helmfile/users/helmfile.yaml

repositories:
- name: ingress-nginx
  url: https://kubernetes.github.io/ingress-nginx
- name: bitnami
  url: https://charts.bitnami.com/bitnami

helmDefaults:
  tillerless: true
  waitForJobs: false

releases:
# - name: vpn-mesh-config
#   chart: ../../charts/vpn-mesh-config
#   namespace: {{ .Values.id }}-ingress-private
#   createNamespace: true
#   values:
#   - certificateAuthority:
#       name: {{ .Values.id }}
#       secretName: ca-{{ .Values.id }}-cert
#   - lighthouse:
#       internalIP: 111.0.0.1
#       externalIP: 46.49.35.44
#       port: "4243"
# - name: ingress-private
#   chart: ingress-nginx/ingress-nginx
#   version: 4.0.3
#   namespace: {{ .Values.id }}-ingress-private
#   createNamespace: true
#   values:
#   - fullnameOverride: nginx
#   - controller:
#       service:
#         type: ClusterIP
#       ingressClassByName: true
#       ingressClassResource:
#         name: {{ .Values.id }}-ingress-private
#         enabled: true
#         default: false
#         controllerValue: k8s.io/{{ .Values.id }}-ingress-private
#       extraArgs:
#         default-ssl-certificate: "{{ .Values.id }}-ingress-private/cert-wildcard.p.{{ .Values.domain }}"
#       extraVolumes:
#       - name: lighthouse-cert
#         secret:
#           secretName: node-lighthouse-cert
#       - name: config
#         configMap:
#           name: lighthouse-config
#       extraContainers:
#       - name: lighthouse
#         image: giolekva/nebula:latest
#         imagePullPolicy: IfNotPresent
#         securityContext:
#           privileged: true
#           capabilities:
#             add:
#             - NET_ADMIN
#         ports:
#         - name: nebula
#           containerPort: 4243
#           protocol: UDP
#         command:
#         - nebula
#         - --config=/etc/nebula/config/lighthouse.yaml
#         volumeMounts:
#         - name: lighthouse-cert
#           mountPath: /etc/nebula/lighthouse
#         - name: config
#           mountPath: /etc/nebula/config
#       config:
#         bind-address: 111.0.0.1
#         proxy-body-size: 0
#       udp:
#       - 53: {{ .Values.id }}-app-pihole/pihole-dns-udp:53
#       tcp:
#       - 53: {{ .Values.id }}-app-pihole/pihole-dns-tcp:53
# - name: certificate-issuer
#   chart: ../../charts/certificate-issuer
#   namespace: {{ .Values.certManagerNamespace }} # {{ .Values.id }}-ingress-private
#   createNamespace: true
#   values:
#   - public:
#       name: {{ .Values.id }}-public
#       server: https://acme-v02.api.letsencrypt.org/directory
#       stagingServer: https://acme-staging-v02.api.letsencrypt.org/directory
#       contactEmail: {{ .Values.contactEmail }}
#       ingressClass: nginx
#   - private:
#       name: {{ .Values.id }}-private
#       domain: {{ .Values.id }}
#       ingressClassName: {{ .Values.id }}-ingress-private
# - name: core-auth-storage  # TODO(giolekva): merge with core-auth
#   chart: bitnami/postgresql
#   version: 10.13.5
#   namespace: {{ .Values.id }}-core-auth
#   createNamespace: true
#   values:
#   - fullnameOverride: postgres
#   - image:
#       repository: arm64v8/postgres
#       tag: 13.4
#   - service:
#       type: ClusterIP
#       port: 5432
#   - postgresqlPassword: psswd
#   - postgresqlDatabase: kratos
#   - persistence:
#       size: 1Gi
#   - securityContext:
#       enabled: true
#       fsGroup: 0
#   - containerSecurityContext:
#       enabled: true
#       runAsUser: 0
#   - volumePermissions:
#       securityContext:
#         runAsUser: 0
# - name: core-auth
#   chart: ../../charts/auth
#   namespace: {{ .Values.id }}-core-auth
#   createNamespace: true
#   values:
#   - kratos:
#       fullnameOverride: kratos
#       image:
#         repository: giolekva/ory-kratos
#         tag: latest
#         pullPolicy: Always
#       service:
#         admin:
#           enabled: true
#           type: ClusterIP
#           port: 80
#           name: http
#         public:
#           enabled: true
#           type: ClusterIP
#           port: 80
#           name: http
#       ingress:
#         admin:
#           enabled: true
#           className: {{ .Values.id }}-ingress-private
#           hosts:
#           - host: kratos.