diff --git a/kubernetes/apps/default/kustomization.yaml b/kubernetes/apps/default/kustomization.yaml index 426bf8157..a0fb247e5 100644 --- a/kubernetes/apps/default/kustomization.yaml +++ b/kubernetes/apps/default/kustomization.yaml @@ -32,6 +32,7 @@ resources: - ./kubernetes-schemas/ks.yaml - ./lidarr/ks.yaml - ./libreddit/ks.yaml + - ./lldap/ks.yaml - ./lychee/ks.yaml - ./mailrise/ks.yaml - ./media-browser/ks.yaml diff --git a/kubernetes/apps/default/lldap/app/gatus.yaml b/kubernetes/apps/default/lldap/app/gatus.yaml new file mode 100644 index 000000000..ea3fedb65 --- /dev/null +++ b/kubernetes/apps/default/lldap/app/gatus.yaml @@ -0,0 +1,21 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: lldap-gatus-ep + namespace: default + labels: + gatus.io/enabled: "true" +data: + config.yaml: | + endpoints: + - name: lldap + group: internal + url: https://lldap.${SECRET_CLUSTER_DOMAIN} + interval: 1m + client: + insecure: true + conditions: + - "[STATUS] == 200" + alerts: + - type: pushover diff --git a/kubernetes/apps/default/lldap/app/helmrelease.yaml b/kubernetes/apps/default/lldap/app/helmrelease.yaml new file mode 100644 index 000000000..0bdb94b59 --- /dev/null +++ b/kubernetes/apps/default/lldap/app/helmrelease.yaml @@ -0,0 +1,89 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: &app lldap + namespace: default +spec: + interval: 30m + chart: + spec: + chart: app-template + version: 1.5.1 + sourceRef: + kind: HelmRepository + name: bjw-s + namespace: flux-system + maxHistory: 2 + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: + initContainers: + 01-init-db: + image: ghcr.io/onedr0p/postgres-init:14.8 + imagePullPolicy: IfNotPresent + envFrom: &envFrom + - secretRef: + name: lldap-secret + controller: + replicas: 2 + strategy: RollingUpdate + annotations: + reloader.stakater.com/auto: "true" + image: + repository: ghcr.io/lldap/lldap + # TODO: Switch to release tag on next release + tag: latest-alpine@sha256:5e8d4770d7fdcfb752ad5a9dc41c19f5c3328f775459b436cf4c50fb87355cf3 + env: + TZ: ${TIMEZONE} + LLDAP_HTTP_PORT: &port 8080 + LLDAP_HTTP_URL: https://lldap.${SECRET_CLUSTER_DOMAIN} + LLDAP_LDAP_PORT: &ldapPort 5389 + LLDAP_LDAP_BASE_DN: dc=home,dc=arpa + envFrom: *envFrom + service: + main: + ports: + http: + port: *port + ldap: + enabled: true + port: *ldapPort + ingress: + main: + enabled: true + ingressClassName: nginx + hosts: + - host: &host "{{ .Release.Name }}.${SECRET_CLUSTER_DOMAIN}" + paths: + - path: / + pathType: Prefix + tls: + - hosts: + - *host + persistence: + data: + enabled: true + type: emptyDir + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: DoNotSchedule + labelSelector: + matchLabels: + app.kubernetes.io/name: *app + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + memory: 500Mi diff --git a/kubernetes/apps/default/lldap/app/kustomization.yaml b/kubernetes/apps/default/lldap/app/kustomization.yaml new file mode 100644 index 000000000..9825106dd --- /dev/null +++ b/kubernetes/apps/default/lldap/app/kustomization.yaml @@ -0,0 +1,9 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: default +resources: + - ./gatus.yaml + - ./helmrelease.yaml + - ./secret.sops.yaml diff --git a/kubernetes/apps/default/lldap/app/secret.sops.yaml b/kubernetes/apps/default/lldap/app/secret.sops.yaml new file mode 100644 index 000000000..f3ddf4041 --- /dev/null +++ b/kubernetes/apps/default/lldap/app/secret.sops.yaml @@ -0,0 +1,40 @@ +# yamllint disable +apiVersion: v1 +kind: Secret +metadata: + name: lldap-secret + namespace: default +stringData: + #ENC[AES256_GCM,data:/lxgog==,iv:6ECsF69rzmsw0wMAMOjbT0lYivVx2zE/CRrSSfIacoA=,tag:xXJej38dzNL5adzZaZyVMA==,type:comment] + LLDAP_JWT_SECRET: ENC[AES256_GCM,data:E+KOEuQC6mYoAmAJS+6cr5Br053eEICP8M/KdFgNDx8Sfofelqd5TQ==,iv:cyoF4Mx5qHHtYl+74a/17YOUB+nV17GH60bBar/yWRM=,tag:sxM7IXbI2Fd5fXjH2VD6xg==,type:str] + LLDAP_LDAP_USER_PASS: ENC[AES256_GCM,data:fCcvXK50rdfESW2rx4RmpeJnmRY=,iv:G2GuddKOxnXkRZGXpMOzlQpUymtu9vftHnifzpbAZ3E=,tag:HbD+R0fZ2qgwq3wzIQeRlQ==,type:str] + LLDAP_USER_DN: ENC[AES256_GCM,data:6sq4ttw=,iv:IkA1DBrd8xrRjqqtdHaThNhjotrtcymWwirGZ94mTXQ=,tag:YFMuKBOvoymL/BTd7q/c4w==,type:str] + LLDAP_LDAP_USER_EMAIL: ENC[AES256_GCM,data:bxF5/HOK5Wq2lc+1KVldPCux6ZI=,iv:CsmuJgZqeCHkVs6AmI5L15KthVTUgeQVKOfsU0dawtQ=,tag:dWDspVAhGJErvyusXFDlGA==,type:str] + LLDAP_SERVER_KEY_SEED: ENC[AES256_GCM,data:GJHrDu2DG8kzfdExSj6wbcRy4TI=,iv:tgYmKoSLMwDGnVqXy1z8GAZox1zsFDKHpvJxXOqOPu8=,tag:OOEV1+O9xyBvHLohmaN/Yg==,type:str] + LLDAP_DATABASE_URL: ENC[AES256_GCM,data:qJ9E2sMLelk5aNui26R+QXFRQTBtV7VN0J9PeI+Qc0hhFb+4J0aNHhzninMSH+yQaWWau4cHPweMIZl21w6UgbaslwdR08H4pODNRlPTHOkz,iv:WOULxNFF8lOXlxzSvGooIK5PSa7+I1+Hff/pTlKRLpk=,tag:MRL3qp7l24ATzAgGh/ohQQ==,type:str] + #ENC[AES256_GCM,data:hqWl8RxgH1OjSqqXRQY=,iv:NpLdgyoRj3ktslB/Zok+33E+qQuGwfIZKzkdbRqPZ5I=,tag:/r82K47Nut8F1GVi8Jp6AA==,type:comment] + INIT_POSTGRES_DBNAME: ENC[AES256_GCM,data:VbV39Uw=,iv:fF0G4nHt8Xh0l7KQoRY6f4a+3W3q0S8jOhTvTm+F5cg=,tag:JJkeUzjN9uPpS1cBss4ppQ==,type:str] + INIT_POSTGRES_HOST: ENC[AES256_GCM,data:AvZpNJddyQVGf6Fu6HsJtcVVoRnjKNg/H9LlCw3J2r0en/rPCg==,iv:wUFHI7XwmOp8F0j+WYSbHkTpm/LZyf048YKQ+3axK+U=,tag:GwtjAw2GK9xt7spx3Qhr3w==,type:str] + INIT_POSTGRES_USER: ENC[AES256_GCM,data:+KU+L0U=,iv:n4fL1Uku9/fGduxZ94ujadjoA1TX87fbg9BTENsPjgI=,tag:v1xcpYEqyYsFG2c0Xu8o6Q==,type:str] + INIT_POSTGRES_PASS: ENC[AES256_GCM,data:4IwcvwL6PlHSbZ4LG+EokI78sEw=,iv:3vrEt087cDDHAlAiQ3x+AQm23qA54Z/PU1mslUZ8KVI=,tag:3Za5ZXMo7IICXU+o75e0Kg==,type:str] + INIT_POSTGRES_SUPER_PASS: ENC[AES256_GCM,data:+2LEor2PSQZL60tR82DH8A==,iv:c3lpHgRm3iZc2gxvcmvfce+QT2Mn2mu3dtvZzyl6lM0=,tag:YqTMU5oXN+Mw2wlP3pG7fA==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiNGdkblhRVzJ3Y1pxaUxN + Rm9SQXhiS2M2citGVjlvTTB5MVBkRVNhUEhFCjhXNDlVMHpETjNwck5HaHY4VG5Q + c1NrT3JoaU9SM3RnM2t4UGowMkJVMGsKLS0tIDdhMWFuNDlIMk1VWmtCSDVBRGc5 + YUZ6T2ZVNWVJc09rS3poWTgrNVBieEUKQVrABbmzHnN8XBtssBE5aK1RZrUUeG3R + hAk11/bxhcz5nCtEaaqb2zDSHKA+z8GkrTQHQL5g1mI4lVrnPuD3VQ== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2023-07-08T16:07:09Z" + mac: ENC[AES256_GCM,data:5eNlpiGLMQf9PXzzuefnYpwJKYmA7dIj5PKJ/FJumuJpoo1W984q5NQYY6iCaubO2GrKml1gf2C86tboBEd5t6S5Z3ac4xYYvCtpXCWkHU3zX5i+7zTmiDhss3/G/JuJ6aLgL4+QOjvZtzN+H06F8DIBnM0/TSHqdh24kzwgCyA=,iv:nGQMjYSZtmLmZ7lkdz4HYI6aECJg0dLJNQQk4qJI1OE=,tag:9jHiA+7in6bxNJNLW6dbdg==,type:str] + pgp: [] + encrypted_regex: ^(data|stringData)$ + version: 3.7.3 diff --git a/kubernetes/apps/default/lldap/ks.yaml b/kubernetes/apps/default/lldap/ks.yaml new file mode 100644 index 000000000..2dd48cf3f --- /dev/null +++ b/kubernetes/apps/default/lldap/ks.yaml @@ -0,0 +1,21 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/kustomize.toolkit.fluxcd.io/kustomization_v1.json +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: cluster-apps-lldap + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + dependsOn: + - name: cluster-apps-cloudnative-pg-cluster + path: ./kubernetes/apps/default/lldap/app + prune: true + sourceRef: + kind: GitRepository + name: home-ops-kubernetes + wait: true + interval: 30m + retryInterval: 1m + timeout: 5m