prune
This commit is contained in:
kjeld Schouten-Lebbing
parent
d5fe7f2a19
commit
d4bcc14f2a
|
|
@ -1,12 +0,0 @@
|
||||||
dependencies:
|
|
||||||
- name: common
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 6.10.6
|
|
||||||
- name: postgresql
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 1.2.3
|
|
||||||
- name: redis
|
|
||||||
repository: https://charts.bitnami.com/bitnami
|
|
||||||
version: 14.8.11
|
|
||||||
digest: sha256:0e70ad08e8bd5ef4d2d42581e20e3b18ed42c61f59fb1b27888c5d985a89d0df
|
|
||||||
generated: "2021-08-28T12:11:55.620064426Z"
|
|
||||||
|
|
@ -1,41 +0,0 @@
|
||||||
apiVersion: v2
|
|
||||||
appVersion: auto
|
|
||||||
dependencies:
|
|
||||||
- name: common
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 6.10.6
|
|
||||||
- condition: postgresql.enabled
|
|
||||||
name: postgresql
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 1.2.3
|
|
||||||
- condition: redis.enabled
|
|
||||||
name: redis
|
|
||||||
repository: https://charts.bitnami.com/bitnami
|
|
||||||
version: 14.8.11
|
|
||||||
deprecated: false
|
|
||||||
description: Authelia is a Single Sign-On Multi-Factor portal for web apps
|
|
||||||
home: https://github.com/truecharts/apps/tree/master/charts/stable/authelia
|
|
||||||
icon: https://avatars2.githubusercontent.com/u/59122411?s=200&v=4
|
|
||||||
keywords:
|
|
||||||
- authelia
|
|
||||||
- authentication
|
|
||||||
- login
|
|
||||||
- SSO
|
|
||||||
- Authentication
|
|
||||||
- Security
|
|
||||||
- Two-Factor
|
|
||||||
- U2F
|
|
||||||
- YubiKey
|
|
||||||
- Push Notifications
|
|
||||||
- LDAP
|
|
||||||
kubeVersion: '>=1.16.0-0'
|
|
||||||
maintainers:
|
|
||||||
- email: info@truecharts.org
|
|
||||||
name: TrueCharts
|
|
||||||
url: truecharts.org
|
|
||||||
name: authelia
|
|
||||||
sources:
|
|
||||||
- https://github.com/authelia/chartrepo
|
|
||||||
- https://github.com/authelia/authelia
|
|
||||||
type: application
|
|
||||||
version: 0.0.1
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
Authelia is a Single Sign-On Multi-Factor portal for web apps
|
|
||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -1,231 +0,0 @@
|
||||||
##
|
|
||||||
# This file contains Values.yaml content that gets added to the output of questions.yaml
|
|
||||||
# It's ONLY meant for content that the user is NOT expected to change.
|
|
||||||
# Example: Everything under "image" is not included in questions.yaml but is included here.
|
|
||||||
##
|
|
||||||
|
|
||||||
image:
|
|
||||||
repository: ghcr.io/authelia/authelia
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
tag: "4.30.4"
|
|
||||||
|
|
||||||
# Enabled postgres
|
|
||||||
postgresql:
|
|
||||||
enabled: true
|
|
||||||
postgresqlUsername: authelia
|
|
||||||
postgresqlDatabase: authelia
|
|
||||||
existingSecret: "{{ .Release.Name }}-dbcreds"
|
|
||||||
persistence:
|
|
||||||
db:
|
|
||||||
storageClass: "SCALE-ZFS"
|
|
||||||
dbbackups:
|
|
||||||
storageClass: "SCALE-ZFS"
|
|
||||||
|
|
||||||
# Enabled redis
|
|
||||||
# ... for more options see https://github.com/bitnami/charts/tree/master/bitnami/redis
|
|
||||||
redis:
|
|
||||||
volumePermissions:
|
|
||||||
enabled: true
|
|
||||||
architecture: standalone
|
|
||||||
enabled: true
|
|
||||||
auth:
|
|
||||||
existingSecret: rediscreds
|
|
||||||
existingSecretPasswordKey: redis-password
|
|
||||||
master:
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
existingClaim: redismaster
|
|
||||||
replica:
|
|
||||||
replicaCount: 0
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: '{{ include "common.names.fullname" . }}-paths'
|
|
||||||
|
|
||||||
probes:
|
|
||||||
liveness:
|
|
||||||
type: HTTP
|
|
||||||
path: /api/health"
|
|
||||||
|
|
||||||
readiness:
|
|
||||||
type: HTTP
|
|
||||||
path: "/api/health"
|
|
||||||
|
|
||||||
startup:
|
|
||||||
type: HTTP
|
|
||||||
path: "/api/health"
|
|
||||||
|
|
||||||
##
|
|
||||||
## Storage Provider Configuration
|
|
||||||
##
|
|
||||||
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
|
|
||||||
storage:
|
|
||||||
##
|
|
||||||
## PostgreSQL (Storage Provider)
|
|
||||||
##
|
|
||||||
postgres:
|
|
||||||
port: 5432
|
|
||||||
database: authelia
|
|
||||||
username: authelia
|
|
||||||
sslmode: disable
|
|
||||||
timeout: 5s
|
|
||||||
|
|
||||||
##
|
|
||||||
## Server Configuration
|
|
||||||
##
|
|
||||||
server:
|
|
||||||
##
|
|
||||||
## Port sets the configured port for the daemon, service, and the probes.
|
|
||||||
## Default is 9091 and should not need to be changed.
|
|
||||||
##
|
|
||||||
port: 9091
|
|
||||||
|
|
||||||
## Buffers usually should be configured to be the same value.
|
|
||||||
## Explanation at https://www.authelia.com/docs/configuration/server.html
|
|
||||||
## Read buffer size adjusts the server's max incoming request size in bytes.
|
|
||||||
## Write buffer size does the same for outgoing responses.
|
|
||||||
read_buffer_size: 4096
|
|
||||||
write_buffer_size: 4096
|
|
||||||
## Set the single level path Authelia listens on.
|
|
||||||
## Must be alphanumeric chars and should not contain any slashes.
|
|
||||||
path: ""
|
|
||||||
|
|
||||||
##
|
|
||||||
## Redis Provider
|
|
||||||
##
|
|
||||||
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
|
||||||
##
|
|
||||||
## The redis connection details
|
|
||||||
redisProvider:
|
|
||||||
port: 6379
|
|
||||||
|
|
||||||
## Optional username to be used with authentication.
|
|
||||||
# username: authelia
|
|
||||||
username: ""
|
|
||||||
|
|
||||||
## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
|
|
||||||
database_index: 0
|
|
||||||
|
|
||||||
## The maximum number of concurrent active connections to Redis.
|
|
||||||
maximum_active_connections: 8
|
|
||||||
|
|
||||||
## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
|
|
||||||
minimum_idle_connections: 0
|
|
||||||
|
|
||||||
## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
|
|
||||||
tls:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
|
|
||||||
server_name: ""
|
|
||||||
|
|
||||||
## Skip verifying the server certificate (to allow a self-signed certificate).
|
|
||||||
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
|
||||||
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
|
||||||
skip_verify: false
|
|
||||||
|
|
||||||
## Minimum TLS version for the connection.
|
|
||||||
minimum_version: TLS1.2
|
|
||||||
|
|
||||||
## The Redis HA configuration options.
|
|
||||||
## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
|
|
||||||
high_availability:
|
|
||||||
enabled: false
|
|
||||||
enabledSecret: false
|
|
||||||
## Sentinel Name / Master Name
|
|
||||||
sentinel_name: mysentinel
|
|
||||||
|
|
||||||
## The additional nodes to pre-seed the redis provider with (for sentinel).
|
|
||||||
## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
|
|
||||||
## For high availability to be used you must have either defined; the host above or at least one node below.
|
|
||||||
nodes: []
|
|
||||||
# nodes:
|
|
||||||
# - host: sentinel-0.databases.svc.cluster.local
|
|
||||||
# port: 26379
|
|
||||||
# - host: sentinel-1.databases.svc.cluster.local
|
|
||||||
# port: 26379
|
|
||||||
|
|
||||||
## Choose the host with the lowest latency.
|
|
||||||
route_by_latency: false
|
|
||||||
|
|
||||||
## Choose the host randomly.
|
|
||||||
route_randomly: false
|
|
||||||
|
|
||||||
identity_providers:
|
|
||||||
oidc:
|
|
||||||
## Enables this in the config map. Currently in beta stage.
|
|
||||||
## See https://www.authelia.com/docs/configuration/identity-providers/oidc.html#roadmap
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
access_token_lifespan: 1h
|
|
||||||
authorize_code_lifespan: 1m
|
|
||||||
id_token_lifespan: 1h
|
|
||||||
refresh_token_lifespan: 90m
|
|
||||||
|
|
||||||
enable_client_debug_messages: false
|
|
||||||
|
|
||||||
## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for
|
|
||||||
## security reasons.
|
|
||||||
minimum_parameter_entropy: 8
|
|
||||||
|
|
||||||
clients: []
|
|
||||||
# clients:
|
|
||||||
# -
|
|
||||||
## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
|
|
||||||
# id: myapp
|
|
||||||
|
|
||||||
## The description to show to users when they end up on the consent screen. Defaults to the ID above.
|
|
||||||
# description: My Application
|
|
||||||
|
|
||||||
## The client secret is a shared secret between Authelia and the consumer of this client.
|
|
||||||
# secret: apple123
|
|
||||||
|
|
||||||
## Sets the client to public. This should typically not be set, please see the documentation for usage.
|
|
||||||
# public: false
|
|
||||||
|
|
||||||
## The policy to require for this client; one_factor or two_factor.
|
|
||||||
# authorization_policy: two_factor
|
|
||||||
|
|
||||||
## Audience this client is allowed to request.
|
|
||||||
# audience: []
|
|
||||||
|
|
||||||
## Scopes this client is allowed to request.
|
|
||||||
# scopes:
|
|
||||||
# - openid
|
|
||||||
# - profile
|
|
||||||
# - email
|
|
||||||
# - groups
|
|
||||||
|
|
||||||
## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
|
|
||||||
# redirect_uris:
|
|
||||||
# - https://oidc.example.com/oauth2/callback
|
|
||||||
|
|
||||||
## Grant Types configures which grants this client can obtain.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# grant_types:
|
|
||||||
# - refresh_token
|
|
||||||
# - authorization_code
|
|
||||||
|
|
||||||
## Response Types configures which responses this client can be sent.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# response_types:
|
|
||||||
# - code
|
|
||||||
|
|
||||||
## Response Modes configures which response modes this client supports.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# response_modes:
|
|
||||||
# - form_post
|
|
||||||
# - query
|
|
||||||
# - fragment
|
|
||||||
|
|
||||||
## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
|
|
||||||
# userinfo_signing_algorithm: none
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
##
|
|
||||||
# Most other defaults are set in questions.yaml
|
|
||||||
# For other options please refer to the wiki, default_values.yaml or the common library chart
|
|
||||||
##
|
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -1,245 +0,0 @@
|
||||||
{{/* Define the configmap */}}
|
|
||||||
{{- define "authelia.configmap" -}}
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: {{ include "common.names.fullname" . }}-paths
|
|
||||||
data:
|
|
||||||
AUTHELIA_SERVER_DISABLE_HEALTHCHECK: "true"
|
|
||||||
AUTHELIA_JWT_SECRET_FILE: "/secrets/JWT_TOKEN"
|
|
||||||
AUTHELIA_SESSION_SECRET_FILE: "/secrets/SESSION_ENCRYPTION_KEY"
|
|
||||||
AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE: "/secrets/STORAGE_PASSWORD"
|
|
||||||
{{- if .Values.authentication_backend.ldap.enabled }}
|
|
||||||
AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE: "/secrets/LDAP_PASSWORD"
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.notifier.smtp.enabled }}
|
|
||||||
AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE: "/secrets/SMTP_PASSWORD"
|
|
||||||
{{- end }}
|
|
||||||
AUTHELIA_SESSION_REDIS_PASSWORD_FILE: "/secrets/REDIS_PASSWORD"
|
|
||||||
{{- if and .Values.redisProvider.high_availability.enabled}}
|
|
||||||
AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE: "/secrets/REDIS_SENTINEL_PASSWORD"
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.duo_api.enabled }}
|
|
||||||
AUTHELIA_DUO_API_SECRET_KEY_FILE: "/secrets/DUO_API_KEY"
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.identity_providers.oidc.enabled }}
|
|
||||||
AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE: "/secrets/OIDC_HMAC_SECRET"
|
|
||||||
AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE: "/secrets/OIDC_PRIVATE_KEY"
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: {{ include "common.names.fullname" . }}-configfile
|
|
||||||
data:
|
|
||||||
configuration.yaml: |
|
|
||||||
---
|
|
||||||
theme: {{ default "light" .Values.theme }}
|
|
||||||
default_redirection_url: {{ default (printf "https://www.%s" .Values.domain) .Values.default_redirection_url }}
|
|
||||||
server:
|
|
||||||
host: 0.0.0.0
|
|
||||||
port: {{ default 9091 .Values.server.port }}
|
|
||||||
{{- if not (eq "" (default "" .Values.server.path)) }}
|
|
||||||
path: {{ .Values.server.path }}
|
|
||||||
{{- end }}
|
|
||||||
read_buffer_size: {{ default 4096 .Values.server.read_buffer_size }}
|
|
||||||
write_buffer_size: {{ default 4096 .Values.server.write_buffer_size }}
|
|
||||||
enable_pprof: {{ default false .Values.server.enable_pprof }}
|
|
||||||
enable_expvars: {{ default false .Values.server.enable_expvars }}
|
|
||||||
log:
|
|
||||||
level: {{ default "info" .Values.log.level }}
|
|
||||||
format: {{ default "text" .Values.log.format }}
|
|
||||||
{{- if not (eq "" (default "" .Values.log.file_path)) }}
|
|
||||||
file_path: {{ .Values.log.file_path }}
|
|
||||||
keep_stdout: true
|
|
||||||
{{- end }}
|
|
||||||
totp:
|
|
||||||
issuer: {{ default .Values.domain .Values.totp.issuer }}
|
|
||||||
period: {{ default 30 .Values.totp.period }}
|
|
||||||
skew: {{ default 1 .Values.totp.skew }}
|
|
||||||
{{- if .Values.duo_api.enabled }}
|
|
||||||
duo_api:
|
|
||||||
hostname: {{ .Values.duo_api.hostname }}
|
|
||||||
integration_key: {{ .Values.duo_api.integration_key }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with $auth := .Values.authentication_backend }}
|
|
||||||
authentication_backend:
|
|
||||||
disable_reset_password: {{ $auth.disable_reset_password }}
|
|
||||||
{{- if $auth.file.enabled }}
|
|
||||||
file:
|
|
||||||
path: {{ $auth.file.path }}
|
|
||||||
password: {{ toYaml $auth.file.password | nindent 10 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.enabled }}
|
|
||||||
ldap:
|
|
||||||
implementation: {{ default "custom" $auth.ldap.implementation }}
|
|
||||||
url: {{ $auth.ldap.url }}
|
|
||||||
timeout: {{ default "5s" $auth.ldap.timeout }}
|
|
||||||
start_tls: {{ $auth.ldap.start_tls }}
|
|
||||||
tls:
|
|
||||||
{{- if hasKey $auth.ldap.tls "server_name" }}
|
|
||||||
server_name: {{ default $auth.ldap.host $auth.ldap.tls.server_name }}
|
|
||||||
{{- end }}
|
|
||||||
minimum_version: {{ default "TLS1.2" $auth.ldap.tls.minimum_version }}
|
|
||||||
skip_verify: {{ default false $auth.ldap.tls.skip_verify }}
|
|
||||||
{{- if $auth.ldap.base_dn }}
|
|
||||||
base_dn: {{ $auth.ldap.base_dn }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.username_attribute }}
|
|
||||||
username_attribute: {{ $auth.ldap.username_attribute }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.additional_users_dn }}
|
|
||||||
additional_users_dn: {{ $auth.ldap.additional_users_dn }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.users_filter }}
|
|
||||||
users_filter: {{ $auth.ldap.users_filter }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.additional_groups_dn }}
|
|
||||||
additional_groups_dn: {{ $auth.ldap.additional_groups_dn }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.groups_filter }}
