diff --git a/kubernetes/apps/default/authelia/app/helmrelease.yaml b/kubernetes/apps/default/authelia/app/helmrelease.yaml index f709e1f1a..83cb28681 100644 --- a/kubernetes/apps/default/authelia/app/helmrelease.yaml +++ b/kubernetes/apps/default/authelia/app/helmrelease.yaml @@ -45,7 +45,7 @@ spec: reloader.stakater.com/auto: "true" image: repository: ghcr.io/authelia/authelia - tag: master@sha256:master@sha256:a3647c3dd136402745c7639e446944004145630c822f27e22f999c414c234d2f + tag: master@sha256:a3647c3dd136402745c7639e446944004145630c822f27e22f999c414c234d2f args: ["--config", "/config/configuration.yaml", "--config.experimental.filters", "expand-env"] env: AUTHELIA_AUTHENTICATION_BACKEND_LDAP_ADDITIONAL_GROUPS_DN: ou=groups diff --git a/kubernetes/apps/default/outline/app/externalsecret.yaml b/kubernetes/apps/default/outline/app/externalsecret.yaml new file mode 100644 index 000000000..ca929a376 --- /dev/null +++ b/kubernetes/apps/default/outline/app/externalsecret.yaml @@ -0,0 +1,34 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: outline + namespace: default +spec: + secretStoreRef: + kind: ClusterSecretStore + name: onepassword-connect + target: + name: outline-secret + creationPolicy: Owner + template: + engineVersion: v2 + data: + # App + AWS_ACCESS_KEY_ID: "{{ .OUTLINE_AWS_ACCESS_KEY_ID }}" + AWS_SECRET_ACCESS_KEY: "{{ .OUTLINE_AWS_SECRET_ACCESS_KEY }}" + SECRET_KEY: "{{ .OUTLINE_SECRET_KEY }}" + UTILS_SECRET: "{{ .OUTLINE_UTILS_SECRET }}" + DATABASE_URL: postgresql://{{ .POSTGRES_USER }}:{{ .POSTGRES_PASS }}@postgres-rw.default.svc.cluster.local:5432/outline + # Postgres Init + INIT_POSTGRES_DBNAME: outline + INIT_POSTGRES_HOST: postgres-rw.default.svc.cluster.local + INIT_POSTGRES_USER: "{{ .POSTGRES_USER }}" + INIT_POSTGRES_PASS: "{{ .POSTGRES_PASS }}" + INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_SUPER_PASS }}" + dataFrom: + - extract: + key: cloudnative-pg + - extract: + key: outline diff --git a/kubernetes/apps/default/outline/app/helmrelease.yaml b/kubernetes/apps/default/outline/app/helmrelease.yaml index c8c9c5ed2..905f0918e 100644 --- a/kubernetes/apps/default/outline/app/helmrelease.yaml +++ b/kubernetes/apps/default/outline/app/helmrelease.yaml @@ -6,7 +6,7 @@ metadata: name: &app outline namespace: default spec: - interval: 15m + interval: 30m chart: spec: chart: app-template @@ -15,7 +15,7 @@ spec: kind: HelmRepository name: bjw-s namespace: flux-system - maxHistory: 3 + maxHistory: 2 install: createNamespace: true remediation: @@ -27,17 +27,45 @@ spec: uninstall: keepHistory: false values: + initContainers: + 01-init-db: + image: ghcr.io/onedr0p/postgres-init:14.8 + imagePullPolicy: IfNotPresent + envFrom: &envFrom + - secretRef: + name: &secret outline-secret controller: - replicas: 1 strategy: RollingUpdate annotations: reloader.stakater.com/auto: "true" image: repository: docker.io/outlinewiki/outline tag: 0.70.2 - envFrom: - - secretRef: - name: outline-secret + envFrom: *envFrom + env: + AWS_REGION: us-east-1 + AWS_S3_ACL: private + AWS_S3_FORCE_PATH_STYLE: "true" + AWS_S3_UPLOAD_BUCKET_NAME: outline + AWS_S3_UPLOAD_BUCKET_URL: "https://truenas.