commit f51e5eaf9c7786e6c09a9d4909c33261e2527aec
parent ed63d7821d1bd1b7cd11f540da5cfa0f42ed32a4
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Sat, 13 Sep 2025 18:16:34 +0200
enable debug logging on stage
Diffstat:
3 files changed, 258 insertions(+), 292 deletions(-)
diff --git a/apps/talos_cluster/connectivity-tester/staging_deployment.yaml b/apps/talos_cluster/connectivity-tester/staging_deployment.yaml
@@ -42,6 +42,11 @@ spec:
- name: federation-tester-api
image: ghcr.io/mtrnord/rust-federation-tester:main
imagePullPolicy: Always
+ env:
+ - name: RFT_DEBUG
+ value: "1"
+ - name: RFT_TRACE_SPANS
+ value: "close"
resources:
limits: {}
requests:
diff --git a/apps/talos_cluster/envoy-gateway/gateway_settings.yaml b/apps/talos_cluster/envoy-gateway/gateway_settings.yaml
@@ -48,42 +48,42 @@ spec:
protocol: TCP
port: 25
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: submissions
protocol: TCP
port: 465
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: submission
protocol: TCP
port: 587
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: imap
protocol: TCP
port: 143
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: imaps
protocol: TCP
port: 993
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
@@ -108,339 +108,339 @@ spec:
hostname: "talos.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: talos.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: talos.midnightthoughts.space-tls
- name: https-nordgedanken.dev
protocol: HTTPS
hostname: "nordgedanken.dev"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: nordgedanken.dev-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: nordgedanken.dev-tls
- name: https-openpgpkey.nordgedanken.dev
protocol: HTTPS
hostname: "openpgpkey.nordgedanken.dev"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: openpgpkey.nordgedanken.dev-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: openpgpkey.nordgedanken.dev-tls
- name: https-midnightthoughts-auth
protocol: HTTPS
hostname: "auth.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: auth.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: auth.midnightthoughts.space-tls
- name: https-midnightthoughts-grafana
protocol: HTTPS
hostname: "grafana.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: grafana.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: grafana.midnightthoughts.space-tls
- name: https-draupnir-midnightthoughts
protocol: HTTPS
hostname: "draupnir.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: draupnir.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: draupnir.midnightthoughts.space-tls
- name: https-matrix-draupnir-midnightthoughts
protocol: HTTPS
hostname: "matrix.draupnir.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: matrix.draupnir.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: matrix.draupnir.midnightthoughts.space-tls
- name: https-midnightthoughts-vault
protocol: HTTPS
hostname: "vault.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: vault.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: vault.midnightthoughts.space-tls
- name: https-midnightthoughts-budget
protocol: HTTPS
hostname: "budget.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: budget.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: budget.midnightthoughts.space-tls
- name: https-midnightthoughts-ldap
protocol: HTTPS
hostname: "ldap.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: ldap.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: ldap.midnightthoughts.space-tls
- name: ldap
protocol: TCP
port: 389
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: https-mtrnord-blog-gts
protocol: HTTPS
hostname: "gts.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: gts.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: gts.mtrnord.blog-tls
- name: https-midnightthoughts-collabora
protocol: HTTPS
hostname: "collabora.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: collabora.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: collabora.midnightthoughts.space
- name: https-midnightthoughts-webhook-kubernetes
protocol: HTTPS
hostname: "webhook.kubernetes.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: webhook.kubernetes.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: webhook.kubernetes.midnightthoughts.space-tls
- name: https-api-connectivity-tester-mtrnord-blog
protocol: HTTPS
hostname: "api.connectivity-tester.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: api.connectivity-tester.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: api.connectivity-tester.mtrnord.blog-tls
- name: https-stage-connectivity-tester-mtrnord-blog
protocol: HTTPS
hostname: "stage.connectivity-tester.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: stage.connectivity-tester.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: stage.connectivity-tester.mtrnord.blog-tls
- name: https-connectivity-tester-mtrnord-blog
protocol: HTTPS
hostname: "connectivity-tester.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: connectivity-tester.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: connectivity-tester.mtrnord.blog-tls
- name: https-federationtester-mtrnord-blog
protocol: HTTPS
hostname: "federationtester.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: federationtester.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: federationtester.mtrnord.blog-tls
- name: https-mtrnord-blog-root
protocol: HTTPS
hostname: "mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: mtrnord.blog-tls
- name: https-mtrnord-blog-matrix
protocol: HTTPS
hostname: "matrix.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: matrix.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: matrix.mtrnord.blog-tls
- name: https-rss-mtrnord-blog
protocol: HTTPS
hostname: "rss.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: rss.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: rss.mtrnord.blog-tls
- name: https-notify-mtrnord-blog
protocol: HTTPS
hostname: "notify.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: notify.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: notify.mtrnord.blog-tls
- name: https-midnightthoughts-rspamd
protocol: HTTPS
hostname: "rspamd.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: rspamd.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: rspamd.midnightthoughts.space-tls
- name: https-midnightthoughts-plane
protocol: HTTPS
hostname: "plane.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: plane.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: plane.midnightthoughts.space
- name: https-midnightthoughts-kimai
protocol: HTTPS
hostname: "kimai.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: kimai.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: kimai.midnightthoughts.space
- name: https-midnightthoughts-morg-statistics
protocol: HTTPS
hostname: "morg-statistics.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: morg-statistics.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: morg-statistics.midnightthoughts.space
- name: https-midnightthoughts-mta-sts
protocol: HTTPS
hostname: "mta-sts.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mta-sts.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: mta-sts.midnightthoughts.space
- name: http
protocol: HTTP
port: 80
allowedRoutes:
- namespaces:
- from: "All"
- # - name: https-midnightthoughts-capacitor
- # protocol: HTTPS
- # hostname: "ui.k8s.midnightthoughts.space"
- # port: 443
- # allowedRoutes:
- # namespaces:
- # from: "All"
- # tls:
- # mode: Terminate
- # certificateRefs:
- # - kind: Secret
- # name: ui.k8s.midnightthoughts.space-tls
+ namespaces:
+ from: "All"
+ # - name: https-midnightthoughts-capacitor
+ # protocol: HTTPS
+ # hostname: "ui.k8s.midnightthoughts.space"
+ # port: 443
+ # allowedRoutes:
+ # namespaces:
+ # from: "All"
+ # tls:
+ # mode: Terminate
+ # certificateRefs:
+ # - kind: Secret
+ # name: ui.k8s.midnightthoughts.space-tls
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
diff --git a/apps/talos_cluster/wkd/deployment.yaml b/apps/talos_cluster/wkd/deployment.yaml
@@ -19,59 +19,59 @@ spec:
- name: nginx
image: nginxinc/nginx-unprivileged:1.25-alpine
ports:
- - containerPort: 8080
- name: http
+ - containerPort: 8080
+ name: http
volumeMounts:
- - name: wkd-config
- mountPath: /etc/nginx/conf.d
- readOnly: true
- - name: wkd-content
- mountPath: /usr/share/nginx/html/.well-known/openpgpkey/hu/
- readOnly: true
- - name: wkd-content
- mountPath: /usr/share/nginx/html/.well-known/openpgpkey/nordgedanken.dev/hu/
- readOnly: true
- - name: tmp
- mountPath: /tmp
- - name: var-cache-nginx
- mountPath: /var/cache/nginx
- - name: var-run
- mountPath: /var/run
+ - name: wkd-config
+ mountPath: /etc/nginx/conf.d
+ readOnly: true
+ - name: wkd-content
+ mountPath: /usr/share/nginx/html/.well-known/openpgpkey/hu/
+ readOnly: true
+ - name: wkd-content
+ mountPath: /usr/share/nginx/html/.well-known/openpgpkey/nordgedanken.dev/hu/
+ readOnly: true
+ - name: tmp
+ mountPath: /tmp
+ - name: var-cache-nginx
+ mountPath: /var/cache/nginx
+ - name: var-run
+ mountPath: /var/run
resources:
- requests:
- memory: "32Mi"
- cpu: "10m"
- limits:
- memory: "64Mi"
- cpu: "50m"
+ requests:
+ memory: "32Mi"
+ cpu: "10m"
+ limits:
+ memory: "64Mi"
+ cpu: "50m"
livenessProbe:
- httpGet:
- path: /health
- port: 8080
- initialDelaySeconds: 10
- periodSeconds: 30
+ httpGet:
+ path: /health
+ port: 8080
+ initialDelaySeconds: 10
+ periodSeconds: 30
readinessProbe:
- httpGet:
- path: /health
- port: 8080
- initialDelaySeconds: 5
- periodSeconds: 10
+ httpGet:
+ path: /health
+ port: 8080
+ initialDelaySeconds: 5
+ periodSeconds: 10
securityContext:
- allowPrivilegeEscalation: false
- readOnlyRootFilesystem: true
- runAsNonRoot: true
- runAsUser: 101
- runAsGroup: 101
- capabilities:
- drop:
- - ALL
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ runAsUser: 101
+ runAsGroup: 101
+ capabilities:
+ drop:
+ - ALL
volumes:
- name: wkd-config
configMap:
- name: wkd-nginx-config
+ name: wkd-nginx-config
- name: wkd-content
configMap:
- name: wkd-content
+ name: wkd-content
- name: tmp
emptyDir: {}
- name: var-cache-nginx
@@ -87,57 +87,18 @@ metadata:
name: wkd-nginx-config
namespace: mailserver
data:
- default.conf: |
- server {
- listen 8080;
- server_name _;
-
- root /usr/share/nginx/html;
- index index.html;
-
- # Security headers
- add_header X-Content-Type-Options nosniff;
- add_header X-Frame-Options DENY;
- add_header X-XSS-Protection "1; mode=block";
-
- # wkd specific configuration
- location /.well-known/openpgpkey/hu/p6d5q6ozbrkcy3cnexq8s8uzh1rk9fbs {
- add_header Content-Type "application/octet-stream; charset=utf-8";
- add_header Cache-Control "max-age=604800";
- try_files $uri =404;
- }
- location /.well-known/openpgpkey/nordgedanken.dev/hu/p6d5q6ozbrkcy3cnexq8s8uzh1rk9fbs {
- add_header Content-Type "application/octet-stream; charset=utf-8";
- add_header Cache-Control "max-age=604800";
- try_files $uri =404;
- }
- location /.well-known/openpgpkey/policy {
- return 200 "";
- add_header Content-Type text/plain;
- }
- location / {
- return 200 "OK\n";
- add_header Content-Type text/plain;
- }
-
- # Tell synapse to not look for a matrix server here
- location /.well-known/matrix/server {
- return 410;
- }
- location /_matrix {
- return 410;
- }
-
- # Health check endpoint
- location /health {
- access_log off;
- return 200 "healthy\n";
- add_header Content-Type text/plain;
- }
-
- # Disable server tokens
- server_tokens off;
- }
+ default.conf: "server {\n listen 8080;\n server_name _;\n \n root /usr/share/nginx/html;\n index index.html;\n\n
+ \ # Security headers\n add_header X-Content-Type-Options nosniff;\n add_header X-Frame-Options DENY;\n add_header
+ X-XSS-Protection \"1; mode=block\";\n\n # wkd specific configuration\n location /.well-known/openpgpkey/hu/p6d5q6ozbrkcy3cnexq8s8uzh1rk9fbs
+ {\n add_header Content-Type \"application/octet-stream; charset=utf-8\";\n add_header Cache-Control
+ \"max-age=604800\";\n try_files $uri =404;\n }\n location /.well-known/openpgpkey/nordgedanken.dev/hu/p6d5q6ozbrkcy3cnexq8s8uzh1rk9fbs
+ {\n add_header Content-Type \"application/octet-stream; charset=utf-8\";\n add_header Cache-Control
+ \"max-age=604800\";\n try_files $uri =404;\n }\n location /.well-known/openpgpkey/policy {\n return
+ 200 \"\";\n add_header Content-Type text/plain;\n }\n location / {\n return 200 \"OK\\n\";\n add_header
+ Content-Type text/plain;\n }\n\n # Tell synapse to not look for a matrix server here\n location /.well-known/matrix/server
+ {\n return 410;\n }\n location /_matrix {\n return 410;\n }\n\n # Health check endpoint\n
+ \ location /health {\n access_log off;\n return 200 \"healthy\\n\";\n add_header Content-Type
+ text/plain;\n }\n\n # Disable server tokens\n server_tokens off;\n}\n"
---
apiVersion: v1
kind: Service
@@ -170,8 +131,8 @@ spec:
- openpgpkey.nordgedanken.dev
rules:
- backendRefs:
- - name: wkd-server
- port: 8080
+ - name: wkd-server
+ port: 8080
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