|
|
||||||
groups_filter: {{ $auth.ldap.groups_filter }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.group_name_attribute }}
|
|
||||||
group_name_attribute: {{ $auth.ldap.group_name_attribute }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.mail_attribute }}
|
|
||||||
mail_attribute: {{ $auth.ldap.mail_attribute }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.display_name_attribute }}
|
|
||||||
display_name_attribute: {{ $auth.ldap.display_name_attribute }}
|
|
||||||
{{- end }}
|
|
||||||
user: {{ $auth.ldap.user }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with $session := .Values.session }}
|
|
||||||
session:
|
|
||||||
name: {{ default "authelia_session" $session.name }}
|
|
||||||
domain: {{ required "A valid .Values.domain entry required!" $.Values.domain }}
|
|
||||||
same_site: {{ default "lax" $session.same_site }}
|
|
||||||
expiration: {{ default "1M" $session.expiration }}
|
|
||||||
inactivity: {{ default "5m" $session.inactivity }}
|
|
||||||
remember_me_duration: {{ default "1M" $session.remember_me_duration }}
|
|
||||||
{{- end }}
|
|
||||||
redis:
|
|
||||||
host: {{ ( printf "%v-%v" .Release.Name "redis-master" ) }}
|
|
||||||
{{- with $redis := .Values.redisProvider }}
|
|
||||||
port: {{ default 6379 $redis.port }}
|
|
||||||
{{- if not (eq $redis.username "") }}
|
|
||||||
username: {{ $redis.username }}
|
|
||||||
{{- end }}
|
|
||||||
maximum_active_connections: {{ default 8 $redis.maximum_active_connections }}
|
|
||||||
minimum_idle_connections: {{ default 0 $redis.minimum_idle_connections }}
|
|
||||||
{{- if $redis.tls.enabled }}
|
|
||||||
tls:
|
|
||||||
server_name: {{ $redis.tls.server_name }}
|
|
||||||
minimum_version: {{ default "TLS1.2" $redis.tls.minimum_version }}
|
|
||||||
skip_verify: {{ $redis.tls.skip_verify }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $redis.high_availability.enabled }}
|
|
||||||
high_availability:
|
|
||||||
sentinel_name: {{ $redis.high_availability.sentinel_name }}
|
|
||||||
{{- if $redis.high_availability.nodes }}
|
|
||||||
nodes: {{ toYaml $redis.high_availability.nodes | nindent 10 }}
|
|
||||||
{{- end }}
|
|
||||||
route_by_latency: {{ $redis.high_availability.route_by_latency }}
|
|
||||||
route_randomly: {{ $redis.high_availability.route_randomly }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
regulation: {{ toYaml .Values.regulation | nindent 6 }}
|
|
||||||
storage:
|
|
||||||
postgres:
|
|
||||||
host: {{ printf "%v-%v" .Release.Name "postgresql" }}
|
|
||||||
{{- with $storage := .Values.storage }}
|
|
||||||
port: {{ default 5432 $storage.postgres.port }}
|
|
||||||
database: {{ default "authelia" $storage.postgres.database }}
|
|
||||||
username: {{ default "authelia" $storage.postgres.username }}
|
|
||||||
timeout: {{ default "5s" $storage.postgres.timeout }}
|
|
||||||
sslmode: {{ default "disable" $storage.postgres.sslmode }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with $notifier := .Values.notifier }}
|
|
||||||
notifier:
|
|
||||||
disable_startup_check: {{ $.Values.notifier.disable_startup_check }}
|
|
||||||
{{- if $notifier.filesystem.enabled }}
|
|
||||||
filesystem:
|
|
||||||
filename: {{ $notifier.filesystem.filename }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $notifier.smtp.enabled }}
|
|
||||||
smtp:
|
|
||||||
host: {{ $notifier.smtp.host }}
|
|
||||||
port: {{ default 25 $notifier.smtp.port }}
|
|
||||||
timeout: {{ default "5s" $notifier.smtp.timeout }}
|
|
||||||
username: {{ $notifier.smtp.username }}
|
|
||||||
sender: {{ $notifier.smtp.sender }}
|
|
||||||
identifier: {{ $notifier.smtp.identifier }}
|
|
||||||
subject: {{ $notifier.smtp.subject | quote }}
|
|
||||||
startup_check_address: {{ $notifier.smtp.startup_check_address }}
|
|
||||||
disable_require_tls: {{ $notifier.smtp.disable_require_tls }}
|
|
||||||
disable_html_emails: {{ $notifier.smtp.disable_html_emails }}
|
|
||||||
tls:
|
|
||||||
server_name: {{ default $notifier.smtp.host $notifier.smtp.tls.server_name }}
|
|
||||||
minimum_version: {{ default "TLS1.2" $notifier.smtp.tls.minimum_version }}
|
|
||||||
skip_verify: {{ default false $notifier.smtp.tls.skip_verify }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.identity_providers.oidc.enabled }}
|
|
||||||
identity_providers:
|
|
||||||
oidc:
|
|
||||||
access_token_lifespan: {{ default "1h" .Values.identity_providers.oidc.access_token_lifespan }}
|
|
||||||
authorize_code_lifespan: {{ default "1m" .Values.identity_providers.oidc.authorize_code_lifespan }}
|
|
||||||
id_token_lifespan: {{ default "1h" .Values.identity_providers.oidc.id_token_lifespan }}
|
|
||||||
refresh_token_lifespan: {{ default "90m" .Values.identity_providers.oidc.refresh_token_lifespan }}
|
|
||||||
enable_client_debug_messages: {{ default false .Values.identity_providers.oidc.enable_client_debug_messages }}
|
|
||||||
minimum_parameter_entropy: {{ default 8 .Values.identity_providers.oidc.minimum_parameter_entropy }}
|
|
||||||
{{- if gt (len .Values.identity_providers.oidc.clients) 0 }}
|
|
||||||
clients:
|
|
||||||
{{- range $client := .Values.identity_providers.oidc.clients }}
|
|
||||||
- id: {{ $client.id }}
|
|
||||||
description: {{ default $client.id $client.description }}
|
|
||||||
secret: {{ default (randAlphaNum 128) $client.secret }}
|
|
||||||
{{- if hasKey $client "public" }}
|
|
||||||
public: {{ $client.public }}
|
|
||||||
{{- end }}
|
|
||||||
authorization_policy: {{ default "two_factor" $client.authorization_policy }}
|
|
||||||
redirect_uris: {{ toYaml $client.redirect_uris | nindent 10 }}
|
|
||||||
{{- if hasKey $client "audience" }}
|
|
||||||
audience: {{ toYaml $client.audience | nindent 10 }}
|
|
||||||
{{- end }}
|
|
||||||
scopes: {{ toYaml (default (list "openid" "profile" "email" "groups") $client.scopes) | nindent 10 }}
|
|
||||||
grant_types: {{ toYaml (default (list "refresh_token" "authorization_code") $client.grant_types) | nindent 10 }}
|
|
||||||
response_types: {{ toYaml (default (list "code") $client.response_types) | nindent 10 }}
|
|
||||||
{{- if hasKey $client "response_modes" }}
|
|
||||||
response_modes: {{ toYaml $client.response_modes | nindent 10 }}
|
|
||||||
{{- end }}
|
|
||||||
userinfo_signing_algorithm: {{ default "none" $client.userinfo_signing_algorithm }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
access_control:
|
|
||||||
{{- if (eq (len .Values.access_control.rules) 0) }}
|
|
||||||
{{- if (eq .Values.access_control.default_policy "bypass") }}
|
|
||||||
default_policy: one_factor
|
|
||||||
{{- else if (eq .Values.access_control.default_policy "deny") }}
|
|
||||||
default_policy: two_factor
|
|
||||||
{{- else }}
|
|
||||||
default_policy: {{ .Values.access_control.default_policy }}
|
|
||||||
{{- end }}
|
|
||||||
{{- else }}
|
|
||||||
default_policy: {{ .Values.access_control.default_policy }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if (eq (len .Values.access_control.networks) 0) }}
|
|
||||||
networks: []
|
|
||||||
{{- else }}
|
|
||||||
networks: {{ toYaml .Values.access_control.networks | nindent 6 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if (eq (len .Values.access_control.rules) 0) }}
|
|
||||||
rules: []
|
|
||||||
{{- else }}
|
|
||||||
rules: {{ toYaml .Values.access_control.rules | nindent 6 }}
|
|
||||||
{{- end }}
|
|
||||||
...
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,112 +0,0 @@
|
||||||
{{/* Define the secrets */}}
|
|
||||||
{{- define "authelia.secrets" -}}
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
{{- include "common.labels" . | nindent 4 }}
|
|
||||||
name: {{ .Release.Name }}-dbcreds
|
|
||||||
{{- $dbprevious := lookup "v1" "Secret" .Release.Namespace ( ( printf "%v-%v" .Release.Name "dbcreds" ) | quote ) }}
|
|
||||||
{{- $dbPass := "" }}
|
|
||||||
data:
|
|
||||||
{{- if $dbprevious }}
|
|
||||||
postgresql-password: {{ ( index $dbprevious.data "postgresql-password" ) }}
|
|
||||||
postgresql-postgres-password: {{ ( index $dbprevious.data "postgresql-postgres-password" ) }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $dbPass = randAlphaNum 50 }}
|
|
||||||
postgresql-password: {{ $dbPass | b64enc | quote }}
|
|
||||||
postgresql-postgres-password: {{ randAlphaNum 50 | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
url: {{ ( printf "%v%v:%v@%v-%v:%v/%v" "postgresql://" .Values.postgresql.postgresqlUsername $dbPass .Release.Name "postgresql" "5432" .Values.postgresql.postgresqlDatabase ) | b64enc | quote }}
|
|
||||||
type: Opaque
|
|
||||||
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
{{- include "common.labels" . | nindent 4 }}
|
|
||||||
name: rediscreds
|
|
||||||
{{- $redisprevious := lookup "v1" "Secret" .Release.Namespace "rediscreds" }}
|
|
||||||
{{- $redisPass := "" }}
|
|
||||||
{{- $sentinelPass := "" }}
|
|
||||||
data:
|
|
||||||
{{- if $redisprevious }}
|
|
||||||
redis-password: {{ ( index $redisprevious.data "redis-password" ) }}
|
|
||||||
sentinel-password: {{ ( index $redisprevious.data "sentinel-password" ) }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $redisPass = randAlphaNum 50 }}
|
|
||||||
{{- $sentinelPass = randAlphaNum 50 }}
|
|
||||||
redis-password: {{ $redisPass | b64enc | quote }}
|
|
||||||
sentinel-password: {{ $sentinelPass | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
masterhost: {{ ( printf "%v-%v" .Release.Name "redis-master" ) | b64enc | quote }}
|
|
||||||
slavehost: {{ ( printf "%v-%v" .Release.Name "redis-master" ) | b64enc | quote }}
|
|
||||||
type: Opaque
|
|
||||||
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
type: Opaque
|
|
||||||
metadata:
|
|
||||||
name: {{ include "common.names.fullname" . }}-secrets
|
|
||||||
{{- $autheliaprevious := lookup "v1" "Secret" .Release.Namespace ( ( printf "%v-%v" ( ( include "common.names.fullname" . ) | quote ) "-secrets" ) | quote ) }}
|
|
||||||
{{- $oidckey := "" }}
|
|
||||||
{{- $oidcsecret := "" }}
|
|
||||||
{{- $jwtsecret := "" }}
|
|
||||||
{{- $sessionsecret := "" }}
|
|
||||||
data:
|
|
||||||
{{- if $autheliaprevious }}
|
|
||||||
SESSION_ENCRYPTION_KEY: {{ index $autheliaprevious.data "SESSION_ENCRYPTION_KEY" }}
|
|
||||||
JWT_TOKEN: {{ index $autheliaprevious.data "JWT_TOKEN" }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $jwtsecret := randAlphaNum 50 }}
|
|
||||||
{{- $sessionsecret := randAlphaNum 50 }}
|
|
||||||
SESSION_ENCRYPTION_KEY: {{ $jwtsecret | b64enc | quote }}
|
|
||||||
JWT_TOKEN: {{ $jwtsecret | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.authentication_backend.ldap.enabled }}
|
|
||||||
LDAP_PASSWORD: {{ .Values.authentication_backend.ldap.plain_password }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.notifier.smtp.enabled }}
|
|
||||||
SMTP_PASSWORD: {{ .Values.notifier.smtp.plain_password }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.duo_api.enabled }}
|
|
||||||
DUO_API_KEY: {{ .Values.duo_api.plain_api_key | b64enc }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $dbprevious }}
|
|
||||||
STORAGE_PASSWORD: {{ ( index $dbprevious.data "postgresql-password" ) }}
|
|
||||||
{{- else }}
|
|
||||||
STORAGE_PASSWORD: {{ $dbPass | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $redisprevious }}
|
|
||||||
REDIS_PASSWORD: {{ ( index $redisprevious.data "redis-password" ) }}
|
|
||||||
{{- if .Values.redisProvider.high_availability.enabled}}
|
|
||||||
REDIS_SENTINEL_PASSWORD: {{ ( index $redisprevious.data "sentinel-password" ) }}
|
|
||||||
{{- end }}
|
|
||||||
{{- else }}
|
|
||||||
REDIS_PASSWORD: {{ $redisPass | b64enc | quote }}
|
|
||||||
{{- if .Values.redisProvider.high_availability.enabled}}
|
|
||||||
REDIS_SENTINEL_PASSWORD: {{ $sentinelPass | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.identity_providers.oidc.enabled }}
|
|
||||||
{{- if $autheliaprevious }}
|
|
||||||
OIDC_PRIVATE_KEY: {{ index $autheliaprevious.data "OIDC_PRIVATE_KEY" }}
|
|
||||||
OIDC_HMAC_SECRET: {{index $autheliaprevious.data "OIDC_HMAC_SECRET" }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $oidckey := genPrivateKey "rsa" }}
|
|
||||||
{{- $oidcsecret := randAlphaNum 32 }}
|
|
||||||
OIDC_PRIVATE_KEY: {{ $oidckey | b64enc }}
|
|
||||||
OIDC_HMAC_SECRET: {{ $oidcsecret | b64enc }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,72 +0,0 @@
|
||||||
{{/* Make sure all variables are set properly */}}
|
|
||||||
{{- include "common.values.setup" . }}
|
|
||||||
|
|
||||||
{{/* Render configmap for authelia */}}
|
|
||||||
{{- include "authelia.configmap" . }}
|
|
||||||
|
|
||||||
{{/* Render secrets for authelia */}}
|
|
||||||
{{- include "authelia.secrets" . }}
|
|
||||||
|
|
||||||
{{/* Append the general configMap volume to the volumes */}}
|
|
||||||
{{- define "authelia.configmapVolume" -}}
|
|
||||||
enabled: "true"
|
|
||||||
mountPath: " /configuration.yaml"
|
|
||||||
readOnly: true
|
|
||||||
subPath: configuration.yaml
|
|
||||||
type: "custom"
|
|
||||||
volumeSpec:
|
|
||||||
configMap:
|
|
||||||
name: {{ include "common.names.fullname" . }}-configfile
|
|
||||||
items:
|
|
||||||
- key: configuration.yaml
|
|
||||||
path: configuration.yaml
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/* Append the general secret volumes to the volumes */}}
|
|
||||||
{{- define "authelia.secretVolumes" -}}
|
|
||||||
enabled: "true"
|
|
||||||
mountPath: " /secrets"
|
|
||||||
readOnly: true
|
|
||||||
type: "custom"
|
|
||||||
volumeSpec:
|
|
||||||
secret:
|
|
||||||
secretName: {{ include "common.names.fullname" . }}-secrets
|
|
||||||
items:
|
|
||||||
- key: "JWT_TOKEN"
|
|
||||||
path: JWT_TOKEN
|
|
||||||
- key: "SESSION_ENCRYPTION_KEY"
|
|
||||||
path: SESSION_ENCRYPTION_KEY
|
|
||||||
- key: "STORAGE_PASSWORD"
|
|
||||||
path: STORAGE_PASSWORD
|
|
||||||
{{- if .Values.authentication_backend.ldap.enabled }}
|
|
||||||
- key: "LDAP_PASSWORD"
|
|
||||||
path: LDAP_PASSWORD
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.notifier.smtp.enabled }}
|
|
||||||
- key: "SMTP_PASSWORD"
|
|
||||||
path: SMTP_PASSWORD
|
|
||||||
{{- end }}
|
|
||||||
- key: "REDIS_PASSWORD"
|
|
||||||
path: REDIS_PASSWORD
|
|
||||||
{{- if .Values.redisProvider.high_availability.enabled}}
|
|
||||||
- key: "REDIS_SENTINEL_PASSWORD"
|
|
||||||
path: REDIS_SENTINEL_PASSWORD
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.duo_api.enabled }}
|
|
||||||
- key: "DUO_API_KEY"
|
|
||||||
path: DUO_API_KEY
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.identity_providers.oidc.enabled }}
|
|
||||||
- key: "OIDC_PRIVATE_KEY"
|
|
||||||
path: OIDC_PRIVATE_KEY
|
|
||||||
- key: "OIDC_HMAC_SECRET"
|
|
||||||
path: OIDC_HMAC_SECRET
|
|
||||||
{{- end }}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- $_ := set .Values.persistence "authelia-configfile" (include "authelia.configmapVolume" . | fromYaml) -}}
|
|
||||||
{{- $_ := set .Values.persistence "authelia-secrets" (include "authelia.secretVolumes" . | fromYaml) -}}
