Add authentik

applications/20-databases/mariadb.yaml

@@ -1,5 +1,4 @@
 ---
-# 1. MariaDB Operator CRDs
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -27,7 +26,6 @@ spec:
       - SyncWave=0  # ensure this is applied first
 
 ---
-# 2. MariaDB Operator
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -53,4 +51,3 @@ spec:
       - ApplyOutOfSyncOnly=true
       - SkipHooks=false
       - SyncWave=1  # ensure this waits for mariadb-operator-crds
-

applications/40-database/mariadb.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: MariaDB
+metadata:
+  name: mariadb
+  namespace: database
+spec:
+  rootPasswordSecretKeyRef:
+    name: db-secrets
+    key:  db-root-password
+
+  storage:
+    size: 5Gi

applications/50-authentik/authentik.yaml

@@ -0,0 +1,39 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: authentik
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: "https://charts.goauthentik.io/"
+    chart: "authentik"
+    targetRevision: "2024.4.2"
+    helm:
+      releaseName: "authentik"
+      values: |
+        postgresql:
+          enabled: false
+        server:
+          ingress:
+            annotations:
+              external-dns.alpha.kubernetes.io/hostname: auth.hxme.net
+            tls:
+              - secretName: wildcard-hxme-net
+                hosts:
+                  - auth.hxme.net
+      valueFiles: []
+      valuesFrom:
+        - kind: Secret
+          name: authentik-values
+  destination:
+    server: "https://kubernetes.default.svc"
+    namespace: home-server
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+

applications/50-nextcloud/nextcloud.yaml

@@ -0,0 +1,134 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nextcloud-pv
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: local-path
+  hostPath:
+    path: /dpool/services/nextcloud/data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-pvc
+  namespace: home-server
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-path 
+  resources:
+    requests:
+      storage: 10Gi
+  volumeName: nextcloud-pv
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud
+  namespace: home-server
+spec:
+  ports:
+    - port: 80
+  selector:
+    app: nextcloud
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nextcloud
+  namespace: home-server
+spec:
+  securityContext:
+    runAsUser:  1000
+    runAsGroup: 1000
+    fsGroup:    1000
+  selector:
+    matchLabels:
+      app: nextcloud
+  template:
+    metadata:
+      labels:
+        app: nextcloud
+    spec:
+      containers:
+        - name: nextcloud
+          image: nextcloud:29
+          env:
+            - name: MYSQL_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: nextcloud-secrets
+                  key: MYSQL_PASSWORD
+            - name: MYSQL_DATABASE
+              value: nextcloud
+            - name: MYSQL_USER
+              value: nextcloud
+            - name: MYSQL_HOST
+              value: nextcloud-db
+          ports:
+            - containerPort: 80
+          volumeMounts:
+            - name: nextcloud-data
+              mountPath: /var/www/html
+          securityContext:
+            runAsUser:  1000
+            runAsGroup: 1000
+            fsGroup:    1000
+      volumes:
+        - name: nextcloud-data
+          persistentVolumeClaim:
+            claimName: nextcloud-pvc
+
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nextcloud
+  namespace: home-server
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: nc.hxme.net
+    nginx.ingress.kubernetes.io/server-snippet: |
+      add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+spec:
+  tls:
+    - hosts:
+        - nc.hxme.net
+      secretName: wildcard-hxme-net
+  rules:
+    - host: nc.hxme.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: nextcloud
+                port:
+                  number: 80
+
+
+---
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: Grant
+metadata:
+  name: nextcloud
+  namespace: database
+spec:
+  databaseRef:
+    name: nextcloud
+  accountName: nextcloud@'%'
+  privileges:
+    - ALL
+  mariaDbRef:
+    name: mariadb
+  passwordSecretKeyRef:
+    name: nextcloud-secrets
+    key:  MYSQL_PASSWORD
+
+

deploy/server.yaml

@@ -28,6 +28,21 @@ spec:
             namespace: home-server
             wave:      2
 
+          - name:      database
+            path:      applications/40-database
+            namespace: database
+            wave:      3
+
+          - name:      authentik
+            path:      applications/50-authentik
+            namespace: home-server
+            wave:      4
+
+          - name:      nextcloud
+            path:      applications/50-nextcloud
+            namespace: home-server
+            wave:      4
+
   template:
     metadata:
       name: '{{name}}'