vynil/domain
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix

Browse Source
This commit is contained in:
Sébastien Huss
2024-01-26 11:14:00 +01:00
parent 0c5e247c0c
commit a0addbd842
91 changed files with 2236 additions and 2236 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
share/authentik-forward/index.yaml
View File

@@ -6,13 +6,6 @@ metadata:
name: authentik-forward
description: null
options:
sub-domain:
default: null
domain-name:
default: your_company.com
examples:
- your_company.com
type: string
domain:
default: your-company
examples:
@@ -23,7 +16,14 @@ options:
examples:
- letsencrypt-prod
type: string
ingress-class:
domain_name:
default: your_company.com
examples:
- your_company.com
type: string
sub-domain:
default: null
ingress_class:
default: traefik
examples:
- traefik

2
share/authentik/datas.tf
View File

@@ -46,7 +46,7 @@ data "kustomization_overlay" "data" {
"AUTHENTIK_POSTGRESQL__PORT=5432",
"AUTHENTIK_POSTGRESQL__USER=${var.component}",
"AUTHENTIK_REDIS__HOST=${var.name}-${var.component}-redis",
"AUTHENTIK_BOOTSTRAP_EMAIL=${var.admin.email}@${var.domain-name}",
"AUTHENTIK_BOOTSTRAP_EMAIL=${var.admin.email}@${var.domain_name}",
]
}
patches {

256
share/authentik/index.yaml
View File

@@ -23,10 +23,35 @@ options:
type: boolean
type: object
type: object
ingress-class:
default: traefik
postgres:
default:
replicas: 1
examples:
- traefik
- replicas: 1
properties:
replicas:
default: 1
type: integer
type: object
admin:
default:
email: auth-admin
examples:
- email: auth-admin
properties:
email:
default: auth-admin
type: string
type: object
domain:
default: your-company
examples:
- your-company
type: string
geoip:
default: /geoip/GeoLite2-City.mmdb
examples:
- /geoip/GeoLite2-City.mmdb
type: string
email:
default:
@@ -53,11 +78,110 @@ options:
default: false
type: boolean
type: object
domain-name:
loglevel:
default: info
examples:
- info
type: string
sub-domain:
default: auth
examples:
- auth
type: string
domain_name:
default: your_company.com
examples:
- your_company.com
type: string
issuer:
default: letsencrypt-prod
examples:
- letsencrypt-prod
type: string
error_reporting:
default:
enabled: false
environment: k8s
send_pii: false
examples:
- enabled: false
environment: k8s
send_pii: false
properties:
enabled:
default: false
type: boolean
environment:
default: k8s
type: string
send_pii:
default: false
type: boolean
type: object
ingress_class:
default: traefik
examples:
- traefik
type: string
backups:
default:
enable: false
endpoint: ''
key-id-key: s3-id
retention:
db: 30d
schedule:
db: 0 3 * * *
secret-key: s3-secret
secret-name: backup-settings
use-barman: false
examples:
- enable: false
endpoint: ''
key-id-key: s3-id
retention:
db: 30d
schedule:
db: 0 3 * * *
secret-key: s3-secret
secret-name: backup-settings
use-barman: false
properties:
enable:
default: false
type: boolean
endpoint:
default: ''
type: string
key-id-key:
default: s3-id
type: string
retention:
default:
db: 30d
properties:
db:
default: 30d
type: string
type: object
schedule:
default:
db: 0 3 * * *
properties:
db:
default: 0 3 * * *
type: string
type: object
secret-key:
default: s3-secret
type: string
secret-name:
default: backup-settings
type: string
use-barman:
default: false
type: boolean
type: object
storage:
default:
postgres:
@@ -224,130 +348,6 @@ options:
type: string
type: object
type: object
domain:
default: your-company
examples:
- your-company
type: string
backups:
default:
enable: false
endpoint: ''
key-id-key: s3-id
retention:
db: 30d
schedule:
db: 0 3 * * *
secret-key: s3-secret
secret-name: backup-settings
use-barman: false
examples:
- enable: false
endpoint: ''
key-id-key: s3-id
retention:
db: 30d
schedule:
db: 0 3 * * *
secret-key: s3-secret
secret-name: backup-settings
use-barman: false
properties:
enable:
default: false
type: boolean
endpoint:
default: ''
type: string
key-id-key:
default: s3-id
type: string
retention:
default:
db: 30d
properties:
db:
default: 30d
type: string
type: object
schedule:
default:
db: 0 3 * * *
properties:
db:
default: 0 3 * * *
type: string
type: object
secret-key:
default: s3-secret
type: string
secret-name:
default: backup-settings
type: string
use-barman:
default: false
type: boolean
type: object
error_reporting:
default:
enabled: false
environment: k8s
send_pii: false
examples:
- enabled: false
environment: k8s
send_pii: false
properties:
enabled:
default: false
type: boolean
environment:
default: k8s
type: string
send_pii:
default: false
type: boolean
type: object
loglevel:
default: info
examples:
- info
type: string
admin:
default:
email: auth-admin
examples:
- email: auth-admin
properties:
email:
default: auth-admin
type: string
type: object
postgres:
default:
replicas: 1
examples:
- replicas: 1
properties:
replicas:
default: 1
type: integer
type: object
geoip:
default: /geoip/GeoLite2-City.mmdb
examples:
- /geoip/GeoLite2-City.mmdb
type: string
sub-domain:
default: auth
examples:
- auth
type: string
issuer:
default: letsencrypt-prod
examples:
- letsencrypt-prod
type: string
dependencies:
- dist: null
category: core

