Add sish

apps/cert-manager.yaml

@@ -22,26 +22,61 @@ spec:
       valuesObject:
         crds:
           enabled: true
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt
-spec:
-  acme:
-    email: zoe.roux@zoriya.dev
-    profile: tlsserver
-    server: https://acme-v02.api.letsencrypt.org/directory
-    privateKeySecretRef:
-      name: lets-encrypt-pk
-    solvers:
-    - http01:
-        ingress:
-          ingressClassName: cilium
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: selfsigned
-spec:
-  selfSigned: {}
+        extraObjects:
+          - apiVersion: cert-manager.io/v1
+            kind: ClusterIssuer
+            metadata:
+              name: letsencrypt
+            spec:
+              acme:
+                email: zoe.roux@zoriya.dev
+                profile: tlsserver
+                server: https://acme-v02.api.letsencrypt.org/directory
+                privateKeySecretRef:
+                  name: lets-encrypt-pk
+                solvers:
+                  - http01:
+                      ingress:
+                        ingressClassName: cilium
+          - apiVersion: cert-manager.io/v1
+            kind: ClusterIssuer
+            metadata:
+              name: selfsigned
+            spec:
+              selfSigned: {}
+          - apiVersion: cert-manager.io/v1
+            kind: ClusterIssuer
+            metadata:
+              name: letsencrypt-dns
+            spec:
+              acme:
+                email: zoe.roux@zoriya.dev
+                profile: tlsserver
+                server: https://acme-v02.api.letsencrypt.org/directory
+                privateKeySecretRef:
+                  name: lets-encrypt-dns-pk
+                solvers:
+                  - selector:
+                      dnsZones:
+                        - sdg.moe
+                    dns01:
+                      cloudflare:
+                        apiTokenSecretRef:
+                          name: cloudflare-api-token
+                          key: api-token
+          - apiVersion: external-secrets.io/v1
+            kind: ExternalSecret
+            metadata:
+              name: cloudflare-api-token
+              namespace: cert-manager
+            spec:
+              refreshInterval: 24h
+              secretStoreRef:
+                name: bitwarden
+                kind: ClusterSecretStore
+              target:
+                name: cloudflare-api-token
+              data:
+                - secretKey: api-token
+                  remoteRef:
+                    key: cloudflare-api-token

apps/sish.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sish
+  namespace: argocd
+spec:
+  project: default
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: sish
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: false
+    syncOptions:
+      - CreateNamespace=true
+  source:
+    repoURL: https://github.com/zoriya/snow
+    targetRevision: HEAD
+    path: charts/sish

charts/sish/certificate.yaml

@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: sish-tls
+spec:
+  secretName: sish-tls
+  dnsNames:
+    - "*.tun.sdg.moe"
+  issuerRef:
+    name: letsencrypt-dns
+    kind: ClusterIssuer
+    group: cert-manager.io

charts/sish/deploy.yaml

@@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sish
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  template:
+    spec:
+      containers:
+        - name: sish
+          image: antoniomika/sish:v2.23.0
+          args:
+            - --ssh-address=:22
+            - --http-address=:80
+            - --domain=tun.sdg.moe
+            - --authentication=true
+            - --authentication-keys-directory=/pubkeys
+            - --private-keys-directory=/keys
+            - --bind-random-subdomains=false
+            - --bind-random-ports=false
+          ports:
+            - name: ssh
+              containerPort: 22
+            - name: http
+              containerPort: 80
+          volumeMounts:
+            - name: keys
+              mountPath: /keys
+            - name: pubkeys
+              mountPath: /pubkeys
+      volumes:
+        - name: keys
+          persistentVolumeClaim:
+            claimName: sish-keys
+        - name: pubkeys
+          configMap:
+            name: sish-pubkeys

charts/sish/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: sish
+spec:
+  ingressClassName: cilium
+  rules:
+    - host: "*.tun.sdg.moe"
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: sish-http
+                port:
+                  name: http
+  tls:
+    - hosts:
+        - "*.tun.sdg.moe"
+      secretName: sish-tls

charts/sish/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+labels:
+  - includeSelectors: true
+    pairs:
+      apps.kubernetes.io/name: sish
+
+resources:
+  - ./deploy.yaml
+  - ./svc.yaml
+  - ./ingress.yaml
+  - ./certificate.yaml
+  - ./pubkeys.yaml
+  - ./pvc.yaml

charts/sish/pubkeys.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: sish-pubkeys
+data:
+  zoriya.pub: |
+    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDGcLP/ZEjnSgkzQMBeLLOWn5uejSr9Gg1h9PJZECVTLm+VDQ7KyI3ORZt+qbfEnsnGL73iwcAqB5Upy9Cdj0182mnrTk2ZViNMeFT7kLBF0yXpiajQTtMjENYj0nbNWpQ5+sJrtJKKYK/tBghW8PyTrJPpVQcrLcf4D66U5DkkJNRDeu4v9SjHKaASUeyia4gRSVV59Ugtrl0lz8sl4yBSL4957zwzdkNR0pVmftaKmUP4KfBvpNcFOOpHcdvzDtEPQs8j0g2l65YOQNNFSMsYQfxt1X4zmEi4unRIlECglaPz12CyoTiM2xmCWa/mS5nm0dR1VbEHFMRtGbbgm9MwedXoxYAfycbu08fqi1AAvg7MQxDNLfWWBIHe7+imGLKrVkqk8B89I409iI4YiOytnUkxKZkxynqVYtEE0bx5J15mniq2vJTw9JD89qSVkvGjZNGuJgh4leIlxPGj4iP8KY3N3Ifaf72PsmmwW4rB5JPDW93RL1DZV8lk3NgyF8M=
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBzfKjYeQ80s/M+qEKCxBhseJjLa2OwBk9ZrHeku90Vg
+    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq7uaYigZWAhk/EIn9SHd6mhWJHtYPRFCUlpYwGSG6SDW2Ef0epsYJL2hBuMhhmhOvmpzzKiP83hZjNXchq8u7xcAhLsCPdPXhrQ4kOScJaeLuoxyY/7wiOqTSvSwz/N2s9tdNNcOLLUAset1Kvyp1OPBkEuXbIFfRGGqwAwcS2YYimlHf9mpcg/tZujBYQHIetHQkMaO+P0h+vMjVHBBcFLcsao+1QsVjoQnZOE96QTf2Oc66SxDBXnyS+1y1OnlWAEslSDL9AXVl6wF4O1JBWcsKNk+X4ShaaJMFRiPJEDQKSqRMKXWflkdFe1vNQ0bSiA6TLeH1lPeT8PXye2sUhu/DhpEswB7sV9YPpiP216QGsVM/2MepjCRq2sdr4EZ/17tubYdNcO8PkhVlQWOhHWXvIwIrvAzOVG1l9laAL1mxAY2iQLLN/gHGFPuiLcZCBem2LrDLQ7Ny+rDYQe4jZMEX4NYzNgNbHPk1ecwj/fqeLM4Qn+TkQgUL/kSM3ZU=

charts/sish/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sish-keys
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 128Mi
+  storageClassName: openebs-zfs-tank

charts/sish/svc.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: sish-http
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: sish-ssh
+  annotations:
+    lbipam.cilium.io/ips: 192.168.1.202
+spec:
+  type: LoadBalancer
+  ports:
+    - name: ssh
+      port: 22
+      targetPort: ssh