${SECRET_DOMAIN}:51515" + AWS_S3_UPLOAD_MAX_SIZE: "26214400" + ENABLE_UPDATES: "false" + OIDC_AUTH_URI: "https://auth.${SECRET_CLUSTER_DOMAIN}/api/oidc/authorization" + OIDC_CLIENT_ID: outline + OIDC_CLIENT_SECRET: "${SECRET_OUTLINE_OAUTH_CLIENT_SECRET}" + OIDC_DISPLAY_NAME: Authelia + OIDC_SCOPES: "openid profile email offline_access" + OIDC_TOKEN_URI: "https://auth.${SECRET_CLUSTER_DOMAIN}/api/oidc/token" + OIDC_USERINFO_URI: "https://auth.${SECRET_CLUSTER_DOMAIN}/api/oidc/userinfo" + OIDC_USERNAME_CLAIM: email + PORT: 8080 + REDIS_URL: ioredis://eyJkYiI6MTUsInNlbnRpbmVscyI6W3siaG9zdCI6InJlZGlzLW5vZGUtMC5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9LHsiaG9zdCI6InJlZGlzLW5vZGUtMS5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9LHsiaG9zdCI6InJlZGlzLW5vZGUtMi5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9XSwibmFtZSI6InJlZGlzLW1hc3RlciJ9 + SMTP_HOST: smtp-relay.default.svc.cluster.local. + SMTP_PORT: 2525 + SMTP_FROM_EMAIL: "outline@${SECRET_DOMAIN}" + SMTP_SECURE: "false" + URL: "https://docs.${SECRET_CLUSTER_DOMAIN}" + WEB_CONCURRENCY: 10 command: [ "/bin/sh", diff --git a/kubernetes/apps/default/outline/app/kustomization.yaml b/kubernetes/apps/default/outline/app/kustomization.yaml index 79a2be19c..85e530b33 100644 --- a/kubernetes/apps/default/outline/app/kustomization.yaml +++ b/kubernetes/apps/default/outline/app/kustomization.yaml @@ -4,8 +4,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: default resources: - - ./secret.sops.yaml + - ./externalsecret.yaml - ./helmrelease.yaml -patchesStrategicMerge: - - ./patches/env.yaml - - ./patches/postgres.yaml diff --git a/kubernetes/apps/default/outline/app/patches/env.yaml b/kubernetes/apps/default/outline/app/patches/env.yaml deleted file mode 100644 index b72f3d59c..000000000 --- a/kubernetes/apps/default/outline/app/patches/env.yaml +++ /dev/null @@ -1,33 +0,0 @@ ---- -# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: outline - namespace: default -spec: - values: - env: - AWS_REGION: us-east-1 - AWS_S3_ACL: private - AWS_S3_FORCE_PATH_STYLE: "true" - AWS_S3_UPLOAD_BUCKET_NAME: outline - AWS_S3_UPLOAD_BUCKET_URL: "https://truenas.${SECRET_DOMAIN}:51515" - AWS_S3_UPLOAD_MAX_SIZE: "26214400" - ENABLE_UPDATES: "false" - OIDC_AUTH_URI: "https://auth.${SECRET_CLUSTER_DOMAIN}/api/oidc/authorization" - OIDC_CLIENT_ID: outline - OIDC_CLIENT_SECRET: "${SECRET_OUTLINE_OAUTH_CLIENT_SECRET}" - OIDC_DISPLAY_NAME: Authelia - OIDC_SCOPES: "openid profile email offline_access" - OIDC_TOKEN_URI: "https://auth.${SECRET_CLUSTER_DOMAIN}/api/oidc/token" - OIDC_USERINFO_URI: "https://auth.