From f945aa99f8db41515efbbd510f32404b2dd2e5cb Mon Sep 17 00:00:00 2001 From: auricom <27022259+auricom@users.noreply.github.com> Date: Mon, 10 Jul 2023 19:15:56 +0200 Subject: [PATCH] =?UTF-8?q?fixup!=20=E2=99=BB=EF=B8=8F=20migration=20exter?= =?UTF-8?q?nalsecrets?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../home-assistant/app/externalsecret.yaml | 1 + .../home-assistant/app/podmonitor.yaml | 2 +- .../default/home-assistant/app/volsync.yaml | 2 +- .../apps/default/joplin/app/helmrelease.yaml | 7 +++ .../lidarr/app/backups/kustomization.yaml | 7 --- .../lidarr/app/backups/replicationsource.yaml | 25 ---------- .../lidarr/app/backups/restic.sops.yaml | 35 ------------- .../default/lidarr/app/externalsecret.yaml | 18 +++++++ .../apps/default/lidarr/app/helmrelease.yaml | 9 ++-- .../default/lidarr/app/kustomization.yaml | 4 +- .../apps/default/lidarr/app/secret.sops.yaml | 29 ----------- .../apps/default/lidarr/app/volsync.yaml | 49 +++++++++++++++++++ kubernetes/apps/default/lidarr/ks.yaml | 1 + .../lychee/app/backups/kustomization.yaml | 7 --- .../lychee/app/backups/replicationsource.yaml | 25 ---------- .../lychee/app/backups/restic.sops.yaml | 35 ------------- .../default/lychee/app/externalsecret.yaml | 34 +++++++++++++ .../apps/default/lychee/app/helmrelease.yaml | 19 ++++--- .../default/lychee/app/kustomization.yaml | 6 +-- .../default/lychee/app/patches/postgres.yaml | 32 ------------ .../apps/default/lychee/app/secret.sops.yaml | 30 ------------ .../apps/default/lychee/app/volsync.yaml | 49 +++++++++++++++++++ kubernetes/apps/default/lychee/ks.yaml | 1 + .../default/mailrise/app/externalsecret.yaml | 18 +++++++ .../default/mailrise/app/helmrelease.yaml | 8 ++- .../default/mailrise/app/kustomization.yaml | 2 +- .../default/mailrise/app/secret.sops.yaml | 29 ----------- kubernetes/apps/default/mailrise/ks.yaml | 2 + .../app/backups/kustomization.yaml | 7 --- .../app/backups/replicationsource.yaml | 21 -------- .../app/backups/restic.sops.yaml | 34 ------------- .../media-browser/app/helmrelease.yaml | 8 ++- .../media-browser/app/kustomization.yaml | 2 +- .../default/media-browser/app/volsync.yaml | 49 +++++++++++++++++++ kubernetes/apps/default/media-browser/ks.yaml | 1 + .../music-transcode/app/helm-release.yaml | 4 +- .../navidrome/app/backups/kustomization.yaml | 7 --- .../app/backups/replicationsource.yaml | 25 ---------- .../navidrome/app/backups/restic.sops.yaml | 34 ------------- .../default/navidrome/app/helmrelease.yaml | 4 +- .../default/navidrome/app/kustomization.yaml | 2 +- .../apps/default/navidrome/app/volsync.yaml | 49 +++++++++++++++++++ kubernetes/apps/default/navidrome/ks.yaml | 1 + .../apps/default/nitter/app/helmrelease.yaml | 9 ++-- .../default/opnsense/app/externalsecret.yaml | 18 +++++++ .../default/opnsense/app/helmrelease.yaml | 6 ++- .../default/opnsense/app/kustomization.yaml | 2 +- .../default/opnsense/app/secret.sops.yaml | 31 ------------ kubernetes/apps/default/opnsense/ks.yaml | 2 + 49 files changed, 352 insertions(+), 450 deletions(-) delete mode 100644 kubernetes/apps/default/lidarr/app/backups/kustomization.yaml delete mode 100644 kubernetes/apps/default/lidarr/app/backups/replicationsource.yaml delete mode 100644 kubernetes/apps/default/lidarr/app/backups/restic.sops.yaml create mode 100644 kubernetes/apps/default/lidarr/app/externalsecret.yaml delete mode 100644 kubernetes/apps/default/lidarr/app/secret.sops.yaml create mode 100644 kubernetes/apps/default/lidarr/app/volsync.yaml delete mode 100644 kubernetes/apps/default/lychee/app/backups/kustomization.yaml delete mode 100644 kubernetes/apps/default/lychee/app/backups/replicationsource.yaml delete mode 100644 kubernetes/apps/default/lychee/app/backups/restic.sops.yaml create mode 100644 kubernetes/apps/default/lychee/app/externalsecret.yaml delete mode 100644 kubernetes/apps/default/lychee/app/patches/postgres.yaml delete mode 100644 kubernetes/apps/default/lychee/app/secret.sops.yaml create mode 100644 kubernetes/apps/default/lychee/app/volsync.yaml create mode 100644 kubernetes/apps/default/mailrise/app/externalsecret.yaml delete mode 100644 kubernetes/apps/default/mailrise/app/secret.sops.yaml delete mode 100644 kubernetes/apps/default/media-browser/app/backups/kustomization.yaml delete mode 100644 kubernetes/apps/default/media-browser/app/backups/replicationsource.yaml delete mode 100644 kubernetes/apps/default/media-browser/app/backups/restic.sops.yaml create mode 100644 kubernetes/apps/default/media-browser/app/volsync.yaml delete mode 100644 kubernetes/apps/default/navidrome/app/backups/kustomization.yaml delete mode 100644 kubernetes/apps/default/navidrome/app/backups/replicationsource.yaml delete mode 100644 kubernetes/apps/default/navidrome/app/backups/restic.sops.yaml create mode 100644 kubernetes/apps/default/navidrome/app/volsync.yaml create mode 100644 kubernetes/apps/default/opnsense/app/externalsecret.yaml delete mode 100644 kubernetes/apps/default/opnsense/app/secret.sops.yaml diff --git a/kubernetes/apps/default/home-assistant/app/externalsecret.yaml b/kubernetes/apps/default/home-assistant/app/externalsecret.yaml index 495b73013..9e010e07c 100644 --- a/kubernetes/apps/default/home-assistant/app/externalsecret.yaml +++ b/kubernetes/apps/default/home-assistant/app/externalsecret.yaml @@ -21,6 +21,7 @@ spec: HASS_SECRET_LONGITUDE: "{{ .HASS_LONGITUDE }}" HASS_SECRET_DB_URL: "postgresql://{{ .POSTGRES_USER }}:{{ .POSTGRES_PASS }}@postgres-rw.default.svc.cluster.local/home_assistant" HASS_SECRET_URL: "{{ .HASS_URL }}" + PROMETHEUS_TOKEN: "{{ .PROMETHEUS_TOKEN }}" # Postgres Init INIT_POSTGRES_DBNAME: home_assistant INIT_POSTGRES_HOST: postgres-rw.default.svc.cluster.local diff --git a/kubernetes/apps/default/home-assistant/app/podmonitor.yaml