🚀 lldap

2025-09-17 18:24:14 +02:00 · 2023-07-08 18:08:32 +02:00
parent f5d5015a4d
commit 7d128755c3
6 changed files with 181 additions and 0 deletions
--- a/kubernetes/apps/default/lldap/app/gatus.yaml
+++ b/kubernetes/apps/default/lldap/app/gatus.yaml
@@ -0,0 +1,21 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: lldap-gatus-ep
+  namespace: default
+  labels:
+    gatus.io/enabled: "true"
+data:
+  config.yaml: |
+    endpoints:
+      - name: lldap
+        group: internal
+        url: https://lldap.${SECRET_CLUSTER_DOMAIN}
+        interval: 1m
+        client:
+          insecure: true
+        conditions:
+          - "[STATUS] == 200"
+        alerts:
+          - type: pushover
--- a/kubernetes/apps/default/lldap/app/helmrelease.yaml
+++ b/kubernetes/apps/default/lldap/app/helmrelease.yaml
@@ -0,0 +1,89 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: &app lldap
+  namespace: default
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    initContainers:
+      01-init-db:
+        image: ghcr.io/onedr0p/postgres-init:14.8
+        imagePullPolicy: IfNotPresent
+        envFrom: &envFrom
+          - secretRef:
+              name: lldap-secret
+    controller:
+      replicas: 2
+      strategy: RollingUpdate
+      annotations:
+        reloader.stakater.com/auto: "true"
+    image:
+      repository: ghcr.io/lldap/lldap
+      # TODO: Switch to release tag on next release
+      tag: latest-alpine@sha256:5e8d4770d7fdcfb752ad5a9dc41c19f5c3328f775459b436cf4c50fb87355cf3
+    env:
+      TZ: ${TIMEZONE}
+      LLDAP_HTTP_PORT: &port 8080
+      LLDAP_HTTP_URL: https://lldap.${SECRET_CLUSTER_DOMAIN}
+      LLDAP_LDAP_PORT: &ldapPort 5389
+      LLDAP_LDAP_BASE_DN: dc=home,dc=arpa
+    envFrom: *envFrom
+    service:
+      main:
+        ports:
+          http:
+            port: *port
+          ldap:
+            enabled: true
+            port: *ldapPort
+    ingress:
+      main:
+        enabled: true
+        ingressClassName: nginx
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_CLUSTER_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+    persistence:
+      data:
+        enabled: true
+        type: emptyDir
+    topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+        labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: *app
+    resources:
+      requests:
+        cpu: 100m
+        memory: 100Mi
+      limits:
+        memory: 500Mi
--- a/kubernetes/apps/default/lldap/app/kustomization.yaml
+++ b/kubernetes/apps/default/lldap/app/kustomization.yaml
@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: default
+resources:
+  - ./gatus.yaml
+  - ./helmrelease.yaml
+  - ./secret.sops.yaml
--- a/kubernetes/apps/default/lldap/app/secret.sops.yaml
+++ b/kubernetes/apps/default/lldap/app/secret.sops.yaml
@@ -0,0 +1,40 @@
+# yamllint disable
+apiVersion: v1
+kind: Secret
+metadata:
+    name: lldap-secret
+    namespace: default
+stringData:
+    #ENC[AES256_GCM,data:/lxgog==,iv:6ECsF69rzmsw0wMAMOjbT0lYivVx2zE/CRrSSfIacoA=,tag:xXJej38dzNL5adzZaZyVMA==,type:comment]
