commit 465d545ae6a46d8681ed2f245c682eb7c6d64826
parent 78718e311b857bc46b3cd930e50522f9b3d80124
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Sun, 3 Aug 2025 21:46:18 +0200
Move vaultwarden
Diffstat:
6 files changed, 457 insertions(+), 318 deletions(-)
diff --git a/apps/base/envoy-gateway/release.yaml b/apps/base/envoy-gateway/release.yaml
@@ -75,42 +75,42 @@ spec:
protocol: TCP
port: 25
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: submissions
protocol: TCP
port: 465
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: submission
protocol: TCP
port: 587
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: imap
protocol: TCP
port: 143
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: imaps
protocol: TCP
port: 993
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
@@ -159,49 +159,49 @@ spec:
hostname: "docuseal.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: docuseal.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: docuseal.midnightthoughts.space-tls
- name: https-midnightthoughts-neoboard
protocol: HTTPS
hostname: "miro-export.neoboard.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: miro-export.neoboard.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: miro-export.neoboard.midnightthoughts.space-tls
- name: https-midnightthoughts-certs
protocol: HTTPS
hostname: "certs.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: certs.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: certs.midnightthoughts.space-tls
- name: https-midnightthoughts-capacitor
protocol: HTTPS
hostname: "ui.k8s.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: ui.k8s.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: ui.k8s.midnightthoughts.space-tls
# - name: https-midnightthoughts-auth
# protocol: HTTPS
# hostname: "auth.midnightthoughts.space"
@@ -219,97 +219,97 @@ spec:
hostname: "ldap.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: ldap.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: ldap.midnightthoughts.space-tls
- name: https-midnightthoughts-status-webhook
protocol: HTTPS
hostname: "webhook.status.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: webhook.status.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: webhook.status.midnightthoughts.space-tls
- name: https-midnightthoughts-budget
protocol: HTTPS
hostname: "budget.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: budget.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: budget.midnightthoughts.space-tls
- name: https-midnightthoughts-bugzilla
protocol: HTTPS
hostname: "bugzilla.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: bugzilla.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: bugzilla.midnightthoughts.space-tls
- name: https-midnightthoughts-root
protocol: HTTPS
hostname: "midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: midnightthoughts.space-tls
- name: https-midnightthoughts-status
protocol: HTTPS
hostname: "status.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: status.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: status.midnightthoughts.space-tls
- name: https-midnightthoughts-webhook-kubernetes
protocol: HTTPS
hostname: "webhook.kubernetes.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: webhook.kubernetes.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: webhook.kubernetes.midnightthoughts.space-tls
- name: https-midnightthoughts-rspamd
protocol: HTTPS
hostname: "rspamd.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: rspamd.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: rspamd.midnightthoughts.space-tls
# - name: https-midnightthoughts-grafana
# protocol: HTTPS
# hostname: "grafana.midnightthoughts.space"
@@ -327,319 +327,319 @@ spec:
hostname: "osticket.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: osticket.midnightthoughts.space-tls
- - name: https-midnightthoughts-vault
- protocol: HTTPS
- hostname: "vault.midnightthoughts.space"
- port: 443
- allowedRoutes:
- namespaces:
- from: "All"
- tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: vault.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: osticket.midnightthoughts.space-tls
+ # - name: https-midnightthoughts-vault
+ # protocol: HTTPS
+ # hostname: "vault.midnightthoughts.space"
+ # port: 443
+ # allowedRoutes:
+ # namespaces:
+ # from: "All"
+ # tls:
+ # mode: Terminate
+ # certificateRefs:
+ # - kind: Secret
