diff --git a/devbox.json b/devbox.json index 41d89c9ab..e9a5240da 100644 --- a/devbox.json +++ b/devbox.json @@ -3,12 +3,13 @@ "renovate@43.150.1", "talosctl@1.13.0", "opencode@1.15.5", - "claude-code@2.1.143" + "claude-code@2.1.143", + "opencloud@latest" ], "env": { - "ANTHROPIC_API_KEY": "aaa", + "ANTHROPIC_API_KEY": "aaa", "ANTHROPIC_BASE_URL": "http://10.0.0.190:32434/", - "KUBECONFIG": "./kubeconfig" + "KUBECONFIG": "./kubeconfig" }, "shell": { "init_hook": [ diff --git a/gitops/argocd/base/apps.yaml b/gitops/argocd/base/apps.yaml index 510e68130..718a83fdc 100644 --- a/gitops/argocd/base/apps.yaml +++ b/gitops/argocd/base/apps.yaml @@ -90,7 +90,7 @@ spec: project: apps source: repoURL: https://github.com/thomasbuchinger/prod-gitops - targetRevision: feat-opencloud + targetRevision: main path: '{{path}}' destination: server: https://kubernetes.default.svc diff --git a/gitops/matrix/httproute.yaml b/gitops/matrix/httproute.yaml index f3aad5c0d..96da03f81 100644 --- a/gitops/matrix/httproute.yaml +++ b/gitops/matrix/httproute.yaml @@ -117,30 +117,30 @@ spec: value: / ---- -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: admin-matrix-cloud-buc-sh -spec: - parentRefs: - - group: gateway.networking.k8s.io - kind: Gateway - name: external-gateway - namespace: external-gateway - hostnames: - - "admin-matrix.cloud.buc.sh" - rules: - - backendRefs: - - group: "" - kind: Service - name: matrix-element-admin - port: 8080 - weight: 1 - matches: - - path: - type: PathPrefix - value: / +# --- +# apiVersion: gateway.networking.k8s.io/v1 +# kind: HTTPRoute +# metadata: +# name: admin-matrix-cloud-buc-sh +# spec: +# parentRefs: +# - group: gateway.networking.k8s.io +# kind: Gateway +# name: external-gateway +# namespace: external-gateway +# hostnames: +# - "admin-matrix.cloud.buc.sh" +# rules: +# - backendRefs: +# - group: "" +# kind: Service +# name: matrix-element-admin +# port: 8080 +# weight: 1 +# matches: +# - path: +# type: PathPrefix +# value: / --- apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute @@ -203,9 +203,67 @@ spec: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: - name: allow-all-within-namespace + name: matrix-authentication-service +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: matrix-authentication-service + policyTypes: + - Ingress + - Egress + # Allow DNS Resolution + egress: + # Allow DNS Resolution + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + - podSelector: + matchLabels: + k8s-app: kube-dns + ports: + - protocol: UDP + port: 53 + - protocol: TCP + port: 53 + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: matrix + # public IP block + - to: + - ipBlock: + cidr: 188.20.0.0/14 + ports: + - protocol: TCP + port: 443 + ingress: + # Allow Ingress + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: matrix + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: external-gateway + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: monitoring + + +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: matrix-rtc-authorization spec: - podSelector: {} + podSelector: + matchLabels: + app.kubernetes.io/name: matrix-rtc-authorisation-service policyTypes: - Ingress - Egress @@ -246,6 +304,54 @@ spec: kubernetes.io/metadata.name: monitoring +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: matrix-rtc-sfu +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: matrix-rtc-sfu + policyTypes: + - Ingress + - Egress + # Allow DNS Resolution + egress: + # Allow DNS Resolution + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: kube-system + - podSelector: + matchLabels: + k8s-app: kube-dns + ports: + - protocol: UDP + port: 53 + - protocol: TCP + port: 53 + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: matrix + ingress: + # Allow Ingress + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: matrix + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: external-gateway + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: monitoring + --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy @@ -286,6 +392,34 @@ spec: ports: - port: 8971 protocol: TCP + - to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: matrix + # Allow access to matrix.org for push notifications + - to: + - ipBlock: + cidr: 172.66.135.3/32 + - ipBlock: + cidr: 172.66.139.239/32 + ports: + - port: 443 + ingress: + # Allow Ingress + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: matrix + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: traefik + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: external-gateway + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: monitoring # # Allow Access to the Internet, but block internal Access # - to: diff --git a/gitops/opencloud/app.yaml b/gitops/opencloud/app.yaml new file mode 100644 index 000000000..31f7e60c8 --- /dev/null +++ b/gitops/opencloud/app.yaml @@ -0,0 +1,333 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: config + namespace: opencloud +data: + # enable services that are not started automatically + # OC_ADD_RUN_SERVICES: ${START_ADDITIONAL_SERVICES} + OC_URL: http://docs.10.0.0.21.nip.io + OC_LOG_LEVEL: info + OC_LOG_COLOR: "false" + OC_LOG_PRETTY: "true" + # do not use SSL between the reverse proxy and OpenCloud + PROXY_TLS: "false" + # INSECURE: needed if OpenCloud / reverse proxy is using self generated certificates + OC_INSECURE: "true" + # basic auth (not recommended, but needed for eg. WebDav clients that do not support OpenID Connect) + # PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-false}" + # demo users + # IDM_CREATE_DEMO_USERS: "${DEMO_USERS:-false}" + # admin password + IDM_ADMIN_PASSWORD: "changeme" + # email server (if configured) + # NOTIFICATIONS_SMTP_HOST: "${SMTP_HOST}" + # NOTIFICATIONS_SMTP_PORT: "${SMTP_PORT}" + # NOTIFICATIONS_SMTP_SENDER: "${SMTP_SENDER:-OpenCloud Notifications }" + # NOTIFICATIONS_SMTP_USERNAME: "${SMTP_USERNAME}" + # NOTIFICATIONS_SMTP_PASSWORD: "${SMTP_PASSWORD}" + # NOTIFICATIONS_SMTP_INSECURE: "${SMTP_INSECURE:-false}" + # NOTIFICATIONS_SMTP_AUTHENTICATION: "${SMTP_AUTHENTICATION}" + # NOTIFICATIONS_SMTP_ENCRYPTION: "${SMTP_TRANSPORT_ENCRYPTION:-none}" + # FRONTEND_ARCHIVER_MAX_SIZE: "10000000000" + # FRONTEND_CHECK_FOR_UPDATES: "${CHECK_FOR_UPDATES:-true}" + # PROXY_CSP_CONFIG_FILE_LOCATION: /etc/opencloud/csp.yaml + # enable to allow using the banned passwords list + # OC_PASSWORD_POLICY_BANNED_PASSWORDS_LIST: banned-password-list.txt + # control the password enforcement and policy for public shares + # OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD: "${OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD:-true}" + # OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD: "${OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD:-false}" + # OC_PASSWORD_POLICY_DISABLED: "${OC_PASSWORD_POLICY_DISABLED:-false}" + # OC_PASSWORD_POLICY_MIN_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_CHARACTERS:-8}" + # OC_PASSWORD_POLICY_MIN_LOWERCASE_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_LOWERCASE_CHARACTERS:-1}" + # OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS:-1}" + # OC_PASSWORD_POLICY_MIN_DIGITS: "${OC_PASSWORD_POLICY_MIN_DIGITS:-1}" + # OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS:-1}" + # default language for services/WebUI; defaults to English, language code (ISO 639-1, e.g. de, en, fr) + OC_DEFAULT_LANGUAGE: de # en + + + + + + opencloud.yaml: |- + token_manager: + jwt_secret: 2wszRp+Y-N4*Gubc*JmE$Q3!E$Aa!cL! + machine_auth_api_key: Q!