helmfile/users/helmfile.yaml

repositories:
- name: ingress-nginx
  url: https://kubernetes.github.io/ingress-nginx
- name: bitnami
  url: https://charts.bitnami.com/bitnami

helmDefaults:
  tillerless: true
  waitForJobs: true
  createNamespace: false

releases:
- name: namespaces
  chart: ../../charts/namespaces
  namespace: {{ .Values.id }}
  createNamespace: true
  values:
  - pcloudInstanceId: {{ .Values.id }}
  - namespacePrefix: {{ .Values.namespacePrefix }}
  - namespaces:
      - app-maddy
      - app-matrix
      - app-pihole
      - app-vaultwarden
      - core-auth
      - ingress-private
- name: vpn-mesh-config
  chart: ../../charts/vpn-mesh-config
  namespace: {{ .Values.namespacePrefix }}ingress-private
  values:
  - certificateAuthority:
      name: {{ .Values.id }}
      secretName: ca-{{ .Values.id }}-cert
  - lighthouse:
      internalIP: 111.0.0.1
      externalIP: 46.49.35.44
      port: "4243"
- name: ingress-private
  chart: ingress-nginx/ingress-nginx
  version: 4.0.3
  namespace: {{ .Values.namespacePrefix }}ingress-private
  values:
  - fullnameOverride: {{ .Values.id }}-nginx-private
  - controller:
      service:
        type: ClusterIP
      ingressClassByName: true
      ingressClassResource:
        name: {{ .Values.id }}-ingress-private
        enabled: true
        default: false
        controllerValue: k8s.io/{{ .Values.id }}-ingress-private
      extraArgs:
        default-ssl-certificate: "{{ .Values.id }}-ingress-private/cert-wildcard.p.{{ .Values.domain }}"
      extraVolumes:
      - name: lighthouse-cert
        secret:
          secretName: node-lighthouse-cert
      - name: config
        configMap:
          name: lighthouse-config
      extraContainers:
      - name: lighthouse
        image: giolekva/nebula:latest
        imagePullPolicy: IfNotPresent
        securityContext:
          privileged: true
          capabilities:
            add:
            - NET_ADMIN
        ports:
        - name: nebula
          containerPort: 4243
          protocol: UDP
        command:
        - nebula
        - --config=/etc/nebula/config/lighthouse.yaml
        volumeMounts:
        - name: lighthouse-cert
          mountPath: /etc/nebula/lighthouse
        - name: config
          mountPath: /etc/nebula/config
      config:
        bind-address: 111.0.0.1
        proxy-body-size: 0
  - udp:
      53: "{{ .Values.namespacePrefix }}app-pihole/pihole-dns-udp:53"
  - tcp:
      53: "{{ .Values.namespacePrefix }}app-pihole/pihole-dns-tcp:53"
      143: "{{ .Values.namespacePrefix }}app-maddy/maddy:143"
      465: "{{ .Values.namespacePrefix }}app-maddy/maddy:465"
      587: "{{ .Values.namespacePrefix }}app-maddy/maddy:587"
      993: "{{ .Values.namespacePrefix }}app-maddy/maddy:993"
- name: certificate-issuer
  chart: ../../charts/certificate-issuer
  namespace: {{ .Values.namespacePrefix }}ingress-private
  values:
  - pcloudInstanceId: {{ .Values.id }}
  - certManager:
      namespace: {{ .Values.pcloudEnvName }}-cert-manager
      gandiWebhookSecretReader: {{ .Values.pcloudEnvName }}-cert-manager-webhook-gandi
  - public:
      name: {{ .Values.id }}-public
      server: https://acme-v02.api.letsencrypt.org/directory
      domain: {{ .Values.domain }}
      stagingServer: https://acme-staging-v02.api.letsencrypt.org/directory
      contactEmail: {{ .Values.contactEmail }}
      ingressClass: {{ .Values.pcloudEnvName }}-ingress-public
  - private:
      name: {{ .Values.id }}-private
      server: https://acme-v02.api.letsencrypt.org/directory
      domain: p.{{ .Values.domain }}
      contactEmail: {{ .Values.contactEmail }}
      ingressClassName: {{ .Values.id }}-ingress-private
      gandiAPIToken: {{ .Values.gandiAPIToken }}
- name: core-auth-storage  # TODO(giolekva): merge with core-auth
  chart: bitnami/postgresql
  version: 10.13.5
  namespace: {{ .Values.namespacePrefix }}core-auth
  values:
  - fullnameOverride: postgres
  - image:
      repository: arm64v8/postgres
      tag: 13.4
  - service:
      type: ClusterIP
      port: 5432
  - postgresqlPassword: psswd
  - postgresqlDatabase: kratos
  - persistence:
      size: 1Gi
  - securityContext:
      enabled: true
      fsGroup: 0
  - containerSecurityContext:
      enabled: true
      runAsUser: 0
  - volumePermissions:
      securityContext:
        runAsUser: 0
- name: core-auth
  chart: ../../charts/auth
  namespace: {{ .Values.namespacePrefix }}core-auth
  values:
  - kratos:
      fullnameOverride: kratos
      image:
        repository: giolekva/ory-kratos
        tag: latest