b/kubernetes/apps/default/home-assistant/app/podmonitor.yaml index 4ed536f86..e6a20287e 100644 --- a/kubernetes/apps/default/home-assistant/app/podmonitor.yaml +++ b/kubernetes/apps/default/home-assistant/app/podmonitor.yaml @@ -11,7 +11,7 @@ spec: port: http scrapeTimeout: 30s bearerTokenSecret: - name: home-automation + name: home-assistant-secret key: PROMETHEUS_TOKEN selector: matchLabels: diff --git a/kubernetes/apps/default/home-assistant/app/volsync.yaml b/kubernetes/apps/default/home-assistant/app/volsync.yaml index 996bf84b9..3e1460713 100644 --- a/kubernetes/apps/default/home-assistant/app/volsync.yaml +++ b/kubernetes/apps/default/home-assistant/app/volsync.yaml @@ -30,7 +30,7 @@ metadata: name: home-assistant namespace: default spec: - sourcePVC: home-assistant-config + sourcePVC: hass-config trigger: schedule: "0 7 * * *" restic: diff --git a/kubernetes/apps/default/joplin/app/helmrelease.yaml b/kubernetes/apps/default/joplin/app/helmrelease.yaml index fe8cf295f..23e283e60 100644 --- a/kubernetes/apps/default/joplin/app/helmrelease.yaml +++ b/kubernetes/apps/default/joplin/app/helmrelease.yaml @@ -32,6 +32,13 @@ spec: controller: annotations: reloader.stakater.com/auto: "true" + initContainers: + 01-init-db: + image: ghcr.io/onedr0p/postgres-init:14.8 + imagePullPolicy: IfNotPresent + envFrom: &envFrom + - secretRef: + name: &secret joplin-secret image: repository: joplin/server tag: 2.11.2-beta diff --git a/kubernetes/apps/default/lidarr/app/backups/kustomization.yaml b/kubernetes/apps/default/lidarr/app/backups/kustomization.yaml deleted file mode 100644 index 57bca902d..000000000 --- a/kubernetes/apps/default/lidarr/app/backups/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./replicationsource.yaml - - ./restic.sops.yaml diff --git a/kubernetes/apps/default/lidarr/app/backups/replicationsource.yaml b/kubernetes/apps/default/lidarr/app/backups/replicationsource.yaml deleted file mode 100644 index 111c8a4d0..000000000 --- a/kubernetes/apps/default/lidarr/app/backups/replicationsource.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json -apiVersion: volsync.backube/v1alpha1 -kind: ReplicationSource -metadata: - name: lidarr - namespace: default -spec: - sourcePVC: lidarr-config - trigger: - schedule: "0 0 * * *" - restic: - copyMethod: Snapshot - pruneIntervalDays: 10 - repository: lidarr-restic - cacheCapacity: 2Gi - volumeSnapshotClassName: csi-ceph-blockpool - storageClassName: rook-ceph-block - moverSecurityContext: - runAsUser: 568 - runAsGroup: 568 - fsGroup: 568 - retain: - daily: 10 - within: 3d diff --git a/kubernetes/apps/default/lidarr/app/backups/restic.sops.yaml b/kubernetes/apps/default/lidarr/app/backups/restic.sops.yaml deleted file mode 100644 index bdb6f0f90..000000000 --- a/kubernetes/apps/default/lidarr/app/backups/restic.sops.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: lidarr-restic - namespace: default -type: Opaque -stringData: - #ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment] - RESTIC_REPOSITORY: ENC[AES256_GCM,data:9TU2gSIK5QV/xBdBBziqF7ajXzwH8F/ZssdBHwufbWVWcDvT+1bVrINVEiHWQf5XnqxOpphq9cI=,iv:l7+Sd+QhcRuq0d0AcBoeRaQCVFxjokRxwh4QQ+BFoxA=,tag:15dkxHK2dOYGiHYI1BZ9Yw==,type:str] - #ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment] - RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str] - #ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment] - #ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment] - AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str] - AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ - THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB - TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN - dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4 - 3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2022-12-28T15:33:10Z" - mac: ENC[AES256_GCM,data:SqVBbFRJ1z/Jq6O5EbGsL20yLjMRf2UyQXmBUxwbLRK8WfBahgW0YYcXCnzWsSWAgAIxgn18INd61zMiH9eT6MIRi2N1avtwoHYIY8Z6lG/+qPf4fUXeXTALuhozwJ73ozYw9hPKh+nUYuSZHluEv8xRalu5Ml4uPY5EhER5l5Q=,iv:4Dja+GbOy986eYvlNSGH0rH/UuQr6sPBzEw8gQbQHsw=,tag:7R7lYosch5PSCZodb1uhdQ==,type:str] - pgp: [] - encrypted_regex: ^(data|stringData)$ - version: 3.7.3 diff --git a/kubernetes/apps/default/lidarr/app/externalsecret.yaml b/kubernetes/apps/default/lidarr/app/externalsecret.yaml new file mode 100644 index 000000000..966bf7af8 --- /dev/null +++ b/kubernetes/apps/default/lidarr/app/externalsecret.yaml @@ -0,0 +1,18 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: lidarr + namespace: default +spec: + secretStoreRef: + kind: ClusterSecretStore + name: onepassword-connect + target: + name: lidarr-secret + creationPolicy: Owner + dataFrom: + - extract: + # LIDARR__API_KEY + key: lidarr diff --git a/kubernetes/apps/default/lidarr/app/helmrelease.yaml b/kubernetes/apps/default/lidarr/app/helmrelease.yaml index e9f04b1d1..e7bc4e2ac 100644 --- a/kubernetes/apps/default/lidarr/app/helmrelease.yaml +++ b/kubernetes/apps/default/lidarr/app/helmrelease.yaml @@ -6,7 +6,7 @@ metadata: name: &app lidarr namespace: default spec: - interval: 15m + interval: 30m chart: spec: chart: app-template @@ -15,7 +15,7 @@ spec: kind: HelmRepository name: bjw-s namespace: flux-system - maxHistory: 3 + maxHistory: 2 install: createNamespace: true remediation: @@ -27,6 +27,9 @@ spec: uninstall: keepHistory: false values: + controller: + annotations: + reloader.stakater.com/auto: "true" image: repository: ghcr.io/onedr0p/lidarr-develop tag: 1.2.6.3313@sha256:495d884e08bb476ad16f5428c87e143efbf1be5556c9a6e0525ecaafc777e407 @@ -37,7 +40,7 @@ spec: LIDARR__LOG_LEVEL: info envFrom: - secretRef: - name: *app + name: lidarr-secret service: main: ports: diff --git a/kubernetes/apps/default/lidarr/app/kustomization.yaml