commit 80dd70a1015f0c0a810812ffbab02bb9a2d0ce95
parent 61c329bb44f138a594536a8db0882dec7a283729
Author: MTRNord <mtrnord1@gmail.com>
Date: Wed, 19 Mar 2025 14:17:25 +0100
Migrate vaultwarden to HTTPRoute
Diffstat:
2 files changed, 78 insertions(+), 15 deletions(-)
diff --git a/apps/base/envoy-gateway/release.yaml b/apps/base/envoy-gateway/release.yaml
@@ -346,6 +346,30 @@ spec:
certificateRefs:
- kind: Secret
name: grafana.midnightthoughts.space-tls
+ - name: https-midnightthoughts-osticket
+ protocol: HTTPS
+ hostname: "osticket.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: osticket.midnightthoughts.space-tls
+ - name: https-midnightthoughts-vault
+ protocol: HTTPS
+ hostname: "vault.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: vault.midnightthoughts.space-tls
- name: https-nordgedanken-root
protocol: HTTPS
hostname: "nordgedanken.dev"
diff --git a/apps/base/vaultwarden/release.yaml b/apps/base/vaultwarden/release.yaml
@@ -19,9 +19,9 @@ spec:
values:
pushNotifications:
installationId:
- value: ENC[AES256_GCM,data:5PSbBhtOlRJnNtY5OkPTWKoGK0OHEur8kpHIlht4JzyMSpCP,iv:bCfB/IfcxL4P6F9gy8XgF5/IeX4K5ANp8aBVcICB9qs=,tag:wD/TdJZHUtrj4D70bXCp3w==,type:str]
+ value: ENC[AES256_GCM,data:iTZubdJ98swGTmrKOVKLnGAfIlk3FHTPB26h2V7cJQtATIK3,iv:RXboXM5a8umeJLJO9ohljLOXy1/UJ72xh2tRR7dziwk=,tag:iaYTE+4EMcHohYo1MYv36Q==,type:str]
installationKey:
- value: ENC[AES256_GCM,data:13lSVt2v0LvHBhtArefnHjd+eck=,iv:EvLy9jdeN35vxWCfkUS1mhTfziB3U+H+IANXKMtO0Gk=,tag:7GW7vZHvw+M1E+yc/0Z49g==,type:str]
+ value: ENC[AES256_GCM,data:Kl80VSuAfOEoKij5oOFgwiDQgtA=,iv:voe87dofqnpE0h3sIYToqOPvOGNF9gK/nTdv3eqIB0M=,tag:UJ+iL5BfhU8qqK6zSGZmWw==,type:str]
relayUri: https://push.bitwarden.eu
identityUri: https://identity.bitwarden.eu
signupsAllowed: false
@@ -30,7 +30,7 @@ spec:
timeZone: Europe/Berlin
database:
type: postgresql
- uriOverride: ENC[AES256_GCM,data:FXNXZprXFt9newUZnuhMyF+S6KLhBQfAb2o/xI7wp4yAq0blWCe1UGIaM0CKK6TzJsFrLD3lcHiq+1oAbgvDsE2hQ2XpG+dIfOFfy6BiEJPoK0B6S/klfSe/0LAJZbq7r/XcX8HucvMqSmqioQtSAJIFKnYyq2wDdkKybWVnCgrpBdf+n3JEiJnf7Wm02EV4IAsYbKCAjjz2F5rbnQQ=,iv:NG5/jMHiGUuLxXIBD64MTkX0IAglnkACaarmRVkPoAo=,tag:AE2S8FzBI+KJkv7hvO0ptQ==,type:str]