        pullPolicy: Always
      service:
        admin:
          enabled: true
          type: ClusterIP
          port: 80
          name: http
        public:
          enabled: true
          type: ClusterIP
          port: 80
          name: http
      ingress:
        admin:
          enabled: true
          className: {{ .Values.id }}-ingress-private
          hosts:
          - host: kratos.p.{{ .Values.domain }}
            paths:
            - path: /
              pathType: Prefix
          tls:
          - hosts:
            - kratos.p.{{ .Values.domain }}
        public:
          enabled: true
          className: {{ .Values.pcloudEnvName }}-ingress-public
          hosts:
          - host: accounts.{{ .Values.domain }}
            paths:
            - path: /
              pathType: Prefix
          annotations:
            cert-manager.io/cluster-issuer: "{{ .Values.id }}-public"
            acme.cert-manager.io/http01-edit-in-place: "true"
          tls:
          - hosts:
            - accounts.{{ .Values.domain }}
            secretName: cert-accounts.{{ .Values.domain }}
            # secretName: cert-wildcard.{{ .Values.domain }}
      secret:
        enabled: true
      kratos:
        autoMigrate: true
        development: false
        config:
          version: v0.7.1-alpha.1
          dsn: postgres://postgres:psswd@postgres:5432/kratos?sslmode=disable&max_conns=20&max_idle_conns=4
          serve:
            public:
              base_url: https://accounts.{{ .Values.domain }}
              cors:
                enabled: true
                debug: false
                allow_credentials: true
                allowed_origins:
                - https://{{ .Values.domain }}
                - https://*.{{ .Values.domain }}
            admin:
              base_url: https://kratos.p.{{ .Values.domain }}/
          selfservice:
            default_browser_return_url: https://accounts-ui.{{ .Values.domain }}
            whitelisted_return_urls:
              - https://accounts-ui.{{ .Values.domain }}
            methods:
              password:
                enabled: true
            flows:
              error:
                ui_url: https://accounts-ui.{{ .Values.domain }}/error
              settings:
                ui_url: https://accounts-ui.{{ .Values.domain }}/settings
                privileged_session_max_age: 15m
              recovery:
                enabled: false
              verification:
                enabled: false
              logout:
                after:
                  default_browser_return_url: https://accounts-ui.{{ .Values.domain }}/login
              login:
                ui_url: https://accounts-ui.{{ .Values.domain }}/login
                lifespan: 10m
                after:
                  password:
                    default_browser_return_url: https://accounts-ui.{{ .Values.domain }}/
              registration:
                lifespan: 10m
                ui_url: https://accounts-ui.{{ .Values.domain }}/registration
                after:
                  password:
                    hooks:
                      -
                        hook: session
                    default_browser_return_url: https://accounts-ui.{{ .Values.domain }}/
          log:
            level: debug
            format: text
            leak_sensitive_values: true
          cookies:
            path: /
            same_site: None
            domain: {{ .Values.domain }}
          secrets:
            cookie:
              - PLEASE-CHANGE-ME-I-AM-VERY-INSECURE
            # cipher:
            #   - 32-LONG-SECRET-NOT-SECURE-AT-ALL
          # ciphers:
          #   algorithm: xchacha20-poly1305
          hashers:
            argon2:
              parallelism: 1
              memory: 128MB
              iterations: 2
              salt_length: 16
              key_length: 16
          identity:
            default_schema_url: file:///etc/config/identity.schema.json
          courier:
            smtp:
              connection_uri: smtps://test-z1VmkYfYPjgdPRgPFgmeZ31esT9rUgS%40{{ .Values.domain }}:iW%213Kk%5EPPLFrZa%24%21bbpTPN9Wv3b8mvwS6ZJvMLtce%23A2%2A4MotD@mx1.{{ .Values.domain }}
        identitySchemas:
          "identity.schema.json": |
            {
              "$id": "https://schemas.ory.sh/presets/kratos/quickstart/email-password/identity.schema.json",
              "$schema": "http://json-schema.org/draft-07/schema#",
              "title": "User",
              "type": "object",
              "properties": {