b/kubernetes/apps/default/lidarr/app/kustomization.yaml index 0753c22a3..f082c6d3b 100644 --- a/kubernetes/apps/default/lidarr/app/kustomization.yaml +++ b/kubernetes/apps/default/lidarr/app/kustomization.yaml @@ -4,7 +4,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: default resources: - - ./backups + - ./externalsecret.yaml - ./helmrelease.yaml - - ./secret.sops.yaml + - ./volsync.yaml - ./volume.yaml diff --git a/kubernetes/apps/default/lidarr/app/secret.sops.yaml b/kubernetes/apps/default/lidarr/app/secret.sops.yaml deleted file mode 100644 index 22ea15d3a..000000000 --- a/kubernetes/apps/default/lidarr/app/secret.sops.yaml +++ /dev/null @@ -1,29 +0,0 @@ -# yamllint disable -apiVersion: v1 -kind: Secret -metadata: - name: lidarr - namespace: default -type: Opaque -stringData: - LIDARR__API_KEY: ENC[AES256_GCM,data:GSu/jivdFANYsUrPwRM5bwrWLX/7nwKn9AOLium0m6Y=,iv:xn+wD7ZyJfL80UpAVy/XIiubtifwIrBuU876Uy8vrgU=,tag:H8lV7wJeV2m2XDLVMx6p/Q==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaU16anJNV2pBZmxPR3h2 - bWREUnpjcTFvd05ZQ2E4VVBDdm1FL2k4WEYwCkdQSStTNWtpdjNkUW51WS9MekdC - VkpTUUFjSjY2a1JMOUtqOVh5M0JRR2sKLS0tIDRmcWpJSEVvaUp4U1lsaTZYZGNw - OGVKWU0zNUZJSFh4aFJxQWFsYm1VeFkKaDeI/hl7z0Qh8t5W39Kxu9ert1dt4xo+ - LX+MjpVqxiZNcfwROD4bkWeQSN+VsxoGOOyj4L15BlggNnlg+L7Hww== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2022-12-28T15:32:56Z" - mac: ENC[AES256_GCM,data:qYD7LQtuhERFaWAhakfOrX8kRtB9gVa4e3ePf8X61edHBzJAInvUceBCOUDZahnyCSg6pzBIfFp5uOgPbYTs8wfc4Aq/vvgWt4b7LIRdWbpo3EoYDfL/fKKZFGzOoX42y9Krd8dtndD0YYRvRt4pQkBwEkAluSOWbNOG1rWBnHw=,iv:3EZYLcxGsS9YyaITAKw9AG8TWCZrbm80pv7ohQXSZvU=,tag:eQNjWtRicx0b++n28qK7wQ==,type:str] - pgp: [] - encrypted_regex: ^(data|stringData)$ - version: 3.7.3 diff --git a/kubernetes/apps/default/lidarr/app/volsync.yaml b/kubernetes/apps/default/lidarr/app/volsync.yaml new file mode 100644 index 000000000..6b86e05cd --- /dev/null +++ b/kubernetes/apps/default/lidarr/app/volsync.yaml @@ -0,0 +1,49 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: lidarr-restic + namespace: default +spec: + secretStoreRef: + kind: ClusterSecretStore + name: onepassword-connect + target: + name: lidarr-restic-secret + creationPolicy: Owner + template: + engineVersion: v2 + data: + RESTIC_REPOSITORY: '{{ .REPOSITORY_TEMPLATE }}/lidarr' + RESTIC_PASSWORD: '{{ .RESTIC_PASSWORD }}' + AWS_ACCESS_KEY_ID: '{{ .AWS_ACCESS_KEY_ID }}' + AWS_SECRET_ACCESS_KEY: '{{ .AWS_SECRET_ACCESS_KEY }}' + dataFrom: + - extract: + key: volsync-restic-template +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/volsync.backube/replicationsource_v1alpha1.json +apiVersion: volsync.backube/v1alpha1 +kind: ReplicationSource +metadata: + name: lidarr + namespace: default +spec: + sourcePVC: lidarr-config + trigger: + schedule: "0 7 * * *" + restic: + copyMethod: Snapshot + pruneIntervalDays: 7 + repository: lidarr-restic-secret + cacheCapacity: 10Gi + volumeSnapshotClassName: csi-ceph-blockpool + storageClassName: rook-ceph-block + moverSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + retain: + daily: 7 + within: 3d diff --git a/kubernetes/apps/default/lidarr/ks.yaml b/kubernetes/apps/default/lidarr/ks.yaml index 419b1419e..23c2927ca 100644 --- a/kubernetes/apps/default/lidarr/ks.yaml +++ b/kubernetes/apps/default/lidarr/ks.yaml @@ -9,6 +9,7 @@ metadata: substitution.flux.home.arpa/enabled: "true" spec: dependsOn: + - name: cluster-apps-external-secrets-stores - name: cluster-apps-rook-ceph-cluster - name: cluster-apps-volsync-app path: ./kubernetes/apps/default/lidarr/app diff --git a/kubernetes/apps/default/lychee/app/backups/kustomization.yaml b/kubernetes/apps/default/lychee/app/backups/kustomization.yaml deleted file mode 100644 index 57bca902d..000000000 --- a/kubernetes/apps/default/lychee/app/backups/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./replicationsource.yaml - - ./restic.sops.yaml diff --git a/kubernetes/apps/default/lychee/app/backups/replicationsource.yaml b/kubernetes/apps/default/lychee/app/backups/replicationsource.yaml deleted file mode 100644 index 322faf157..000000000 --- a/kubernetes/apps/default/lychee/app/backups/replicationsource.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json -apiVersion: volsync.backube/v1alpha1 -kind: ReplicationSource -metadata: - name: lychee - namespace: default -spec: - sourcePVC: lychee-files - trigger: - schedule: "0 0 * * *" - restic: - copyMethod: Snapshot - pruneIntervalDays: 10 - repository: lychee-restic - cacheCapacity: 20Gi - volumeSnapshotClassName: csi-ceph-blockpool - storageClassName: rook-ceph-block - moverSecurityContext: - runAsUser: 33 - runAsGroup: 33 - fsGroup: 33 - retain: - daily: 10 - within: 3d diff --git a/kubernetes/apps/default/lychee/app/backups/restic.sops.yaml b/kubernetes/apps/default/lychee/app/backups/restic.sops.yaml deleted file mode 100644 index 93fca3940..000000000 --- a/kubernetes/apps/default/lychee/app/backups/restic.sops.