Commit new Chart releases for TrueCharts
Signed-off-by: TrueCharts-Bot <bot@truecharts.org>
This commit is contained in:
TrueCharts-Bot
parent
396e92a624
commit
7d4011b3fb
|
|
@ -0,0 +1,99 @@
|
|||
**Important:**
|
||||
*for the complete changelog, please refer to the website*
|
||||
|
||||
|
||||
|
||||
|
||||
## [authelia-20.0.5](https://github.com/truecharts/charts/compare/authelia-20.0.4...authelia-20.0.5) (2023-12-21)
|
||||
|
||||
### Chore
|
||||
|
||||
- require ingress for certain charts
|
||||
|
||||
|
||||
|
||||
|
||||
## [authelia-20.0.4](https://github.com/truecharts/charts/compare/authelia-20.0.3...authelia-20.0.4) (2023-12-21)
|
||||
|
||||
|
||||
|
||||
|
||||
## [authelia-20.0.3](https://github.com/truecharts/charts/compare/authelia-20.0.2...authelia-20.0.3) (2023-12-21)
|
||||
|
||||
### Chore
|
||||
|
||||
- bump everything to ensure patches are applied globally
|
||||
|
||||
### Fix
|
||||
|
||||
- ensure the cnpg GUI is included on CNPG apps
|
||||
|
||||
|
||||
|
||||
|
||||
## [authelia-20.0.2](https://github.com/truecharts/charts/compare/authelia-20.0.1...authelia-20.0.2) (2023-12-21)
|
||||
|
||||
### Chore
|
||||
|
||||
- update helm general non-major by renovate ([#16341](https://github.com/truecharts/charts/issues/16341))
|
||||
|
||||
|
||||
|
||||
|
||||
## [authelia-20.0.1](https://github.com/truecharts/charts/compare/authelia-20.0.0...authelia-20.0.1) (2023-12-20)
|
||||
|
||||
### Chore
|
||||
|
||||
- bump patch versions on all charts for new GUI release
|
||||
|
||||
|
||||
|
||||
|
||||
## [authelia-20.0.0](https://github.com/truecharts/charts/compare/authelia-19.0.17...authelia-20.0.0) (2023-12-20)
|
||||
|
||||
### Chore
|
||||
|
||||
- update helm general major by renovate (major) ([#14631](https://github.com/truecharts/charts/issues/14631))
|
||||
|
||||
|
||||
|
||||
|
||||
## [authelia-19.0.17](https://github.com/truecharts/charts/compare/authelia-19.0.16...authelia-19.0.17) (2023-12-20)
|
||||
|
||||
### Chore
|
||||
|
||||
- Bump everything to force min/max scale version update
|
||||
|
||||
|
||||
|
||||
|
||||
## [authelia-19.0.16](https://github.com/truecharts/charts/compare/authelia-19.0.14...authelia-19.0.16) (2023-12-16)
|
||||
|
||||
### Chore
|
||||
|
||||
- fix move mistake and cleanup metadata
|
||||
- update helm general non-major ([#14784](https://github.com/truecharts/charts/issues/14784))
|
||||
|
||||
|
||||
|
||||
|
||||
## [authelia-19.0.16](https://github.com/truecharts/charts/compare/authelia-19.0.14...authelia-19.0.16) (2023-12-16)
|
||||
|
||||
### Chore
|
||||
|
||||
- fix move mistake and cleanup metadata
|
||||
- update helm general non-major ([#14784](https://github.com/truecharts/charts/issues/14784))
|
||||
|
||||
|
||||
|
||||
|
||||
## [authelia-19.0.15](https://github.com/truecharts/charts/compare/authelia-19.0.14...authelia-19.0.15) (2023-12-16)
|
||||
|
||||
### Chore
|
||||
|
||||
- fix move mistake and cleanup metadata
|
||||
|
||||
|
||||
|
||||
|
||||
## [authelia-19.0.14](https://github.com/truecharts/charts/compare/authelia-19.0.13...authelia-19.0.14) (2023-12-03)
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
kubeVersion: ">=1.24.0-0"
|
||||
apiVersion: v2
|
||||
name: authelia
|
||||
version: 20.0.5
|
||||
appVersion: 4.37.5
|
||||
description: Authelia is a Single Sign-On Multi-Factor portal for web apps
|
||||
home: https://truecharts.org/charts/enterprise/authelia
|
||||
icon: https://truecharts.org/img/hotlink-ok/chart-icons/authelia.png
|
||||
deprecated: false
|
||||
sources:
|
||||
- https://github.com/authelia/chartrepo
|
||||
- https://github.com/authelia/authelia
|
||||
- https://github.com/truecharts/charts/tree/master/charts/enterprise/authelia
|
||||
- https://ghcr.io/authelia/authelia
|
||||
maintainers:
|
||||
- name: TrueCharts
|
||||
email: info@truecharts.org
|
||||
url: https://truecharts.org
|
||||
keywords:
|
||||
- authelia
|
||||
- authentication
|
||||
- login
|
||||
- SSO
|
||||
- Authentication
|
||||
- Security
|
||||
- Two-Factor
|
||||
- U2F
|
||||
- YubiKey
|
||||
- Push Notifications
|
||||
- LDAP
|
||||
dependencies:
|
||||
- name: common
|
||||
version: 16.2.9
|
||||
repository: https://library-charts.truecharts.org
|
||||
condition: ""
|
||||
alias: ""
|
||||
tags: []
|
||||
import-values: []
|
||||
- name: redis
|
||||
version: 10.0.4
|
||||
repository: https://deps.truecharts.org
|
||||
condition: redis.enabled
|
||||
alias: ""
|
||||
tags: []
|
||||
import-values: []
|
||||
annotations:
|
||||
max_scale_version: 23.10.2
|
||||
min_scale_version: 23.10.0
|
||||
truecharts.org/SCALE-support: "true"
|
||||
truecharts.org/category: security
|
||||
truecharts.org/max_helm_version: "3.13"
|
||||
truecharts.org/min_helm_version: "3.12"
|
||||
truecharts.org/train: enterprise
|
||||
type: application
|
||||
|
|
@ -0,0 +1,106 @@
|
|||
Business Source License 1.1
|
||||
|
||||
Parameters
|
||||
|
||||
Licensor: The TrueCharts Project, it's owner and it's contributors
|
||||
Licensed Work: The TrueCharts "Cert-Manager" Helm Chart
|
||||
Additional Use Grant: You may use the licensed work in production, as long
|
||||
as it is directly sourced from a TrueCharts provided
|
||||
official repository, catalog or source. You may also make private
|
||||
modification to the directly sourced licenced work,
|
||||
when used in production.
|
||||
|
||||
The following cases are, due to their nature, also
|
||||
defined as 'production use' and explicitly prohibited:
|
||||
- Bundling, including or displaying the licensed work
|
||||
with(in) another work intended for production use,
|
||||
with the apparent intend of facilitating and/or
|
||||
promoting production use by third parties in
|
||||
violation of this license.
|
||||
|
||||
Change Date: 2050-01-01
|
||||
|
||||
Change License: 3-clause BSD license
|
||||
|
||||
For information about alternative licensing arrangements for the Software,
|
||||
please contact: legal@truecharts.org
|
||||
|
||||
Notice
|
||||
|
||||
The Business Source License (this document, or the “License”) is not an Open
|
||||
Source license. However, the Licensed Work will eventually be made available
|
||||
under an Open Source License, as stated in this License.
|
||||
|
||||
License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
|
||||
“Business Source License” is a trademark of MariaDB Corporation Ab.
|
||||
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
Business Source License 1.1
|
||||
|
||||
Terms
|
||||
|
||||
The Licensor hereby grants you the right to copy, modify, create derivative
|
||||
works, redistribute, and make non-production use of the Licensed Work. The
|
||||
Licensor may make an Additional Use Grant, above, permitting limited
|
||||
production use.
|
||||
|
||||
Effective on the Change Date, or the fourth anniversary of the first publicly
|
||||
available distribution of a specific version of the Licensed Work under this
|
||||
License, whichever comes first, the Licensor hereby grants you rights under
|
||||
the terms of the Change License, and the rights granted in the paragraph
|
||||
above terminate.
|
||||
|
||||
If your use of the Licensed Work does not comply with the requirements
|
||||
currently in effect as described in this License, you must purchase a
|
||||
commercial license from the Licensor, its affiliated entities, or authorized
|
||||
resellers, or you must refrain from using the Licensed Work.
|
||||
|
||||
All copies of the original and modified Licensed Work, and derivative works
|
||||
of the Licensed Work, are subject to this License. This License applies
|
||||
separately for each version of the Licensed Work and the Change Date may vary
|
||||
for each version of the Licensed Work released by Licensor.
|
||||
|
||||
You must conspicuously display this License on each original or modified copy
|
||||
of the Licensed Work. If you receive the Licensed Work in original or
|
||||
modified form from a third party, the terms and conditions set forth in this
|
||||
License apply to your use of that work.
|
||||
|
||||
Any use of the Licensed Work in violation of this License will automatically
|
||||
terminate your rights under this License for the current and all other
|
||||
versions of the Licensed Work.
|
||||
|
||||
This License does not grant you any right in any trademark or logo of
|
||||
Licensor or its affiliates (provided that you may use a trademark or logo of
|
||||
Licensor as expressly required by this License).
|
||||
|
||||
TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
|
||||
AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
|
||||
EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
|
||||
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
|
||||
TITLE.
|
||||
|
||||
MariaDB hereby grants you permission to use this License’s text to license
|
||||
your works, and to refer to it using the trademark “Business Source License”,
|
||||
as long as you comply with the Covenants of Licensor below.
|
||||
|
||||
Covenants of Licensor
|
||||
|
||||
In consideration of the right to use this License’s text and the “Business
|
||||
Source License” name and trademark, Licensor covenants to MariaDB, and to all
|
||||
other recipients of the licensed work to be provided by Licensor:
|
||||
|
||||
1. To specify as the Change License the GPL Version 2.0 or any later version,
|
||||
or a license that is compatible with GPL Version 2.0 or a later version,
|
||||
where “compatible” means that software provided under the Change License can
|
||||
be included in a program with software provided under GPL Version 2.0 or a
|
||||
later version. Licensor may specify additional Change Licenses without
|
||||
limitation.
|
||||
|
||||
2. To either: (a) specify an additional grant of rights to use that does not
|
||||
impose any additional restriction on the right granted in this License, as
|
||||
the Additional Use Grant; or (b) insert the text “None”.
|
||||
|
||||
3. To specify a Change Date.
|
||||
|
||||
4. Not to modify this License in any other way.
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
# README
|
||||
|
||||
## General Info
|
||||
|
||||
TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE.
|
||||
However only installations using the TrueNAS SCALE Apps system are supported.
|
||||
|
||||
For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/enterprise/authelia)
|
||||
|
||||
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
|
||||
- See the [Website](https://truecharts.org)
|
||||
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
||||
- Open a [issue](https://github.com/truecharts/charts/issues/new/choose)
|
||||
|
||||
---
|
||||
|
||||
## Sponsor TrueCharts
|
||||
|
||||
TrueCharts can only exist due to the incredible effort of our staff.
|
||||
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
||||
|
||||
*All Rights Reserved - The TrueCharts Project*
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
|
||||
|
||||
## [authelia-20.0.5](https://github.com/truecharts/charts/compare/authelia-20.0.4...authelia-20.0.5) (2023-12-21)
|
||||
|
||||
### Chore
|
||||
|
||||
- require ingress for certain charts
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
Authelia is a Single Sign-On Multi-Factor portal for web apps
|
||||
|
||||
This App is supplied by TrueCharts, for more information visit the manual: [https://truecharts.org/charts/enterprise/authelia](https://truecharts.org/charts/enterprise/authelia)
|
||||
|
||||
---
|
||||
|
||||
TrueCharts can only exist due to the incredible effort of our staff.
|
||||
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
||||
Binary file not shown.
Binary file not shown.
|
|
@ -0,0 +1,582 @@
|
|||
image:
|
||||
repository: ghcr.io/authelia/authelia
|
||||
pullPolicy: IfNotPresent
|
||||
tag: 4.37.5@sha256:25fc5423238b6f3a1fc967fda3f6a9212846aeb4a720327ef61c8ccff52dbbe2
|
||||
manifestManager:
|
||||
enabled: true
|
||||
workload:
|
||||
main:
|
||||
replicas: 2
|
||||
strategy: RollingUpdate
|
||||
podSpec:
|
||||
containers:
|
||||
main:
|
||||
command:
|
||||
- authelia
|
||||
args:
|
||||
- --config=/configuration.yaml
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: authelia-paths
|
||||
probes:
|
||||
liveness:
|
||||
type: http
|
||||
path: "/api/health"
|
||||
readiness:
|
||||
type: http
|
||||
path: "/api/health"
|
||||
startup:
|
||||
type: http
|
||||
path: "/api/health"
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
main:
|
||||
port: 9091
|
||||
targetPort: 9091
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
mountPath: "/config"
|
||||
cnpg:
|
||||
main:
|
||||
enabled: true
|
||||
user: authelia
|
||||
database: authelia
|
||||
# Enabled redis
|
||||
# ... for more options see https://github.com/tccr.io/truecharts/charts/tree/master/tccr.io/truecharts/redis
|
||||
redis:
|
||||
enabled: true
|
||||
domain: example.com
|
||||
##
|
||||
## Server Configuration
|
||||
##
|
||||
server:
|
||||
##
|
||||
## Port sets the configured port for the daemon, service, and the probes.
|
||||
## Default is 9091 and should not need to be changed.
|
||||
##
|
||||
port: 9091
|
||||
## Buffers usually should be configured to be the same value.
|
||||
## Explanation at https://www.authelia.com/docs/configuration/server.html
|
||||
## Read buffer size adjusts the server's max incoming request size in bytes.
|
||||
## Write buffer size does the same for outgoing responses.
|
||||
read_buffer_size: 4096
|
||||
write_buffer_size: 4096
|
||||
## Set the single level path Authelia listens on.
|
||||
## Must be alphanumeric chars and should not contain any slashes.
|
||||
path: ""
|
||||
log:
|
||||
## Level of verbosity for logs: info, debug, trace.
|
||||
level: trace
|
||||
## Format the logs are written as: json, text.
|
||||
format: text
|
||||
## TODO: Statefulness check should check if this is set, and the configMap should enable it.
|
||||
## File path where the logs will be written. If not set logs are written to stdout.
|
||||
# file_path: /config/authelia.log
|
||||
## Default redirection URL
|
||||
##
|
||||
## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
|
||||
## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
|
||||
## in such a case.
|
||||
##
|
||||
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
|
||||
## Default is https://www.<domain> (value at the top of the values.yaml).
|
||||
default_redirection_url: ""
|
||||
# default_redirection_url: https://example.com
|
||||
|
||||
theme: light
|
||||
##
|
||||
## TOTP Configuration
|
||||
##
|
||||
## Parameters used for TOTP generation
|
||||
totp:
|
||||
## The issuer name displayed in the Authenticator application of your choice
|
||||
## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names
|
||||
## Defaults to <domain>.
|
||||
issuer: ""
|
||||
## The period in seconds a one-time password is current for. Changing this will require all users to register
|
||||
## their TOTP applications again. Warning: before changing period read the docs link below.
|
||||
period: 30
|
||||
## The skew controls number of one-time passwords either side of the current one that are valid.
|
||||
## Warning: before changing skew read the docs link below.
|
||||
## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation.
|
||||
skew: 1
|
||||
##
|
||||
## Password Policy Config
|
||||
##
|
||||
## Parameters used for Password Policies
|
||||
password_policy:
|
||||
## See: https://www.authelia.com/configuration/security/password-policy/
|
||||
standard:
|
||||
enabled: false
|
||||
min_length: 8
|
||||
max_length: 0
|
||||
require_uppercase: false
|
||||
require_lowercase: false
|
||||
require_number: false
|
||||
require_special: false
|
||||
zxcvbn:
|
||||
## See https://www.authelia.com/configuration/security/password-policy/#zxcvbn for more info
|
||||
enabled: false
|
||||
min_score: 3
|
||||
##
|
||||
## Duo Push API Configuration
|
||||
##
|
||||
## Parameters used to contact the Duo API. Those are generated when you protect an application of type
|
||||
## "Partner Auth API" in the management panel.
|
||||
duo_api:
|
||||
enabled: false
|
||||
hostname: api-123456789.example.com
|
||||
integration_key: ABCDEF
|
||||
plain_api_key: ""
|
||||
## NTP settings
|
||||
ntp:
|
||||
address: "time.cloudflare.com:123"
|
||||
version: 4
|
||||
max_desync: 3s
|
||||
disable_startup_check: false
|
||||
disable_failure: true
|
||||
##
|
||||
## Authentication Backend Provider Configuration
|
||||
##
|
||||
## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
|
||||
##
|
||||
## The available providers are: `file`, `ldap`. You must use one and only one of these providers.
|
||||
authentication_backend:
|
||||
## Disable both the HTML element and the API for reset password functionality
|
||||
disable_reset_password: false
|
||||
## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
|
||||
## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
|
||||
## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
|
||||
## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
|
||||
## See the below documentation for more information.
|
||||
## Duration Notation docs: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
||||
## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval
|
||||
refresh_interval: 5m
|
||||
## LDAP backend configuration.
|
||||
##
|
||||
## This backend allows Authelia to be scaled to more
|
||||
## than one instance and therefore is recommended for
|
||||
## production.
|
||||
ldap:
|
||||
## Enable LDAP Backend.
|
||||
enabled: false
|
||||
## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
|
||||
## Acceptable options are as follows:
|
||||
## - 'activedirectory' - For Microsoft Active Directory.
|
||||
## - 'custom' - For custom specifications of attributes and filters.
|
||||
## This currently defaults to 'custom' to maintain existing behaviour.
|
||||
##
|
||||
## Depending on the option here certain other values in this section have a default value, notably all of the
|
||||
## attribute mappings have a default value that this config overrides, you can read more about these default values
|
||||
## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults
|
||||
implementation: activedirectory
|
||||
## The url to the ldap server. Format: <scheme>://<address>[:<port>].
|
||||
## Scheme can be ldap or ldaps in the format (port optional).
|
||||
url: ldap://openldap.default.svc.cluster.local
|
||||
## Connection Timeout.
|
||||
timeout: 5s
|
||||
## Use StartTLS with the LDAP connection.
|
||||
start_tls: false
|
||||
tls:
|
||||
## Server Name for certificate validation (in case it's not set correctly in the URL).
|
||||
server_name: ""
|
||||
## Skip verifying the server certificate (to allow a self-signed certificate).
|
||||
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
||||
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
||||
skip_verify: false
|
||||
## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
|
||||
minimum_version: TLS1.2
|
||||
## The base dn for every LDAP query.
|
||||
base_dn: DC=example,DC=com
|
||||
## The attribute holding the username of the user. This attribute is used to populate the username in the session
|
||||
## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
|
||||
## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
|
||||
## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.
|
||||
## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user
|
||||
## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
|
||||
## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
|
||||
## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
|
||||
username_attribute: "uid"
|
||||
## An additional dn to define the scope to all users.
|
||||
additional_users_dn: OU=Users
|
||||
## The users filter used in search queries to find the user profile based on input filled in login form.
|
||||
## Various placeholders are available in the user filter:
|
||||
## - {input} is a placeholder replaced by what the user inputs in the login form.
|
||||
## - {username_attribute} is a mandatory placeholder replaced by what is configured in `username_attribute`.
|
||||
## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
|
||||
## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
|
||||
## versions, so please don't use it.
|
||||
##
|
||||
## Recommended settings are as follows:
|
||||
## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
|
||||
## - OpenLDAP:
|
||||
## - (&({username_attribute}={input})(objectClass=person))
|
||||
## - (&({username_attribute}={input})(objectClass=inetOrgPerson))
|
||||
##
|
||||
## To allow sign in both with username and email, one can use a filter like
|
||||
## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
|
||||
users_filter: ""
|
||||
## An additional dn to define the scope of groups.
|
||||
additional_groups_dn: OU=Groups
|
||||
## The groups filter used in search queries to find the groups of the user.
|
||||
## - {input} is a placeholder replaced by what the user inputs in the login form.
|
||||
## - {username} is a placeholder replace by the username stored in LDAP (based on `username_attribute`).
|
||||
## - {dn} is a matcher replaced by the user distinguished name, aka, user DN.
|
||||
## - {username_attribute} is a placeholder replaced by what is configured in `username_attribute`.
|
||||
## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
|
||||
## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
|
||||
## versions, so please don't use it.
|
||||
## - DON'T USE - {1} is an alias for {username} supported for backward compatibility but it will be deprecated in
|
||||
## later version, so please don't use it.
|
||||
##
|
||||
## If your groups use the `groupOfUniqueNames` structure use this instead:
|
||||
## (&(uniquemember={dn})(objectclass=groupOfUniqueNames))
|
||||
groups_filter: ""
|
||||
## The attribute holding the name of the group
|
||||
group_name_attribute: "cn"
|
||||
## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
|
||||
## first one returned by the LDAP server is used.
|
||||
mail_attribute: "mail"
|
||||
## The attribute holding the display name of the user. This will be used to greet an authenticated user.
|
||||
display_name_attribute: "displayname"
|
||||
## The username of the admin user.
|
||||
user: CN=admin,DC=example,DC=com
|
||||
plain_password: ""
|
||||
##
|
||||
## File (Authentication Provider)
|
||||
##
|
||||
## With this backend, the users database is stored in a file which is updated when users reset their passwords.
|
||||
## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
|
||||
## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
|
||||
## implications it is highly recommended you leave the default values. Before considering changing these settings
|
||||
## please read the docs page below:
|
||||
## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning
|
||||
##
|
||||
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
||||
##
|
||||
file:
|
||||
enabled: true
|
||||
path: /config/users_database.yml
|
||||
password:
|
||||
algorithm: argon2id
|
||||
iterations: 1
|
||||
key_length: 32
|
||||
salt_length: 16
|
||||
memory: 1024
|
||||
parallelism: 8
|
||||
##
|
||||
## Access Control Configuration
|
||||
##
|
||||
## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
|
||||
##
|
||||
## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
|
||||
## to anyone. Otherwise restrictions follow the rules defined.
|
||||
##
|
||||
## Note: One can use the wildcard * to match any subdomain.
|
||||
## It must stand at the beginning of the pattern. (example: *.mydomain.com)
|
||||
##
|
||||
## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
|
||||
##
|
||||
## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
|
||||
##
|
||||
## - 'domain' defines which domain or set of domains the rule applies to.
|
||||
##
|
||||
## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
|
||||
## provided. If provided, the parameter represents either a user or a group. It should be of the form
|
||||
## 'user:<username>' or 'group:<groupname>'.
|
||||
##
|
||||
## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
|
||||
##
|
||||
## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
|
||||
## is optional and matches any resource if not provided.
|
||||
##
|
||||
## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
|
||||
access_control:
|
||||
## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
|
||||
## resource if there is no policy to be applied to the user.
|
||||
default_policy: deny
|
||||
networks: []
|
||||
# networks:
|
||||
# - name: private
|
||||
# networks:
|
||||
# - 10.0.0.0/8
|
||||
# - 172.16.0.0/12
|
||||
# - 192.168.0.0/16
|
||||
# - name: vpn
|
||||
# networks:
|
||||
# - 10.9.0.0/16
|
||||
|
||||
rules: []