+ # name: vault.midnightthoughts.space-tls
- name: https-midnightthoughts-rook
protocol: HTTPS
hostname: "rook.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: rook.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: rook.midnightthoughts.space-tls
- name: https-midnightthoughts-jenkins
protocol: HTTPS
hostname: "jenkins.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: jenkins.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: jenkins.midnightthoughts.space-tls
- name: https-midnightthoughts-gerrit
protocol: HTTPS
hostname: "gerrit.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: gerrit.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: gerrit.midnightthoughts.space-tls
- name: https-midnightthoughts-uptime
protocol: HTTPS
hostname: "uptime.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: uptime.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: uptime.midnightthoughts.space-tls
- name: https-midnightthoughts-element-changes
protocol: HTTPS
hostname: "element-changes.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: element-changes.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: element-changes.midnightthoughts.space
- name: https-midnightthoughts-dav
protocol: HTTPS
hostname: "dav.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: dav.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: dav.midnightthoughts.space
- name: https-midnightthoughts-plane
protocol: HTTPS
hostname: "plane.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: plane.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: plane.midnightthoughts.space
- name: https-midnightthoughts-irc
protocol: HTTPS
hostname: "irc.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: irc.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: irc.midnightthoughts.space
- name: https-midnightthoughts-rspamd-matrix
protocol: HTTPS
hostname: "rspamd.matrix.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: rspamd.matrix.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: rspamd.matrix.midnightthoughts.space
- name: https-midnightthoughts-collabora
protocol: HTTPS
hostname: "collabora.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: collabora.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: collabora.midnightthoughts.space
- name: https-nordgedanken-root
protocol: HTTPS
hostname: "nordgedanken.dev"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: nordgedanken.dev-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: nordgedanken.dev-tls
- name: https-nordgedanken
protocol: HTTPS
hostname: "*.nordgedanken.dev"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: nordgedanken.dev-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: nordgedanken.dev-tls
- name: https-mtrnord-blog-root
protocol: HTTPS
hostname: "mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: mtrnord.blog-tls
- name: https-mtrnord-blog-matrix
protocol: HTTPS
hostname: "matrix.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: matrix.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: matrix.mtrnord.blog-tls
- name: https-mtrnord-blog-hubzilla
protocol: HTTPS
hostname: "hub.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: hub.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: hub.mtrnord.blog-tls
- name: https-mtrnord-blog-mastodon
protocol: HTTPS
hostname: "mastodon.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mastodon.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: mastodon.mtrnord.blog-tls
- name: https-api-connectivity-tester-mtrnord-blog
protocol: HTTPS
hostname: "api.connectivity-tester.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: api.connectivity-tester.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: api.connectivity-tester.mtrnord.blog-tls
- name: https-stage-connectivity-tester-mtrnord-blog
protocol: HTTPS
hostname: "stage.connectivity-tester.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: stage.connectivity-tester.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: stage.connectivity-tester.mtrnord.blog-tls
- name: https-connectivity-tester-mtrnord-blog
protocol: HTTPS
hostname: "connectivity-tester.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: connectivity-tester.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: connectivity-tester.mtrnord.blog-tls
- name: https-federationtester-mtrnord-blog
protocol: HTTPS