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: lychee-restic - namespace: default -type: Opaque -stringData: - #ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment] - RESTIC_REPOSITORY: ENC[AES256_GCM,data:indKdyrRptk2rKJFrtaNjufG4asKcjTb9mvQjW9t00iJuR1mNLafazViyBcEjIoSm4MN4B9WAI4=,iv:E16uoSrAJQ+CF/uu1dP5ZJ9l0uT5DyTbWa50j3pGk1I=,tag:TPpmObERt9fz8tgWA1P81g==,type:str] - #ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment] - RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str] - #ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment] - #ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment] - AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str] - AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ - THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB - TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN - dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4 - 3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2022-12-28T15:00:37Z" - mac: ENC[AES256_GCM,data:rl+tYaE6BAR0IFy4Jz2mZ6MZKBDmjZ8R0WCxrpV9jgWWGKKnIfduRoiErXFTSX3BojqSMnOowzi3Y7W0YgZTHPJXfymTHx4UfbRyNJkZHOc4P6S4tyZLxj5n/F9uO/i4GSt+x0By2PLuVJUR5oY2siLezSCDevtiSs6MEIlLRAw=,iv:1tvzLaymrwk3u6pv8Y9wbh7Xz8gbUZZ5C3meLFNDB1E=,tag:kDU4NvGtullPjHe0Fw+JVg==,type:str] - pgp: [] - encrypted_regex: ^(data|stringData)$ - version: 3.7.3 diff --git a/kubernetes/apps/default/lychee/app/externalsecret.yaml b/kubernetes/apps/default/lychee/app/externalsecret.yaml new file mode 100644 index 000000000..11f035419 --- /dev/null +++ b/kubernetes/apps/default/lychee/app/externalsecret.yaml @@ -0,0 +1,34 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: lychee + namespace: default +spec: + secretStoreRef: + kind: ClusterSecretStore + name: onepassword-connect + target: + name: lychee-secret + creationPolicy: Owner + template: + engineVersion: v2 + data: + # App + DB_HOST: &dbHost postgres-rw.default.svc.cluster.local + DB_PORT: "5432" + DB_DATABASE: &dbName lychee + DB_USERNAME: &dbUser "{{ .POSTGRES_USERNAME }}" + DB_PASSWORD: &dbPass "{{ .POSTGRES_PASSWORD }}" + # Postgres Init + INIT_POSTGRES_DBNAME: *dbName + INIT_POSTGRES_HOST: *dbHost + INIT_POSTGRES_USER: *dbUser + INIT_POSTGRES_PASS: *dbPass + INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_SUPER_PASS }}" + dataFrom: + - extract: + key: cloudnative-pg + - extract: + key: lychee diff --git a/kubernetes/apps/default/lychee/app/helmrelease.yaml b/kubernetes/apps/default/lychee/app/helmrelease.yaml index e0eee3b8c..7f3dcd0b3 100644 --- a/kubernetes/apps/default/lychee/app/helmrelease.yaml +++ b/kubernetes/apps/default/lychee/app/helmrelease.yaml @@ -6,7 +6,7 @@ metadata: name: &app lychee namespace: default spec: - interval: 15m + interval: 30m chart: spec: chart: app-template @@ -15,7 +15,7 @@ spec: kind: HelmRepository name: bjw-s namespace: flux-system - maxHistory: 3 + maxHistory: 2 install: createNamespace: true remediation: @@ -27,6 +27,16 @@ spec: uninstall: keepHistory: false values: + initContainers: + 01-init-db: + image: ghcr.io/onedr0p/postgres-init:14.8 + imagePullPolicy: IfNotPresent + envFrom: &envFrom + - secretRef: + name: &secret lychee-secret + controller: + annotations: + reloader.stakater.com/auto: "true" image: repository: lycheeorg/lychee-laravel tag: v4.9.4 @@ -34,14 +44,11 @@ spec: TIMEZONE: ${TIMEZONE} APP_NAME: Lychee DB_CONNECTION: pgsql - DB_HOST: ${POSTGRES_HOST} - DB_PORT: ${POSTGRES_PORT} - DB_DATABASE: lychee REDIS_HOST: redis.default.svc.cluster.local. REDIS_PORT: 6379 envFrom: - secretRef: - name: *app + name: lychee-secret service: main: ports: diff --git a/kubernetes/apps/default/lychee/app/kustomization.yaml b/kubernetes/apps/default/lychee/app/kustomization.yaml index ec111867e..f082c6d3b 100644 --- a/kubernetes/apps/default/lychee/app/kustomization.yaml +++ b/kubernetes/apps/default/lychee/app/kustomization.yaml @@ -4,9 +4,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: default resources: - - ./backups + - ./externalsecret.yaml - ./helmrelease.yaml - - ./secret.sops.yaml + - ./volsync.yaml - ./volume.yaml -patchesStrategicMerge: - - ./patches/postgres.yaml diff --git a/kubernetes/apps/default/lychee/app/patches/postgres.yaml b/kubernetes/apps/default/lychee/app/patches/postgres.yaml deleted file mode 100644 index 718cda8df..000000000 --- a/kubernetes/apps/default/lychee/app/patches/postgres.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: lychee - namespace: default -spec: - values: - initContainers: - init-db: - image: ghcr.io/onedr0p/postgres-initdb:14.8 - env: - - name: POSTGRES_HOST - value: ${POSTGRES_HOST} - - name: POSTGRES_DB - value: lychee - - name: POSTGRES_SUPER_PASS - valueFrom: - secretKeyRef: - name: postgres-superuser - key: password - - name: POSTGRES_USER - valueFrom: - secretKeyRef: - name: lychee - key: DB_USERNAME - - name: POSTGRES_PASS - valueFrom: - secretKeyRef: - name: lychee - key: DB_PASSWORD diff --git a/kubernetes/apps/default/lychee/app/secret.sops.yaml b/kubernetes/apps/default/lychee/app/secret.sops.yaml deleted file mode 100644 index ffd5e4781..000000000 --- a/kubernetes/apps/default/lychee/app/secret.sops.yaml +++ /dev/null @@ -1,30 +0,0 @@ -# yamllint disable -apiVersion: v1 -kind: Secret -metadata: - name: lychee - namespace: default -type: Opaque -stringData: - DB_USERNAME: ENC[AES256_GCM,data:aEFa7HU4,iv:fS7dJjHGB/Qd0lLKKOG1MJ18WA6L3YxyBWbo8gZvmXc=,tag:FRTCcKgAy9oqUw/qz8MSwg==,type:str] - DB_PASSWORD: ENC[AES256_GCM,data:sc3ekmCLFNk+Oy9fAF4=,iv:Jr8XwbB5wO0rGbozPODZIijg9BbBiqnoV34YDOEJHc8=,tag:M/3L2WbfHkRUvfP95GLcMQ==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaU16anJNV2pBZmxPR3h2 - bWREUnpjcTFvd05ZQ2E4VVBDdm1FL2k4WEYwCkdQSStTNWtpdjNkUW51WS9MekdC - VkpTUUFjSjY2a1JMOUtqOVh5M0JRR2sKLS0tIDRmcWpJSEVvaUp4U1lsaTZYZGNw - OGVKWU0zNUZJSFh4aFJxQWFsYm1VeFkKaDeI/hl7z0Qh8t5W39Kxu9ert1dt4xo+ - LX+MjpVqxiZNcfwROD4bkWeQSN+VsxoGOOyj4L15BlggNnlg+L7Hww== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2022-12-28T15:01:21Z" - mac: ENC[AES256_GCM,data:k1UsbtS868JoU28Y1vi+Pdbe5TlHKuH8HFMUrh8V6JA2Kak0TvS+3Mi7aAhXQJnWZRegeyrV4A2Z9rfuS55uKztFDQHdTmk0o00I9rq0G42EdsaynIM2ToR61/1cBHvwUuopxEJ8S+sM18/W0IQIJ2qH4hZsdQBVI75KtehSlT8=,iv:Il7gSuAItFi1k2UF3Y1qPpq+rjDQQx/qtl1Vt0+Th6M=,tag:5vTTFYYzuvDoRORuOsR7aQ==,type:str] - pgp: [] - encrypted_regex: ^(data|stringData)$ - version: 3.7.3 diff --git a/kubernetes/apps/default/lychee/app/volsync.yaml b/kubernetes/apps/default/lychee/app/volsync.yaml new file mode 100644 index 000000000..a38c82967 --- /dev/null +++ b/kubernetes/apps/default/lychee/app/volsync.yaml @@ -0,0 +1,49 