|
||||
# rules:
|
||||
# - domain: public.example.com
|
||||
# policy: bypass
|
||||
# - domain: "*.example.com"
|
||||
# policy: bypass
|
||||
# methods:
|
||||
# - OPTIONS
|
||||
# - domain: secure.example.com
|
||||
# policy: one_factor
|
||||
# networks:
|
||||
# - private
|
||||
# - vpn
|
||||
# - 192.168.1.0/24
|
||||
# - 10.0.0.1
|
||||
# - domain:
|
||||
# - secure.example.com
|
||||
# - private.example.com
|
||||
# policy: two_factor
|
||||
# - domain: singlefactor.example.com
|
||||
# policy: one_factor
|
||||
# - domain: "mx2.mail.example.com"
|
||||
# subject: "group:admins"
|
||||
# policy: deny
|
||||
# - domain: "*.example.com"
|
||||
# subject:
|
||||
# - "group:admins"
|
||||
# - "group:moderators"
|
||||
# policy: two_factor
|
||||
# - domain: dev.example.com
|
||||
# resources:
|
||||
# - "^/groups/dev/.*$"
|
||||
# subject: "group:dev"
|
||||
# policy: two_factor
|
||||
# - domain: dev.example.com
|
||||
# resources:
|
||||
# - "^/users/john/.*$"
|
||||
# subject:
|
||||
# - ["group:dev", "user:john"]
|
||||
# - "group:admins"
|
||||
# policy: two_factor
|
||||
# - domain: "{user}.example.com"
|
||||
# policy: bypass
|
||||
##
|
||||
## Session Provider Configuration
|
||||
##
|
||||
## The session cookies identify the user once logged in.
|
||||
## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
|
||||
session:
|
||||
## The name of the session cookie. (default: authelia_session).
|
||||
name: authelia_session
|
||||
## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
|
||||
## Please read https://www.authelia.com/docs/configuration/session.html#same_site
|
||||
same_site: lax
|
||||
## The time in seconds before the cookie expires and session is reset.
|
||||
expiration: 1h
|
||||
## The inactivity time in seconds before the session is reset.
|
||||
inactivity: 5m
|
||||
## The remember me duration.
|
||||
## Value is in seconds, or duration notation. Value of 0 disables remember me.
|
||||
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
||||
## Longer periods are considered less secure because a stolen cookie will last longer giving attackers more time to
|
||||
## spy or attack. Currently the default is 1M or 1 month.
|
||||
remember_me_duration: 1M
|
||||
##
|
||||
## Redis Provider
|
||||
##
|
||||
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
||||
##
|
||||
## The redis connection details
|
||||
redisProvider:
|
||||
port: 6379
|
||||
## Optional username to be used with authentication.
|
||||
# username: authelia
|
||||
username: ""
|
||||
## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
|
||||
database_index: 0
|
||||
## The maximum number of concurrent active connections to Redis.
|
||||
maximum_active_connections: 8
|
||||
## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
|
||||
minimum_idle_connections: 0
|
||||
## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
|
||||
tls:
|
||||
enabled: false
|
||||
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
|
||||
server_name: ""
|
||||
## Skip verifying the server certificate (to allow a self-signed certificate).
|
||||
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
||||
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
||||
skip_verify: false
|
||||
## Minimum TLS version for the connection.
|
||||
minimum_version: TLS1.2
|
||||
## The Redis HA configuration options.
|
||||
## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
|
||||
high_availability:
|
||||
enabled: false
|
||||
enabledSecret: false
|
||||
## Sentinel Name / Master Name
|
||||
sentinel_name: mysentinel
|
||||
## The additional nodes to pre-seed the redis provider with (for sentinel).
|
||||
## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
|
||||
## For high availability to be used you must have either defined; the host above or at least one node below.
|
||||
nodes: []
|
||||
# nodes:
|
||||
# - host: sentinel-0.databases.svc.cluster.local
|
||||
# port: 26379
|
||||
# - host: sentinel-1.databases.svc.cluster.local
|
||||
# port: 26379
|
||||
|
||||
## Choose the host with the lowest latency.
|
||||
route_by_latency: false
|
||||
## Choose the host randomly.
|
||||
route_randomly: false
|
||||
##
|
||||
## Regulation Configuration
|
||||
##
|
||||
## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are done
|
||||
## in a short period of time.
|
||||
regulation:
|
||||
## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
|
||||
max_retries: 3
|
||||
## The time range during which the user can attempt login before being banned. The user is banned if the
|
||||
## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
|
||||
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
||||
find_time: 2m
|
||||
## The length of time before a banned user can login again. Ban Time accepts duration notation.
|
||||
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
||||
ban_time: 5m
|
||||
##
|
||||
## Storage Provider Configuration
|
||||
##
|
||||
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
|
||||
storage:
|
||||
##
|
||||
## PostgreSQL (Storage Provider)
|
||||
##
|
||||
postgres:
|
||||
port: 5432
|
||||
database: authelia
|
||||
username: authelia
|
||||
sslmode: disable
|
||||
timeout: 5s
|
||||
##
|
||||
## Notification Provider
|
||||
##
|
||||
##
|
||||
## Notifications are sent to users when they require a password reset, a u2f registration or a TOTP registration.
|
||||
## The available providers are: filesystem, smtp. You must use one and only one of these providers.
|
||||
notifier:
|
||||
## You can disable the notifier startup check by setting this to true.
|
||||
disable_startup_check: false
|
||||
##
|
||||
## File System (Notification Provider)
|
||||
##
|
||||
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
||||
##
|
||||
filesystem:
|
||||
enabled: true
|
||||
filename: /config/notification.txt
|
||||
##
|
||||
## SMTP (Notification Provider)
|
||||
##
|
||||
## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.
|
||||
## [Security] By default Authelia will:
|
||||
## - force all SMTP connections over TLS including unauthenticated connections
|
||||
## - use the disable_require_tls boolean value to disable this requirement
|
||||
## (only works for unauthenticated connections)
|
||||
## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
|
||||
## (configure in tls section)
|
||||
smtp:
|
||||
enabled: false
|
||||
enabledSecret: false
|
||||
host: smtp.mail.svc.cluster.local
|
||||
port: 25
|
||||
timeout: 5s
|
||||
username: test
|
||||
plain_password: test
|
||||
sender: admin@example.com
|
||||
## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
|
||||
identifier: localhost
|
||||
## Subject configuration of the emails sent.
|
||||
## {title} is replaced by the text from the notifier
|
||||
subject: "[Authelia] {title}"
|
||||
## This address is used during the startup check to verify the email configuration is correct.
|
||||
## It's not important what it is except if your email server only allows local delivery.
|
||||
startup_check_address: test@authelia.com
|
||||
disable_require_tls: false
|
||||
disable_html_emails: false
|
||||
tls:
|
||||
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
|
||||
server_name: ""
|
||||
## Skip verifying the server certificate (to allow a self-signed certificate).
|
||||
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
||||
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
||||
skip_verify: false
|
||||
## Minimum TLS version for either StartTLS or SMTPS.
|
||||
minimum_version: TLS1.2
|
||||
identity_providers:
|
||||
oidc:
|
||||
## Enables this in the config map. Currently in beta stage.
|
||||
## See https://www.authelia.com/docs/configuration/identity-providers/oidc.html#roadmap
|
||||
enabled: false
|
||||
access_token_lifespan: 1h
|
||||
authorize_code_lifespan: 1m
|
||||
id_token_lifespan: 1h
|
||||
refresh_token_lifespan: 90m
|
||||
enable_client_debug_messages: false
|
||||
## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for
|
||||
## security reasons.
|
||||
minimum_parameter_entropy: 8
|
||||
clients: []
|
||||
# clients:
|
||||
# -
|
||||
## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
|
||||
# id: myapp
|
||||
## The description to show to users when they end up on the consent screen. Defaults to the ID above.
|
||||
# description: My Application
|
||||
|
||||
## The client secret is a shared secret between Authelia and the consumer of this client.
|
||||
# secret: apple123
|
||||
|
||||
## Sets the client to public. This should typically not be set, please see the documentation for usage.
|
||||
# public: false
|
||||
|
||||
## The policy to require for this client; one_factor or two_factor.
|
||||
# authorization_policy: two_factor
|
||||
|
||||
## Configures the consent mode; auto, explicit or implicit
|
||||
# consent_mode: auto
|
||||
|
||||
## Audience this client is allowed to request.
|
||||
# audience: []
|
||||
|
||||
## Scopes this client is allowed to request.
|
||||
# scopes:
|
||||
# - openid
|
||||
# - profile
|
||||
# - email
|
||||
# - groups
|
||||
|
||||
## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
|
||||
# redirect_uris:
|
||||
# - https://oidc.example.com/oauth2/callback
|
||||
|
||||
## Grant Types configures which grants this client can obtain.
|
||||
## It's not recommended to configure this unless you know what you're doing.
|
||||
# grant_types:
|
||||
# - refresh_token
|
||||
# - authorization_code
|
||||
|
||||
## Response Types configures which responses this client can be sent.
|
||||
## It's not recommended to configure this unless you know what you're doing.
|
||||
# response_types:
|
||||
# - code
|
||||
|
||||
## Response Modes configures which response modes this client supports.
|
||||
## It's not recommended to configure this unless you know what you're doing.
|
||||
# response_modes:
|
||||
# - form_post
|
||||
# - query
|
||||
# - fragment
|
||||
|
||||
## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
|
||||
# userinfo_signing_algorithm: none
|
||||
|
||||
portal:
|
||||
open:
|
||||
enabled: true
|
||||
|
||||
ingress:
|
||||
main:
|
||||
required: true
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1 @@
|
|||
{{- include "tc.v1.common.lib.chart.notes" $ -}}
|
||||
|
|
@ -0,0 +1,363 @@
|
|||
{{/* Define the configmap */}}
|
||||
{{- define "authelia.configmap.paths" -}}
|
||||
enabled: true
|
||||
data:
|
||||
AUTHELIA_SERVER_DISABLE_HEALTHCHECK: "true"
|
||||
AUTHELIA_JWT_SECRET_FILE: "/secrets/JWT_TOKEN"
|
||||
AUTHELIA_SESSION_SECRET_FILE: "/secrets/SESSION_ENCRYPTION_KEY"
|
||||
AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: "/secrets/ENCRYPTION_KEY"
|
||||
AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE: "/secrets/STORAGE_PASSWORD"
|
||||
{{- if .Values.authentication_backend.ldap.enabled }}
|
||||
AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE: "/secrets/LDAP_PASSWORD"
|
||||
{{- end }}
|
||||
{{- if .Values.notifier.smtp.enabled }}
|
||||
AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE: "/secrets/SMTP_PASSWORD"
|
||||
{{- end }}
|
||||
AUTHELIA_SESSION_REDIS_PASSWORD_FILE: "/secrets/REDIS_PASSWORD"
|
||||
{{- if .Values.redisProvider.high_availability.enabled }}
|
||||
AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE: "/secrets/REDIS_SENTINEL_PASSWORD"
|
||||
{{- end }}
|
||||
{{- if .Values.duo_api.enabled }}
|
||||
AUTHELIA_DUO_API_SECRET_KEY_FILE: "/secrets/DUO_API_KEY"
|
||||
{{- end }}
|
||||
{{- if .Values.identity_providers.oidc.enabled }}
|
||||
AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE: "/secrets/OIDC_HMAC_SECRET"
|
||||
AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE: "/secrets/OIDC_PRIVATE_KEY"
|
||||
{{- end }}
|
||||
|
||||
{{- end -}}
|
||||
|
||||
{{- define "authelia.configmap.configfile" -}}
|
||||
enabled: true
|
||||
data:
|
||||
configuration.yaml: |
|
||||
---
|
||||
theme: {{ .Values.theme | default "light" }}
|
||||
default_redirection_url: {{ default (printf "https://www.%s" .Values.domain) .Values.default_redirection_url }}
|
||||
ntp:
|
||||
address: {{ .Values.ntp.address | default "time.cloudflare.com:123" }}
|
||||
version: {{ .Values.ntp.version | default 4 }}
|
||||
max_desync: {{ .Values.ntp.max_desync | default "3s" }}
|
||||
disable_startup_check: {{ .Values.ntp.disable_startup_check | default false }}
|
||||
disable_failure: {{ .Values.ntp.disable_failure | default true }}
|
||||
server:
|
||||
host: 0.0.0.0
|
||||
port: {{ .Values.server.port | default 9091 }}
|
||||
{{- if ne "" (.Values.server.path | default "") }}
|
||||
path: {{ .Values.server.path }}
|
||||
{{- end }}
|
||||
buffers:
|
||||
write: {{ .Values.server.write_buffer_size | default 4096 }}
|
||||
read: {{ .Values.server.read_buffer_size | default 4096 }}
|
||||
enable_pprof: {{ .Values.server.enable_pprof | default false }}
|
||||
enable_expvars: {{ .Values.server.enable_expvars | default false }}
|
||||
log:
|
||||
level: {{ .Values.log.level | default "info" }}
|
||||
format: {{ .Values.log.format | default "text" }}
|
||||
{{- if ne "" (.Values.log.file_path | default "") }}
|
||||
file_path: {{ .Values.log.file_path }}
|
||||
keep_stdout: true
|
||||
{{- end }}
|
||||
totp:
|
||||
issuer: {{ .Values.totp.issuer | default .Values.domain }}
|
||||
period: {{ .Values.totp.period | default 30 }}
|
||||
skew: {{ .Values.totp.skew | default 1 }}
|
||||
{{- if .Values.password_policy.enabled }}
|
||||
password_policy:
|
||||
standard:
|
||||
enabled: {{ .Values.password_policy.standard.enabled | default false }}
|
||||
min_length: {{ .Values.password_policy.standard.min_length | default 8 }}
|
||||
max_length: {{ .Values.password_policy.standard.max_length | default 0 }}
|
||||
require_uppercase: {{ .Values.password_policy.standard.require_uppercase | default false }}
|
||||
require_lowercase: {{ .Values.password_policy.standard.require_lowercase | default false }}
|
||||
require_number: {{ .Values.password_policy.standard.require_number | default false }}
|
||||
require_special: {{ .Values.password_policy.standard.require_special | default false }}
|
||||
zxcvbn:
|
||||
enabled: {{ .Values.password_policy.zxcvbn.enabled | default false }}
|
||||
min_score: {{ .Values.password_policy.zxcvbn.min_score | default 3 }}
|
||||
{{- end -}}
|
||||
{{- if .Values.duo_api.enabled }}
|
||||
duo_api:
|
||||
hostname: {{ .Values.duo_api.hostname }}
|
||||
integration_key: {{ .Values.duo_api.integration_key }}
|
||||
{{- end -}}
|
||||
{{- with $auth := .Values.authentication_backend }}
|
||||
authentication_backend:
|
||||
password_reset:
|
||||
disable: {{ $auth.disable_reset_password }}
|
||||
{{- if $auth.file.enabled }}
|
||||
file:
|
||||
path: {{ $auth.file.path }}
|
||||
password:
|
||||
{{- $p := $auth.file.password -}}
|
||||
{{- if $p.algorithm }}
|
||||
algorithm: {{ $p.algorithm }}
|
||||
{{- end -}}
|
||||
{{- if $p.iterations }}
|
||||
iterations: {{ $p.iterations }}
|
||||
{{- end -}}
|
||||
{{- if $p.key_length }}
|
||||
key_length: {{ $p.key_length }}
|
||||
{{- end -}}
|
||||
{{- if $p.salt_length }}
|
||||
salt_length: {{ $p.salt_length }}
|
||||
{{- end -}}
|
||||
{{- if $p.memory }}
|
||||
memory: {{ $p.memory }}
|
||||
{{- end -}}
|
||||
{{- if $p.parallelism }}
|
||||
parallelism: {{ $p.parallelism }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if $auth.ldap.enabled }}
|
||||
ldap:
|
||||
implementation: {{ $auth.ldap.implementation | default "custom" }}
|
||||
url: {{ $auth.ldap.url }}
|
||||
timeout: {{ $auth.ldap.timeout | default "5s" }}
|
||||
start_tls: {{ $auth.ldap.start_tls }}
|
||||
tls:
|
||||
{{- if hasKey $auth.ldap.tls "server_name" }}
|
||||
server_name: {{ $auth.ldap.tls.server_name | default $auth.ldap.host }}
|
||||
{{- end }}
|
||||
minimum_version: {{ $auth.ldap.tls.minimum_version | default "TLS1.2" }}
|
||||
skip_verify: {{ $auth.ldap.tls.skip_verify | default false }}
|
||||
{{- if $auth.ldap.base_dn }}
|
||||
base_dn: {{ $auth.ldap.base_dn }}
|
||||
{{- end -}}
|
||||
{{- if $auth.ldap.username_attribute }}
|
||||
username_attribute: {{ $auth.ldap.username_attribute }}
|
||||
{{- end -}}
|
||||
{{- if $auth.ldap.additional_users_dn }}
|
||||
additional_users_dn: {{ $auth.ldap.additional_users_dn }}
|
||||
{{- end -}}
|
||||
{{- if $auth.ldap.users_filter }}
|
||||
users_filter: {{ $auth.ldap.users_filter }}
|
||||
{{- end -}}
|
||||
{{- if $auth.ldap.additional_groups_dn }}
|
||||
additional_groups_dn: {{ $auth.ldap.additional_groups_dn }}
|
||||
{{- end -}}
|
||||
{{- if $auth.ldap.groups_filter }}
|
||||
groups_filter: {{ $auth.ldap.groups_filter }}
|
||||
{{- end -}}
|
||||
{{- if $auth.ldap.group_name_attribute }}
|
||||
group_name_attribute: {{ $auth.ldap.group_name_attribute }}
|
||||
{{- end -}}
|
||||
{{- if $auth.ldap.mail_attribute }}
|
||||
mail_attribute: {{ $auth.ldap.mail_attribute }}
|
||||
{{- end -}}
|
||||
{{- if $auth.ldap.display_name_attribute }}
|
||||
display_name_attribute: {{ $auth.ldap.display_name_attribute }}
|
||||
{{- end }}
|
||||
user: {{ $auth.ldap.user }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- with $session := .Values.session }}
|
||||
session:
|
||||
name: {{ $session.name | default "authelia_session" }}
|
||||
domain: {{ required "A valid .Values.domain entry required!" $.Values.domain }}
|
||||
same_site: {{ $session.same_site | default "lax" }}
|
||||
expiration: {{ $session.expiration | default "1M" }}
|
||||
inactivity: {{ $session.inactivity | default "5m" }}
|
||||
remember_me_duration: {{ $session.remember_me_duration | default "1M" }}
|
||||
{{- end }}
|
||||
redis:
|
||||
host: {{ .Values.redis.creds.plain }}
|
||||
{{- with $redis := .Values.redisProvider }}
|
||||
port: {{ $redis.port | default 6379 }}
|
||||
{{- if not (eq $redis.username "") }}
|
||||
username: {{ $redis.username }}
|
||||
{{- end }}
|
||||
maximum_active_connections: {{ $redis.maximum_active_connections | default 8 }}
|
||||
minimum_idle_connections: {{ $redis.minimum_idle_connections | default 0 }}
|
||||
{{- if $redis.tls.enabled }}
|
||||
tls:
|
||||
server_name: {{ $redis.tls.server_name }}
|
||||
minimum_version: {{ $redis.tls.minimum_version | default "TLS1.2" }}
|
||||
skip_verify: {{ $redis.tls.skip_verify }}
|
||||
{{- end }}
|
||||
{{- if $redis.high_availability.enabled }}
|
||||
high_availability:
|
||||
sentinel_name: {{ $redis.high_availability.sentinel_name }}
|
||||
{{- if $redis.high_availability.nodes }}
|
||||
nodes:
|
||||
{{- range $node := $redis.high_availability.nodes }}
|
||||
- host: {{ $node.host }}
|
||||
port: {{ $node.port | default 26379 }}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
route_by_latency: {{ $redis.high_availability.route_by_latency }}
|
||||
route_randomly: {{ $redis.high_availability.route_randomly }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
regulation:
|
||||
max_retries: {{ .Values.regulation.max_retries | default 3 }}
|
||||
find_time: {{ .Values.regulation.find_time | default "1m" }}
|
||||
ban_time: {{ .Values.regulation.ban_time | default "5m" }}
|
||||
storage:
|
||||
postgres:
|
||||
host: {{ $.Values.cnpg.main.creds.host }}
|
||||
{{- with $storage := .Values.storage }}
|
||||
port: {{ $storage.postgres.port | default 5432 }}
|
||||
database: {{ $storage.postgres.database | default "authelia" }}
|
||||
username: {{ $storage.postgres.username | default "authelia" }}
|
||||
timeout: {{ $storage.postgres.timeout | default "5s" }}
|
||||
ssl:
|
||||
mode: {{ $storage.postgres.sslmode | default "disable" }}
|
||||
{{- end }}
|
||||
{{- with $notifier := .Values.notifier }}
|
||||
notifier:
|
||||
disable_startup_check: {{ $.Values.notifier.disable_startup_check }}
|
||||
{{- if $notifier.filesystem.enabled }}
|
||||
filesystem:
|
||||
filename: {{ $notifier.filesystem.filename }}
|
||||
{{- end }}
|
||||
{{- if $notifier.smtp.enabled }}
|
||||
smtp:
|
||||
host: {{ $notifier.smtp.host }}
|
||||
port: {{ $notifier.smtp.port | default 25 }}
|
||||
timeout: {{ $notifier.smtp.timeout | default "5s" }}
|
||||
{{- with $notifier.smtp.username }}
|
||||
username: {{ . }}
|
||||
{{- end }}
|
||||
sender: {{ $notifier.smtp.sender | quote }}
|
||||
identifier: {{ $notifier.smtp.identifier | quote }}
|
||||
subject: {{ $notifier.smtp.subject | quote }}
|
||||
startup_check_address: {{ $notifier.smtp.startup_check_address | quote }}
|
||||
disable_require_tls: {{ $notifier.smtp.disable_require_tls }}
|
||||
disable_html_emails: {{ $notifier.smtp.disable_html_emails }}
|
||||
tls:
|
||||
server_name: {{ $notifier.smtp.tls.server_name | default $notifier.smtp.host }}
|
||||
minimum_version: {{ $notifier.smtp.tls.minimum_version | default "TLS1.2" }}
|
||||
skip_verify: {{ $notifier.smtp.tls.skip_verify | default false }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.identity_providers.oidc.enabled }}
|
||||
identity_providers:
|
||||
oidc:
|
||||
access_token_lifespan: {{ .Values.identity_providers.oidc.access_token_lifespan | default "1h" }}
|
||||
authorize_code_lifespan: {{ .Values.identity_providers.oidc.authorize_code_lifespan | default "1m" }}
|
||||
id_token_lifespan: {{ .Values.identity_providers.oidc.id_token_lifespan | default "1h" }}
|
||||
refresh_token_lifespan: {{ .Values.identity_providers.oidc.refresh_token_lifespan | default "90m" }}
|
||||
enable_client_debug_messages: {{ .Values.identity_providers.oidc.enable_client_debug_messages | default false }}
|
||||
minimum_parameter_entropy: {{ .Values.identity_providers.oidc.minimum_parameter_entropy | default 8 }}
|
||||
{{- if .Values.identity_providers.oidc.clients }}
|
||||
clients:
|
||||
{{- range $client := .Values.identity_providers.oidc.clients }}
|
||||
- id: {{ $client.id }}
|
||||
description: {{ $client.description | default $client.id }}
|
||||
secret: {{ $client.secret | default (randAlphaNum 128) }}
|
||||
{{- if $client.public }}
|
||||
public: {{ $client.public }}
|
||||
{{- end }}
|
||||
authorization_policy: {{ $client.authorization_policy | default "two_factor" }}
|
||||
consent_mode: {{ $client.consent_mode | default "auto" }}
|
||||
redirect_uris:
|
||||
{{- range $client.redirect_uris }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- if $client.audience }}
|
||||
audience:
|
||||
{{- range $client.audience }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
scopes:
|
||||
{{- range ($client.scopes | default (list "openid" "profile" "email" "groups")) }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
grant_types:
|
||||
{{- range ($client.grant_types | default (list "refresh_token" "authorization_code")) }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
response_types:
|
||||
{{- range ($client.response_types | default (list "code")) }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- if $client.response_modes }}
|
||||
response_modes:
|
||||
{{- range $client.response_modes }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
userinfo_signing_algorithm: {{ $client.userinfo_signing_algorithm | default "none" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
access_control:
|
||||
{{- if not .Values.access_control.rules }}
|
||||
{{- if (eq .Values.access_control.default_policy "bypass") }}
|
||||
default_policy: one_factor
|
||||
{{- else if (eq .Values.access_control.default_policy "deny") }}
|
||||
default_policy: two_factor
|
||||
{{- else }}
|
||||
default_policy: {{ .Values.access_control.default_policy }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
default_policy: {{ .Values.access_control.default_policy }}
|
||||
{{- end }}
|
||||
|
||||
{{- if not .Values.access_control.networks }}
|
||||
networks: []
|
||||
{{- else }}
|
||||
networks:
|
||||
{{- range $net := .Values.access_control.networks }}
|
||||
- name: {{ $net.name }}
|
||||
networks:
|
||||
{{- range $net.networks }}
|
||||
- {{ . | squote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if not .Values.access_control.rules }}
|
||||
rules: []
|
||||
{{- else }}
|
||||
rules:
|
||||
{{- range $rule := .Values.access_control.rules }}
|
||||
{{- if $rule.domain }}
|
||||
- domain:
|
||||
{{- if kindIs "string" $rule.domain }}
|
||||
- {{ $rule.domain | squote }}
|
||||
{{- else -}}
|
||||
{{- range $rule.domain }}
|
||||
- {{ . | squote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- with $rule.policy }}
|
||||
policy: {{ . }}
|
||||
{{- end -}}
|
||||
{{- if $rule.networks }}
|
||||
networks:
|
||||
{{- if kindIs "string" $rule.networks }}
|
||||
- {{ $rule.networks | squote }}
|
||||
{{- else -}}
|
||||
{{- range $rule.networks }}
|
||||
- {{ . | squote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $rule.subject }}
|
||||
subject:
|
||||
{{- if kindIs "string" $rule.subject }}
|
||||
- {{ $rule.subject | squote }}
|
||||
{{- else -}}
|
||||
{{- range $rule.subject }}
|
||||
- {{ . | squote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $rule.resources }}
|
||||
resources:
|
||||
{{- if kindIs "string" $rule.resources }}
|
||||
- {{ $rule.resources | squote }}
|
||||
{{- else -}}
|
||||
{{- range $rule.resources }}
|
||||
- {{ . | squote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
...