+ uriOverride: ENC[AES256_GCM,data:9h2zyS+BqqkZ9wnGviTgJZ7btNNsHjXrIlqa5k0oSLAa8BaBhrEv3ksTY0HtYn88Ujws47Vrs1HNqZ1MJvUbmxCro0Gau/wI1pJysdl8djhFR6YPCBuO62grgXSJVBzVNdi7rZHNnswPc57NHpSOq5H9vqc2GenQaUIY3ag0WBmzya70zsyV0DgvfDdGSIJ4mvXNBeAAbuy3MygxLWw=,iv:zLcfOivbzG6oHSzInjaPyP/+Vk26+l4Lc8oFGfQ3zfs=,tag:G61yk2qSY+j5rDUY9BhhiQ==,type:str]
ingress:
enabled: true
additionalAnnotations:
@@ -49,14 +49,14 @@ spec:
username:
value: support@midnightthoughts.space
password:
- value: ENC[AES256_GCM,data:1ZmPnoE3943F0dz7yeTTjVYReDLctDA1RbLf753wzYSZPS/hYgLdSS6E1D6e/VkbPnLXiIv6eInFU2XUsnx5lg==,iv:ua5LelpWE6Iu1rpV36rVk3iBNl1a5yigSea3hNDeFwQ=,tag:bO9+b4djglOO6zuQjog91w==,type:str]
+ value: ENC[AES256_GCM,data:dtRtjwzZaXxaGuTOQDIaEyYtkt0y3Ju6+jLdBMQ5lKo56dPxYgDxzaB42zefDgwpiu/CHGsg+mmRJ10c4v+35g==,iv:8yN1NWZxTXTWRpi8OKxZMmgG5wkuXLNwXE7/1jE34xg=,tag:5ARFS/MLHVsidashSwFy8w==,type:str]
security: force_tls
port: 465
data:
- name: ENC[AES256_GCM,data:1E1SIRDSt3607HDM01ZBzA==,iv:YPmxngKaPcHwrNU/KcWMqfZAkdZijvov9ScgWadMDEk=,tag:N12PBnvfopKMWCFkaDDHUQ==,type:str]
- size: ENC[AES256_GCM,data:buE+,iv:WYcdf3TPNtSlI/mdOwSBw7IwGHQpjY+m+QSocDoeAEc=,tag:+eyfKCplpaP4+AF7cZgyGg==,type:str]
- accessMode: ENC[AES256_GCM,data:7t2EFHUuDDAir8pW8A==,iv:aR4ZXmBMe6GPvihd+1HKxO5/FngDJUcr6KAV/6eh190=,tag:L46kPinc9LRM4CTs5Y4Htw==,type:str]
- keepPvc: ENC[AES256_GCM,data:hMuMlA==,iv:RE7fo4qkmW4IwXGehaNyq9cZTELUEQd5yODrLvnmqWM=,tag:MV/npvne02vDhWiq3DJyIg==,type:bool]
+ name: ENC[AES256_GCM,data:hl2WjRTRndzsCfABM7hTLA==,iv:4JL9mWDYfRto85lai4daNh5U2TgxtdqBpXm1JErjEbk=,tag:V2X2ZyLdRT/NVm0ju9DNuA==,type:str]
+ size: ENC[AES256_GCM,data:0AFo,iv:6HWI1Bs7kKPHqnqxvzziAzcM0B08+NpYn3BhsWASnTo=,tag:MTuF2lZOdS7W0N2EFqaGtA==,type:str]
+ accessMode: ENC[AES256_GCM,data:EwH3tSYBVWoo6jAEgg==,iv:EO0lBE4YYBLp1LMlzMEj+0Y3f4aGHGuxolP1K/wbM7k=,tag:xchYk9x5VFVreIsCnW76vA==,type:str]
+ keepPvc: ENC[AES256_GCM,data:FkYZyQ==,iv:4MobKpfk0dhrV5cafzq8GJiZyz3bLRNVwMgqmX4WaCo=,tag:ayvd388LmUaLYSUdbL38dw==,type:bool]
resources:
requests:
cpu: 50m
@@ -70,14 +70,53 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQWDVNQmI5Q3MxZktzcjhJ
- d1lVMXd1SE5OaTdXdjhFZkdCbHR0Z25iQUVBClo4NjFBWHZvTnFNT09pcWpKSlc4
- STk1WnhrTnBiWGI5ZVF6RzB1eEZVYnMKLS0tIE9zeHRKM3pYLzh5MFpWYVlEanlB