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: lychee-restic + namespace: default +spec: + secretStoreRef: + kind: ClusterSecretStore + name: onepassword-connect + target: + name: lychee-restic-secret + creationPolicy: Owner + template: + engineVersion: v2 + data: + RESTIC_REPOSITORY: '{{ .REPOSITORY_TEMPLATE }}/lychee' + RESTIC_PASSWORD: '{{ .RESTIC_PASSWORD }}' + AWS_ACCESS_KEY_ID: '{{ .AWS_ACCESS_KEY_ID }}' + AWS_SECRET_ACCESS_KEY: '{{ .AWS_SECRET_ACCESS_KEY }}' + dataFrom: + - extract: + key: volsync-restic-template +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/volsync.backube/replicationsource_v1alpha1.json +apiVersion: volsync.backube/v1alpha1 +kind: ReplicationSource +metadata: + name: lychee + namespace: default +spec: + sourcePVC: lychee-files + trigger: + schedule: "0 7 * * *" + restic: + copyMethod: Snapshot + pruneIntervalDays: 7 + repository: lychee-restic-secret + cacheCapacity: 20Gi + volumeSnapshotClassName: csi-ceph-blockpool + storageClassName: rook-ceph-block + moverSecurityContext: + runAsUser: 33 + runAsGroup: 33 + fsGroup: 33 + retain: + daily: 7 + within: 3d diff --git a/kubernetes/apps/default/lychee/ks.yaml b/kubernetes/apps/default/lychee/ks.yaml index cadd40326..ea29b39c3 100644 --- a/kubernetes/apps/default/lychee/ks.yaml +++ b/kubernetes/apps/default/lychee/ks.yaml @@ -15,6 +15,7 @@ spec: name: home-ops-kubernetes dependsOn: - name: cluster-apps-cloudnative-pg-cluster + - name: cluster-apps-external-secrets-stores - name: cluster-apps-rook-ceph-cluster - name: cluster-apps-volsync-app healthChecks: diff --git a/kubernetes/apps/default/mailrise/app/externalsecret.yaml b/kubernetes/apps/default/mailrise/app/externalsecret.yaml new file mode 100644 index 000000000..ab8f3da6f --- /dev/null +++ b/kubernetes/apps/default/mailrise/app/externalsecret.yaml @@ -0,0 +1,18 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: mailrise + namespace: default +spec: + secretStoreRef: + kind: ClusterSecretStore + name: onepassword-connect + target: + name: mailrise-secret + creationPolicy: Owner + dataFrom: + - extract: + # PUSHOVER_TRUENAS + key: mailrise diff --git a/kubernetes/apps/default/mailrise/app/helmrelease.yaml b/kubernetes/apps/default/mailrise/app/helmrelease.yaml index 76933402a..cf3a4b0f3 100644 --- a/kubernetes/apps/default/mailrise/app/helmrelease.yaml +++ b/kubernetes/apps/default/mailrise/app/helmrelease.yaml @@ -6,7 +6,7 @@ metadata: name: &app mailrise namespace: default spec: - interval: 15m + interval: 30m chart: spec: chart: app-template @@ -15,7 +15,7 @@ spec: kind: HelmRepository name: bjw-s namespace: flux-system - maxHistory: 3 + maxHistory: 2 install: createNamespace: true remediation: @@ -39,7 +39,7 @@ spec: TZ: ${TIMEZONE} envFrom: - secretRef: - name: *app + name: mailrise-secret service: main: type: LoadBalancer @@ -77,8 +77,6 @@ spec: labelSelector: matchLabels: app.kubernetes.io/name: *app - podAnnotations: - secret.reloader.stakater.com/reload: *app resources: requests: cpu: 10m diff --git a/kubernetes/apps/default/mailrise/app/kustomization.yaml b/kubernetes/apps/default/mailrise/app/kustomization.yaml index f847833c0..1d8be59ef 100644 --- a/kubernetes/apps/default/mailrise/app/kustomization.yaml +++ b/kubernetes/apps/default/mailrise/app/kustomization.yaml @@ -4,8 +4,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: default resources: + - ./externalsecret.yaml - ./helmrelease.yaml - - ./secret.sops.yaml configMapGenerator: - name: mailrise-configmap files: diff --git a/kubernetes/apps/default/mailrise/app/secret.sops.yaml b/kubernetes/apps/default/mailrise/app/secret.sops.yaml deleted file mode 100644 index 1ead4b1e1..000000000 --- a/kubernetes/apps/default/mailrise/app/secret.sops.yaml +++ /dev/null @@ -1,29 +0,0 @@ -# yamllint disable -apiVersion: v1 -kind: Secret -metadata: - name: mailrise - namespace: default -type: Opaque -stringData: - PUSHOVER_TRUENAS: ENC[AES256_GCM,data:0sViJTQ7VNLccJLzJpwYQGbX0wP3oMCdMng/OFMW85Vfkejag0EEIP6HBCo/rOetq6VAtjvDoUNIx7I2HlHmm0uE7+oM,iv:bz43yn8QOG2/oWnxISTd5Y/JHVdhVfemcNWi62OGD2Q=,tag:YckZYWnKnhXB+0vUO9T5Tg==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaU16anJNV2pBZmxPR3h2 - bWREUnpjcTFvd05ZQ2E4VVBDdm1FL2k4WEYwCkdQSStTNWtpdjNkUW51WS9MekdC - VkpTUUFjSjY2a1JMOUtqOVh5M0JRR2sKLS0tIDRmcWpJSEVvaUp4U1lsaTZYZGNw - OGVKWU0zNUZJSFh4aFJxQWFsYm1VeFkKaDeI/hl7z0Qh8t5W39Kxu9ert1dt4xo+ - LX+MjpVqxiZNcfwROD4bkWeQSN+VsxoGOOyj4L15BlggNnlg+L7Hww== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2022-12-29T15:53:20Z" - mac: ENC[AES256_GCM,data:NwSRgt+Qr/suY+xca7c9hAAivYTPr9Uo9dJ5bzJzN8F1Tj4jxQcD/NHYvn+8OiPg9PCOlVDLzwcuuwUBwDc01diUMmkH5VTz50nQIO+CNlESJrVCDLEId8qgw3qU9AlBg9ik1lmNtggwl5X8NLduzrmYqS3mi+/jgt/3spZuLOA=,iv:FDe5+AEFs+76sP4PkwLIoofKcg0AbEqITp7nZKfab7o=,tag:zwcklTcIo4qeGxFLasidEw==,type:str] - pgp: [] - encrypted_regex: ^(data|stringData)$ - version: 3.7.3 diff --git a/kubernetes/apps/default/mailrise/ks.yaml b/kubernetes/apps/default/mailrise/ks.yaml index 1d6bb4bb2..cfe7ebc0d 100644 --- a/kubernetes/apps/default/mailrise/ks.yaml +++ b/kubernetes/apps/default/mailrise/ks.yaml @@ -13,6 +13,8 @@ spec: sourceRef: kind: GitRepository name: home-ops-kubernetes + dependsOn: + - name: cluster-apps-external-secrets-stores healthChecks: - apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease diff --git a/kubernetes/apps/default/media-browser/app/backups/kustomization.yaml b/kubernetes/apps/default/media-browser/app/backups/kustomization.yaml deleted file mode 100644 index 57bca902d..000000000 --- a/kubernetes/apps/default/media-browser/app/backups/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./replicationsource.yaml - - ./restic.sops.yaml diff --git a/kubernetes/apps/default/media-browser/app/backups/replicationsource.yaml b/kubernetes/apps/default/media-browser/app/backups/replicationsource.yaml deleted file mode 100644 index 31b9f85ea..000000000 --- a/kubernetes/apps/default/media-browser/app/backups/replicationsource.