Initial commit

templates/configmap.yml.j2

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ (luanti_wasm_name ~ '-config') | to_json }}
+  namespace: {{ luanti_wasm_namespace | to_json }}
+data:
+  nginx.conf: {{ lookup('ansible.builtin.template', 'nginx.conf.j2') | to_json }}
+  lwproxy.toml: {{ lookup('ansible.builtin.template', 'proxy.toml.j2') | to_json }}

templates/deployment.yml.j2

@@ -0,0 +1,110 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ luanti_wasm_name | to_json }}
+  namespace: {{ luanti_wasm_namespace | to_json }}
+spec:
+  replicas: {{ luanti_wasm_replicas }}
+  revisionHistoryLimit: 2
+  selector:
+    matchLabels:
+      app: {{ luanti_wasm_name | to_json }}
+  template:
+    metadata:
+      labels:
+        app: {{ luanti_wasm_name | to_json }}
+      annotations:
+        checksum/config: {{ lookup('ansible.builtin.template', 'configmap.yml.j2') | hash('sha256') | to_json }}
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        fsGroup: 101
+        seccompProfile:
+          type: RuntimeDefault
+      imagePullSecrets: {{ luanti_wasm_image_pull_secrets | to_json }}
+      nodeSelector: {{ luanti_wasm_node_selector | to_json }}
+      tolerations: {{ luanti_wasm_tolerations | to_json }}
+      containers:
+        - name: web
+          image: {{ luanti_wasm_web_image | to_json }}
+          imagePullPolicy: {{ luanti_wasm_image_pull_policy | to_json }}
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 101
+            runAsGroup: 101
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          startupProbe:
+            httpGet:
+              path: /
+              port: http
+            periodSeconds: 2
+            failureThreshold: 30
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            periodSeconds: 20
+          resources: {{ luanti_wasm_web_resources | to_json }}
+          volumeMounts:
+            - name: config
+              mountPath: /etc/nginx/nginx.conf
+              subPath: nginx.conf
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+        - name: proxy
+          image: {{ luanti_wasm_proxy_image | to_json }}
+          imagePullPolicy: {{ luanti_wasm_image_pull_policy | to_json }}
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65532
+            runAsGroup: 65532
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+          ports:
+            - name: proxy
+              containerPort: 7777
+              protocol: TCP
+          startupProbe:
+            tcpSocket:
+              port: proxy
+            periodSeconds: 2
+            failureThreshold: 30
+          readinessProbe:
+            tcpSocket:
+              port: proxy
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket:
+              port: proxy
+            periodSeconds: 20
+          resources: {{ luanti_wasm_proxy_resources | to_json }}
+          volumeMounts:
+            - name: config
+              mountPath: /etc/lwproxy.toml
+              subPath: lwproxy.toml
+              readOnly: true
+      volumes:
+        - name: config
+          configMap:
+            name: {{ (luanti_wasm_name ~ '-config') | to_json }}
+            defaultMode: 0444
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: {{ luanti_wasm_tmp_size_limit | to_json }}

templates/ingress.yml.j2

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ luanti_wasm_name | to_json }}
+  namespace: {{ luanti_wasm_namespace | to_json }}
+{% if luanti_wasm_ingress_enabled %}
+  annotations: {{ (luanti_wasm_ingress_annotations | combine({'cert-manager.io/cluster-issuer': luanti_wasm_cluster_issuer} if luanti_wasm_cluster_issuer | length > 0 else {})) | to_json }}
+spec:
+{% if luanti_wasm_ingress_class | length > 0 %}
+  ingressClassName: {{ luanti_wasm_ingress_class | to_json }}
+{% endif %}
+  tls:
+    - hosts: [{{ luanti_wasm_hostname | to_json }}]
+      secretName: {{ luanti_wasm_tls_secret_name | to_json }}
+  rules:
+    - host: {{ luanti_wasm_hostname | to_json }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ luanti_wasm_name | to_json }}
+                port:
+                  number: 8080
+{% endif %}

templates/networkpolicy.yml.j2

@@ -0,0 +1,48 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ luanti_wasm_name | to_json }}
+  namespace: {{ luanti_wasm_namespace | to_json }}
+spec:
+  podSelector:
+    matchLabels:
+      app: {{ luanti_wasm_name | to_json }}
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - ports:
+        - port: 8080
+          protocol: TCP
+{% if luanti_wasm_ingress_peers | length > 0 %}
+      from: {{ luanti_wasm_ingress_peers | to_json }}
+{% endif %}
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    - to:
+{% for cidr in luanti_wasm_game_cidrs %}
+        - ipBlock:
+            cidr: {{ cidr | to_json }}
+{% endfor %}
+      ports:
+        - port: {{ luanti_wasm_game_port }}
+          protocol: UDP
+{% if luanti_wasm_https_cidrs | length > 0 %}
+    - to:
+{% for cidr in luanti_wasm_https_cidrs %}
+        - ipBlock:
+            cidr: {{ cidr | to_json }}
+{% endfor %}
+      ports:
+        - port: 443
+          protocol: TCP
+{% endif %}

templates/nginx.conf.j2

@@ -0,0 +1,58 @@
+worker_processes auto;
+pid /tmp/nginx.pid;
+error_log /dev/stderr warn;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    access_log /dev/stdout;
+    sendfile on;
+    server_tokens off;
+    client_body_temp_path /tmp/client_temp;
+    proxy_temp_path /tmp/proxy_temp;
+    fastcgi_temp_path /tmp/fastcgi_temp;
+    uwsgi_temp_path /tmp/uwsgi_temp;
+    scgi_temp_path /tmp/scgi_temp;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+    }
+    map $uri $cache_control {
+        default "no-cache";
+        "~^/[0-9a-f]{12}/" "public, max-age=31536000, immutable";
+    }
+
+    server {
+        listen 8080;
+        root /usr/share/nginx/html;
+        index index.html;
+
+        add_header Cross-Origin-Opener-Policy same-origin always;
+        add_header Cross-Origin-Embedder-Policy require-corp always;
+        add_header X-Content-Type-Options nosniff always;
+        add_header Cache-Control $cache_control always;
+
+        location = /proxy {
+            proxy_pass http://127.0.0.1:7777;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+            proxy_read_timeout {{ luanti_wasm_websocket_timeout_seconds }}s;
+            proxy_send_timeout {{ luanti_wasm_websocket_timeout_seconds }}s;
+            proxy_buffering off;
+        }
+
+        location / {
+            try_files $uri $uri/ =404;
+        }
+        location ~ /\. {
+            deny all;
+        }
+    }
+}

templates/proxy.toml.j2

@@ -0,0 +1,9 @@
+[[serve]]
+protocol = "ws"
+# Pod-IP binding is required for kubelet TCP probes. NetworkPolicy denies ingress
+# to 7777; nginx talks to this sidecar through the shared pod loopback interface.
+bind_address = "0.0.0.0:7777"
+
+[http_proxy]
+# JSON string arrays are valid TOML, including escaping untrusted strings.
+allowed_hosts = {{ luanti_wasm_http_allowed_hosts | to_json }}

templates/service.yml.j2

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ luanti_wasm_name | to_json }}
+  namespace: {{ luanti_wasm_namespace | to_json }}
+spec:
+  type: ClusterIP
+  selector:
+    app: {{ luanti_wasm_name | to_json }}
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+      protocol: TCP