From e18d3796de677ac0e6785cba717878f611058aa0 Mon Sep 17 00:00:00 2001
From: Vegard Hagen <vegard@stonegarden.dev>
Date: Sat, 5 Aug 2023 11:52:40 +0200
Subject: [PATCH] feat(cloudflared): Configuring tunnel locally/declaratively
 instead of ClickOps through Dashboard

---
 infra/net-aux/config/cloudflared/config.yaml | 22 ++++++++++++++++++++
 infra/net-aux/deployment.yaml                | 13 +++++-------
 infra/net-aux/kustomization.yaml             |  2 +-
 infra/net-aux/tunnel-credentials.yaml        | 13 ++++++++++++
 infra/net-aux/tunnel-token.yaml              | 14 -------------
 5 files changed, 41 insertions(+), 23 deletions(-)
 create mode 100644 infra/net-aux/tunnel-credentials.yaml
 delete mode 100644 infra/net-aux/tunnel-token.yaml

diff --git a/infra/net-aux/config/cloudflared/config.yaml b/infra/net-aux/config/cloudflared/config.yaml
index 482931a..069181a 100644
--- a/infra/net-aux/config/cloudflared/config.yaml
+++ b/infra/net-aux/config/cloudflared/config.yaml
@@ -1,2 +1,24 @@
+tunnel: gauss-k8s
+credentials-file: /etc/cloudflared/creds/credentials.json
 metrics: 0.0.0.0:2000
 no-autoupdate: true
+
+warp-routing:
+  enabled: true
+
+ingress:
+  - hostname: hello.stonegarden.dev
+    service: hello_world
+  - hostname: hei.stonegarden.dev
+    service: hello_world
+    originRequest:
+      access:
+        required: true
+        teamName: stonegarden
+  - hostname: ssh.stonegarden.dev
+    service: ssh://192.168.1.12:22
+  - hostname: stonegarden.dev
+    service: https://stonegarden.dev
+  - hostname: "*.stonegarden.dev"
+    service: https://stonegarden.dev
+  - service: http_status:404
\ No newline at end of file
diff --git a/infra/net-aux/deployment.yaml b/infra/net-aux/deployment.yaml
index 2375c51..4e65856 100644
--- a/infra/net-aux/deployment.yaml
+++ b/infra/net-aux/deployment.yaml
@@ -126,16 +126,13 @@ spec:
             initialDelaySeconds: 60
             failureThreshold: 5
             periodSeconds: 10
-          env:
-            - name: TUNNEL_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  key: tunnel-token
-                  name: tunnel-token
           volumeMounts:
             - name: cloudflared-config
               mountPath: /etc/cloudflared/config/config.yaml
               subPath: config.yaml
+            - name: tunnel-credentials
+              mountPath: /etc/cloudflared/creds
+              readOnly: true
       restartPolicy: Always
       volumes:
         - name: unbound-config
@@ -159,6 +156,6 @@ spec:
         - name: cloudflared-config
           configMap:
             name: cloudflared-config
-        - name: tunnel-token
+        - name: tunnel-credentials
           secret:
-            secretName: tunnel-token
+            secretName: tunnel-credentials
diff --git a/infra/net-aux/kustomization.yaml b/infra/net-aux/kustomization.yaml
index a1827c0..3d62fe6 100644
--- a/infra/net-aux/kustomization.yaml