${SECRET_CLUSTER_DOMAIN}/api/oidc/userinfo" - OIDC_USERNAME_CLAIM: email - PORT: 8080 - REDIS_URL: ioredis://eyJkYiI6MTUsInNlbnRpbmVscyI6W3siaG9zdCI6InJlZGlzLW5vZGUtMC5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9LHsiaG9zdCI6InJlZGlzLW5vZGUtMS5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9LHsiaG9zdCI6InJlZGlzLW5vZGUtMi5yZWRpcy1oZWFkbGVzcy5kZWZhdWx0LnN2Yy5jbHVzdGVyLmxvY2FsIiwicG9ydCI6MjYzNzl9XSwibmFtZSI6InJlZGlzLW1hc3RlciJ9 - SMTP_HOST: smtp-relay.default.svc.cluster.local. - SMTP_PORT: 2525 - SMTP_FROM_EMAIL: "outline@${SECRET_DOMAIN}" - SMTP_SECURE: "false" - URL: "https://docs.${SECRET_CLUSTER_DOMAIN}" - WEB_CONCURRENCY: 10 diff --git a/kubernetes/apps/default/outline/app/patches/postgres.yaml b/kubernetes/apps/default/outline/app/patches/postgres.yaml deleted file mode 100644 index 639df7813..000000000 --- a/kubernetes/apps/default/outline/app/patches/postgres.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: &app outline - namespace: default -spec: - values: - initContainers: - init-db: - image: ghcr.io/onedr0p/postgres-initdb:14.8 - env: - - name: POSTGRES_HOST - value: ${POSTGRES_HOST} - - name: POSTGRES_DB - value: *app - - name: POSTGRES_SUPER_PASS - valueFrom: - secretKeyRef: - name: postgres-superuser - key: password - envFrom: - - secretRef: - name: outline-secret diff --git a/kubernetes/apps/default/outline/app/secret.sops.yaml b/kubernetes/apps/default/outline/app/secret.sops.yaml deleted file mode 100644 index c9f3a82b3..000000000 --- a/kubernetes/apps/default/outline/app/secret.sops.yaml +++ /dev/null @@ -1,35 +0,0 @@ -# yamllint disable -apiVersion: v1 -kind: Secret -metadata: - name: outline-secret - namespace: default -type: Opaque -stringData: - AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:ZJ6v/Kyxxy5mu2XrA003uRVHRzI=,iv:0tBr1HSrUNMQMxFi+RzgfKV7x/Ee99dL5DFXMSFjJtw=,tag:v7AVhxXjVV3cvpAANGVLeg==,type:str] - AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:2GGPneKPmFEtq3A9X7fskiv/FnKv5deoyzNx0/euYrTOJKrRiTgj8g==,iv:u1LLrjxP1GwWcM1FJLjB9OpUFTPI0D9IZEX86IHGpmU=,tag:7vq4QeQagU2B9+WShheDKg==,type:str] - SECRET_KEY: ENC[AES256_GCM,data:RUjf4wghv9PnDdSNWeytoDRzH+A7wa8RNYDP+MYIf8KHjOGyVNzZwEuS8ah8wy8tvBWAE9kykOC1KhP+wFofIA==,iv:3z7NZ87ILlyrkx4YMWQ9uFL2W31bTmwZFkJxOHgSVvo=,tag:umplfrhjvCZX9Ucneo7Q+Q==,type:str] - UTILS_SECRET: ENC[AES256_GCM,data:r5DADkQbM5fEBsWs7ddUx2PXnt+ePiQcJZgKMmHYpkddmPFeS5xpJGgbhun7v409aKJLQRm/tUIysBlxHlnSbA==,iv:cP2KQeUmgjoXuY7UnQ57M4tBUeO0hELGe+HrSB5RJ3Q=,tag:HD4lccnbZXjllmOLyEHY3Q==,type:str] - DATABASE_URL: ENC[AES256_GCM,data:Q/lDi+O65wYIH4dBve0WBy4tHGbwgMfzzoz1N8VTu0kl5Myxjk36bCUFzfP62RYicdXEJpffUigtlwKQxnFT5Atu8xvpeqmsZ0Gq6IXfE3+NWCeNXkD1BkqD,iv:hhX+hW7fuuUbKrvhTd0j9wPpZzbZxbJulfYhrH3S304=,tag:COskqvtXUxqOuv92QL3hXw==,type:str] - POSTGRES_USER: ENC[AES256_GCM,data:4FlwiUkmmQ==,iv:f/mOMCV34bvseHAJ37AaUIZUYcBobtdIAYN/5ONhGbg=,tag:HFvPkQh2i/BtnynAjP0uhg==,type:str] - POSTGRES_PASS: ENC[AES256_GCM,data:DrO0C2kyUu9irfd3I4Ii/2QZcIA=,iv:44crBneaLpsyp9POZqNVQfh2JYIsJD4Yoq1YrvyANGc=,tag:V84EYlBMZzVj9bs8k4dV8g==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFYUFSaFFVbVgyTXkzbmFR - NHllQjdJcEUxdlloWC9sSGtJNnBoL0xIM1VjCmk4NFpEM0ZFOEJKWCtyNkRTVkdw - SFVBY1J4c1VUdnQxZnVOWHFWbmYzRlUKLS0tIDE0L3VybUhnSkJlYStxR0k4dzZ6 - eGsyL3NhNS8xdUp0VlNQbWRYbHFLYW8KeMc82BlegMJMtAF/WGMbXhpf2MVvUP5q - ehHCSwpe3a8WwXEBNu1u5IPcnMO4Fo5HhjLbMx6H1Ynd6KdyDXUKEg== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2022-12-01T22:25:43Z" - mac: ENC[AES256_GCM,data:/zmgGjJRYcDt4iXpLyDN2MA0FWxuQmmZNRggw0UX+IPgUrvGKmLpLsC3+0zhHUAwjANgWtQ5pJWHMuz1R39lOOBEcUBM4Re/ZTnyClDZIkxVC0WUrmTsj4spz719v9iwORYmTQujPW6bO9a/1KFNL5KjKqz/7Qx8Iu9MsCNfIfE=,iv:iUD51jsCdT4uBnWiAS20DITCdN1lov0Ibz3EacXNQOs=,tag:46LubofEdvYErTrgsgUGxg==,type:str] - pgp: [] - encrypted_regex: ^(data|stringData)$ - version: 3.7.3 diff --git a/kubernetes/apps/default/outline/ks.yaml b/kubernetes/apps/default/outline/ks.yaml index 2b76b6000..8949be6a9 100644 --- a/kubernetes/apps/default/outline/ks.yaml +++ b/kubernetes/apps/default/outline/ks.yaml @@ -15,6 +15,7 @@ spec: name: home-ops-kubernetes dependsOn: - name: cluster-apps-cloudnative-pg-cluster + - name: cluster-apps-external-secrets-stores healthChecks: - apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease diff --git a/kubernetes/apps/default/vaultwarden/app/backups/kustomization.yaml b/kubernetes/apps/default/vaultwarden/app/backups/kustomization.yaml deleted file mode 100644 index 57bca902d..000000000 --- a/kubernetes/apps/default/vaultwarden/app/backups/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./replicationsource.yaml - - ./restic.sops.yaml diff --git a/kubernetes/apps/default/vaultwarden/app/backups/replicationsource.yaml b/kubernetes/apps/default/vaultwarden/app/backups/replicationsource.yaml deleted file mode 100644 index 366ba4dc9..000000000 --- a/kubernetes/apps/default/vaultwarden/app/backups/replicationsource.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json -apiVersion: volsync.backube/v1alpha1 -kind: ReplicationSource -metadata: - name: vaultwarden - namespace: default -spec: - sourcePVC: vaultwarden-data - trigger: - schedule: "0 0 * * *" - restic: - copyMethod: Snapshot - pruneIntervalDays: 10 - repository: vaultwarden-restic - cacheCapacity: 2Gi - volumeSnapshotClassName: csi-ceph-blockpool - storageClassName: rook-ceph-block - retain: - daily: 10 - within: 3d diff --git a/kubernetes/apps/default/vaultwarden/app/backups/restic.sops.yaml b/kubernetes/apps/default/vaultwarden/app/backups/restic.sops.yaml deleted file mode 100644 index ffd3b319e..000000000 --- a/kubernetes/apps/default/vaultwarden/app/backups/restic.sops.