diff --git a/.sops.yaml b/.sops.yaml index 821c263..fe46ea4 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -38,3 +38,6 @@ creation_rules: - path_regex: woodpecker.*\.enc\.yaml$ encrypted_regex: ^(data|stringData)$ age: age13qwkssk8esashln2j3gfv6e9csashr4vddkdav5v38hm5wejl36qd2ew9s + - path_regex: tinyauth.*\.enc\.yaml$ + encrypted_regex: ^(data|stringData)$ + age: age1rvyt7nlnjqeyt6ykwh9fj9d88kjmq9vetcx667ul3ql6fyfz4gqqh9lq9q diff --git a/clusters/base/apps/tinyauth/helmrelease.yaml b/clusters/base/apps/tinyauth/helmrelease.yaml new file mode 100644 index 0000000..df7db34 --- /dev/null +++ b/clusters/base/apps/tinyauth/helmrelease.yaml @@ -0,0 +1,74 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: tinyauth + namespace: auth +spec: + interval: 10m + chartRef: + kind: OCIRepository + name: tinyauth + driftDetection: + mode: enabled + values: + controllers: + tinyauth: + containers: + app: + image: + repository: ghcr.io/tinyauthapp/tinyauth + tag: v5.2.0 + env: + TZ: Europe/Moscow + TINYAUTH_APPURL: https://login.aggtaa.com + TINYAUTH_UI_TITLE: "Welcome" + TINYAUTH_AUTH_USERSFILE: /config/users + TINYAUTH_AUTH_SECURECOOKIE: "true" + TINYAUTH_LABELPROVIDER: none + TINYAUTH_ANALYTICS_ENABLED: "false" + TINYAUTH_DATABASE_DRIVER: memory + probes: + liveness: + enabled: true + readiness: + enabled: true + resources: + requests: + cpu: 20m + memory: 64Mi + limits: + memory: 256Mi + + service: + app: + controller: tinyauth + ports: + http: + port: 3000 + + ingress: + app: + className: traefik + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod + hosts: + - host: login.aggtaa.com + paths: + - path: / + pathType: Prefix + service: + identifier: app + port: http + tls: + - secretName: tinyauth-tls + hosts: + - login.aggtaa.com + + persistence: + users: + type: secret + name: tinyauth-secrets + globalMounts: + - path: /config/users + subPath: users + readOnly: true diff --git a/clusters/base/apps/tinyauth/helmrepository.yaml b/clusters/base/apps/tinyauth/helmrepository.yaml new file mode 100644 index 0000000..1432fef --- /dev/null +++ b/clusters/base/apps/tinyauth/helmrepository.yaml @@ -0,0 +1,10 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: OCIRepository +metadata: + name: tinyauth + namespace: auth +spec: + interval: 1h + url: oci://ghcr.io/bjw-s-labs/helm/app-template + ref: + tag: "5.0.1" diff --git a/clusters/base/apps/tinyauth/kustomization.yaml b/clusters/base/apps/tinyauth/kustomization.yaml new file mode 100644 index 0000000..aa99ec8 --- /dev/null +++ b/clusters/base/apps/tinyauth/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helmrepository.yaml + - helmrelease.yaml + - middleware.yaml + - secret.enc.yaml diff --git a/clusters/base/apps/tinyauth/middleware.yaml b/clusters/base/apps/tinyauth/middleware.yaml new file mode 100644 index 0000000..38dd0c1 --- /dev/null +++ b/clusters/base/apps/tinyauth/middleware.yaml @@ -0,0 +1,14 @@ +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: tinyauth + namespace: auth +spec: + forwardAuth: + address: http://tinyauth.auth.svc.cluster.local:3000/api/auth/traefik + trustForwardHeader: true + authResponseHeaders: + - Remote-User + - Remote-Groups + - Remote-Name + - Remote-Email diff --git a/clusters/base/apps/tinyauth/secret.enc.yaml b/clusters/base/apps/tinyauth/secret.enc.yaml new file mode 100644 index 0000000..300294d --- /dev/null +++ b/clusters/base/apps/tinyauth/secret.enc.yaml @@ -0,0 +1,22 @@ +apiVersion: v1 +kind: Secret +metadata: + name: tinyauth-secrets + namespace: auth +stringData: + users: ENC[AES256_GCM,data:C3Dhfymnr+WLWy18EpY9upXn+f7sY6w0cf3oXO9352PTPCP+rLYQTm8eiJtsU8gp/Uea7lMpsRPHSy8CoRdI8DOGT+hyPyK1ovjLdyO7bEiq0TtYOIFlHSR7Kwo0Cm+pZegSN9e1dm/v51+YyFfX3JpLaymYrlmXL3sFPQ0yOzEuMp3zXSV3VAkJe6gZrswIAUNhY0xmaGItr4Vc2isItDuc16lx7tW2wJHI7NgLI98p9FyU8HlXd9MsiPMxDaXSGeAwnjGU+TEvQv9NbhcZO0sUocSi2zgnRbi0i8Zt,iv:5OVryBqH4VNC71QdZkqZsoDrfbT5++Z5xZjgCFNOAu0=,tag:V+OC7Mad6Dw38u91gp6d/Q==,type:str] +sops: + age: + - recipient: age1rvyt7nlnjqeyt6ykwh9fj9d88kjmq9vetcx667ul3ql6fyfz4gqqh9lq9q + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJS1llcTdHUmx2ZXdjVFh1 + ekJheVN2MVBwa0V1a2JOY2pFM1pmYUJrMzFRCllaRnlnTGFVYTlQeXVxNXFsNEZu + bWUxd3BWZTlEOWxsZVRnREx6YUJ6em8KLS0tIGNDd1Znb0dlSDZEUE1JUkdWMlBG + ajBNVW1pa20zKzhISmFBUmdiazA4T1UK0wyvTMGsyJthx2Py1LITvRePQsjKN/9v + jqKjeeCuVutQCo3FvoVrlkkmiD19jqPDoXjWz95sTN6QjWmP7u6AIA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-10-20T07:13:27Z" + mac: ENC[AES256_GCM,data:oLDi3nfNcZir32V88C9q7wDH0Dsgt+ik54XJ+N41bYZSX745T1DFpLyUus5Xy0GKfSHXyjxWKoBuQ3ccEC5IrTE/xLM4XBCQfvV6hh/OtGA5TteCBeWII21YDikkIV12c9T7gHmT3hnUR2ICzPI9Ipsc9TpYG1NPHhrgZRuhJOI=,iv:kuXOPZTeOkMzd9jbdprCgsdPx/kIMFwC065sWx4FVIQ=,tag:ktIi29LDEtfCePWoQ3DHBA==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.11.0 diff --git a/clusters/home/apps/kustomization.yaml b/clusters/home/apps/kustomization.yaml index f28d897..108d705 100644 --- a/clusters/home/apps/kustomization.yaml +++ b/clusters/home/apps/kustomization.yaml @@ -17,4 +17,5 @@ resources: - joplin.yaml - gitea.yaml - dev.yaml - - woodpecker.yaml \ No newline at end of file + - woodpecker.yaml + - tinyauth.yaml \ No newline at end of file diff --git a/clusters/home/apps/tinyauth.yaml b/clusters/home/apps/tinyauth.yaml new file mode 100644 index 0000000..9193009 --- /dev/null +++ b/clusters/home/apps/tinyauth.yaml @@ -0,0 +1,21 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: tinyauth + namespace: flux-system +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: flux-system + path: ./clusters/base/apps/tinyauth + prune: true + wait: true + dependsOn: + - name: namespaces + - name: infra + retryInterval: 5s + decryption: + provider: sops + secretRef: + name: sops-age-tinyauth