+++ b/infra/net-aux/kustomization.yaml
@@ -32,7 +32,7 @@ resources:
   - pv-pi-hole.yaml
   - pvc-pi-hole.yaml
   - auth-secret.yaml
-  - tunnel-token.yaml
+  - tunnel-credentials.yaml
   - ingress-route.yaml
   - service.yaml
   - deployment.yaml
diff --git a/infra/net-aux/tunnel-credentials.yaml b/infra/net-aux/tunnel-credentials.yaml
new file mode 100644
index 0000000..6b8e88d
--- /dev/null
+++ b/infra/net-aux/tunnel-credentials.yaml
@@ -0,0 +1,13 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: tunnel-credentials
+  namespace: net-aux
+spec:
+  encryptedData:
+    credentials.json: AgDR65D32Doss7Umwl5EEZBKJ2ZrUpNVtvZS2XINGDiZfHs9Znn2IQKAKyYmGqdchXRyGcvxuRSH1aXordrg212bx0Yo6ndtUPoH2ivxe9z4DvAO2GCgR1TFDaiXI32k3zNR5j5lQl6ry4eASYrUhn3J6JvHXm5gk2hv2cHTNojt1LlDKu3KgIT67Og37rEGMaEz56p2zKddCc1x/lkmvYJE3BMM/O70w6TBVndJXJO4ZkV7kGhblLvez42lwzLyMMtA6d/X8thykUwP3QNpjSJrvDzxF+4enfNmWPveH6GPhdzDZH0b84l3dZfj239q95/sTbUQAygbyeD0kFyjuquGCofr6G/jCpRB+wYNGmRd2j83wrh6+MSq6PmehS/+EfzYde3a4jr/gWXZpd5viaZvadCaUCFgVBkFNlfdxO0CTWWdVuvHre11es1FNWOUx1WJ0GOEknn1XrEXBKGEm2z+6tw5XEZwZrNmBpxjgFvVD+L+oln/DF7ALKkYLvni6m5l2UOddE4gIENOedjWdYw0VN0AYIqwxMlrEzVcjPcH7hzS+7cu5btNpYZp/3pjB661yzbiUM6RKwVLgCOY2dttL9d1eH7QK+l9NR/ZxbjD7yqpDZ9agOUApvkbbK73dk6c5vXQrw4ynYvsNm3eB3asPCngWfiJF1TULKnkNrfojOEenpg7MmIL3xk5mSfClX6nWgdpDbKAVpKypP1bLJdj6J0tq16z+BKBpDT5hCHMdiAvyPKpbdSeze/tW9WOWon7Ql/0YZcVgxa3kKMfYHnSwr6dFUMMPrFsTSYdYc/vPrXf33RXTGWrsf3ALBHuLWvtZDhQo7cU+HduGc0bPuZTO9gp/8YmiNmE9vAZXi3r/h5gvvMrmV5Vlf9ZxI4Qy8Bt6ewl5F0YPZiOZRaN+XJgkg==
+  template:
+    metadata:
+      name: tunnel-credentials
+      namespace: net-aux
+
diff --git a/infra/net-aux/tunnel-token.yaml b/infra/net-aux/tunnel-token.yaml
deleted file mode 100644
index 4ede4f2..0000000
--- a/infra/net-aux/tunnel-token.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: tunnel-token
-  namespace: net-aux
-spec:
-  encryptedData:
-    tunnel-token: AgDp++v1aHWzqI52J7DI1xdt7h0l2aOvYSDxMuJdx1jPHSFtGFYEGwU6H5a9wJZ5A374ob4UFrrM68g6KMNImn61Vp8HDsYh33b2BdqA7JdmqE3I+HvB0I5Y85m1btIOrhcCs/+dABTv0bZD0lue2GZYWL9T8GbyUBLsD3PMrI5MXYnMFlKhpWUGweFRuDDLYTNPgaLx9tPNRYaXR3aX4gm6wdhv++u065tDhhyHgy0tMoviYmFjpLQrhnm4dHg6uzWRhbX5Z296S/kIygmf4ydh+petIeAGf87PuI/t0o94MM1uC+rx+ldvvzi+oRVXSyQ/K9JXOqqt/4cfqcIigZiT1w/DO2O8uKJZGkoKGoUhf9cCqE609iqf/tjTqa2uWl6fO/SlQWfeVz9KjRq0NWDYzYfgyMrzN4kWoAi7jYLpccGEq5YgVFNNVYbvyVjqN4lkqjPGnw7fKa4+pxbjwHwdk09KEVjVwYe/GRz6By62QKqzndZA020paJbfB99t3UcufiSW9V6/x5Jp1ekYtijeVx7BhYrzJPtyhWu2yYoB4DS674LE0oanjxfIAar6cThT4Iqxl5UPYq9hoQo1Ojcg7ALYNhgX5pHijr491e6kBAyfdq3CgCRDX9ImdYLDdAHGnd9au2cKQRbKHVylnRh37Otb1GcTMMw3pZBLcf//PAzDSbgtG7MgGQhPJrDRXA5vCcnPPACpVLeRqccAflr3NzYXzEZ8AAkgkQSu0+Ek5Gw1v+nPI3IUGvW41G2eEiddfu3nN60cxn1FoM/ctMez9gXZgEDhn7feAMYcERsmuIllD/mAqIGl04sofnBWN600s49D1+cH38simPv6tV39MFnUj1oQNr1bcEx7MzlDOyBd45DFMrNrtQIwEqU1fXWvKz6ipJKUHklaujQBCKj7a/WcqTKPBkX9Dvax4i6t6IxLhJO53AZe
-  template:
-    metadata:
-      name: tunnel-token
-      namespace: net-aux
-    type: Opaque
-