{{ .Values.id }}
#             paths:
#             - path: /
#               pathType: Prefix
#           annotations:
#             cert-manager.io/cluster-issuer: "{{ .Values.id }}-private"
#             acme.cert-manager.io/http01-edit-in-place: "true"
#           tls:
#           - hosts:
#             - kratos.{{ .Values.id }}
#             secretName: cert-kratos.{{ .Values.id }}
#         public:
#           enabled: true
#           className: nginx
#           hosts:
#           - host: accounts.{{ .Values.domain }}
#             paths:
#             - path: /
#               pathType: Prefix
#           annotations:
#             cert-manager.io/cluster-issuer: "{{ .Values.id }}-public"
#             acme.cert-manager.io/http01-edit-in-place: "true"
#           tls:
#           - hosts:
#             - accounts.{{ .Values.domain }}
#             # secretName: cert-accounts.{{ .Values.domain }}
#             secretName: cert-wildcard.{{ .Values.domain }}
#       secret:
#         enabled: true
#       kratos:
#         autoMigrate: true
#         development: false
#         config:
#           version: v0.7.1-alpha.1
#           dsn: postgres://postgres:psswd@postgres:5432/kratos?sslmode=disable&max_conns=20&max_idle_conns=4
#           serve:
#             public:
#               base_url: https://accounts.{{ .Values.domain }}
#               cors:
#                 enabled: true
#                 debug: false
#                 allow_credentials: true
#                 allowed_origins:
#                 - https://{{ .Values.domain }}
#                 - https://*.{{ .Values.domain }}
#             admin:
#               base_url: https://kratos.{{ .Values.id }}/
#           selfservice:
#             default_browser_return_url: https://accounts-ui.{{ .Values.domain }}
#             whitelisted_return_urls:
#               - https://accounts-ui.{{ .Values.domain }}
#             methods:
#               password:
#                 enabled: true
#             flows:
#               error:
#                 ui_url: https://accounts-ui.{{ .Values.domain }}/error
#               settings:
#                 ui_url: https://accounts-ui.{{ .Values.domain }}/settings
#                 privileged_session_max_age: 15m
#               recovery:
#                 enabled: false
#               verification:
#                 enabled: false
#               logout:
#                 after:
#                   default_browser_return_url: https://accounts-ui.{{ .Values.domain }}/login
#               login:
#                 ui_url: https://accounts-ui.{{ .Values.domain }}/login
#                 lifespan: 10m
#                 after:
#                   password:
#                     default_browser_return_url: https://accounts-ui.{{ .Values.domain }}/
#               registration:
#                 lifespan: 10m
#                 ui_url: https://accounts-ui.{{ .Values.domain }}/registration
#                 after:
#                   password:
#                     hooks:
#                       -
#                         hook: session
#                     default_browser_return_url: https://accounts-ui.{{ .Values.domain }}/
#           log:
#             level: debug
#             format: text
#             leak_sensitive_values: true
#           cookies:
#             path: /
#             same_site: None
#             domain: {{ .Values.domain }}
#           secrets:
#             cookie:
#               - PLEASE-CHANGE-ME-I-AM-VERY-INSECURE
#             # cipher:
#             #   - 32-LONG-SECRET-NOT-SECURE-AT-ALL
#           # ciphers:
#           #   algorithm: xchacha20-poly1305
#           hashers:
#             argon2:
#               parallelism: 1
#               memory: 128MB
#               iterations: 2
#               salt_length: 16
#               key_length: 16
#           identity:
#             default_schema_url: file:///etc/config/identity.schema.json
#           courier:
#             smtp:
#               connection_uri: smtps://test-z1VmkYfYPjgdPRgPFgmeZ31esT9rUgS%40{{ .Values.domain }}:iW%213Kk%5EPPLFrZa%24%21bbpTPN9Wv3b8mvwS6ZJvMLtce%23A2%2A4MotD@mx1.