Merge pull request #454 from lentzi90/development

Switch jern.me to external-secrets and move nextcloud to jern.fi

.github/workflows/kustomize-build.yaml

@@ -14,7 +14,6 @@ jobs:
         - argocd/overlays/kind
         - cert-manager/overlays/kind
         - nginx-ingress/overlays/kind
-        - gitea/overlays/kind
         - nextcloud/overlays/kind
         - cloudnative-pg/overlays/kind
         - pi-hole/overlays/kind

apps/nextcloud-app.yaml

@@ -8,7 +8,7 @@ spec:
     server: https://kubernetes.default.svc
   project: default
   source:
-    path: nextcloud/overlays/jern.me
+    path: nextcloud/overlays/jern.fi
     repoURL: https://github.com/lentzi90/personal-cloud.git
     targetRevision: HEAD
   syncPolicy: {}

minio/overlays/jern.me/externalsecret.yaml

@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: minio-root-creds
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    # This name must match the metadata.name in the `SecretStore`
+    name: bitwarden-personal-cloud
+    kind: ClusterSecretStore
+  data:
+  - secretKey: MINIO_ROOT_USER
+    remoteRef:
+      key: 46fe8669-f670-484a-b458-b24c008d1b3f
+  - secretKey: MINIO_ROOT_PASSWORD
+    remoteRef:
+      key: 2df100eb-fdc0-4406-99a4-b24c008d3574

minio/overlays/jern.me/kustomization.yaml

@@ -12,9 +12,7 @@ resources:
 - ../../base
 - namespace.yaml
 - pv.yaml
+- externalsecret.yaml
 
 patches:
 - path: pvc.yaml
-
-generators:
-- minio-root-generator.yaml

nextcloud/bases/basic/deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
       - name: nextcloud
-        image: nextcloud:22.2.2-apache
+        image: nextcloud
         env:
         - name: NC_overwriteprotocol
           value: https
@@ -35,7 +35,7 @@ spec:
             port: http
             httpHeaders:
             - name: Host
-              value: nextcloud.jern.me
+              value: nextcloud.example.com
           initialDelaySeconds: 2400
           timeoutSeconds: 10
           failureThreshold: 6
@@ -45,7 +45,7 @@ spec:
             port: http
             httpHeaders:
             - name: Host
-              value: nextcloud.jern.me
+              value: nextcloud.example.com
           initialDelaySeconds: 30
           timeoutSeconds: 3
           periodSeconds: 5

nextcloud/overlays/jern.me/certificate.yaml → nextcloud/overlays/jern.fi/certificate.yaml

@@ -4,7 +4,7 @@ metadata:
   name: nextcloud-cert
 spec:
   dnsNames:
-    - nextcloud.jern.me
+  - nextcloud.jern.fi
   issuerRef:
     group: cert-manager.io
     kind: ClusterIssuer

nextcloud/overlays/jern.me/deployment.yaml → nextcloud/overlays/jern.fi/deployment.yaml

@@ -29,12 +29,12 @@ spec:
           httpGet:
             httpHeaders:
             - name: Host
-              value: nextcloud.jern.me
+              value: nextcloud.jern.fi
         readinessProbe:
           httpGet:
             httpHeaders:
             - name: Host
-              value: nextcloud.jern.me
+              value: nextcloud.jern.fi
         resources:
           requests:
             cpu: 200m

