davide/fleet-infra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: deploy Wave 1 - Vaultwarden, Uptime Kuma, Trivy Operator, Authelia

Browse Source 
GitOps manifests for security stack Wave 1:
- Vaultwarden (vault.davidepiu.xyz) - password manager
- Uptime Kuma (status.davidepiu.xyz) - uptime monitoring
- Trivy Operator - vulnerability scanning
- Authelia (auth.davidepiu.xyz) - SSO + 2FA

All with NetworkPolicies for Traefik ingress.
This commit is contained in:
Davide Piu
2026-02-19 22:44:34 +00:00
parent 232957ac4a
commit c2a803d28b
4 changed files with 292 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

73
clusters/lab/apps/uptime-kuma.yaml Normal file
View File

@@ -0,0 +1,73 @@
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: uptime-kuma
namespace: flux-system
spec:
interval: 1h
url: https://helm.irsigler.cloud
---
apiVersion: v1
kind: Namespace
metadata:
name: uptime-kuma
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: uptime-kuma
namespace: flux-system
spec:
interval: 1h
targetNamespace: uptime-kuma
install:
createNamespace: true
chart:
spec:
chart: uptime-kuma
sourceRef:
kind: HelmRepository
name: uptime-kuma
interval: 1h
values:
ingress:
enabled: true
className: traefik
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd
hosts:
- host: status.davidepiu.xyz
paths:
- path: /
pathType: Prefix
tls:
- secretName: uptime-kuma-tls
hosts:
- status.davidepiu.xyz
persistence:
enabled: true
size: 4Gi
resources:
requests:
cpu: 10m
memory: 64Mi
limits:
cpu: 200m
memory: 200Mi
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-ingress-from-traefik
namespace: uptime-kuma
spec:
podSelector: {}
policyTypes:
- Ingress
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system

69
clusters/lab/apps/vaultwarden.yaml Normal file
View File

@@ -0,0 +1,69 @@
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: vaultwarden
namespace: flux-system
spec:
interval: 1h
url: https://guerzon.github.io/vaultwarden/
---
apiVersion: v1
kind: Namespace
metadata:
name: vaultwarden
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: vaultwarden
namespace: flux-system
spec:
interval: 1h
targetNamespace: vaultwarden
install:
createNamespace: true
chart:
spec:
chart: vaultwarden
sourceRef:
kind: HelmRepository
name: vaultwarden
interval: 1h
values:
domain: "https://vault.davidepiu.xyz"
ingress:
enabled: true
class: traefik
nginxIngressAnnotations: false
additionalAnnotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd
hostname: vault.davidepiu.xyz
tls: true
tlsSecret: vaultwarden-tls
data:
name: vaultwarden-data
size: 5Gi
resources:
requests:
cpu: 10m
memory: 64Mi
limits:
cpu: 200m
memory: 128Mi
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-ingress-from-traefik
namespace: vaultwarden
spec:
podSelector: {}
policyTypes:
- Ingress
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system

105
clusters/lab/security/authelia.yaml Normal file
View File

@@ -0,0 +1,105 @@
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: authelia
namespace: flux-system
spec:
interval: 1h
url: https://charts.authelia.com
---
apiVersion: v1
kind: Namespace
metadata:
name: authelia
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: authelia
namespace: flux-system
spec:
interval: 1h
targetNamespace: authelia
install:
createNamespace: true
chart:
spec:
chart: authelia
sourceRef:
kind: HelmRepository
name: authelia
interval: 1h
valuesFrom:
- kind: Secret
name: authelia-secrets
valuesKey: JWT_SECRET
targetPath: secret.jwt.value
- kind: Secret
name: authelia-secrets
valuesKey: SESSION_SECRET
targetPath: secret.session.value
- kind: Secret
name: authelia-secrets
valuesKey: STORAGE_ENCRYPTION_KEY
targetPath: secret.storage.value
values:
pod:
resources:
requests:
cpu: 10m
memory: 64Mi
limits:
cpu: 200m
memory: 128Mi
ingress:
enabled: true
className: traefik
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd
tls:
enabled: true
secret: authelia-tls
configMap:
theme: light
default_2fa_method: totp
server:
address: tcp://0.0.0.0:9091/
session:
cookies:
- domain: davidepiu.xyz
subdomain: auth
default_redirection_url: https://auth.davidepiu.xyz
storage:
local:
enabled: true
path: /config/db.sqlite3
access_control:
default_policy: one_factor
authentication_backend:
file:
enabled: true
path: /config/users_database.yml
notifier:
filesystem:
enabled: true
filename: /config/notification.txt
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-ingress-from-traefik
namespace: authelia
spec:
podSelector: {}
policyTypes:
- Ingress
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
ports:
- port: 9091
protocol: TCP

45
clusters/lab/security/trivy-operator.yaml Normal file
View File

@@ -0,0 +1,45 @@
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: aquasecurity
namespace: flux-system
spec:
interval: 1h
url: https://aquasecurity.github.io/helm-charts/
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: trivy-operator
namespace: flux-system
spec:
interval: 1h
targetNamespace: trivy-system
install:
createNamespace: true
chart:
spec:
chart: trivy-operator
sourceRef:
kind: HelmRepository
name: aquasecurity
interval: 1h
values:
trivy:
resources:
requests:
cpu: 10m
memory: 64Mi
limits:
cpu: 500m
memory: 512Mi
operator:
scanJobsConcurrentLimit: 1
vulnerabilityScannerScanOnlyCurrentRevisions: true
compliance:
cron: ""
nodeCollector:
excludeNodes: ""
serviceMonitor:
enabled: false