|
|
||||||
|
|
||||||
|
|
||||||
{{/* Render the templates */}}
|
|
||||||
{{ include "common.all" . }}
|
|
||||||
|
|
@ -1,662 +0,0 @@
|
||||||
# Default values for Bitwarden.
|
|
||||||
|
|
||||||
image:
|
|
||||||
repository: ghcr.io/authelia/authelia
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
tag: "4.30.4"
|
|
||||||
|
|
||||||
command: ["authelia"]
|
|
||||||
args: ["--config=/configuration.yaml"]
|
|
||||||
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
|
|
||||||
service:
|
|
||||||
main:
|
|
||||||
ports:
|
|
||||||
main:
|
|
||||||
port: 9091
|
|
||||||
|
|
||||||
persistence:
|
|
||||||
config:
|
|
||||||
enabled: true
|
|
||||||
mountPath: "/config"
|
|
||||||
type: pvc
|
|
||||||
accessMode: ReadWriteOnce
|
|
||||||
size: "100Gi"
|
|
||||||
redismaster:
|
|
||||||
noMount: true
|
|
||||||
forceName: "redismaster"
|
|
||||||
enabled: true
|
|
||||||
type: pvc
|
|
||||||
accessMode: ReadWriteOnce
|
|
||||||
size: "100Gi"
|
|
||||||
|
|
||||||
# Enabled postgres
|
|
||||||
postgresql:
|
|
||||||
enabled: true
|
|
||||||
postgresqlUsername: authelia
|
|
||||||
postgresqlDatabase: authelia
|
|
||||||
existingSecret: "{{ .Release.Name }}-dbcreds"
|
|
||||||
|
|
||||||
# Enabled redis
|
|
||||||
# ... for more options see https://github.com/bitnami/charts/tree/master/bitnami/redis
|
|
||||||
redis:
|
|
||||||
volumePermissions:
|
|
||||||
enabled: true
|
|
||||||
architecture: standalone
|
|
||||||
enabled: true
|
|
||||||
auth:
|
|
||||||
existingSecret: rediscreds
|
|
||||||
existingSecretPasswordKey: redis-password
|
|
||||||
master:
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
existingClaim: redismaster
|
|
||||||
replica:
|
|
||||||
replicaCount: 0
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
|
|
||||||
podSecurityContext:
|
|
||||||
runAsUser: 568
|
|
||||||
runAsGroup: 568
|
|
||||||
fsGroup: 568
|
|
||||||
|
|
||||||
securityContext:
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
privileged: false
|
|
||||||
|
|
||||||
|
|
||||||
resources:
|
|
||||||
limits: {}
|
|
||||||
# limits:
|
|
||||||
# cpu: "4.00"
|
|
||||||
# memory: 125Mi
|
|
||||||
requests: {}
|
|
||||||
# requests:
|
|
||||||
# cpu: "0.25"
|
|
||||||
# memory: 50Mi
|
|
||||||
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: '{{ include "common.names.fullname" . }}-paths'
|
|
||||||
|
|
||||||
probes:
|
|
||||||
liveness:
|
|
||||||
type: HTTP
|
|
||||||
path: /api/health"
|
|
||||||
|
|
||||||
readiness:
|
|
||||||
type: HTTP
|
|
||||||
path: "/api/health"
|
|
||||||
|
|
||||||
startup:
|
|
||||||
type: HTTP
|
|
||||||
path: "/api/health"
|
|
||||||
|
|
||||||
domain: example.com
|
|
||||||
|
|
||||||
##
|
|
||||||
## Server Configuration
|
|
||||||
##
|
|
||||||
server:
|
|
||||||
##
|
|
||||||
## Port sets the configured port for the daemon, service, and the probes.
|
|
||||||
## Default is 9091 and should not need to be changed.
|
|
||||||
##
|
|
||||||
port: 9091
|
|
||||||
|
|
||||||
## Buffers usually should be configured to be the same value.
|
|
||||||
## Explanation at https://www.authelia.com/docs/configuration/server.html
|
|
||||||
## Read buffer size adjusts the server's max incoming request size in bytes.
|
|
||||||
## Write buffer size does the same for outgoing responses.
|
|
||||||
read_buffer_size: 4096
|
|
||||||
write_buffer_size: 4096
|
|
||||||
## Set the single level path Authelia listens on.
|
|
||||||
## Must be alphanumeric chars and should not contain any slashes.
|
|
||||||
path: ""
|
|
||||||
|
|
||||||
log:
|
|
||||||
## Level of verbosity for logs: info, debug, trace.
|
|
||||||
level: trace
|
|
||||||
|
|
||||||
## Format the logs are written as: json, text.
|
|
||||||
format: text
|
|
||||||
|
|
||||||
## TODO: Statefulness check should check if this is set, and the configMap should enable it.
|
|
||||||
## File path where the logs will be written. If not set logs are written to stdout.
|
|
||||||
# file_path: /config/authelia.log
|
|
||||||
|
|
||||||
## Default redirection URL
|
|
||||||
##
|
|
||||||
## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
|
|
||||||
## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
|
|
||||||
## in such a case.
|
|
||||||
##
|
|
||||||
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
|
|
||||||
## Default is https://www.<domain> (value at the top of the values.yaml).
|
|
||||||
default_redirection_url: ""
|
|
||||||
# default_redirection_url: https://example.com
|
|
||||||
|
|
||||||
theme: light
|
|
||||||
|
|
||||||
##
|
|
||||||
## TOTP Configuration
|
|
||||||
##
|
|
||||||
## Parameters used for TOTP generation
|
|
||||||
totp:
|
|
||||||
## The issuer name displayed in the Authenticator application of your choice
|
|
||||||
## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names
|
|
||||||
## Defaults to <domain>.
|
|
||||||
issuer: ""
|
|
||||||
## The period in seconds a one-time password is current for. Changing this will require all users to register
|
|
||||||
## their TOTP applications again. Warning: before changing period read the docs link below.
|
|
||||||
period: 30
|
|
||||||
## The skew controls number of one-time passwords either side of the current one that are valid.
|
|
||||||
## Warning: before changing skew read the docs link below.
|
|
||||||
## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation.
|
|
||||||
skew: 1
|
|
||||||
|
|
||||||
##
|
|
||||||
## Duo Push API Configuration
|
|
||||||
##
|
|
||||||
## Parameters used to contact the Duo API. Those are generated when you protect an application of type
|
|
||||||
## "Partner Auth API" in the management panel.
|
|
||||||
duo_api:
|
|
||||||
enabled: false
|
|
||||||
hostname: api-123456789.example.com
|
|
||||||
integration_key: ABCDEF
|
|
||||||
plain_api_key: ""
|
|
||||||
|
|
||||||
##
|
|
||||||
## Authentication Backend Provider Configuration
|
|
||||||
##
|
|
||||||
## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
|
|
||||||
##
|
|
||||||
## The available providers are: `file`, `ldap`. You must use one and only one of these providers.
|
|
||||||
authentication_backend:
|
|
||||||
## Disable both the HTML element and the API for reset password functionality
|
|
||||||
disable_reset_password: false
|
|
||||||
|
|
||||||
## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
|
|
||||||
## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
|
|
||||||
## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
|
|
||||||
## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
|
|
||||||
## See the below documentation for more information.
|
|
||||||
## Duration Notation docs: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
|
||||||
## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval
|
|
||||||
refresh_interval: 5m
|
|
||||||
|
|
||||||
## LDAP backend configuration.
|
|
||||||
##
|
|
||||||
## This backend allows Authelia to be scaled to more
|
|
||||||
## than one instance and therefore is recommended for
|
|
||||||
## production.
|
|
||||||
ldap:
|
|
||||||
|
|
||||||
## Enable LDAP Backend.
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
|
|
||||||
## Acceptable options are as follows:
|
|
||||||
## - 'activedirectory' - For Microsoft Active Directory.
|
|
||||||
## - 'custom' - For custom specifications of attributes and filters.
|
|
||||||
## This currently defaults to 'custom' to maintain existing behaviour.
|
|
||||||
##
|
|
||||||
## Depending on the option here certain other values in this section have a default value, notably all of the
|
|
||||||
## attribute mappings have a default value that this config overrides, you can read more about these default values
|
|
||||||
## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults
|
|
||||||
implementation: activedirectory
|
|
||||||
|
|
||||||
## The url to the ldap server. Format: <scheme>://<address>[:<port>].
|
|
||||||
## Scheme can be ldap or ldaps in the format (port optional).
|
|
||||||
url: ldap://openldap.default.svc.cluster.local
|
|
||||||
|
|
||||||
## Connection Timeout.
|
|
||||||
timeout: 5s
|
|
||||||
|
|
||||||
## Use StartTLS with the LDAP connection.
|
|
||||||
start_tls: false
|
|
||||||
|
|
||||||
tls:
|
|
||||||
## Server Name for certificate validation (in case it's not set correctly in the URL).
|
|
||||||
server_name: ""
|
|
||||||
|
|
||||||
## Skip verifying the server certificate (to allow a self-signed certificate).
|
|
||||||
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
|
||||||
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
|
||||||
skip_verify: false
|
|
||||||
|
|
||||||
## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
|
|
||||||
minimum_version: TLS1.2
|
|
||||||
|
|
||||||
## The base dn for every LDAP query.
|
|
||||||
base_dn: DC=example,DC=com
|
|
||||||
|
|
||||||
## The attribute holding the username of the user. This attribute is used to populate the username in the session
|
|
||||||
## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
|
|
||||||
## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
|
|
||||||
## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.
|
|
||||||
## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user
|
|
||||||
## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
|
|
||||||
## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
|
|
||||||
## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
|
|
||||||
username_attribute: ""
|
|
||||||
|
|
||||||
## An additional dn to define the scope to all users.
|
|
||||||
additional_users_dn: OU=Users
|
|
||||||
|
|
||||||
## The users filter used in search queries to find the user profile based on input filled in login form.
|
|
||||||
## Various placeholders are available in the user filter:
|
|
||||||
## - {input} is a placeholder replaced by what the user inputs in the login form.
|
|
||||||
## - {username_attribute} is a mandatory placeholder replaced by what is configured in `username_attribute`.
|
|
||||||
## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
|
|
||||||
## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
|
|
||||||
## versions, so please don't use it.
|
|
||||||
##
|
|
||||||
## Recommended settings are as follows:
|
|
||||||
## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
|
|
||||||
## - OpenLDAP:
|
|
||||||
## - (&({username_attribute}={input})(objectClass=person))
|
|
||||||
## - (&({username_attribute}={input})(objectClass=inetOrgPerson))
|
|
||||||
##
|
|
||||||
## To allow sign in both with username and email, one can use a filter like
|
|
||||||
## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
|
|
||||||
users_filter: ""
|
|
||||||
|
|
||||||
## An additional dn to define the scope of groups.
|
|
||||||
additional_groups_dn: OU=Groups
|
|
||||||
|
|
||||||
## The groups filter used in search queries to find the groups of the user.
|
|
||||||
## - {input} is a placeholder replaced by what the user inputs in the login form.
|
|
||||||
## - {username} is a placeholder replace by the username stored in LDAP (based on `username_attribute`).
|
|
||||||
## - {dn} is a matcher replaced by the user distinguished name, aka, user DN.
|
|
||||||
## - {username_attribute} is a placeholder replaced by what is configured in `username_attribute`.
|
|
||||||
## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
|
|
||||||
## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
|
|
||||||
## versions, so please don't use it.
|
|
||||||
## - DON'T USE - {1} is an alias for {username} supported for backward compatibility but it will be deprecated in
|
|
||||||
## later version, so please don't use it.
|
|
||||||
##
|
|
||||||
## If your groups use the `groupOfUniqueNames` structure use this instead:
|
|
||||||
## (&(uniquemember={dn})(objectclass=groupOfUniqueNames))
|
|
||||||
groups_filter: ""
|
|
||||||
|
|
||||||
## The attribute holding the name of the group
|
|
||||||
group_name_attribute: ""
|
|
||||||
|
|
||||||
## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
|
|
||||||
## first one returned by the LDAP server is used.
|
|
||||||
mail_attribute: ""
|
|
||||||
|
|
||||||
## The attribute holding the display name of the user. This will be used to greet an authenticated user.
|
|
||||||
display_name_attribute: ""
|
|
||||||
|
|
||||||
## The username of the admin user.
|
|
||||||
user: CN=Authelia,DC=example,DC=com
|
|
||||||
plain_password: ""
|
|
||||||
|
|
||||||
##
|
|
||||||
## File (Authentication Provider)
|
|
||||||
##
|
|
||||||
## With this backend, the users database is stored in a file which is updated when users reset their passwords.
|
|
||||||
## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
|
|
||||||
## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
|
|
||||||
## implications it is highly recommended you leave the default values. Before considering changing these settings
|
|
||||||
## please read the docs page below:
|
|
||||||
## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning
|
|
||||||
##
|
|
||||||
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
|
||||||
##
|
|
||||||
file:
|
|
||||||
enabled: true
|
|
||||||
path: /config/users_database.yml
|
|
||||||
password:
|
|
||||||
algorithm: argon2id
|
|
||||||
iterations: 1
|
|
||||||
key_length: 32
|
|
||||||
salt_length: 16
|
|
||||||
memory: 1024
|
|
||||||
parallelism: 8
|
|
||||||
|
|
||||||
##
|
|
||||||
## Access Control Configuration
|
|
||||||
##
|
|
||||||
## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
|
|
||||||
##
|
|
||||||
## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
|
|
||||||
## to anyone. Otherwise restrictions follow the rules defined.
|
|
||||||
##
|
|
||||||
## Note: One can use the wildcard * to match any subdomain.
|
|
||||||
## It must stand at the beginning of the pattern. (example: *.mydomain.com)
|
|
||||||
##
|
|
||||||
## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
|
|
||||||
##
|
|
||||||
## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
|
|
||||||
##
|
|
||||||
## - 'domain' defines which domain or set of domains the rule applies to.
|
|
||||||
##
|
|
||||||
## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
|
|
||||||
## provided. If provided, the parameter represents either a user or a group. It should be of the form
|
|
||||||
## 'user:<username>' or 'group:<groupname>'.
|
|
||||||
##
|
|
||||||
## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
|
|
||||||
##
|
|
||||||
## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
|
|
||||||
## is optional and matches any resource if not provided.
|
|
||||||
##
|
|
||||||
## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
|
|
||||||
access_control:
|
|
||||||
## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
|
|
||||||
## resource if there is no policy to be applied to the user.
|
|
||||||
default_policy: deny
|
|
||||||
|
|
||||||
networks: []
|
|
||||||
# networks:
|
|
||||||
# - name: private
|
|
||||||
# networks:
|
|
||||||
# - 10.0.0.0/8
|
|
||||||
# - 172.16.0.0/12
|
|
||||||
# - 192.168.0.0/16
|
|
||||||
# - name: vpn
|
|
||||||
# networks:
|
|
||||||
# - 10.9.0.0/16
|
|
||||||
|
|
||||||
rules: []
|
|
||||||
# rules:
|
|
||||||
# - domain: public.example.com
|
|
||||||
# policy: bypass
|
|
||||||
# - domain: "*.example.com"
|
|
||||||
# policy: bypass
|
|
||||||
# methods:
|
|
||||||
# - OPTIONS
|
|
||||||
# - domain: secure.example.com
|
|
||||||
# policy: one_factor
|
|
||||||
# networks:
|
|
||||||
# - private
|
|
||||||
# - vpn
|
|
||||||
# - 192.168.1.0/24
|
|
||||||
# - 10.0.0.1
|
|
||||||
# - domain:
|
|
||||||
# - secure.example.com
|
|
||||||
# - private.example.com
|
|
||||||
# policy: two_factor
|
|
||||||
# - domain: singlefactor.example.com
|
|
||||||
# policy: one_factor
|
|
||||||
# - domain: "mx2.mail.example.com"
|
|
||||||
# subject: "group:admins"
|
|
||||||
# policy: deny
|
|
||||||
# - domain: "*.example.com"
|
|
||||||
# subject:
|
|
||||||
# - "group:admins"
|
|
||||||
# - "group:moderators"
|
|
||||||
# policy: two_factor
|
|
||||||
# - domain: dev.example.com
|
|
||||||
# resources:
|
|
||||||
# - "^/groups/dev/.*$"
|
|
||||||
# subject: "group:dev"
|
|
||||||
# policy: two_factor
|
|
||||||
# - domain: dev.example.com
|
|
||||||
# resources:
|
|
||||||
# - "^/users/john/.*$"
|
|
||||||
# subject:
|
|
||||||
# - ["group:dev", "user:john"]
|
|
||||||
# - "group:admins"
|
|
||||||
# policy: two_factor
|
|
||||||
# - domain: "{user}.example.com"
|
|
||||||
# policy: bypass
|
|
||||||
|
|
||||||
##
|
|
||||||
## Session Provider Configuration
|
|
||||||
##
|
|
||||||
## The session cookies identify the user once logged in.
|
|
||||||
## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
|
|
||||||
session:
|
|
||||||
## The name of the session cookie. (default: authelia_session).
|
|
||||||
name: authelia_session
|
|
||||||
|
|
||||||
## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
|
|
||||||
## Please read https://www.authelia.com/docs/configuration/session.html#same_site
|
|
||||||
same_site: lax
|
|
||||||
|
|
||||||
## The time in seconds before the cookie expires and session is reset.
|
|
||||||
expiration: 1h
|
|
||||||
|
|
||||||
## The inactivity time in seconds before the session is reset.
|
|
||||||
inactivity: 5m
|
|
||||||
|
|
||||||
## The remember me duration.
|
|
||||||
## Value is in seconds, or duration notation. Value of 0 disables remember me.
|
|
||||||
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
|
||||||
## Longer periods are considered less secure because a stolen cookie will last longer giving attackers more time to
|
|
||||||
## spy or attack. Currently the default is 1M or 1 month.
|
|
||||||
remember_me_duration: 1M
|
|
||||||
|
|
||||||
##
|
|
||||||
## Redis Provider
|
|
||||||
##
|
|
||||||
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
|
||||||
##
|
|
||||||
## The redis connection details
|
|
||||||
redisProvider:
|
|
||||||
port: 6379
|
|
||||||
|
|
||||||
## Optional username to be used with authentication.
|
|
||||||
# username: authelia
|
|
||||||
username: ""
|
|
||||||
|
|
||||||
## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
|
|
||||||
database_index: 0
|
|
||||||
|
|
||||||
## The maximum number of concurrent active connections to Redis.
|
|
||||||
maximum_active_connections: 8
|
|
||||||
|
|
||||||
## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
|
|
||||||
minimum_idle_connections: 0
|
|
||||||
|
|
||||||
## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
|
|
||||||
tls:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
|
|
||||||
server_name: ""
|
|
||||||
|
|
||||||
## Skip verifying the server certificate (to allow a self-signed certificate).
|
|
||||||
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
|
||||||
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
|
||||||
skip_verify: false
|
|
||||||
|
|
||||||
## Minimum TLS version for the connection.
|
|
||||||
minimum_version: TLS1.2
|
|
||||||
|
|
||||||
## The Redis HA configuration options.
|
|
||||||
## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
|
|
||||||
high_availability:
|
|
||||||
enabled: false
|
|
||||||
enabledSecret: false
|
|
||||||
## Sentinel Name / Master Name
|
|
||||||
sentinel_name: mysentinel
|
|
||||||
|
|
||||||
## The additional nodes to pre-seed the redis provider with (for sentinel).
|
|
||||||
## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
|
|
||||||
## For high availability to be used you must have either defined; the host above or at least one node below.
|
|
||||||
nodes: []
|
|
||||||
# nodes:
|
|
||||||
# - host: sentinel-0.databases.svc.cluster.local
|
|
||||||
# port: 26379
|
|
||||||
# - host: sentinel-1.databases.svc.cluster.local
|
|
||||||
# port: 26379
|
|
||||||
|
|
||||||
## Choose the host with the lowest latency.
|
|
||||||
route_by_latency: false
|
|
||||||
|
|
||||||
## Choose the host randomly.
|
|
||||||
route_randomly: false
|
|
||||||
|
|
||||||
##
|
|
||||||
## Regulation Configuration
|
|
||||||
##
|
|
||||||
## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are done
|
|
||||||
## in a short period of time.
|
|
||||||
regulation:
|
|
||||||
## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
|
|
||||||
max_retries: 3
|
|
||||||
|
|
||||||
## The time range during which the user can attempt login before being banned. The user is banned if the
|
|
||||||
## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
|
|
||||||
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
|
||||||
find_time: 2m
|
|
||||||
|
|
||||||
## The length of time before a banned user can login again. Ban Time accepts duration notation.
|
|
||||||
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
|
||||||
ban_time: 5m
|
|
||||||
|
|
||||||
|
|
||||||
##
|
|
||||||
## Storage Provider Configuration
|
|
||||||
##
|
|
||||||
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
|
|
||||||
storage:
|
|
||||||
##
|
|
||||||
## PostgreSQL (Storage Provider)
|
|
||||||
##
|
|
||||||
postgres:
|
|
||||||
port: 5432
|
|
||||||
database: authelia
|
|
||||||
username: authelia
|
|
||||||
sslmode: disable
|
|
||||||
timeout: 5s
|
|
||||||
|
|
||||||
##
|
|
||||||
## Notification Provider
|
|
||||||
##
|
|
||||||
##
|
|
||||||
## Notifications are sent to users when they require a password reset, a u2f registration or a TOTP registration.
|
|
||||||
## The available providers are: filesystem, smtp. You must use one and only one of these providers.
|
|
||||||
notifier:
|
|
||||||
## You can disable the notifier startup check by setting this to true.
|
|
||||||
disable_startup_check: false
|
|
||||||
|
|
||||||
##
|
|
||||||
## File System (Notification Provider)
|
|
||||||
##
|
|
||||||
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
|
||||||
##
|
|
||||||
filesystem:
|
|
||||||
enabled: true
|
|
||||||
filename: /config/notification.txt
|
|
||||||
|
|
||||||
##
|
|
||||||
## SMTP (Notification Provider)
|
|
||||||
##
|
|
||||||
## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.
|
|
||||||
## [Security] By default Authelia will:
|
|
||||||
## - force all SMTP connections over TLS including unauthenticated connections
|
|
||||||
## - use the disable_require_tls boolean value to disable this requirement
|
|
||||||
## (only works for unauthenticated connections)
|
|
||||||
## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
|
|
||||||
## (configure in tls section)
|
|
||||||
smtp:
|
|
||||||
enabled: false
|
|
||||||
enabledSecret: false
|
|
||||||
host: smtp.mail.svc.cluster.local
|
|
||||||
port: 25
|
|
||||||
timeout: 5s
|
|
||||||
username: test
|
|
||||||
plain_password: test
|
|
||||||
sender: admin@example.com
|
|
||||||
## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
|
|
||||||
identifier: localhost
|
|
||||||
## Subject configuration of the emails sent.
|
|
||||||
## {title} is replaced by the text from the notifier
|
|
||||||
subject: "[Authelia] {title}"
|
|
||||||
## This address is used during the startup check to verify the email configuration is correct.
|
|
||||||
## It's not important what it is except if your email server only allows local delivery.
|
|
||||||
startup_check_address: test@authelia.com
|
|
||||||
disable_require_tls: false
|
|
||||||
disable_html_emails: false
|
|
||||||
|
|
||||||
tls:
|
|
||||||
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
|
|
||||||
server_name: ""
|
|
||||||
|
|
||||||
## Skip verifying the server certificate (to allow a self-signed certificate).
|
|
||||||
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
|
||||||
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
|
||||||
skip_verify: false
|
|
||||||
|
|
||||||
## Minimum TLS version for either StartTLS or SMTPS.
|
|
||||||
minimum_version: TLS1.2
|
|
||||||
|
|
||||||
identity_providers:
|
|
||||||
oidc:
|
|
||||||
## Enables this in the config map. Currently in beta stage.
|
|
||||||
## See https://www.authelia.com/docs/configuration/identity-providers/oidc.html#roadmap
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
access_token_lifespan: 1h
|
|
||||||
authorize_code_lifespan: 1m
|
|
||||||
id_token_lifespan: 1h
|
|
||||||
refresh_token_lifespan: 90m
|
|
||||||
|
|
||||||
enable_client_debug_messages: false
|
|
||||||
|
|
||||||
## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for
|
|
||||||
## security reasons.
|
|
||||||
minimum_parameter_entropy: 8
|
|
||||||
|
|
||||||
clients: []
|
|
||||||
# clients:
|
|
||||||
# -
|
|
||||||
## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
|
|
||||||
# id: myapp
|
|
||||||
|
|
||||||
## The description to show to users when they end up on the consent screen. Defaults to the ID above.
|
|
||||||
# description: My Application
|
|
||||||
|
|
||||||
## The client secret is a shared secret between Authelia and the consumer of this client.
|
|
||||||
# secret: apple123
|
|
||||||
|
|
||||||
## Sets the client to public. This should typically not be set, please see the documentation for usage.
|
|
||||||
# public: false
|
|
||||||
|
|
||||||
## The policy to require for this client; one_factor or two_factor.
|
|
||||||
# authorization_policy: two_factor
|
|
||||||
|
|
||||||
## Audience this client is allowed to request.
|
|
||||||
# audience: []
|
|
||||||
|
|
||||||
## Scopes this client is allowed to request.
|
|
||||||
# scopes:
|
|
||||||
# - openid
|
|
||||||
# - profile
|
|
||||||
# - email
|
|
||||||
# - groups
|
|
||||||
|
|
||||||
## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
|
|
||||||
# redirect_uris:
|
|
||||||
# - https://oidc.example.com/oauth2/callback
|
|
||||||
|
|
||||||
## Grant Types configures which grants this client can obtain.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# grant_types:
|
|
||||||
# - refresh_token
|
|
||||||
# - authorization_code
|
|
||||||
|
|
||||||
## Response Types configures which responses this client can be sent.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# response_types:
|
|
||||||
# - code
|
|
||||||
|
|
||||||
## Response Modes configures which response modes this client supports.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# response_modes:
|
|
||||||
# - form_post
|
|
||||||
# - query
|
|
||||||
# - fragment
|
|
||||||
|
|
||||||
## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
|
|
||||||
# userinfo_signing_algorithm: none
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
dependencies:
|
|
||||||
- name: common
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 6.10.7
|
|
||||||
- name: postgresql
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 1.2.3
|
|
||||||
- name: redis
|
|
||||||
repository: https://charts.bitnami.com/bitnami
|
|
||||||
version: 14.8.11
|
|
||||||
digest: sha256:828defa5ad7e3157f54408b86d5a2a23c92c72844df7f15c341e7a830307762a
|
|
||||||
generated: "2021-08-28T12:41:44.659566247Z"
|
|
||||||
|
|
@ -1,41 +0,0 @@
|
||||||
apiVersion: v2
|
|
||||||
appVersion: auto
|
|
||||||
dependencies:
|
|
||||||
- name: common
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 6.10.7
|
|
||||||
- condition: postgresql.enabled
|
|
||||||
name: postgresql
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 1.2.3
|
|
||||||
- condition: redis.enabled
|
|
||||||
name: redis
|
|
||||||
repository: https://charts.bitnami.com/bitnami
|
|
||||||
version: 14.8.11
|
|
||||||
deprecated: false
|
|
||||||
description: Authelia is a Single Sign-On Multi-Factor portal for web apps
|
|
||||||
home: https://github.com/truecharts/apps/tree/master/charts/stable/authelia
|
|
||||||
icon: https://avatars2.githubusercontent.com/u/59122411?s=200&v=4
|
|
||||||
keywords:
|
|
||||||
- authelia
|
|
||||||
- authentication
|
|
||||||
- login
|
|
||||||
- SSO
|
|
||||||
- Authentication
|
|
||||||
- Security
|
|
||||||
- Two-Factor
|
|
||||||
- U2F
|
|
||||||
- YubiKey
|
|
||||||
- Push Notifications
|
|
||||||
- LDAP
|
|
||||||
kubeVersion: '>=1.16.0-0'
|
|
||||||
maintainers:
|
|
||||||
- email: info@truecharts.org
|
|
||||||
name: TrueCharts
|
|
||||||
url: truecharts.org
|
|
||||||
name: authelia
|
|
||||||
sources:
|
|
||||||
- https://github.com/authelia/chartrepo
|
|
||||||
- https://github.com/authelia/authelia
|
|
||||||
type: application
|
|
||||||
version: 0.0.2
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
Authelia is a Single Sign-On Multi-Factor portal for web apps
|
|
||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -1,231 +0,0 @@
|
||||||
##
|
|
||||||
# This file contains Values.yaml content that gets added to the output of questions.yaml
|
|
||||||
# It's ONLY meant for content that the user is NOT expected to change.
|
|
||||||
# Example: Everything under "image" is not included in questions.yaml but is included here.
|
|
||||||
##
|
|
||||||
|
|
||||||
image:
|
|
||||||
repository: ghcr.io/authelia/authelia
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
tag: "4.30.4"
|
|
||||||
|
|
||||||
# Enabled postgres
|
|
||||||
postgresql:
|
|
||||||
enabled: true
|
|
||||||
postgresqlUsername: authelia
|
|
||||||
postgresqlDatabase: authelia
|
|
||||||
existingSecret: "{{ .Release.Name }}-dbcreds"
|
|
||||||
persistence:
|
|
||||||
db:
|
|
||||||
storageClass: "SCALE-ZFS"
|
|
||||||
dbbackups:
|
|
||||||
storageClass: "SCALE-ZFS"
|
|
||||||
|
|
||||||
# Enabled redis
|
|
||||||
# ... for more options see https://github.com/bitnami/charts/tree/master/bitnami/redis
|
|
||||||
redis:
|
|
||||||
volumePermissions:
|
|
||||||
enabled: true
|
|
||||||
architecture: standalone
|
|
||||||
enabled: true
|
|
||||||
auth:
|
|
||||||
existingSecret: rediscreds
|
|
||||||
existingSecretPasswordKey: redis-password
|
|
||||||
master:
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
existingClaim: redismaster
|
|
||||||
replica:
|
|
||||||
replicaCount: 0
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: '{{ include "common.names.fullname" . }}-paths'
|
|
||||||
|
|
||||||
probes:
|
|
||||||
liveness:
|
|
||||||
type: HTTP
|
|
||||||
path: /api/health"
|
|
||||||
|
|
||||||
readiness:
|
|
||||||
type: HTTP
|
|
||||||
path: "/api/health"
|
|
||||||
|
|
||||||
startup:
|
|
||||||
type: HTTP
|
|
||||||
path: "/api/health"
|
|
||||||
|
|
||||||
##
|
|
||||||
## Storage Provider Configuration
|
|
||||||
##
|
|
||||||
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
|
|
||||||
storage:
|
|
||||||
##
|
|
||||||
## PostgreSQL (Storage Provider)
|
|
||||||
##
|
|
||||||
postgres:
|
|
||||||
port: 5432
|
|
||||||
database: authelia
|
|
||||||
username: authelia
|
|
||||||
sslmode: disable
|
|
||||||
timeout: 5s
|
|
||||||
|
|
||||||
##
|
|
||||||
## Server Configuration
|
|
||||||
##
|
|
||||||
server:
|
|
||||||
##
|
|
||||||
## Port sets the configured port for the daemon, service, and the probes.
|
|
||||||
## Default is 9091 and should not need to be changed.
|
|
||||||
##
|
|
||||||
port: 9091
|
|
||||||
|
|
||||||
## Buffers usually should be configured to be the same value.
|
|
||||||
## Explanation at https://www.authelia.com/docs/configuration/server.html
|
|
||||||
## Read buffer size adjusts the server's max incoming request size in bytes.
|
|
||||||
## Write buffer size does the same for outgoing responses.
|
|
||||||
read_buffer_size: 4096
|
|
||||||
write_buffer_size: 4096
|
|
||||||
## Set the single level path Authelia listens on.
|
|
||||||
## Must be alphanumeric chars and should not contain any slashes.
|
|
||||||
path: ""
|
|
||||||
|
|
||||||
##
|
|
||||||
## Redis Provider
|
|
||||||
##
|
|
||||||
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
|
||||||
##
|
|
||||||
## The redis connection details
|
|
||||||
redisProvider:
|
|
||||||
port: 6379
|
|
||||||
|
|
||||||
## Optional username to be used with authentication.
|
|
||||||
# username: authelia
|
|
||||||
username: ""
|
|
||||||
|
|
||||||
## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
|
|
||||||
database_index: 0
|
|
||||||
|
|
||||||
## The maximum number of concurrent active connections to Redis.
|
|
||||||
maximum_active_connections: 8
|
|
||||||
|
|
||||||
## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
|
|
||||||
minimum_idle_connections: 0
|
|
||||||
|
|
||||||
## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
|
|
||||||
tls:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
|
|
||||||
server_name: ""
|
|
||||||
|
|
||||||
## Skip verifying the server certificate (to allow a self-signed certificate).
|
|
||||||
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
|
||||||
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
|
||||||
skip_verify: false
|
|
||||||
|
|
||||||
## Minimum TLS version for the connection.
|
|
||||||
minimum_version: TLS1.2
|
|
||||||
|
|
||||||
## The Redis HA configuration options.
|
|
||||||
## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
|
|
||||||
high_availability:
|
|
||||||
enabled: false
|
|
||||||
enabledSecret: false
|
|
||||||
## Sentinel Name / Master Name
|
|
||||||
sentinel_name: mysentinel
|
|
||||||
|
|
||||||
## The additional nodes to pre-seed the redis provider with (for sentinel).
|
|
||||||
## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
|
|
||||||
## For high availability to be used you must have either defined; the host above or at least one node below.
|
|
||||||
nodes: []
|
|
||||||
# nodes:
|
|
||||||
# - host: sentinel-0.databases.svc.cluster.local
|
|
||||||
# port: 26379
|
|
||||||
# - host: sentinel-1.databases.svc.cluster.local
|
|
||||||
# port: 26379
|
|
||||||
|
|
||||||
## Choose the host with the lowest latency.
|
|
||||||
route_by_latency: false
|
|
||||||
|
|
||||||
## Choose the host randomly.
|
|
||||||
route_randomly: false
|
|
||||||
|
|
||||||
identity_providers:
|
|
||||||
oidc:
|
|
||||||
## Enables this in the config map. Currently in beta stage.
|
|
||||||
## See https://www.authelia.com/docs/configuration/identity-providers/oidc.html#roadmap
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
access_token_lifespan: 1h
|
|
||||||
authorize_code_lifespan: 1m
|
|
||||||
id_token_lifespan: 1h
|
|
||||||
refresh_token_lifespan: 90m
|
|
||||||
|
|
||||||
enable_client_debug_messages: false
|
|
||||||
|
|
||||||
## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for
|
|
||||||
## security reasons.
|
|
||||||
minimum_parameter_entropy: 8
|
|
||||||
|
|
||||||
clients: []
|
|
||||||
# clients:
|
|
||||||
# -
|
|
||||||
## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
|
|
||||||
# id: myapp
|
|
||||||
|
|
||||||
## The description to show to users when they end up on the consent screen. Defaults to the ID above.
|
|
||||||
# description: My Application
|
|
||||||
|
|
||||||
## The client secret is a shared secret between Authelia and the consumer of this client.
|
|
||||||
# secret: apple123
|
|
||||||
|
|
||||||
## Sets the client to public. This should typically not be set, please see the documentation for usage.
|
|
||||||
# public: false
|
|
||||||
|
|
||||||
## The policy to require for this client; one_factor or two_factor.
|
|
||||||
# authorization_policy: two_factor
|
|
||||||
|
|
||||||
## Audience this client is allowed to request.
|
|
||||||
# audience: []
|
|
||||||
|
|
||||||
## Scopes this client is allowed to request.
|
|
||||||
# scopes:
|
|
||||||
# - openid
|
|
||||||
# - profile
|
|
||||||
# - email
|
|
||||||
# - groups
|
|
||||||
|
|
||||||
## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
|
|
||||||
# redirect_uris:
|
|
||||||
# - https://oidc.example.com/oauth2/callback
|
|
||||||
|
|
||||||
## Grant Types configures which grants this client can obtain.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# grant_types:
|
|
||||||
# - refresh_token
|
|
||||||
# - authorization_code
|
|
||||||
|
|
||||||
## Response Types configures which responses this client can be sent.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# response_types:
|
|
||||||
# - code
|
|
||||||
|
|
||||||
## Response Modes configures which response modes this client supports.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# response_modes:
|
|
||||||
# - form_post
|
|
||||||
# - query
|
|
||||||
# - fragment
|
|
||||||
|
|
||||||
## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
|
|
||||||
# userinfo_signing_algorithm: none
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
##
|
|
||||||
# Most other defaults are set in questions.yaml
|
|
||||||
# For other options please refer to the wiki, default_values.yaml or the common library chart
|
|
||||||
##
|
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -1,245 +0,0 @@
|
||||||
{{/* Define the configmap */}}
|
|
||||||
{{- define "authelia.configmap" -}}
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: {{ include "common.names.fullname" . }}-paths
|
|
||||||
data:
|
|
||||||
AUTHELIA_SERVER_DISABLE_HEALTHCHECK: "true"
|
|
||||||
AUTHELIA_JWT_SECRET_FILE: "/secrets/JWT_TOKEN"
|
|
||||||
AUTHELIA_SESSION_SECRET_FILE: "/secrets/SESSION_ENCRYPTION_KEY"
|
|
||||||
AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE: "/secrets/STORAGE_PASSWORD"
|
|
||||||
{{- if .Values.authentication_backend.ldap.enabled }}
|
|
||||||
AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE: "/secrets/LDAP_PASSWORD"
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.notifier.smtp.enabled }}
|
|
||||||
AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE: "/secrets/SMTP_PASSWORD"
|
|
||||||
{{- end }}
|
|
||||||
AUTHELIA_SESSION_REDIS_PASSWORD_FILE: "/secrets/REDIS_PASSWORD"
|
|
||||||
{{- if and .Values.redisProvider.high_availability.enabled}}
|
|
||||||
AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE: "/secrets/REDIS_SENTINEL_PASSWORD"
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.duo_api.enabled }}
|
|
||||||
AUTHELIA_DUO_API_SECRET_KEY_FILE: "/secrets/DUO_API_KEY"
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.identity_providers.oidc.enabled }}
|
|
||||||
AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE: "/secrets/OIDC_HMAC_SECRET"
|
|
||||||
AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE: "/secrets/OIDC_PRIVATE_KEY"
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: {{ include "common.names.fullname" . }}-configfile
|
|
||||||
data:
|
|
||||||
configuration.yaml: |
|
|
||||||
---
|
|
||||||
theme: {{ default "light" .Values.theme }}
|
|
||||||
default_redirection_url: {{ default (printf "https://www.%s" .Values.domain) .Values.default_redirection_url }}
|
|
||||||
server:
|
|
||||||
host: 0.0.0.0
|
|
||||||
port: {{ default 9091 .Values.server.port }}
|
|
||||||
{{- if not (eq "" (default "" .Values.server.path)) }}
|
|
||||||
path: {{ .Values.server.path }}
|
|
||||||
{{- end }}
|
|
||||||
read_buffer_size: {{ default 4096 .Values.server.read_buffer_size }}
|
|
||||||
write_buffer_size: {{ default 4096 .Values.server.write_buffer_size }}
|
|
||||||
enable_pprof: {{ default false .Values.server.enable_pprof }}
|
|
||||||
enable_expvars: {{ default false .Values.server.enable_expvars }}
|
|
||||||
log:
|
|
||||||
level: {{ default "info" .Values.log.level }}
|
|
||||||
format: {{ default "text" .Values.log.format }}
|
|
||||||
{{- if not (eq "" (default "" .Values.log.file_path)) }}
|
|
||||||
file_path: {{ .Values.log.file_path }}
|
|
||||||
keep_stdout: true
|
|
||||||
{{- end }}
|
|
||||||
totp:
|
|
||||||
issuer: {{ default .Values.domain .Values.totp.issuer }}
|
|
||||||
period: {{ default 30 .Values.totp.period }}
|
|
||||||
skew: {{ default 1 .Values.totp.skew }}
|
|
||||||
{{- if .Values.duo_api.enabled }}
|
|
||||||
duo_api:
|
|
||||||
hostname: {{ .Values.duo_api.hostname }}
|
|
||||||
integration_key: {{ .Values.duo_api.integration_key }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with $auth := .Values.authentication_backend }}
|
|
||||||
authentication_backend:
|
|
||||||
disable_reset_password: {{ $auth.disable_reset_password }}
|
|
||||||
{{- if $auth.file.enabled }}
|
|
||||||
file:
|
|
||||||
path: {{ $auth.file.path }}
|
|
||||||
password: {{ toYaml $auth.file.password | nindent 10 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.enabled }}
|
|
||||||
ldap:
|
|
||||||
implementation: {{ default "custom" $auth.ldap.implementation }}
|
|
||||||
url: {{ $auth.ldap.url }}
|
|
||||||
timeout: {{ default "5s" $auth.ldap.timeout }}
|
|
||||||
start_tls: {{ $auth.ldap.start_tls }}
|
|
||||||
tls:
|
|
||||||
{{- if hasKey $auth.ldap.tls "server_name" }}
|
|
||||||
server_name: {{ default $auth.ldap.host $auth.ldap.tls.server_name }}
|
|
||||||
{{- end }}
|
|
||||||
minimum_version: {{ default "TLS1.2" $auth.ldap.tls.minimum_version }}
|
|
||||||
skip_verify: {{ default false $auth.ldap.tls.skip_verify }}
|
|
||||||
{{- if $auth.ldap.base_dn }}
|
|
||||||
base_dn: {{ $auth.ldap.base_dn }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.username_attribute }}
|
|
||||||
username_attribute: {{ $auth.ldap.username_attribute }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.additional_users_dn }}
|
|
||||||
additional_users_dn: {{ $auth.ldap.additional_users_dn }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.users_filter }}
|
|
||||||
users_filter: {{ $auth.ldap.users_filter }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.additional_groups_dn }}
|
|
||||||
additional_groups_dn: {{ $auth.ldap.additional_groups_dn }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.groups_filter }}
|
|
||||||
groups_filter: {{ $auth.ldap.groups_filter }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.group_name_attribute }}
|
|
||||||
group_name_attribute: {{ $auth.ldap.group_name_attribute }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.mail_attribute }}
|
|
||||||
mail_attribute: {{ $auth.ldap.mail_attribute }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.display_name_attribute }}
|
|
||||||
display_name_attribute: {{ $auth.ldap.display_name_attribute }}
|
|
||||||
{{- end }}
|
|
||||||
user: {{ $auth.ldap.user }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with $session := .Values.session }}
|
|
||||||
session:
|
|
||||||
name: {{ default "authelia_session" $session.name }}
|
|
||||||
domain: {{ required "A valid .Values.domain entry required!" $.Values.domain }}
|
|
||||||
same_site: {{ default "lax" $session.same_site }}
|
|
||||||
expiration: {{ default "1M" $session.expiration }}
|
|
||||||
inactivity: {{ default "5m" $session.inactivity }}
|
|
||||||
remember_me_duration: {{ default "1M" $session.remember_me_duration }}
|
|
||||||
{{- end }}
|
|
||||||
redis:
|
|
||||||
host: {{ ( printf "%v-%v" .Release.Name "redis-master" ) }}
|
|
||||||
{{- with $redis := .Values.redisProvider }}
|
|
||||||
port: {{ default 6379 $redis.port }}
|
|
||||||
{{- if not (eq $redis.username "") }}
|
|
||||||
username: {{ $redis.username }}
|
|
||||||
{{- end }}
|
|
||||||
maximum_active_connections: {{ default 8 $redis.maximum_active_connections }}
|
|
||||||
minimum_idle_connections: {{ default 0 $redis.minimum_idle_connections }}
|
|
||||||
{{- if $redis.tls.enabled }}
|
|
||||||
tls:
|
|
||||||
server_name: {{ $redis.tls.server_name }}
|
|
||||||
minimum_version: {{ default "TLS1.2" $redis.tls.minimum_version }}
|
|
||||||
skip_verify: {{ $redis.tls.skip_verify }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $redis.high_availability.enabled }}
|
|
||||||
high_availability:
|
|
||||||
sentinel_name: {{ $redis.high_availability.sentinel_name }}
|
|
||||||
{{- if $redis.high_availability.nodes }}
|
|
||||||
nodes: {{ toYaml $redis.high_availability.nodes | nindent 10 }}
|
|
||||||
{{- end }}
|
|
||||||
route_by_latency: {{ $redis.high_availability.route_by_latency }}
|
|
||||||
route_randomly: {{ $redis.high_availability.route_randomly }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
regulation: {{ toYaml .Values.regulation | nindent 6 }}
|
|
||||||
storage:
|
|
||||||
postgres:
|
|
||||||
host: {{ printf "%v-%v" .Release.Name "postgresql" }}
|
|
||||||
{{- with $storage := .Values.storage }}
|
|
||||||
port: {{ default 5432 $storage.postgres.port }}
|
|
||||||
database: {{ default "authelia" $storage.postgres.database }}
|
|
||||||
username: {{ default "authelia" $storage.postgres.username }}
|
|
||||||
timeout: {{ default "5s" $storage.postgres.timeout }}
|
|
||||||
sslmode: {{ default "disable" $storage.postgres.sslmode }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with $notifier := .Values.notifier }}
|
|
||||||
notifier:
|
|
||||||
disable_startup_check: {{ $.Values.notifier.disable_startup_check }}
|
|
||||||
{{- if $notifier.filesystem.enabled }}
|
|
||||||
filesystem:
|
|
||||||
filename: {{ $notifier.filesystem.filename }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $notifier.smtp.enabled }}
|
|
||||||
smtp:
|
|
||||||
host: {{ $notifier.smtp.host }}
|
|
||||||
port: {{ default 25 $notifier.smtp.port }}
|
|
||||||
timeout: {{ default "5s" $notifier.smtp.timeout }}
|
|
||||||
username: {{ $notifier.smtp.username }}
|
|
||||||
sender: {{ $notifier.smtp.sender }}
|
|
||||||
identifier: {{ $notifier.smtp.identifier }}
|
|
||||||
subject: {{ $notifier.smtp.subject | quote }}
|
|
||||||
startup_check_address: {{ $notifier.smtp.startup_check_address }}
|
|
||||||
disable_require_tls: {{ $notifier.smtp.disable_require_tls }}
|
|
||||||
disable_html_emails: {{ $notifier.smtp.disable_html_emails }}
|
|
||||||
tls:
|
|
||||||
server_name: {{ default $notifier.smtp.host $notifier.smtp.tls.server_name }}
|
|
||||||
minimum_version: {{ default "TLS1.2" $notifier.smtp.tls.minimum_version }}
|
|
||||||
skip_verify: {{ default false $notifier.smtp.tls.skip_verify }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.identity_providers.oidc.enabled }}
|
|
||||||
identity_providers:
|
|
||||||
oidc:
|
|
||||||
access_token_lifespan: {{ default "1h" .Values.identity_providers.oidc.access_token_lifespan }}
|
|
||||||
authorize_code_lifespan: {{ default "1m" .Values.identity_providers.oidc.authorize_code_lifespan }}
|
|
||||||
id_token_lifespan: {{ default "1h" .Values.identity_providers.oidc.id_token_lifespan }}
|
|
||||||
refresh_token_lifespan: {{ default "90m" .Values.identity_providers.oidc.refresh_token_lifespan }}
|
|
||||||
enable_client_debug_messages: {{ default false .Values.identity_providers.oidc.enable_client_debug_messages }}
|
|
||||||
minimum_parameter_entropy: {{ default 8 .Values.identity_providers.oidc.minimum_parameter_entropy }}
|
|
||||||
{{- if gt (len .Values.identity_providers.oidc.clients) 0 }}
|
|
||||||
clients:
|
|
||||||
{{- range $client := .Values.identity_providers.oidc.clients }}
|
|
||||||
- id: {{ $client.id }}
|
|
||||||
description: {{ default $client.id $client.description }}
|
|
||||||
secret: {{ default (randAlphaNum 128) $client.secret }}
|
|
||||||
{{- if hasKey $client "public" }}
|
|
||||||
public: {{ $client.public }}
|
|
||||||
{{- end }}
|
|
||||||
authorization_policy: {{ default "two_factor" $client.authorization_policy }}
|
|
||||||
redirect_uris: {{ toYaml $client.redirect_uris | nindent 10 }}
|
|
||||||
{{- if hasKey $client "audience" }}
|
|
||||||
audience: {{ toYaml $client.audience | nindent 10 }}
|
|
||||||
{{- end }}
|
|
||||||
scopes: {{ toYaml (default (list "openid" "profile" "email" "groups") $client.scopes) | nindent 10 }}
|
|
||||||
grant_types: {{ toYaml (default (list "refresh_token" "authorization_code") $client.grant_types) | nindent 10 }}
|
|
||||||
response_types: {{ toYaml (default (list "code") $client.response_types) | nindent 10 }}
|
|
||||||
{{- if hasKey $client "response_modes" }}
|
|
||||||
response_modes: {{ toYaml $client.response_modes | nindent 10 }}
|
|
||||||
{{- end }}
|
|
||||||
userinfo_signing_algorithm: {{ default "none" $client.userinfo_signing_algorithm }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
access_control:
|
|
||||||
{{- if (eq (len .Values.access_control.rules) 0) }}
|
|
||||||
{{- if (eq .Values.access_control.default_policy "bypass") }}
|
|
||||||
default_policy: one_factor
|
|
||||||
{{- else if (eq .Values.access_control.default_policy "deny") }}
|
|
||||||
default_policy: two_factor
|
|
||||||
{{- else }}
|
|
||||||
default_policy: {{ .Values.access_control.default_policy }}
|
|
||||||
{{- end }}
|
|
||||||
{{- else }}
|
|
||||||
default_policy: {{ .Values.access_control.default_policy }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if (eq (len .Values.access_control.networks) 0) }}
|
|
||||||
networks: []
|
|
||||||
{{- else }}
|
|
||||||
networks: {{ toYaml .Values.access_control.networks | nindent 6 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if (eq (len .Values.access_control.rules) 0) }}
|
|
||||||
rules: []
|
|
||||||
{{- else }}
|
|
||||||
rules: {{ toYaml .Values.access_control.rules | nindent 6 }}
|
|
||||||
{{- end }}
|
|
||||||
...