nextcloud/overlays/jern.fi/externalsecret.yaml

@@ -0,0 +1,38 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: minio-creds
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    # This name must match the metadata.name in the `SecretStore`
+    name: bitwarden-personal-cloud
+    kind: ClusterSecretStore
+  data:
+  - secretKey: USER
+    remoteRef:
+      key: e2f8b061-39b2-424a-a584-b24c0088f2f1
+  - secretKey: PASSWORD
+    remoteRef:
+      key: 0ac7b595-a1b5-494b-b973-b24c00891023
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: nextcloud-admin
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    # This name must match the metadata.name in the `SecretStore`
+    name: bitwarden-personal-cloud
+    kind: ClusterSecretStore
+  data:
+  - secretKey: NEXTCLOUD_ADMIN_USER
+    remoteRef:
+      key: bb358c4d-1645-41ac-80c9-b24c00896313
+  - secretKey: NEXTCLOUD_ADMIN_PASSWORD
+    remoteRef:
+      key: d77b580e-8dca-4881-9892-b24c008a50a9
+  - secretKey: REDIS_HOST_PASSWORD
+    remoteRef:
+      key: cb4cdfce-4324-4936-b74b-b24c008a7ef3

nextcloud/overlays/jern.me/ingress.yaml → nextcloud/overlays/jern.fi/ingress.yaml

@@ -7,21 +7,20 @@ metadata:
 spec:
   ingressClassName: nginx
   tls:
-    - secretName: nextcloud-cert
-      hosts:
-        - nextcloud.jern.me
+  - secretName: nextcloud-cert
+    hosts:
+    - nextcloud.jern.fi
   rules:
-    - host: nextcloud.jern.me
-      http:
-        paths:
-          - backend:
-              service:
-                name: nextcloud
-                port:
-                  name: http
-            path: /
-            pathType: Prefix
----
+  - host: nextcloud.jern.fi
+    http:
+      paths:
+      - backend:
+          service:
+            name: nextcloud
+            port:
+              name: http
+        path: /
+        pathType: Prefix
 # Nextcloud recommends rewriting /.wellknown/carddav and /.wellknown/caldav
 # to /remote.php/dav since some clients have trouble with this.
 # See https://docs.nextcloud.com/server/21/admin_manual/issues/general_troubleshooting.html#service-discovery
@@ -34,9 +33,9 @@ spec:
 #   tls:
 #     - secretName: nextcloud-cert
 #       hosts:
-#         - nextcloud.jern.me
+#         - nextcloud.jern.fi
 #   rules:
-#     - host: nextcloud.jern.me
+#     - host: nextcloud.jern.fi
 #       http:
 #         paths:
 #           - backend:
@@ -53,3 +52,4 @@ spec:
 #                   name: http
 #             path: /.wellknown/caldav
 #             pathType: Exact
+---

nextcloud/overlays/jern.me/kustomization.yaml → nextcloud/overlays/jern.fi/kustomization.yaml

@@ -6,7 +6,7 @@ namespace: nextcloud
 labels:
 - includeSelectors: true
   pairs:
-    environment: jern.me
+    environment: jern.fi
 
 resources:
 - ../../bases/basic
@@ -15,6 +15,7 @@ resources:
 - postgres.yaml
 - scheduled-backup.yaml
 - certificate.yaml
+- externalsecret.yaml
 
 patches:
 - path: deployment.yaml
@@ -28,10 +29,6 @@ configMapGenerator:
   - POSTGRES_DB=nextcloud
   - POSTGRES_HOST=nextcloud-database-rw
 
-generators:
-- nextcloud-admin-generator.yaml
-- minio-credentials-generator.yaml
-
 configurations:
 - config/cloudnative-pg.yaml
 

pi-hole/overlays/jern.me/externalsecret.yaml

@@ -0,0 +1,14 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: pi-hole-env
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    # This name must match the metadata.name in the `SecretStore`
+    name: bitwarden-personal-cloud
+    kind: ClusterSecretStore
+  data:
+  - secretKey: WEBPASSWORD
+    remoteRef:
+      key: e17b2830-6c61-414e-8a9d-b24c008e0608

pi-hole/overlays/jern.me/kustomization.yaml

@@ -22,6 +22,3 @@ configMapGenerator:
   - 02-interface.conf
   - 05-custom-cname.conf
   name: custom
-
-generators:
-- pi-hole-env-generator.yaml