{{ .Values.domain }}
#         identitySchemas:
#           "identity.schema.json": |
#             {
#               "$id": "https://schemas.ory.sh/presets/kratos/quickstart/email-password/identity.schema.json",
#               "$schema": "http://json-schema.org/draft-07/schema#",
#               "title": "User",
#               "type": "object",
#               "properties": {
#                 "traits": {
#                   "type": "object",
#                   "properties": {
#                     "username": {
#                       "type": "string",
#                       "format": "username",
#                       "title": "Username",
#                       "minLength": 3,
#                       "ory.sh/kratos": {
#                         "credentials": {
#                           "password": {
#                             "identifier": true
#                           }
#                         }
#                       }
#                     }
#                   },
#                   "additionalProperties": false
#                 }
#               }
#             }
#   - hydra:
#       fullnameOverride: hydra
#       image:
#         repository: giolekva/ory-hydra
#         tag: latest
#         pullPolicy: Always
#       service:
#         admin:
#           enabled: true
#           type: ClusterIP
#           port: 80
#           name: http
#         public:
#           enabled: true
#           type: ClusterIP
#           port: 80
#           name: http
#       ingress:
#         admin:
#           enabled: true
#           className: {{ .Values.id }}-ingress-private
#           hosts:
#           - host: hydra.{{ .Values.id }}
#             paths:
#             - path: /
#               pathType: Prefix
#           annotations:
#             cert-manager.io/cluster-issuer: "{{ .Values.id }}-private"
#             acme.cert-manager.io/http01-edit-in-place: "true"
#           tls:
#           - hosts:
#             - hydra.{{ .Values.id }}
#             secretName: cert-hydra.{{ .Values.id }}
#         public:
#           enabled: true
#           className: nginx
#           hosts:
#           - host: hydra.{{ .Values.domain }}
#             paths:
#             - path: /
#               pathType: Prefix
#           annotations:
#             cert-manager.io/cluster-issuer: "{{ .Values.id }}-public"
#             acme.cert-manager.io/http01-edit-in-place: "true"
#           tls:
#           - hosts:
#             - hydra.{{ .Values.domain }}
#             # secretName: cert-hydra.{{ .Values.domain }}
#             secretName: cert-wildcard.{{ .Values.domain }}
#       secret:
#         enabled: true
#       maester:
#         enabled: true
#         hydraFullnameOverride: hydra
#       hydra-maester:
#         image:
#           repository: giolekva/ory-hydra-maester
#           tag: latest
#           pullPolicy: IfNotPresent
#         adminService:
#           name: hydra
#           port: 80
#       hydra:
#         autoMigrate: true
#         config:
#           version: v1.10.6
#           dsn: postgres://postgres:psswd@postgres:5432/kratos?sslmode=disable&max_conns=20&max_idle_conns=4
#           serve:
#             cookies:
#               same_site_mode: None
#             public:
#               cors:
#                 enabled: true
#                 debug: false
#                 allow_credentials: true
#                 allowed_origins:
#                   - https://{{ .Values.domain }}
#                   - https://*.{{ .Values.domain }}
#             admin:
#               # host: localhost
#               cors:
#                 allowed_origins:
#                   - https://hydra.{{ .Values.id }}
#               tls:
#                 allow_termination_from:
#                   - 0.0.0.0/0
#                   - 10.42.0.0/16
#                   - 10.43.0.0/16
#                   - 111.0.0.1/32
#             tls:
#               allow_termination_from:
#                 - 0.0.0.0/0
#                 - 10.42.0.0/16
#                 - 10.43.0.0/16
#                 - 111.0.0.1/32
#           urls:
#             self:
#               public: https://hydra.{{ .Values.domain }}
#               issuer: https://hydra.{{ .Values.domain }}
#             consent: https://accounts-ui.{{ .Values.domain }}/consent
#             login: https://accounts-ui.