commit e5e2725a3aa385ed4183bd4cc2b1c3dc71c734af
parent c74c459746be2d7034884738df6f34fd9fd3f0df
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Thu, 11 Sep 2025 11:15:54 +0200
Add wkd server
Diffstat:
6 files changed, 164 insertions(+), 37 deletions(-)
diff --git a/apps/talos_cluster/envoy-gateway/gateway_settings.yaml b/apps/talos_cluster/envoy-gateway/gateway_settings.yaml
@@ -115,6 +115,18 @@ spec:
certificateRefs:
- kind: Secret
name: talos.midnightthoughts.space-tls
+ - name: https-nordgedanken.dev
+ protocol: HTTPS
+ hostname: "nordgedanken.dev"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: nordgedanken.dev-tls
- name: https-midnightthoughts-auth
protocol: HTTPS
hostname: "auth.midnightthoughts.space"
diff --git a/apps/talos_cluster/kustomization.yaml b/apps/talos_cluster/kustomization.yaml
@@ -19,4 +19,5 @@ resources:
- ./mailserver
- ./plane
- ./kimai
+ - ./wkd
# - ./matrix-org-statistics
diff --git a/apps/talos_cluster/mailserver/mta-sts-deployment.yaml b/apps/talos_cluster/mailserver/mta-sts-deployment.yaml
@@ -43,13 +43,13 @@ spec:
cpu: "50m"
livenessProbe:
httpGet:
- path: /.well-known/mta-sts.txt
+ path: /health
port: 8080
initialDelaySeconds: 10
periodSeconds: 30
readinessProbe:
httpGet:
- path: /.well-known/mta-sts.txt
+ path: /health
port: 8080
initialDelaySeconds: 5
periodSeconds: 10
@@ -84,41 +84,13 @@ metadata:
name: mta-sts-nginx-config
namespace: mailserver
data:
- default.conf: |
- server {
- listen 8080;
- server_name _;
-
- root /usr/share/nginx/html;
- index index.html;
-
- # Security headers
- add_header X-Content-Type-Options nosniff;
- add_header X-Frame-Options DENY;
- add_header X-XSS-Protection "1; mode=block";
-
- # MTA-STS specific configuration
- location /.well-known/mta-sts.txt {
- add_header Content-Type "text/plain; charset=utf-8";
- add_header Cache-Control "max-age=604800";
- try_files $uri =404;
- }
-
- # Health check endpoint
- location /health {
- access_log off;
- return 200 "healthy\n";
- add_header Content-Type text/plain;
- }
-
- # Deny access to other locations
- location / {
- return 404;
- }
-
- # Disable server tokens
- server_tokens off;
- }
+ default.conf: "server {\n listen 8080;\n server_name _;\n \n root /usr/share/nginx/html;\n index index.html;\n\n
+ \ # Security headers\n add_header X-Content-Type-Options nosniff;\n add_header X-Frame-Options DENY;\n add_header
+ X-XSS-Protection \"1; mode=block\";\n\n # MTA-STS specific configuration\n location /.well-known/mta-sts.txt
+ {\n add_header Content-Type \"text/plain; charset=utf-8\";\n add_header Cache-Control \"max-age=604800\";\n
+ \ try_files $uri =404;\n }\n\n # Health check endpoint\n location /health {\n access_log off;\n
+ \ return 200 \"healthy\\n\";\n add_header Content-Type text/plain;\n }\n\n # Deny access to other
+ locations\n location / {\n return 404;\n }\n\n # Disable server tokens\n server_tokens off;\n}\n"
---
apiVersion: v1
kind: Service
diff --git a/apps/talos_cluster/wkd/deployment.yaml b/apps/talos_cluster/wkd/deployment.yaml
@@ -0,0 +1,129 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: wkd-server
+ namespace: mailserver
+ labels:
+ app: wkd-server
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: wkd-server
+ template:
+ metadata:
+ labels:
+ app: wkd-server
+ spec:
+ containers:
+ - name: nginx
+ image: nginxinc/nginx-unprivileged:1.25-alpine
+ ports:
+ - containerPort: 8080
+ name: http
+ volumeMounts:
+ - name: wkd-config
+ mountPath: /etc/nginx/conf.d
+ readOnly: true
+ - name: wkd-content
+ mountPath: /usr/share/nginx/html/.well-known/openpgpkey/hu/
+ readOnly: true
+ - name: tmp
+ mountPath: /tmp
+ - name: var-cache-nginx
+ mountPath: /var/cache/nginx
+ - name: var-run
+ mountPath: /var/run
+ resources:
+ requests:
+ memory: "32Mi"
+ cpu: "10m"
+ limits:
+ memory: "64Mi"
+ cpu: "50m"
+ livenessProbe:
+ httpGet:
+ path: /health
+ port: 8080
+ initialDelaySeconds: 10
+ periodSeconds: 30
+ readinessProbe:
+ httpGet:
+ path: /health
+ port: 8080
+ initialDelaySeconds: 5
+ periodSeconds: 10
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ runAsUser: 101
+ runAsGroup: 101
+ capabilities:
+ drop:
+ - ALL
+ volumes:
+ - name: wkd-config
+ configMap:
+ name: wkd-nginx-config
+ - name: wkd-content
+ configMap:
+ name: wkd-content
+ - name: tmp
+ emptyDir: {}
+ - name: var-cache-nginx
+ emptyDir: {}
+ - name: var-run
+ emptyDir: {}
+ securityContext:
+ fsGroup: 101
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: wkd-nginx-config
+ namespace: mailserver
+data:
+ default.conf: "server {\n listen 8080;\n server_name _;\n \n root /usr/share/nginx/html;\n index index.html;\n\n
+ \ # Security headers\n add_header X-Content-Type-Options nosniff;\n add_header X-Frame-Options DENY;\n add_header
+ X-XSS-Protection \"1; mode=block\";\n\n # wkd specific configuration\n location /.well-known/openpgpkey/hu/p6d5q6ozbrkcy3cnexq8s8uzh1rk9fbs
+ {\n add_header Content-Type \"application/pgp-key; charset=utf-8\";\n add_header Cache-Control \"max-age=604800\";\n
+ \ try_files $uri =404;\n }\n\n # Health check endpoint\n location /health {\n access_log off;\n
+ \ return 200 \"healthy\\n\";\n add_header Content-Type text/plain;\n }\n\n # Deny access to other
+ locations\n location / {\n return 404;\n }\n\n # Disable server tokens\n server_tokens off;\n}\n"
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: wkd-server
+ namespace: mailserver
+ labels:
+ app: wkd-server
+spec:
+ selector:
+ app: wkd-server
+ ports:
+ - name: http
+ port: 8080
+ targetPort: http
+ protocol: TCP
+ type: ClusterIP
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ name: wkd-server
+ namespace: mailserver
+spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - nordgedanken.dev
+ rules:
+ - backendRefs:
+ - name: wkd-server
+ port: 8080
+ timeouts:
+ request: 240s
+ backendRequest: 0s
diff --git a/apps/talos_cluster/wkd/kustomization.yaml b/apps/talos_cluster/wkd/kustomization.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: mailserver
+resources:
+ - deployment.yaml
+configMapGenerator:
+ - name: wkd-content
+ namespace: mailserver
+ files:
+ - p6d5q6ozbrkcy3cnexq8s8uzh1rk9fbs=p6d5q6ozbrkcy3cnexq8s8uzh1rk9fbs
+ options:
+ labels:
+ app: wkd-server
diff --git a/apps/talos_cluster/wkd/p6d5q6ozbrkcy3cnexq8s8uzh1rk9fbs b/apps/talos_cluster/wkd/p6d5q6ozbrkcy3cnexq8s8uzh1rk9fbs
Binary files differ.