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
{{/* Define the secrets */}}
|
||||
{{- define "authelia.secrets" -}}
|
||||
{{- $basename := include "tc.v1.common.lib.chart.names.fullname" $ -}}
|
||||
{{- $fetchname := printf "%s-authelia-secrets" $basename -}}
|
||||
|
||||
{{/* Initialize all keys */}}
|
||||
{{- $oidckey := genPrivateKey "rsa" }}
|
||||
{{- $oidcsecret := randAlphaNum 32 }}
|
||||
{{- $jwtsecret := randAlphaNum 50 }}
|
||||
{{- $sessionsecret := randAlphaNum 50 }}
|
||||
{{- $encryptionkey := randAlphaNum 100 }}
|
||||
|
||||
enabled: true
|
||||
data:
|
||||
{{ with (lookup "v1" "Secret" .Release.Namespace $fetchname) }}
|
||||
{{/* Get previous values and decode */}}
|
||||
{{ $sessionsecret = (index .data "SESSION_ENCRYPTION_KEY") | b64dec }}
|
||||
{{ $jwtsecret = (index .data "JWT_TOKEN") | b64dec }}
|
||||
{{ $encryptionkey = (index .data "ENCRYPTION_KEY") | b64dec }}
|
||||
|
||||
{{/* Check if those keys ever existed. as OIDC is optional */}}
|
||||
{{ if and (hasKey .data "OIDC_PRIVATE_KEY") (hasKey .data "OIDC_HMAC_SECRET") }}
|
||||
{{ $oidckey = (index .data "OIDC_PRIVATE_KEY") | b64dec }}
|
||||
{{ $oidcsecret = (index .data "OIDC_HMAC_SECRET") | b64dec }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
SESSION_ENCRYPTION_KEY: {{ $sessionsecret }}
|
||||
JWT_TOKEN: {{ $jwtsecret }}
|
||||
ENCRYPTION_KEY: {{ $encryptionkey }}
|
||||
|
||||
{{- if .Values.authentication_backend.ldap.enabled }}
|
||||
LDAP_PASSWORD: {{ .Values.authentication_backend.ldap.plain_password }}
|
||||
{{- end }}
|
||||
|
||||
{{- if and .Values.notifier.smtp.enabled .Values.notifier.smtp.plain_password }}
|
||||
SMTP_PASSWORD: {{ .Values.notifier.smtp.plain_password }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.duo_api.enabled }}
|
||||
DUO_API_KEY: {{ .Values.duo_api.plain_api_key }}
|
||||
{{- end }}
|
||||
|
||||
STORAGE_PASSWORD: {{ $.Values.cnpg.main.creds.password | trimAll "\"" }}
|
||||
|
||||
REDIS_PASSWORD: {{ .Values.redis.creds.redisPassword | trimAll "\"" }}
|
||||
{{- if .Values.redisProvider.high_availability.enabled }}
|
||||
REDIS_SENTINEL_PASSWORD: {{ .Values.redis.sentinelPassword | trimAll "\"" }}
|
||||
{{- end }}
|
||||
|
||||
OIDC_PRIVATE_KEY: |
|
||||
{{- $oidckey | nindent 4 }}
|
||||
OIDC_HMAC_SECRET: {{ $oidcsecret }}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,77 @@
|
|||
{{/* Make sure all variables are set properly */}}
|
||||
{{- include "tc.v1.common.loader.init" . }}
|
||||
|
||||
{{/* Render configmap for authelia */}}
|
||||
{{- $configmapPaths := include "authelia.configmap.paths" . | fromYaml -}}
|
||||
{{- if $configmapPaths -}}
|
||||
{{- $_ := set .Values.configmap "authelia-paths" $configmapPaths -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $configmapFile := include "authelia.configmap.configfile" . | fromYaml -}}
|
||||
{{- if $configmapFile -}}
|
||||
{{- $_ := set .Values.configmap "authelia-configfile" $configmapFile -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Render secrets for authelia */}}
|
||||
{{- $secret := include "authelia.secrets" . | fromYaml -}}
|
||||
{{- if $secret -}}
|
||||
{{- $_ := set .Values.secret "authelia-secrets" $secret -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Append the general configMap volume to the volumes */}}
|
||||
{{- define "authelia.configmapVolume" -}}
|
||||
enabled: true
|
||||
mountPath: /configuration.yaml
|
||||
subPath: configuration.yaml
|
||||
readOnly: true
|
||||
type: "configmap"
|
||||
objectName: authelia-configfile
|
||||
{{- end -}}
|
||||
|
||||
{{/* Append the general secret volumes to the volumes */}}
|
||||
{{- define "authelia.secretVolumes" -}}
|
||||
enabled: true
|
||||
mountPath: "/secrets"
|
||||
readOnly: true
|
||||
type: "secret"
|
||||
objectName: authelia-secrets
|
||||
items:
|
||||
- key: "JWT_TOKEN"
|
||||
path: JWT_TOKEN
|
||||
- key: "SESSION_ENCRYPTION_KEY"
|
||||
path: SESSION_ENCRYPTION_KEY
|
||||
- key: "ENCRYPTION_KEY"
|
||||
path: ENCRYPTION_KEY
|
||||
- key: "STORAGE_PASSWORD"
|
||||
path: STORAGE_PASSWORD
|
||||
{{- if .Values.authentication_backend.ldap.enabled }}
|
||||
- key: "LDAP_PASSWORD"
|
||||
path: LDAP_PASSWORD
|
||||
{{- end }}
|
||||
{{- if and .Values.notifier.smtp.enabled .Values.notifier.smtp.plain_password }}
|
||||
- key: "SMTP_PASSWORD"
|
||||
path: SMTP_PASSWORD
|
||||
{{- end }}
|
||||
- key: "REDIS_PASSWORD"
|
||||
path: REDIS_PASSWORD
|
||||
{{- if .Values.redisProvider.high_availability.enabled}}
|
||||
- key: "REDIS_SENTINEL_PASSWORD"
|
||||
path: REDIS_SENTINEL_PASSWORD
|
||||
{{- end }}
|
||||
{{- if .Values.duo_api.enabled }}
|
||||
- key: "DUO_API_KEY"
|
||||
path: DUO_API_KEY
|
||||
{{- end }}
|
||||
{{- if .Values.identity_providers.oidc.enabled }}
|
||||
- key: "OIDC_PRIVATE_KEY"
|
||||
path: OIDC_PRIVATE_KEY
|
||||
- key: "OIDC_HMAC_SECRET"
|
||||
path: OIDC_HMAC_SECRET
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- $_ := set .Values.persistence "authelia-configfile" (include "authelia.configmapVolume" . | fromYaml) -}}
|
||||
{{- $_ := set .Values.persistence "authelia-secrets" (include "authelia.secretVolumes" . | fromYaml) -}}
|
||||
|
||||
{{/* Render the templates */}}
|
||||
{{ include "tc.v1.common.loader.apply" . }}
|
||||
|
|
@ -0,0 +1,99 @@
|
|||
**Important:**
|
||||
*for the complete changelog, please refer to the website*
|
||||
|
||||
|
||||
|
||||
|
||||
## [vaultwarden-24.0.5](https://github.com/truecharts/charts/compare/vaultwarden-24.0.4...vaultwarden-24.0.5) (2023-12-21)
|
||||
|
||||
### Chore
|
||||
|
||||
- require ingress for certain charts
|
||||
|
||||
|
||||
|
||||
|
||||
## [vaultwarden-24.0.4](https://github.com/truecharts/charts/compare/vaultwarden-24.0.3...vaultwarden-24.0.4) (2023-12-21)
|
||||
|
||||
|
||||
|
||||
|
||||
## [vaultwarden-24.0.3](https://github.com/truecharts/charts/compare/vaultwarden-24.0.2...vaultwarden-24.0.3) (2023-12-21)
|
||||
|
||||
### Chore
|
||||
|
||||
- bump everything to ensure patches are applied globally
|
||||
|
||||
### Fix
|
||||
|
||||
- ensure the cnpg GUI is included on CNPG apps
|
||||
|
||||
|
||||
|
||||
|
||||
## [vaultwarden-24.0.2](https://github.com/truecharts/charts/compare/vaultwarden-24.0.1...vaultwarden-24.0.2) (2023-12-21)
|
||||
|
||||
### Chore
|
||||
|
||||
- update helm general non-major by renovate ([#16341](https://github.com/truecharts/charts/issues/16341))
|
||||
|
||||
|
||||
|
||||
|
||||
## [vaultwarden-24.0.1](https://github.com/truecharts/charts/compare/vaultwarden-24.0.0...vaultwarden-24.0.1) (2023-12-20)
|
||||
|
||||
### Chore
|
||||
|
||||
- bump patch versions on all charts for new GUI release
|
||||
|
||||
|
||||
|
||||
|
||||
## [vaultwarden-24.0.0](https://github.com/truecharts/charts/compare/vaultwarden-23.0.15...vaultwarden-24.0.0) (2023-12-20)
|
||||
|
||||
### Chore
|
||||
|
||||
- update helm general major by renovate (major) ([#14631](https://github.com/truecharts/charts/issues/14631))
|
||||
|
||||
|
||||
|
||||
|
||||
## [vaultwarden-23.0.15](https://github.com/truecharts/charts/compare/vaultwarden-23.0.14...vaultwarden-23.0.15) (2023-12-20)
|
||||
|
||||
### Chore
|
||||
|
||||
- Bump everything to force min/max scale version update
|
||||
|
||||
|
||||
|
||||
|
||||
## [vaultwarden-23.0.14](https://github.com/truecharts/charts/compare/vaultwarden-23.0.12...vaultwarden-23.0.14) (2023-12-16)
|
||||
|
||||
### Chore
|
||||
|
||||
- fix move mistake and cleanup metadata
|
||||
- update helm general non-major ([#14784](https://github.com/truecharts/charts/issues/14784))
|
||||
|
||||
|
||||
|
||||
|
||||
## [vaultwarden-23.0.14](https://github.com/truecharts/charts/compare/vaultwarden-23.0.12...vaultwarden-23.0.14) (2023-12-16)
|
||||
|
||||
### Chore
|
||||
|
||||
- fix move mistake and cleanup metadata
|
||||
- update helm general non-major ([#14784](https://github.com/truecharts/charts/issues/14784))
|
||||
|
||||
|
||||
|
||||
|
||||
## [vaultwarden-23.0.13](https://github.com/truecharts/charts/compare/vaultwarden-23.0.12...vaultwarden-23.0.13) (2023-12-16)
|
||||
|
||||
### Chore
|
||||
|
||||
- fix move mistake and cleanup metadata
|
||||
|
||||
|
||||
|
||||
|
||||
## [vaultwarden-23.0.12](https://github.com/truecharts/charts/compare/vaultwarden-23.0.11...vaultwarden-23.0.12) (2023-12-03)
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
kubeVersion: ">=1.24.0-0"
|
||||
apiVersion: v2
|
||||
name: vaultwarden
|
||||
version: 24.0.5
|
||||
appVersion: 1.30.1
|
||||
description: Unofficial Bitwarden compatible server written in Rust
|
||||
home: https://truecharts.org/charts/enterprise/vaultwarden
|
||||
icon: https://truecharts.org/img/hotlink-ok/chart-icons/vaultwarden.png
|
||||
deprecated: false
|
||||
sources:
|
||||
- https://github.com/dani-garcia/vaultwarden
|
||||
- https://github.com/truecharts/charts/tree/master/charts/enterprise/vaultwarden
|
||||
- https://hub.docker.com/r/vaultwarden/server
|
||||
maintainers:
|
||||
- name: TrueCharts
|
||||
email: info@truecharts.org
|
||||
url: https://truecharts.org
|
||||
keywords:
|
||||
- bitwarden
|
||||
- bitwardenrs
|
||||
- bitwarden_rs
|
||||
- vaultwarden
|
||||
- password
|
||||
- rust
|
||||
dependencies:
|
||||
- name: common
|
||||
version: 16.2.9
|
||||
repository: https://library-charts.truecharts.org
|
||||
condition: ""
|
||||
alias: ""
|
||||
tags: []
|
||||
import-values: []
|
||||
annotations:
|
||||
max_scale_version: 23.10.2
|
||||
min_scale_version: 23.10.0
|
||||
truecharts.org/SCALE-support: "true"
|
||||
truecharts.org/category: security
|
||||
truecharts.org/max_helm_version: "3.13"
|
||||
truecharts.org/min_helm_version: "3.12"
|
||||
truecharts.org/train: enterprise
|
||||
type: application
|
||||
|
|
@ -0,0 +1,106 @@
|
|||
Business Source License 1.1
|
||||
|
||||
Parameters
|
||||
|
||||
Licensor: The TrueCharts Project, it's owner and it's contributors
|
||||
Licensed Work: The TrueCharts "Cert-Manager" Helm Chart
|
||||
Additional Use Grant: You may use the licensed work in production, as long
|
||||
as it is directly sourced from a TrueCharts provided
|
||||
official repository, catalog or source. You may also make private
|
||||
modification to the directly sourced licenced work,
|
||||
when used in production.
|
||||
|
||||
The following cases are, due to their nature, also
|
||||
defined as 'production use' and explicitly prohibited:
|
||||
- Bundling, including or displaying the licensed work
|
||||
with(in) another work intended for production use,
|
||||
with the apparent intend of facilitating and/or
|
||||
promoting production use by third parties in
|
||||
violation of this license.
|
||||
|
||||
Change Date: 2050-01-01
|
||||
|
||||
Change License: 3-clause BSD license
|
||||
|
||||
For information about alternative licensing arrangements for the Software,
|
||||
please contact: legal@truecharts.org
|
||||
|
||||
Notice
|
||||
|
||||
The Business Source License (this document, or the “License”) is not an Open
|
||||
Source license. However, the Licensed Work will eventually be made available
|
||||
under an Open Source License, as stated in this License.
|
||||
|
||||
License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
|
||||
“Business Source License” is a trademark of MariaDB Corporation Ab.
|
||||
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
Business Source License 1.1
|
||||
|
||||
Terms
|
||||
|
||||
The Licensor hereby grants you the right to copy, modify, create derivative
|
||||
works, redistribute, and make non-production use of the Licensed Work. The
|
||||
Licensor may make an Additional Use Grant, above, permitting limited
|
||||
production use.
|
||||
|
||||
Effective on the Change Date, or the fourth anniversary of the first publicly
|
||||
available distribution of a specific version of the Licensed Work under this
|
||||
License, whichever comes first, the Licensor hereby grants you rights under
|
||||
the terms of the Change License, and the rights granted in the paragraph
|
||||
above terminate.
|
||||
|
||||
If your use of the Licensed Work does not comply with the requirements
|
||||
currently in effect as described in this License, you must purchase a
|
||||
commercial license from the Licensor, its affiliated entities, or authorized
|
||||
resellers, or you must refrain from using the Licensed Work.
|
||||
|
||||
All copies of the original and modified Licensed Work, and derivative works
|
||||
of the Licensed Work, are subject to this License. This License applies
|
||||
separately for each version of the Licensed Work and the Change Date may vary
|
||||
for each version of the Licensed Work released by Licensor.
|
||||
|
||||
You must conspicuously display this License on each original or modified copy
|
||||
of the Licensed Work. If you receive the Licensed Work in original or
|
||||
modified form from a third party, the terms and conditions set forth in this
|
||||
License apply to your use of that work.
|
||||
|
||||
Any use of the Licensed Work in violation of this License will automatically
|
||||
terminate your rights under this License for the current and all other
|
||||
versions of the Licensed Work.
|
||||
|
||||
This License does not grant you any right in any trademark or logo of
|
||||
Licensor or its affiliates (provided that you may use a trademark or logo of
|
||||
Licensor as expressly required by this License).
|
||||
|
||||
TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
|
||||
AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
|
||||
EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
|
||||
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
|
||||
TITLE.
|
||||
|
||||
MariaDB hereby grants you permission to use this License’s text to license
|
||||
your works, and to refer to it using the trademark “Business Source License”,
|
||||
as long as you comply with the Covenants of Licensor below.
|
||||
|
||||
Covenants of Licensor
|
||||
|
||||
In consideration of the right to use this License’s text and the “Business
|
||||
Source License” name and trademark, Licensor covenants to MariaDB, and to all
|
||||
other recipients of the licensed work to be provided by Licensor:
|
||||
|
||||
1. To specify as the Change License the GPL Version 2.0 or any later version,
|
||||
or a license that is compatible with GPL Version 2.0 or a later version,
|
||||
where “compatible” means that software provided under the Change License can
|
||||
be included in a program with software provided under GPL Version 2.0 or a
|
||||
later version. Licensor may specify additional Change Licenses without
|
||||
limitation.
|
||||
|
||||
2. To either: (a) specify an additional grant of rights to use that does not
|
||||
impose any additional restriction on the right granted in this License, as
|
||||
the Additional Use Grant; or (b) insert the text “None”.
|
||||
|
||||
3. To specify a Change Date.
|
||||
|
||||
4. Not to modify this License in any other way.
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
# README
|
||||
|
||||
## General Info
|
||||
|
||||
TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE.
|
||||
However only installations using the TrueNAS SCALE Apps system are supported.
|
||||
|
||||
For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/enterprise/vaultwarden)
|
||||
|
||||
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
|
||||
- See the [Website](https://truecharts.org)
|
||||
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
||||
- Open a [issue](https://github.com/truecharts/charts/issues/new/choose)
|
||||
|
||||
---
|
||||
|
||||
## Sponsor TrueCharts
|
||||
|
||||
TrueCharts can only exist due to the incredible effort of our staff.
|
||||
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
||||
|
||||
*All Rights Reserved - The TrueCharts Project*
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
|
||||
|
||||
## [vaultwarden-24.0.5](https://github.com/truecharts/charts/compare/vaultwarden-24.0.4...vaultwarden-24.0.5) (2023-12-21)
|
||||
|
||||
### Chore
|
||||
|
||||
- require ingress for certain charts
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
Unofficial Bitwarden compatible server written in Rust
|
||||
|
||||
This App is supplied by TrueCharts, for more information visit the manual: [https://truecharts.org/charts/enterprise/vaultwarden](https://truecharts.org/charts/enterprise/vaultwarden)
|
||||
|
||||
---
|
||||
|
||||
TrueCharts can only exist due to the incredible effort of our staff.
|
||||
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
||||
Binary file not shown.
|
|
@ -0,0 +1,152 @@
|
|||
image:
|
||||
repository: docker.io/vaultwarden/server
|
||||
pullPolicy: IfNotPresent
|
||||
tag: 1.30.1@sha256:ab9fe547277245533a28d8e0a0c4a1e1120daf469f983fd683fc13556927d4fe
|
||||
manifestManager:
|
||||
enabled: true
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
main:
|
||||
port: 10102
|
||||
targetPort: 8080
|
||||
workload:
|
||||
main:
|
||||
podSpec:
|
||||
containers:
|
||||
main:
|
||||
env:
|
||||
DOMAIN: "https://{{ if .Values.ingress }}{{ if .Values.ingress.main.enabled }}{{ ( index .Values.ingress.main.hosts 0 ).host }}{{ else }}placeholder.com{{ end }}{{ else }}placeholder.com{{ end }}"
|
||||
DATABASE_URL:
|
||||
secretKeyRef:
|
||||
name: cnpg-main-urls
|
||||
key: std
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: vaultwardenconfig
|
||||
- secretRef:
|
||||
name: vaultwardensecret
|
||||
database:
|
||||
# -- Database type,
|
||||
# must be one of: 'sqlite', 'mysql' or 'postgresql'.
|
||||
type: postgresql
|
||||
# -- Enable DB Write-Ahead-Log for SQLite,
|
||||
# disabled for other databases. https://github.com/dani-garcia/bitwarden_rs/wiki/Running-without-WAL-enabled
|
||||
wal: true
|
||||
## URL for external databases (mysql://user:pass@host:port or postgresql://user:pass@host:port).
|
||||
# url: ""
|
||||
## Set the size of the database connection pool.
|
||||
# maxConnections: 10
|
||||
## Connection retries during startup, 0 for infinite. 1 second between retries.
|
||||
# retries: 15
|
||||
# Set Bitwarden_rs application variables
|
||||
vaultwarden:
|
||||
# -- Allow any user to sign-up
|
||||
# see: https://github.com/dani-garcia/bitwarden_rs/wiki/Disable-registration-of-new-users
|
||||
allowSignups: true
|
||||
## Whitelist domains allowed to sign-up. 'allowSignups' is ignored if set.
|
||||
# signupDomains:
|
||||
# - domain.tld
|
||||
# -- Verify e-mail before login is enabled.
|
||||
# SMTP must be enabled.
|
||||
verifySignup: false
|
||||
# When a user logs in an email is required to be sent. If sending the email fails the login attempt will fail. SMTP must be enabled.