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: vaultwarden-restic - namespace: default -type: Opaque -stringData: - #ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment] - RESTIC_REPOSITORY: ENC[AES256_GCM,data:uOeOyeDbYvbOzaHbzBEiGGbTajNGiyyvdAZ6gxQsQkK/7zlYGjjHJToe1P08f9ubfJvb1qYDolbUFG1r7w==,iv:Rt+XeXIaPCNe/4RN1j+Oq1onSuL7ygObJ6RE8OtVqQM=,tag:O60RdSxw1vtklvaCSPA+rA==,type:str] - #ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment] - RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str] - #ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment] - #ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment] - AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str] - AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ - THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB - TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN - dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4 - 3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2022-12-28T06:25:12Z" - mac: ENC[AES256_GCM,data:p1g7s7w7umL5nLw8MiFZUwFf7a8/iFE/AAFS5roUoxUZA3L2DULAvx3cHyOHuTWLXJRuvrTWDR4EgvGo3fgXcsWLSKEK/5G7ZK2gsBRjr3nrcGoOmf6ICj7W5tsjP3t9IZ6XHApu1DG83GTm/eehNuQOt6bGp/eTjjB3j+bScOo=,iv:VYZu8ryjAd1N7+2qhZjhbYiSCa5zQTnrITitT8W8QhA=,tag:UV5AmjLD02N0HfqsIqJUeA==,type:str] - pgp: [] - encrypted_regex: ^(data|stringData)$ - version: 3.7.3 diff --git a/kubernetes/apps/default/vaultwarden/app/externalsecret.yaml b/kubernetes/apps/default/vaultwarden/app/externalsecret.yaml new file mode 100644 index 000000000..d2cb27f33 --- /dev/null +++ b/kubernetes/apps/default/vaultwarden/app/externalsecret.yaml @@ -0,0 +1,31 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: vaultwarden + namespace: default +spec: + secretStoreRef: + kind: ClusterSecretStore + name: onepassword-connect + target: + name: vaultwarden-secret + creationPolicy: Owner + template: + engineVersion: v2 + data: + # App + DATABASE_URL: postgresql://{{ .POSTGRES_USER }}:{{ .POSTGRES_PASS }}@postgres-rw.default.svc.cluster.local.:5432/vaultwarden + ADMIN_TOKEN: "{{ .VAULTWARDEN_ADMIN_TOKEN }}" + # Postgres Init + INIT_POSTGRES_DBNAME: vaultwarden + INIT_POSTGRES_HOST: postgres-rw.default.svc.cluster.local + INIT_POSTGRES_USER: "{{ .POSTGRES_USER }}" + INIT_POSTGRES_PASS: "{{ .POSTGRES_PASS }}" + INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_SUPER_PASS }}" + dataFrom: + - extract: + key: cloudnative-pg + - extract: + key: vaultwarden diff --git a/kubernetes/apps/default/vaultwarden/app/helmrelease.yaml b/kubernetes/apps/default/vaultwarden/app/helmrelease.yaml index d6cae8d55..f1ffaf220 100644 --- a/kubernetes/apps/default/vaultwarden/app/helmrelease.yaml +++ b/kubernetes/apps/default/vaultwarden/app/helmrelease.yaml @@ -6,7 +6,7 @@ metadata: name: &app vaultwarden namespace: default spec: - interval: 15m + interval: 30m chart: spec: chart: app-template @@ -15,7 +15,7 @@ spec: kind: HelmRepository name: bjw-s namespace: flux-system - maxHistory: 3 + maxHistory: 2 install: createNamespace: true remediation: @@ -27,6 +27,16 @@ spec: uninstall: keepHistory: false values: + initContainers: + 01-init-db: + image: ghcr.io/onedr0p/postgres-init:14.8 + imagePullPolicy: IfNotPresent + envFrom: &envFrom + - secretRef: + name: &secret vaultwarden-secret + controller: + annotations: + reloader.stakater.com/auto: "true" image: repository: vaultwarden/server tag: 1.29.0 @@ -45,11 +55,7 @@ spec: SMTP_FROM_NAME: vaultwarden SMTP_PORT: 2525 SMTP_SECURITY: "off" - envFrom: - - secretRef: - name: *app - podAnnotations: - secret.reloader.stakater.com/reload: *app + envFrom: *envFrom service: main: ports: diff --git a/kubernetes/apps/default/vaultwarden/app/kustomization.yaml b/kubernetes/apps/default/vaultwarden/app/kustomization.yaml index ec111867e..f082c6d3b 100644 --- a/kubernetes/apps/default/vaultwarden/app/kustomization.yaml +++ b/kubernetes/apps/default/vaultwarden/app/kustomization.yaml @@ -4,9 +4,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: default resources: - - ./backups + - ./externalsecret.yaml - ./helmrelease.yaml - - ./secret.sops.yaml + - ./volsync.yaml - ./volume.yaml -patchesStrategicMerge: - - ./patches/postgres.yaml diff --git a/kubernetes/apps/default/vaultwarden/app/patches/postgres.yaml b/kubernetes/apps/default/vaultwarden/app/patches/postgres.yaml deleted file mode 100644 index d4338f391..000000000 --- a/kubernetes/apps/default/vaultwarden/app/patches/postgres.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: vaultwarden - namespace: default -spec: - values: - initContainers: - init-db: - image: ghcr.io/onedr0p/postgres-initdb:14.8 - env: - - name: POSTGRES_HOST - value: ${POSTGRES_HOST} - - name: POSTGRES_DB - value: vaultwarden - - name: POSTGRES_SUPER_PASS - valueFrom: - secretKeyRef: - name: postgres-superuser - key: password - - name: POSTGRES_USER - valueFrom: - secretKeyRef: - name: vaultwarden - key: POSTGRES_USER - - name: POSTGRES_PASS - valueFrom: - secretKeyRef: - name: vaultwarden - key: POSTGRES_PASS diff --git a/kubernetes/apps/default/vaultwarden/app/secret.sops.yaml b/kubernetes/apps/default/vaultwarden/app/secret.sops.yaml deleted file mode 100644 index 1fe0105e0..000000000 --- a/kubernetes/apps/default/vaultwarden/app/secret.sops.yaml +++ /dev/null @@ -1,32 +0,0 @@ -# yamllint disable -apiVersion: v1 -kind: Secret -metadata: - name: vaultwarden - namespace: default -type: Opaque -stringData: - ADMIN_TOKEN: ENC[AES256_GCM,data:lckmNXsxah0qbl0Lj+U9ow9iL8i2UcELDBVHX/auyfqW+1Lp6QzutQ9A20m04y9RHRU8ifXo4mfaA5Bn6FvuYQ==,iv:qWBB0oeZJ7Bju+nGdrGZm/hjODi7vPVnRb6Qiw0jmFY=,tag:Sg5nfHjFx5jo6GD0GGglwg==,type:str] - DATABASE_URL: ENC[AES256_GCM,data:mFxeL8sQIuEG0x+c9ZN9cgFzx4xLOEFprQuNL12w6ZuGxMlY2gAJ3W/fktnbSqHveaKqBulKrh8StS/AtFZ9P27EPZqZuIPDJ3JI42zWtB2krW9CmK7SIa+oxfRLCdXug646,iv:vwlwfOcuXjE6kXLcASqq4yXNrA6jblfr5d0j8jlFTSw=,tag:yR2TzKyhpRlc91U3ob5rkg==,type:str] - POSTGRES_USER: ENC[AES256_GCM,data:C8AE1A15q9TnIqk=,iv:4B+9fmpVu6B4HyQ2FF6tiCBYBP8q88ExRfLZuyIbbIA=,tag:tCPk0oYjP2uQfKu6a4HP4g==,type:str] - POSTGRES_PASS: ENC[AES256_GCM,data:er6JHXy0vxBperPCq3fWOWYh,iv:aUh/ZwFb4XWirA5V0/9O8dIsQHQlWJIqe8cq5WXAlv4=,tag:M++5dqnSyY5DVKyxaoCkMg==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaU16anJNV2pBZmxPR3h2 - bWREUnpjcTFvd05ZQ2E4VVBDdm1FL2k4WEYwCkdQSStTNWtpdjNkUW51WS9MekdC - VkpTUUFjSjY2a1JMOUtqOVh5M0JRR2sKLS0tIDRmcWpJSEVvaUp4U1lsaTZYZGNw - OGVKWU0zNUZJSFh4aFJxQWFsYm1VeFkKaDeI/hl7z0Qh8t5W39Kxu9ert1dt4xo+ - LX+MjpVqxiZNcfwROD4bkWeQSN+VsxoGOOyj4L15BlggNnlg+L7Hww== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2022-09-16T11:38:24Z" - mac: ENC[AES256_GCM,data:UvnBQRkO/GDyUkTVPGkXsDCy3HTpjTtFJdQPU6Y375qy+3kI8SJFQ/YlYL3Z5W5OBnriOfMrfzOK8+QbaPGHK9hg2A6dDXPwjF+8YYesUspOJ+lRCoWsuubYJragW7nKcpeNVcMMWPNFK1vPwCR0pC8rBZDOF8dXoGe9Ozk1yvA=,iv:2P/c5IXti6zV/j9QFynvS+bXwgH6mANh6CzB4vCmE1Q=,tag:GmOovYX2kVjDL9fm17gAHw==,type:str] - pgp: [] - encrypted_regex: ^(data|stringData)$ - version: 3.7.3 diff --git a/kubernetes/apps/default/vaultwarden/app/volsync.yaml b/kubernetes/apps/default/vaultwarden/app/volsync.yaml new file mode 100644 index 000000000..a38c82967 --- /dev/null +++ b/kubernetes/apps/default/vaultwarden/app/volsync.yaml @@ -0,0 +1,49 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: lychee-restic + namespace: default +spec: + secretStoreRef: + kind: ClusterSecretStore + name: onepassword-connect + target: + name: lychee-restic-secret + creationPolicy: Owner + template: + engineVersion: v2 + data: + RESTIC_REPOSITORY: '{{ .REPOSITORY_TEMPLATE }}/lychee' + RESTIC_PASSWORD: '{{ .RESTIC_PASSWORD }}' + AWS_ACCESS_KEY_ID: '{{ .AWS_ACCESS_KEY_ID }}' + AWS_SECRET_ACCESS_KEY: '{{ .AWS_SECRET_ACCESS_KEY }}' + dataFrom: + - extract: + key: volsync-restic-template +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/volsync.backube/replicationsource_v1alpha1.json +apiVersion: volsync.backube/v1alpha1 +kind: ReplicationSource +metadata: + name: lychee + namespace: default +spec: + sourcePVC: lychee-files + trigger: + schedule: "0 7 * * *" + restic: + copyMethod: Snapshot + pruneIntervalDays: 7 + repository: lychee-restic-secret + cacheCapacity: 20Gi + volumeSnapshotClassName: csi-ceph-blockpool + storageClassName: rook-ceph-block + moverSecurityContext: + runAsUser: 33 + runAsGroup: 33 + fsGroup: 33 + retain: + daily: 7 + within: 3d diff --git a/kubernetes/apps/default/vaultwarden/ks.yaml b/kubernetes/apps/default/vaultwarden/ks.yaml index f809c0f1f..d1faa252f 100644 --- a/kubernetes/apps/default/vaultwarden/ks.yaml +++ b/kubernetes/apps/default/vaultwarden/ks.yaml @@ -15,6 +15,7 @@ spec: name: home-ops-kubernetes dependsOn: - name: cluster-apps-cloudnative-pg-cluster + - name: cluster-apps-external-secrets-stores - name: cluster-apps-rook-ceph-cluster - name: cluster-apps-volsync-app healthChecks: