diff --git a/k8s/argo-apps/lldap.yaml b/k8s/argo-apps/lldap.yaml new file mode 100644 index 0000000..173a5d1 --- /dev/null +++ b/k8s/argo-apps/lldap.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: lldap + namespace: argo-cd +spec: + destination: + name: '' + namespace: apps-fuku + server: https://kubernetes.default.svc + sources: + - repoURL: https://git.roboces.dev/catalin/fukuops.git + path: k8s/charts/lldap + targetRevision: feat/lldap + project: fuku + syncPolicy: + automated: {} diff --git a/k8s/charts/lldap/Chart.yaml b/k8s/charts/lldap/Chart.yaml new file mode 100644 index 0000000..40fbda7 --- /dev/null +++ b/k8s/charts/lldap/Chart.yaml @@ -0,0 +1,8 @@ +apiVersion: v2 +name: lldap +description: A Helm chart for LLDAP - Light LDAP implementation for authentication +type: application +version: 0.1.0 +appVersion: v0.6.1 +annotations: + artifacthub.io/images: "- name: lldap\n image: nitnelave/lldap:v0.6.1-alpine\n" diff --git a/k8s/charts/lldap/templates/_helpers.tpl b/k8s/charts/lldap/templates/_helpers.tpl new file mode 100644 index 0000000..1f47629 --- /dev/null +++ b/k8s/charts/lldap/templates/_helpers.tpl @@ -0,0 +1,60 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "lldap.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +*/}} +{{- define "lldap.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "lldap.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "lldap.labels" -}} +helm.sh/chart: {{ include "lldap.chart" . }} +{{ include "lldap.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "lldap.selectorLabels" -}} +app.kubernetes.io/name: {{ include "lldap.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Service account name +*/}} +{{- define "lldap.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "lldap.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/k8s/charts/lldap/templates/deployment.yaml b/k8s/charts/lldap/templates/deployment.yaml new file mode 100644 index 0000000..3335c9c --- /dev/null +++ b/k8s/charts/lldap/templates/deployment.yaml @@ -0,0 +1,102 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "lldap.fullname" . }} + labels: + {{- include "lldap.labels" . | nindent 4 }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + {{- include "lldap.selectorLabels" . | nindent 6 }} + strategy: + type: Recreate + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "lldap.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + env: + - name: GID + value: {{ .Values.env.GID | quote }} + - name: UID + value: {{ .Values.env.UID | quote }} + - name: TZ + value: {{ .Values.env.TZ }} + - name: LLDAP_JWT_SECRET + valueFrom: + secretKeyRef: + name: {{ .Values.secret.existingSecretName }} + key: lldap-jwt-secret + - name: LLDAP_LDAP_BASE_DN + valueFrom: + secretKeyRef: + name: {{ .Values.secret.existingSecretName }} + key: base-dn + - name: LLDAP_LDAP_USER_DN + valueFrom: + secretKeyRef: + name: {{ .Values.secret.existingSecretName }} + key: lldap-ldap-user-name + - name: LLDAP_LDAP_USER_PASS + valueFrom: + secretKeyRef: + name: {{ .Values.secret.existingSecretName }} + key: lldap-ldap-user-pass + - name: LLDAP_KEY_SEED + valueFrom: + secretKeyRef: + name: {{ .Values.secret.existingSecretName }} + key: lldap-key-seed + ports: + - name: ldap + containerPort: {{ .Values.service.ldapPort }} + protocol: TCP + - name: web + containerPort: {{ .Values.service.webPort }} + protocol: TCP + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + - name: data + mountPath: /data + volumes: + - name: data + {{- if .Values.persistence.existingClaim }} + persistentVolumeClaim: + claimName: {{ .Values.persistence.existingClaim }} + {{- else }} + persistentVolumeClaim: + claimName: {{ include "lldap.fullname" . }}-data + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + automountServiceAccountToken: false diff --git a/k8s/charts/lldap/templates/ingress.yaml b/k8s/charts/lldap/templates/ingress.yaml new file mode 100644 index 0000000..bc5e9d1 --- /dev/null +++ b/k8s/charts/lldap/templates/ingress.yaml @@ -0,0 +1,39 @@ +{{- if .Values.ingress.enabled }} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "lldap.fullname" . }} + labels: + {{- include "lldap.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + ingressClassName: {{ .Values.ingress.className }} + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + pathType: {{ .pathType }} + backend: + service: + name: {{ include "lldap.fullname" $ }} + port: + number: {{ $.Values.service.webPort }} + {{- end }} + {{- end }} +{{- end }} diff --git a/k8s/charts/lldap/templates/pvc.yaml b/k8s/charts/lldap/templates/pvc.yaml new file mode 100644 index 0000000..6c1ce16 --- /dev/null +++ b/k8s/charts/lldap/templates/pvc.yaml @@ -0,0 +1,21 @@ +{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ include "lldap.fullname" . }}-data + labels: + {{- include "lldap.labels" . | nindent 4 }} +spec: + accessModes: + - {{ .Values.persistence.accessMode }} + {{- if .Values.persistence.storageClass }} + {{- if eq "-" .Values.persistence.storageClass }} + storageClassName: "" + {{- else }} + storageClassName: {{ .Values.persistence.storageClass | quote }} + {{- end }} + {{- end }} + resources: + requests: + storage: {{ .Values.persistence.size }} +{{- end }} diff --git a/k8s/charts/lldap/templates/service.yaml b/k8s/charts/lldap/templates/service.yaml new file mode 100644 index 0000000..1d061fb --- /dev/null +++ b/k8s/charts/lldap/templates/service.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "lldap.fullname" . }} + labels: + {{- include "lldap.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.ldapPort }} + targetPort: ldap + protocol: TCP + name: ldap + - port: {{ .Values.service.webPort }} + targetPort: web + protocol: TCP + name: web + selector: + {{- include "lldap.selectorLabels" . | nindent 4 }} diff --git a/k8s/charts/lldap/values.yaml b/k8s/charts/lldap/values.yaml new file mode 100644 index 0000000..2be4e78 --- /dev/null +++ b/k8s/charts/lldap/values.yaml @@ -0,0 +1,61 @@ +# Configuration for lldap chart +replicaCount: 1 + +image: + repository: nitnelave/lldap + pullPolicy: IfNotPresent + tag: v0.6.1-alpine + +imagePullSecrets: [] +podAnnotations: {} +podSecurityContext: {} +securityContext: {} + +service: + type: ClusterIP + ldapPort: 3890 + webPort: 17170 + +ingress: + enabled: true + className: traefik + annotations: + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" + hosts: + - host: ldap.fuku + paths: + - path: / + pathType: Prefix + tls: [] + +persistence: + enabled: true + storageClass: truenas-nfs-csi + accessMode: ReadWriteMany + size: 1Gi + existingClaim: "" + +autoscaling: + enabled: false + +resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 500m + memory: 512Mi + +env: + TZ: Europe/Bucharest + GID: "1001" + UID: "1001" + +secret: + enabled: true + existingSecretName: lldap-credentials + +nodeSelector: {} +tolerations: [] +affinity: {} diff --git a/k8s/services/argo/project-fuku.yaml b/k8s/services/argo/project-fuku.yaml index adfc1a7..3ff07db 100644 --- a/k8s/services/argo/project-fuku.yaml +++ b/k8s/services/argo/project-fuku.yaml @@ -38,3 +38,4 @@ spec: - https://harish2k01.github.io/helm-charts/ - git.roboces.dev/catalin/fukuops - git.roboces.dev/catalin + - oci://git.roboces.dev/catalin/fukuops diff --git a/tofu/adguard/main.tf b/tofu/adguard/main.tf index 803522b..f206fae 100644 --- a/tofu/adguard/main.tf +++ b/tofu/adguard/main.tf @@ -122,3 +122,8 @@ resource "adguard_rewrite" "dns" { domain = "dns.fuku" answer = "192.168.1.12" } + +resource "adguard_rewrite" "lldap" { + domain = "ldap.fuku" + answer = "192.168.1.12" +}