commit 9527edbe44c56d8d99863bc826a22e9b753f2ce3
parent 13cda78279a292ab0cabac853720f967be8c27bb
Author: MTRNord <mtrnord1@gmail.com>
Date: Sun, 19 Mar 2023 14:49:28 +0100
Add vaultwarden
Diffstat:
8 files changed, 217 insertions(+), 0 deletions(-)
diff --git a/apps/base/vaultwarden/kustomization.yaml b/apps/base/vaultwarden/kustomization.yaml
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: k8s-at-home
+resources:
+ - namespace.yaml
+ - repository.yaml
+ - release.yaml
diff --git a/apps/base/vaultwarden/namespace.yaml b/apps/base/vaultwarden/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+ name: k8s-at-home
diff --git a/apps/base/vaultwarden/release.yaml b/apps/base/vaultwarden/release.yaml
@@ -0,0 +1,60 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+ name: vaultwarden
+ namespace: k8s-at-home
+spec:
+ releaseName: vaultwarden
+ chart:
+ spec:
+ chart: vaultwarden
+ sourceRef:
+ kind: HelmRepository
+ name: k8s-at-home
+ interval: 50m
+ install:
+ remediation:
+ retries: 3
+ # Default values
+ # https://github.com/stefanprodan/podinfo/blob/master/charts/podinfo/values.yaml
+ values:
+ image:
+ tag: 1.27.0
+ env:
+ TZ: "Europe/Berlin"
+ SIGNUPS_ALLOWED: false
+ ADMIN_TOKEN:
+ valueFrom:
+ secretKeyRef:
+ name: vaultwarden-envs
+ key: admin-token
+ WEBSOCKET_ENABLED: true
+ SMTP_PASSWORD:
+ valueFrom:
+ secretKeyRef:
+ name: vaultwarden-envs
+ key: smtp-password
+ DATABASE_URL:
+ valueFrom:
+ secretKeyRef:
+ name: vaultwarden-envs
+ key: database-url
+ persistence:
+ config:
+ enabled: true
+
+ postgresql:
+ enabled: true
+ auth:
+ existingSecret: vaultwarden-postgresql
+ database: vaultwarden
+ persistence:
+ enabled: true
+ service:
+ main:
+ ports:
+ http:
+ port: 80
+ websocket:
+ enabled: true
+ port: 3012
diff --git a/apps/base/vaultwarden/repository.yaml b/apps/base/vaultwarden/repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+ name: k8s-at-home
+ namespace: k8s-at-home
+spec:
+ interval: 5m
+ url: https://k8s-at-home.com/charts/
diff --git a/apps/production/kustomization.yaml b/apps/production/kustomization.yaml
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+ - vaultwarden-secret.yaml
+ - ../base/vaultwarden
+patchesStrategicMerge:
+ - vaultwarden-values.yaml
diff --git a/apps/production/vaultwarden-secret.yaml b/apps/production/vaultwarden-secret.yaml
@@ -0,0 +1,63 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: vaultwarden-postgresql
+ namespace: k8s-at-home
+type: Opaque
+data:
+ postgresql-password: ENC[AES256_GCM,data:h3gXx8ZUR6mtyU++eOK0+lsNTKZGdJrmQx7TKxeySHpw2zcRElKq9maHtPOCKVXG5Tf0t9mLCL1Jf99ruyUoJVMg6ufyVO3pyZUGWGa+4BTIxQP3Fe2NzA==,iv:4XUj7NWmr5ogFHPJCkaktXjAmm0C04ZLFb4xz9e+UEQ=,tag:iyX7n7L5ZpERxiJXGFp+IA==,type:str]
+ postgresql-postgres-password: ENC[AES256_GCM,data:OG+tLnZrJ+R9FbXx2NOREw==,iv:JGvpSvk25JQYCxIxygInRusj2FGtmkCLzAX+ZbCTmok=,tag:RLsF+KO6nPqX/F0M6R4zow==,type:str]
+ password: ENC[AES256_GCM,data:cIvw4gC4s94bECR5V5vFZsyyQlk86kg+JmIcQr4fLb75/T2AcTAm9JOAtOa4yvCk789tOc7Tncw1vufcVoKQSuDS0oi2oEvQGCPdMeg01fHIJnQ5/xISMA==,iv:dItSer1bPtVb9mNoG4GTerRV2NN9AeLh+fiLBylayd4=,tag:YHgKtuQQNsIiTuuXzPqh6w==,type:str]
+ postgres-password: ENC[AES256_GCM,data:08Mh7/ogJjOu2E+m9Ln+4A==,iv:siHg00e+9xE/A8HvIqL8+YUkvqTYY77eI8aC0iSYOwQ=,tag:QTdMVCDBx6hVeO633gS+1Q==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxYjlJWndmOVNDWjc0dU9r
+ eG14bmd3dVZqZmxTRUkvZk5tbm95RzNFK1F3ClpoOTBpWlJMUXhaM0kxaUE5OUdw
+ c1NVZG9yOFZEOUxUSnVKclpBczVuVlEKLS0tIDNBUnJUaHhPZ3R5TzNqZXl1QjJ4
+ SkE1L2tkQXphSlNmU2lVNldrNjU5Qk0KnUm93N3G7ZYU4UKWerKkJBCkpYh7oAmk
