diff --git a/.gitignore b/.gitignore index 9f9e64f..a594a2c 100644 --- a/.gitignore +++ b/.gitignore @@ -108,3 +108,4 @@ fabric.properties # All secrets are SealedSecrets — safe to commit # kustomization.yaml and *.yaml are tracked; raw *.yml files are not secrets/**/*.yml +/scripts/sealed-secrets-key-backup.yaml diff --git a/Passwords.kdbx b/Passwords.kdbx old mode 100755 new mode 100644 index 6723c5b..2841000 Binary files a/Passwords.kdbx and b/Passwords.kdbx differ diff --git a/cert-manager/htwg-1/cert-issuer.yaml b/cert-manager/htwg-1/cert-issuer.yaml new file mode 100644 index 0000000..d61870c --- /dev/null +++ b/cert-manager/htwg-1/cert-issuer.yaml @@ -0,0 +1,6 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: selfsigned-ca +spec: + selfSigned: {} diff --git a/cert-manager/htwg-1/kustomization.yaml b/cert-manager/htwg-1/kustomization.yaml new file mode 100644 index 0000000..18dc29f --- /dev/null +++ b/cert-manager/htwg-1/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - cert-issuer.yaml diff --git a/htwg-1/flux-apps/argo-rollouts.yaml b/htwg-1/flux-apps/argo-rollouts.yaml new file mode 100644 index 0000000..3cd4a7c --- /dev/null +++ b/htwg-1/flux-apps/argo-rollouts.yaml @@ -0,0 +1,22 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: argo-rollouts + namespace: kube-system +spec: + interval: 1h + chart: + spec: + chart: argo-rollouts + version: "2.40.10" + sourceRef: + kind: HelmRepository + name: argo + namespace: flux-system + values: + installCRDs: true + clusterInstall: true + controller: + replicas: 1 + dashboard: + enabled: false diff --git a/htwg-1/flux-apps/cert-manager.yaml b/htwg-1/flux-apps/cert-manager.yaml new file mode 100644 index 0000000..1ea8602 --- /dev/null +++ b/htwg-1/flux-apps/cert-manager.yaml @@ -0,0 +1,35 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: cert-manager + namespace: cert-manager +spec: + interval: 1h + chart: + spec: + chart: cert-manager + version: "1.20.2" + sourceRef: + kind: HelmRepository + name: cert-manager + namespace: flux-system + values: + crds: + enabled: true +--- +# ClusterIssuer is applied after cert-manager CRDs exist; FluxCD retries on failure +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: cert-issuer + namespace: flux-system +spec: + interval: 2m + retryInterval: 1m + sourceRef: + kind: GitRepository + name: gitops + namespace: flux-system + path: ./cert-manager/htwg-1 + prune: true + timeout: 2m diff --git a/htwg-1/flux-apps/gitrepository.yaml b/htwg-1/flux-apps/gitrepository.yaml new file mode 100644 index 0000000..d31fd0e --- /dev/null +++ b/htwg-1/flux-apps/gitrepository.yaml @@ -0,0 +1,12 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: GitRepository +metadata: + name: gitops + namespace: flux-system +spec: + interval: 1m + url: ssh://git@git.janis-eccarius.de/NowChess/GitOps.git + ref: + branch: main + secretRef: + name: gitops-ssh diff --git a/htwg-1/flux-apps/ingress-nginx.yaml b/htwg-1/flux-apps/ingress-nginx.yaml new file mode 100644 index 0000000..22fd2f2 --- /dev/null +++ b/htwg-1/flux-apps/ingress-nginx.yaml @@ -0,0 +1,20 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: ingress-nginx + namespace: ingress-nginx +spec: + interval: 1h + chart: + spec: + chart: ingress-nginx + version: "4.15.1" + sourceRef: + kind: HelmRepository + name: ingress-nginx + namespace: flux-system + values: + controller: + service: + type: LoadBalancer + externalTrafficPolicy: Cluster diff --git a/htwg-1/flux-apps/kustomization.yaml b/htwg-1/flux-apps/kustomization.yaml new file mode 100644 index 0000000..c486311 --- /dev/null +++ b/htwg-1/flux-apps/kustomization.yaml @@ -0,0 +1,15 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - gitrepository.yaml + - namespaces.yaml + - sources.yaml + - cert-manager.yaml + - ingress-nginx.yaml + - sealed-secrets.yaml + - metrics-server.yaml + - redis.yaml + - argo-rollouts.yaml + - nowchess.yaml + - postgres-tunnel.yaml + - secrets.yaml diff --git a/htwg-1/flux-apps/metrics-server.yaml b/htwg-1/flux-apps/metrics-server.yaml new file mode 100644 index 0000000..51c298a --- /dev/null +++ b/htwg-1/flux-apps/metrics-server.yaml @@ -0,0 +1,27 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: metrics-server + namespace: kube-system +spec: + interval: 1h + chart: + spec: + chart: metrics-server + version: "3.13.0" + sourceRef: + kind: HelmRepository + name: metrics-server + namespace: flux-system + values: + resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 100m + memory: 128Mi + metrics: + enabled: true + serviceMonitor: + enabled: false diff --git a/htwg-1/flux-apps/namespaces.yaml b/htwg-1/flux-apps/namespaces.yaml new file mode 100644 index 0000000..6e3e40b --- /dev/null +++ b/htwg-1/flux-apps/namespaces.yaml @@ -0,0 +1,24 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: nowchess +--- +apiVersion: v1 +kind: Namespace +metadata: + name: redis +--- +apiVersion: v1 +kind: Namespace +metadata: + name: postgres-tunnel +--- +apiVersion: v1 +kind: Namespace +metadata: + name: cert-manager +--- +apiVersion: v1 +kind: Namespace +metadata: + name: ingress-nginx diff --git a/htwg-1/flux-apps/nowchess.yaml b/htwg-1/flux-apps/nowchess.yaml new file mode 100644 index 0000000..d2792f0 --- /dev/null +++ b/htwg-1/flux-apps/nowchess.yaml @@ -0,0 +1,16 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: nowchess + namespace: flux-system +spec: + interval: 10m + retryInterval: 2m + sourceRef: + kind: GitRepository + name: gitops + namespace: flux-system + path: ./nowchess/htwg-1-prod + prune: true + targetNamespace: nowchess + timeout: 5m diff --git a/htwg-1/flux-apps/postgres-tunnel.yaml b/htwg-1/flux-apps/postgres-tunnel.yaml new file mode 100644 index 0000000..5b473e2 --- /dev/null +++ b/htwg-1/flux-apps/postgres-tunnel.yaml @@ -0,0 +1,15 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: postgres-tunnel + namespace: flux-system +spec: + interval: 10m + retryInterval: 2m + sourceRef: + kind: GitRepository + name: gitops + namespace: flux-system + path: ./postgres-tunnel/htwg-1 + prune: true + timeout: 3m diff --git a/htwg-1/flux-apps/redis.yaml b/htwg-1/flux-apps/redis.yaml new file mode 100644 index 0000000..4272aa6 --- /dev/null +++ b/htwg-1/flux-apps/redis.yaml @@ -0,0 +1,33 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: redis + namespace: redis +spec: + interval: 1h + chart: + spec: + chart: redis + version: "20.x" + sourceRef: + kind: HelmRepository + name: bitnami + namespace: flux-system + values: + architecture: standalone + auth: + enabled: false + image: + registry: docker.io + repository: redis + tag: "8.6.2-trixie" + master: + resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 200m + memory: 128Mi + persistence: + enabled: false diff --git a/htwg-1/flux-apps/sealed-secrets.yaml b/htwg-1/flux-apps/sealed-secrets.yaml new file mode 100644 index 0000000..1f92998 --- /dev/null +++ b/htwg-1/flux-apps/sealed-secrets.yaml @@ -0,0 +1,17 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: sealed-secrets + namespace: kube-system +spec: + interval: 1h + chart: + spec: + chart: sealed-secrets + version: "2.16.1" + sourceRef: + kind: HelmRepository + name: sealed-secrets + namespace: flux-system + values: + fullnameOverride: sealed-secrets diff --git a/htwg-1/flux-apps/secrets.yaml b/htwg-1/flux-apps/secrets.yaml new file mode 100644 index 0000000..a3ba062 --- /dev/null +++ b/htwg-1/flux-apps/secrets.yaml @@ -0,0 +1,15 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: secrets + namespace: flux-system +spec: + interval: 10m + retryInterval: 2m + sourceRef: + kind: GitRepository + name: gitops + namespace: flux-system + path: ./secrets/htwg-1 + prune: true + timeout: 3m diff --git a/htwg-1/flux-apps/sources.yaml b/htwg-1/flux-apps/sources.yaml new file mode 100644 index 0000000..cd8a693 --- /dev/null +++ b/htwg-1/flux-apps/sources.yaml @@ -0,0 +1,53 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: cert-manager + namespace: flux-system +spec: + interval: 12h + url: https://charts.jetstack.io +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: ingress-nginx + namespace: flux-system +spec: + interval: 12h + url: https://kubernetes.github.io/ingress-nginx +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: sealed-secrets + namespace: flux-system +spec: + interval: 12h + url: https://bitnami-labs.github.io/sealed-secrets +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: metrics-server + namespace: flux-system +spec: + interval: 12h + url: https://kubernetes-sigs.github.io/metrics-server/ +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: bitnami + namespace: flux-system +spec: + interval: 12h + url: https://charts.bitnami.com/bitnami +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: argo + namespace: flux-system +spec: + interval: 12h + url: https://argoproj.github.io/argo-helm diff --git a/htwg-1/flux-system/kustomization.yaml b/htwg-1/flux-system/kustomization.yaml new file mode 100644 index 0000000..a4dd62f --- /dev/null +++ b/htwg-1/flux-system/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +# gotk-components.yaml is generated by: flux install --export > gotk-components.yaml +resources: + - gotk-components.yaml diff --git a/htwg-1/root-ks.yaml b/htwg-1/root-ks.yaml new file mode 100644 index 0000000..797e622 --- /dev/null +++ b/htwg-1/root-ks.yaml @@ -0,0 +1,15 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: flux-apps + namespace: flux-system +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: gitops + namespace: flux-system + path: ./htwg-1/flux-apps + prune: true + wait: true + timeout: 5m diff --git a/nowchess/htwg-1-prod/ingress.yaml b/nowchess/htwg-1-prod/ingress.yaml new file mode 100644 index 0000000..62ada79 --- /dev/null +++ b/nowchess/htwg-1-prod/ingress.yaml @@ -0,0 +1,62 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: nowchess-ingress + annotations: + nginx.ingress.kubernetes.io/ssl-redirect: "false" + nginx.ingress.kubernetes.io/backend-protocol: "HTTP" + nginx.ingress.kubernetes.io/use-regex: "true" +spec: + ingressClassName: nginx + rules: + - http: + paths: + - path: /api/board/game/[A-Za-z0-9]{8}/ws + pathType: ImplementationSpecific + backend: + service: + name: nowchess-ws-active + port: + number: 8084 + - path: /api/user/ws + pathType: ImplementationSpecific + backend: + service: + name: nowchess-ws-active + port: + number: 8084 + - path: /api/account + pathType: Prefix + backend: + service: + name: nowchess-account-active + port: + number: 8083 + - path: /api/challenge + pathType: Prefix + backend: + service: + name: nowchess-account-active + port: + number: 8083 + - path: /api/store + pathType: Prefix + backend: + service: + name: nowchess-store-active + port: + number: 8085 + - path: /api + pathType: Prefix + backend: + service: + name: nowchess-core-active + port: + number: 8080 + - path: / + pathType: Prefix + backend: + service: + name: nowchess-frontend-active + port: + number: 80 diff --git a/nowchess/htwg-1-prod/kustomization.yaml b/nowchess/htwg-1-prod/kustomization.yaml new file mode 100644 index 0000000..7638894 --- /dev/null +++ b/nowchess/htwg-1-prod/kustomization.yaml @@ -0,0 +1,53 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: nowchess +resources: + - ../base + - ingress.yaml +patches: + - patch: |- + apiVersion: v1 + kind: ConfigMap + metadata: + name: nowchess-env-config + data: + QUARKUS_PROFILE: deployed + CORS_ORIGINS: http://141.37.74.142 + NOWCHESS_COORDINATOR_ENABLED: "false" + REDIS_PREFIX: nowchess + QUARKUS_LOG_LEVEL: "WARN" + target: + kind: ConfigMap + name: nowchess-env-config + - patch: |- + apiVersion: v1 + kind: ConfigMap + metadata: + name: nowchess-frontend-env-config + data: + API_URL: "http://141.37.74.142" + WEBSOCKET_URL: "ws://141.37.74.142" + target: + kind: ConfigMap + name: nowchess-frontend-env-config +images: + - name: ghcr.io/now-chess/now-chess-systems/account + newTag: 0.18.0 + - name: ghcr.io/now-chess/now-chess-systems/bot-platform + newTag: 0.11.0 + - name: ghcr.io/now-chess/now-chess-systems/coordinator + newTag: 0.32.0 + - name: ghcr.io/now-chess/now-chess-systems/core + newTag: 0.45.0 + - name: ghcr.io/now-chess/now-chess-systems/frontend + newTag: 0.2.4 + - name: ghcr.io/now-chess/now-chess-systems/io + newTag: 0.22.0 + - name: ghcr.io/now-chess/now-chess-systems/official-bots + newTag: 0.13.0 + - name: ghcr.io/now-chess/now-chess-systems/rule + newTag: 0.18.0 + - name: ghcr.io/now-chess/now-chess-systems/store + newTag: 0.22.0 + - name: ghcr.io/now-chess/now-chess-systems/ws + newTag: 0.14.0 diff --git a/postgres-tunnel/htwg-1/kustomization.yaml b/postgres-tunnel/htwg-1/kustomization.yaml new file mode 100644 index 0000000..7913d65 --- /dev/null +++ b/postgres-tunnel/htwg-1/kustomization.yaml @@ -0,0 +1,17 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../eu-central-1 +# Patch SSH_HOST if the postgres server is different for htwg-1: +# patches: +# - patch: |- +# apiVersion: v1 +# kind: ConfigMap +# metadata: +# name: postgres-tunnel-config +# namespace: postgres-tunnel +# data: +# SSH_HOST: "" +# target: +# kind: ConfigMap +# name: postgres-tunnel-config diff --git a/scripts/deploy-to-cluster-htwg-1.sh b/scripts/deploy-to-cluster-htwg-1.sh new file mode 100755 index 0000000..44572cc --- /dev/null +++ b/scripts/deploy-to-cluster-htwg-1.sh @@ -0,0 +1,164 @@ +#!/usr/bin/bash +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +REPO_ROOT="$(dirname "$SCRIPT_DIR")" + +# ---- + +generate_flux_manifests() { + clear + echo "----------------------------------------" + echo " ⌛ Generate FluxCD manifests" + echo " ⌛ Install FluxCD controllers" + echo " ⌛ Setup Sealed Secrets" + echo " ⌛ Apply Git source secret" + echo " ⌛ Bootstrap FluxCD" + echo "----------------------------------------" + + GOTK="$REPO_ROOT/htwg-1/flux-system/gotk-components.yaml" + if [[ -f "$GOTK" ]]; then + echo "✅ gotk-components.yaml already exists, skipping generation." + else + echo "🚀 Generating FluxCD controller manifests..." + flux install --export > "$GOTK" + echo "✅ Generated $GOTK" + echo "⚠️ Commit this file to the repository before continuing." + read -rp "Press Enter after committing gotk-components.yaml..." + fi +} + +# ---- + +install_flux() { + clear + echo "----------------------------------------" + echo " ✅ Generate FluxCD manifests" + echo " ⌛ Install FluxCD controllers" + echo " ⌛ Setup Sealed Secrets" + echo " ⌛ Apply Git source secret" + echo " ⌛ Bootstrap FluxCD" + echo "----------------------------------------" + + echo "🚀 Installing FluxCD controllers..." + kubectl apply -f "$REPO_ROOT/htwg-1/flux-system/gotk-components.yaml" + echo "⏳ Waiting for FluxCD controllers to be ready..." + kubectl -n flux-system rollout status deployment/source-controller --timeout=120s + kubectl -n flux-system rollout status deployment/kustomize-controller --timeout=120s + kubectl -n flux-system rollout status deployment/helm-controller --timeout=120s + echo "✅ FluxCD controllers ready!" +} + +# ---- + +setup_sealed_secrets() { + clear + echo "----------------------------------------" + echo " ✅ Generate FluxCD manifests" + echo " ✅ Install FluxCD controllers" + echo " ⌛ Setup Sealed Secrets" + echo " ⌛ Apply Git source secret" + echo " ⌛ Bootstrap FluxCD" + echo "----------------------------------------" + + echo "🔑 Restoring sealed-secrets key..." + read -rp "Path to sealed-secrets key backup (leave blank to skip — new key will be generated): " KEY_FILE + if [[ -n "$KEY_FILE" ]]; then + "$SCRIPT_DIR/sealed-secrets-key.sh" import "$KEY_FILE" + echo "✅ Sealed-secrets key imported." + else + echo "⚠️ Skipped. New sealed-secrets key will be generated after controller deploys." + echo "⚠️ All secrets in secrets/nowchess/htwg-1-prod/ and secrets/flux/ must be re-sealed with the new key." + fi + + # Install sealed-secrets now (before FluxCD bootstraps) so we can decrypt the gitops-ssh secret + echo "🚀 Installing sealed-secrets controller..." + kubectl apply -f "$REPO_ROOT/htwg-1/flux-apps/sealed-secrets.yaml" + echo "⏳ Waiting for sealed-secrets controller to be ready (this may take a few minutes)..." + kubectl -n kube-system wait helmrelease/sealed-secrets \ + --for=condition=ready --timeout=300s 2>/dev/null || \ + kubectl -n kube-system rollout status deployment/sealed-secrets --timeout=300s + echo "✅ Sealed-secrets controller ready!" +} + +# ---- + +apply_git_source_secret() { + clear + echo "----------------------------------------" + echo " ✅ Generate FluxCD manifests" + echo " ✅ Install FluxCD controllers" + echo " ✅ Setup Sealed Secrets" + echo " ⌛ Apply Git source secret" + echo " ⌛ Bootstrap FluxCD" + echo "----------------------------------------" + + echo "🔑 Applying gitops-ssh SealedSecret..." + GIT_SECRET="$REPO_ROOT/secrets/flux/gitops-ssh-htwg-1.yaml" + + if grep -q "REPLACE_WITH_SEALED_VALUE" "$GIT_SECRET"; then + echo "❌ $GIT_SECRET is a placeholder — seal it first:" + echo "" + echo " ssh-keygen -t ed25519 -f gitops-deploy-key -N \"\" -C \"flux-htwg-1\"" + echo " kubectl -n flux-system create secret generic gitops-ssh \\" + echo " --from-file=identity=./gitops-deploy-key \\" + echo " --from-literal=known_hosts=\"\$(ssh-keyscan -H git.janis-eccarius.de 2>/dev/null)\" \\" + echo " --dry-run=client -o yaml \\" + echo " | kubeseal --controller-namespace kube-system -o yaml > $GIT_SECRET" + echo "" + echo " Then add gitops-deploy-key.pub as a deploy key in Gitea:" + echo " https://git.janis-eccarius.de/NowChess/GitOps/settings/keys" + exit 1 + fi + + kubectl apply -f "$GIT_SECRET" + echo "✅ gitops-ssh secret applied and will be decrypted by sealed-secrets." +} + +# ---- + +bootstrap_flux() { + clear + echo "----------------------------------------" + echo " ✅ Generate FluxCD manifests" + echo " ✅ Install FluxCD controllers" + echo " ✅ Setup Sealed Secrets" + echo " ✅ Apply Git source secret" + echo " ⌛ Bootstrap FluxCD" + echo "----------------------------------------" + + echo "🚀 Applying GitRepository source..." + kubectl apply -f "$REPO_ROOT/htwg-1/flux-apps/gitrepository.yaml" + + echo "⏳ Waiting for GitRepository to be ready..." + kubectl -n flux-system wait gitrepository/gitops --for=condition=ready --timeout=120s + + echo "🚀 Applying root Kustomization..." + kubectl apply -f "$REPO_ROOT/htwg-1/root-ks.yaml" + + echo "✅ FluxCD bootstrap complete!" + echo "" + echo "FluxCD will now reconcile all components. Monitor with:" + echo " flux get kustomizations -A" + echo " flux get helmreleases -A" +} + +# ---- + +generate_flux_manifests +install_flux +setup_sealed_secrets +apply_git_source_secret +bootstrap_flux + +clear +echo "----------------------------------------" +echo " 🎉 htwg-1 cluster bootstrap complete!" +echo " 🎉 Cluster IP: 141.37.74.142" +echo " 🎉 NowChess: http://141.37.74.142" +echo "----------------------------------------" +echo "" +echo "Next steps:" +echo " 1. Seal secrets in secrets/nowchess/htwg-1-prod/ (if not done)" +echo " 2. Monitor reconciliation: flux get all -A" +echo " 3. Check NowChess pods: kubectl -n nowchess get pods" diff --git a/scripts/deploy-to-cluster.sh b/scripts/deploy-to-cluster.sh old mode 100644 new mode 100755 diff --git a/secrets/flux/gitops-ssh-htwg-1.yaml b/secrets/flux/gitops-ssh-htwg-1.yaml new file mode 100644 index 0000000..063d30f --- /dev/null +++ b/secrets/flux/gitops-ssh-htwg-1.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: gitops-ssh + namespace: flux-system +spec: + encryptedData: + identity: AgAOzHL/nvgowOSUS8s8OooQSxNrFEBHDZYca7VzfOJLlF+nehigNUS4GSqofRQBJObgPL51TfSyTVYN+Sg5Ddvq8+JKtySkjNil4MpgiT1LPpiL/PylKF3AZKqhpmvwzDxh0TiJFHijljW/YqbnuTo4y3TFs/PKFErrE5WCO/WufG5fEO6izEFnC4YsmD2DVrMewqn9UEokdxsj7IyMtY3hHMBnGoaLsMHeH6HpwWZ/75Di/Cf7Uwl1sEYesMfz21QOR33uGpmQmguIrwrL5A/FQCzMtldZD3fhbad1biqs/uXqn3im5p8o+CCj42dvHnp2wSB3TC78iwdvGGArwVRxh8+GuNAy448JBzh/HveUsrCnzyLKgBwCON8k2w83ZNr0JjoNCmL8MiA/WhVPmF+rj5b7BoBfQ+UZgb1w/Yfn8vD0j8O4D1GINVs8Us2SYsjJ75maBOyU8nOEHzl9ytEUFzCA5yCPslp6Btr41njIVV2G7obTE9hqReea1oIl0K9XxRm9etEIhfnNbPynXTMaHlIvkf1ufRpNH4F/lNVGuwHPLD+y4LXoydu7tr/glL+vKBN+diDKR7R8ilnLbkCNYJ1GELZfGyjeMG5mc/bwXod2BbKNjMVxxZIdw/CtVBTnJE+vGagofNsn/VlbS4iVbwAdAfSazYdTK/HxgmypjxoRGxPNoIdPrFLRL25/M8CcY1o0SUZg6eUtET1dbcw2Vd0lxm29TvKD8RKVsPahque7EVw1aVh5fUYBthbAZ7gzlWpbq/nEXPBQwQSL+yt/4C3hIzbZOV1WRtYpPJK3BrWILfPF1HBrdvSiDwm4H75mms8qon2qbmmeJo6LYQIgG949quUXSeA2Cz4licAQxA3jjDwefW+hsfb7zy9pS6yZscxkpRNb+HjGuIcjZzqT06oRQhslBNqX5CmXqf5ZLg9gfG1Dgq695HjDG+gdFuSdGiY6H/sqbLp9BVwBGMLnwa+iMu+L86R9Y1nI8Hel/nwB/KoeQBzXdVWE4Hf1am4J0soyPgHDClNYwMQO60rxXcD+HurrgZnUOFq281ba6DEHIzY6ymg5soWWlYJ6veck7FS1jaj8Ihbg8ydlMzjUBnBWk4ZKs1nI7vdfvbgTgpA9lxTIrdQRIXxx+o3uUawL6DaTOubTZhyExtn3zhidfHn+cshGSipvA+OZctJ0J9aoBQdWLkhqecUdCJFiwwLmjVbIk5yBEaLQuQB//cw= + known_hosts: AgB+ku9oRGCXi2OCTd8gY0QZ5P36YKb7cKL7sItNEvT2hKrD8DtF3eQK2vx4TXRsj8iuBnCTRu0m5ID+Rbi7I+mDQq2CZodpnIyu1iKIwx04xQROFPiKXQ6EFaEl94by6r5jn9cyCrkgG7HifNDD3Z1jXNPgWn94msNH++lA4oXhqzhCzN3sgWrcvEFDv7CizRZ4A2ARaL5pY6tDw7JnqejSsz+dwg6Ar9WlLPtJYAE5ZMtOE5M4tCUZ326z2waisjed86VbnORAX2uu1ARpnxg+jhtNni3Ixk4xZokzknvJfV9Kyq9wc94c2WzVs1MQjhl6IPoyALpii2VdvPqmIsmpLefmLPT1/8/NyHGzgwf6E8BUINr/TN9y2WjIu7/Y4NXlqPV0GI8bES3Y4U1h4yV3Sp6KifFPCUavx7a/D64j0CDC/ZlQglke+qVo6nFTEzgnBDLkaqPnN2Inl1KvhwdAvVCT5eUC12tdbfZ2A9uQIhT0k/A7cn30zcIA+LGT5JtKu9B69aElhDtrrpRksyJsclSzC2YTOSzHlavnaoOPqHM0ywSN5w3l9XIPiHyjKQNzWjzaWVkOq3MQbrPU3yM2zq20KqzIv1eBYstVie/u8yi6CDgumWPEYVzg0gAXlN+RZtoLBhbwrn1Bvlz8bsSYfggmjlFj4RUGkkRGliMbZsLkNGq4zca/437bqSB84oAt6l8lm4RezAg3ZOl9l8pAfmPxKTzy5r6YjQKdQ8lo8DKcjad49M/92fg5xbSfw7MqXclu+L5vPp1DrObueAG8j32xeOBn798ebWTccGag7/h8mwyLmQ6wWQ2SIyozNLWKFGUybZj6tb6vYQ9qW/c+KMXcexvkSMcEGYs+Dtk5KMOkBk/EkWLvbHrg+w2krL5V81WAyjJ7bYPKtArdagpd9c1pvQ6tXqWmqpPwWlDqpj5YmO8xH5LVtXoYPKuvk5qFrZJq1PpTU6zSozGWjOtiA+tNunZZQNOqqe1Q6SM5ZW/7YLTJpP2O5a0dih0X8kjFBbAVLdGQ5aDjnUGLUzWGb4imsNM+vknD9cPUfXv/3x/MY/xb8ghoGby2W5a6dZJO1GHquIfNkTjgDVqdbJvRM4dJC1MsIrnUyeviId4FkIecSSZ7iq+fcKMHKGU6Ljrtz4kz599paL10S/a3Tk3UR/bhCDncr9koChudbKQWdUMwwletTSCCIw/F0qC+wsLS3ul55xYFU3nsKXIm5suF211lutPseOnDne+iizW56uePDpUOJjMlGDFVza/rBaKKtMftTseUM7bxOw/NDcmO3rRqbgPom5UPUifCTWPwKhAVDl7xVlSAK+ARdxOvWs8kOd3DEUzqp4FFl37e54QiihiowG/BYOYiJyFmKmbiMsMLUwH18wM90Xptow9XnZLxYt1Yo4DvOMrFN8qi+hTn/Ddmk8WvK70QSBz0dW04Q1ZleeheN1MKjcL6F3/4+bj80JkRotM6aGgpG9XsYiY0/p0MG6gVLWb2xKYD+3gb8d0y/HLi462XldO8nwlD18KiB24ECV6yw1p2uFrewYsa6qbtMP/yPZbd6mqtj1hrvp5ZtIGLQ+x89n9O4wWyF+4Bk3GEH8VqxVMQKISdrqpL4UJ7rvi9gcRjSHtMsF2H9VlXaPJAZ/02peJEZwGG4zH7+8g5/Zf/nz+i6o89hIvp6rYCCh7HtSPG3fEX7Y19x3C9OtG8harNF9BzDpcLDMnPsiQr9W7aaAc9EK1hR8nwpZf4n6B2B692rzXz9ovHivW/VtaTdRq8AEr898iJ7D9gu587kiyjI9RZwT6qqL+z5JV/pm5UZQV2R5VYbkNjZ5WdliJuWYo+TkE4YSpp7Ut+FJL7+GybhFVJvVTpF5F0VU1FxZJaZ3+9Isw5nk0U9uwIzz1ODePH3wZ8cjuNAkz+1zT8nCGU25oXDLv2GMKSv6cjuZfNvt6Or8bq5FxNm9g5Gdhy29R8VUPWN1kzKLElZE7Ydzsu5ImGFdQ2Fmso6xD42EVw9yL1q2E0kLopyK0ls1aqcdYZ12+o0kvtEn7uGYI/FmbJ5LM2LBpAuoXCRghgv8zGZ+WpDQYssJLija2NSopqV58o+fMmSehqUmccLS1Ng/ZMVnmHa3we2vHV2gDsszKPgTIqBRTBjQNrkpGfQ1bbeN/q+apkYUX0JZ+7tD6c8dcvYI2Qr0v6PQxGhhf+X5VwXm20t6hvlmKCiE2LGADXZNwW71rnQh9y + template: + metadata: + name: gitops-ssh + namespace: flux-system diff --git a/secrets/htwg-1/kustomization.yaml b/secrets/htwg-1/kustomization.yaml new file mode 100644 index 0000000..f2f49be --- /dev/null +++ b/secrets/htwg-1/kustomization.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +# Seal each secret with the htwg-1 cluster key before uncommenting: +# kubectl -n nowchess create secret generic ... --dry-run=client -o yaml \ +# | kubeseal --controller-namespace kube-system -o yaml > secrets/nowchess/htwg-1-prod/.yaml +resources: + - ../nowchess/htwg-1-prod/ghcr-pull-secret.yaml + - ../nowchess/htwg-1-prod/ncs-jwt-keys.yaml + - ../nowchess/htwg-1-prod/ncs-db-secrets.yaml + - ../nowchess/htwg-1-prod/ncs-internal-secret.yaml + - ../nowchess/htwg-1-prod/remotek6-certs.yaml + - ../postgres-tunnel/secret.yaml diff --git a/secrets/nowchess/htwg-1-prod/ghcr-pull-secret.yaml b/secrets/nowchess/htwg-1-prod/ghcr-pull-secret.yaml new file mode 100644 index 0000000..1173efa --- /dev/null +++ b/secrets/nowchess/htwg-1-prod/ghcr-pull-secret.yaml @@ -0,0 +1,17 @@ +# PLACEHOLDER — seal with htwg-1 cluster key before use: +# kubectl -n nowchess create secret docker-registry ghcr-pull-secret \ +# --docker-server=ghcr.io --docker-username= --docker-password= \ +# --dry-run=client -o yaml | kubeseal --controller-namespace kube-system -o yaml > this-file.yaml +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: ghcr-pull-secret + namespace: nowchess +spec: + encryptedData: + .dockerconfigjson: REPLACE_WITH_SEALED_VALUE + template: + type: kubernetes.io/dockerconfigjson + metadata: + name: ghcr-pull-secret + namespace: nowchess diff --git a/secrets/nowchess/htwg-1-prod/ncs-db-secrets.yaml b/secrets/nowchess/htwg-1-prod/ncs-db-secrets.yaml new file mode 100644 index 0000000..8cf9e94 --- /dev/null +++ b/secrets/nowchess/htwg-1-prod/ncs-db-secrets.yaml @@ -0,0 +1,17 @@ +# PLACEHOLDER — seal with htwg-1 cluster key before use: +# kubectl -n nowchess create secret generic ncs-db-secrets \ +# --from-literal=ACCOUNT_DB_URL=... --from-literal=ACCOUNT_DB_PASSWORD=... \ +# (add all other DB keys) \ +# --dry-run=client -o yaml | kubeseal --controller-namespace kube-system -o yaml > this-file.yaml +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: ncs-db-secrets + namespace: nowchess +spec: + encryptedData: + REPLACE_KEY: REPLACE_WITH_SEALED_VALUE + template: + metadata: + name: ncs-db-secrets + namespace: nowchess diff --git a/secrets/nowchess/htwg-1-prod/ncs-internal-secret.yaml b/secrets/nowchess/htwg-1-prod/ncs-internal-secret.yaml new file mode 100644 index 0000000..f47b83d --- /dev/null +++ b/secrets/nowchess/htwg-1-prod/ncs-internal-secret.yaml @@ -0,0 +1,13 @@ +# PLACEHOLDER — seal with htwg-1 cluster key before use +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: ncs-internal-secret + namespace: nowchess +spec: + encryptedData: + REPLACE_KEY: REPLACE_WITH_SEALED_VALUE + template: + metadata: + name: ncs-internal-secret + namespace: nowchess diff --git a/secrets/nowchess/htwg-1-prod/ncs-jwt-keys.yaml b/secrets/nowchess/htwg-1-prod/ncs-jwt-keys.yaml new file mode 100644 index 0000000..bd4c720 --- /dev/null +++ b/secrets/nowchess/htwg-1-prod/ncs-jwt-keys.yaml @@ -0,0 +1,13 @@ +# PLACEHOLDER — seal with htwg-1 cluster key before use +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: ncs-jwt-keys + namespace: nowchess +spec: + encryptedData: + REPLACE_KEY: REPLACE_WITH_SEALED_VALUE + template: + metadata: + name: ncs-jwt-keys + namespace: nowchess diff --git a/secrets/nowchess/htwg-1-prod/remotek6-certs.yaml b/secrets/nowchess/htwg-1-prod/remotek6-certs.yaml new file mode 100644 index 0000000..8090b7e --- /dev/null +++ b/secrets/nowchess/htwg-1-prod/remotek6-certs.yaml @@ -0,0 +1,13 @@ +# PLACEHOLDER — seal with htwg-1 cluster key before use +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: remotek6-certs + namespace: nowchess +spec: + encryptedData: + REPLACE_KEY: REPLACE_WITH_SEALED_VALUE + template: + metadata: + name: remotek6-certs + namespace: nowchess