From e03760980ad9597061e5dec2973e3bd2aa8539e7 Mon Sep 17 00:00:00 2001 From: Zoe Roux Date: Mon, 20 Jul 2026 19:05:13 +0200 Subject: [PATCH] Add sish --- apps/cert-manager.yaml | 81 ++++++++++++++++++++++++---------- apps/sish.yaml | 20 +++++++++ charts/sish/certificate.yaml | 12 +++++ charts/sish/deploy.yaml | 39 ++++++++++++++++ charts/sish/ingress.yaml | 21 +++++++++ charts/sish/kustomization.yaml | 15 +++++++ charts/sish/pubkeys.yaml | 9 ++++ charts/sish/pvc.yaml | 11 +++++ charts/sish/svc.yaml | 23 ++++++++++ 9 files changed, 208 insertions(+), 23 deletions(-) create mode 100644 apps/sish.yaml create mode 100644 charts/sish/certificate.yaml create mode 100644 charts/sish/deploy.yaml create mode 100644 charts/sish/ingress.yaml create mode 100644 charts/sish/kustomization.yaml create mode 100644 charts/sish/pubkeys.yaml create mode 100644 charts/sish/pvc.yaml create mode 100644 charts/sish/svc.yaml diff --git a/apps/cert-manager.yaml b/apps/cert-manager.yaml index 07d734c..1975175 100644 --- a/apps/cert-manager.yaml +++ b/apps/cert-manager.yaml @@ -22,26 +22,61 @@ spec: valuesObject: crds: enabled: true ---- -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt -spec: - acme: - email: zoe.roux@zoriya.dev - profile: tlsserver - server: https://acme-v02.api.letsencrypt.org/directory - privateKeySecretRef: - name: lets-encrypt-pk - solvers: - - http01: - ingress: - ingressClassName: cilium ---- -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: selfsigned -spec: - selfSigned: {} + extraObjects: + - apiVersion: cert-manager.io/v1 + kind: ClusterIssuer + metadata: + name: letsencrypt + spec: + acme: + email: zoe.roux@zoriya.dev + profile: tlsserver + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: lets-encrypt-pk + solvers: + - http01: + ingress: + ingressClassName: cilium + - apiVersion: cert-manager.io/v1 + kind: ClusterIssuer + metadata: + name: selfsigned + spec: + selfSigned: {} + - apiVersion: cert-manager.io/v1 + kind: ClusterIssuer + metadata: + name: letsencrypt-dns + spec: + acme: + email: zoe.roux@zoriya.dev + profile: tlsserver + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: lets-encrypt-dns-pk + solvers: + - selector: + dnsZones: + - sdg.moe + dns01: + cloudflare: + apiTokenSecretRef: + name: cloudflare-api-token + key: api-token + - apiVersion: external-secrets.io/v1 + kind: ExternalSecret + metadata: + name: cloudflare-api-token + namespace: cert-manager + spec: + refreshInterval: 24h + secretStoreRef: + name: bitwarden + kind: ClusterSecretStore + target: + name: cloudflare-api-token + data: + - secretKey: api-token + remoteRef: + key: cloudflare-api-token diff --git a/apps/sish.yaml b/apps/sish.yaml new file mode 100644 index 0000000..fddd683 --- /dev/null +++ b/apps/sish.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: sish + namespace: argocd +spec: + project: default + destination: + server: https://kubernetes.default.svc + namespace: sish + syncPolicy: + automated: + prune: true + selfHeal: false + syncOptions: + - CreateNamespace=true + source: + repoURL: https://github.com/zoriya/snow + targetRevision: HEAD + path: charts/sish diff --git a/charts/sish/certificate.yaml b/charts/sish/certificate.yaml new file mode 100644 index 0000000..f3972e6 --- /dev/null +++ b/charts/sish/certificate.yaml @@ -0,0 +1,12 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: sish-tls +spec: + secretName: sish-tls + dnsNames: + - "*.tun.sdg.moe" + issuerRef: + name: letsencrypt-dns + kind: ClusterIssuer + group: cert-manager.io diff --git a/charts/sish/deploy.yaml b/charts/sish/deploy.yaml new file mode 100644 index 0000000..80d50a3 --- /dev/null +++ b/charts/sish/deploy.yaml @@ -0,0 +1,39 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: sish +spec: + replicas: 1 + strategy: + type: Recreate + template: + spec: + containers: + - name: sish + image: antoniomika/sish:v2.23.0 + args: + - --ssh-address=:22 + - --http-address=:80 + - --domain=tun.sdg.moe + - --authentication=true + - --authentication-keys-directory=/pubkeys + - --private-keys-directory=/keys + - --bind-random-subdomains=false + - --bind-random-ports=false + ports: + - name: ssh + containerPort: 22 + - name: http + containerPort: 80 + volumeMounts: + - name: keys + mountPath: /keys + - name: pubkeys + mountPath: /pubkeys + volumes: + - name: keys + persistentVolumeClaim: + claimName: sish-keys + - name: pubkeys + configMap: + name: sish-pubkeys diff --git a/charts/sish/ingress.yaml b/charts/sish/ingress.yaml new file mode 100644 index 0000000..d13eefa --- /dev/null +++ b/charts/sish/ingress.yaml @@ -0,0 +1,21 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: sish +spec: + ingressClassName: cilium + rules: + - host: "*.tun.sdg.moe" + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: sish-http + port: + name: http + tls: + - hosts: + - "*.tun.sdg.moe" + secretName: sish-tls diff --git a/charts/sish/kustomization.yaml b/charts/sish/kustomization.yaml new file mode 100644 index 0000000..cfad306 --- /dev/null +++ b/charts/sish/kustomization.yaml @@ -0,0 +1,15 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +labels: + - includeSelectors: true + pairs: + apps.kubernetes.io/name: sish + +resources: + - ./deploy.yaml + - ./svc.yaml + - ./ingress.yaml + - ./certificate.yaml + - ./pubkeys.yaml + - ./pvc.yaml diff --git a/charts/sish/pubkeys.yaml b/charts/sish/pubkeys.yaml new file mode 100644 index 0000000..807aa75 --- /dev/null +++ b/charts/sish/pubkeys.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: sish-pubkeys +data: + zoriya.pub: | + ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDGcLP/ZEjnSgkzQMBeLLOWn5uejSr9Gg1h9PJZECVTLm+VDQ7KyI3ORZt+qbfEnsnGL73iwcAqB5Upy9Cdj0182mnrTk2ZViNMeFT7kLBF0yXpiajQTtMjENYj0nbNWpQ5+sJrtJKKYK/tBghW8PyTrJPpVQcrLcf4D66U5DkkJNRDeu4v9SjHKaASUeyia4gRSVV59Ugtrl0lz8sl4yBSL4957zwzdkNR0pVmftaKmUP4KfBvpNcFOOpHcdvzDtEPQs8j0g2l65YOQNNFSMsYQfxt1X4zmEi4unRIlECglaPz12CyoTiM2xmCWa/mS5nm0dR1VbEHFMRtGbbgm9MwedXoxYAfycbu08fqi1AAvg7MQxDNLfWWBIHe7+imGLKrVkqk8B89I409iI4YiOytnUkxKZkxynqVYtEE0bx5J15mniq2vJTw9JD89qSVkvGjZNGuJgh4leIlxPGj4iP8KY3N3Ifaf72PsmmwW4rB5JPDW93RL1DZV8lk3NgyF8M= + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBzfKjYeQ80s/M+qEKCxBhseJjLa2OwBk9ZrHeku90Vg + ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq7uaYigZWAhk/EIn9SHd6mhWJHtYPRFCUlpYwGSG6SDW2Ef0epsYJL2hBuMhhmhOvmpzzKiP83hZjNXchq8u7xcAhLsCPdPXhrQ4kOScJaeLuoxyY/7wiOqTSvSwz/N2s9tdNNcOLLUAset1Kvyp1OPBkEuXbIFfRGGqwAwcS2YYimlHf9mpcg/tZujBYQHIetHQkMaO+P0h+vMjVHBBcFLcsao+1QsVjoQnZOE96QTf2Oc66SxDBXnyS+1y1OnlWAEslSDL9AXVl6wF4O1JBWcsKNk+X4ShaaJMFRiPJEDQKSqRMKXWflkdFe1vNQ0bSiA6TLeH1lPeT8PXye2sUhu/DhpEswB7sV9YPpiP216QGsVM/2MepjCRq2sdr4EZ/17tubYdNcO8PkhVlQWOhHWXvIwIrvAzOVG1l9laAL1mxAY2iQLLN/gHGFPuiLcZCBem2LrDLQ7Ny+rDYQe4jZMEX4NYzNgNbHPk1ecwj/fqeLM4Qn+TkQgUL/kSM3ZU= diff --git a/charts/sish/pvc.yaml b/charts/sish/pvc.yaml new file mode 100644 index 0000000..99cc05a --- /dev/null +++ b/charts/sish/pvc.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: sish-keys +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 128Mi + storageClassName: openebs-zfs-tank diff --git a/charts/sish/svc.yaml b/charts/sish/svc.yaml new file mode 100644 index 0000000..d8aae00 --- /dev/null +++ b/charts/sish/svc.yaml @@ -0,0 +1,23 @@ +apiVersion: v1 +kind: Service +metadata: + name: sish-http +spec: + type: ClusterIP + ports: + - name: http + port: 80 + targetPort: http +--- +apiVersion: v1 +kind: Service +metadata: + name: sish-ssh + annotations: + lbipam.cilium.io/ips: 192.168.1.202 +spec: + type: LoadBalancer + ports: + - name: ssh + port: 22 + targetPort: ssh