=Wo1avR^hF1nKIOp.g+tf-wkSXN3f% + system_user_api_key: dIfwV#IaB+u$DcC6^@+NvM2ItC+6dw@% + transfer_secret: m=9j#%wU8dVNVkRsR.6*8@p6zv.P#2HH + url_signing_secret: A.urz%0rGZV3UuuVEc^TxXWEi5T@x%u3 + system_user_id: 647c1d64-e232-441e-92a8-29fdd3efd863 + admin_user_id: 5c92695d-0976-433d-8153-9d40f980a98f + graph: + application: + id: fa106767-d322-4aec-9fa0-e467e56464bd + events: + tls_insecure: false + spaces: + insecure: false + identity: + ldap: + bind_password: ^YRg.IaPoA%*rYqCnQa%KeiwhWmmSs.l + service_account: + service_account_id: 8b2c1ea4-080a-4eff-8d4e-4da709606338 + service_account_secret: '*YEmxnwPw3$$$n+c^ZIZ&x%U%QVl30=6' + idp: + ldap: + bind_password: Rgn&ov.sc@2B+qjmQ-%$XC7B^ypwdc*S + idm: + service_user_passwords: + idm_password: ^YRg.IaPoA%*rYqCnQa%KeiwhWmmSs.l + reva_password: zX8nW!B$Akdglvb#KnxDE&I@hwRKTf5N + idp_password: Rgn&ov.sc@2B+qjmQ-%$XC7B^ypwdc*S + collaboration: + wopi: + secret: fpr!VCOUiU80.=41TXTCRAUoCL7teZ*$ + app: + insecure: false + proxy: + oidc: + insecure: false + insecure_backends: false + service_account: + service_account_id: 8b2c1ea4-080a-4eff-8d4e-4da709606338 + service_account_secret: '*YEmxnwPw3$$$n+c^ZIZ&x%U%QVl30=6' + frontend: + app_handler: + insecure: false + archiver: + insecure: false + service_account: + service_account_id: 8b2c1ea4-080a-4eff-8d4e-4da709606338 + service_account_secret: '*YEmxnwPw3$$$n+c^ZIZ&x%U%QVl30=6' + ocdav: + insecure: false + auth_basic: + auth_providers: + ldap: + bind_password: zX8nW!B$Akdglvb#KnxDE&I@hwRKTf5N + auth_bearer: + auth_providers: + oidc: + insecure: false + users: + drivers: + ldap: + bind_password: zX8nW!B$Akdglvb#KnxDE&I@hwRKTf5N + groups: + drivers: + ldap: + bind_password: zX8nW!B$Akdglvb#KnxDE&I@hwRKTf5N + ocm: + service_account: + service_account_id: 8b2c1ea4-080a-4eff-8d4e-4da709606338 + service_account_secret: '*YEmxnwPw3$$$n+c^ZIZ&x%U%QVl30=6' + thumbnails: + thumbnail: + transfer_secret: YgSin&P!V$S.b#$lri&KoMmUBau@QP%K + webdav_allow_insecure: false + cs3_allow_insecure: false + search: + events: + tls_insecure: false + service_account: + service_account_id: 8b2c1ea4-080a-4eff-8d4e-4da709606338 + service_account_secret: '*YEmxnwPw3$$$n+c^ZIZ&x%U%QVl30=6' + audit: + events: + tls_insecure: false + settings: + service_account_ids: + - 8b2c1ea4-080a-4eff-8d4e-4da709606338 + sharing: + events: + tls_insecure: false + service_account: + service_account_id: 8b2c1ea4-080a-4eff-8d4e-4da709606338 + service_account_secret: '*YEmxnwPw3$$$n+c^ZIZ&x%U%QVl30=6' + storage_users: + events: + tls_insecure: false + mount_id: 6918073e-2b8a-407d-9d53-20070be75153 + service_account: + service_account_id: 8b2c1ea4-080a-4eff-8d4e-4da709606338 + service_account_secret: '*YEmxnwPw3$$$n+c^ZIZ&x%U%QVl30=6' + notifications: + notifications: + events: + tls_insecure: false + service_account: + service_account_id: 8b2c1ea4-080a-4eff-8d4e-4da709606338 + service_account_secret: '*YEmxnwPw3$$$n+c^ZIZ&x%U%QVl30=6' + nats: + nats: + tls_skip_verify_client_cert: false + gateway: + storage_registry: + storage_users_mount_id: 6918073e-2b8a-407d-9d53-20070be75153 + userlog: + service_account: + service_account_id: 8b2c1ea4-080a-4eff-8d4e-4da709606338 + service_account_secret: '*YEmxnwPw3$$$n+c^ZIZ&x%U%QVl30=6' + auth_service: + service_account: + service_account_id: 8b2c1ea4-080a-4eff-8d4e-4da709606338 + service_account_secret: '*YEmxnwPw3$$$n+c^ZIZ&x%U%QVl30=6' + clientlog: + service_account: + service_account_id: 8b2c1ea4-080a-4eff-8d4e-4da709606338 + service_account_secret: '*YEmxnwPw3$$$n+c^ZIZ&x%U%QVl30=6' + activitylog: + service_account: + service_account_id: 8b2c1ea4-080a-4eff-8d4e-4da709606338 + service_account_secret: '*YEmxnwPw3$$$n+c^ZIZ&x%U%QVl30=6' + +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: opencloud + namespace: opencloud +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app.kubernetes.io/name: opencloud + template: + metadata: + labels: + app.kubernetes.io/name: opencloud + spec: + containers: + - name: opencloud + image: opencloudeu/opencloud-rolling:latest + ports: + - name: http + containerPort: 9200 + envFrom: + - configMapRef: + name: config + securityContext: + capabilities: + drop: + - ALL + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + privileged: false + readOnlyRootFilesystem: true + volumeMounts: + - name: opencloud-data + mountPath: /var/lib/opencloud + - name: opencloud-config + mountPath: /etc/opencloud + # subPath: opencloud.yaml + volumes: + - name: opencloud-data + emptyDir: {} + # persistentVolumeClaim: + # claimName: opencloud-pvc + - name: opencloud-config + configMap: + name: config + +--- +apiVersion: v1 +kind: Service +metadata: + name: opencloud + namespace: opencloud +spec: + selector: + app.kubernetes.io/name: opencloud + ports: + - name: http + protocol: TCP + port: 9200 + targetPort: 9200 + - name: collabora-http + protocol: TCP + port: 9300 + targetPort: 9300 + - name: collabora-grpc + protocol: TCP + port: 9301 + targetPort: 9301 + type: ClusterIP + +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: opencloud-ingress + namespace: opencloud +spec: + tls: + - hosts: + - docs.buc.sh + secretName: cert-docs-buc-sh + rules: + - host: docs.buc.sh + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: opencloud + port: + name: http +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: opencloud-http + namespace: opencloud +spec: + rules: + - host: docs.10.0.0.21.nip.io + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: opencloud + port: + name: http + - host: office.10.0.0.21.nip.io + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: opencloud + port: + name: http + - host: docs.10.0.0.21.nip.io + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: opencloud + port: + name: http +# --- +# apiVersion: v1 +# kind: PersistentVolumeClaim +# metadata: +# name: opencloud-pvc +# namespace: opencloud +# spec: +# accessModes: +# - ReadWriteOnce +# resources: +# requests: +# storage: 10Gi + diff --git a/gitops/opencloud/kustomization.yaml b/gitops/opencloud/kustomization.yaml index e69de29bb..61d0861cc 100644 --- a/gitops/opencloud/kustomization.yaml +++ b/gitops/opencloud/kustomization.yaml @@ -0,0 +1,3 @@ + +resources: +- app.yaml \ No newline at end of file diff --git a/talos/talos-merge.yaml b/talos/talos-merge.yaml index 0566955cc..3168bde8a 100644 --- a/talos/talos-merge.yaml +++ b/talos/talos-merge.yaml @@ -19,6 +19,7 @@ machine: - device: /dev/vdb partitions: - mountpoint: /var/lib/local-path-provisioner + kubelet: extraArgs: rotate-server-certificates: true