|
||||
requireEmail: false
|
||||
## Maximum attempts before an email token is reset and a new email will need to be sent.
|
||||
# emailAttempts: 3
|
||||
## Email token validity in seconds.
|
||||
# emailTokenExpiration: 600
|
||||
# Allow invited users to sign-up even feature is disabled: https://github.com/dani-garcia/bitwarden_rs/wiki/Disable-invitations
|
||||
allowInvitation: true
|
||||
# Show password hints: https://github.com/dani-garcia/bitwarden_rs/wiki/Password-hint-display
|
||||
## Default organization name in invitation e-mails that are not coming from a specific organization.
|
||||
# defaultInviteName: ""
|
||||
showPasswordHint: true
|
||||
# Enable Web Vault (static content). https://github.com/dani-garcia/bitwarden_rs/wiki/Disabling-or-overriding-the-Vault-interface-hosting
|
||||
enableWebVault: true
|
||||
# Restrict creation of orgs. Options are: 'all', 'none' or a comma-separated list of users.
|
||||
orgCreationUsers: all
|
||||
## Limit attachment disk usage per organization.
|
||||
# attachmentLimitOrg:
|
||||
## Limit attachment disk usage per user.
|
||||
# attachmentLimitUser:
|
||||
## HaveIBeenPwned API Key. Can be purchased at https://haveibeenpwned.com/API/Key.
|
||||
# hibpApiKey:
|
||||
|
||||
admin:
|
||||
# Enable admin portal.
|
||||
enabled: false
|
||||
# Disabling the admin token will make the admin portal accessible to anyone, use carefully: https://github.com/dani-garcia/bitwarden_rs/wiki/Disable-admin-token
|
||||
disableAdminToken: false
|
||||
## Token for admin login, will be generated if not defined. https://github.com/dani-garcia/bitwarden_rs/wiki/Enabling-admin-page
|
||||
# token:
|
||||
# Enable SMTP. https://github.com/dani-garcia/bitwarden_rs/wiki/SMTP-configuration
|
||||
smtp:
|
||||
enabled: false
|
||||
# SMTP hostname, required if SMTP is enabled.
|
||||
host: ""
|
||||
# SMTP sender e-mail address, required if SMTP is enabled.
|
||||
from: ""
|
||||
## SMTP sender name, defaults to 'Bitwarden_RS'.
|
||||
# fromName: ""
|
||||
## Enable SSL connection.
|
||||
# security: starttls
|
||||
## SMTP port. Defaults to 587 with STARTTLS, 465 with FORCE_TLS, and 25 without SSL.
|
||||
# port: 587
|
||||
## SMTP Authentication Mechanisms. Comma-separated options: 'Plain', 'Login' and 'Xoauth2'. Defaults to 'Plain'.
|
||||
# authMechanism: Plain
|
||||
## Hostname to be sent for SMTP HELO. Defaults to pod name.
|
||||
# heloName: ""
|
||||
## SMTP timeout.
|
||||
# timeout: 15
|
||||
## Accept SSL session if certificate is valid but hostname doesn't match. DANGEROUS, vulnerable to men-in-the-middle attacks!
|
||||
# invalidHostname: false
|
||||
## Accept invalid certificates. DANGEROUS, vulnerable to men-in-the-middle attacks!
|
||||
# invalidCertificate: false
|
||||
## SMTP username.
|
||||
# user: ""
|
||||
## SMTP password. Required is user is specified, ignored if no user provided.
|
||||
# password: ""
|
||||
## Enable Yubico OTP authentication. https://github.com/dani-garcia/bitwarden_rs/wiki/Enabling-Yubikey-OTP-authentication
|
||||
yubico:
|
||||
enabled: false
|
||||
## Yubico server. Defaults to YubiCloud.
|
||||
# server:
|
||||
## Yubico ID and Secret Key.
|
||||
# clientId:
|
||||
# secretKey:
|
||||
## Enable Mobile Push Notifications. You must obtain and ID and Key here: https://bitwarden.com/host
|
||||
push:
|
||||
enabled: false
|
||||
# installationId:
|
||||
# installationKey:
|
||||
## Logging options. https://github.com/dani-garcia/bitwarden_rs/wiki/Logging
|
||||
log:
|
||||
# Log to file.
|
||||
file: ""
|
||||
# Log level. Options are "trace", "debug", "info", "warn", "error" or "off".
|
||||
level: "trace"
|
||||
## Log timestamp format. See https://docs.rs/chrono/0.4.15/chrono/format/strftime/index.html. Defaults to time in milliseconds.
|
||||
# timeFormat: ""
|
||||
icons:
|
||||
# Disables download of external icons. Setting to true will still serve icons from cache (/data/icon_cache). TTL will default to zero.
|
||||
disableDownload: false
|
||||
## Cache time-to-live for icons fetched. 0 means no purging.
|
||||
# cache: 2592000
|
||||
## Cache time-to-live for icons that were not available. 0 means no purging.
|
||||
# cacheFailed: 259200
|
||||
persistence:
|
||||
data:
|
||||
enabled: true
|
||||
mountPath: "/data"
|
||||
cnpg:
|
||||
main:
|
||||
enabled: true
|
||||
user: vaultwarden
|
||||
database: vaultwarden
|
||||
portal:
|
||||
open:
|
||||
enabled: true
|
||||
ingress:
|
||||
main:
|
||||
required: true
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1 @@
|
|||
{{- include "tc.v1.common.lib.chart.notes" $ -}}
|
||||
|
|
@ -0,0 +1,111 @@
|
|||
{{/* Define the configmap */}}
|
||||
{{- define "vaultwarden.configmap" -}}
|
||||
enabled: true
|
||||
data:
|
||||
ROCKET_PORT: "8080"
|
||||
SIGNUPS_ALLOWED: {{ .Values.vaultwarden.allowSignups | quote }}
|
||||
{{- if .Values.vaultwarden.signupDomains }}
|
||||
SIGNUPS_DOMAINS_WHITELIST: {{ join "," .Values.vaultwarden.signupDomains | quote }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.vaultwarden.verifySignup true) (eq .Values.vaultwarden.smtp.enabled false) }}{{ required "Signup verification requires SMTP to be enabled" nil}}{{end}}
|
||||
SIGNUPS_VERIFY: {{ .Values.vaultwarden.verifySignup | quote }}
|
||||
{{- if and (eq .Values.vaultwarden.requireEmail true) (eq .Values.vaultwarden.smtp.enabled false) }}{{ required "Requiring emails for login depends on SMTP" nil}}{{end}}
|
||||
REQUIRE_DEVICE_EMAIL: {{ .Values.vaultwarden.requireEmail | quote }}
|
||||
{{- if .Values.vaultwarden.emailAttempts }}
|
||||
EMAIL_ATTEMPTS_LIMIT: {{ .Values.vaultwarden.emailAttempts | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vaultwarden.emailTokenExpiration }}
|
||||
EMAIL_EXPIRATION_TIME: {{ .Values.vaultwarden.emailTokenExpiration | quote }}
|
||||
{{- end }}
|
||||
INVITATIONS_ALLOWED: {{ .Values.vaultwarden.allowInvitation | quote }}
|
||||
{{- if .Values.vaultwarden.defaultInviteName }}
|
||||
INVITATION_ORG_NAME: {{ .Values.vaultwarden.defaultInviteName | quote }}
|
||||
{{- end }}
|
||||
SHOW_PASSWORD_HINT: {{ .Values.vaultwarden.showPasswordHint | quote }}
|
||||
WEB_VAULT_ENABLED: {{ .Values.vaultwarden.enableWebVault | quote }}
|
||||
ORG_CREATION_USERS: {{ .Values.vaultwarden.orgCreationUsers | quote }}
|
||||
{{- if .Values.vaultwarden.attachmentLimitOrg }}
|
||||
ORG_ATTACHMENT_LIMIT: {{ .Values.vaultwarden.attachmentLimitOrg | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vaultwarden.attachmentLimitUser }}
|
||||
USER_ATTACHMENT_LIMIT: {{ .Values.vaultwarden.attachmentLimitUser | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vaultwarden.hibpApiKey }}
|
||||
HIBP_API_KEY: {{ .Values.vaultwarden.hibpApiKey | quote }}
|
||||
{{- end }}
|
||||
{{- include "vaultwarden.dbTypeValid" . }}
|
||||
{{- if .Values.database.retries }}
|
||||
DB_CONNECTION_RETRIES: {{ .Values.database.retries | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.database.maxConnections }}
|
||||
DATABASE_MAX_CONNS: {{ .Values.database.maxConnections | quote }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.vaultwarden.smtp.enabled true }}
|
||||
SMTP_HOST: {{ required "SMTP host is required to enable SMTP" .Values.vaultwarden.smtp.host | quote }}
|
||||
SMTP_FROM: {{ required "SMTP sender address ('from') is required to enable SMTP" .Values.vaultwarden.smtp.from | quote }}
|
||||
{{- if .Values.vaultwarden.smtp.fromName }}
|
||||
SMTP_FROM_NAME: {{ .Values.vaultwarden.smtp.fromName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vaultwarden.smtp.ssl }}
|
||||
SMTP_SECURITY: {{ .Values.vaultwarden.smtp.security | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vaultwarden.smtp.port }}
|
||||
SMTP_PORT: {{ .Values.vaultwarden.smtp.port | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vaultwarden.smtp.authMechanism }}
|
||||
SMTP_AUTH_MECHANISM: {{ .Values.vaultwarden.smtp.authMechanism | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vaultwarden.smtp.heloName }}
|
||||
HELO_NAME: {{ .Values.vaultwarden.smtp.heloName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vaultwarden.smtp.timeout }}
|
||||
SMTP_TIMEOUT: {{ .Values.vaultwarden.smtp.timeout | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vaultwarden.smtp.invalidHostname }}
|
||||
SMTP_ACCEPT_INVALID_HOSTNAMES: {{ .Values.vaultwarden.smtp.invalidHostname | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vaultwarden.smtp.invalidCertificate }}
|
||||
SMTP_ACCEPT_INVALID_CERTS: {{ .Values.vaultwarden.smtp.invalidCertificate | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.vaultwarden.log.file }}
|
||||
LOG_FILE: {{ .Values.vaultwarden.log.file | quote }}
|
||||
{{- end }}
|
||||
{{- if or .Values.vaultwarden.log.level .Values.vaultwarden.log.timeFormat }}
|
||||
EXTENDED_LOGGING: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.vaultwarden.log.level }}
|
||||
{{- include "vaultwarden.logLevelValid" . }}
|
||||
LOG_LEVEL: {{ .Values.vaultwarden.log.level | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vaultwarden.log.timeFormat }}
|
||||
LOG_TIMESTAMP_FORMAT: {{ .Values.vaultwarden.log.timeFormat | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vaultwarden.icons.disableDownload }}
|
||||
DISABLE_ICON_DOWNLOAD: {{ .Values.vaultwarden.icons.disableDownload | quote }}
|
||||
{{- if and (not .Values.vaultwarden.icons.cache) (eq .Values.vaultwarden.icons.disableDownload "true") }}
|
||||
ICON_CACHE_TTL: "0"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.vaultwarden.icons.cache }}
|
||||
ICON_CACHE_TTL: {{ .Values.vaultwarden.icons.cache | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vaultwarden.icons.cacheFailed }}
|
||||
ICON_CACHE_NEGTTL: {{ .Values.vaultwarden.icons.cacheFailed | quote }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.vaultwarden.admin.enabled true }}
|
||||
{{- if eq .Values.vaultwarden.admin.disableAdminToken true }}
|
||||
DISABLE_ADMIN_TOKEN: "true"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.vaultwarden.yubico.enabled true }}
|
||||
{{- if .Values.vaultwarden.yubico.server }}
|
||||
YUBICO_SERVER: {{ .Values.vaultwarden.yubico.server | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.database.type "sqlite" }}
|
||||
ENABLE_DB_WAL: {{ .Values.database.wal | quote }}
|
||||
{{- else }}
|
||||
ENABLE_DB_WAL: "false"
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
{{/* Define the secrets */}}
|
||||
{{- define "vaultwarden.secrets" -}}
|
||||
|
||||
{{- $adminToken := "" }}
|
||||
{{- if eq .Values.vaultwarden.admin.enabled true }}
|
||||
{{- $adminToken = .Values.vaultwarden.admin.token | default (randAlphaNum 48) | quote }}
|
||||
{{- end -}}
|
||||
|
||||
{{- $smtpUser := "" }}
|
||||
{{- if and (eq .Values.vaultwarden.smtp.enabled true ) (.Values.vaultwarden.smtp.user) }}
|
||||
{{- $smtpUser = .Values.vaultwarden.smtp.user | quote }}
|
||||
{{- end -}}
|
||||
|
||||
{{- $yubicoClientId := "" }}
|
||||
{{- if eq .Values.vaultwarden.yubico.enabled true }}
|
||||
{{- $yubicoClientId = required "Yubico Client ID required" .Values.vaultwarden.yubico.clientId | toString | quote }}
|
||||
{{- end -}}
|
||||
enabled: true
|
||||
data:
|
||||
placeholder: placeholdervalue
|
||||
{{- if ne $adminToken "" }}
|
||||
ADMIN_TOKEN: {{ $adminToken }}
|
||||
{{- end }}
|
||||
{{- if ne $smtpUser "" }}
|
||||
SMTP_USERNAME: {{ $smtpUser }}
|
||||
SMTP_PASSWORD: {{ required "Must specify SMTP password" .Values.vaultwarden.smtp.password | quote }}
|
||||
{{- end }}
|
||||
{{- if ne $yubicoClientId "" }}
|
||||
YUBICO_CLIENT_ID: {{ $yubicoClientId }}
|
||||
YUBICO_SECRET_KEY: {{ required "Yubico Secret Key required" .Values.vaultwarden.yubico.secretKey | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.vaultwarden.push.enabled }}
|
||||
PUSH_ENABLED: {{ .Values.vaultwarden.push.enabled | quote }}
|
||||
PUSH_INSTALLATION_ID: {{ required "Installation ID required" .Values.vaultwarden.push.installationId | quote }}
|
||||
PUSH_INSTALLATION_KEY: {{ required "Installation Key required" .Values.vaultwarden.push.installationKey | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
{{/*
|
||||
Ensure valid DB type is select, defaults to SQLite
|
||||
*/}}
|
||||
{{- define "vaultwarden.dbTypeValid" -}}
|
||||
{{- if not (or (eq .Values.database.type "postgresql") (eq .Values.database.type "mysql") (eq .Values.database.type "sqlite")) }}
|
||||
{{- required "Invalid database type" nil }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Ensure log type is valid
|
||||
*/}}
|
||||
{{- define "vaultwarden.logLevelValid" -}}
|
||||
{{- if not (or (eq .Values.vaultwarden.log.level "trace") (eq .Values.vaultwarden.log.level "debug") (eq .Values.vaultwarden.log.level "info") (eq .Values.vaultwarden.log.level "warn") (eq .Values.vaultwarden.log.level "error") (eq .Values.vaultwarden.log.level "off")) }}
|
||||
{{- required "Invalid log level" nil }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
{{/* Make sure all variables are set properly */}}
|
||||
{{- include "tc.v1.common.loader.init" . }}
|
||||
|
||||
{{/* Render configmap for vaultwarden */}}
|
||||
{{- $configmapFile := include "vaultwarden.configmap" . | fromYaml -}}
|
||||
{{- if $configmapFile -}}
|
||||
{{- $_ := set .Values.configmap "vaultwardenconfig" $configmapFile -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Render secrets for vaultwarden */}}
|
||||
{{- $secret := include "vaultwarden.secrets" . | fromYaml -}}
|
||||
{{- if $secret -}}
|
||||
{{- $_ := set .Values.secret "vaultwardensecret" $secret -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Render the templates */}}
|
||||
{{ include "tc.v1.common.loader.apply" . }}
|
||||
|
|
@ -0,0 +1,99 @@
|
|||
**Important:**
|
||||
*for the complete changelog, please refer to the website*
|
||||
|
||||
|
||||
|
||||
|
||||
## [authentik-17.0.4](https://github.com/truecharts/charts/compare/authentik-17.0.3...authentik-17.0.4) (2023-12-21)
|
||||
|
||||
### Chore
|
||||
|
||||
- require ingress for certain charts
|
||||
|
||||
|
||||
|
||||
|
||||
## [authentik-17.0.3](https://github.com/truecharts/charts/compare/authentik-17.0.2...authentik-17.0.3) (2023-12-21)
|
||||
|
||||
### Chore
|
||||
|
||||
- bump everything to ensure patches are applied globally
|
||||
|
||||
### Fix
|
||||
|
||||
- ensure the cnpg GUI is included on CNPG apps
|
||||
|
||||
|
||||
|
||||
|
||||
## [authentik-17.0.2](https://github.com/truecharts/charts/compare/authentik-17.0.1...authentik-17.0.2) (2023-12-21)
|
||||
|
||||
### Chore
|
||||
|
||||
- update helm general non-major by renovate ([#16341](https://github.com/truecharts/charts/issues/16341))
|
||||
|
||||
|
||||
|
||||
|
||||
## [authentik-17.0.1](https://github.com/truecharts/charts/compare/authentik-17.0.0...authentik-17.0.1) (2023-12-20)
|
||||
|
||||
### Chore
|
||||
|
||||
- bump patch versions on all charts for new GUI release
|
||||
|
||||
|
||||
|
||||
|
||||
## [authentik-17.0.0](https://github.com/truecharts/charts/compare/authentik-16.0.0...authentik-17.0.0) (2023-12-20)
|
||||
|
||||
### Chore
|
||||
|
||||
- update helm general major by renovate (major) ([#14631](https://github.com/truecharts/charts/issues/14631))
|
||||
|
||||
|
||||
|
||||
|
||||
## [authentik-16.0.0](https://github.com/truecharts/charts/compare/authentik-15.0.27...authentik-16.0.0) (2023-12-20)
|
||||
|
||||
|
||||
|
||||
|
||||
## [authentik-15.0.27](https://github.com/truecharts/charts/compare/authentik-15.0.26...authentik-15.0.27) (2023-12-20)
|
||||
|
||||
### Chore
|
||||
|
||||
- Bump everything to force min/max scale version update
|
||||
|
||||
|
||||
|
||||
|
||||
## [authentik-15.0.26](https://github.com/truecharts/charts/compare/authentik-15.0.25...authentik-15.0.26) (2023-12-16)
|
||||
|
||||
### Chore
|
||||
|
||||
- update helm general non-major ([#14784](https://github.com/truecharts/charts/issues/14784))
|
||||
|
||||
|
||||
|
||||
|
||||
## [authentik-15.0.26](https://github.com/truecharts/charts/compare/authentik-15.0.25...authentik-15.0.26) (2023-12-16)
|
||||
|
||||
### Chore
|
||||
|
||||
- update helm general non-major ([#14784](https://github.com/truecharts/charts/issues/14784))
|
||||
|
||||
|
||||
|
||||
|
||||
## [authentik-15.0.25](https://github.com/truecharts/charts/compare/authentik-15.0.24...authentik-15.0.25) (2023-12-03)
|
||||
|
||||
### Chore
|
||||
|
||||
- bump everything to ensure catalog has latest versions
|
||||
- fix annotations again
|
||||
- update annotations
|
||||
- cleanup chart.yaml and add min-max scale version
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
kubeVersion: ">=1.24.0-0"
|
||||
apiVersion: v2
|
||||
name: authentik
|
||||
version: 17.0.4
|
||||
appVersion: 2023.10.4
|
||||
description: Authentik is an open-source Identity Provider focused on flexibility and versatility.
|
||||
home: https://truecharts.org/charts/stable/authentik
|
||||
icon: https://truecharts.org/img/hotlink-ok/chart-icons/authentik.png
|
||||
deprecated: false
|
||||
sources:
|
||||
- https://goauthentik.io/docs/
|
||||
- https://github.com/truecharts/charts/tree/master/charts/stable/authentik
|
||||
- https://ghcr.io/maxmind/geoipupdate
|
||||
- https://github.com/goauthentik/authentik
|
||||
maintainers:
|
||||
- name: TrueCharts
|
||||
email: info@truecharts.org
|
||||
url: https://truecharts.org
|
||||
keywords:
|
||||
- authentik
|
||||
dependencies:
|
||||
- name: common
|
||||
version: 16.2.9
|
||||
repository: https://library-charts.truecharts.org
|
||||
condition: ""
|
||||
alias: ""
|
||||
tags: []
|
||||
import-values: []
|
||||
- name: redis
|
||||
version: 10.0.4
|
||||
repository: https://deps.truecharts.org
|
||||
condition: redis.enabled
|
||||
alias: ""
|
||||
tags: []
|
||||
import-values: []
|
||||
annotations:
|
||||
max_scale_version: 23.10.2
|
||||
min_scale_version: 23.10.0
|
||||
truecharts.org/SCALE-support: "true"
|
||||
truecharts.org/category: authentication
|
||||
truecharts.org/max_helm_version: "3.13"
|
||||
truecharts.org/min_helm_version: "3.12"
|
||||
truecharts.org/train: stable
|
||||
type: application
|
||||
|
|
@ -0,0 +1,106 @@
|
|||
Business Source License 1.1
|
||||
|
||||
Parameters
|
||||
|
||||
Licensor: The TrueCharts Project, it's owner and it's contributors
|
||||
Licensed Work: The TrueCharts "Blocky" Helm Chart
|
||||
Additional Use Grant: You may use the licensed work in production, as long
|
||||
as it is directly sourced from a TrueCharts provided
|
||||
official repository, catalog or source. You may also make private
|
||||
modification to the directly sourced licenced work,
|
||||
when used in production.
|
||||
|
||||
The following cases are, due to their nature, also
|
||||
defined as 'production use' and explicitly prohibited:
|
||||
- Bundling, including or displaying the licensed work
|
||||
with(in) another work intended for production use,
|
||||
with the apparent intend of facilitating and/or
|
||||
promoting production use by third parties in
|
||||
violation of this license.
|
||||
|
||||
Change Date: 2050-01-01
|
||||
|
||||
Change License: 3-clause BSD license
|
||||
|
||||
For information about alternative licensing arrangements for the Software,
|
||||
please contact: legal@truecharts.org
|
||||
|
||||
Notice
|
||||
|
||||
The Business Source License (this document, or the “License”) is not an Open
|
||||
Source license. However, the Licensed Work will eventually be made available
|
||||
under an Open Source License, as stated in this License.
|
||||
|
||||
License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
|
||||
“Business Source License” is a trademark of MariaDB Corporation Ab.
|
||||
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
Business Source License 1.1
|
||||
|
||||
Terms
|
||||
|
||||
The Licensor hereby grants you the right to copy, modify, create derivative
|
||||
works, redistribute, and make non-production use of the Licensed Work. The
|
||||
Licensor may make an Additional Use Grant, above, permitting limited
|
||||
production use.
|
||||
|
||||
Effective on the Change Date, or the fourth anniversary of the first publicly
|
||||
available distribution of a specific version of the Licensed Work under this
|
||||
License, whichever comes first, the Licensor hereby grants you rights under
|
||||
the terms of the Change License, and the rights granted in the paragraph
|
||||
above terminate.
|
||||
|
||||
If your use of the Licensed Work does not comply with the requirements
|
||||
currently in effect as described in this License, you must purchase a
|
||||
commercial license from the Licensor, its affiliated entities, or authorized
|
||||
resellers, or you must refrain from using the Licensed Work.
|
||||
|
||||
All copies of the original and modified Licensed Work, and derivative works
|
||||
of the Licensed Work, are subject to this License. This License applies
|
||||
separately for each version of the Licensed Work and the Change Date may vary
|
||||
for each version of the Licensed Work released by Licensor.
|
||||
|
||||
You must conspicuously display this License on each original or modified copy
|
||||
of the Licensed Work. If you receive the Licensed Work in original or
|
||||
modified form from a third party, the terms and conditions set forth in this
|
||||
License apply to your use of that work.
|
||||
|
||||
Any use of the Licensed Work in violation of this License will automatically
|
||||
terminate your rights under this License for the current and all other
|
||||
versions of the Licensed Work.
|
||||
|
||||
This License does not grant you any right in any trademark or logo of
|
||||
Licensor or its affiliates (provided that you may use a trademark or logo of
|
||||
Licensor as expressly required by this License).
|
||||
|
||||
TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
|
||||
AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
|
||||
EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
|
||||
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
|
||||
TITLE.
|
||||
|
||||
MariaDB hereby grants you permission to use this License’s text to license
|
||||
your works, and to refer to it using the trademark “Business Source License”,
|
||||
as long as you comply with the Covenants of Licensor below.
|
||||
|
||||
Covenants of Licensor
|
||||
|
||||
In consideration of the right to use this License’s text and the “Business
|
||||
Source License” name and trademark, Licensor covenants to MariaDB, and to all
|
||||
other recipients of the licensed work to be provided by Licensor:
|
||||
|
||||
1. To specify as the Change License the GPL Version 2.0 or any later version,
|
||||
or a license that is compatible with GPL Version 2.0 or a later version,
|
||||
where “compatible” means that software provided under the Change License can
|
||||
be included in a program with software provided under GPL Version 2.0 or a
|
||||
later version. Licensor may specify additional Change Licenses without
|
||||
limitation.
|
||||
|
||||
2. To either: (a) specify an additional grant of rights to use that does not
|
||||
impose any additional restriction on the right granted in this License, as
|
||||
the Additional Use Grant; or (b) insert the text “None”.
|
||||
|
||||
3. To specify a Change Date.
|
||||
|
||||
4. Not to modify this License in any other way.
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
# README
|
||||
|
||||
## General Info
|
||||
|
||||
TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE.
|
||||
However only installations using the TrueNAS SCALE Apps system are supported.
|
||||
|
||||
For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/stable/authentik)
|
||||
|
||||
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
|
||||
- See the [Website](https://truecharts.org)
|
||||
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
||||
- Open a [issue](https://github.com/truecharts/charts/issues/new/choose)
|
||||
|
||||
---
|
||||
|
||||
## Sponsor TrueCharts
|
||||
|
||||
TrueCharts can only exist due to the incredible effort of our staff.
|
||||
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
||||
|
||||
*All Rights Reserved - The TrueCharts Project*
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
|
||||
|
||||
## [authentik-17.0.4](https://github.com/truecharts/charts/compare/authentik-17.0.3...authentik-17.0.4) (2023-12-21)
|
||||
|
||||
### Chore
|
||||
|
||||
- require ingress for certain charts
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
Authentik is an open-source Identity Provider focused on flexibility and versatility.
|
||||
|
||||
This App is supplied by TrueCharts, for more information visit the manual: [https://truecharts.org/charts/stable/authentik](https://truecharts.org/charts/stable/authentik)
|
||||
|
||||
---
|
||||
|
||||
TrueCharts can only exist due to the incredible effort of our staff.
|
||||
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
||||
Binary file not shown.