hostname: "federationtester.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: federationtester.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: federationtester.mtrnord.blog-tls
- name: https-notify-mtrnord-blog
protocol: HTTPS
hostname: "notify.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: notify.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: notify.mtrnord.blog-tls
- name: https-rss-mtrnord-blog
protocol: HTTPS
hostname: "rss.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: rss.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: rss.mtrnord.blog-tls
- name: http
protocol: HTTP
port: 80
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
- name: ldap
protocol: TCP
port: 389
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: gerrit-ssh
protocol: TCP
port: 29418
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: ircs
protocol: TCP
port: 6697
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
diff --git a/apps/talos_cluster/envoy-gateway/gateway_settings.yaml b/apps/talos_cluster/envoy-gateway/gateway_settings.yaml
@@ -48,42 +48,42 @@ spec:
protocol: TCP
port: 25
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: submissions
protocol: TCP
port: 465
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: submission
protocol: TCP
port: 587
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: imap
protocol: TCP
port: 143
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: imaps
protocol: TCP
port: 993
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
@@ -108,61 +108,73 @@ spec:
hostname: "talos.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: talos.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: talos.midnightthoughts.space-tls
- name: https-midnightthoughts-auth
protocol: HTTPS
hostname: "auth.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: auth.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: auth.midnightthoughts.space-tls
- name: https-midnightthoughts-grafana
protocol: HTTPS
hostname: "grafana.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: grafana.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: grafana.midnightthoughts.space-tls
- name: https-draupnir-midnightthoughts
protocol: HTTPS
hostname: "draupnir.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: draupnir.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: draupnir.midnightthoughts.space-tls
- name: https-matrix-draupnir-midnightthoughts
protocol: HTTPS
hostname: "matrix.draupnir.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: matrix.draupnir.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: matrix.draupnir.midnightthoughts.space-tls
+ - name: https-midnightthoughts-vault
+ protocol: HTTPS
+ hostname: "vault.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: vault.midnightthoughts.space-tls
# - name: https-docuseal-midnightthoughts
# protocol: HTTPS
# hostname: "docuseal.midnightthoughts.space"
@@ -319,18 +331,6 @@ spec:
# certificateRefs:
# - kind: Secret
# name: osticket.midnightthoughts.space-tls
- # - name: https-midnightthoughts-vault
- # protocol: HTTPS
- # hostname: "vault.midnightthoughts.space"
- # port: 443
- # allowedRoutes:
- # namespaces:
- # from: "All"
- # tls:
- # mode: Terminate
- # certificateRefs:
- # - kind: Secret
- # name: vault.midnightthoughts.space-tls
# - name: https-midnightthoughts-rook
# protocol: HTTPS
# hostname: "rook.midnightthoughts.space"
diff --git a/apps/talos_cluster/kustomization.yaml b/apps/talos_cluster/kustomization.yaml
@@ -7,3 +7,4 @@ resources:
- ./authentik
- ./draupnir4all
- ./draupnir-synapse
+ - ./vaultwarden
diff --git a/apps/talos_cluster/vaultwarden/kustomization.yaml b/apps/talos_cluster/vaultwarden/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: vaultwarden
+resources:
+ - repository.yaml
+ - release.yaml
diff --git a/apps/talos_cluster/vaultwarden/release.yaml b/apps/talos_cluster/vaultwarden/release.yaml
@@ -0,0 +1,124 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+ name: vaultwarden
+ namespace: vaultwarden
+spec:
+ releaseName: vaultwarden
+ chart:
+ spec:
+ version: 0.32.4
+ chart: vaultwarden
+ sourceRef:
+ kind: HelmRepository
+ name: vaultwarden
+ interval: 50m
+ install:
+ remediation:
+ retries: 3
+ values:
+ pushNotifications:
+ installationId:
+ value: ENC[AES256_GCM,data:CtGFmtPISOv0J2O6me4PmlzgXK+CDFrHoLo3e13WgXD+f5m0,iv:KC/WZwA8KKPt0dj+8RQDvxzXLRWk9rAKEjsE2cNfEgQ=,tag:SUkTx6P4osCxJ6q2JvxueQ==,type:str]