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,112 +0,0 @@
|
||||||
{{/* Define the secrets */}}
|
|
||||||
{{- define "authelia.secrets" -}}
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
{{- include "common.labels" . | nindent 4 }}
|
|
||||||
name: {{ .Release.Name }}-dbcreds
|
|
||||||
{{- $dbprevious := lookup "v1" "Secret" .Release.Namespace ( ( printf "%v-%v" .Release.Name "dbcreds" ) | quote ) }}
|
|
||||||
{{- $dbPass := "" }}
|
|
||||||
data:
|
|
||||||
{{- if $dbprevious }}
|
|
||||||
postgresql-password: {{ ( index $dbprevious.data "postgresql-password" ) }}
|
|
||||||
postgresql-postgres-password: {{ ( index $dbprevious.data "postgresql-postgres-password" ) }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $dbPass = randAlphaNum 50 }}
|
|
||||||
postgresql-password: {{ $dbPass | b64enc | quote }}
|
|
||||||
postgresql-postgres-password: {{ randAlphaNum 50 | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
url: {{ ( printf "%v%v:%v@%v-%v:%v/%v" "postgresql://" .Values.postgresql.postgresqlUsername $dbPass .Release.Name "postgresql" "5432" .Values.postgresql.postgresqlDatabase ) | b64enc | quote }}
|
|
||||||
type: Opaque
|
|
||||||
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
{{- include "common.labels" . | nindent 4 }}
|
|
||||||
name: rediscreds
|
|
||||||
{{- $redisprevious := lookup "v1" "Secret" .Release.Namespace "rediscreds" }}
|
|
||||||
{{- $redisPass := "" }}
|
|
||||||
{{- $sentinelPass := "" }}
|
|
||||||
data:
|
|
||||||
{{- if $redisprevious }}
|
|
||||||
redis-password: {{ ( index $redisprevious.data "redis-password" ) }}
|
|
||||||
sentinel-password: {{ ( index $redisprevious.data "sentinel-password" ) }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $redisPass = randAlphaNum 50 }}
|
|
||||||
{{- $sentinelPass = randAlphaNum 50 }}
|
|
||||||
redis-password: {{ $redisPass | b64enc | quote }}
|
|
||||||
sentinel-password: {{ $sentinelPass | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
masterhost: {{ ( printf "%v-%v" .Release.Name "redis-master" ) | b64enc | quote }}
|
|
||||||
slavehost: {{ ( printf "%v-%v" .Release.Name "redis-master" ) | b64enc | quote }}
|
|
||||||
type: Opaque
|
|
||||||
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
type: Opaque
|
|
||||||
metadata:
|
|
||||||
name: {{ include "common.names.fullname" . }}-secrets
|
|
||||||
{{- $autheliaprevious := lookup "v1" "Secret" .Release.Namespace ( ( printf "%v-%v" ( ( include "common.names.fullname" . ) | quote ) "-secrets" ) | quote ) }}
|
|
||||||
{{- $oidckey := "" }}
|
|
||||||
{{- $oidcsecret := "" }}
|
|
||||||
{{- $jwtsecret := "" }}
|
|
||||||
{{- $sessionsecret := "" }}
|
|
||||||
data:
|
|
||||||
{{- if $autheliaprevious }}
|
|
||||||
SESSION_ENCRYPTION_KEY: {{ index $autheliaprevious.data "SESSION_ENCRYPTION_KEY" }}
|
|
||||||
JWT_TOKEN: {{ index $autheliaprevious.data "JWT_TOKEN" }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $jwtsecret := randAlphaNum 50 }}
|
|
||||||
{{- $sessionsecret := randAlphaNum 50 }}
|
|
||||||
SESSION_ENCRYPTION_KEY: {{ $jwtsecret | b64enc | quote }}
|
|
||||||
JWT_TOKEN: {{ $jwtsecret | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.authentication_backend.ldap.enabled }}
|
|
||||||
LDAP_PASSWORD: {{ .Values.authentication_backend.ldap.plain_password }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.notifier.smtp.enabled }}
|
|
||||||
SMTP_PASSWORD: {{ .Values.notifier.smtp.plain_password }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.duo_api.enabled }}
|
|
||||||
DUO_API_KEY: {{ .Values.duo_api.plain_api_key | b64enc }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $dbprevious }}
|
|
||||||
STORAGE_PASSWORD: {{ ( index $dbprevious.data "postgresql-password" ) }}
|
|
||||||
{{- else }}
|
|
||||||
STORAGE_PASSWORD: {{ $dbPass | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $redisprevious }}
|
|
||||||
REDIS_PASSWORD: {{ ( index $redisprevious.data "redis-password" ) }}
|
|
||||||
{{- if .Values.redisProvider.high_availability.enabled}}
|
|
||||||
REDIS_SENTINEL_PASSWORD: {{ ( index $redisprevious.data "sentinel-password" ) }}
|
|
||||||
{{- end }}
|
|
||||||
{{- else }}
|
|
||||||
REDIS_PASSWORD: {{ $redisPass | b64enc | quote }}
|
|
||||||
{{- if .Values.redisProvider.high_availability.enabled}}
|
|
||||||
REDIS_SENTINEL_PASSWORD: {{ $sentinelPass | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.identity_providers.oidc.enabled }}
|
|
||||||
{{- if $autheliaprevious }}
|
|
||||||
OIDC_PRIVATE_KEY: {{ index $autheliaprevious.data "OIDC_PRIVATE_KEY" }}
|
|
||||||
OIDC_HMAC_SECRET: {{index $autheliaprevious.data "OIDC_HMAC_SECRET" }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $oidckey := genPrivateKey "rsa" }}
|
|
||||||
{{- $oidcsecret := randAlphaNum 32 }}
|
|
||||||
OIDC_PRIVATE_KEY: {{ $oidckey | b64enc }}
|
|
||||||
OIDC_HMAC_SECRET: {{ $oidcsecret | b64enc }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,72 +0,0 @@
|
||||||
{{/* Make sure all variables are set properly */}}
|
|
||||||
{{- include "common.values.setup" . }}
|
|
||||||
|
|
||||||
{{/* Render configmap for authelia */}}
|
|
||||||
{{- include "authelia.configmap" . }}
|
|
||||||
|
|
||||||
{{/* Render secrets for authelia */}}
|
|
||||||
{{- include "authelia.secrets" . }}
|
|
||||||
|
|
||||||
{{/* Append the general configMap volume to the volumes */}}
|
|
||||||
{{- define "authelia.configmapVolume" -}}
|
|
||||||
enabled: "true"
|
|
||||||
mountPath: " /configuration.yaml"
|
|
||||||
readOnly: true
|
|
||||||
subPath: configuration.yaml
|
|
||||||
type: "custom"
|
|
||||||
volumeSpec:
|
|
||||||
configMap:
|
|
||||||
name: {{ include "common.names.fullname" . }}-configfile
|
|
||||||
items:
|
|
||||||
- key: configuration.yaml
|
|
||||||
path: configuration.yaml
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/* Append the general secret volumes to the volumes */}}
|
|
||||||
{{- define "authelia.secretVolumes" -}}
|
|
||||||
enabled: "true"
|
|
||||||
mountPath: " /secrets"
|
|
||||||
readOnly: true
|
|
||||||
type: "custom"
|
|
||||||
volumeSpec:
|
|
||||||
secret:
|
|
||||||
secretName: {{ include "common.names.fullname" . }}-secrets
|
|
||||||
items:
|
|
||||||
- key: "JWT_TOKEN"
|
|
||||||
path: JWT_TOKEN
|
|
||||||
- key: "SESSION_ENCRYPTION_KEY"
|
|
||||||
path: SESSION_ENCRYPTION_KEY
|
|
||||||
- key: "STORAGE_PASSWORD"
|
|
||||||
path: STORAGE_PASSWORD
|
|
||||||
{{- if .Values.authentication_backend.ldap.enabled }}
|
|
||||||
- key: "LDAP_PASSWORD"
|
|
||||||
path: LDAP_PASSWORD
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.notifier.smtp.enabled }}
|
|
||||||
- key: "SMTP_PASSWORD"
|
|
||||||
path: SMTP_PASSWORD
|
|
||||||
{{- end }}
|
|
||||||
- key: "REDIS_PASSWORD"
|
|
||||||
path: REDIS_PASSWORD
|
|
||||||
{{- if .Values.redisProvider.high_availability.enabled}}
|
|
||||||
- key: "REDIS_SENTINEL_PASSWORD"
|
|
||||||
path: REDIS_SENTINEL_PASSWORD
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.duo_api.enabled }}
|
|
||||||
- key: "DUO_API_KEY"
|
|
||||||
path: DUO_API_KEY
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.identity_providers.oidc.enabled }}
|
|
||||||
- key: "OIDC_PRIVATE_KEY"
|
|
||||||
path: OIDC_PRIVATE_KEY
|
|
||||||
- key: "OIDC_HMAC_SECRET"
|
|
||||||
path: OIDC_HMAC_SECRET
|
|
||||||
{{- end }}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- $_ := set .Values.persistence "authelia-configfile" (include "authelia.configmapVolume" . | fromYaml) -}}
|
|
||||||
{{- $_ := set .Values.persistence "authelia-secrets" (include "authelia.secretVolumes" . | fromYaml) -}}
|
|
||||||
|
|
||||||
|
|
||||||
{{/* Render the templates */}}
|
|
||||||
{{ include "common.all" . }}
|
|
||||||
|
|
@ -1,662 +0,0 @@
|
||||||
# Default values for Bitwarden.
|
|
||||||
|
|
||||||
image:
|
|
||||||
repository: ghcr.io/authelia/authelia
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
tag: "4.30.4"
|
|
||||||
|
|
||||||
command: ["authelia"]
|
|
||||||
args: ["--config=/configuration.yaml"]
|
|
||||||
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
|
|
||||||
service:
|
|
||||||
main:
|
|
||||||
ports:
|
|
||||||
main:
|
|
||||||
port: 9091
|
|
||||||
|
|
||||||
persistence:
|
|
||||||
config:
|
|
||||||
enabled: true
|
|
||||||
mountPath: "/config"
|
|
||||||
type: pvc
|
|
||||||
accessMode: ReadWriteOnce
|
|
||||||
size: "100Gi"
|
|
||||||
redismaster:
|
|
||||||
noMount: true
|
|
||||||
forceName: "redismaster"
|
|
||||||
enabled: true
|
|
||||||
type: pvc
|
|
||||||
accessMode: ReadWriteOnce
|
|
||||||
size: "100Gi"
|
|
||||||
|
|
||||||
# Enabled postgres
|
|
||||||
postgresql:
|
|
||||||
enabled: true
|
|
||||||
postgresqlUsername: authelia
|
|
||||||
postgresqlDatabase: authelia
|
|
||||||
existingSecret: "{{ .Release.Name }}-dbcreds"
|
|
||||||
|
|
||||||
# Enabled redis
|
|
||||||
# ... for more options see https://github.com/bitnami/charts/tree/master/bitnami/redis
|
|
||||||
redis:
|
|
||||||
volumePermissions:
|
|
||||||
enabled: true
|
|
||||||
architecture: standalone
|
|
||||||
enabled: true
|
|
||||||
auth:
|
|
||||||
existingSecret: rediscreds
|
|
||||||
existingSecretPasswordKey: redis-password
|
|
||||||
master:
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
existingClaim: redismaster
|
|
||||||
replica:
|
|
||||||
replicaCount: 0
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
|
|
||||||
podSecurityContext:
|
|
||||||
runAsUser: 568
|
|
||||||
runAsGroup: 568
|
|
||||||
fsGroup: 568
|
|
||||||
|
|
||||||
securityContext:
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
privileged: false
|
|
||||||
|
|
||||||
|
|
||||||
resources:
|
|
||||||
limits: {}
|
|
||||||
# limits:
|
|
||||||
# cpu: "4.00"
|
|
||||||
# memory: 125Mi
|
|
||||||
requests: {}
|
|
||||||
# requests:
|
|
||||||
# cpu: "0.25"
|
|
||||||
# memory: 50Mi
|
|
||||||
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: '{{ include "common.names.fullname" . }}-paths'
|
|
||||||
|
|
||||||
probes:
|
|
||||||
liveness:
|
|
||||||
type: HTTP
|
|
||||||
path: /api/health"
|
|
||||||
|
|
||||||
readiness:
|
|
||||||
type: HTTP
|
|
||||||
path: "/api/health"
|
|
||||||
|
|
||||||
startup:
|
|
||||||
type: HTTP
|
|
||||||
path: "/api/health"
|
|
||||||
|
|
||||||
domain: example.com
|
|
||||||
|
|
||||||
##
|
|
||||||
## Server Configuration
|
|
||||||
##
|
|
||||||
server:
|
|
||||||
##
|
|
||||||
## Port sets the configured port for the daemon, service, and the probes.
|
|
||||||
## Default is 9091 and should not need to be changed.
|
|
||||||
##
|
|
||||||
port: 9091
|
|
||||||
|
|
||||||
## Buffers usually should be configured to be the same value.
|
|
||||||
## Explanation at https://www.authelia.com/docs/configuration/server.html
|
|
||||||
## Read buffer size adjusts the server's max incoming request size in bytes.
|
|
||||||
## Write buffer size does the same for outgoing responses.
|
|
||||||
read_buffer_size: 4096
|
|
||||||
write_buffer_size: 4096
|
|
||||||
## Set the single level path Authelia listens on.
|
|
||||||
## Must be alphanumeric chars and should not contain any slashes.
|
|
||||||
path: ""
|
|
||||||
|
|
||||||
log:
|
|
||||||
## Level of verbosity for logs: info, debug, trace.
|
|
||||||
level: trace
|
|
||||||
|
|
||||||
## Format the logs are written as: json, text.
|
|
||||||
format: text
|
|
||||||
|
|
||||||
## TODO: Statefulness check should check if this is set, and the configMap should enable it.
|
|
||||||
## File path where the logs will be written. If not set logs are written to stdout.
|
|
||||||
# file_path: /config/authelia.log
|
|
||||||
|
|
||||||
## Default redirection URL
|
|
||||||
##
|
|
||||||
## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
|
|
||||||
## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
|
|
||||||
## in such a case.
|
|
||||||
##
|
|
||||||
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
|
|
||||||
## Default is https://www.<domain> (value at the top of the values.yaml).
|
|
||||||
default_redirection_url: ""
|
|
||||||
# default_redirection_url: https://example.com
|
|
||||||
|
|
||||||
theme: light
|
|
||||||
|
|
||||||
##
|
|
||||||
## TOTP Configuration
|
|
||||||
##
|
|
||||||
## Parameters used for TOTP generation
|
|
||||||
totp:
|
|
||||||
## The issuer name displayed in the Authenticator application of your choice
|
|
||||||
## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names
|
|
||||||
## Defaults to <domain>.
|
|
||||||
issuer: ""
|
|
||||||
## The period in seconds a one-time password is current for. Changing this will require all users to register
|
|
||||||
## their TOTP applications again. Warning: before changing period read the docs link below.
|
|
||||||
period: 30
|
|
||||||
## The skew controls number of one-time passwords either side of the current one that are valid.
|
|
||||||
## Warning: before changing skew read the docs link below.
|
|
||||||
## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation.