Binary file not shown.
|
|
@ -0,0 +1,502 @@
|
|||
image:
|
||||
repository: ghcr.io/goauthentik/server
|
||||
tag: 2023.10.4@sha256:f201d0515461ef5ec2afd37ead691247f09dfef231fdaa494fd48105b65913ca
|
||||
pullPolicy: IfNotPresent
|
||||
geoipImage:
|
||||
repository: ghcr.io/maxmind/geoipupdate
|
||||
tag: v6.0.0@sha256:e0d5c1dee7379d360e0f355557542d9672c616215dfdd5aaf917382de84cb84c
|
||||
pullPolicy: IfNotPresent
|
||||
ldapImage:
|
||||
repository: ghcr.io/goauthentik/ldap
|
||||
tag: 2023.10.4@sha256:e16028e4e6312dcb0fb35a9b537829efd9f7c0c3c1bbe966150fca5734211c6d
|
||||
pullPolicy: IfNotPresent
|
||||
radiusImage:
|
||||
repository: ghcr.io/goauthentik/radius
|
||||
tag: 2023.10.4@sha256:a5d36976190e4ccacb8caf315814534e75b983f789dc422bc327c4999a60cdab
|
||||
pullPolicy: IfNotPresent
|
||||
proxyImage:
|
||||
repository: ghcr.io/goauthentik/proxy
|
||||
tag: 2023.10.4@sha256:35217928c215f5221685289e09a076ad38767b17485b102661fad5aca184b8b1
|
||||
pullPolicy: IfNotPresent
|
||||
authentik:
|
||||
credentials:
|
||||
# Only works on initial install
|
||||
email: my-mail@example.com
|
||||
password: my-password
|
||||
# Optional, only set if you want to use it
|
||||
bootstrapToken: ""
|
||||
general:
|
||||
disableUpdateCheck: false
|
||||
disableStartupAnalytics: true
|
||||
allowUserChangeName: true
|
||||
allowUserChangeEmail: true
|
||||
allowUserChangeUsername: true
|
||||
overwriteDefaultBlueprints: false
|
||||
gdprCompliance: true
|
||||
tokenLength: 128
|
||||
impersonation: true
|
||||
avatars:
|
||||
- gravatar
|
||||
- initials
|
||||
footerLinks:
|
||||
- name: Authentik
|
||||
href: https://goauthentik.io
|
||||
email:
|
||||
host: ""
|
||||
port: 587
|
||||
username:
|
||||
password:
|
||||
useTLS: true
|
||||
useSSL: false
|
||||
timeout: 10
|
||||
from: ""
|
||||
ldap:
|
||||
tlsCiphers: "null"
|
||||
taskTimeoutHours: 2
|
||||
logging:
|
||||
# info, debug, warning, error, trace
|
||||
logLevel: info
|
||||
errorReporting:
|
||||
enabled: false
|
||||
sendPII: false
|
||||
environment: customer
|
||||
sentryDSN: ""
|
||||
geoip:
|
||||
enabled: false
|
||||
# Ignored if enabled is true
|
||||
# If enabled is false, and this is true, the
|
||||
# built-in GeoIP database will be wiped
|
||||
wipeBuiltInDb: false
|
||||
editionID: GeoLite2-City
|
||||
frequency: 8
|
||||
accountID: ""
|
||||
licenseKey: ""
|
||||
outposts:
|
||||
proxy:
|
||||
enabled: false
|
||||
token: ""
|
||||
radius:
|
||||
enabled: false
|
||||
token: ""
|
||||
ldap:
|
||||
enabled: false
|
||||
token: ""
|
||||
# ===== DO NOT EDIT BELOW THIS LINE =====
|
||||
workload:
|
||||
# ===== Server =====
|
||||
main:
|
||||
enabled: true
|
||||
type: Deployment
|
||||
podSpec:
|
||||
containers:
|
||||
main:
|
||||
enabled: true
|
||||
primary: true
|
||||
imageSelector: image
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
# readOnlyRootFilesystem: false
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: server
|
||||
- secretRef:
|
||||
name: server-worker
|
||||
- configMapRef:
|
||||
name: server-worker
|
||||
args:
|
||||
- server
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /lifecycle/ak
|
||||
- healthcheck
|
||||
readiness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /lifecycle/ak
|
||||
- healthcheck
|
||||
startup:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /lifecycle/ak
|
||||
- healthcheck
|
||||
# ===== Worker =====
|
||||
worker:
|
||||
enabled: true
|
||||
type: Deployment
|
||||
podSpec:
|
||||
containers:
|
||||
worker:
|
||||
enabled: true
|
||||
primary: true
|
||||
imageSelector: image
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
# readOnlyRootFilesystem: false
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: server-worker
|
||||
- configMapRef:
|
||||
name: server-worker
|
||||
args:
|
||||
- worker
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /lifecycle/ak
|
||||
- healthcheck
|
||||
readiness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /lifecycle/ak
|
||||
- healthcheck
|
||||
startup:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /lifecycle/ak
|
||||
- healthcheck
|
||||
# ===== PROXY =====
|
||||
proxy:
|
||||
enabled: true
|
||||
type: Deployment
|
||||
podSpec:
|
||||
containers:
|
||||
proxy:
|
||||
enabled: true
|
||||
primary: true
|
||||
imageSelector: proxyImage
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: proxy
|
||||
- secretRef:
|
||||
name: proxy
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /proxy
|
||||
- healthcheck
|
||||
readiness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /proxy
|
||||
- healthcheck
|
||||
startup:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /proxy
|
||||
- healthcheck
|
||||
# ===== RADIUS =====
|
||||
radius:
|
||||
enabled: true
|
||||
type: Deployment
|
||||
podSpec:
|
||||
containers:
|
||||
radius:
|
||||
enabled: true
|
||||
primary: true
|
||||
imageSelector: radiusImage
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: radius
|
||||
- secretRef:
|
||||
name: radius
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /radius
|
||||
- healthcheck
|
||||
readiness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /radius
|
||||
- healthcheck
|
||||
startup:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /radius
|
||||
- healthcheck
|
||||
# ===== LDAP =====
|
||||
ldap:
|
||||
enabled: true
|
||||
type: Deployment
|
||||
podSpec:
|
||||
containers:
|
||||
ldap:
|
||||
enabled: true
|
||||
primary: true
|
||||
imageSelector: ldapImage
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: ldap
|
||||
- secretRef:
|
||||
name: ldap
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /ldap
|
||||
- healthcheck
|
||||
readiness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /ldap
|
||||
- healthcheck
|
||||
startup:
|
||||
enabled: true
|
||||
type: exec
|
||||
command:
|
||||
- /ldap
|
||||
- healthcheck
|
||||
# ===== GeoIP Updater =====
|
||||
geoip:
|
||||
enabled: true
|
||||
type: Deployment
|
||||
podSpec:
|
||||
containers:
|
||||
geoip:
|
||||
enabled: true
|
||||
primary: true
|
||||
imageSelector: geoipImage
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
capabilities:
|
||||
disableS6Caps: true
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: geoip
|
||||
- secretRef:
|
||||
name: geoip
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
startup:
|
||||
enabled: false
|
||||
service:
|
||||
# Server HTTPS
|
||||
main:
|
||||
ports:
|
||||
main:
|
||||
protocol: https
|
||||
port: 10229
|
||||
# Server HTTP
|
||||
http:
|
||||
enabled: true
|
||||
type: ClusterIP
|
||||
ports:
|
||||
http:
|
||||
enabled: true
|
||||
protocol: http
|
||||
port: 10230
|
||||
# Proxy
|
||||
proxy:
|
||||
enabled: true
|
||||
targetSelector: proxy
|
||||
ports:
|
||||
http:
|
||||
enabled: true
|
||||
protocol: http
|
||||
port: 10227
|
||||
targetSelector: proxy
|
||||
https:
|
||||
enabled: true
|
||||
protocol: https
|
||||
port: 10228
|
||||
targetSelector: proxy
|
||||
# Radius
|
||||
radius:
|
||||
enabled: true
|
||||
targetSelector: radius
|
||||
ports:
|
||||
radius:
|
||||
enabled: true
|
||||
protocol: udp
|
||||
targetSelector: radius
|
||||
port: 1812
|
||||
# LDAP
|
||||
ldap:
|
||||
enabled: true
|
||||
targetSelector: ldap
|
||||
ports:
|
||||
ldap:
|
||||
enabled: true
|
||||
port: 389
|
||||
targetSelector: ldap
|
||||
# LDAPS
|
||||
ldaps:
|
||||
enabled: true
|
||||
targetSelector: ldap
|
||||
ports:
|
||||
ldaps:
|
||||
enabled: true
|
||||
port: 636
|
||||
targetSelector: ldap
|
||||
# Server Metrics
|
||||
servermetrics:
|
||||
enabled: true
|
||||
type: ClusterIP
|
||||
ports:
|
||||
servermetrics:
|
||||
enabled: true
|
||||
protocol: http
|
||||
port: 10231
|
||||
# Radius Metrics
|
||||
radiusmetrics:
|
||||
enabled: true
|
||||
type: ClusterIP
|
||||
targetSelector: radius
|
||||
ports:
|
||||
radiusmetrics:
|
||||
enabled: true
|
||||
protocol: http
|
||||
port: 10232
|
||||
targetSelector: radius
|
||||
# LDAP Metrics
|
||||
ldapmetrics:
|
||||
enabled: true
|
||||
type: ClusterIP
|
||||
targetSelector: ldap
|
||||
ports:
|
||||
ldapmetrics:
|
||||
enabled: true
|
||||
protocol: http
|
||||
port: 10233
|
||||
targetSelector: ldap
|
||||
# Proxy Metrics
|
||||
proxymetrics:
|
||||
enabled: true
|
||||
type: ClusterIP
|
||||
targetSelector: proxy
|
||||
ports:
|
||||
proxymetrics:
|
||||
enabled: true
|
||||
protocol: http
|
||||
port: 10234
|
||||
targetSelector: proxy
|
||||
persistence:
|
||||
media:
|
||||
enabled: true
|
||||
targetSelector:
|
||||
main:
|
||||
main:
|
||||
mountPath: /media
|
||||
worker:
|
||||
worker:
|
||||
mountPath: /media
|
||||
templates:
|
||||
enabled: true
|
||||
targetSelector:
|
||||
main:
|
||||
main:
|
||||
mountPath: /templates
|
||||
worker:
|
||||
worker:
|
||||
mountPath: /templates
|
||||
blueprints:
|
||||
enabled: true
|
||||
targetSelector:
|
||||
worker:
|
||||
worker:
|
||||
# This will automatically change to `/blueprints`
|
||||
# if `overwriteDefaultBlueprints` is set to `true
|
||||
# Otherwise it will respect the value specified here
|
||||
mountPath: /blueprints/custom
|
||||
certs:
|
||||
enabled: true
|
||||
mountPath: /certs
|
||||
targetSelector:
|
||||
worker:
|
||||
worker:
|
||||
mountPath: /certs
|
||||
geoip:
|
||||
enabled: true
|
||||
targetSelector:
|
||||
main:
|
||||
main:
|
||||
mountPath: /geoip
|
||||
worker:
|
||||
worker:
|
||||
mountPath: /geoip
|
||||
geoip:
|
||||
geoip:
|
||||
mountPath: /usr/share/GeoIP
|
||||
cnpg:
|
||||
main:
|
||||
enabled: true
|
||||
user: authentik
|
||||
database: authentik
|
||||
redis:
|
||||
enabled: true
|
||||
portal:
|
||||
open:
|
||||
enabled: true
|
||||
metrics:
|
||||
# FIXME: Metrics do not work yet
|
||||
servermetrics:
|
||||
enabled: true
|
||||
type: servicemonitor
|
||||
endpoints:
|
||||
- port: "{{ .Values.service.servermetrics.ports.servermetrics.port }}"
|
||||
path: /metrics
|
||||
prometheusRule:
|
||||
enabled: false
|
||||
radiusmetrics:
|
||||
enabled: true
|
||||
type: servicemonitor
|
||||
endpoints:
|
||||
- port: "{{ .Values.service.radiusmetrics.ports.radiusmetrics.port }}"
|
||||
path: /metrics
|
||||
prometheusRule:
|
||||
enabled: false
|
||||
ldapmetrics:
|
||||
enabled: true
|
||||
type: servicemonitor
|
||||
endpoints:
|
||||
- port: "{{ .Values.service.ldapmetrics.ports.ldapmetrics.port }}"
|
||||
path: /metrics
|
||||
prometheusRule:
|
||||
enabled: false
|
||||
proxymetrics:
|
||||
enabled: true
|
||||
type: servicemonitor
|
||||
endpoints:
|
||||
- port: "{{ .Values.service.proxymetrics.ports.proxymetrics.port }}"
|
||||
path: /metrics
|
||||
prometheusRule:
|
||||
enabled: false
|
||||
updated: true
|
||||
|
||||
ingress:
|
||||
main:
|
||||
required: true
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1 @@
|
|||
{{- include "tc.v1.common.lib.chart.notes" $ -}}
|
||||
|
|
@ -0,0 +1,128 @@
|
|||
{{/* Define the configmaps */}}
|
||||
{{- define "authentik.configmaps" -}}
|
||||
|
||||
{{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}}
|
||||
{{- $serverHost := printf "https://%v:%v" $fullname .Values.service.main.ports.main.port -}}
|
||||
{{- $host := .Values.chartContext.appUrl }}
|
||||
server:
|
||||
enabled: true
|
||||
data:
|
||||
AUTHENTIK_LISTEN__HTTPS: {{ printf "0.0.0.0:%v" .Values.service.main.ports.main.port | quote }}
|
||||
AUTHENTIK_LISTEN__HTTP: {{ printf "0.0.0.0:%v" .Values.service.http.ports.http.port | quote }}
|
||||
AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.servermetrics.ports.servermetrics.port | quote }}
|
||||
|
||||
server-worker:
|
||||
enabled: true
|
||||
data:
|
||||
{{/* Dependencies */}}
|
||||
AUTHENTIK_POSTGRESQL__NAME: {{ .Values.cnpg.main.database }}
|
||||
AUTHENTIK_POSTGRESQL__USER: {{ .Values.cnpg.main.user }}
|
||||
AUTHENTIK_POSTGRESQL__HOST: {{ .Values.cnpg.main.creds.host }}
|
||||
AUTHENTIK_POSTGRESQL__PORT: "5432"
|
||||
AUTHENTIK_REDIS__HOST: {{ .Values.redis.creds.plain }}
|
||||
AUTHENTIK_REDIS__PORT: "6379"
|
||||
|
||||
{{/* Outposts */}}
|
||||
AUTHENTIK_OUTPOSTS__DISCOVER: "false"
|
||||
|
||||
{{/* GeoIP */}}
|
||||
{{- $geoipPath := (printf "/geoip/%v.mmdb" .Values.authentik.geoip.editionID) -}}
|
||||
{{- if not .Values.authentik.geoip.enabled -}}
|
||||
{{- $geoipPath = "/tmp/non-existent-file" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if or .Values.authentik.geoip.enabled .Values.authentik.geoip.wipeBuiltInDb }}
|
||||
AUTHENTIK_GEOIP: {{ $geoipPath }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Mail */}}
|
||||
AUTHENTIK_EMAIL__USE_TLS: {{ .Values.authentik.email.useTLS | quote }}
|
||||
AUTHENTIK_EMAIL__USE_SSL: {{ .Values.authentik.email.useSSL | quote }}
|
||||
{{- with .Values.authentik.email.port }}
|
||||
AUTHENTIK_EMAIL__PORT: {{ . | quote }}
|
||||
{{- end -}}
|
||||
{{- with .Values.authentik.email.timeout }}
|
||||
AUTHENTIK_EMAIL__TIMEOUT: {{ . | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{/* LDAP */}}
|
||||
AUTHENTIK_LDAP__TASK_TIMEOUT_HOURS: {{ .Values.authentik.ldap.taskTimeoutHours | quote }}
|
||||
AUTHENTIK_LDAP__TLS__CIPHERS: {{ .Values.authentik.ldap.tlsCiphers | quote }}
|
||||
|
||||
{{/* Logging */}}
|
||||
AUTHENTIK_LOG_LEVEL: {{ .Values.authentik.logging.logLevel }}
|
||||
|
||||
{{/* Error Reporting */}}
|
||||
AUTHENTIK_ERROR_REPORTING__ENABLED: {{ .Values.authentik.errorReporting.enabled | quote }}
|
||||
AUTHENTIK_ERROR_REPORTING__SEND_PII: {{ .Values.authentik.errorReporting.sendPII | quote }}
|
||||
{{- with .Values.authentik.errorReporting.environment }}
|
||||
AUTHENTIK_ERROR_REPORTING__ENVIRONMENT: {{ . | quote }}
|
||||
{{- end -}}
|
||||
{{- with .Values.authentik.errorReporting.sentryDSN }}
|
||||
AUTHENTIK_ERROR_REPORTING__SENTRY_DSN: {{ . | quote }}
|
||||
{{- end -}}
|
||||
{{- with .Values.authentik.general.avatars }}
|
||||
AUTHENTIK_AVATARS: {{ join "," . }}
|
||||
{{- end -}}
|
||||
{{- with .Values.authentik.general.footerLinks }}
|
||||
AUTHENTIK_FOOTER_LINKS: {{ toJson . | squote }}
|
||||
{{- end }}
|
||||
|
||||
{{/* General */}}
|
||||
AUTHENTIK_DISABLE_UPDATE_CHECK: {{ .Values.authentik.general.disableUpdateCheck | quote }}
|
||||
AUTHENTIK_DISABLE_STARTUP_ANALYTICS: {{ .Values.authentik.general.disableStartupAnalytics | quote }}
|
||||
AUTHENTIK_DEFAULT_USER_CHANGE_NAME: {{ .Values.authentik.general.allowUserChangeName | quote }}
|
||||
AUTHENTIK_DEFAULT_USER_CHANGE_EMAIL: {{ .Values.authentik.general.allowUserChangeEmail | quote }}
|
||||
AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME: {{ .Values.authentik.general.allowUserChangeUsername | quote }}
|
||||
AUTHENTIK_GDPR_COMPLIANCE: {{ .Values.authentik.general.gdprCompliance | quote }}
|
||||
AUTHENTIK_DEFAULT_TOKEN_LENGTH: {{ .Values.authentik.general.tokenLength | quote }}
|
||||
AUTHENTIK_IMPERSONATION: {{ .Values.authentik.general.impersonation | quote }}
|
||||
|
||||
{{- if .Values.authentik.outposts.proxy.enabled }}
|
||||
proxy:
|
||||
enabled: true
|
||||
data:
|
||||
AUTHENTIK_LISTEN__HTTP: {{ printf "0.0.0.0:%v" .Values.service.proxy.ports.http.port | quote }}
|
||||
AUTHENTIK_LISTEN__HTTPS: {{ printf "0.0.0.0:%v" .Values.service.proxy.ports.https.port | quote }}
|
||||
AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.proxymetrics.ports.proxymetrics.port | quote }}
|
||||
AUTHENTIK_HOST: {{ $serverHost }}
|
||||
AUTHENTIK_INSECURE: "true"
|
||||
# TODO: node ip or ingress host
|
||||
AUTHENTIK_HOST_BROWSER: {{ $host }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.outposts.radius.enabled }}
|
||||
radius:
|
||||
enabled: true
|
||||
data:
|
||||
AUTHENTIK_LISTEN__RADIUS: {{ printf "0.0.0.0:%v" .Values.service.radius.ports.radius.port | quote }}
|
||||
AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.radiusmetrics.ports.radiusmetrics.port | quote }}
|
||||
AUTHENTIK_HOST: {{ $serverHost }}
|
||||
AUTHENTIK_INSECURE: "true"
|
||||
# TODO: node ip or ingress host
|
||||
AUTHENTIK_HOST_BROWSER: {{ $host }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.outposts.ldap.enabled }}
|
||||
ldap:
|
||||
enabled: true
|
||||
data:
|
||||
AUTHENTIK_LISTEN__LDAP: {{ printf "0.0.0.0:%v" .Values.service.ldap.ports.ldap.port | quote }}
|
||||
AUTHENTIK_LISTEN__LDAPS: {{ printf "0.0.0.0:%v" .Values.service.ldaps.ports.ldaps.port | quote }}
|
||||
AUTHENTIK_LISTEN__METRICS: {{ printf "0.0.0.0:%v" .Values.service.ldapmetrics.ports.ldapmetrics.port | quote }}
|
||||
AUTHENTIK_HOST: {{ $serverHost }}
|
||||
AUTHENTIK_INSECURE: "true"
|
||||
# TODO: node ip or ingress host
|
||||
AUTHENTIK_HOST_BROWSER: {{ $host }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.geoip.enabled }}
|
||||
geoip:
|
||||
enabled: true
|
||||
data:
|
||||
GEOIPUPDATE_EDITION_IDS: {{ .Values.authentik.geoip.editionID }}
|
||||
GEOIPUPDATE_FREQUENCY: {{ .Values.authentik.geoip.frequency | quote }}
|
||||
GEOIPUPDATE_DB_DIR: {{ .Values.persistence.geoip.targetSelector.geoip.geoip.mountPath | quote }}
|
||||
{{- end -}}
|
||||
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
{{/* Define the secrets */}}
|
||||
{{- define "authentik.secrets" -}}
|
||||
|
||||
{{- $fullname := include "tc.v1.common.lib.chart.names.fullname" $ -}}
|
||||
{{- $fetchname := printf "%v-server-worker" $fullname -}}
|
||||
|
||||
{{- $secretKey := randAlphaNum 32 -}}
|
||||
{{- with (lookup "v1" "Secret" .Release.Namespace $fetchname) -}}
|
||||
{{- $secretKey = index .data "AUTHENTIK_SECRET_KEY" | b64dec -}}
|
||||
{{- end }}
|
||||
|
||||
server-worker:
|
||||
enabled: true
|
||||
data:
|
||||
{{/* Dependencies */}}
|
||||
AUTHENTIK_POSTGRESQL__PASSWORD: {{ .Values.cnpg.main.creds.password | trimAll "\"" }}
|
||||
AUTHENTIK_REDIS__PASSWORD: {{ .Values.redis.creds.redisPassword | trimAll "\"" }}
|
||||
|
||||
{{/* Secret Key */}}
|
||||
AUTHENTIK_SECRET_KEY: {{ $secretKey }}
|
||||
|
||||
{{/* Initial credentials */}}
|
||||
AUTHENTIK_BOOTSTRAP_EMAIL: {{ .Values.authentik.credentials.email | quote }}
|
||||
AUTHENTIK_BOOTSTRAP_PASSWORD: {{ .Values.authentik.credentials.password | quote }}
|
||||
{{- with .Values.authentik.credentials.bootstrapToken }}
|
||||
AUTHENTIK_BOOTSTRAP_TOKEN: {{ . }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Mail */}}
|
||||
{{- with .Values.authentik.email.host }}
|
||||
AUTHENTIK_EMAIL__HOST: {{ . }}
|
||||
{{- end -}}
|
||||
{{- with .Values.authentik.email.username }}
|
||||
AUTHENTIK_EMAIL__USERNAME: {{ . }}
|
||||
{{- end -}}
|
||||
{{- with .Values.authentik.email.password }}
|
||||
AUTHENTIK_EMAIL__PASSWORD: {{ . }}
|
||||
{{- end -}}
|
||||
{{- with .Values.authentik.email.from }}
|
||||
AUTHENTIK_EMAIL__FROM: {{ . }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.geoip.enabled }}
|
||||
geoip:
|
||||
enabled: true
|
||||
data:
|
||||
GEOIPUPDATE_VERBOSE: "0"
|
||||
GEOIPUPDATE_PRESERVE_FILE_TIMES: "1"
|
||||
GEOIPUPDATE_ACCOUNT_ID: {{ .Values.authentik.geoip.accountID | quote }}
|
||||
GEOIPUPDATE_LICENSE_KEY: {{ .Values.authentik.geoip.licenseKey | quote }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.outposts.proxy.enabled }}
|
||||
proxy:
|
||||
enabled: true
|
||||
data:
|
||||
AUTHENTIK_TOKEN: {{ .Values.authentik.outposts.proxy.token | quote }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.outposts.radius.enabled }}
|
||||
radius:
|
||||
enabled: true
|
||||
data:
|
||||
AUTHENTIK_TOKEN: {{ .Values.authentik.outposts.radius.token | quote }}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.outposts.ldap.enabled }}
|
||||
ldap:
|
||||
enabled: true
|
||||
data:
|
||||
AUTHENTIK_TOKEN: {{ .Values.authentik.outposts.ldap.token | quote }}
|
||||
{{- end -}}
|
||||
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{{- define "authentik.validation" -}}
|
||||
{{- range $outpost, $values := .Values.authentik.outposts -}}
|
||||
{{- if (kindIs "dict" $values) -}}
|
||||
{{- if and $values.enabled (not $values.token) -}}
|
||||
{{- fail (printf "Authentik - Outpost [%v] is enabled, but [token] was not provided" ($outpost | upper)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.geoip.enabled -}}
|
||||
{{- if not .Values.authentik.geoip.accountID -}}
|
||||
{{- fail "Authentik - GeoIP is enabled but [accountID] was not provided" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not .Values.authentik.geoip.licenseKey -}}
|
||||
{{- fail "Authentik - GeoIP is enabled but [licenseKey] was not provided" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if contains " " .Values.authentik.geoip.editionID -}}
|
||||
{{- fail "Authentik - GeoIP is enabled but [editionID] cannot contain spaces" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{{- define "authentik.wait.server" -}}
|
||||
{{- $fullname := (include "tc.v1.common.lib.chart.names.fullname" $) -}}
|
||||
{{- $serverUrl := printf "https://%v:%v/-/health/ready/" $fullname .Values.service.main.ports.main.port }}
|
||||
enabled: true
|
||||
type: init
|
||||
imageSelector: alpineImage
|
||||
command: /bin/sh
|
||||
args:
|
||||
- -c
|
||||
- |
|
||||
echo "Waiting Authentik Server [{{ $serverUrl }}] to be ready..."