4
share/authentik/ingress.tf
View File

@@ -1,5 +1,5 @@
locals {
dns_names = ["${var.sub-domain}.${var.domain-name}"]
dns_names = ["${var.sub-domain}.${var.domain_name}"]
middlewares = ["${var.instance}-https"]
service = {
"name" = "${var.instance}"
@@ -66,7 +66,7 @@ resource "kubectl_manifest" "prj_ingress" {
annotations:
"traefik.ingress.kubernetes.io/router.middlewares": "${join(",", [for m in local.middlewares : format("%s-%s@kubernetescrd", var.namespace, m)])}"
spec:
ingressClassName: "${var.ingress-class}"
ingressClassName: "${var.ingress_class}"
rules: ${jsonencode(local.rules)}
tls:
- hosts: ${jsonencode(local.dns_names)}

6
share/dataset-pg/directus.tf
View File

@@ -45,7 +45,7 @@ resource "kubectl_manifest" "directus_config" {
DB_PORT: "5432"
STORAGE_LOCATIONS: "local"
STORAGE_LOCAL_ROOT: "/var/store"
ADMIN_EMAIL: "admin@${var.domain-name}"
ADMIN_EMAIL: "admin@${var.domain_name}"
NODE_EXTRA_CA_CERTS: "/etc/local-ca/ca.crt"
TELEMETRY: "false"
AUTH_PROVIDERS: "VYNIL"
@@ -216,7 +216,7 @@ module "directus-ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.directus-labels
dns_names = [local.directus-dns_name]
create-redirect = true
@@ -232,7 +232,7 @@ module "directus-application" {
source = "/dist/modules/application"
component = "directus-${replace(var.sub-domain, ".", "-")}"
instance = var.instance
app-group = var.app-group
app_group = var.app_group
dns_name = local.directus-dns_name
icon = local.directus-icon
protocol_provider = module.directus-oauth2[0].provider-id

6
share/dataset-pg/index.yaml
View File

@@ -6,7 +6,7 @@ metadata:
name: dataset-pg
description: null
options:
app-group:
app_group:
default: api
examples:
- api
@@ -278,7 +278,7 @@ options:
default: backup-settings
type: string
type: object
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
@@ -340,7 +340,7 @@ options:
default: 1
type: integer
type: object
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com

2
share/dataset-pg/postgresql.tf
View File

@@ -1,5 +1,5 @@
locals {
dns_name = "${var.instance}.${var.sub-domain}.${var.domain-name}"
dns_name = "${var.instance}.${var.sub-domain}.${var.domain_name}"
pg-labels = merge(local.common-labels, {
"app.kubernetes.io/component" = "postgresql"
})

4
share/dataset-pg/postgrest.tf
View File

@@ -152,7 +152,7 @@ module "postgrest-ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.prest-labels
dns_names = [local.prest-dns_name]
create-redirect = true
@@ -184,7 +184,7 @@ module "swagger-ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.prest-labels
dns_names = [local.prest-dns_name]
middlewares = []

4
share/dns/config.tf
View File

@@ -23,13 +23,13 @@ locals {
}
EOF
soa-ns = <<-EOF
@ IN SOA ${var.sub-domain}.${var.domain-name}. ${var.domain-name}. (
@ IN SOA ${var.sub-domain}.${var.domain_name}. ${var.domain_name}. (
${formatdate("YYYYMMDDhh",timestamp())} ; Serial
4H ; Refresh
1H ; Retry
7D ; Expire
4H ) ; Negative Cache TTL
@ IN NS ${var.sub-domain}.${var.domain-name}.
@ IN NS ${var.sub-domain}.${var.domain_name}.
EOF
files = merge({
"Corefile" = join("\n", concat([local.begin-core],[for z in var.zones: format("file /etc/coredns/%s.db %s", z.name,z.name)],[local.end-core]))