{{ .Values.domain }}/login
#             logout: https://accounts-ui.{{ .Values.domain }}/logout
#           secrets:
#             system:
#               - youReallyNeedToChangeThis
#           oidc:
#             subject_identifiers:
#               supported_types:
#                 - pairwise
#                 - public
#               pairwise:
#                 salt: youReallyNeedToChangeThis
#           log:
#             level: trace
#             leak_sensitive_values: false
#   - ui:
#       certificateIssuer: {{ .Values.id }}-public
#       ingressClassName: nginx
#       domain: {{ .Values.domain }}
#       internalDomain: {{ .Values.id }}
#       nebula:
#         lighthouse:
#           name: ui-lighthouse
#           internalIP: 111.0.0.1
#           externalIP: 46.49.35.44
#           port: "4243"
#         node:
#           name: ui
#           ipCidr: 111.0.0.2/24
#           secretName: node-ui-cert
#         certificateAuthority:
#           name: {{ .Values.id }}
#           namespace: {{ .Values.id }}-ingress-private
# - name: vaultwarden
#   chart: ../../charts/vaultwarden
#   namespace: {{ .Values.id }}-app-vaultwarden
#   createNamespace: true
#   values:
#   - image:
#       repository: vaultwarden/server
#       tag: 1.22.2
#       pullPolicy: IfNotPresent
#   - storage:
#       size: 1Gi
#   - domain: bitwarden.{{ .Values.id }}
#   - certificateIssuer: {{ .Values.id }}-private
#   - ingressClassName: {{ .Values.id }}-ingress-private
# - name: matrix-storage  # TODO(giolekva): merge with core-auth
#   chart: bitnami/postgresql
#   version: 10.13.5
#   namespace: {{ .Values.id }}-app-matrix
#   createNamespace: true
#   values:
#   - fullnameOverride: postgres
#   - image:
#       repository: arm64v8/postgres
#       tag: 13.4
#   - service:
#       type: ClusterIP
#       port: 5432
#   - postgresqlPassword: psswd
#   - initdbScripts:
#       createdb.sh: |
#         #!/bin/sh
#         createdb -U postgres --encoding=UTF8 --locale=C --template=template0 --owner=postgres matrix
#   - persistence:
#       size: 1Gi
#   - securityContext:
#       enabled: true
#       fsGroup: 0
#   - containerSecurityContext:
#       enabled: true
#       runAsUser: 0
#   - volumePermissions:
#       securityContext:
#         runAsUser: 0
# - name: matrix
#   chart: ../../charts/matrix
#   namespace: {{ .Values.id }}-app-matrix
#   createNamespace: true
#   values:
#   - domain: {{ .Values.domain }}
#   - oauth2:
#       hydraAdmin: http://hydra-admin
#       hydraPublic: https://hydra.{{ .Values.domain }}
#       clientId: matrix
#       clientSecret: ""
#       secretName: oauth2-client
#   - postgresql:
#       host: postgres
#       port: 5432
#       database: matrix
#       user: postgres
#       password: psswd
#   - certificateIssuer: {{ .Values.id }}-public
#   - ingressClassName: nginx
#   - configMerge:
#       configName: config-to-merge
#       fileName: to-merge.yaml
- name: pihole
  chart: ../../charts/pihole
  namespace: {{ .Values.id }}-app-pihole
  createNamespace: true
  values:
  - domain: {{ .Values.domain }}
  - pihole:
      image:
        repository: "pihole/pihole"
        tag: v5.8.1
      persistentVolumeClaim:
        enabled: true
        size: 5Gi
      adminPassword: "admin"
      ingress:
        enabled: false
      serviceDhcp:
        enabled: false
      serviceDns:
        type: ClusterIP
      serviceWeb:
        type: ClusterIP
        http:
          enabled: true
        https:
          enabled: false
      virtualHost: pihole.p.{{ .Values.domain }}
      resources:
        requests:
          cpu: "250m"
          memory: "100M"
        limits:
          cpu: "500m"
          memory: "250M"
  - oauth2:
      clientId: pihole
      clientSecret: ""
      secretName: oauth2-secret
      configName: oauth2-proxy
      hydraAdmin: http://hydra-admin
  - hydraPublic: https://hydra.{{ .Values.domain }}/
  - profileUrl: https://accounts-ui.{{ .Values.domain }}
  - certificateIssuer: {{ .Values.id }}-private
  - ingressClassName: {{ .Values.id }}-ingress-private

environments:
  shveli:
    values:
    - id: shveli
    - domain: shve.li
    - contactEmail: giolekva@gmail.com
    - certManagerNamespace: cert-manager