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json -apiVersion: volsync.backube/v1alpha1 -kind: ReplicationSource -metadata: - name: media-browser - namespace: default -spec: - sourcePVC: media-browser-config - trigger: - schedule: "0 0 * * *" - restic: - copyMethod: Snapshot - pruneIntervalDays: 10 - repository: media-browser-restic - cacheCapacity: 2Gi - volumeSnapshotClassName: csi-ceph-blockpool - storageClassName: rook-ceph-block - retain: - daily: 10 - within: 3d diff --git a/kubernetes/apps/default/media-browser/app/backups/restic.sops.yaml b/kubernetes/apps/default/media-browser/app/backups/restic.sops.yaml deleted file mode 100644 index 436ef2d4d..000000000 --- a/kubernetes/apps/default/media-browser/app/backups/restic.sops.yaml +++ /dev/null @@ -1,34 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: media-browser-restic -type: Opaque -stringData: - #ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment] - RESTIC_REPOSITORY: ENC[AES256_GCM,data:0yTdf+xoL8IPuWqVGPSWDpJ9/mDomP9QR5NCkDHrFDoY30nsvyDSChBWa3gCtrBjQOvyoXsfPg2N2eCCvSIR,iv:Ky3NuiDgw9w4isHBNcaWx1EQX5893GgaCPyhCNgmcLM=,tag:TnMn/2adBvA6emxeSRayxA==,type:str] - #ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment] - RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str] - #ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment] - #ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment] - AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str] - AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ - THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB - TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN - dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4 - 3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2022-12-28T14:47:51Z" - mac: ENC[AES256_GCM,data:glyXcw3UgFAceT3sfX1YsO1pZBQg29fK8iXGiaIfx+AlHD/AerUOSoFGYHhlun3lRbXxv1jH8Q4Jkd4afpcQmA9fpXEEP/OIrWF0ORSrPG8jAOCGYHyFoMv4MevTUZqSfY2g8vVfYQt++5TBPDTZe/JNdoPO0v9ENGjWTnPnq3g=,iv:oynyyDwR0yLE5+ZtyZY1Ynhm5xbD8pQ05Hbz/tJROrY=,tag:ULMrr+hXq/Ga2vsf8hHcwg==,type:str] - pgp: [] - encrypted_regex: ^(data|stringData)$ - version: 3.7.3 diff --git a/kubernetes/apps/default/media-browser/app/helmrelease.yaml b/kubernetes/apps/default/media-browser/app/helmrelease.yaml index a931e29df..dbf624c3e 100644 --- a/kubernetes/apps/default/media-browser/app/helmrelease.yaml +++ b/kubernetes/apps/default/media-browser/app/helmrelease.yaml @@ -6,7 +6,7 @@ metadata: name: &app media-browser namespace: default spec: - interval: 15m + interval: 30m chart: spec: chart: app-template @@ -15,7 +15,7 @@ spec: kind: HelmRepository name: bjw-s namespace: flux-system - maxHistory: 3 + maxHistory: 2 install: createNamespace: true remediation: @@ -27,6 +27,9 @@ spec: uninstall: keepHistory: false values: + controller: + annotations: + reloader.stakater.com/auto: "true" image: repository: docker.io/filebrowser/filebrowser tag: v2.23.0 @@ -61,6 +64,7 @@ spec: enabled: true ingressClassName: "nginx" annotations: + auth.home.arpa/enabled: "true" hajimari.io/icon: mdi:folder-play-outline hosts: - host: &host "{{ .Release.Name }}.${SECRET_CLUSTER_DOMAIN}" diff --git a/kubernetes/apps/default/media-browser/app/kustomization.yaml b/kubernetes/apps/default/media-browser/app/kustomization.yaml index b71b75551..39fd93644 100644 --- a/kubernetes/apps/default/media-browser/app/kustomization.yaml +++ b/kubernetes/apps/default/media-browser/app/kustomization.yaml @@ -4,6 +4,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: default resources: - - ./backups - ./helmrelease.yaml + - ./volsync.yaml - ./volume.yaml diff --git a/kubernetes/apps/default/media-browser/app/volsync.yaml b/kubernetes/apps/default/media-browser/app/volsync.yaml new file mode 100644 index 000000000..a38c82967 --- /dev/null +++ b/kubernetes/apps/default/media-browser/app/volsync.yaml @@ -0,0 +1,49 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: lychee-restic + namespace: default +spec: + secretStoreRef: + kind: ClusterSecretStore + name: onepassword-connect + target: + name: lychee-restic-secret + creationPolicy: Owner + template: + engineVersion: v2 + data: + RESTIC_REPOSITORY: '{{ .REPOSITORY_TEMPLATE }}/lychee' + RESTIC_PASSWORD: '{{ .RESTIC_PASSWORD }}' + AWS_ACCESS_KEY_ID: '{{ .AWS_ACCESS_KEY_ID }}' + AWS_SECRET_ACCESS_KEY: '{{ .AWS_SECRET_ACCESS_KEY }}' + dataFrom: + - extract: + key: volsync-restic-template +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/volsync.backube/replicationsource_v1alpha1.json +apiVersion: volsync.backube/v1alpha1 +kind: ReplicationSource +metadata: + name: lychee + namespace: default +spec: + sourcePVC: lychee-files + trigger: + schedule: "0 7 * * *" + restic: + copyMethod: Snapshot + pruneIntervalDays: 7 + repository: lychee-restic-secret + cacheCapacity: 20Gi + volumeSnapshotClassName: csi-ceph-blockpool + storageClassName: rook-ceph-block + moverSecurityContext: + runAsUser: 33 + runAsGroup: 33 + fsGroup: 33 + retain: + daily: 7 + within: 3d diff --git a/kubernetes/apps/default/media-browser/ks.yaml b/kubernetes/apps/default/media-browser/ks.yaml index 046168e36..17070eb7d 100644 --- a/kubernetes/apps/default/media-browser/ks.yaml +++ b/kubernetes/apps/default/media-browser/ks.yaml @@ -9,6 +9,7 @@ metadata: substitution.flux.home.arpa/enabled: "true" spec: dependsOn: + - name: cluster-apps-external-secrets-stores - name: cluster-apps-rook-ceph-cluster - name: cluster-apps-volsync-app path: ./kubernetes/apps/default/media-browser/app diff --git a/kubernetes/apps/default/music-transcode/app/helm-release.yaml