2
share/dns/index.yaml
View File

@@ -16,7 +16,7 @@ options:
examples:
- dns
type: string
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com

2
share/organisation/gitea-user.tf
View File

@@ -83,7 +83,7 @@ resource "gitea_user" "user-ci" {
username = "${var.instance}-ci"
login_name = "${var.instance}-ci"
password = random_password.password.result
email = "${var.instance}-ci@${var.domain-name}"
email = "${var.instance}-ci@${var.domain_name}"
must_change_password = true
}

6
share/organisation/index.yaml
View File

@@ -6,7 +6,7 @@ metadata:
name: organisation
description: null
options:
app-group:
app_group:
default: dev
examples:
- dev
@@ -16,7 +16,7 @@ options:
examples:
- your-company
type: string
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
@@ -87,7 +87,7 @@ options:
type: string
type: object
type: array
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com

10
share/organisation/stages.tf
View File

@@ -1,17 +1,17 @@
locals {
annotations = {
"vynil.solidite.fr/name" = "${var.component}"
"vynil.solidite.fr/domain" = var.domain-name
"vynil.solidite.fr/domain" = var.domain_name
"vynil.solidite.fr/issuer" = var.issuer
"vynil.solidite.fr/ingress" = var.ingress-class
"vynil.solidite.fr/ingress" = var.ingress_class
}
global = {
"domain" = var.namespace
"domain-name" = var.domain-name
"domain_name" = var.domain_name
"issuer" = var.issuer
"ingress-class" = var.ingress-class
"ingress_class" = var.ingress_class
"backups" = var.backups
"app-group" = var.app-group
"app_group" = var.app_group
}
sorted-stage-name = reverse(distinct(sort([for s in var.stages: s.name])))
sorted-dataset-name = reverse(distinct(sort([for d in var.datasets: d.name])))

6
share/wildduck/application.tf
View File

@@ -14,10 +14,10 @@ resource "authentik_application" "prj_app" {
name = "${var.instance}"
slug = "${var.component}-${var.instance}"
#protocol_provider = authentik_provider_oauth2.oauth2.id
group = var.app-group
group = var.app_group
backchannel_providers = [authentik_provider_scim.scim.id]
meta_launch_url = format("https://%s.%s", var.sub-domain, var.domain-name)
meta_icon = format("https://%s.%s/%s", var.sub-domain, var.domain-name, "favicon-32x32.png")
meta_launch_url = format("https://%s.%s", var.sub-domain, var.domain_name)
meta_icon = format("https://%s.%s/%s", var.sub-domain, var.domain_name, "favicon-32x32.png")
}
resource "authentik_policy_expression" "policy" {

8
share/wildduck/haraka.tf
View File

@@ -96,11 +96,11 @@ resource "kubernetes_config_map_v1" "haraka_config" {
}
data = yamldecode(<<-EOF
me: |-
${var.sub-domain}.${var.domain-name}
${var.sub-domain}.${var.domain_name}
host_list: |-
# add hosts in here we want to accept mail for
${var.sub-domain}.${var.domain-name}
${var.domain-name}
${var.sub-domain}.${var.domain_name}
${var.domain_name}
${join("\n ",var.additional-domains)}
rspamd.ini: |-
host = ${var.instance}-rspamd.${var.namespace}.svc.cluster.local
@@ -188,7 +188,7 @@ resource "kubernetes_config_map_v1" "haraka_config" {
dkim_sign.ini: |-
disabled = true
selector = mail
domain = ${var.domain-name}
domain = ${var.domain_name}
headers_to_sign = From, Sender, Reply-To, Subject, Date, Message-ID, To, Cc, MIME-Version
wildduck.yaml: |-
redis:

6
share/wildduck/index.yaml
View File

@@ -28,12 +28,12 @@ options:
type: boolean
type: object
type: object
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
type: string
app-group:
app_group:
default: ''
examples:
- ''
@@ -360,7 +360,7 @@ options:
type: string
type: object
type: object
ingress-class:
ingress_class:
default: traefik
examples:
- traefik

6
share/wildduck/ingress.tf
View File

@@ -1,6 +1,6 @@
locals {
dns_names = ["${var.sub-domain}.${var.domain-name}"]
cert-names = concat(local.dns_names, ["${var.domain-name}"])
dns_names = ["${var.sub-domain}.${var.domain_name}"]
cert-names = concat(local.dns_names, ["${var.domain_name}"])
middlewares = ["${var.instance}-https"]
service = {
"name" = "${var.instance}-webmail"
@@ -67,7 +67,7 @@ resource "kubectl_manifest" "prj_ingress" {
annotations:
"traefik.ingress.kubernetes.io/router.middlewares": "${join(",", [for m in local.middlewares : format("%s-%s@kubernetescrd", var.namespace, m)])}"
spec:
ingressClassName: "${var.ingress-class}"
ingressClassName: "${var.ingress_class}"
rules: ${jsonencode(local.rules)}
tls:
- hosts: ${jsonencode(local.dns_names)}