|
||||
until wget --no-check-certificate --spider --quiet "{{ $serverUrl }}";
|
||||
do
|
||||
echo "Waiting Authentik Server [{{ $serverUrl }}] to be ready..."
|
||||
sleep 3
|
||||
done
|
||||
|
||||
echo "Authentik [{{ $serverUrl }}] is ready..."
|
||||
echo "Starting Outpost..."
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,97 @@
|
|||
{{/* Make sure all variables are set properly */}}
|
||||
{{- include "tc.v1.common.loader.init" . }}
|
||||
|
||||
{{- include "authentik.validation" $ -}}
|
||||
|
||||
{{/* Render secrets for authentik and friends */}}
|
||||
{{- $secrets := include "authentik.secrets" . | fromYaml -}}
|
||||
{{- if $secrets -}}
|
||||
{{ $secrets := (mustMergeOverwrite .Values.secret $secrets) }}
|
||||
{{- $_ := set .Values "secret" $secrets -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Render configmaps for authentik and friends */}}
|
||||
{{- $configmaps := include "authentik.configmaps" . | fromYaml -}}
|
||||
{{- if $configmaps -}}
|
||||
{{ $configmaps := (mustMergeOverwrite .Values.configmap $configmaps) }}
|
||||
{{- $_ := set .Values "configmap" $configmaps -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.general.overwriteDefaultBlueprints -}}
|
||||
{{- $_ := set .Values.persistence.blueprints.targetSelector.worker.worker "mountPath" "/blueprints" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.geoip.enabled -}}
|
||||
{{- $_ := set .Values.workload.geoip "enabled" true -}}
|
||||
{{- else -}}
|
||||
{{- $_ := set .Values.workload.geoip "enabled" false -}}
|
||||
{{- $_ := set .Values.persistence.geoip "enabled" false -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if or .Values.authentik.geoip.enabled .Values.authentik.geoip.wipeBuiltInDb -}}
|
||||
{{- $_ := set .Values.persistence.geoip "enabled" true -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.outposts.proxy.enabled -}}
|
||||
{{- $_ := set .Values.workload.proxy "enabled" true -}}
|
||||
{{- if not .Values.workload.proxy.podSpec.initContainers -}}
|
||||
{{- $_ := set .Values.workload.proxy.podSpec "initContainers" dict -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set .Values.workload.proxy.podSpec.initContainers "wait-server" (include "authentik.wait.server" . | fromYaml) -}}
|
||||
{{- $_ := set .Values.service.proxy "enabled" true -}}
|
||||
{{- $_ := set .Values.service.proxymetrics "enabled" true -}}
|
||||
{{- $_ := set .Values.metrics.proxymetrics "enabled" true -}}
|
||||
{{- else -}}
|
||||
{{- $_ := set .Values.workload.proxy "enabled" false -}}
|
||||
{{- $_ := set .Values.service.proxy "enabled" false -}}
|
||||
{{- $_ := set .Values.service.proxymetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.metrics.proxymetrics "enabled" false -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.outposts.radius.enabled -}}
|
||||
{{- $_ := set .Values.workload.radius "enabled" true -}}
|
||||
{{- if not .Values.workload.radius.podSpec.initContainers -}}
|
||||
{{- $_ := set .Values.workload.radius.podSpec "initContainers" dict -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set .Values.workload.radius.podSpec.initContainers "wait-server" (include "authentik.wait.server" . | fromYaml) -}}
|
||||
{{- $_ := set .Values.service.radius "enabled" true -}}
|
||||
{{- $_ := set .Values.service.radiusmetrics "enabled" true -}}
|
||||
{{- $_ := set .Values.metrics.radiusmetrics "enabled" true -}}
|
||||
{{- else -}}
|
||||
{{- $_ := set .Values.workload.radius "enabled" false -}}
|
||||
{{- $_ := set .Values.service.radius "enabled" false -}}
|
||||
{{- $_ := set .Values.service.radiusmetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.metrics.radiusmetrics "enabled" false -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.authentik.outposts.ldap.enabled -}}
|
||||
{{- $_ := set .Values.workload.ldap "enabled" true -}}
|
||||
{{- if not .Values.workload.ldap.podSpec.initContainers -}}
|
||||
{{- $_ := set .Values.workload.ldap.podSpec "initContainers" dict -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set .Values.workload.ldap.podSpec.initContainers "wait-server" (include "authentik.wait.server" . | fromYaml) -}}
|
||||
{{- $_ := set .Values.service.ldap "enabled" true -}}
|
||||
{{- $_ := set .Values.service.ldaps "enabled" true -}}
|
||||
{{- $_ := set .Values.service.ldapmetrics "enabled" true -}}
|
||||
{{- $_ := set .Values.metrics.ldapmetrics "enabled" true -}}
|
||||
{{- else -}}
|
||||
{{- $_ := set .Values.workload.ldap "enabled" false -}}
|
||||
{{- $_ := set .Values.service.ldap "enabled" false -}}
|
||||
{{- $_ := set .Values.service.ldaps "enabled" false -}}
|
||||
{{- $_ := set .Values.service.ldapmetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.metrics.ldapmetrics "enabled" false -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* FIXME: See values.yaml */}}
|
||||
{{- $_ := set .Values.service.servermetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.service.proxymetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.service.radiusmetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.service.ldapmetrics "enabled" false -}}
|
||||
|
||||
{{- $_ := set .Values.metrics.servermetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.metrics.proxymetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.metrics.radiusmetrics "enabled" false -}}
|
||||
{{- $_ := set .Values.metrics.ldapmetrics "enabled" false -}}
|
||||
|
||||
{{/* Render the templates */}}
|
||||
{{ include "tc.v1.common.loader.apply" . }}
|
||||
|
|
@ -0,0 +1,99 @@
|
|||
**Important:**
|
||||
*for the complete changelog, please refer to the website*
|
||||
|
||||
|
||||
|
||||
|
||||
## [nextcloud-25.0.6](https://github.com/truecharts/charts/compare/nextcloud-25.0.5...nextcloud-25.0.6) (2023-12-21)
|
||||
|
||||
### Chore
|
||||
|
||||
- require ingress for certain charts
|
||||
|
||||
|
||||
|
||||
|
||||
## [nextcloud-25.0.5](https://github.com/truecharts/charts/compare/nextcloud-25.0.4...nextcloud-25.0.5) (2023-12-21)
|
||||
|
||||
### Chore
|
||||
|
||||
- bump nextcloud
|
||||
|
||||
### Fix
|
||||
|
||||
- nextcloud collabora service in ingress being wrong
|
||||
|
||||
|
||||
|
||||
|
||||
## [nextcloud-25.0.4](https://github.com/truecharts/charts/compare/nextcloud-25.0.3...nextcloud-25.0.4) (2023-12-21)
|
||||
|
||||
### Chore
|
||||
|
||||
- bump everything to ensure patches are applied globally
|
||||
|
||||
### Fix
|
||||
|
||||
- ensure the cnpg GUI is included on CNPG apps
|
||||
|
||||
|
||||
|
||||
|
||||
## [nextcloud-25.0.3](https://github.com/truecharts/charts/compare/nextcloud-25.0.2...nextcloud-25.0.3) (2023-12-21)
|
||||
|
||||
### Chore
|
||||
|
||||
- update helm general non-major by renovate ([#16341](https://github.com/truecharts/charts/issues/16341))
|
||||
|
||||
|
||||
|
||||
|
||||
## [nextcloud-25.0.2](https://github.com/truecharts/charts/compare/nextcloud-25.0.1...nextcloud-25.0.2) (2023-12-21)
|
||||
|
||||
### Fix
|
||||
|
||||
- correctly reference collabora's interfacemode ([#16327](https://github.com/truecharts/charts/issues/16327))
|
||||
|
||||
|
||||
|
||||
|
||||
## [nextcloud-25.0.1](https://github.com/truecharts/charts/compare/nextcloud-25.0.0...nextcloud-25.0.1) (2023-12-20)
|
||||
|
||||
### Chore
|
||||
|
||||
- bump patch versions on all charts for new GUI release
|
||||
|
||||
|
||||
|
||||
|
||||
## [nextcloud-25.0.0](https://github.com/truecharts/charts/compare/nextcloud-24.0.0...nextcloud-25.0.0) (2023-12-20)
|
||||
|
||||
### Chore
|
||||
|
||||
- update helm general major by renovate (major) ([#14631](https://github.com/truecharts/charts/issues/14631))
|
||||
|
||||
|
||||
|
||||
|
||||
## [nextcloud-24.0.0](https://github.com/truecharts/charts/compare/nextcloud-23.0.2...nextcloud-24.0.0) (2023-12-20)
|
||||
|
||||
|
||||
|
||||
|
||||
## [nextcloud-23.0.2](https://github.com/truecharts/charts/compare/nextcloud-23.0.1...nextcloud-23.0.2) (2023-12-20)
|
||||
|
||||
### Chore
|
||||
|
||||
- Bump everything to force min/max scale version update
|
||||
|
||||
|
||||
|
||||
|
||||
## [nextcloud-23.0.1](https://github.com/truecharts/charts/compare/nextcloud-23.0.0...nextcloud-23.0.1) (2023-12-18)
|
||||
|
||||
### Fix
|
||||
|
||||
- add nginx changes for nc 28 ([#16306](https://github.com/truecharts/charts/issues/16306))
|
||||
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,48 @@
|
|||
kubeVersion: ">=1.24.0-0"
|
||||
apiVersion: v2
|
||||
name: nextcloud
|
||||
version: 25.0.6
|
||||
appVersion: 28.0.0
|
||||
description: A private cloud server that puts the control and security of your own data back into your hands.
|
||||
home: https://truecharts.org/charts/stable/nextcloud
|
||||
icon: https://truecharts.org/img/hotlink-ok/chart-icons/nextcloud.png
|
||||
deprecated: false
|
||||
sources:
|
||||
- https://github.com/nextcloud/helm
|
||||
- https://github.com/nextcloud/docker
|
||||
- https://github.com/truecharts/charts/tree/master/charts/stable/nextcloud
|
||||
- https://hub.docker.com/r/collabora/code
|
||||
maintainers:
|
||||
- name: TrueCharts
|
||||
email: info@truecharts.org
|
||||
url: https://truecharts.org
|
||||
keywords:
|
||||
- nextcloud
|
||||
- storage
|
||||
- http
|
||||
- web
|
||||
- php
|
||||
dependencies:
|
||||
- name: common
|
||||
version: 16.2.9
|
||||
repository: https://library-charts.truecharts.org
|
||||
condition: ""
|
||||
alias: ""
|
||||
tags: []
|
||||
import-values: []
|
||||
- name: redis
|
||||
version: 10.0.4
|
||||
repository: https://deps.truecharts.org
|
||||
condition: redis.enabled
|
||||
alias: ""
|
||||
tags: []
|
||||
import-values: []
|
||||
annotations:
|
||||
max_scale_version: 23.10.2
|
||||
min_scale_version: 23.10.0
|
||||
truecharts.org/SCALE-support: "true"
|
||||
truecharts.org/category: cloud
|
||||
truecharts.org/max_helm_version: "3.13"
|
||||
truecharts.org/min_helm_version: "3.12"
|
||||
truecharts.org/train: stable
|
||||
type: application
|
||||
|
|
@ -0,0 +1,106 @@
|
|||
Business Source License 1.1
|
||||
|
||||
Parameters
|
||||
|
||||
Licensor: The TrueCharts Project, it's owner and it's contributors
|
||||
Licensed Work: The TrueCharts "Blocky" Helm Chart
|
||||
Additional Use Grant: You may use the licensed work in production, as long
|
||||
as it is directly sourced from a TrueCharts provided
|
||||
official repository, catalog or source. You may also make private
|
||||
modification to the directly sourced licenced work,
|
||||
when used in production.
|
||||
|
||||
The following cases are, due to their nature, also
|
||||
defined as 'production use' and explicitly prohibited:
|
||||
- Bundling, including or displaying the licensed work
|
||||
with(in) another work intended for production use,
|
||||
with the apparent intend of facilitating and/or
|
||||
promoting production use by third parties in
|
||||
violation of this license.
|
||||
|
||||
Change Date: 2050-01-01
|
||||
|
||||
Change License: 3-clause BSD license
|
||||
|
||||
For information about alternative licensing arrangements for the Software,
|
||||
please contact: legal@truecharts.org
|
||||
|
||||
Notice
|
||||
|
||||
The Business Source License (this document, or the “License”) is not an Open
|
||||
Source license. However, the Licensed Work will eventually be made available
|
||||
under an Open Source License, as stated in this License.
|
||||
|
||||
License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
|
||||
“Business Source License” is a trademark of MariaDB Corporation Ab.
|
||||
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
Business Source License 1.1
|
||||
|
||||
Terms
|
||||
|
||||
The Licensor hereby grants you the right to copy, modify, create derivative
|
||||
works, redistribute, and make non-production use of the Licensed Work. The
|
||||
Licensor may make an Additional Use Grant, above, permitting limited
|
||||
production use.
|
||||
|
||||
Effective on the Change Date, or the fourth anniversary of the first publicly
|
||||
available distribution of a specific version of the Licensed Work under this
|
||||
License, whichever comes first, the Licensor hereby grants you rights under
|
||||
the terms of the Change License, and the rights granted in the paragraph
|
||||
above terminate.
|
||||
|
||||
If your use of the Licensed Work does not comply with the requirements
|
||||
currently in effect as described in this License, you must purchase a
|
||||
commercial license from the Licensor, its affiliated entities, or authorized
|
||||
resellers, or you must refrain from using the Licensed Work.
|
||||
|
||||
All copies of the original and modified Licensed Work, and derivative works
|
||||
of the Licensed Work, are subject to this License. This License applies
|
||||
separately for each version of the Licensed Work and the Change Date may vary
|
||||
for each version of the Licensed Work released by Licensor.
|
||||
|
||||
You must conspicuously display this License on each original or modified copy
|
||||
of the Licensed Work. If you receive the Licensed Work in original or
|
||||
modified form from a third party, the terms and conditions set forth in this
|
||||
License apply to your use of that work.
|
||||
|
||||
Any use of the Licensed Work in violation of this License will automatically
|
||||
terminate your rights under this License for the current and all other
|
||||
versions of the Licensed Work.
|
||||
|
||||
This License does not grant you any right in any trademark or logo of
|
||||
Licensor or its affiliates (provided that you may use a trademark or logo of
|
||||
Licensor as expressly required by this License).
|
||||
|
||||
TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
|
||||
AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
|
||||
EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
|
||||
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
|
||||
TITLE.
|
||||
|
||||
MariaDB hereby grants you permission to use this License’s text to license
|
||||
your works, and to refer to it using the trademark “Business Source License”,
|
||||
as long as you comply with the Covenants of Licensor below.
|
||||
|
||||
Covenants of Licensor
|
||||
|
||||
In consideration of the right to use this License’s text and the “Business
|
||||
Source License” name and trademark, Licensor covenants to MariaDB, and to all
|
||||
other recipients of the licensed work to be provided by Licensor:
|
||||
|
||||
1. To specify as the Change License the GPL Version 2.0 or any later version,
|
||||
or a license that is compatible with GPL Version 2.0 or a later version,
|
||||
where “compatible” means that software provided under the Change License can
|
||||
be included in a program with software provided under GPL Version 2.0 or a
|
||||
later version. Licensor may specify additional Change Licenses without
|
||||
limitation.
|
||||
|
||||
2. To either: (a) specify an additional grant of rights to use that does not
|
||||
impose any additional restriction on the right granted in this License, as
|
||||
the Additional Use Grant; or (b) insert the text “None”.
|
||||
|
||||
3. To specify a Change Date.
|
||||
|
||||
4. Not to modify this License in any other way.
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
# README
|
||||
|
||||
## General Info
|
||||
|
||||
TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE.
|
||||
However only installations using the TrueNAS SCALE Apps system are supported.
|
||||
|
||||
For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/stable/nextcloud)
|
||||
|
||||
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
|
||||
|
||||
|
||||
## Support
|
||||
|
||||
- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
|
||||
- See the [Website](https://truecharts.org)
|
||||
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
||||
- Open a [issue](https://github.com/truecharts/charts/issues/new/choose)
|
||||
|
||||
---
|
||||
|
||||
## Sponsor TrueCharts
|
||||
|
||||
TrueCharts can only exist due to the incredible effort of our staff.
|
||||
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
||||
|
||||
*All Rights Reserved - The TrueCharts Project*
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
|
||||
|
||||
## [nextcloud-25.0.6](https://github.com/truecharts/charts/compare/nextcloud-25.0.5...nextcloud-25.0.6) (2023-12-21)
|
||||
|
||||
### Chore
|
||||
|
||||
- require ingress for certain charts
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
A private cloud server that puts the control and security of your own data back into your hands.
|
||||
|
||||
This App is supplied by TrueCharts, for more information visit the manual: [https://truecharts.org/charts/stable/nextcloud](https://truecharts.org/charts/stable/nextcloud)
|
||||
|
||||
---
|
||||
|
||||
TrueCharts can only exist due to the incredible effort of our staff.
|
||||
Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
|
||||
Binary file not shown.
Binary file not shown.
|
|
@ -0,0 +1,516 @@
|
|||
image:
|
||||
repository: tccr.io/truecharts/nextcloud-fpm
|
||||
pullPolicy: IfNotPresent
|
||||
tag: v28.0.0@sha256:a765a49bafef4e3e6c1f874c5ee1c4d2ce39b2bd6793b9a2e044ed75645bbc1a
|
||||
nginxImage:
|
||||
repository: nginxinc/nginx-unprivileged
|
||||
pullPolicy: IfNotPresent
|
||||
tag: 1.25.3@sha256:1d026ae92e50e76c77ca776f234f154d4a1d39e33e8f813115e53c2a9b893bc9
|
||||
imaginaryImage:
|
||||
repository: tccr.io/truecharts/nextcloud-imaginary
|
||||
pullPolicy: IfNotPresent
|
||||
tag: v20230401@sha256:6a227d1b0200d29f25028e07b8852f60e3d91a5814048933e70eccee749dc04c
|
||||
hpbImage:
|
||||
repository: tccr.io/truecharts/nextcloud-push-notify
|
||||
pullPolicy: IfNotPresent
|
||||
tag: v0.6.3@sha256:b9c35ab123354eeac3996e361f8c30b8e4de6d2ccd69e5179a7c2a101a67b46f
|
||||
clamavImage:
|
||||
repository: clamav/clamav
|
||||
pullPolicy: IfNotPresent
|
||||
tag: 1.2.1@sha256:d584c29eefc29e138eb14f243abef2f6712cffecac52194626a2b2f6bb3ec2c7
|
||||
collaboraImage:
|
||||
repository: collabora/code
|
||||
pullPolicy: IfNotPresent
|
||||
tag: 23.05.6.3.1@sha256:6d21951e6376be4a12009b5058c57f3da7df06faf05c62406030b3652a3e78f6
|
||||
nextcloud:
|
||||
# Initial Credentials
|
||||
credentials:
|
||||
initialAdminUser: admin
|
||||
initialAdminPassword: adminpass
|
||||
# General settings
|
||||
general:
|
||||
# Custom Nextcloud Scripts
|
||||
run_optimize: true
|
||||
default_phone_region: GR
|
||||
# IP used for exposing nextcloud,
|
||||
# often the loadbalancer IP
|
||||
accessIP: ""
|
||||
# Allows Nextcloud to connect to unsecure (http) endpoints
|
||||
force_enable_allow_local_remote_servers: false
|
||||
# File settings
|
||||
files:
|
||||
shared_folder_name: Shared
|
||||
max_chunk_size: 10485760
|
||||
# Expiration settings
|
||||
expirations:
|
||||
activity_expire_days: 90
|
||||
trash_retention_obligation: auto
|
||||
versions_retention_obligation: auto
|
||||
# Previews settings
|
||||
previews:
|
||||
enabled: true
|
||||
# It will also deploy the container
|
||||
imaginary: true
|
||||
cron: true
|
||||
schedule: "*/30 * * * *"
|
||||
max_x: 2048
|
||||
max_y: 2048
|
||||
max_memory: 1024
|
||||
max_file_size_image: 50
|
||||
# Setting for Imaginary
|
||||
max_allowed_resolution: 18.0
|
||||
jpeg_quality: 60
|
||||
square_sizes: 32 256
|
||||
width_sizes: 256 384
|
||||
height_sizes: 256
|
||||
# Casings are important
|
||||
# https://github.com/nextcloud/server/blob/master/config/config.sample.php#L1269
|
||||
# Only the last part of the provider is needed
|
||||
providers:
|
||||
- PNG
|
||||
- JPEG
|
||||
# Logging settings
|
||||
logging:
|
||||
log_level: 2
|
||||
log_file: /var/www/html/data/logs/nextcloud.log
|
||||
log_audit_file: /var/www/html/data/logs/audit.log
|
||||
log_date_format: d/m/Y H:i:s
|
||||
# ClamAV settings
|
||||
clamav:
|
||||
# It will also deploy the container
|
||||
# Note that this runs as root
|
||||
enabled: false
|
||||
stream_max_length: 26214400
|
||||
file_max_size: -1
|
||||
infected_action: only_log
|
||||
# Notify Push settings
|
||||
notify_push:
|
||||
# It will also deploy the container
|
||||
enabled: true
|
||||
# Collabora settings
|
||||
collabora:
|
||||
# It will also deploy the container
|
||||
enabled: false
|
||||
# default|compact|tabbed
|
||||
interface_mode: default
|
||||
username: admin
|
||||
password: changeme
|
||||
dictionaries:
|
||||
- de_DE
|
||||
- en_GB
|
||||
- en_US
|
||||
- el_GR
|
||||
- es_ES
|
||||
- fr_FR
|
||||
- pt_BR
|
||||
- pt_PT
|
||||
- it
|
||||
- nl
|
||||
- ru
|
||||
onlyoffice:
|
||||
# It will not deploy the container
|
||||
# Only add the OnlyOffice settings
|
||||
enabled: false
|
||||
url: ""
|
||||
internal_url: ""
|
||||
verify_ssl: true
|
||||
jwt: ""
|
||||
jwt_header: Authorization
|
||||
# PHP settings
|
||||
php:
|
||||
memory_limit: 1G
|
||||
upload_limit: 10G
|
||||
pm_max_children: 180
|
||||
pm_start_servers: 18
|
||||
pm_min_spare_servers: 12
|
||||
pm_max_spare_servers: 30
|
||||
opcache:
|
||||
interned_strings_buffer: 32
|
||||
max_accelerated_files: 10000
|
||||
memory_consumption: 128
|
||||
revalidate_freq: 60
|
||||
jit_buffer_size: 128
|
||||
# Do NOT edit below this line
|
||||
workload:
|
||||
# Nextcloud php-fpm
|
||||
main:
|
||||
type: Deployment
|
||||
podSpec:
|
||||
containers:
|
||||
main:
|
||||
enabled: true
|
||||
primary: true
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: nextcloud-config
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command: /healthcheck.sh
|
||||
readiness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command: /healthcheck.sh
|
||||
startup:
|
||||
enabled: true
|
||||
type: tcp
|
||||
port: "{{ .Values.service.nextcloud.ports.nextcloud.targetPort }}"
|
||||
nginx:
|
||||
enabled: true
|
||||
type: Deployment
|
||||
strategy: RollingUpdate
|
||||
replicas: 1
|
||||
podSpec:
|
||||
containers:
|
||||
nginx:
|
||||
enabled: true
|
||||
primary: true
|
||||
imageSelector: nginxImage
|
||||
probes:
|
||||
readiness:
|
||||
enabled: true
|
||||
path: /robots.txt
|
||||
port: "{{ .Values.service.main.ports.main.port }}"
|
||||
httpHeaders:
|
||||
Host: kube.internal.healthcheck
|
||||
liveness:
|
||||
enabled: true
|
||||
path: /robots.txt
|
||||
port: "{{ .Values.service.main.ports.main.port }}"
|
||||
httpHeaders:
|
||||
Host: kube.internal.healthcheck
|
||||
startup:
|
||||
enabled: true
|
||||
type: tcp
|
||||
port: "{{ .Values.service.main.ports.main.port }}"
|
||||
notify:
|
||||
enabled: true
|
||||
type: Deployment
|
||||
strategy: RollingUpdate
|
||||
replicas: 1
|
||||
podSpec:
|
||||
containers:
|
||||
notify:
|
||||
primary: true
|
||||
enabled: true
|
||||
imageSelector: hpbImage
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: hpb-config
|
||||
probes:
|
||||
readiness:
|
||||
enabled: true
|
||||
path: /push/test/cookie
|
||||
port: 7867
|
||||
httpHeaders:
|
||||
Host: kube.internal.healthcheck
|
||||
liveness:
|
||||
enabled: true
|
||||
path: /push/test/cookie
|
||||
port: 7867
|
||||
httpHeaders:
|
||||
Host: kube.internal.healthcheck
|
||||
startup:
|
||||
enabled: true
|
||||
type: tcp
|
||||
port: 7867
|
||||
imaginary:
|
||||
enabled: true
|
||||
type: Deployment
|
||||
strategy: RollingUpdate
|
||||
replicas: 1
|
||||
podSpec:
|
||||
containers:
|
||||
imaginary:
|
||||
primary: true
|
||||
enabled: true
|
||||
imageSelector: imaginaryImage
|
||||
command: imaginary
|
||||
args:
|
||||
- -p
|
||||
- "{{ .Values.service.imaginary.ports.imaginary.port }}"
|
||||
- -concurrency
|
||||
- "10"
|
||||
- -max-allowed-resolution
|
||||
- "{{ .Values.nextcloud.previews.max_allowed_resolution }}"
|
||||
- -enable-url-source
|
||||
- -return-size
|
||||
probes:
|
||||
readiness:
|
||||
enabled: true
|
||||
path: /health
|
||||
port: "{{ .Values.service.imaginary.ports.imaginary.port }}"
|
||||
liveness:
|
||||
enabled: true
|
||||
path: /health
|
||||
port: "{{ .Values.service.imaginary.ports.imaginary.port }}"
|
||||
startup:
|
||||
enabled: true
|
||||
type: tcp
|
||||
port: "{{ .Values.service.imaginary.ports.imaginary.port }}"
|
||||
clamav:
|
||||
enabled: true
|
||||
type: Deployment
|
||||
strategy: RollingUpdate
|
||||
replicas: 1
|
||||
podSpec:
|
||||
containers:
|
||||
clamav:
|
||||
primary: true
|
||||
enabled: true
|
||||
imageSelector: clamavImage
|
||||
# FIXME: https://github.com/Cisco-Talos/clamav/issues/478
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
readOnlyRootFilesystem: false
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: clamav-config
|
||||
probes:
|
||||
readiness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command: clamdcheck.sh
|
||||
liveness:
|
||||
enabled: true
|
||||
type: exec
|
||||
command: clamdcheck.sh
|
||||
startup:
|
||||
enabled: true
|
||||
type: tcp
|
||||
port: "{{ .Values.service.clamav.ports.clamav.targetPort }}"
|
||||
collabora:
|
||||
enabled: true
|
||||
type: Deployment
|
||||
strategy: RollingUpdate
|
||||
replicas: 1
|
||||
podSpec:
|
||||
containers:
|
||||
collabora:
|
||||
primary: true
|
||||
enabled: true
|
||||
imageSelector: collaboraImage
|
||||
securityContext:
|
||||
runAsUser: 100
|
||||
runAsGroup: 102
|
||||
readOnlyRootFilesystem: false
|
||||
allowPrivilegeEscalation: true
|
||||
capabilities:
|
||||
add:
|
||||
- CHOWN
|
||||
- FOWNER
|
||||
- SYS_CHROOT
|
||||
- MKNOD
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: collabora-config
|
||||
probes:
|
||||
readiness:
|
||||
enabled: true
|
||||
type: http
|
||||
path: /collabora/
|
||||
port: "{{ .Values.service.collabora.ports.collabora.targetPort }}"
|
||||
liveness:
|
||||
enabled: true
|
||||
type: http
|
||||
path: /collabora/
|
||||
port: "{{ .Values.service.collabora.ports.collabora.targetPort }}"
|
||||
startup:
|
||||
enabled: true
|
||||
type: tcp
|
||||
port: "{{ .Values.service.collabora.ports.collabora.targetPort }}"
|
||||
cronjobs:
|
||||
# Don't change names, it's used in the persistence
|
||||
- name: nextcloud-cron
|
||||
enabled: true
|
||||
schedule: "*/5 * * * *"
|
||||
cmd:
|
||||
- echo "Running [php -f /var/www/html/cron.php] ..."
|
||||
- php -f /var/www/html/cron.php
|
||||
- echo "Finished [php -f /var/www/html/cron.php]"
|
||||
- name: preview-cron
|
||||
enabled: "{{ .Values.nextcloud.previews.cron }}"
|
||||
schedule: "{{ .Values.nextcloud.previews.schedule }}"
|
||||
cmd:
|
||||
- echo "Running [occ preview:pre-generate] ..."
|
||||
- occ preview:pre-generate
|
||||
- echo "Finished [occ preview:pre-generate]"
|
||||
service:
|
||||
# Main service links to ingress easier
|
||||
# That's why the nginx is swapped with nextcloud
|
||||
main:
|
||||
targetSelector: nginx
|
||||
ports:
|
||||
main:
|
||||
targetSelector: nginx
|
||||
port: 8080
|
||||
nextcloud:
|
||||
enabled: true
|
||||
targetSelector: main
|
||||
ports:
|
||||
nextcloud:
|
||||
enabled: true
|
||||
targetSelector: main
|
||||
port: 9000
|
||||
targetPort: 9000
|
||||
notify:
|
||||
enabled: true
|
||||
targetSelector: notify
|
||||
ports:
|
||||
notify:
|
||||
enabled: true
|
||||
primary: true
|
||||
port: 7867
|
||||
targetPort: 7867
|
||||
targetSelector: notify
|
||||
metrics:
|
||||
enabled: true
|
||||
port: 7868
|
||||
targetSelector: notify
|
||||
imaginary:
|
||||
enabled: true
|
||||
targetSelector: imaginary
|
||||
ports:
|
||||
imaginary:
|
||||
enabled: true
|
||||
port: 9090
|
||||
targetSelector: imaginary
|
||||
clamav:
|
||||
enabled: true
|
||||
targetSelector: clamav
|
||||
ports:
|
||||
clamav:
|
||||
enabled: true
|
||||
port: 3310
|
||||
targetPort: 3310
|
||||
targetSelector: clamav
|
||||
collabora:
|
||||
enabled: true
|
||||
targetSelector: collabora
|
||||
ports:
|
||||
collabora:
|
||||
enabled: true
|
||||
port: 9980
|
||||
targetPort: 9980
|
||||
targetSelector: collabora
|
||||
persistence:
|
||||
php-tune:
|
||||
enabled: true
|
||||
type: configmap
|
||||
objectName: php-tune
|
||||
targetSelector:
|
||||
main:
|
||||
main:
|
||||
mountPath: /usr/local/etc/php-fpm.d/zz-tune.conf
|
||||
subPath: zz-tune.conf
|
||||
readOnly: true
|
||||
redis-session:
|
||||
enabled: true
|
||||
type: configmap
|
||||
objectName: redis-session
|
||||
targetSelector:
|
||||
main:
|
||||
main:
|
||||
mountPath: /usr/local/etc/php/conf.d/redis-session.ini
|
||||
subPath: redis-session.ini
|
||||
readOnly: true
|
||||
opcache-recommended:
|
||||
enabled: true
|
||||
type: configmap
|
||||
objectName: opcache
|
||||
targetSelector:
|
||||
main:
|
||||
main:
|
||||
mountPath: /usr/local/etc/php/conf.d/opcache-recommended.ini
|
||||
subPath: opcache-recommended.ini
|
||||
readOnly: true
|
||||
nginx:
|
||||
enabled: true
|
||||
type: configmap
|
||||
objectName: nginx-config
|
||||
targetSelector:
|
||||
nginx:
|
||||
nginx:
|
||||
mountPath: /etc/nginx/nginx.conf
|
||||
subPath: nginx.conf
|
||||
readOnly: true
|
||||
nginx-temp:
|
||||
enabled: true
|
||||
type: emptyDir
|
||||
targetSelector:
|
||||
nginx:
|
||||
nginx:
|
||||
mountPath: /tmp/nginx
|
||||
html:
|
||||
enabled: true
|
||||
targetSelector:
|
||||
main:
|
||||
main:
|
||||
mountPath: /var/www/html
|
||||
nextcloud-cron:
|
||||
nextcloud-cron:
|
||||
mountPath: /var/www/html
|
||||
preview-cron:
|
||||
preview-cron:
|
||||
mountPath: /var/www/html
|
||||
nginx:
|
||||
nginx:
|
||||
mountPath: /var/www/html
|
||||
readOnly: true
|
||||
config:
|
||||
enabled: true
|
||||
targetSelector:
|
||||
main:
|
||||
main:
|
||||
mountPath: /var/www/html/config
|
||||
nextcloud-cron:
|
||||
nextcloud-cron:
|
||||
mountPath: /var/www/html/config
|
||||
preview-cron:
|
||||
preview-cron:
|
||||
mountPath: /var/www/html/config
|
||||
notify:
|
||||
notify:
|
||||
mountPath: /var/www/html/config
|
||||
readOnly: true
|
||||
nginx:
|
||||
nginx:
|
||||
mountPath: /var/www/html/config
|
||||
readOnly: true
|
||||
data:
|
||||
enabled: true
|
||||
targetSelector:
|
||||
main:
|
||||
main:
|
||||
mountPath: /var/www/html/data
|
||||
init-perms:
|
||||
mountPath: /var/www/html/data
|
||||
nextcloud-cron:
|
||||
nextcloud-cron:
|
||||
mountPath: /var/www/html/data
|
||||
preview-cron:
|
||||
preview-cron:
|
||||
mountPath: /var/www/html/data
|
||||
nginx:
|
||||
nginx:
|
||||
mountPath: /var/www/html/data
|
||||
readOnly: true
|
||||
cnpg:
|
||||
main:
|
||||
enabled: true
|
||||
user: nextcloud
|
||||
database: nextcloud
|
||||
redis:
|
||||
enabled: true
|
||||
username: default
|
||||
portal:
|
||||
open:
|
||||
enabled: true
|
||||
updated: true
|
||||
|
||||
ingress:
|
||||
main:
|
||||
required: true
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1 @@
|
|||
{{- include "tc.v1.common.lib.chart.notes" $ -}}
|
||||
|
|
@ -0,0 +1,443 @@
|
|||
{{- define "nextcloud.accessurl" -}}
|
||||
{{- $accessUrl := .Values.chartContext.appUrl -}}
|
||||
{{- if or (contains "127.0.0.1" $accessUrl) (contains "localhost" $accessUrl) -}}
|
||||
{{- if .Values.nextcloud.general.accessIP -}}
|
||||
{{- $prot := "http" -}}
|
||||
{{- $host := .Values.nextcloud.general.accessIP -}}
|
||||
{{- $port := .Values.service.main.ports.main.port -}}
|
||||
{{/*
|
||||
Allowing here to override protocol and port
|
||||
should be enough to make it work with any rev proxy
|
||||
*/}}
|
||||
{{- $accessUrl = printf "%v://%v:%v" $prot $host $port -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $accessUrl -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "nextcloud.accesshost" -}}
|
||||
{{- $accessUrl := (include "nextcloud.accessurl" $) -}}
|
||||
{{- $accessHost := regexReplaceAll ".*://(.*)" $accessUrl "${1}" -}}
|
||||
{{- $accessHost = regexReplaceAll "(.*):.*" $accessHost "${1}" -}}
|
||||
|
||||
{{- $accessHost -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Define the configmap */}}
|
||||
{{- define "nextcloud.configmaps" -}}
|
||||
{{- $fullname := (include "tc.v1.common.lib.chart.names.fullname" $) -}}
|
||||
{{- $fqdn := (include "tc.v1.common.lib.chart.names.fqdn" $) -}}
|
||||
{{- $accessUrl := (include "nextcloud.accessurl" $) -}}
|
||||
{{- $accessHost := (include "nextcloud.accesshost" $) -}}
|
||||
{{- $accessHostPort := regexReplaceAll ".*://(.*)" $accessUrl "${1}" -}}
|
||||
{{- $accessProtocol := regexReplaceAll "(.*)://.*" $accessUrl "${1}" -}}
|
||||
{{- $redisHost := .Values.redis.creds.plainhost | trimAll "\"" -}}
|
||||
{{- $redisPass := .Values.redis.creds.redisPassword | trimAll "\"" -}}
|
||||
{{- $healthHost := "kube.internal.healthcheck" -}}
|
||||
|
||||
php-tune:
|
||||
enabled: true
|
||||
data:
|
||||
zz-tune.conf: |
|
||||
[www]
|
||||
pm.max_children = {{ .Values.nextcloud.php.pm_max_children }}
|
||||
pm.start_servers = {{ .Values.nextcloud.php.pm_start_servers }}
|
||||
pm.min_spare_servers = {{ .Values.nextcloud.php.pm_min_spare_servers }}
|
||||
pm.max_spare_servers = {{ .Values.nextcloud.php.pm_max_spare_servers }}
|
||||
|
||||
opcache:
|
||||
enabled: true
|
||||
data:
|
||||
opcache-recommended.ini: |
|
||||
opcache.enable=1
|
||||
opcache.save_comments=1
|
||||
opcache.jit=1255
|
||||
opcache.interned_strings_buffer={{ .Values.nextcloud.opcache.interned_strings_buffer }}
|
||||
opcache.max_accelerated_files={{ .Values.nextcloud.opcache.max_accelerated_files }}
|
||||
opcache.memory_consumption={{ .Values.nextcloud.opcache.memory_consumption }}
|
||||
opcache.revalidate_freq={{ .Values.nextcloud.opcache.revalidate_freq }}
|
||||
opcache.jit_buffer_size={{ printf "%vM" .Values.nextcloud.opcache.jit_buffer_size }}
|
||||
|
||||
redis-session:
|
||||
enabled: true
|
||||
data:
|
||||
redis-session.ini: |
|
||||
session.save_handler = redis
|
||||
session.save_path = {{ printf "tcp://%v:6379?auth=%v" $redisHost $redisPass | quote }}
|
||||
redis.session.locking_enabled = 1
|
||||
redis.session.lock_retries = -1
|
||||
redis.session.lock_wait_time = 10000
|
||||
|
||||
hpb-config:
|
||||
enabled: {{ .Values.nextcloud.notify_push.enabled }}
|
||||
data:
|
||||
NEXTCLOUD_URL: {{ printf "http://%v:%v" $fullname .Values.service.main.ports.main.port }}
|
||||
HPB_HOST: {{ $healthHost }}
|
||||
CONFIG_FILE: {{ printf "%v/config.php" .Values.persistence.config.targetSelector.notify.notify.mountPath }}
|
||||
METRICS_PORT: {{ .Values.service.notify.ports.metrics.port | quote }}
|
||||
|
||||
clamav-config:
|
||||
enabled: {{ .Values.nextcloud.clamav.enabled }}
|
||||
data:
|
||||
CLAMAV_NO_CLAMD: "false"
|
||||
CLAMAV_NO_FRESHCLAMD: "true"
|
||||
CLAMAV_NO_MILTERD: "true"
|
||||
CLAMD_STARTUP_TIMEOUT: "1800"
|
||||
|
||||
collabora-config:
|
||||
enabled: {{ .Values.nextcloud.collabora.enabled }}
|
||||
data:
|
||||
aliasgroup1: {{ $accessUrl }}
|
||||
server_name: {{ $accessHostPort }}
|
||||
dictionaries: {{ join " " .Values.nextcloud.collabora.dictionaries }}
|
||||
username: {{ .Values.nextcloud.collabora.username | quote }}
|
||||
password: {{ .Values.nextcloud.collabora.password | quote }}
|
||||
DONT_GEN_SSL_CERT: "true"
|
||||
# mount_jail_tree is only used for local storage
|
||||
# not needed for WOPI https://github.com/CollaboraOnline/online/issues/3604#issuecomment-989833814
|
||||
extra_params: |
|
||||
--o:ssl.enable=false
|
||||
--o:ssl.termination=true
|
||||
--o:net.service_root=/collabora
|
||||
--o:home_mode.enable=true
|
||||
--o:welcome.enable=false
|
||||
--o:logging.level=warning
|
||||
--o:logging.level_startup=warning
|
||||
--o:security.seccomp=true
|
||||
--o:mount_jail_tree=false
|
||||
--o:user_interface.mode={{ .Values.nextcloud.collabora.interface_mode }}
|
||||
|
||||
nextcloud-config:
|
||||
enabled: true
|
||||
data:
|
||||
{{/* Database */}}
|
||||
POSTGRES_DB: {{ .Values.cnpg.main.database | quote }}
|
||||
POSTGRES_USER: {{ .Values.cnpg.main.user | quote }}
|
||||
POSTGRES_PASSWORD: {{ .Values.cnpg.main.creds.password | trimAll "\"" }}
|
||||
POSTGRES_HOST: {{ .Values.cnpg.main.creds.host | trimAll "\"" }}
|
||||
|
||||
{{/* Redis */}}
|
||||
NX_REDIS_HOST: {{ $redisHost }}
|
||||
NX_REDIS_PASS: {{ $redisPass }}
|
||||
|
||||
{{/* Nextcloud INITIAL credentials */}}
|
||||
NEXTCLOUD_ADMIN_USER: {{ .Values.nextcloud.credentials.initialAdminUser | quote }}
|
||||
NEXTCLOUD_ADMIN_PASSWORD: {{ .Values.nextcloud.credentials.initialAdminPassword | quote }}
|
||||
|
||||
{{/* PHP Variables */}}
|
||||
PHP_MEMORY_LIMIT: {{ .Values.nextcloud.php.memory_limit | quote }}
|
||||
PHP_UPLOAD_LIMIT: {{ .Values.nextcloud.php.upload_limit | quote }}
|
||||
|
||||
{{/* Notify Push */}}
|
||||
NX_NOTIFY_PUSH: {{ .Values.nextcloud.notify_push.enabled | quote }}
|
||||
{{- if .Values.nextcloud.notify_push.enabled }}
|
||||
NX_NOTIFY_PUSH_ENDPOINT: {{ $accessUrl }}/push
|
||||
{{- end }}
|
||||
|
||||
{{/* Previews */}}
|
||||
NX_PREVIEWS: {{ .Values.nextcloud.previews.enabled | quote }}
|
||||
NX_PREVIEW_PROVIDERS: {{ join " " .Values.nextcloud.previews.providers }}
|
||||
NX_PREVIEW_MAX_X: {{ .Values.nextcloud.previews.max_x | quote }}
|
||||
NX_PREVIEW_MAX_Y: {{ .Values.nextcloud.previews.max_y | quote }}
|
||||
NX_PREVIEW_MAX_MEMORY: {{ .Values.nextcloud.previews.max_memory | quote }}
|
||||
NX_PREVIEW_MAX_FILESIZE_IMAGE: {{ .Values.nextcloud.previews.max_file_size_image | quote }}
|
||||
NX_JPEG_QUALITY: {{ .Values.nextcloud.previews.jpeg_quality | quote }}
|
||||
NX_PREVIEW_SQUARE_SIZES: {{ .Values.nextcloud.previews.square_sizes | quote }}
|
||||
NX_PREVIEW_WIDTH_SIZES: {{ .Values.nextcloud.previews.width_sizes | quote }}
|
||||
NX_PREVIEW_HEIGHT_SIZES: {{ .Values.nextcloud.previews.height_sizes | quote }}
|
||||
|
||||
{{/* Imaginary */}}
|
||||
NX_IMAGINARY: {{ and .Values.nextcloud.previews.enabled .Values.nextcloud.previews.imaginary | quote }}
|
||||
{{- if and .Values.nextcloud.previews.enabled .Values.nextcloud.previews.imaginary }}
|
||||
NX_IMAGINARY_URL: {{ printf "http://%v-imaginary:%v" $fullname .Values.service.imaginary.ports.imaginary.port }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Expirations */}}
|
||||
NX_ACTIVITY_EXPIRE_DAYS: {{ .Values.nextcloud.expirations.activity_expire_days | quote }}
|
||||
NX_TRASH_RETENTION: {{ .Values.nextcloud.expirations.trash_retention_obligation | quote }}
|
||||
NX_VERSIONS_RETENTION: {{ .Values.nextcloud.expirations.versions_retention_obligation | quote }}
|
||||
|
||||
{{/* General */}}
|
||||
NX_RUN_OPTIMIZE: {{ .Values.nextcloud.general.run_optimize | quote }}
|
||||
NX_DEFAULT_PHONE_REGION: {{ .Values.nextcloud.general.default_phone_region | quote }}
|
||||
NEXTCLOUD_DATA_DIR: {{ .Values.persistence.data.targetSelector.main.main.mountPath }}
|
||||
NX_FORCE_ENABLE_ALLOW_LOCAL_REMOTE_SERVERS: {{ .Values.nextcloud.general.force_enable_allow_local_remote_servers | quote }}
|
||||
|
||||
{{/* Files */}}
|
||||
NX_SHARED_FOLDER_NAME: {{ .Values.nextcloud.files.shared_folder_name | quote }}
|
||||
NX_MAX_CHUNKSIZE: {{ .Values.nextcloud.files.max_chunk_size | mul 1 | quote }}
|
||||
|
||||
{{/* Logging */}}
|
||||
NX_LOG_LEVEL: {{ .Values.nextcloud.logging.log_level | quote }}
|
||||
NX_LOG_FILE: {{ .Values.nextcloud.logging.log_file | quote }}
|
||||
NX_LOG_FILE_AUDIT: {{ .Values.nextcloud.logging.log_audit_file | quote }}
|
||||
NX_LOG_DATE_FORMAT: {{ .Values.nextcloud.logging.log_date_format | quote }}
|
||||
NX_LOG_TIMEZONE: {{ .Values.TZ | quote }}
|
||||
|
||||
{{/* ClamAV */}}
|
||||
NX_CLAMAV: {{ .Values.nextcloud.clamav.enabled | quote }}
|
||||
{{- if .Values.nextcloud.clamav.enabled }}
|
||||
NX_CLAMAV_HOST: {{ printf "%v-clamav" $fullname }}
|
||||
NX_CLAMAV_PORT: {{ .Values.service.clamav.ports.clamav.targetPort | quote }}
|
||||
NX_CLAMAV_STREAM_MAX_LENGTH: {{ .Values.nextcloud.clamav.stream_max_length | mul 1 | quote }}
|
||||
NX_CLAMAV_FILE_MAX_SIZE: {{ .Values.nextcloud.clamav.file_max_size | quote }}
|
||||
NX_CLAMAV_INFECTED_ACTION: {{ .Values.nextcloud.clamav.infected_action | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Collabora */}}
|
||||
NX_COLLABORA: {{ .Values.nextcloud.collabora.enabled | quote }}
|
||||
{{- if .Values.nextcloud.collabora.enabled }}
|
||||
NX_COLLABORA_URL: {{ printf "%v/collabora" $accessUrl | quote }}
|
||||
# Ideally this would be a combo of: public ip, pod cidr, svc cidr
|
||||
# But not always people have static IP.
|
||||
NX_COLLABORA_ALLOWLIST: "0.0.0.0/0"
|
||||
{{- end }}
|
||||
|
||||
{{/* Only Office */}}
|
||||
NX_ONLYOFFICE: {{ .Values.nextcloud.onlyoffice.enabled | quote }}
|
||||
{{- if .Values.nextcloud.onlyoffice.enabled }}
|
||||
NX_ONLYOFFICE_URL: {{ .Values.nextcloud.onlyoffice.url | quote }}
|
||||
NX_ONLYOFFICE_INTERNAL_URL: {{ .Values.nextcloud.onlyoffice.internal_url | quote }}
|
||||
NX_ONLYOFFICE_VERIFY_SSL: {{ .Values.nextcloud.onlyoffice.verify_ssl | quote }}
|
||||
NX_ONLYOFFICE_NEXTCLOUD_INTERNAL_URL: {{ printf "http://%v.svc.cluster.local:%v" $fqdn .Values.service.main.ports.main.port }}
|
||||
NX_ONLYOFFICE_JWT: {{ .Values.nextcloud.onlyoffice.jwt | quote }}
|
||||
NX_ONLYOFFICE_JWT_HEADER: {{ .Values.nextcloud.onlyoffice.jwt_header | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{/* URLs */}}
|
||||
NX_OVERWRITE_HOST: {{ $accessHostPort }}
|
||||
NX_OVERWRITE_CLI_URL: {{ $accessUrl }}
|
||||
# Return the protocol part of the URL
|
||||
NX_OVERWRITE_PROTOCOL: {{ $accessProtocol | lower }}
|
||||
# IP (or range in this case) of the proxy(ies)
|
||||
NX_TRUSTED_PROXIES: |
|
||||
{{ .Values.chartContext.podCIDR }}
|
||||
{{ .Values.chartContext.svcCIDR }}
|
||||
# fullname-* will allow access from the
|
||||
# other services in the same namespace
|
||||
NX_TRUSTED_DOMAINS: |
|
||||
127.0.0.1
|
||||
localhost
|
||||
{{ $fullname }}
|
||||
{{ printf "%v-*" $fullname }}
|
||||
{{ $healthHost }}
|
||||
{{- if not (contains "127.0.0.1" $accessHost) }}
|
||||
{{- $accessHost | nindent 6 }}
|
||||
{{- end -}}
|
||||
{{- with .Values.nextcloud.general.accessIP }}
|
||||
{{- . | nindent 6 }}
|
||||
{{- end }}
|
||||
|
||||
# TODO: Replace locations with ingress
|
||||
# like /push, /.well-known/carddav, /.well-known/caldav
|
||||
# needs some work as nginx converts urls to pretty urls
|
||||
# before matching them to locations, so ingress needs to
|
||||
# take that into consideration.
|
||||
nginx-config:
|
||||
enabled: true
|
||||
data:
|
||||
nginx.conf: |
|
||||
worker_processes auto;
|
||||
|
||||
error_log /var/log/nginx/error.log warn;
|
||||
# Set to /tmp so it can run as non-root
|
||||
pid /tmp/nginx.pid;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
# Set to /tmp so it can run as non-root
|
||||
client_body_temp_path /tmp/nginx/client_temp;
|
||||
proxy_temp_path /tmp/nginx/proxy_temp_path;
|
||||
fastcgi_temp_path /tmp/nginx/fastcgi_temp;
|
||||
uwsgi_temp_path /tmp/nginx/uwsgi_temp;
|
||||
scgi_temp_path /tmp/nginx/scgi_temp;
|
||||
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||
|
||||
access_log /var/log/nginx/access.log main;
|
||||
|
||||
sendfile on;
|
||||
#tcp_nopush on;
|
||||
|
||||
# Prevent nginx HTTP Server Detection
|
||||
server_tokens off;
|
||||
|
||||
keepalive_timeout 65;
|
||||
|
||||
#gzip on;
|
||||
|
||||
upstream php-handler {
|
||||
server {{ printf "%v-nextcloud" $fullname }}:{{ .Values.service.nextcloud.ports.nextcloud.targetPort }};
|
||||
}
|
||||
|
||||
server {
|
||||
listen {{ .Values.service.main.ports.main.port }};
|
||||
absolute_redirect off;
|
||||
|
||||
{{- if .Values.nextcloud.notify_push.enabled }}
|
||||
# Forward Notify_Push "High Performance Backend" to it's own container
|
||||
location ^~ /push/ {
|
||||
# The trailing "/" is important!
|
||||
proxy_pass http://{{ printf "%v-notify" $fullname }}:{{ .Values.service.notify.ports.notify.targetPort }}/;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "Upgrade";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
}
|
||||
{{- end }}
|
||||
|
||||
# HSTS settings
|
||||
# WARNING: Only add the preload option once you read about
|
||||
# the consequences in https://hstspreload.org/. This option
|
||||
# will add the domain to a hardcoded list that is shipped
|
||||
# in all major browsers and getting removed from this list
|
||||
# could take several months.
|
||||
#add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
|
||||
|
||||
# Set max upload size
|
||||
client_max_body_size {{ .Values.nextcloud.php.upload_limit | default "512M" }};
|
||||
fastcgi_buffers 64 4K;
|
||||
|
||||
# Enable gzip but do not remove ETag headers
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_comp_level 4;
|
||||
gzip_min_length 256;
|
||||
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
|
||||
gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
|
||||
|
||||
# Pagespeed is not supported by Nextcloud, so if your server is built
|
||||
# with the `ngx_pagespeed` module, uncomment this line to disable it.
|
||||
#pagespeed off;
|
||||
|
||||
include mime.types;
|
||||
types {
|
||||
text/javascript js mjs;
|
||||
}
|
||||
|
||||
# HTTP response headers borrowed from Nextcloud `.htaccess`
|
||||
add_header Referrer-Policy "no-referrer" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Download-Options "noopen" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
||||
add_header X-Robots-Tag "noindex, nofollow" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
|
||||
# Remove X-Powered-By, which is an information leak
|
||||
fastcgi_hide_header X-Powered-By;
|
||||
|
||||
# Path to the root of your installation
|
||||
root {{ .Values.persistence.html.targetSelector.nginx.nginx.mountPath }};
|
||||
|
||||
# Specify how to handle directories -- specifying `/index.php$request_uri`
|
||||
# here as the fallback means that Nginx always exhibits the desired behaviour
|
||||
# when a client requests a path that corresponds to a directory that exists
|
||||
# on the server. In particular, if that directory contains an index.php file,
|
||||
# that file is correctly served; if it doesn't, then the request is passed to
|
||||
# the front-end controller. This consistent behaviour means that we don't need
|
||||
# to specify custom rules for certain paths (e.g. images and other assets,
|
||||
# `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
|
||||
# `try_files $uri $uri/ /index.php$request_uri`
|
||||
# always provides the desired behaviour.
|
||||
index index.php index.html /index.php$request_uri;
|
||||
|
||||
# Rule borrowed from `.htaccess` to handle Microsoft DAV clients
|
||||
location = / {
|
||||
if ( $http_user_agent ~ ^DavClnt ) {
|
||||
return 302 /remote.php/webdav/$is_args$args;
|
||||
}
|
||||
}
|
||||
|
||||
location = /robots.txt {
|
||||
allow all;
|
||||
log_not_found off;
|
||||
access_log off;
|
||||
}
|
||||
|
||||
# Make a regex exception for `/.well-known` so that clients can still
|
||||
# access it despite the existence of the regex rule
|
||||
# `location ~ /(\.|autotest|...)` which would otherwise handle requests
|
||||
# for `/.well-known`.
|
||||
location ^~ /.well-known {
|
||||
# The rules in this block are an adaptation of the rules
|
||||
# in `.htaccess` that concern `/.well-known`.
|
||||
|
||||
location = /.well-known/carddav { return 301 /remote.php/dav/; }
|
||||
location = /.well-known/caldav { return 301 /remote.php/dav/; }
|
||||
|
||||
location /.well-known/acme-challenge { try_files $uri $uri/ =404; }
|
||||
location /.well-known/pki-validation { try_files $uri $uri/ =404; }
|
||||
|
||||
# Let Nextcloud's API for `/.well-known` URIs handle all other
|
||||
# requests by passing them to the front-end controller.
|
||||
return 301 /index.php$request_uri;
|
||||
}
|
||||
|
||||
# Rules borrowed from `.htaccess` to hide certain paths from clients
|
||||
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; }
|
||||
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; }
|
||||
|
||||
# Ensure this block, which passes PHP files to the PHP process, is above the blocks
|
||||
# which handle static assets (as seen below). If this block is not declared first,
|
||||
# then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
|
||||
# to the URI, resulting in a HTTP 500 error response.
|
||||
location ~ \.php(?:$|/) {
|
||||
# Required for legacy support
|
||||
rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
|
||||
|
||||
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
|
||||
set $path_info $fastcgi_path_info;
|
||||
|
||||
try_files $fastcgi_script_name =404;
|
||||
|
||||
include fastcgi_params;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
fastcgi_param PATH_INFO $path_info;
|
||||
#fastcgi_param HTTPS on;
|
||||
|
||||
fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice
|
||||
fastcgi_param front_controller_active true; # Enable pretty urls
|
||||
fastcgi_pass php-handler;
|
||||
|
||||
fastcgi_intercept_errors on;
|
||||
fastcgi_request_buffering off;
|
||||
proxy_send_timeout 3600s;
|
||||
proxy_read_timeout 3600s;
|
||||
fastcgi_send_timeout 3600s;
|
||||
fastcgi_read_timeout 3600s;
|
||||
}
|
||||
|
||||
location ~ \.(?:css|js|svg|gif)$ {
|
||||
try_files $uri /index.php$request_uri;
|
||||
expires 6M; # Cache-Control policy borrowed from `.htaccess`
|
||||
access_log off; # Optional: Don't log access to assets
|
||||
}
|
||||
|
||||
location ~ \.woff2?$ {
|
||||
try_files $uri /index.php$request_uri;
|
||||
expires 7d; # Cache-Control policy borrowed from `.htaccess`
|
||||
access_log off; # Optional: Don't log access to assets
|
||||
}
|
||||
|
||||
# Rule borrowed from `.htaccess`
|
||||
location /remote {
|
||||
return 301 /remote.php$request_uri;
|
||||
}
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ /index.php$request_uri;
|
||||
}
|
||||
}
|
||||
}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
{{- define "nextcloud.cronjobs" -}}
|
||||
{{- range $cj := .Values.cronjobs }}
|
||||
{{- $name := $cj.name | required "Nextcloud - Expected non-empty name in cronjob" -}}
|
||||
{{- $schedule := $cj.schedule | required "Nextcloud - Expected non-empty schedule in cronjob" }}
|
||||
|
||||
{{ $name }}:
|
||||
enabled: {{ $cj.enabled | quote }}
|
||||
type: CronJob
|
||||
schedule: {{ $schedule | quote }}
|
||||
podSpec:
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
{{ $name }}:
|
||||
enabled: true
|
||||
primary: true
|
||||
imageSelector: image
|
||||
command:
|
||||
- /bin/bash
|
||||
- -c
|
||||
- |
|
||||
{{- range $cj.cmd }}
|
||||
{{- . | nindent 12 }}
|
||||
{{- else -}}
|
||||
{{- fail "Nextcloud - Expected non-empty cmd in cronjob" -}}
|
||||
{{- end }}
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
startup:
|
||||
enabled: false
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
{{- define "nextcloud.ingressInjector" -}}
|
||||
{{- if .Values.ingress.main.enabled -}}
|
||||
{{- $injectPaths := list -}}
|
||||
{{- if .Values.nextcloud.collabora.enabled -}}
|
||||
{{- $injectPaths = mustAppend $injectPaths (include "nextcloud.collabora.ingress" $ | fromYaml) -}}
|
||||
{{- end -}}
|
||||
{{/* Append more paths here if needed */}}
|
||||
|
||||
{{- range $host := .Values.ingress.main.hosts -}}
|
||||
{{- $paths := $host.paths -}}
|
||||
{{- $paths = concat $paths $injectPaths -}}
|
||||
{{- $_ := set $host "paths" $paths -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "nextcloud.collabora.ingress" -}}
|
||||
{{- $fullname := include "tc.v1.common.lib.chart.names.fullname" . }}
|
||||
path: /collabora/
|
||||
pathType: Prefix
|
||||
overrideService:
|
||||
name: {{ printf "%v-collabora" $fullname }}
|
||||
port: {{ .Values.service.collabora.ports.collabora.port }}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
{{- define "nextcloud.init.perms" -}}
|
||||
{{- $uid := .Values.securityContext.container.runAsUser -}}
|
||||
{{- $gid := .Values.securityContext.container.runAsGroup -}}
|
||||
{{- $path := .Values.persistence.data.targetSelector.main.main.mountPath }}
|
||||
enabled: true
|
||||
type: install
|
||||
imageSelector: alpineImage
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
capabilities:
|
||||
disableS6Caps: true
|
||||
add:
|
||||
- DAC_OVERRIDE
|
||||
- FOWNER
|
||||
- CHOWN
|
||||
command: /bin/sh
|
||||
args:
|
||||
- -c
|
||||
- |
|
||||
echo "Setting permissions to 700 on data directory [{{ $path }}] ..."
|
||||
chmod 770 {{ $path }} | echo "Failed to set permissions on data directory [{{ $path }}]"
|
||||
|
||||
echo "Setting ownership to {{ $uid }}:{{ $gid }} on data directory [{{ $path }}] ..."
|
||||
chown {{ $uid }}:{{ $gid }} {{ $path }} | echo "Failed to set ownership on data directory [{{ $path }}]"
|
||||
|
||||
echo "Finished."
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
{{- define "nextcloud.validation" -}}
|
||||
|
||||
{{- if not (mustRegexMatch "^[0-9]+(M|G){1}$" .Values.nextcloud.php.memory_limit) -}}
|
||||
{{- fail (printf "Nextcloud - Expected Memory Limit to be in format [1M, 1G] but got [%v]" .Values.nextcloud.php.memory_limit) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not (mustRegexMatch "^[0-9]+(M|G){1}$" .Values.nextcloud.php.upload_limit) -}}
|
||||
{{- fail (printf "Nextcloud - Expected Memory Limit to be in format [1M, 1G] but got [%v]" .Values.nextcloud.php.upload_limit) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not (deepEqual .Values.nextcloud.previews.providers (uniq .Values.nextcloud.previews.providers)) -}}
|
||||
{{- fail (printf "Nextcloud - Expected preview providers to be unique but got [%v]" .Values.nextcloud.previews.providers) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if and .Values.nextcloud.collabora.enabled .Values.nextcloud.onlyoffice.enabled -}}
|
||||
{{- fail "Nextcloud - Expected only one of [Collabora, OnlyOffice] to be enabled" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if contains "$" .Values.nextcloud.collabora.password -}}
|
||||
{{- fail "Nextcloud - Collabora [Password] cannot contain [$]" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.nextcloud.collabora.enabled -}}
|
||||
{{- if lt (len .Values.nextcloud.collabora.password) 8 -}}
|
||||
{{- fail "Nextcloud - Collabora [Password] must be at least 8 characters" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $collaboraUIModes := (list "default" "compact" "tabbed") -}}
|
||||
{{- if not (mustHas .Values.nextcloud.collabora.interface_mode $collaboraUIModes) -}}
|
||||
{{- fail (printf "Nextcloud - Expected [Interface Mode] in Collabora to be one of [%v], but got [%v]" (join "," $collaboraUIModes) .Values.nextcloud.collabora.interface_mode) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not .Values.nextcloud.collabora.dictionaries -}}
|
||||
{{- fail "Nextcloud - Expected non-empty Collabora [Dictionaries]" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not (deepEqual .Values.nextcloud.collabora.dictionaries (uniq .Values.nextcloud.collabora.dictionaries)) -}}
|
||||
{{- fail "Nextcloud - Collabora [Dictionaries] must be unique" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
{{- define "nextcloud.wait.nextcloud" -}}
|
||||
{{- $fullname := (include "tc.v1.common.lib.chart.names.fullname" $) -}}
|
||||
{{- $ncURL := printf "%v-nextcloud:%v" $fullname .Values.service.nextcloud.ports.nextcloud.targetPort }}
|
||||
enabled: true
|
||||
type: init
|
||||
imageSelector: image
|
||||
securityContext:
|
||||
command: /bin/sh
|
||||
args:
|
||||
- -c
|
||||
- |
|
||||
echo "Waiting Nextcloud [{{ $ncURL }}] to be ready and installed..."
|
||||
until \
|
||||
REQUEST_METHOD="GET" \
|
||||
SCRIPT_NAME="status.php" \
|
||||
SCRIPT_FILENAME="status.php" \
|
||||
cgi-fcgi -bind -connect "{{ $ncURL }}" | grep -q '"installed":true';
|
||||
do
|
||||
echo "Waiting Nextcloud [{{ $ncURL }}] to be ready and installed..."
|
||||
sleep 3
|
||||
done
|
||||
|
||||
echo "Nextcloud is ready and installed..."
|
||||
echo "Starting Nginx..."
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,80 @@
|
|||
{{/* Make sure all variables are set properly */}}
|
||||
{{- include "tc.v1.common.loader.init" . -}}
|
||||
|
||||
{{- include "nextcloud.validation" $ -}}
|
||||
|
||||
{{/* Render configmaps for all pods */}}
|
||||
{{- $configmaps := include "nextcloud.configmaps" . | fromYaml -}}
|
||||
{{- if $configmaps -}}
|
||||
{{- $_ := mustMergeOverwrite .Values.configmap $configmaps -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Create hostAliases (resolve ingress host to Node/LB IP) */}}
|
||||
{{- $hostAlias := (list (dict
|
||||
"ip" .Values.nextcloud.general.accessIP
|
||||
"hostnames" (
|
||||
list (include "nextcloud.accesshost" $)
|
||||
)
|
||||
)) -}}
|
||||
|
||||
{{/* Add [hostAliases] to nextcloud and collabora pod */}}
|
||||
{{- $_ := set .Values.workload.main.podSpec "hostAliases" $hostAlias -}}
|
||||
{{- $_ := set .Values.workload.collabora.podSpec "hostAliases" $hostAlias -}}
|
||||
|
||||
{{/* Add [init perms] container to nextcloud */}}
|
||||
{{- if not (get .Values.workload.main.podSpec "initContainers") -}}
|
||||
{{- $_ := set .Values.workload.main.podSpec "initContainers" dict -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $initPerms := (include "nextcloud.init.perms" . | fromYaml) -}}
|
||||
{{- $_ := set .Values.workload.main.podSpec.initContainers "init-perms" $initPerms -}}
|
||||
|
||||
{{/* Add [wait nextcloud] container to nginx */}}
|
||||
{{- if not (get .Values.workload.nginx.podSpec "initContainers") -}}
|
||||
{{- $_ := set .Values.workload.nginx.podSpec "initContainers" dict -}}
|
||||
{{- end -}}
|
||||
{{- $waitNextcloud := (include "nextcloud.wait.nextcloud" . | fromYaml) -}}
|
||||
{{- $_ := set .Values.workload.nginx.podSpec.initContainers "wait-nextcloud" $waitNextcloud -}}
|
||||
|
||||
{{/* Disable [notify push] if requested */}}
|
||||
{{- if not .Values.nextcloud.notify_push.enabled -}}
|
||||
{{- $_ := set .Values.workload.notify "enabled" false -}}
|
||||
{{- $_ := set .Values.service.notify "enabled" false -}}
|
||||
{{- else -}}
|
||||
{{/* Add [wait nextcloud] container to notify push */}}
|
||||
{{- if not (get .Values.workload.notify.podSpec "initContainers") -}}
|
||||
{{- $_ := set .Values.workload.notify.podSpec "initContainers" dict -}}
|
||||
{{- end -}}
|
||||
{{- $waitNextcloud := (include "nextcloud.wait.nextcloud" . | fromYaml) -}}
|
||||
{{- $_ := set .Values.workload.notify.podSpec.initContainers "wait-nextcloud" $waitNextcloud -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Disable [clamav] if requested */}}
|
||||
{{- if not .Values.nextcloud.clamav.enabled -}}
|
||||
{{- $_ := set .Values.workload.clamav "enabled" false -}}
|
||||
{{- $_ := set .Values.service.clamav "enabled" false -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Disable [previews] if requested */}}
|
||||
{{- if or (not .Values.nextcloud.previews.imaginary) (not .Values.nextcloud.previews.enabled) -}}
|
||||
{{- $_ := set .Values.workload.imaginary "enabled" false -}}
|
||||
{{- $_ := set .Values.service.imaginary "enabled" false -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Disable [collabora] if requested */}}
|
||||
{{- if not .Values.nextcloud.collabora.enabled -}}
|
||||
{{- $_ := set .Values.workload.collabora "enabled" false -}}
|
||||
{{- $_ := set .Values.service.collabora "enabled" false -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Create [cronjobs] defined */}}
|
||||
{{- $cronjobs := include "nextcloud.cronjobs" . | fromYaml -}}
|
||||
{{- if $cronjobs -}}
|
||||
{{- $_ := mustMergeOverwrite .Values.workload $cronjobs -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* TODO: Do we have to cleanup when something (eg Collabora) is disabled? */}}
|
||||
{{- include "nextcloud.ingressInjector" $ -}}
|
||||
|
||||
{{/* Render the templates */}}
|
||||
{{- include "tc.v1.common.loader.apply" . -}}
|
||||
Loading…
Reference in New Issue