diff --git a/infra/cloudflared/deployment.yaml b/infra/cloudflared/deployment.yaml index 1512f8c..3ce9dc7 100644 --- a/infra/cloudflared/deployment.yaml +++ b/infra/cloudflared/deployment.yaml @@ -7,7 +7,7 @@ spec: selector: matchLabels: app: cloudflared - replicas: 1 + replicas: 2 template: metadata: labels: diff --git a/infra/cloudflared/kustomization.yaml b/infra/cloudflared/kustomization.yaml index 27c735d..60887ad 100644 --- a/infra/cloudflared/kustomization.yaml +++ b/infra/cloudflared/kustomization.yaml @@ -6,4 +6,4 @@ resources: - namespace.yaml - config-map.yaml - tunnel-token.yaml -# - deployment.yaml \ No newline at end of file + - deployment.yaml \ No newline at end of file diff --git a/infra/pi-hole/auth-secret.yaml b/infra/pi-hole/auth-secret.yaml new file mode 100644 index 0000000..80dcc9a --- /dev/null +++ b/infra/pi-hole/auth-secret.yaml @@ -0,0 +1,15 @@ +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: traefik-forward-auth-secrets + namespace: pi-hole +spec: + encryptedData: + google-client-id: AgAB1h2c7w9lgsugRpdHg0aGM9ragcQDJPebFMttuBnYg4bbRvnATh/d3l0tFX1GEgMESiAqpRN92AvXENNiaHkqI+Geru3I5EvKHOUyp84k3rXsFomqaLYlYhDtIEzplzd1bChMyv0Eo6p5dxOaXW00K4I1OE9qXE9DAkAtIzf93ye0y+cjB40RVYDgS5cKowaGEKTrtJ+H86rB9rtivzc1/rpFA7L7DrHHsr/KZ6Bf1DNWt//ZxcpzRhgwVIGby+Q+QjhSuqMt4ELlgRgkel3RM99LrK6IVh1lEJJ/lLA0KlUBMZZgLqU+5akX++f3C7xpWYYCW7/5wRTRySXivhtxiJ60EVfYVUdHPBHPrK5qienpd2KRGCrmrNebTxMOfW/zj1G6oM/jXFtYl2OsXo5X615uyTqPHS8fArp2DRTg5cCW5SqBlGxPGuXskZb8HQcJKf5mN92vLYic1UVVy5wmMR1glm1mg/xlzDe1hjR1wtwTYi4kEMYYpvkJnIid8Cnut99PALAEZiutaWLZXH0o3OVETDP939yrgzTmVKIpACGSxeL7mzEeB6hmFa1DqaqB7G8hDGZ5Q+KEhnz6W/NCnYxLYNEpm7LNOWJVh+CMR83ofotS8BbGbn5rNHzsLT2sRlCDBp16uWcydConcClQcuYSkiVRzG5yd1a0DEdZxn3cJDILgYmYwbhQF80ntEASFKRvtfD+q6VgjwpPhiOtQQJvbV0iPoPzqZ5Vh+IMwNRTI5epaVQmBJNOu9P+2V0IkaEhOMtejrxtIE2lBDgvjfLge+U86YM= + google-client-secret: AgA1pIbv9hSBYWAPZlJ8oMkaVradAXJvPP9X6WGOLqMahn5KL324yi6lBzym4vJQWzwVPbucmUZMGqJqEmfWMOHzjL88nRkRXI85wMSgyIA6i+WLmRr3QTuYiMs2UuHFZyIXveyjxgD0XEE/BJdzr7GMfUKAmTDnQur8Wb+DC2pMI8azjnAXrNI2evZ71TnLhfA1QFUR5ecZ5OLPqkiMXik+vQsscKFJlz4cmkVIOESk2RUtPkj06ChzRvokdojzZ1hprwnuQyQWS6BCXFV9LvbUL3ZZfj27xlx3BubulZPqVQ4fy/5oBFxRSfLONTpSqQ46ni7R28G9JnLHKjefu5LMP4hOcNdoQdklMy0QIKc10WCuqXRAzRDCSdtSgUJ6A1TBXd5ubneHhhUg4iSapqNIEia6HDkSWGtmtUrn02Vk1Uklpi8yIeAgbBjqANfLMclOhDgEygZbb8RPCLTxCksdaqsaUj6GE58PbYf3XzDpDMqomdMlp4fHzUrBNcUSCwRbfE4wqPxhVmF4/ST3upHuqnKH+og7HfB9YkYEF/mLBxf2HQeYnIBs/iVv+rWV9EW/73iRnzwjmS1uSvZPv/lbFjPYKaUgtV6as9WGSHhH+PC8LH+l/iOBm3FI89KWJEwq+fW0YIHeRoQ1YTLL0EXeW2nTYHIGbQuB1zw8mvtmHqbgn8bdZulOLS2Ftb0LdJRVPhhMqHAkzD1bsuL6FuT5v7IBYk11QkxYhb/+XG8Pe2Fs9g== + secret: AgA0PHE8APviTYiAWRQ18emplMCbxkWb6y+G8BcMt0SIjRaH/WXp1gDyr3NEuirjB3p+Foteh8NMC6zvTOoyXOHFwMozQYOl8ndi9v501AlVuaYSkUCJRJwwnpajsBkCeFk+PX1zn49Z82DamsfTj30Yt0AWigZbk5bEWPvCNnIc8ddj43rAI0ahkzb3GpLY1Y9YJ97Mk/fvrrBzeFlrbufyaNhRHlwLkvKrKd6qxYCuTBME6COx3gnKH8dN9eSgoJJFjVdfIvfBDHSl4O9nuGGFcZzm6Dd4UBcRfoOU+pDqOKt4yc5TG4XlGr1oc9Qs41n7/lqV8ZaCJe/B4jUBeHvPsc76wR6TTQ983WW2QEj6SqymIPwqFWYObsVlJgISVMORGTIwCG5UTYu9OFhXDi05/npdbZa3hyP0yn59JSjWvFBULrEqm6rGHm7BnGxpKfT71pE3nTPCGUENnMYKjtwuIko2G2hAIvZ8F7RgmgNufFGH6i20cHAMBwUZ//RCnqxnwal8CX2iUV1T8Ifn2V+LUJqmcnGzveJNtFaji/l60Ap7mqcxE9F5rhqkf2BJHLA2WFfrefN290AiXbh4PaMXU4pjvOmwY+yBjoUh2oADan6Jk+fEF6SMG20XwGh33DhbtPzBsxrmMlx9f5AqW0diPscwZC+XKlPnz1Pvk2YeO8ljhsn40DK6FzZBnPDKhpba3aFrBaew74CKqA== + template: + metadata: + name: traefik-forward-auth-secrets + namespace: pi-hole + diff --git a/infra/pi-hole/auth-values.yaml b/infra/pi-hole/auth-values.yaml new file mode 100644 index 0000000..b09468e --- /dev/null +++ b/infra/pi-hole/auth-values.yaml @@ -0,0 +1,7 @@ +name: auth +namespace: pi-hole +authOnly: true +auth: + cookieDomain: stonegarden.dev + whitelist: + - veghag@gmail.com diff --git a/infra/pi-hole/cm-dnsmasq.yaml b/infra/pi-hole/cm-dnsmasq.yaml new file mode 100644 index 0000000..f11c9e5 --- /dev/null +++ b/infra/pi-hole/cm-dnsmasq.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: pi-hole-custom-dnsmasq +data: + 02-custom.conf: | + address=/stonegarden.dev/192.168.1.128 + address=/stonegarden.lan/192.168.1.128 \ No newline at end of file diff --git a/infra/pi-hole/config/02-custom.conf b/infra/pi-hole/config/02-custom.conf new file mode 100644 index 0000000..2bc41a9 --- /dev/null +++ b/infra/pi-hole/config/02-custom.conf @@ -0,0 +1,2 @@ +address=/stonegarden.dev/192.168.1.128 +address=/stonegarden.lan/192.168.1.128 \ No newline at end of file diff --git a/infra/pi-hole/config/pi-hole-env b/infra/pi-hole/config/pi-hole-env new file mode 100644 index 0000000..fed9115 --- /dev/null +++ b/infra/pi-hole/config/pi-hole-env @@ -0,0 +1,7 @@ +TZ=Europe/Oslo +DNSMASQ_LISTENING=all +WEBPASSWORD=password +DNS1=1.1.1.1 +DNS2=8.8.8.8 +VIRTUAL_HOST=pi.hole +WEB_PORT=80 \ No newline at end of file diff --git a/infra/pi-hole/deployment.yaml b/infra/pi-hole/deployment.yaml index 541beba..12c9f2d 100644 --- a/infra/pi-hole/deployment.yaml +++ b/infra/pi-hole/deployment.yaml @@ -10,37 +10,28 @@ spec: selector: matchLabels: app: pi-hole - #strategy: - # rollingUpdate: - # maxSurge: 1 - # maxUnavailable: 0 - # type: RollingUpdate + strategy: + rollingUpdate: + maxSurge: 1 + maxUnavailable: 1 + type: RollingUpdate template: metadata: labels: app: pi-hole spec: + dnsPolicy: None + dnsConfig: + nameservers: + - 127.0.0.1 + - 8.8.8.8 containers: - - env: - - name: TZ - value: Europe/Oslo - - name: WEBPASSWORD - value: password - #- name: DNS1 - # value: 1.1.1.1 - # #value: 185.228.168.168 - #- name: DNS2 - # value: 8.8.8.8 - # #value: 185.228.169.168 - - name: CONDITIONAL_FORWARDING - value: 'true' - - name: CONDITIONAL_FORWARDING_DOMAIN - value: stonegarden.dev - - name: CONDITIONAL_FORWARDING_IP - value: 192.168.1.128 - image: pihole/pihole:latest - imagePullPolicy: Always - name: pi-hole + - name: pi-hole + image: pihole/pihole:2023.05.2 + imagePullPolicy: IfNotPresent + envFrom: + - configMapRef: + name: pi-hole-env ports: - name: dns-tcp containerPort: 53 @@ -51,7 +42,7 @@ spec: - name: dchp containerPort: 67 protocol: UDP - - name: web + - name: http containerPort: 80 protocol: TCP - name: https @@ -75,11 +66,26 @@ spec: # port: dns-tcp # initialDelaySeconds: 15 # periodSeconds: 30 + livenessProbe: + httpGet: + path: /admin/index.php + port: http + scheme: HTTP + initialDelaySeconds: 60 + failureThreshold: 10 + timeoutSeconds: 5 + readinessProbe: + httpGet: + path: /admin/index.php + port: http + scheme: HTTP + initialDelaySeconds: 60 + failureThreshold: 3 + timeoutSeconds: 5 volumeMounts: - - name: etc-pihole - mountPath: /etc/pihole - - name: etc-dnsmasq - mountPath: /etc/dnsmasq.d + - name: custom-dnsmasq + mountPath: /etc/dnsmasq.d/02-custom.conf + subPath: 02-custom.conf # - name: var-log # mountPath: /var/log # - name: var-log-lighttpd @@ -98,12 +104,10 @@ spec: # subPath: adlists.list restartPolicy: Always volumes: - - name: etc-pihole - emptyDir: - medium: Memory - - name: etc-dnsmasq - emptyDir: - medium: Memory + - name: custom-dnsmasq + configMap: + name: custom-dnsmasq + defaultMode: 420 #- name: var-log # emptyDir: # medium: Memory diff --git a/infra/pi-hole/ingress-route.yaml b/infra/pi-hole/ingress-route.yaml new file mode 100644 index 0000000..f51dc12 --- /dev/null +++ b/infra/pi-hole/ingress-route.yaml @@ -0,0 +1,18 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: pi-hole +spec: + entryPoints: + - websecure + routes: + - match: Host(`pi-hole.stonegarden.dev`) + kind: Rule + services: + - name: pi-hole-web + port: http + middlewares: + - name: traefik-forward-auth + tls: + store: + name: cloudflare-tls \ No newline at end of file diff --git a/infra/pi-hole/kustomization.yaml b/infra/pi-hole/kustomization.yaml index d010fa7..d3507b0 100644 --- a/infra/pi-hole/kustomization.yaml +++ b/infra/pi-hole/kustomization.yaml @@ -4,11 +4,31 @@ namespace: pi-hole commonLabels: app: pi-hole + +configMapGenerator: + - name: pi-hole-env + envs: + - config/pi-hole-env + - name: custom-dnsmasq + files: + - config/02-custom.conf + resources: - namespace.yaml + - auth-secret.yaml + - ingress-route.yaml - service.yaml + #- cm-dnsmasq.yaml #- cm-adlists.yaml #- cm-ftl.yaml #- cm-regex.yaml #- cm-whitelist.yaml - deployment.yaml + +helmGlobals: + chartHome: ../../charts + +helmCharts: + - name: application + releaseName: auth + valuesFile: auth-values.yaml diff --git a/infra/pi-hole/service.yaml b/infra/pi-hole/service.yaml index 9438c6f..cdd4f68 100644 --- a/infra/pi-hole/service.yaml +++ b/infra/pi-hole/service.yaml @@ -2,37 +2,52 @@ kind: Service apiVersion: v1 metadata: - name: pi-hole-udp + name: pi-hole-dns-udp namespace: pi-hole annotations: - metallb.universe.tf/allow-shared-ip: dns + metallb.universe.tf/allow-shared-ip: pi-hole spec: selector: app: pi-hole ports: - - protocol: UDP + - name: dns-udp port: 53 - name: dnsudp - targetPort: 53 + protocol: UDP + targetPort: dns-udp type: LoadBalancer --- kind: Service apiVersion: v1 metadata: - name: pi-hole-tcp + name: pi-hole-dns-tcp namespace: pi-hole annotations: - metallb.universe.tf/allow-shared-ip: dns + metallb.universe.tf/allow-shared-ip: pi-hole spec: selector: app: pi-hole ports: - - protocol: TCP + - name: dns-tcp port: 53 - name: dnstcp - targetPort: 53 - - protocol: TCP + protocol: TCP + targetPort: dns-tcp + type: LoadBalancer +--- +kind: Service +apiVersion: v1 +metadata: + name: pi-hole-web + namespace: pi-hole + annotations: + metallb.universe.tf/allow-shared-ip: pi-hole +spec: + selector: + app: pi-hole + ports: + - name: http port: 80 - name: web - targetPort: 80 - type: LoadBalancer \ No newline at end of file + targetPort: http + - name: https + port: 443 + targetPort: https + type: LoadBalancer