2
share/wildduck/scimgateway.tf
View File

@@ -55,7 +55,7 @@ resource "kubectl_manifest" "scimgateway_deploy" {
- name: "PORT"
value: "8880"
- name: "WILDDUCK_DOMAIN"
value: "${var.domain-name}"
value: "${var.domain_name}"
- name: "WILDDUCK_API"
value: "http://${var.instance}-wildduck-api.${var.namespace}.svc"
- name: SEED

12
share/wildduck/webmail.tf
View File

@@ -92,7 +92,7 @@ resource "kubernetes_config_map_v1" "webmail_config" {
[service]
# email domain for new users
domain="${var.domain-name}"
domain="${var.domain_name}"
# default quotas for new users
quota=1024
recipients=2000
@@ -102,7 +102,7 @@ resource "kubernetes_config_map_v1" "webmail_config" {
allowJoin=false
enableSpecial=false # if true the allow creating addresses with special usernames
# allowed domains for new addresses
domains=["${var.domain-name}"]
domains=["${var.domain_name}"]
generalNotification="" # static notification to show on top of the page
@@ -145,7 +145,7 @@ resource "kubernetes_config_map_v1" "webmail_config" {
# set to false if not using HTTPS
enabled=true
# must be https url or use default
appId="https://${var.domain-name}"
appId="https://${var.domain_name}"
[log]
level="silly"
@@ -154,15 +154,15 @@ resource "kubernetes_config_map_v1" "webmail_config" {
[setup]
# these values are shown in the configuration help page
[setup.imap]
hostname="${var.sub-domain}.${var.domain-name}"
hostname="${var.sub-domain}.${var.domain_name}"
secure=true
port=143
[setup.pop3]
hostname="${var.sub-domain}.${var.domain-name}"
hostname="${var.sub-domain}.${var.domain_name}"
secure=true
port=110
[setup.smtp]
hostname="${var.sub-domain}.${var.domain-name}"
hostname="${var.sub-domain}.${var.domain_name}"
secure=true
port=25
EOF

6
share/wildduck/wildduck.tf
View File

@@ -173,7 +173,7 @@ resource "kubernetes_config_map_v1" "wildduck_config" {
enabled=true
[smtp.setup]
# Public configuration for SMTP MDA, needed for mobileconfig files
hostname="${var.sub-domain}.${var.domain-name}"
hostname="${var.sub-domain}.${var.domain_name}"
secure=true
port=465
[webhooks]
@@ -312,7 +312,7 @@ resource "kubernetes_config_map_v1" "wildduck_config" {
autoExpunge=true
[setup]
# Public configuration for IMAP
hostname="${var.sub-domain}.${var.domain-name}"
hostname="${var.sub-domain}.${var.domain_name}"
secure=true
# port defaults to imap.port
port=9930
@@ -360,7 +360,7 @@ resource "kubernetes_config_map_v1" "wildduck_config" {
cert="/var/opt/certs/tls.crt"
[setup]
# Public configuration for POP3
hostname="${var.sub-domain}.${var.domain-name}"
hostname="${var.sub-domain}.${var.domain_name}"
secure=true
# port defaults to pop3.port
port=995

6
share/wildduck/zonemta.tf
View File

@@ -128,7 +128,7 @@ resource "kubernetes_config_map_v1" "zonemta_config" {
# Server process must be able to locally bind to these addresses
[[default]]
address="0.0.0.0"
name="${var.sub-domain}.${var.domain-name}"
name="${var.sub-domain}.${var.domain_name}"
#
#[[default]]
#address="1.2.3.5"
@@ -145,7 +145,7 @@ resource "kubernetes_config_map_v1" "zonemta_config" {
interfaces=["feeder"]
# optional hostname to be used in headers
# defaults to os.hostname()
hostname="${var.sub-domain}.${var.domain-name}"
hostname="${var.sub-domain}.${var.domain_name}"
# How long to keep auth records in log
authlogExpireDays=30
# default smtp recipients for 24h (can be overriden per user)
@@ -161,7 +161,7 @@ resource "kubernetes_config_map_v1" "zonemta_config" {
# SRS secret value. Must be the same as in the MX side
secret="${local.secrets.srs}"
# SRS domain, must resolve back to MX
rewriteDomain="${var.domain-name}"
rewriteDomain="${var.domain_name}"
# DKIM Settings
# -------------
["modules/zonemta-wildduck".dkim]