                "traits": {
                  "type": "object",
                  "properties": {
                    "username": {
                      "type": "string",
                      "format": "username",
                      "title": "Username",
                      "minLength": 3,
                      "ory.sh/kratos": {
                        "credentials": {
                          "password": {
                            "identifier": true
                          }
                        }
                      }
                    }
                  },
                  "additionalProperties": false
                }
              }
            }
  - hydra:
      fullnameOverride: hydra
      image:
        repository: giolekva/ory-hydra
        tag: latest
        pullPolicy: Always
      service:
        admin:
          enabled: true
          type: ClusterIP
          port: 80
          name: http
        public:
          enabled: true
          type: ClusterIP
          port: 80
          name: http
      ingress:
        admin:
          enabled: true
          className: {{ .Values.id }}-ingress-private
          hosts:
          - host: hydra.p.{{ .Values.domain }}
            paths:
            - path: /
              pathType: Prefix
          tls:
          - hosts:
            - hydra.p.{{ .Values.domain }}
        public:
          enabled: true
          className: {{ .Values.pcloudEnvName }}-ingress-public
          hosts:
          - host: hydra.{{ .Values.domain }}
            paths:
            - path: /
              pathType: Prefix
          annotations:
            cert-manager.io/cluster-issuer: "{{ .Values.id }}-public"
            acme.cert-manager.io/http01-edit-in-place: "true"
          tls:
          - hosts:
            - hydra.{{ .Values.domain }}
            secretName: cert-hydra.{{ .Values.domain }}
            # secretName: cert-wildcard.{{ .Values.domain }}
      secret:
        enabled: true
      maester:
        enabled: false
        hydraFullnameOverride: hydra
      hydra-maester:
        fullnameOverride: {{ .Values.id }}-hydra-maester
        image:
          repository: giolekva/ory-hydra-maester
          tag: latest
          pullPolicy: IfNotPresent
        adminService:
          name: hydra
          port: 80
      hydra:
        autoMigrate: true
        config:
          version: v1.10.6
          dsn: postgres://postgres:psswd@postgres:5432/kratos?sslmode=disable&max_conns=20&max_idle_conns=4
          serve:
            cookies:
              same_site_mode: None
            public:
              cors:
                enabled: true
                debug: false
                allow_credentials: true
                allowed_origins:
                  - https://{{ .Values.domain }}
                  - https://*.{{ .Values.domain }}
            admin:
              # host: localhost
              cors:
                allowed_origins:
                  - https://hydra.p.{{ .Values.domain }}
              tls:
                allow_termination_from:
                  - 0.0.0.0/0
                  - 10.42.0.0/16
                  - 10.43.0.0/16
                  - 111.0.0.1/32
            tls:
              allow_termination_from:
                - 0.0.0.0/0
                - 10.42.0.0/16
                - 10.43.0.0/16
                - 111.0.0.1/32
          urls:
            self:
              public: https://hydra.{{ .Values.domain }}
              issuer: https://hydra.{{ .Values.domain }}
            consent: https://accounts-ui.{{ .Values.domain }}/consent
            login: https://accounts-ui.{{ .Values.domain }}/login
            logout: https://accounts-ui.{{ .Values.domain }}/logout
          secrets:
            system:
              - youReallyNeedToChangeThis
          oidc:
            subject_identifiers:
              supported_types:
                - pairwise
                - public
              pairwise:
                salt: youReallyNeedToChangeThis
          log:
            level: trace
            leak_sensitive_values: false
  - ui:
      certificateIssuer: {{ .Values.id }}-public
      ingressClassName: {{ .Values.pcloudEnvName }}-ingress-public
      domain: {{ .Values.domain }}
      internalDomain: p.{{ .Values.domain }}
      nebula:
        lighthouse:
          name: ui-lighthouse
          internalIP: 111.0.0.1
          externalIP: 46.49.35.44
          port: "4243"
        node:
          name: ui
          ipCidr: 111.0.0.2/24
          secretName: node-ui-cert