b/kubernetes/apps/default/music-transcode/app/helm-release.yaml index 99102749b..ed30622af 100644 --- a/kubernetes/apps/default/music-transcode/app/helm-release.yaml +++ b/kubernetes/apps/default/music-transcode/app/helm-release.yaml @@ -6,7 +6,7 @@ metadata: name: music-transcode namespace: default spec: - interval: 15m + interval: 30m chart: spec: chart: app-template @@ -15,7 +15,7 @@ spec: kind: HelmRepository name: bjw-s namespace: flux-system - maxHistory: 3 + maxHistory: 2 install: createNamespace: true remediation: diff --git a/kubernetes/apps/default/navidrome/app/backups/kustomization.yaml b/kubernetes/apps/default/navidrome/app/backups/kustomization.yaml deleted file mode 100644 index 57bca902d..000000000 --- a/kubernetes/apps/default/navidrome/app/backups/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# yaml-language-server: $schema=https://json.schemastore.org/kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./replicationsource.yaml - - ./restic.sops.yaml diff --git a/kubernetes/apps/default/navidrome/app/backups/replicationsource.yaml b/kubernetes/apps/default/navidrome/app/backups/replicationsource.yaml deleted file mode 100644 index 01af3b726..000000000 --- a/kubernetes/apps/default/navidrome/app/backups/replicationsource.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json -apiVersion: volsync.backube/v1alpha1 -kind: ReplicationSource -metadata: - name: navidrome - namespace: default -spec: - sourcePVC: navidrome-config - trigger: - schedule: "0 0 * * *" - restic: - copyMethod: Snapshot - pruneIntervalDays: 10 - repository: navidrome-restic - cacheCapacity: 2Gi - volumeSnapshotClassName: csi-ceph-blockpool - storageClassName: rook-ceph-block - moverSecurityContext: - runAsUser: 568 - runAsGroup: 568 - fsGroup: 568 - retain: - daily: 10 - within: 3d diff --git a/kubernetes/apps/default/navidrome/app/backups/restic.sops.yaml b/kubernetes/apps/default/navidrome/app/backups/restic.sops.yaml deleted file mode 100644 index 3a3158ef3..000000000 --- a/kubernetes/apps/default/navidrome/app/backups/restic.sops.yaml +++ /dev/null @@ -1,34 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: navidrome-restic -type: Opaque -stringData: - #ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment] - RESTIC_REPOSITORY: ENC[AES256_GCM,data:/DJM9W9fInB4vj+epdSzoZ6qLJbtgNATZXW34AZ2gStf57gF8QB2z+kiKKEv4bYdcMmg2Q06ejPMvxc=,iv:3gMbOnVt7DZjiMVy3h9FkXDWBdyw1uLmPtwKvApqKyQ=,tag:jFRup6tGA8pfvOOPGlkfow==,type:str] - #ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment] - RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str] - #ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment] - #ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment] - AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str] - AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ - THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB - TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN - dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4 - 3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2022-12-28T14:46:17Z" - mac: ENC[AES256_GCM,data:NWdJiyeL7eqshNhdWXQNHYOEFRbJ38hlz6p2K1RW+poJaSdFwk8sPIcou/h2xbU2Dxf3I7om0nZEeLgFtL1RZ7uTk5fpE6eOvtFerQx+uhHOfm03Ti2kofDLf/RgufPtw9ztq73a/lFBlAYAIFzn9PM95fkvjdRfrHs05PuNFAc=,iv:L7+N//Mh32T9gT5AQ9Nq433odU2lxEot1KaJkEbjOLQ=,tag:Fn4B2an5C0+H48rSc5aQnA==,type:str] - pgp: [] - encrypted_regex: ^(data|stringData)$ - version: 3.7.3 diff --git a/kubernetes/apps/default/navidrome/app/helmrelease.yaml b/kubernetes/apps/default/navidrome/app/helmrelease.yaml index 8ce30476a..45c6cc83b 100644 --- a/kubernetes/apps/default/navidrome/app/helmrelease.yaml +++ b/kubernetes/apps/default/navidrome/app/helmrelease.yaml @@ -6,7 +6,7 @@ metadata: name: &app navidrome namespace: default spec: - interval: 15m + interval: 30m chart: spec: chart: app-template @@ -15,7 +15,7 @@ spec: kind: HelmRepository name: bjw-s namespace: flux-system - maxHistory: 3 + maxHistory: 2 install: createNamespace: true remediation: diff --git a/kubernetes/apps/default/navidrome/app/kustomization.yaml b/kubernetes/apps/default/navidrome/app/kustomization.yaml index b71b75551..39fd93644 100644 --- a/kubernetes/apps/default/navidrome/app/kustomization.yaml +++ b/kubernetes/apps/default/navidrome/app/kustomization.yaml @@ -4,6 +4,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: default resources: - - ./backups - ./helmrelease.yaml + - ./volsync.yaml - ./volume.yaml diff --git a/kubernetes/apps/default/navidrome/app/volsync.yaml b/kubernetes/apps/default/navidrome/app/volsync.yaml new file mode 100644 index 000000000..f1155580e --- /dev/null +++ b/kubernetes/apps/default/navidrome/app/volsync.yaml @@ -0,0 +1,49 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: navidrome-restic + namespace: default +spec: + secretStoreRef: + kind: ClusterSecretStore + name: onepassword-connect + target: + name: navidrome-restic-secret + creationPolicy: Owner + template: + engineVersion: v2 + data: + RESTIC_REPOSITORY: '{{ .REPOSITORY_TEMPLATE }}/navidrome' + RESTIC_PASSWORD: '{{ .RESTIC_PASSWORD }}' + AWS_ACCESS_KEY_ID: '{{ .AWS_ACCESS_KEY_ID }}' + AWS_SECRET_ACCESS_KEY: '{{ .AWS_SECRET_ACCESS_KEY }}' + dataFrom: + - extract: + key: volsync-restic-template +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/volsync.backube/replicationsource_v1alpha1.json +apiVersion: volsync.backube/v1alpha1 +kind: ReplicationSource +metadata: + name: navidrome + namespace: default +spec: + sourcePVC: navidrome-config + trigger: + schedule: "0 7 * * *" + restic: + copyMethod: Snapshot + pruneIntervalDays: 7 + repository: navidrome-restic-secret + cacheCapacity: 20Gi + volumeSnapshotClassName: csi-ceph-blockpool + storageClassName: rook-ceph-block + moverSecurityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + retain: + daily: 7 + within: 3d diff --git a/kubernetes/apps/default/navidrome/ks.yaml b/kubernetes/apps/default/navidrome/ks.yaml index 1e966d777..33cab944d 100644 --- a/kubernetes/apps/default/navidrome/ks.yaml +++ b/kubernetes/apps/default/navidrome/ks.yaml @@ -9,6 +9,7 @@ metadata: substitution.flux.home.arpa/enabled: "true" spec: dependsOn: + - name: cluster-apps-external-secrets-stores - name: cluster-apps-rook-ceph-cluster - name: cluster-apps-volsync-app path: ./kubernetes/apps/default/navidrome/app diff --git a/kubernetes/apps/default/nitter/app/helmrelease.yaml b/kubernetes/apps/default/nitter/app/helmrelease.yaml index 0c515a379..2a42cddd6 100644 --- a/kubernetes/apps/default/nitter/app/helmrelease.yaml +++ b/kubernetes/apps/default/nitter/app/helmrelease.yaml @@ -6,7 +6,7 @@ metadata: name: &app nitter namespace: default spec: - interval: 15m + interval: 30m chart: spec: chart: app-template @@ -15,7 +15,7 @@ spec: kind: HelmRepository name: bjw-s namespace: flux-system - maxHistory: 3 + maxHistory: 2 install: createNamespace: true remediation: @@ -27,6 +27,9 @@ spec: uninstall: keepHistory: false values: + controller: + annotations: + reloader.stakater.com/auto: "true" image: repository: docker.io/zedeus/nitter tag: latest@sha256:db0674e7426309b0ae41ad36fa0bbd1d52ab7abe20823b27a49017116a2c0b34 @@ -74,8 +77,6 @@ spec: subPath: config.yml mountPath: /src/nitter.conf readOnly: false - podAnnotations: - secret.reloader.stakater.com/reload: *app resources: requests: cpu: 50m diff --git a/kubernetes/apps/default/opnsense/app/externalsecret.yaml b/kubernetes/apps/default/opnsense/app/externalsecret.yaml new file mode 100644 index 000000000..1c1e2f093 --- /dev/null +++ b/kubernetes/apps/default/opnsense/app/externalsecret.yaml @@ -0,0 +1,18 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: opnsense-backup + namespace: default +spec: + secretStoreRef: + kind: ClusterSecretStore + name: onepassword-connect + target: + name: opnsense-backup-secret + creationPolicy: Owner + dataFrom: + - extract: + # OPNSENSE_KEY, OPNSENSE_SECRET, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY + key: opnsense-backup diff --git a/kubernetes/apps/default/opnsense/app/helmrelease.yaml b/kubernetes/apps/default/opnsense/app/helmrelease.yaml index 658aa2a0b..1325b7b83 100644 --- a/kubernetes/apps/default/opnsense/app/helmrelease.yaml +++ b/kubernetes/apps/default/opnsense/app/helmrelease.yaml @@ -6,7 +6,7 @@ metadata: name: opnsense-backup namespace: default spec: - interval: 15m + interval: 30m chart: spec: chart: app-template @@ -15,13 +15,17 @@ spec: kind: HelmRepository name: bjw-s namespace: flux-system + maxHistory: 2 install: createNamespace: true remediation: retries: 3 upgrade: + cleanupOnFail: true remediation: retries: 3 + uninstall: + keepHistory: false values: controller: type: cronjob diff --git a/kubernetes/apps/default/opnsense/app/kustomization.yaml b/kubernetes/apps/default/opnsense/app/kustomization.yaml index 1ffebc93d..00c6f50fb 100644 --- a/kubernetes/apps/default/opnsense/app/kustomization.yaml +++ b/kubernetes/apps/default/opnsense/app/kustomization.yaml @@ -4,7 +4,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: default resources: - - ./secret.sops.yaml + - ./externalsecret.yaml - ./helmrelease.yaml configMapGenerator: - name: opnsense-backup-configmap diff --git a/kubernetes/apps/default/opnsense/app/secret.sops.yaml b/kubernetes/apps/default/opnsense/app/secret.sops.yaml deleted file mode 100644 index 03e65e034..000000000 --- a/kubernetes/apps/default/opnsense/app/secret.sops.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: opnsense-backup-secret - namespace: default -type: Opaque -stringData: - OPNSENSE_KEY: ENC[AES256_GCM,data:o2RT80AbQJg1EOFbX3iMIyC8eRIVx0YcL7/+H51SpDdcs0ynisIaKgycxOTg6t65VTApnVhyZaWgVbQxfSsH2zKuGT9dFYfUHbcFjve3isc=,iv:l/qvdOFBZhA2LFV7Q6vIBuVkNSJmEWEqiAUU9vXsSuo=,tag:Itiz/H7S4F+TktGyT7WX2A==,type:str] - OPNSENSE_SECRET: ENC[AES256_GCM,data:ITYxDGhq7rxU2w3BSa3t+ka/TbPipP1tJzoUuWkvNyXxBlNV277oNRWxMUta210+xq9C8m7BD7ay6lVrbvev4Rf8YNdgTGXl6tFmfVnSqmo=,iv:MbrRhgGoRz2cu9H0y+pYBZrX2CikDfplOGH0h8e6GDo=,tag:pVqki2c534KKZ8GLSF3BlQ==,type:str] - AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:bi/0BL4yJo64Ya4tFmyjjfxcSgM=,iv:WfaYaVCMvq4MlUY3AHyyd5UyVngLX8qjC4WDJyStGhg=,tag:6Rk/Qsf5cfSbZm0be4V1wA==,type:str] - AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:jfCGidFYWH45ilkGvViGLQ8ZXDTMCKaH93DtbtEwITGlEUuMYNZIxA==,iv:2kNo+aj7m9rCaovgXoIbiTQFgUux9L4LsQLH+GHGLaA=,tag:m+qNg1DHuNfaakYdMB4QpQ==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmMEhOUTJMcUYvNFozRDNr - WnhJTEYzVWN4V1VXemhtWWU1SmMvUmljNFFNCk91aHhXRVBDSzhhcjIzalQ5SEpN - cTJIOGVVYWNYRGdtMm5nZUZ5Q0EzTE0KLS0tIFRMYnNGakdrSktjT2ZoNk1sN21C - YlhlTVhRdDFJUVZiMTdtVXlveWNDWE0KG7MKLp5tUCm7KpuhpmsvAWDrreBuHSEp - zyH6hY1i7jgjh020qZI32zNDHeTIJhi+mHur/jvBJhEGLMz6JYUPrg== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2022-12-29T07:38:56Z" - mac: ENC[AES256_GCM,data:1tbBSKSUY1PFKcoQshI/6mv1KUV3b/K/BGALgNNDunjc4PRVBOMbZI6Aa4MWk0ElN7NB9Y6nO+Gv+i6sTet4peRMEBnfoWTSRjImYMiyt+aQ2XjMfI/ZEtOBgv8VFmSQr68Mkgp1zDLiD8lCwewE1nqoUg82jQNzy/bFUYcvIfY=,iv:IKd7yXgBfZBJX7yKH6HzlETA7WBvJrmsWNpO+ZZsElA=,tag:5R05VsD8CPHu8PX+MLXuJw==,type:str] - pgp: [] - encrypted_regex: ^(data|stringData)$ - version: 3.7.3 diff --git a/kubernetes/apps/default/opnsense/ks.yaml b/kubernetes/apps/default/opnsense/ks.yaml index ed32b03ff..41d0900d2 100644 --- a/kubernetes/apps/default/opnsense/ks.yaml +++ b/kubernetes/apps/default/opnsense/ks.yaml @@ -13,6 +13,8 @@ spec: sourceRef: kind: GitRepository name: home-ops-kubernetes + dependsOn: + - name: cluster-apps-external-secrets-stores healthChecks: - apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease