commit 1055bbb0e933c7ac51b2d6762e53f6da163e51e5
parent 61c0726508f8b596f2e118a8f7e81bef23752368
Author: MTRNord <mtrnord1@gmail.com>
Date: Wed, 12 Mar 2025 17:45:11 +0100
Cachet webhook via envoy
Diffstat:
5 files changed, 129 insertions(+), 125 deletions(-)
diff --git a/apps/base/cachet/sync_deployment.yaml b/apps/base/cachet/sync_deployment.yaml
@@ -74,27 +74,21 @@ spec:
targetPort: 8080
protocol: TCP
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
metadata:
name: pagerduty-cachet
namespace: cachet
- annotations:
- cert-manager.io/cluster-issuer: letsencrypt-dns
- external-dns.alpha.kubernetes.io/hostname: midnightthoughts.space
spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - webhook.status.midnightthoughts.space
rules:
- - host: webhook.status.midnightthoughts.space
- http:
- paths:
- - path: /
- pathType: Prefix
- backend:
- service:
- name: pagerduty-cachet
- port:
- number: 80
- tls:
- - secretName: pagerduty-cachet-midnightthoughts-space-tls
- hosts:
- - webhook.status.midnightthoughts.space
+ - backendRefs:
+ - name: pagerduty-cachet
+ port: 80
+ timeouts:
+ request: 240s
+ backendRequest: 0s
diff --git a/apps/base/envoy-gateway/release.yaml b/apps/base/envoy-gateway/release.yaml
@@ -250,6 +250,18 @@ spec:
certificateRefs:
- kind: Secret
name: ldap.midnightthoughts.space-tls
+ - name: https-midnightthoughts-status-webhook
+ protocol: HTTPS
+ hostname: "webhook.status.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: webhook.status.midnightthoughts.space-tls
- name: https-midnightthoughts-root
protocol: HTTPS
hostname: "midnightthoughts.space"
diff --git a/apps/base/hubzilla/deployment.yaml b/apps/base/hubzilla/deployment.yaml
@@ -36,78 +36,78 @@ spec:
imagePullPolicy: Always
name: hubzilla
env:
- - name: HUBZILLA_DB_HOST
- value: mariadb-maxscale.mariadb-operator.svc.cluster.local
- - name: HUBZILLA_DB_USER
- value: hubzilla
- - name: HUBZILLA_DB_PASS
- valueFrom:
- secretKeyRef:
- name: hubzilla-env
- key: mariadb-password
- - name: HUBZILLA_DB_NAME
- value: hubzilla
- - name: SSMTP_ROOT
- value: support@midnightthoughts.space
- - name: SSMTP_MAILHUB
- value: mail.midnightthoughts.space:587
- - name: SSMTP_AUTHUSER
- value: support@midnightthoughts.space
- - name: SSMTP_AUTHPASS
- valueFrom:
- secretKeyRef:
- name: hubzilla-env
- key: email-password
- - name: SSMTP_USESTARTTLS
- value: "Yes"
- - name: SSMTP_FROMLINEOVERRIDE
- value: "Yes"
- - name: REVALIASES_ROOT
- value: support@midnightthoughts.space:mail.midnightthoughts.space:587
- - name: REVALIASES_WWWDATA
- value: support@midnightthoughts.space:mail.midnightthoughts.space:587
+ - name: HUBZILLA_DB_HOST
+ value: mariadb-maxscale.mariadb-operator.svc.cluster.local
+ - name: HUBZILLA_DB_USER
+ value: hubzilla
+ - name: HUBZILLA_DB_PASS
+ valueFrom:
+ secretKeyRef:
+ name: hubzilla-env
+ key: mariadb-password
+ - name: HUBZILLA_DB_NAME
+ value: hubzilla
+ - name: SSMTP_ROOT
+ value: support@midnightthoughts.space
+ - name: SSMTP_MAILHUB
+ value: mail.midnightthoughts.space:587
+ - name: SSMTP_AUTHUSER
+ value: support@midnightthoughts.space
+ - name: SSMTP_AUTHPASS
+ valueFrom:
+ secretKeyRef:
+ name: hubzilla-env
+ key: email-password
+ - name: SSMTP_USESTARTTLS
+ value: "Yes"
+ - name: SSMTP_FROMLINEOVERRIDE
+ value: "Yes"
+ - name: REVALIASES_ROOT
+ value: support@midnightthoughts.space:mail.midnightthoughts.space:587
+ - name: REVALIASES_WWWDATA
+ value: support@midnightthoughts.space:mail.midnightthoughts.space:587
livenessProbe:
- failureThreshold: 3
- httpGet:
- path: /
- port: 80
+ failureThreshold: 3
+ httpGet:
+ path: /
+ port: 80
readinessProbe:
- httpGet:
- path: /
- port: 80
+ httpGet:
+ path: /
+ port: 80
resources:
- requests:
- ephemeral-storage: 1024Mi
- cpu: 100m
- memory: 200Mi
- limits:
- ephemeral-storage: 2048Mi
- cpu: 2000m
- memory: 2000Mi
+ requests:
+ ephemeral-storage: 1024Mi
+ cpu: 100m
+ memory: 200Mi
+ limits:
+ ephemeral-storage: 2048Mi
+ cpu: 2000m
+ memory: 2000Mi
securityContext:
- allowPrivilegeEscalation: false
- capabilities:
- drop:
- - ALL
- add:
- - NET_BIND_SERVICE
- - CHOWN
- - SETGID
- - SETUID
- readOnlyRootFilesystem: false
- #runAsNonRoot: true
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ add:
+ - NET_BIND_SERVICE
+ - CHOWN
+ - SETGID
+ - SETUID
+ readOnlyRootFilesystem: false
+ #runAsNonRoot: true
volumeMounts:
- - mountPath: /var/www/html
- name: hubzilla-data
- - mountPath: /tmp
- name: tmp
+ - mountPath: /var/www/html
+ name: hubzilla-data
+ - mountPath: /tmp
+ name: tmp
volumes:
- name: hubzilla-data
persistentVolumeClaim:
- claimName: hubzilla-data
+ claimName: hubzilla-data
- name: tmp
emptyDir:
- sizeLimit: 2048Mi
+ sizeLimit: 2048Mi
---
apiVersion: v1
kind: Service
@@ -138,5 +138,5 @@ spec:
- "hub.mtrnord.blog"
rules:
- backendRefs:
- - name: hubzilla-srv
- port: 80
+ - name: hubzilla-srv
+ port: 80
diff --git a/apps/base/mailserver/release.yaml b/apps/base/mailserver/release.yaml
@@ -220,8 +220,7 @@ spec:
dovecot.cf:
create: true
path: dovecot.cf
- data:
- "{{- if .Values.proxyProtocol.enabled }}\n haproxy_trusted_networks = {{ .Values.proxyProtocol.trustedNetworks
+ data: "{{- if .Values.proxyProtocol.enabled }}\n haproxy_trusted_networks = {{ .Values.proxyProtocol.trustedNetworks
}}\n\n {{- if and (.Values.deployment.env.ENABLE_IMAP) (not .Values.deployment.env.SMTP_ONLY) }}\n service
imap-login {\n inet_listener imap {\n port = 143\n }\n\n inet_listener imaps {\n
\ port = 993\n ssl = yes\n }\n\n inet_listener imap_proxy {\n haproxy
@@ -270,8 +269,7 @@ spec:
user-patches.sh:
create: true
path: user-patches.sh
- data:
- "#!/bin/bash\n\n{{- if .Values.proxyProtocol.enabled }}\n# Make sure to keep this file in sync with
+ data: "#!/bin/bash\n\n{{- if .Values.proxyProtocol.enabled }}\n# Make sure to keep this file in sync with
https://github.com/docker-mailserver/docker-mailserver/blob/master/target/postfix/master.cf!\ncat <<EOS
>> /etc/postfix/master.cf\n\n# Submission with proxy\n10587 inet n - n - -
\ smtpd\n -o syslog_name=postfix/submission\n -o smtpd_tls_security_level=encrypt\n -o smtpd_sasl_auth_enable=yes\n
@@ -302,8 +300,8 @@ spec:
sectionName: smtp
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 25
+ - name: mailserver-docker-mailserver
+ port: 25
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
@@ -319,8 +317,8 @@ spec:
sectionName: submissions
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 465