+ installationKey:
+ value: ENC[AES256_GCM,data:hLwMy1Hyv7WCB63QWTtWZGTJB6E=,iv:pbBrx6K/xqBhZtnxTI/kvKI5hcX1agYgV+YYPugHIVw=,tag:eU0yIUfRbBNhS3Yqe1OZ2A==,type:str]
+ relayUri: https://push.bitwarden.eu
+ identityUri: https://identity.bitwarden.eu
+ signupsAllowed: false
+ domain: https://vault.midnightthoughts.space
+ signupDomains: nordgedanken.dev,gmail.com
+ timeZone: Europe/Berlin
+ database:
+ type: postgresql
+ uriOverride: ENC[AES256_GCM,data:pACKc/t3QxbEOd0NBDwb+Z+qQbmxEl1wmhDj8WMQdu0FyOS53+ZzPwajKZGdjfTfDZYLSpAZ00NouociUUsB7kkm0K56aW9MLwPBwmRawLS5dD9oTdJDPk6an+FUUNotUjaqfHx//ZVxnSU5zMZ4Af+8gouLZpLSG75lz6szV0HFCz7T81NVYW/ZWi1qdk3d1LKmv9Y3CsnKnXqB+I0=,iv:lCoyLvmPnA0pi4aCQgmwe9/RqXOdwzmG7Rw9UEeMPto=,tag:oWa1K1Eg876+zqapAppk3Q==,type:str]
+ ingress:
+ enabled: false
+ additionalAnnotations:
+ external-dns.alpha.kubernetes.io/hostname: vault.midnightthoughts.space
+ cert-manager.io/cluster-issuer: letsencrypt-dns
+ tlsSecret: vault.midnightthoughts.space-crt
+ hostname: vault.midnightthoughts.space
+ nginxIngressAnnotations: false
+ class: traefik
+ adminToken:
+ value: $argon2id$v=19$m=19456,t=2,p=1$R0VoUlJ2T3I5UDRiL0h0cGgvTzYwbHhIL0poeFNpWmkzZThPUDh3TnNtND0$dm7crNLYaQFcGS7KZ38aKTyrV+E2RdyYKx1wDSjpu4s
+ smtp:
+ host: mail.midnightthoughts.space
+ from: support@midnightthoughts.space
+ fromName: Vault Administrator
+ username:
+ value: support@midnightthoughts.space
+ password:
+ value: ENC[AES256_GCM,data:R6+OcLYjaibNWOD0q+mXal2FbQ/T+d8gwWHvLy0RNL9GY+Pua5RHvJFlEoehNivOWzxGKTanxW2TNuJGztu+qw==,iv:skFwkctaHX5n8xbcwy0gpp6wbsK2LnCA7W93rRa7PzE=,tag:XSB/9LunhtR9NggAaw2CZA==,type:str]
+ security: force_tls
+ port: 465
+ storage:
+ data:
+ name: ENC[AES256_GCM,data:evNb0IVmcyR28vtmJ51uSg==,iv:zZhLCPs1dulZP3n7uziGkXQ7jjRyBO5hzkgyHEA1HCc=,tag:MPb3RGVErypZCQSOyu/T0w==,type:str]
+ class: ENC[AES256_GCM,data:1zirMw5kVsqKYui27Vzy,iv:DEzF6jWtcxlanzBHtkl61+YjmUx49iJkdsMYNvMnkZU=,tag:MF1RC+lpMu5fmVNa6gtJ2g==,type:str]
+ size: ENC[AES256_GCM,data:Go1IbE0=,iv:i4e0yHboRQdmnnDs4QV3MivStpTqO/WRH+afcWN/KCE=,tag:dQsOUkjvSCVRFcBkaotJJQ==,type:str]
+ accessMode: ENC[AES256_GCM,data:dXiHeVUzJTUbZvlnCA==,iv:A4ggZ+NSviEcDzBRI2kCU7UE8UKuLTF9VXmXUgfhp5c=,tag:T6CTgynn5LZEKk4CwCvdHg==,type:str]
+ keepPvc: ENC[AES256_GCM,data:8JbcnA==,iv:/ekC4pqIysCh/8GSKidLvjWofCmifLtZSz9RvpTP9so=,tag:gmsAkyLowWvvvAAnDY1Q8g==,type:bool]
+ resources:
+ requests:
+ cpu: 50m
+ memory: 256Mi
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5RTRKa1JRamJ0RTg4OEtl
+ Q1lRRVVkUElZQUVpeFprWm9GSGpjL2xkcUVRClo2bFczOE9RdjM1VmpkUWp2b0Fa
+ UHJ3b2NuMkZFVENCNGUrTmJ2Zkk1NzAKLS0tIDZ2cXI1ODZrMEsyTHZFTDdBNUNB
+ bmVRRVMzUUdoNE0vWFJaYWFVcTQ1LzAKheuPKSFl287+oh8P157O7615zfqnpcM/
+ pFCfrvVUfmTTdcaGOBbKXupfhpWux5dvS8AYMn7vltQWf6+dGwIdRQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-03-22T17:27:04Z"
+ mac: ENC[AES256_GCM,data:3u33IvkTdqFsfnQvSwwZv4dsTnd+GHTBqRg/rQ8YyLIs61qrIfUPfAhc8wpNJXvpRyOBzBZ96vCon/ZCLYA6gJCIUAV6v1Qq3M6QyqrVU+V7/wMNe3C7mZhQlcSueMeqUiSjwhz3W7/SCrMpqPRq+QQJgAEXZHy4CfzkFyQIm/0=,iv:nsxcaeRlfsWhRDLsm5nrWuSDTZMp3mThrGSvWu6i9Fs=,tag:xYp9xiiEgj6+mzOLAzlvbw==,type:str]
+ pgp: []
+ encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ name: vaultwarden
+ namespace: vaultwarden
+spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - vault.midnightthoughts.space
+ rules:
+ - backendRefs:
+ - name: vaultwarden
+ port: 80
+ timeouts:
+ request: 240s
+ backendRequest: 0s
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5RTRKa1JRamJ0RTg4OEtl
+ Q1lRRVVkUElZQUVpeFprWm9GSGpjL2xkcUVRClo2bFczOE9RdjM1VmpkUWp2b0Fa
+ UHJ3b2NuMkZFVENCNGUrTmJ2Zkk1NzAKLS0tIDZ2cXI1ODZrMEsyTHZFTDdBNUNB
+ bmVRRVMzUUdoNE0vWFJaYWFVcTQ1LzAKheuPKSFl287+oh8P157O7615zfqnpcM/
+ pFCfrvVUfmTTdcaGOBbKXupfhpWux5dvS8AYMn7vltQWf6+dGwIdRQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-03-22T17:27:04Z"
+ mac: ENC[AES256_GCM,data:3u33IvkTdqFsfnQvSwwZv4dsTnd+GHTBqRg/rQ8YyLIs61qrIfUPfAhc8wpNJXvpRyOBzBZ96vCon/ZCLYA6gJCIUAV6v1Qq3M6QyqrVU+V7/wMNe3C7mZhQlcSueMeqUiSjwhz3W7/SCrMpqPRq+QQJgAEXZHy4CfzkFyQIm/0=,iv:nsxcaeRlfsWhRDLsm5nrWuSDTZMp3mThrGSvWu6i9Fs=,tag:xYp9xiiEgj6+mzOLAzlvbw==,type:str]
+ pgp: []
+ encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/vaultwarden/repository.yaml b/apps/talos_cluster/vaultwarden/repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+ name: vaultwarden
+ namespace: vaultwarden
+spec:
+ interval: 5m
+ url: https://guerzon.github.io/vaultwarden