+    LLDAP_JWT_SECRET: ENC[AES256_GCM,data:E+KOEuQC6mYoAmAJS+6cr5Br053eEICP8M/KdFgNDx8Sfofelqd5TQ==,iv:cyoF4Mx5qHHtYl+74a/17YOUB+nV17GH60bBar/yWRM=,tag:sxM7IXbI2Fd5fXjH2VD6xg==,type:str]
+    LLDAP_LDAP_USER_PASS: ENC[AES256_GCM,data:fCcvXK50rdfESW2rx4RmpeJnmRY=,iv:G2GuddKOxnXkRZGXpMOzlQpUymtu9vftHnifzpbAZ3E=,tag:HbD+R0fZ2qgwq3wzIQeRlQ==,type:str]
+    LLDAP_USER_DN: ENC[AES256_GCM,data:6sq4ttw=,iv:IkA1DBrd8xrRjqqtdHaThNhjotrtcymWwirGZ94mTXQ=,tag:YFMuKBOvoymL/BTd7q/c4w==,type:str]
+    LLDAP_LDAP_USER_EMAIL: ENC[AES256_GCM,data:bxF5/HOK5Wq2lc+1KVldPCux6ZI=,iv:CsmuJgZqeCHkVs6AmI5L15KthVTUgeQVKOfsU0dawtQ=,tag:dWDspVAhGJErvyusXFDlGA==,type:str]
+    LLDAP_SERVER_KEY_SEED: ENC[AES256_GCM,data:GJHrDu2DG8kzfdExSj6wbcRy4TI=,iv:tgYmKoSLMwDGnVqXy1z8GAZox1zsFDKHpvJxXOqOPu8=,tag:OOEV1+O9xyBvHLohmaN/Yg==,type:str]
+    LLDAP_DATABASE_URL: ENC[AES256_GCM,data:qJ9E2sMLelk5aNui26R+QXFRQTBtV7VN0J9PeI+Qc0hhFb+4J0aNHhzninMSH+yQaWWau4cHPweMIZl21w6UgbaslwdR08H4pODNRlPTHOkz,iv:WOULxNFF8lOXlxzSvGooIK5PSa7+I1+Hff/pTlKRLpk=,tag:MRL3qp7l24ATzAgGh/ohQQ==,type:str]
+    #ENC[AES256_GCM,data:hqWl8RxgH1OjSqqXRQY=,iv:NpLdgyoRj3ktslB/Zok+33E+qQuGwfIZKzkdbRqPZ5I=,tag:/r82K47Nut8F1GVi8Jp6AA==,type:comment]
+    INIT_POSTGRES_DBNAME: ENC[AES256_GCM,data:VbV39Uw=,iv:fF0G4nHt8Xh0l7KQoRY6f4a+3W3q0S8jOhTvTm+F5cg=,tag:JJkeUzjN9uPpS1cBss4ppQ==,type:str]
+    INIT_POSTGRES_HOST: ENC[AES256_GCM,data:AvZpNJddyQVGf6Fu6HsJtcVVoRnjKNg/H9LlCw3J2r0en/rPCg==,iv:wUFHI7XwmOp8F0j+WYSbHkTpm/LZyf048YKQ+3axK+U=,tag:GwtjAw2GK9xt7spx3Qhr3w==,type:str]
+    INIT_POSTGRES_USER: ENC[AES256_GCM,data:+KU+L0U=,iv:n4fL1Uku9/fGduxZ94ujadjoA1TX87fbg9BTENsPjgI=,tag:v1xcpYEqyYsFG2c0Xu8o6Q==,type:str]
+    INIT_POSTGRES_PASS: ENC[AES256_GCM,data:4IwcvwL6PlHSbZ4LG+EokI78sEw=,iv:3vrEt087cDDHAlAiQ3x+AQm23qA54Z/PU1mslUZ8KVI=,tag:3Za5ZXMo7IICXU+o75e0Kg==,type:str]
+    INIT_POSTGRES_SUPER_PASS: ENC[AES256_GCM,data:+2LEor2PSQZL60tR82DH8A==,iv:c3lpHgRm3iZc2gxvcmvfce+QT2Mn2mu3dtvZzyl6lM0=,tag:YqTMU5oXN+Mw2wlP3pG7fA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiNGdkblhRVzJ3Y1pxaUxN
+            Rm9SQXhiS2M2citGVjlvTTB5MVBkRVNhUEhFCjhXNDlVMHpETjNwck5HaHY4VG5Q
+            c1NrT3JoaU9SM3RnM2t4UGowMkJVMGsKLS0tIDdhMWFuNDlIMk1VWmtCSDVBRGc5
+            YUZ6T2ZVNWVJc09rS3poWTgrNVBieEUKQVrABbmzHnN8XBtssBE5aK1RZrUUeG3R
+            hAk11/bxhcz5nCtEaaqb2zDSHKA+z8GkrTQHQL5g1mI4lVrnPuD3VQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-07-08T16:07:09Z"
+    mac: ENC[AES256_GCM,data:5eNlpiGLMQf9PXzzuefnYpwJKYmA7dIj5PKJ/FJumuJpoo1W984q5NQYY6iCaubO2GrKml1gf2C86tboBEd5t6S5Z3ac4xYYvCtpXCWkHU3zX5i+7zTmiDhss3/G/JuJ6aLgL4+QOjvZtzN+H06F8DIBnM0/TSHqdh24kzwgCyA=,iv:nGQMjYSZtmLmZ7lkdz4HYI6aECJg0dLJNQQk4qJI1OE=,tag:9jHiA+7in6bxNJNLW6dbdg==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3
--- a/kubernetes/apps/default/lldap/ks.yaml
+++ b/kubernetes/apps/default/lldap/ks.yaml
@@ -0,0 +1,21 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-apps-lldap
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  dependsOn:
+    - name: cluster-apps-cloudnative-pg-cluster
+  path: ./kubernetes/apps/default/lldap/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-ops-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m