cluster

commit 54a32d745abaa74e219e00602498900acdba28dc
parent d54427837103d0e29ecec5927e8560fc53ad8ab0
Author: MTRNord <mtrnord1@gmail.com>
Date:   Tue, 19 Mar 2024 21:52:39 +0100

Initial ldap try

Diffstat:
A
apps/base/openldap/kustomization.yaml
 | 
6
++++++
A
apps/base/openldap/release.yaml
 | 
77
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
A
apps/base/openldap/repository.yaml
 | 
9
+++++++++
M
apps/namespaces/kustomization.yaml
 | 
1
+
A
apps/namespaces/openldap.yaml
 | 
4
++++
M
apps/production/kustomization.yaml
 | 
1
+
M
decrypt.sh
 | 
2
+-
M
encrypt.sh
 | 
2
+-

8 files changed, 100 insertions(+), 2 deletions(-)
diff --git a/apps/base/openldap/kustomization.yaml b/apps/base/openldap/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: openldap
+resources:
+  - repository.yaml
+  - release.yaml
diff --git a/apps/base/openldap/release.yaml b/apps/base/openldap/release.yaml
@@ -0,0 +1,77 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+    name: openldap
+    namespace: openldap
+spec:
+    releaseName: openldap
+    chart:
+        spec:
+            chart: openldap-stack-ha
+            sourceRef:
+                kind: HelmRepository
+                name: openldap
+    interval: 50m
+    timeout: 25m
+    install:
+        timeout: 25m
+        remediation:
+            retries: 3
+    values:
+        global:
+            ldapDomain: users.midnightthoughts.space
+            adminUser: ENC[AES256_GCM,data:25tp3e6eLQ==,iv:pyDid6JGyByvoj6WJyVGqlVFMbQkBv7dEAxClxPJZsQ=,tag:coJSZj41BfXcUiHJnKf4jw==,type:str]
+            adminPassword: ENC[AES256_GCM,data:4ONRXd9gnj6oviEGNjz5bzxIPSqPoiy0dvY+E+RekqjYc1fnEzg4Z8vWhRn3QeL/CcuI+lzbd+1Y4Df95BUqhg==,iv:IPQG6E6MovpuGnS1YnDPvyQL62K8VqDu/Ob3e+0wReI=,tag:GoFY3Lhj28/2CkDdw8fzGA==,type:str]
+            configUser: ENC[AES256_GCM,data:BG54cWaa9Q==,iv:ZsrFCLn7tV9JWGuQoLg6w0uXuOGCShp/7ycoliKrq/c=,tag:/R80StjQf+zhRZKAq4ejcQ==,type:str]
+            configPassword: ENC[AES256_GCM,data:dbRBRedVwSuLutdsmbiHHIxiTMLpcggrJLzqbjrU/4SlQa91yiHnsW3BLIrRUrKIilHRja68Bu49zxojuj1sQA==,iv:UOn7Rg2RUvJQAhszbvXIcTlqySKWh16rTM8eyCtqY18=,tag:nFVHoIjjww1DSMPKYXNh6g==,type:str]
+        pdb:
+            enabled: true
+        persistence:
+            storageClass: nfs-csi
+        tolerations:
+            - key: arch
+              operator: Equal
+              value: arm64
+              effect: NoSchedule
+        initTLSSecret:
+            tls_enabled: true
+            secret: ENC[AES256_GCM,data:OnCQT0huyoggSzd7KL/Hldl4oInJmzUretcrlM3LaFc=,iv:m61zFa3wjLNPPV4y3LkN5xYWA/f5gT6vl+kxJTBffPE=,tag:Squ5RedC/a1X6s1AX0U6Yw==,type:str]
+        ltb-passwd:
+            enabled: false
+        phpldapadmin:
+            enabled: true
+            ingress:
+                enabled: true
+                annotations:
+                    cert-manager.io/cluster-issuer: letsencrypt-http
+                path: /
+                pathType: Prefix
+                ## Ingress Host
+                hosts:
+                    - admin.users.midnightthoughts.space
+                ## Ingress cert
+                tls:
+                    - secretName: users.midnightthoughts.space-tls
+                      hosts:
+                        - users.midnightthoughts.space
+                        - admin.users.midnightthoughts.space
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1cWJ1Z0t3akVuQ2sveSsw
+            YVQyWHRmdkpxQ3pGa2gwakFMcTdoS01RblFJCjNGNDdBcGJPQUlVWEpsK084d1pK
+            SERRaHBnOHFGOHRZclJOT1dsVTY2aXMKLS0tIGpUaWJkUGwrWmJqZHVZNWtuRkcz
+            VFU0a0hjMVJ0bU44S0QyY0VDV1pFS2MKL2V0VSuUqCHIQj730lpY/icE32w+sP7X
+            I5acmwmgQ72linD3X8tgexV1TIZRutR35o2vaRhhX0ibcAKMkoSmFg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-03-19T20:52:23Z"
+    mac: ENC[AES256_GCM,data:7X6D03/+CU62silHN7gsRKNm/CcfMgo7Xii/jRuVho3LwgNJ22WSTIZ+DZdOjEoVbejkhh2zKXcU6wzQXXF/I5eRSi/WcuFB+y9HFPdF1n7PchsTMuDtSp895BlbxRgETV3jnNCModh8YPm6xgUtSJnbz2Od57W4Ju1Hln0KV4c=,iv:t0N9Gkbwlmem5WhOUBBcsPRpph6S46nt41XKN5doS5k=,tag:hfVCMWpB4lMMwmUOcqnwzQ==,type:str]
+    pgp: []
+    encrypted_regex: ^(adminPassword|configPassword|adminUser|configUser|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$
+    version: 3.8.1
diff --git a/apps/base/openldap/repository.yaml b/apps/base/openldap/repository.yaml
@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: openldap
+  namespace: openldap
+spec:
+  interval: 5m
+  url: https://jp-gouin.github.io/helm-openldap/
diff --git a/apps/namespaces/kustomization.yaml b/apps/namespaces/kustomization.yaml
@@ -27,3 +27,4 @@ resources:
   - xandikos.yaml
   - calendar.yaml
   - element-call.yaml
+  - openldap.yaml
diff --git a/apps/namespaces/openldap.yaml b/apps/namespaces/openldap.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: openldap
diff --git a/apps/production/kustomization.yaml b/apps/production/kustomization.yaml
@@ -32,6 +32,7 @@ resources:
   - ../base/calendar
   - ../base/matrix/element-call
   - ../base/matrix/element-call-synapse
+  - ../base/openldap
 patchesStrategicMerge:
   - cosign-values.yaml
   - vaultwarden-values.yaml
diff --git a/decrypt.sh b/decrypt.sh
@@ -1,4 +1,4 @@
 #!/bin/bash
 
 export SOPS_AGE_KEY_FILE="$(pwd)/age.agekey"
-sops --ignore-mac --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh --decrypt --encrypted-regex '^(api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$' --in-place "$1"
+sops --ignore-mac --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh --decrypt --encrypted-regex '^(adminPassword|configPassword|adminUser|configUser|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$' --in-place "$1"
diff --git a/encrypt.sh b/encrypt.sh
@@ -1,3 +1,3 @@
 #!/bin/bash
 
-sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh --encrypt --encrypted-regex '^(api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$' --in-place "$1"
+sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh --encrypt --encrypted-regex '^(adminPassword|configPassword|adminUser|configUser|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|adminPassword|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret)$' --in-place "$1"