commit 9b702999bc2feb5d43e3d3bd88fa13260dc1275d
parent e6c4e62295818b62a85fe7eaddaa73a5334a93da
Author: MTRNord <mtrnord1@gmail.com>
Date: Thu, 3 Apr 2025 11:12:28 +0200
Set up xandikos
Diffstat:
5 files changed, 519 insertions(+), 200 deletions(-)
diff --git a/apps/2024_cluster/kustomization.yaml b/apps/2024_cluster/kustomization.yaml
@@ -47,3 +47,4 @@ resources:
- ../base/actualbudget-server
- ../base/uptime-kuma
- ../base/element_changedetection
+ - ../base/xandikos
diff --git a/apps/base/element_changedetection/element_deployment.yaml b/apps/base/element_changedetection/element_deployment.yaml
@@ -1,225 +1,225 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
- name: element-changedetection-data
- namespace: changedetection
+ name: element-changedetection-data
+ namespace: changedetection
spec:
- storageClassName: ceph-filesystem
- accessModes:
- - ReadWriteMany
- resources:
- requests:
- storage: 15Gi
+ storageClassName: ceph-filesystem
+ accessModes:
+ - ReadWriteMany
+ resources:
+ requests:
+ storage: 15Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
- name: element-changedetection-sonic-data
- namespace: changedetection
+ name: element-changedetection-sonic-data
+ namespace: changedetection
spec:
- storageClassName: ceph-filesystem
- accessModes:
- - ReadWriteMany
- resources:
- requests:
- storage: 256Mi
+ storageClassName: ceph-filesystem
+ accessModes:
+ - ReadWriteMany
+ resources:
+ requests:
+ storage: 256Mi
---
apiVersion: apps/v1
kind: Deployment
metadata:
- name: element-changedetection
- namespace: changedetection
+ name: element-changedetection
+ namespace: changedetection
spec:
- replicas: 1
- selector:
- matchLabels:
- app: element-changedetection
- strategy:
- rollingUpdate:
- maxSurge: 25%
- maxUnavailable: 25%
- type: RollingUpdate
- template:
- metadata:
- labels:
- app: element-changedetection
- spec:
- containers:
- - image: archivebox/archivebox:latest
- imagePullPolicy: Always
- name: element-changedetection
- command:
- - /app/bin/docker_entrypoint.sh
- args:
- #- init
- #- --setup
- - server
- - --reload
- - 0.0.0.0:8000
- env:
- - name: ADMIN_USERNAME
- value: "MTRNord"
- - name: ADMIN_PASSWORD
- valueFrom:
- secretKeyRef:
- name: element-changedetection
- key: admin_password
- - name: ALLOWED_HOSTS
- value: "element-changes.midnightthoughts.space"
- - name: CSRF_TRUSTED_ORIGINS
- value: "https://element-changes.midnightthoughts.space"
- - name: TZ
- value: "Europe/Berlin"
- - name: PUBLIC_INDEX
- value: "True"
- - name: PUBLIC_SNAPSHOTS
- value: "False"
- - name: PUBLIC_ADD_VIEW
- value: "False"
- - name: SEARCH_BACKEND_ENGINE
- value: "sonic"
- - name: SEARCH_BACKEND_HOST_NAME
- value: "localhost"
- - name: TIMEOUT
- value: "720"
- - name: SEARCH_BACKEND_PASSWORD
- valueFrom:
- secretKeyRef:
- name: element-changedetection
- key: search_backend_password
- livenessProbe:
- failureThreshold: 3
- httpGet:
- path: /
- port: 8000
- httpHeaders:
- - name: Host