- Wm94SWNwVmdSSWk5ZmhqYm5nMWd6WWMKw6ciC8wd5At3/5wfeHjRyNEr7xQzuonA
- O5TgUDcNOlfx6Nf6nmsZYz9Vslsyra9sxcMwhZXewPWGhufcsA28Kg==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJbGRaNlRDdTVzRWxqRTJ1
+ eTVWcVBoOXU3S09lRFhvZU1DOWYrRStPNUVRCnVlenNsWFJHb09QUjByRExwb29r
+ dFhheVlpTExGeDZyM3h2SVFhR28yNGcKLS0tIGlJU2ZnWEZiaWxKT0R3NDFRS3lw
+ ZjkwMTU1bmo4bVZSLzNoMTB5aEJJWncKlIMi5RLZuT4lMXKhGNGwTCgYpPHFHVHt
+ +JHucGxVBTjq5cQUgfz35lRl80y2j5yXgCYtvZdMiHhbZMld8BWDGw==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-03-16T13:09:24Z"
- mac: ENC[AES256_GCM,data:G5qFQMwhqoJAaK5r+rPVn1sOLhnxktq/LR2FI9H6JklkD8WEcwGjbNcTbMHv11UFLITB8Z7NkzT7yHBswWkb8OZ/Si5/kBlHRrrUL+iurUx0oHE0m6+bgVkpfIAbscyzBQjlq2hZ/vAbaIBUBnL0ySIQUsKicEXZOMgZSpRyPUU=,iv:pR7zpbVemSdy8RgZoNug2SfdChQ9mJfNnR2GnEMmP+0=,tag:AJDgltomKHhbmLAJVHH8Fg==,type:str]
+ lastmodified: "2025-03-19T13:15:36Z"
+ mac: ENC[AES256_GCM,data:QhaK4v48I0IHScwOg0F1PUq+cM0wxoVGDrmnLSG8bgxWgqik/QileLykDFMHk4vpOl+BkobF1iCK5RAr/YRCGp3un0rjybXCUEx728x8zW5GX9cvAzpPMVWoNdPlI8w4w5RBPC5/rDkyn5Z4v4xgZ4vuY/cUuOhXIG80Ayq4Fgw=,iv:cTNUqdmGzSv2OO22zXTsVRrp56tfj9P6BqbYMMuJNt4=,tag:FUXROknb9UXNjSQxAKKtPA==,type:str]
+ pgp: []
+ encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ name: vaultwarden
+ namespace: vaultwarden
+spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - vault.midnightthoughts.space
+ rules:
+ - backendRefs:
+ - name: vaultwarden
+ port: 80
+ timeouts:
+ request: 240s
+ backendRequest: 0s
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJbGRaNlRDdTVzRWxqRTJ1
+ eTVWcVBoOXU3S09lRFhvZU1DOWYrRStPNUVRCnVlenNsWFJHb09QUjByRExwb29r
+ dFhheVlpTExGeDZyM3h2SVFhR28yNGcKLS0tIGlJU2ZnWEZiaWxKT0R3NDFRS3lw
+ ZjkwMTU1bmo4bVZSLzNoMTB5aEJJWncKlIMi5RLZuT4lMXKhGNGwTCgYpPHFHVHt
+ +JHucGxVBTjq5cQUgfz35lRl80y2j5yXgCYtvZdMiHhbZMld8BWDGw==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-03-19T13:15:36Z"
+ mac: ENC[AES256_GCM,data:QhaK4v48I0IHScwOg0F1PUq+cM0wxoVGDrmnLSG8bgxWgqik/QileLykDFMHk4vpOl+BkobF1iCK5RAr/YRCGp3un0rjybXCUEx728x8zW5GX9cvAzpPMVWoNdPlI8w4w5RBPC5/rDkyn5Z4v4xgZ4vuY/cUuOhXIG80Ayq4Fgw=,iv:cTNUqdmGzSv2OO22zXTsVRrp56tfj9P6BqbYMMuJNt4=,tag:FUXROknb9UXNjSQxAKKtPA==,type:str]
pgp: []
encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
