From 99afc0ca05f3c3fffafc5fa48c20ec0486a8080e Mon Sep 17 00:00:00 2001 From: j Date: Thu, 14 Aug 2025 00:39:59 +1000 Subject: [PATCH] Move namespacing around. Add DNS & LE. Add authentik. --- applications/20-domain-names/bind.yaml | 139 ++++++++++++++++++ applications/20-domain-names/certmanager.yaml | 76 ++++++++++ applications/20-domain-names/externaldns.yaml | 78 ++++++++++ .../databases.yaml | 0 .../mariadb-database/database.yaml | 0 .../mariadb-operators/mariadb-operators.yaml | 0 applications/40-authentik/authentik.yaml | 38 +++++ deploy/server.yaml | 14 +- 8 files changed, 343 insertions(+), 2 deletions(-) create mode 100644 applications/20-domain-names/bind.yaml create mode 100644 applications/20-domain-names/certmanager.yaml create mode 100644 applications/20-domain-names/externaldns.yaml rename applications/{20-databases => 30-databases}/databases.yaml (100%) rename applications/{20-databases => 30-databases}/mariadb-database/database.yaml (100%) rename applications/{20-databases => 30-databases}/mariadb-operators/mariadb-operators.yaml (100%) create mode 100644 applications/40-authentik/authentik.yaml diff --git a/applications/20-domain-names/bind.yaml b/applications/20-domain-names/bind.yaml new file mode 100644 index 0000000..c44f7d5 --- /dev/null +++ b/applications/20-domain-names/bind.yaml @@ -0,0 +1,139 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: bind-master-config + namespace: home-server +data: + named.conf: | + include "/etc/bind/externaldns-key.conf"; + + options { + directory "/var/cache/bind"; + + recursion yes; + allow-query { any; }; + + listen-on port 53 { any; }; + listen-on-v6 port 53 { any; }; + + forwarders { + 10.40.0.254; + }; + + dnssec-validation auto; + }; + + zone "." IN { + type hint; + file "/usr/share/dns/root.hints"; + }; + + zone "hxme.net." IN { + type master; + file "/etc/bind/db.hxme.net"; + allow-update { key "externaldns-key"; }; + }; + db.hxme.net: | + $TTL 3600 + @ IN SOA ns1.hxme.net. admin.hxme.net. ( + 1 ; Serial + 7200 ; Refresh + 1800 ; Retry + 1209600 ; Expire + 86400 ) ; Negative Cache TTL + ; + @ IN NS ns1.hxme.net. + ns1 IN A 10.40.0.110 + @ IN A 10.40.0.110 + www IN A 10.40.0.110 +--- +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: bind-master + namespace: home-server +spec: + selector: + matchLabels: + app: bind-master + template: + metadata: + labels: + app: bind-master + spec: + hostNetwork: true + dnsPolicy: ClusterFirstWithHostNet + securityContext: + fsGroup: 999 + initContainers: + - name: fetch-root-hints + image: debian:12 + command: + - sh + - -c + - | + apt update && apt -y install curl + curl -sfSL https://www.internic.net/domain/named.cache -o /usr/share/dns/root.hints + volumeMounts: + - mountPath: /usr/share/dns + name: root-hints + containers: + - name: bind-master + image: internetsystemsconsortium/bind9:9.18 + command: ["named", "-g", "-c", "/etc/bind/named.conf"] + ports: + - containerPort: 53 + protocol: UDP + - containerPort: 53 + protocol: TCP + volumeMounts: + - name: config + mountPath: /etc/bind/named.conf + subPath: named.conf + - name: config + mountPath: /etc/bind/db.hxme.net + subPath: db.hxme.net + - name: dns-secrets + mountPath: /etc/bind/externaldns-key.conf + subPath: externaldns-key.conf + - name: bind-cache + mountPath: /var/cache/bind + - name: bind-rundir + mountPath: /var/run/named + - name: root-hints + mountPath: /usr/share/dns + volumes: + - name: dns-secrets + secret: + secretName: dns-secrets + - name: config + configMap: + name: bind-master-config + - name: bind-cache + emptyDir: {} + - name: bind-rundir + emptyDir: {} + - name: root-hints + emptyDir: {} + +--- +apiVersion: v1 +kind: Service +metadata: + name: bind-master + namespace: home-server +spec: + selector: + app: bind-master + ports: + - name: dns-udp + port: 53 + protocol: UDP + targetPort: 53 + - name: dns-tcp + port: 53 + protocol: TCP + targetPort: 53 + + diff --git a/applications/20-domain-names/certmanager.yaml b/applications/20-domain-names/certmanager.yaml new file mode 100644 index 0000000..83befe8 --- /dev/null +++ b/applications/20-domain-names/certmanager.yaml @@ -0,0 +1,76 @@ +--- +# 1. cert-manager Helm chart +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cert-manager + namespace: argocd +spec: + project: default + source: + repoURL: "https://charts.jetstack.io" + chart: "cert-manager" + targetRevision: "v1.18.2" + helm: + releaseName: "cert-manager" + values: | + installCRDs: true + extraArgs: + - --dns01-recursive-nameservers-only + - --dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53 + destination: + server: "https://kubernetes.default.svc" + namespace: home-server + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ApplyOutOfSyncOnly=true + - SkipHooks=false + - SyncWave=0 # ensure cert-manager is installed first + +--- +# 2. ClusterIssuer +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-rfc2136 +spec: + acme: + email: admin@hxme.net + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-rfc2136 + solvers: + - dns01: + rfc2136: + nameserver: hawke.hxst.com.au:53 + tsigKeyName: "hxme-update-key" + tsigAlgorithm: HMACSHA512 + tsigSecretSecretRef: + name: hxme-update-key + key: hxme-update-key + +--- +# 3. Certificate +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: wildcard-hxme-net + namespace: home-server +spec: + secretName: wildcard-hxme-net + secretTemplate: + annotations: + replicator.v1.mittwald.de/replication-allowed: "true" + replicator.v1.mittwald.de/replicate-to: "home-media" + issuerRef: + name: letsencrypt-rfc2136 + kind: ClusterIssuer + commonName: "hxme.net" + dnsNames: + - "hxme.net" + - "*.hxme.net" + diff --git a/applications/20-domain-names/externaldns.yaml b/applications/20-domain-names/externaldns.yaml new file mode 100644 index 0000000..c3a9736 --- /dev/null +++ b/applications/20-domain-names/externaldns.yaml @@ -0,0 +1,78 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: external-dns +rules: + - apiGroups: [""] + resources: ["services","endpoints","pods"] + verbs: ["get","watch","list"] + - apiGroups: ["extensions","networking.k8s.io"] + resources: ["ingresses"] + verbs: ["get","watch","list"] + - apiGroups: [""] + resources: ["nodes"] + verbs: ["list","watch"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices"] + verbs: ["get", "watch", "list"] + # Add DNS provider specific rules here if needed (e.g., for AWS IAM, GCP etc.) +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: external-dns-viewer +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: external-dns +subjects: + - kind: ServiceAccount + name: external-dns + namespace: home-server +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: external-dns + namespace: home-server +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: external-dns + namespace: home-server +spec: + replicas: 1 + selector: + matchLabels: + app: external-dns + template: + metadata: + labels: + app: external-dns + spec: + serviceAccountName: external-dns + containers: + - name: external-dns + image: bitnami/external-dns:latest + args: + - --source=service + - --source=ingress + - --provider=rfc2136 + - --rfc2136-host=bind-master.home-server.svc.cluster.local + - --rfc2136-port=53 + - --rfc2136-zone=hxme.net + - --rfc2136-tsig-secret=$(RFC2136_TSIG_SECRET) + - --rfc2136-tsig-secret-alg=hmac-sha256 + - --rfc2136-tsig-keyname=externaldns-key + - --policy=sync + - --registry=txt + - --txt-owner-id=my-cluster + env: + - name: RFC2136_TSIG_SECRET + valueFrom: + secretKeyRef: + name: dns-secrets + key: externaldns-secret + diff --git a/applications/20-databases/databases.yaml b/applications/30-databases/databases.yaml similarity index 100% rename from applications/20-databases/databases.yaml rename to applications/30-databases/databases.yaml diff --git a/applications/20-databases/mariadb-database/database.yaml b/applications/30-databases/mariadb-database/database.yaml similarity index 100% rename from applications/20-databases/mariadb-database/database.yaml rename to applications/30-databases/mariadb-database/database.yaml diff --git a/applications/20-databases/mariadb-operators/mariadb-operators.yaml b/applications/30-databases/mariadb-operators/mariadb-operators.yaml similarity index 100% rename from applications/20-databases/mariadb-operators/mariadb-operators.yaml rename to applications/30-databases/mariadb-operators/mariadb-operators.yaml diff --git a/applications/40-authentik/authentik.yaml b/applications/40-authentik/authentik.yaml new file mode 100644 index 0000000..c4871ce --- /dev/null +++ b/applications/40-authentik/authentik.yaml @@ -0,0 +1,38 @@ +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: authentik + namespace: argocd +spec: + project: default + source: + repoURL: "https://charts.goauthentik.io/" + chart: "authentik" + targetRevision: "2024.4.2" + helm: + releaseName: "authentik" + values: | + postgresql: + enabled: false + server: + ingress: + annotations: + external-dns.alpha.kubernetes.io/hostname: auth.hxme.net + tls: + - secretName: wildcard-hxme-net + hosts: + - auth.hxme.net + valueFiles: [] + valuesFrom: + - kind: Secret + name: authentik-values + destination: + server: "https://kubernetes.default.svc" + namespace: home-server + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/deploy/server.yaml b/deploy/server.yaml index 2457b37..95d9513 100644 --- a/deploy/server.yaml +++ b/deploy/server.yaml @@ -14,11 +14,21 @@ spec: namespace: home-server wave: 1 - - name: databases - path: applications/20-databases + - name: domain-names + path: applications/20-domain-names namespace: home-server wave: 1 + - name: databases + path: applications/30-databases + namespace: home-server + wave: 2 + + - name: authentik + path: applications/40-authentik + namespace: home-server + wave: 3 + template: metadata: name: "{{.name}}"