- value: "element-changes.midnightthoughts.space"
- readinessProbe:
- httpGet:
- path: /
- port: 8000
- httpHeaders:
- - name: Host
- value: "element-changes.midnightthoughts.space"
- resources:
- requests:
- ephemeral-storage: 1024Mi
- cpu: 100m
- memory: 200Mi
- limits: {}
- volumeMounts:
- - mountPath: /data
- name: element-changedetection-data
- - mountPath: /tmp
- name: tmp
- - image: archivebox/archivebox:latest
- imagePullPolicy: Always
- name: element-changedetection-scheduler
- env:
- - name: PUID
- value: "911"
- - name: PGID
- value: "911"
- - name: TIMEOUT
- value: "720"
- - name: SEARCH_BACKEND_ENGINE
- value: "sonic"
- - name: SEARCH_BACKEND_HOST_NAME
- value: "localhost"
- - name: SEARCH_BACKEND_PASSWORD
- valueFrom:
- secretKeyRef:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: element-changedetection
+ strategy:
+ rollingUpdate:
+ maxSurge: 25%
+ maxUnavailable: 25%
+ type: RollingUpdate
+ template:
+ metadata:
+ labels:
+ app: element-changedetection
+ spec:
+ containers:
+ - image: archivebox/archivebox:latest
+ imagePullPolicy: Always
name: element-changedetection
- key: search_backend_password
- command:
- - /app/bin/docker_entrypoint.sh
- args:
- - schedule
- - --tag
- - element-blog
- - --every
- - "*/15 * * * *"
- - --foreground
- - --update
- - --depth=1
- - https://element.io/blog/rss/
- resources:
- requests:
- ephemeral-storage: 1024Mi
- cpu: 1000m
- memory: 1000Mi
- limits: {}
- volumeMounts:
- - mountPath: /data
- name: element-changedetection-data
- - mountPath: /tmp
- name: tmp
- - image: archivebox/sonic:latest
- imagePullPolicy: Always
- name: element-changedetection-sonic
- env:
- - name: SEARCH_BACKEND_PASSWORD
- valueFrom:
- secretKeyRef:
- name: element-changedetection
- key: search_backend_password
- resources:
- requests:
- ephemeral-storage: 1024Mi
- cpu: 100m
- memory: 200Mi
- limits: {}
- securityContext:
- allowPrivilegeEscalation: false
- capabilities:
- drop:
- - ALL
- #add:
- # - SYS_ADMIN
- readOnlyRootFilesystem: true
- runAsNonRoot: false
- volumeMounts:
- - mountPath: /var/lib/sonic/store
- name: element-changedetection-sonic-data
- - mountPath: /tmp
- name: tmp
- volumes:
- - name: element-changedetection-sonic-data
- persistentVolumeClaim:
- claimName: element-changedetection-sonic-data
- - name: tmp
- emptyDir:
- sizeLimit: 2048Mi
+ command:
+ - /app/bin/docker_entrypoint.sh
+ args:
+ #- init
+ #- --setup
+ - server
+ - --reload
+ - 0.0.0.0:8000
+ env:
+ - name: ADMIN_USERNAME
+ value: "MTRNord"
+ - name: ADMIN_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: element-changedetection
+ key: admin_password
+ - name: ALLOWED_HOSTS
+ value: "element-changes.midnightthoughts.space"
+ - name: CSRF_TRUSTED_ORIGINS
+ value: "https://element-changes.midnightthoughts.space"
+ - name: TZ
+ value: "Europe/Berlin"
+ - name: PUBLIC_INDEX
+ value: "True"
+ - name: PUBLIC_SNAPSHOTS
+ value: "False"
+ - name: PUBLIC_ADD_VIEW
+ value: "False"
+ - name: SEARCH_BACKEND_ENGINE
+ value: "sonic"
+ - name: SEARCH_BACKEND_HOST_NAME
+ value: "localhost"
+ - name: TIMEOUT
+ value: "720"
+ - name: SEARCH_BACKEND_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: element-changedetection
+ key: search_backend_password
+ livenessProbe:
+ failureThreshold: 3
+ httpGet:
+ path: /
+ port: 8000
+ httpHeaders:
+ - name: Host
+ value: "element-changes.midnightthoughts.space"
+ readinessProbe:
+ httpGet:
+ path: /
+ port: 8000
+ httpHeaders:
+ - name: Host
+ value: "element-changes.midnightthoughts.space"
+ resources:
+ requests:
+ ephemeral-storage: 1024Mi
+ cpu: 100m
+ memory: 200Mi
+ limits: {}
+ volumeMounts:
+ - mountPath: /data
+ name: element-changedetection-data
+ - mountPath: /tmp
+ name: tmp
+ - image: archivebox/archivebox:latest
+ imagePullPolicy: Always
+ name: element-changedetection-scheduler
+ env:
+ - name: PUID
+ value: "911"
+ - name: PGID
+ value: "911"
+ - name: TIMEOUT
+ value: "720"
+ - name: SEARCH_BACKEND_ENGINE
+ value: "sonic"
+ - name: SEARCH_BACKEND_HOST_NAME
+ value: "localhost"
+ - name: SEARCH_BACKEND_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: element-changedetection
+ key: search_backend_password
+ command:
+ - /app/bin/docker_entrypoint.sh
+ args:
+ - schedule
+ - --tag
+ - element-blog
+ - --every
+ - "*/15 * * * *"
+ - --foreground
+ - --update
+ - --depth=1
+ - https://element.io/blog/rss/
+ resources:
+ requests:
+ ephemeral-storage: 1024Mi
+ cpu: 1000m
+ memory: 1000Mi
+ limits: {}
+ volumeMounts:
+ - mountPath: /data
+ name: element-changedetection-data
+ - mountPath: /tmp
+ name: tmp
+ - image: archivebox/sonic:latest
+ imagePullPolicy: Always
+ name: element-changedetection-sonic
+ env:
+ - name: SEARCH_BACKEND_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: element-changedetection
+ key: search_backend_password
+ resources:
+ requests:
+ ephemeral-storage: 1024Mi
+ cpu: 100m
+ memory: 200Mi
+ limits: {}
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ #add:
+ # - SYS_ADMIN
+ readOnlyRootFilesystem: true
+ runAsNonRoot: false
+ volumeMounts:
+ - mountPath: /var/lib/sonic/store
+ name: element-changedetection-sonic-data
+ - mountPath: /tmp
+ name: tmp
+ volumes:
+ - name: element-changedetection-sonic-data
+ persistentVolumeClaim:
+ claimName: element-changedetection-sonic-data
+ - name: tmp
+ emptyDir:
+ sizeLimit: 2048Mi
---
apiVersion: v1
kind: Service
metadata:
- labels:
- app: element-changedetection
- name: element-changedetection-srv
- namespace: changedetection
+ labels:
+ app: element-changedetection
+ name: element-changedetection-srv
+ namespace: changedetection
spec:
- ports:
- - port: 8000
- protocol: TCP
- targetPort: 8000
- selector:
- app: element-changedetection
- type: ClusterIP
+ ports:
+ - port: 8000
+ protocol: TCP
+ targetPort: 8000
+ selector:
+ app: element-changedetection
+ type: ClusterIP
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
- name: element-changedetection
- namespace: changedetection
+ name: element-changedetection
+ namespace: changedetection
spec:
- parentRefs:
- - name: envoy-gateway
- namespace: envoy-gateway
- hostnames:
- - "element-changes.midnightthoughts.space"
- rules:
- - backendRefs:
- - name: element-changedetection-srv
- port: 8000
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - "element-changes.midnightthoughts.space"
+ rules:
+ - backendRefs:
+ - name: element-changedetection-srv
+ port: 8000
diff --git a/apps/base/envoy-gateway/release.yaml b/apps/base/envoy-gateway/release.yaml
@@ -430,6 +430,18 @@ spec:
certificateRefs:
- kind: Secret
name: element-changes.midnightthoughts.space
+ - name: https-midnightthoughts-dav
+ protocol: HTTPS
+ hostname: "dav.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: dav.midnightthoughts.space
- name: https-nordgedanken-root
protocol: HTTPS
hostname: "nordgedanken.dev"
diff --git a/apps/base/xandikos/kustomization.yaml b/apps/base/xandikos/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: xandikos
+resources:
+ - release.yaml
diff --git a/apps/base/xandikos/release.yaml b/apps/base/xandikos/release.yaml
@@ -0,0 +1,301 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+ name: xandikos
+ namespace: xandikos
+spec:
+ accessModes:
+ - ReadWriteMany
+ resources:
+ requests:
+ storage: 100Mi
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5b2dpdzIveERjM2FOV3Uz
+ MTZsVEhaV2pHVmFtT2E0OURCa3BoUUdSZFdjCm5DWmprdzYzTjJSNDA0OStTL3pY
+ amsvc21mTjdndXZsMzRYM3JSOW5UREkKLS0tIHkrNmdOakFQREVBcm9KQTY0dVVY
+ WlB4SXViYkcvLy9kMlNHd3NWeTR2THcKH2u+ehSawhRtHoWlnLCbrYvLspOJpG/r
+ 0UIYAhI95ofk8upsTs0Yt9sI3VTssVbmqIZ5nGWwuEG2Wygtvu7VzQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-04-03T09:11:21Z"
+ mac: ENC[AES256_GCM,data:kdSiawd4mAyYlRxAEy4JPbmjdyQlnYUsokojaykAbX9Lv7ww+evMHZ8i4SDVD9bc0rB5ufp29uSIDZmeFRuhUATtP5lGbjbva7QQRgCncIkWVcNj9LmfDYhIx3TLb+6/JlAi/miD10M3L4ZJ8Ln/j3lMcfw3N5gIvXDJCXwH+YA=,iv:gdquXNPE5xHpzapS4tNTjkhFb0R0Jjj1c3U94HCcwnc=,tag:cnOkjLIjRuOVqOJHbso9/Q==,type:str]
+ pgp: []
+ encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: xandikos
+ namespace: xandikos
+spec:
+ strategy:
+ rollingUpdate:
+ maxSurge: 1
+ maxUnavailable: 1
+ type: RollingUpdate
+ replicas: 1
+ selector:
+ matchLabels:
+ app: xandikos
+ template:
+ metadata:
+ labels:
+ app: xandikos
+ spec:
+ containers:
+ - name: xandikos
+ image: ghcr.io/jelmer/xandikos
+ imagePullPolicy: Always
+ command:
+ - python3
+ - -m
+ - xandikos.web
+ - --port=8080
+ - -d/data
+ - --defaults
+ - --listen-address=0.0.0.0
+ - --current-user-principal=/jelmer
+ - --route-prefix=/dav
+ resources:
+ limits:
+ cpu: "2"
+ memory: 2Gi
+ requests:
+ cpu: "0.1"
+ memory: 10M
+ livenessProbe:
+ httpGet:
+ path: /health
+ port: 8081
+ initialDelaySeconds: 30
+ periodSeconds: 3
+ timeoutSeconds: 90
+ ports:
+ - containerPort: 8081
+ volumeMounts:
+ - name: xandikos-volume
+ mountPath: /data
+ securityContext:
+ fsGroup: 1000
+ volumes:
+ - name: xandikos-volume
+ persistentVolumeClaim:
+ claimName: xandikos
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5b2dpdzIveERjM2FOV3Uz
+ MTZsVEhaV2pHVmFtT2E0OURCa3BoUUdSZFdjCm5DWmprdzYzTjJSNDA0OStTL3pY
+ amsvc21mTjdndXZsMzRYM3JSOW5UREkKLS0tIHkrNmdOakFQREVBcm9KQTY0dVVY
+ WlB4SXViYkcvLy9kMlNHd3NWeTR2THcKH2u+ehSawhRtHoWlnLCbrYvLspOJpG/r
+ 0UIYAhI95ofk8upsTs0Yt9sI3VTssVbmqIZ5nGWwuEG2Wygtvu7VzQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-04-03T09:11:21Z"
+ mac: ENC[AES256_GCM,data:kdSiawd4mAyYlRxAEy4JPbmjdyQlnYUsokojaykAbX9Lv7ww+evMHZ8i4SDVD9bc0rB5ufp29uSIDZmeFRuhUATtP5lGbjbva7QQRgCncIkWVcNj9LmfDYhIx3TLb+6/JlAi/miD10M3L4ZJ8Ln/j3lMcfw3N5gIvXDJCXwH+YA=,iv:gdquXNPE5xHpzapS4tNTjkhFb0R0Jjj1c3U94HCcwnc=,tag:cnOkjLIjRuOVqOJHbso9/Q==,type:str]
+ pgp: []
+ encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: xandikos
+ namespace: xandikos
+ labels:
+ app: xandikos
+spec:
+ ports:
+ - port: 8080
+ name: web
+ selector:
+ app: xandikos
+ type: ClusterIP
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5b2dpdzIveERjM2FOV3Uz
+ MTZsVEhaV2pHVmFtT2E0OURCa3BoUUdSZFdjCm5DWmprdzYzTjJSNDA0OStTL3pY
+ amsvc21mTjdndXZsMzRYM3JSOW5UREkKLS0tIHkrNmdOakFQREVBcm9KQTY0dVVY
+ WlB4SXViYkcvLy9kMlNHd3NWeTR2THcKH2u+ehSawhRtHoWlnLCbrYvLspOJpG/r
+ 0UIYAhI95ofk8upsTs0Yt9sI3VTssVbmqIZ5nGWwuEG2Wygtvu7VzQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-04-03T09:11:21Z"
+ mac: ENC[AES256_GCM,data:kdSiawd4mAyYlRxAEy4JPbmjdyQlnYUsokojaykAbX9Lv7ww+evMHZ8i4SDVD9bc0rB5ufp29uSIDZmeFRuhUATtP5lGbjbva7QQRgCncIkWVcNj9LmfDYhIx3TLb+6/JlAi/miD10M3L4ZJ8Ln/j3lMcfw3N5gIvXDJCXwH+YA=,iv:gdquXNPE5xHpzapS4tNTjkhFb0R0Jjj1c3U94HCcwnc=,tag:cnOkjLIjRuOVqOJHbso9/Q==,type:str]
+ pgp: []
+ encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: basic-auth-credentials
+ namespace: xandikos
+data:
+ .htpasswd: ENC[AES256_GCM,data:Agc55rRWqvR4eFwKUXYrLoT0oRYES6D5bCJn/QHaeQQjpHn4XIOrNYZHSvjDRcpA+tMwoh9qUbU=,iv:rovP1QyzIuCstp1DX65foEJw9alcE5mCleA9XI59K/s=,tag:g8Mumi0E3YZGvVE4d9U4vA==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5b2dpdzIveERjM2FOV3Uz
+ MTZsVEhaV2pHVmFtT2E0OURCa3BoUUdSZFdjCm5DWmprdzYzTjJSNDA0OStTL3pY
+ amsvc21mTjdndXZsMzRYM3JSOW5UREkKLS0tIHkrNmdOakFQREVBcm9KQTY0dVVY
+ WlB4SXViYkcvLy9kMlNHd3NWeTR2THcKH2u+ehSawhRtHoWlnLCbrYvLspOJpG/r
+ 0UIYAhI95ofk8upsTs0Yt9sI3VTssVbmqIZ5nGWwuEG2Wygtvu7VzQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-04-03T09:11:21Z"
+ mac: ENC[AES256_GCM,data:kdSiawd4mAyYlRxAEy4JPbmjdyQlnYUsokojaykAbX9Lv7ww+evMHZ8i4SDVD9bc0rB5ufp29uSIDZmeFRuhUATtP5lGbjbva7QQRgCncIkWVcNj9LmfDYhIx3TLb+6/JlAi/miD10M3L4ZJ8Ln/j3lMcfw3N5gIvXDJCXwH+YA=,iv:gdquXNPE5xHpzapS4tNTjkhFb0R0Jjj1c3U94HCcwnc=,tag:cnOkjLIjRuOVqOJHbso9/Q==,type:str]
+ pgp: []
+ encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ name: xandikos-wellknown
+ namespace: xandikos
+spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - midnightthoughts.space
+ rules:
+ - matches:
+ - path:
+ value: /.well-known/caldav
+ filters:
+ - type: URLRewrite
+ urlRewrite:
+ path:
+ type: ReplaceFullPath
+ replaceFullPath: /user/calendars
+ backendRefs:
+ - name: xandikos
+ port: 8080
+ - matches:
+ - path:
+ value: /.well-known/carddav
+ filters:
+ - type: URLRewrite
+ urlRewrite:
+ path:
+ type: ReplaceFullPath
+ replaceFullPath: /user/contacts
+ backendRefs:
+ - name: xandikos
+ port: 8080
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5b2dpdzIveERjM2FOV3Uz
+ MTZsVEhaV2pHVmFtT2E0OURCa3BoUUdSZFdjCm5DWmprdzYzTjJSNDA0OStTL3pY
+ amsvc21mTjdndXZsMzRYM3JSOW5UREkKLS0tIHkrNmdOakFQREVBcm9KQTY0dVVY
+ WlB4SXViYkcvLy9kMlNHd3NWeTR2THcKH2u+ehSawhRtHoWlnLCbrYvLspOJpG/r
+ 0UIYAhI95ofk8upsTs0Yt9sI3VTssVbmqIZ5nGWwuEG2Wygtvu7VzQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-04-03T09:11:21Z"
+ mac: ENC[AES256_GCM,data:kdSiawd4mAyYlRxAEy4JPbmjdyQlnYUsokojaykAbX9Lv7ww+evMHZ8i4SDVD9bc0rB5ufp29uSIDZmeFRuhUATtP5lGbjbva7QQRgCncIkWVcNj9LmfDYhIx3TLb+6/JlAi/miD10M3L4ZJ8Ln/j3lMcfw3N5gIvXDJCXwH+YA=,iv:gdquXNPE5xHpzapS4tNTjkhFb0R0Jjj1c3U94HCcwnc=,tag:cnOkjLIjRuOVqOJHbso9/Q==,type:str]
+ pgp: []
+ encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ name: xandikos
+ namespace: xandikos
+spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - dav.midnightthoughts.space
+ rules:
+ - backendRefs:
+ - name: xandikos
+ port: 8080
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5b2dpdzIveERjM2FOV3Uz
+ MTZsVEhaV2pHVmFtT2E0OURCa3BoUUdSZFdjCm5DWmprdzYzTjJSNDA0OStTL3pY
+ amsvc21mTjdndXZsMzRYM3JSOW5UREkKLS0tIHkrNmdOakFQREVBcm9KQTY0dVVY
+ WlB4SXViYkcvLy9kMlNHd3NWeTR2THcKH2u+ehSawhRtHoWlnLCbrYvLspOJpG/r
+ 0UIYAhI95ofk8upsTs0Yt9sI3VTssVbmqIZ5nGWwuEG2Wygtvu7VzQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-04-03T09:11:21Z"
+ mac: ENC[AES256_GCM,data:kdSiawd4mAyYlRxAEy4JPbmjdyQlnYUsokojaykAbX9Lv7ww+evMHZ8i4SDVD9bc0rB5ufp29uSIDZmeFRuhUATtP5lGbjbva7QQRgCncIkWVcNj9LmfDYhIx3TLb+6/JlAi/miD10M3L4ZJ8Ln/j3lMcfw3N5gIvXDJCXwH+YA=,iv:gdquXNPE5xHpzapS4tNTjkhFb0R0Jjj1c3U94HCcwnc=,tag:cnOkjLIjRuOVqOJHbso9/Q==,type:str]
+ pgp: []
+ encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+ name: basic-auth
+ namespace: xandikos
+spec:
+ targetRefs:
+ - group: gateway.networking.k8s.io
+ kind: HTTPRoute
+ name: xandikos
+ basicAuth:
+ users:
+ name: basic-auth-credentials
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5b2dpdzIveERjM2FOV3Uz
+ MTZsVEhaV2pHVmFtT2E0OURCa3BoUUdSZFdjCm5DWmprdzYzTjJSNDA0OStTL3pY
+ amsvc21mTjdndXZsMzRYM3JSOW5UREkKLS0tIHkrNmdOakFQREVBcm9KQTY0dVVY
+ WlB4SXViYkcvLy9kMlNHd3NWeTR2THcKH2u+ehSawhRtHoWlnLCbrYvLspOJpG/r
+ 0UIYAhI95ofk8upsTs0Yt9sI3VTssVbmqIZ5nGWwuEG2Wygtvu7VzQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-04-03T09:11:21Z"
+ mac: ENC[AES256_GCM,data:kdSiawd4mAyYlRxAEy4JPbmjdyQlnYUsokojaykAbX9Lv7ww+evMHZ8i4SDVD9bc0rB5ufp29uSIDZmeFRuhUATtP5lGbjbva7QQRgCncIkWVcNj9LmfDYhIx3TLb+6/JlAi/miD10M3L4ZJ8Ln/j3lMcfw3N5gIvXDJCXwH+YA=,iv:gdquXNPE5xHpzapS4tNTjkhFb0R0Jjj1c3U94HCcwnc=,tag:cnOkjLIjRuOVqOJHbso9/Q==,type:str]
+ pgp: []
+ encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