        certificateAuthority:
          name: {{ .Values.id }}
          namespace: {{ .Values.namespacePrefix }}ingress-private
- name: vaultwarden
  chart: ../../charts/vaultwarden
  namespace: {{ .Values.namespacePrefix }}app-vaultwarden
  values:
  - image:
      repository: vaultwarden/server
      tag: 1.22.2
      pullPolicy: IfNotPresent
  - storage:
      size: 1Gi
  - domain: bitwarden.p.{{ .Values.domain }}
  - certificateIssuer: {{ .Values.id }}-private
  - ingressClassName: {{ .Values.id }}-ingress-private
- name: matrix-storage  # TODO(giolekva): merge with core-auth
  chart: bitnami/postgresql
  version: 10.13.5
  namespace: {{ .Values.namespacePrefix }}app-matrix
  values:
  - fullnameOverride: postgres
  - image:
      repository: arm64v8/postgres
      tag: 13.4
  - service:
      type: ClusterIP
      port: 5432
  - postgresqlPassword: psswd
  - initdbScripts:
      createdb.sh: |
        #!/bin/sh
        createdb -U postgres --encoding=UTF8 --locale=C --template=template0 --owner=postgres matrix
  - persistence:
      size: {{ .Values.matrixStorageSize }}
  - securityContext:
      enabled: true
      fsGroup: 0
  - containerSecurityContext:
      enabled: true
      runAsUser: 0
  - volumePermissions:
      securityContext:
        runAsUser: 0
- name: matrix
  chart: ../../charts/matrix
  namespace: {{ .Values.namespacePrefix }}app-matrix
  values:
  - domain: {{ .Values.domain }}
  - oauth2:
      hydraAdmin: http://hydra-admin.{{ .Values.namespacePrefix}}core-auth.svc.cluster.local
      hydraPublic: https://hydra.{{ .Values.domain }}
      clientId: matrix
      clientSecret: {{ .Values.matrixOAuth2ClientSecret }}
      secretName: oauth2-client
  - postgresql:
      host: postgres
      port: 5432
      database: matrix
      user: postgres
      password: psswd
  - certificateIssuer: {{ .Values.id }}-public
  - ingressClassName: {{ .Values.pcloudEnvName }}-ingress-public
  - configMerge:
      configName: config-to-merge
      fileName: to-merge.yaml
- name: pihole
  chart: ../../charts/pihole
  namespace: {{ .Values.namespacePrefix }}app-pihole
  values:
  - domain: pihole.p.{{ .Values.domain }}
  - pihole:
      image:
        repository: "pihole/pihole"
        tag: v5.8.1
      persistentVolumeClaim:
        enabled: true
        size: 5Gi
      adminPassword: admin
      ingress:
        enabled: false
      serviceDhcp:
        enabled: false
      serviceDns:
        type: ClusterIP
      serviceWeb:
        type: ClusterIP
        http:
          enabled: true
        https:
          enabled: false
      virtualHost: pihole.p.{{ .Values.domain }}
      resources:
        requests:
          cpu: "250m"
          memory: "100M"
        limits:
          cpu: "500m"
          memory: "250M"
  - oauth2:
      clientId: pihole
      clientSecret: {{ .Values.piholeOAuth2ClientSecret }}
      cookieSecret: {{ .Values.piholeOAuth2CookieSecret }}
      secretName: oauth2-secret
      configName: oauth2-proxy
      hydraAdmin: http://hydra-admin.{{ .Values.namespacePrefix}}core-auth.svc.cluster.local
  - hydraPublic: https://hydra.{{ .Values.domain }}/
  - profileUrl: https://accounts-ui.{{ .Values.domain }}
  - ingressClassName: {{ .Values.id }}-ingress-private
- name: maddy
  chart: ../../charts/maddy
  namespace: {{ .Values.namespacePrefix }}app-maddy
  values:
  - ingress:
      private:
        className: {{ .Values.id }}-ingress-private
        domain: p.{{ .Values.domain }}
      public:
        className: {{ .Values.pcloudEnvName }}-ingress-public
        domain: {{ .Values.domain }}
        certificateIssuer: {{ .Values.id }}-public
  - storage:
      size: 10Gi
  - mailGateway:
      mxHostname: {{ .Values.mxHostname}}
      address: {{ .Values.mailGatewayAddress }}

environments:
  shveli:
    secrets:
    - secrets.shveli.yaml
    values:
    - pcloudEnvName: pcloud
    - id: shveli
    - namespacePrefix: shveli-
    - domain: shve.li
    - contactEmail: giolekva@gmail.com
    - certManagerNamespace: cert-manager
    - mxHostname: mail.lekva.me
    - mailGatewayAddress: "tcp://maddy.pcloud-mail-gateway.svc.cluster.local:587"
    - matrixStorageSize: 1Gi
  lekva:
    secrets:
    - secrets.lekva.yaml
    values:
    - pcloudEnvName: pcloud
    - id: lekva
    - namespacePrefix: lekva-
    - domain: lekva.me
    - contactEmail: giolekva@gmail.com
    - certManagerNamespace: cert-manager
    - mxHostname: mail.lekva.me
    - mailGatewayAddress: "tcp://maddy.pcloud-mail-gateway.svc.cluster.local:587"
    - matrixStorageSize: 100Gi