+ RNxWx6IGruh1XibBQnOzYvu8RrhqIg6QEgj9WSO4fUalPd0sHByofw==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2023-03-19T13:48:40Z"
+ mac: ENC[AES256_GCM,data:ypOqCj9iYS5rrP0mq2TLArE64INur8hTnU973JHK5BOL1Zedpd0NMT2m9gyx/EjyeEzL51gK7tWHVNMgIm7ZkQOGTV3QulTA3bzN3hr6jNeVajJlL3KiUCk7SWbAoK7NsAOh+dIvBCHy/iFDZiyUcgBYM5oPO4mas8iDyWJhywE=,iv:70UFCZpbCECccUzPQ4AvwPAzZ7/AcCSdcORAkMxHv/M=,tag:Ma2Q0fSmyoyydyCcQ/9Cpg==,type:str]
+ pgp: []
+ encrypted_regex: ^(data|stringData)$
+ version: 3.7.3
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: vaultwarden-envs
+ namespace: k8s-at-home
+type: Opaque
+stringData:
+ admin-token: ENC[AES256_GCM,data:EPL9v8s2yd7LwNymfGFE6wIKCTbZ/NMTgwH7ndRE6DwoYuj0+r6uQZZnbjSd2U+HX707eTxGh4pV0ntAA2IgQA==,iv:kjvn5CLjOW1/R9UmbepR/OFyPD1fKQvLiHQFvuDAuRA=,tag:1H7b67XZXyS1912C7Md8jA==,type:str]
+ smtp-user: ENC[AES256_GCM,data:C+ZLN9yZLX5UjkExmxfgkGEDoqU=,iv:gXFmGlXMoCwVyZ2JUUnkmFLHsPBRn7/hFyJQWvn+9Kc=,tag:VDnd2XGCyTvIbeE1Pz857A==,type:str]
+ smtp-password: ENC[AES256_GCM,data:N9su+bHa5VRu,iv:rPTS1hqPxvb3v8RW9gTu8bIoxipKKL7ytpkPd07zcVE=,tag:bj71sBrsxNHf0SUAe0PJ1w==,type:str]
+ database-url: ENC[AES256_GCM,data:voI0418K5y9cwL6hx233wQoQQsHokL9AnhXhOc1Iq/vw2D3USw3IomoccS5hQrySKZAPTzmCtSVen/W6SnqQ/BmUet1hDRgmerluwOqp9tgXzyuZduASkLrU9u90zeh/mVTAFTUbC74XCBdV/F2s5Z50uWcgizUvibud7LJh57k6Hh/T6HS9JloEyC95rqa8wDSQwhb2M5BgcQ==,iv:8TjB//F6HAli/EfvALxYZC5Rcf+5OTrwkM2aA3tnbSI=,tag:5rx8OKVGJzYZZ25wmlXNCA==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxYjlJWndmOVNDWjc0dU9r
+ eG14bmd3dVZqZmxTRUkvZk5tbm95RzNFK1F3ClpoOTBpWlJMUXhaM0kxaUE5OUdw
+ c1NVZG9yOFZEOUxUSnVKclpBczVuVlEKLS0tIDNBUnJUaHhPZ3R5TzNqZXl1QjJ4
+ SkE1L2tkQXphSlNmU2lVNldrNjU5Qk0KnUm93N3G7ZYU4UKWerKkJBCkpYh7oAmk
+ RNxWx6IGruh1XibBQnOzYvu8RrhqIg6QEgj9WSO4fUalPd0sHByofw==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2023-03-19T13:48:40Z"
+ mac: ENC[AES256_GCM,data:ypOqCj9iYS5rrP0mq2TLArE64INur8hTnU973JHK5BOL1Zedpd0NMT2m9gyx/EjyeEzL51gK7tWHVNMgIm7ZkQOGTV3QulTA3bzN3hr6jNeVajJlL3KiUCk7SWbAoK7NsAOh+dIvBCHy/iFDZiyUcgBYM5oPO4mas8iDyWJhywE=,iv:70UFCZpbCECccUzPQ4AvwPAzZ7/AcCSdcORAkMxHv/M=,tag:Ma2Q0fSmyoyydyCcQ/9Cpg==,type:str]
+ pgp: []
+ encrypted_regex: ^(data|stringData)$
+ version: 3.7.3
diff --git a/apps/production/vaultwarden-values.yaml b/apps/production/vaultwarden-values.yaml
@@ -0,0 +1,47 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+ name: vaultwarden
+ namespace: k8s-at-home
+spec:
+ chart:
+ spec:
+ version: "5.3.2"
+ values:
+ env:
+ DOMAIN: https://vault.nordgedanken.dev
+ SMTP_HOST: mail.nordgedanken.dev
+ SMTP_FROM:
+ valueFrom:
+ secretKeyRef:
+ name: vaultwarden-envs
+ key: smtp-user
+ SMTP_PORT: 465
+ SMTP_SECURITY: force_tls
+ SMTP_USERNAME:
+ valueFrom:
+ secretKeyRef:
+ name: vaultwarden-envs
+ key: smtp-user
+ ingress:
+ main:
+ enabled: true
+ hosts:
+ - host: vault.nordgedanken.dev
+ paths:
+ - path: /
+ pathType: Prefix
+ service:
+ port: 80
+ - path: /notifications/hub/negotiate
+ pathType: Prefix
+ service:
+ port: 80
+ - path: /notifications/hub
+ pathType: Prefix
+ service:
+ port: 3012
+ tls:
+ - secretName: vault.nordgedanken.dev-tls
+ hosts:
+ - vault.nordgedanken.dev
diff --git a/clusters/production/apps.yaml b/clusters/production/apps.yaml
@@ -0,0 +1,21 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+ name: apps
+ namespace: flux-system
+spec:
+ interval: 10m0s
+ dependsOn:
+ - name: infra-configs
+ sourceRef:
+ kind: GitRepository
+ name: flux-system
+ path: ./apps/production
+ prune: false
+ wait: true
+ timeout: 5m0s
+ decryption:
+ provider: sops
+ secretRef:
+ name: sops-age
