts/incubator/wireguard/templates/_secret.tpl b/charts/incubator/wireguard/templates/_secret.tpl new file mode 100644 index 00000000000..43238aece7e --- /dev/null +++ b/charts/incubator/wireguard/templates/_secret.tpl @@ -0,0 +1,16 @@ +{{/* Define the secrets */}} +{{- define "wg.config-secret" -}} + +{{- $secretName := printf "%s-wg-config-secret" (include "tc.common.names.fullname" .) }} +--- +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: {{ $secretName }} + labels: + {{- include "tc.common.labels" . | nindent 4 }} +data: + wg0.conf: | +{{ .Values.wg.config.data | b64enc | indent 4 }} +{{- end -}} diff --git a/charts/incubator/wireguard/templates/common.yaml b/charts/incubator/wireguard/templates/common.yaml new file mode 100644 index 00000000000..22f96e37a2f --- /dev/null +++ b/charts/incubator/wireguard/templates/common.yaml @@ -0,0 +1,12 @@ +{{/* Make sure all variables are set properly */}} +{{- include "tc.common.loader.init" . }} + +{{/* Render config */}} +{{- include "wg.env.configmap" . }} +{{/* Render secret */}} +{{- include "wg.config-secret" . }} + +{{- $_ := set .Values.persistence "configfile" (include "wireguard.configfile" . | fromYaml) -}} + +{{/* Render the templates */}} +{{ include "tc.common.loader.apply" . }} diff --git a/charts/incubator/wireguard/values.yaml b/charts/incubator/wireguard/values.yaml new file mode 100644 index 00000000000..e399b4d88e6 --- /dev/null +++ b/charts/incubator/wireguard/values.yaml @@ -0,0 +1,59 @@ +image: + repository: tccr.io/truecharts/wireguard + tag: v1.0.20210914@sha256:9f56e5660e8df8d4d38521ed73a4cc29fa24bf578007bfbe633e00184e2ebfbc + pullPolicy: IfNotPresent + +podSecurityContext: + runAsUser: 0 + runAsGroup: 0 + +securityContext: + runAsNonRoot: false + readOnlyRootFilesystem: false + capabilities: + add: + - NET_ADMIN + - SYS_MODULE + +wg: + killswitch: false + excludedIP4networks: [] + excludedIP6networks: [] + # Leave empty if you going to use the paste your config bellow + configFileHostPath: "" + config: + enabled: false + # Your wg config here eg: + data: | + [Interface] + Address = 10.0.0.1/24 + ListenPort = 51820 + PrivateKey = PRIVATE_KEY + + [Peer] + PublicKey = PUBLIC_KEY + AllowedIPs = 10.0.0.0/24 + Endpoint = wg.example:51820 + +envFrom: + - configMapRef: + name: '{{ include "tc.common.names.fullname" . }}-wg-env-config' + +probes: + liveness: + enabled: false + readiness: + enabled: false + startup: + enabled: false + +service: + main: + ports: + main: + port: 51820 + targetPort: 51820 + protocol: UDP + +portal: + enabled: false diff --git a/cspell.config.yaml b/cspell.config.yaml index 68a4a8d27ea..c220bd7117e 100644 --- a/cspell.config.yaml +++ b/cspell.config.yaml @@ -1,5 +1,6 @@ version: "0.2" words: + - airsonic - aliasgroup - allowtransparency - APITOKEN @@ -89,6 +90,7 @@ words: - multihost - neko - netdata + - networkv - nextcloud - nobind - nodeport