+ - name: mailserver-docker-mailserver
+ port: 465
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
@@ -336,8 +334,8 @@ spec:
sectionName: submission
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 587
+ - name: mailserver-docker-mailserver
+ port: 587
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
@@ -353,8 +351,8 @@ spec:
sectionName: imap
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 143
+ - name: mailserver-docker-mailserver
+ port: 143
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
@@ -370,5 +368,5 @@ spec:
sectionName: imaps
rules:
- backendRefs:
- - name: mailserver-docker-mailserver
- port: 993
+ - name: mailserver-docker-mailserver
+ port: 993
diff --git a/apps/base/matrix/synapse/release.yaml b/apps/base/matrix/synapse/release.yaml
@@ -97,13 +97,13 @@ spec:
modules:
- module: matrix_invitee_server_blocker.InviteeServerBlocker
config:
- broken_servers:
- #- matrix.org
- - matrix.im
- - funami.tech
- - suicideserver.net
- - cuteness-overdose.com
- - xmr.se
+ broken_servers:
+ #- matrix.org
+ - matrix.im
+ - funami.tech
+ - suicideserver.net
+ - cuteness-overdose.com
+ - xmr.se
persistence:
enabled: true
size: 20Gi
@@ -167,11 +167,11 @@ spec:
modules:
- module: matrix_invitee_server_blocker.InviteeServerBlocker
config:
- broken_servers:
- #- matrix.org
- - matrix.im
- - funami.tech
- - suicideserver.net
+ broken_servers:
+ #- matrix.org
+ - matrix.im
+ - funami.tech
+ - suicideserver.net
federation_reader:
resources:
requests:
@@ -397,16 +397,16 @@ spec:
- matrix.midnightthoughts.space
csPaths:
- backendRefs:
- - kind: Service
- name: mas
- port: 8080
+ - kind: Service
+ name: mas
+ port: 8080
matches:
- - path:
- type: RegularExpression
- value: /_matrix/client/.*/(login|logout|refresh).*
- - path:
- type: RegularExpression
- value: /_matrix/client/(api/v1|r0|v3|unstable)/login/sso/redirect
+ - path:
+ type: RegularExpression
+ value: /_matrix/client/.*/(login|logout|refresh).*
+ - path:
+ type: RegularExpression
+ value: /_matrix/client/(api/v1|r0|v3|unstable)/login/sso/redirect
ingress:
enabled: false
sops:
@@ -417,13 +417,13 @@ sops:
age:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzNnU2QzQxaDRUSzZweitZ
- cGRqZ2tVbzcyaDgxK25YR3VBd05vdjErTzBzCnhoUUtLQjJNUFcvS3gwZWFHQTRX
- SlRYbktmZHB3NUZVTGkraVpGbDFuRGsKLS0tIEhzUVp0eGFpS0x3b0Iwa0wyblha
- aVpTQ3NvSmNTaUlkRGRBZyt3NTFIOVUKfMOuzBi39ih3KEp1e8AYxMyBFs/lfoAT
- tBfnztH7yg4wKeey33TVfutV9fOOBsh8jH3qxPHbByqRZJUFJPWkQw==
- -----END AGE ENCRYPTED FILE-----
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzNnU2QzQxaDRUSzZweitZ
+ cGRqZ2tVbzcyaDgxK25YR3VBd05vdjErTzBzCnhoUUtLQjJNUFcvS3gwZWFHQTRX
+ SlRYbktmZHB3NUZVTGkraVpGbDFuRGsKLS0tIEhzUVp0eGFpS0x3b0Iwa0wyblha
+ aVpTQ3NvSmNTaUlkRGRBZyt3NTFIOVUKfMOuzBi39ih3KEp1e8AYxMyBFs/lfoAT
+ tBfnztH7yg4wKeey33TVfutV9fOOBsh8jH3qxPHbByqRZJUFJPWkQw==
+ -----END AGE ENCRYPTED FILE-----
lastmodified: "2025-01-18T14:02:39Z"
mac: ENC[AES256_GCM,data:cqQ7aC03mgh+oBcOYywJo+gqAY+SybgqRmgbCgbZ1mDs0boNfLEAVV4PjuaEutA5Wcq2046rE4gedcUDqxZJpznJquQ0Pcf1oH2pQ/qWSIiOKPf7deeWF5QjClKsg6s+LObdpHpg2QTuOzzwm45guvf40kqlwQQCSi5WVTRlu5g=,iv:lnT8jDGhm1UfrwHp11s5y1W5zkNEoddRn+j/xSq38Io=,tag:K7NfHNUev8C2KjY81QOE4g==,type:str]
pgp: []