|
|
||||||
skew: 1
|
|
||||||
|
|
||||||
##
|
|
||||||
## Duo Push API Configuration
|
|
||||||
##
|
|
||||||
## Parameters used to contact the Duo API. Those are generated when you protect an application of type
|
|
||||||
## "Partner Auth API" in the management panel.
|
|
||||||
duo_api:
|
|
||||||
enabled: false
|
|
||||||
hostname: api-123456789.example.com
|
|
||||||
integration_key: ABCDEF
|
|
||||||
plain_api_key: ""
|
|
||||||
|
|
||||||
##
|
|
||||||
## Authentication Backend Provider Configuration
|
|
||||||
##
|
|
||||||
## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
|
|
||||||
##
|
|
||||||
## The available providers are: `file`, `ldap`. You must use one and only one of these providers.
|
|
||||||
authentication_backend:
|
|
||||||
## Disable both the HTML element and the API for reset password functionality
|
|
||||||
disable_reset_password: false
|
|
||||||
|
|
||||||
## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
|
|
||||||
## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
|
|
||||||
## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
|
|
||||||
## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
|
|
||||||
## See the below documentation for more information.
|
|
||||||
## Duration Notation docs: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
|
||||||
## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval
|
|
||||||
refresh_interval: 5m
|
|
||||||
|
|
||||||
## LDAP backend configuration.
|
|
||||||
##
|
|
||||||
## This backend allows Authelia to be scaled to more
|
|
||||||
## than one instance and therefore is recommended for
|
|
||||||
## production.
|
|
||||||
ldap:
|
|
||||||
|
|
||||||
## Enable LDAP Backend.
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
|
|
||||||
## Acceptable options are as follows:
|
|
||||||
## - 'activedirectory' - For Microsoft Active Directory.
|
|
||||||
## - 'custom' - For custom specifications of attributes and filters.
|
|
||||||
## This currently defaults to 'custom' to maintain existing behaviour.
|
|
||||||
##
|
|
||||||
## Depending on the option here certain other values in this section have a default value, notably all of the
|
|
||||||
## attribute mappings have a default value that this config overrides, you can read more about these default values
|
|
||||||
## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults
|
|
||||||
implementation: activedirectory
|
|
||||||
|
|
||||||
## The url to the ldap server. Format: <scheme>://<address>[:<port>].
|
|
||||||
## Scheme can be ldap or ldaps in the format (port optional).
|
|
||||||
url: ldap://openldap.default.svc.cluster.local
|
|
||||||
|
|
||||||
## Connection Timeout.
|
|
||||||
timeout: 5s
|
|
||||||
|
|
||||||
## Use StartTLS with the LDAP connection.
|
|
||||||
start_tls: false
|
|
||||||
|
|
||||||
tls:
|
|
||||||
## Server Name for certificate validation (in case it's not set correctly in the URL).
|
|
||||||
server_name: ""
|
|
||||||
|
|
||||||
## Skip verifying the server certificate (to allow a self-signed certificate).
|
|
||||||
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
|
||||||
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
|
||||||
skip_verify: false
|
|
||||||
|
|
||||||
## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
|
|
||||||
minimum_version: TLS1.2
|
|
||||||
|
|
||||||
## The base dn for every LDAP query.
|
|
||||||
base_dn: DC=example,DC=com
|
|
||||||
|
|
||||||
## The attribute holding the username of the user. This attribute is used to populate the username in the session
|
|
||||||
## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
|
|
||||||
## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
|
|
||||||
## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.
|
|
||||||
## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user
|
|
||||||
## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
|
|
||||||
## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
|
|
||||||
## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
|
|
||||||
username_attribute: ""
|
|
||||||
|
|
||||||
## An additional dn to define the scope to all users.
|
|
||||||
additional_users_dn: OU=Users
|
|
||||||
|
|
||||||
## The users filter used in search queries to find the user profile based on input filled in login form.
|
|
||||||
## Various placeholders are available in the user filter:
|
|
||||||
## - {input} is a placeholder replaced by what the user inputs in the login form.
|
|
||||||
## - {username_attribute} is a mandatory placeholder replaced by what is configured in `username_attribute`.
|
|
||||||
## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
|
|
||||||
## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
|
|
||||||
## versions, so please don't use it.
|
|
||||||
##
|
|
||||||
## Recommended settings are as follows:
|
|
||||||
## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
|
|
||||||
## - OpenLDAP:
|
|
||||||
## - (&({username_attribute}={input})(objectClass=person))
|
|
||||||
## - (&({username_attribute}={input})(objectClass=inetOrgPerson))
|
|
||||||
##
|
|
||||||
## To allow sign in both with username and email, one can use a filter like
|
|
||||||
## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
|
|
||||||
users_filter: ""
|
|
||||||
|
|
||||||
## An additional dn to define the scope of groups.
|
|
||||||
additional_groups_dn: OU=Groups
|
|
||||||
|
|
||||||
## The groups filter used in search queries to find the groups of the user.
|
|
||||||
## - {input} is a placeholder replaced by what the user inputs in the login form.
|
|
||||||
## - {username} is a placeholder replace by the username stored in LDAP (based on `username_attribute`).
|
|
||||||
## - {dn} is a matcher replaced by the user distinguished name, aka, user DN.
|
|
||||||
## - {username_attribute} is a placeholder replaced by what is configured in `username_attribute`.
|
|
||||||
## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
|
|
||||||
## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
|
|
||||||
## versions, so please don't use it.
|
|
||||||
## - DON'T USE - {1} is an alias for {username} supported for backward compatibility but it will be deprecated in
|
|
||||||
## later version, so please don't use it.
|
|
||||||
##
|
|
||||||
## If your groups use the `groupOfUniqueNames` structure use this instead:
|
|
||||||
## (&(uniquemember={dn})(objectclass=groupOfUniqueNames))
|
|
||||||
groups_filter: ""
|
|
||||||
|
|
||||||
## The attribute holding the name of the group
|
|
||||||
group_name_attribute: ""
|
|
||||||
|
|
||||||
## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
|
|
||||||
## first one returned by the LDAP server is used.
|
|
||||||
mail_attribute: ""
|
|
||||||
|
|
||||||
## The attribute holding the display name of the user. This will be used to greet an authenticated user.
|
|
||||||
display_name_attribute: ""
|
|
||||||
|
|
||||||
## The username of the admin user.
|
|
||||||
user: CN=Authelia,DC=example,DC=com
|
|
||||||
plain_password: ""
|
|
||||||
|
|
||||||
##
|
|
||||||
## File (Authentication Provider)
|
|
||||||
##
|
|
||||||
## With this backend, the users database is stored in a file which is updated when users reset their passwords.
|
|
||||||
## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
|
|
||||||
## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
|
|
||||||
## implications it is highly recommended you leave the default values. Before considering changing these settings
|
|
||||||
## please read the docs page below:
|
|
||||||
## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning
|
|
||||||
##
|
|
||||||
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
|
||||||
##
|
|
||||||
file:
|
|
||||||
enabled: true
|
|
||||||
path: /config/users_database.yml
|
|
||||||
password:
|
|
||||||
algorithm: argon2id
|
|
||||||
iterations: 1
|
|
||||||
key_length: 32
|
|
||||||
salt_length: 16
|
|
||||||
memory: 1024
|
|
||||||
parallelism: 8
|
|
||||||
|
|
||||||
##
|
|
||||||
## Access Control Configuration
|
|
||||||
##
|
|
||||||
## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
|
|
||||||
##
|
|
||||||
## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
|
|
||||||
## to anyone. Otherwise restrictions follow the rules defined.
|
|
||||||
##
|
|
||||||
## Note: One can use the wildcard * to match any subdomain.
|
|
||||||
## It must stand at the beginning of the pattern. (example: *.mydomain.com)
|
|
||||||
##
|
|
||||||
## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
|
|
||||||
##
|
|
||||||
## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
|
|
||||||
##
|
|
||||||
## - 'domain' defines which domain or set of domains the rule applies to.
|
|
||||||
##
|
|
||||||
## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
|
|
||||||
## provided. If provided, the parameter represents either a user or a group. It should be of the form
|
|
||||||
## 'user:<username>' or 'group:<groupname>'.
|
|
||||||
##
|
|
||||||
## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
|
|
||||||
##
|
|
||||||
## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
|
|
||||||
## is optional and matches any resource if not provided.
|
|
||||||
##
|
|
||||||
## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
|
|
||||||
access_control:
|
|
||||||
## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
|
|
||||||
## resource if there is no policy to be applied to the user.
|
|
||||||
default_policy: deny
|
|
||||||
|
|
||||||
networks: []
|
|
||||||
# networks:
|
|
||||||
# - name: private
|
|
||||||
# networks:
|
|
||||||
# - 10.0.0.0/8
|
|
||||||
# - 172.16.0.0/12
|
|
||||||
# - 192.168.0.0/16
|
|
||||||
# - name: vpn
|
|
||||||
# networks:
|
|
||||||
# - 10.9.0.0/16
|
|
||||||
|
|
||||||
rules: []
|
|
||||||
# rules:
|
|
||||||
# - domain: public.example.com
|
|
||||||
# policy: bypass
|
|
||||||
# - domain: "*.example.com"
|
|
||||||
# policy: bypass
|
|
||||||
# methods:
|
|
||||||
# - OPTIONS
|
|
||||||
# - domain: secure.example.com
|
|
||||||
# policy: one_factor
|
|
||||||
# networks:
|
|
||||||
# - private
|
|
||||||
# - vpn
|
|
||||||
# - 192.168.1.0/24
|
|
||||||
# - 10.0.0.1
|
|
||||||
# - domain:
|
|
||||||
# - secure.example.com
|
|
||||||
# - private.example.com
|
|
||||||
# policy: two_factor
|
|
||||||
# - domain: singlefactor.example.com
|
|
||||||
# policy: one_factor
|
|
||||||
# - domain: "mx2.mail.example.com"
|
|
||||||
# subject: "group:admins"
|
|
||||||
# policy: deny
|
|
||||||
# - domain: "*.example.com"
|
|
||||||
# subject:
|
|
||||||
# - "group:admins"
|
|
||||||
# - "group:moderators"
|
|
||||||
# policy: two_factor
|
|
||||||
# - domain: dev.example.com
|
|
||||||
# resources:
|
|
||||||
# - "^/groups/dev/.*$"
|
|
||||||
# subject: "group:dev"
|
|
||||||
# policy: two_factor
|
|
||||||
# - domain: dev.example.com
|
|
||||||
# resources:
|
|
||||||
# - "^/users/john/.*$"
|
|
||||||
# subject:
|
|
||||||
# - ["group:dev", "user:john"]
|
|
||||||
# - "group:admins"
|
|
||||||
# policy: two_factor
|
|
||||||
# - domain: "{user}.example.com"
|
|
||||||
# policy: bypass
|
|
||||||
|
|
||||||
##
|
|
||||||
## Session Provider Configuration
|
|
||||||
##
|
|
||||||
## The session cookies identify the user once logged in.
|
|
||||||
## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
|
|
||||||
session:
|
|
||||||
## The name of the session cookie. (default: authelia_session).
|
|
||||||
name: authelia_session
|
|
||||||
|
|
||||||
## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
|
|
||||||
## Please read https://www.authelia.com/docs/configuration/session.html#same_site
|
|
||||||
same_site: lax
|
|
||||||
|
|
||||||
## The time in seconds before the cookie expires and session is reset.
|
|
||||||
expiration: 1h
|
|
||||||
|
|
||||||
## The inactivity time in seconds before the session is reset.
|
|
||||||
inactivity: 5m
|
|
||||||
|
|
||||||
## The remember me duration.
|
|
||||||
## Value is in seconds, or duration notation. Value of 0 disables remember me.
|
|
||||||
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
|
||||||
## Longer periods are considered less secure because a stolen cookie will last longer giving attackers more time to
|
|
||||||
## spy or attack. Currently the default is 1M or 1 month.
|
|
||||||
remember_me_duration: 1M
|
|
||||||
|
|
||||||
##
|
|
||||||
## Redis Provider
|
|
||||||
##
|
|
||||||
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
|
||||||
##
|
|
||||||
## The redis connection details
|
|
||||||
redisProvider:
|
|
||||||
port: 6379
|
|
||||||
|
|
||||||
## Optional username to be used with authentication.
|
|
||||||
# username: authelia
|
|
||||||
username: ""
|
|
||||||
|
|
||||||
## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
|
|
||||||
database_index: 0
|
|
||||||
|
|
||||||
## The maximum number of concurrent active connections to Redis.
|
|
||||||
maximum_active_connections: 8
|
|
||||||
|
|
||||||
## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
|
|
||||||
minimum_idle_connections: 0
|
|
||||||
|
|
||||||
## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
|
|
||||||
tls:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
|
|
||||||
server_name: ""
|
|
||||||
|
|
||||||
## Skip verifying the server certificate (to allow a self-signed certificate).
|
|
||||||
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
|
||||||
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
|
||||||
skip_verify: false
|
|
||||||
|
|
||||||
## Minimum TLS version for the connection.
|
|
||||||
minimum_version: TLS1.2
|
|
||||||
|
|
||||||
## The Redis HA configuration options.
|
|
||||||
## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
|
|
||||||
high_availability:
|
|
||||||
enabled: false
|
|
||||||
enabledSecret: false
|
|
||||||
## Sentinel Name / Master Name
|
|
||||||
sentinel_name: mysentinel
|
|
||||||
|
|
||||||
## The additional nodes to pre-seed the redis provider with (for sentinel).
|
|
||||||
## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
|
|
||||||
## For high availability to be used you must have either defined; the host above or at least one node below.
|
|
||||||
nodes: []
|
|
||||||
# nodes:
|
|
||||||
# - host: sentinel-0.databases.svc.cluster.local
|
|
||||||
# port: 26379
|
|
||||||
# - host: sentinel-1.databases.svc.cluster.local
|
|
||||||
# port: 26379
|
|
||||||
|
|
||||||
## Choose the host with the lowest latency.
|
|
||||||
route_by_latency: false
|
|
||||||
|
|
||||||
## Choose the host randomly.
|
|
||||||
route_randomly: false
|
|
||||||
|
|
||||||
##
|
|
||||||
## Regulation Configuration
|
|
||||||
##
|
|
||||||
## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are done
|
|
||||||
## in a short period of time.
|
|
||||||
regulation:
|
|
||||||
## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
|
|
||||||
max_retries: 3
|
|
||||||
|
|
||||||
## The time range during which the user can attempt login before being banned. The user is banned if the
|
|
||||||
## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
|
|
||||||
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
|
||||||
find_time: 2m
|
|
||||||
|
|
||||||
## The length of time before a banned user can login again. Ban Time accepts duration notation.
|
|
||||||
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
|
||||||
ban_time: 5m
|
|
||||||
|
|
||||||
|
|
||||||
##
|
|
||||||
## Storage Provider Configuration
|
|
||||||
##
|
|
||||||
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
|
|
||||||
storage:
|
|
||||||
##
|
|
||||||
## PostgreSQL (Storage Provider)
|
|
||||||
##
|
|
||||||
postgres:
|
|
||||||
port: 5432
|
|
||||||
database: authelia
|
|
||||||
username: authelia
|
|
||||||
sslmode: disable
|
|
||||||
timeout: 5s
|
|
||||||
|
|
||||||
##
|
|
||||||
## Notification Provider
|
|
||||||
##
|
|
||||||
##
|
|
||||||
## Notifications are sent to users when they require a password reset, a u2f registration or a TOTP registration.
|
|
||||||
## The available providers are: filesystem, smtp. You must use one and only one of these providers.
|
|
||||||
notifier:
|
|
||||||
## You can disable the notifier startup check by setting this to true.
|
|
||||||
disable_startup_check: false
|
|
||||||
|
|
||||||
##
|
|
||||||
## File System (Notification Provider)
|
|
||||||
##
|
|
||||||
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
|
||||||
##
|
|
||||||
filesystem:
|
|
||||||
enabled: true
|
|
||||||
filename: /config/notification.txt
|
|
||||||
|
|
||||||
##
|
|
||||||
## SMTP (Notification Provider)
|
|
||||||
##
|
|
||||||
## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.
|
|
||||||
## [Security] By default Authelia will:
|
|
||||||
## - force all SMTP connections over TLS including unauthenticated connections
|
|
||||||
## - use the disable_require_tls boolean value to disable this requirement
|
|
||||||
## (only works for unauthenticated connections)
|
|
||||||
## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
|
|
||||||
## (configure in tls section)
|
|
||||||
smtp:
|
|
||||||
enabled: false
|
|
||||||
enabledSecret: false
|
|
||||||
host: smtp.mail.svc.cluster.local
|
|
||||||
port: 25
|
|
||||||
timeout: 5s
|
|
||||||
username: test
|
|
||||||
plain_password: test
|
|
||||||
sender: admin@example.com
|
|
||||||
## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
|
|
||||||
identifier: localhost
|
|
||||||
## Subject configuration of the emails sent.
|
|
||||||
## {title} is replaced by the text from the notifier
|
|
||||||
subject: "[Authelia] {title}"
|
|
||||||
## This address is used during the startup check to verify the email configuration is correct.
|
|
||||||
## It's not important what it is except if your email server only allows local delivery.
|
|
||||||
startup_check_address: test@authelia.com
|
|
||||||
disable_require_tls: false
|
|
||||||
disable_html_emails: false
|
|
||||||
|
|
||||||
tls:
|
|
||||||
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
|
|
||||||
server_name: ""
|
|
||||||
|
|
||||||
## Skip verifying the server certificate (to allow a self-signed certificate).
|
|
||||||
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
|
||||||
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
|
||||||
skip_verify: false
|
|
||||||
|
|
||||||
## Minimum TLS version for either StartTLS or SMTPS.
|
|
||||||
minimum_version: TLS1.2
|
|
||||||
|
|
||||||
identity_providers:
|
|
||||||
oidc:
|
|
||||||
## Enables this in the config map. Currently in beta stage.
|
|
||||||
## See https://www.authelia.com/docs/configuration/identity-providers/oidc.html#roadmap
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
access_token_lifespan: 1h
|
|
||||||
authorize_code_lifespan: 1m
|
|
||||||
id_token_lifespan: 1h
|
|
||||||
refresh_token_lifespan: 90m
|
|
||||||
|
|
||||||
enable_client_debug_messages: false
|
|
||||||
|
|
||||||
## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for
|
|
||||||
## security reasons.
|
|
||||||
minimum_parameter_entropy: 8
|
|
||||||
|
|
||||||
clients: []
|
|
||||||
# clients:
|
|
||||||
# -
|
|
||||||
## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
|
|
||||||
# id: myapp
|
|
||||||
|
|
||||||
## The description to show to users when they end up on the consent screen. Defaults to the ID above.
|
|
||||||
# description: My Application
|
|
||||||
|
|
||||||
## The client secret is a shared secret between Authelia and the consumer of this client.
|
|
||||||
# secret: apple123
|
|
||||||
|
|
||||||
## Sets the client to public. This should typically not be set, please see the documentation for usage.
|
|
||||||
# public: false
|
|
||||||
|
|
||||||
## The policy to require for this client; one_factor or two_factor.
|
|
||||||
# authorization_policy: two_factor
|
|
||||||
|
|
||||||
## Audience this client is allowed to request.
|
|
||||||
# audience: []
|
|
||||||
|
|
||||||
## Scopes this client is allowed to request.
|
|
||||||
# scopes:
|
|
||||||
# - openid
|
|
||||||
# - profile
|
|
||||||
# - email
|
|
||||||
# - groups
|
|
||||||
|
|
||||||
## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
|
|
||||||
# redirect_uris:
|
|
||||||
# - https://oidc.example.com/oauth2/callback
|
|
||||||
|
|
||||||
## Grant Types configures which grants this client can obtain.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# grant_types:
|
|
||||||
# - refresh_token
|
|
||||||
# - authorization_code
|
|
||||||
|
|
||||||
## Response Types configures which responses this client can be sent.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# response_types:
|
|
||||||
# - code
|
|
||||||
|
|
||||||
## Response Modes configures which response modes this client supports.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# response_modes:
|
|
||||||
# - form_post
|
|
||||||
# - query
|
|
||||||
# - fragment
|
|
||||||
|
|
||||||
## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
|
|
||||||
# userinfo_signing_algorithm: none
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
dependencies:
|
|
||||||
- name: common
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 6.10.7
|
|
||||||
- name: postgresql
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 1.2.4
|
|
||||||
- name: redis
|
|
||||||
repository: https://charts.bitnami.com/bitnami
|
|
||||||
version: 15.0.3
|
|
||||||
digest: sha256:c143830b5616998587eb49dc5674fba102aa344fce208d264cd3ab16d71c4e04
|
|
||||||
generated: "2021-08-28T13:15:17.681484055Z"
|
|
||||||
|
|
@ -1,41 +0,0 @@
|
||||||
apiVersion: v2
|
|
||||||
appVersion: auto
|
|
||||||
dependencies:
|
|
||||||
- name: common
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 6.10.7
|
|
||||||
- condition: postgresql.enabled
|
|
||||||
name: postgresql
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 1.2.4
|
|
||||||
- condition: redis.enabled
|
|
||||||
name: redis
|
|
||||||
repository: https://charts.bitnami.com/bitnami
|
|
||||||
version: 15.0.3
|
|
||||||
deprecated: false
|
|
||||||
description: Authelia is a Single Sign-On Multi-Factor portal for web apps
|
|
||||||
home: https://github.com/truecharts/apps/tree/master/charts/stable/authelia
|
|
||||||
icon: https://avatars2.githubusercontent.com/u/59122411?s=200&v=4
|
|
||||||
keywords:
|
|
||||||
- authelia
|
|
||||||
- authentication
|
|
||||||
- login
|
|
||||||
- SSO
|
|
||||||
- Authentication
|
|
||||||
- Security
|
|
||||||
- Two-Factor
|
|
||||||
- U2F
|
|
||||||
- YubiKey
|
|
||||||
- Push Notifications
|
|
||||||
- LDAP
|
|
||||||
kubeVersion: '>=1.16.0-0'
|
|
||||||
maintainers:
|
|
||||||
- email: info@truecharts.org
|
|
||||||
name: TrueCharts
|
|
||||||
url: truecharts.org
|
|
||||||
name: authelia
|
|
||||||
sources:
|
|
||||||
- https://github.com/authelia/chartrepo
|
|
||||||
- https://github.com/authelia/authelia
|
|
||||||
type: application
|
|
||||||
version: 1.0.2
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
Authelia is a Single Sign-On Multi-Factor portal for web apps
|
|
||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -1,231 +0,0 @@
|
||||||
##
|
|
||||||
# This file contains Values.yaml content that gets added to the output of questions.yaml
|
|
||||||
# It's ONLY meant for content that the user is NOT expected to change.
|
|
||||||
# Example: Everything under "image" is not included in questions.yaml but is included here.
|
|
||||||
##
|
|
||||||
|
|
||||||
image:
|
|
||||||
repository: ghcr.io/authelia/authelia
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
tag: "4.30.4"
|
|
||||||
|
|
||||||
# Enabled postgres
|
|
||||||
postgresql:
|
|
||||||
enabled: true
|
|
||||||
postgresqlUsername: authelia
|
|
||||||
postgresqlDatabase: authelia
|
|
||||||
existingSecret: "{{ .Release.Name }}-dbcreds"
|
|
||||||
persistence:
|
|
||||||
db:
|
|
||||||
storageClass: "SCALE-ZFS"
|
|
||||||
dbbackups:
|
|
||||||
storageClass: "SCALE-ZFS"
|
|
||||||
|
|
||||||
# Enabled redis
|
|
||||||
# ... for more options see https://github.com/bitnami/charts/tree/master/bitnami/redis
|
|
||||||
redis:
|
|
||||||
volumePermissions:
|
|
||||||
enabled: true
|
|
||||||
architecture: standalone
|
|
||||||
enabled: true
|
|
||||||
auth:
|
|
||||||
existingSecret: rediscreds
|
|
||||||
existingSecretPasswordKey: redis-password
|
|
||||||
master:
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
existingClaim: redismaster
|
|
||||||
replica:
|
|
||||||
replicaCount: 0
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: '{{ include "common.names.fullname" . }}-paths'
|
|
||||||
|
|
||||||
probes:
|
|
||||||
liveness:
|
|
||||||
type: HTTP
|
|
||||||
path: /api/health"
|
|
||||||
|
|
||||||
readiness:
|
|
||||||
type: HTTP
|
|
||||||
path: "/api/health"
|
|
||||||
|
|
||||||
startup:
|
|
||||||
type: HTTP
|
|
||||||
path: "/api/health"
|
|
||||||
|
|
||||||
##
|
|
||||||
## Storage Provider Configuration
|
|
||||||
##
|
|
||||||
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
|
|
||||||
storage:
|
|
||||||
##
|
|
||||||
## PostgreSQL (Storage Provider)
|
|
||||||
##
|
|
||||||
postgres:
|
|
||||||
port: 5432
|
|
||||||
database: authelia
|
|
||||||
username: authelia
|
|
||||||
sslmode: disable
|
|
||||||
timeout: 5s
|
|
||||||
|
|
||||||
##
|
|
||||||
## Server Configuration
|
|
||||||
##
|
|
||||||
server:
|
|
||||||
##
|
|
||||||
## Port sets the configured port for the daemon, service, and the probes.
|
|
||||||
## Default is 9091 and should not need to be changed.
|
|
||||||
##
|
|
||||||
port: 9091
|
|
||||||
|
|
||||||
## Buffers usually should be configured to be the same value.
|
|
||||||
## Explanation at https://www.authelia.com/docs/configuration/server.html
|
|
||||||
## Read buffer size adjusts the server's max incoming request size in bytes.
|
|
||||||
## Write buffer size does the same for outgoing responses.
|
|
||||||
read_buffer_size: 4096
|
|
||||||
write_buffer_size: 4096
|
|
||||||
## Set the single level path Authelia listens on.
|
|
||||||
## Must be alphanumeric chars and should not contain any slashes.
|
|
||||||
path: ""
|
|
||||||
|
|
||||||
##
|
|
||||||
## Redis Provider
|
|
||||||
##
|
|
||||||
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
|
||||||
##
|
|
||||||
## The redis connection details
|
|
||||||
redisProvider:
|
|
||||||
port: 6379
|
|
||||||
|
|
||||||
## Optional username to be used with authentication.
|
|
||||||
# username: authelia
|
|
||||||
username: ""
|
|
||||||
|
|
||||||
## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
|
|
||||||
database_index: 0
|
|
||||||
|
|
||||||
## The maximum number of concurrent active connections to Redis.
|
|
||||||
maximum_active_connections: 8
|
|
||||||
|
|
||||||
## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
|
|
||||||
minimum_idle_connections: 0
|
|
||||||
|
|
||||||
## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
|
|
||||||
tls:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
|
|
||||||
server_name: ""
|
|
||||||
|
|
||||||
## Skip verifying the server certificate (to allow a self-signed certificate).
|
|
||||||
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
|
||||||
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
|
||||||
skip_verify: false
|
|
||||||
|
|
||||||
## Minimum TLS version for the connection.
|
|
||||||
minimum_version: TLS1.2
|
|
||||||
|
|
||||||
## The Redis HA configuration options.
|
|
||||||
## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
|
|
||||||
high_availability:
|
|
||||||
enabled: false
|
|
||||||
enabledSecret: false
|
|
||||||
## Sentinel Name / Master Name
|
|
||||||
sentinel_name: mysentinel
|
|
||||||
|
|
||||||
## The additional nodes to pre-seed the redis provider with (for sentinel).
|
|
||||||
## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
|
|
||||||
## For high availability to be used you must have either defined; the host above or at least one node below.
|
|
||||||
nodes: []
|
|
||||||
# nodes:
|
|
||||||
# - host: sentinel-0.databases.svc.cluster.local
|
|
||||||
# port: 26379
|
|
||||||
# - host: sentinel-1.databases.svc.cluster.local
|
|
||||||
# port: 26379
|
|
||||||
|
|
||||||
## Choose the host with the lowest latency.
|
|
||||||
route_by_latency: false
|
|
||||||
|
|
||||||
## Choose the host randomly.
|
|
||||||
route_randomly: false
|
|
||||||
|
|
||||||
identity_providers:
|
|
||||||
oidc:
|
|
||||||
## Enables this in the config map. Currently in beta stage.
|
|
||||||
## See https://www.authelia.com/docs/configuration/identity-providers/oidc.html#roadmap
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
access_token_lifespan: 1h
|
|
||||||
authorize_code_lifespan: 1m
|
|
||||||
id_token_lifespan: 1h
|
|
||||||
refresh_token_lifespan: 90m
|
|
||||||
|
|
||||||
enable_client_debug_messages: false
|
|
||||||
|
|
||||||
## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for
|
|
||||||
## security reasons.
|
|
||||||
minimum_parameter_entropy: 8
|
|
||||||
|
|
||||||
clients: []
|
|
||||||
# clients:
|
|
||||||
# -
|
|
||||||
## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
|
|
||||||
# id: myapp
|
|
||||||
|
|
||||||
## The description to show to users when they end up on the consent screen. Defaults to the ID above.
|
|
||||||
# description: My Application
|
|
||||||
|
|
||||||
## The client secret is a shared secret between Authelia and the consumer of this client.
|
|
||||||
# secret: apple123
|
|
||||||
|
|
||||||
## Sets the client to public. This should typically not be set, please see the documentation for usage.
|
|
||||||
# public: false
|
|
||||||
|
|
||||||
## The policy to require for this client; one_factor or two_factor.
|
|
||||||
# authorization_policy: two_factor
|
|
||||||
|
|
||||||
## Audience this client is allowed to request.
|
|
||||||
# audience: []
|
|
||||||
|
|
||||||
## Scopes this client is allowed to request.
|
|
||||||
# scopes:
|
|
||||||
# - openid
|
|
||||||
# - profile
|
|
||||||
# - email
|
|
||||||
# - groups
|
|
||||||
|
|
||||||
## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
|
|
||||||
# redirect_uris:
|
|
||||||
# - https://oidc.example.com/oauth2/callback
|
|
||||||
|
|
||||||
## Grant Types configures which grants this client can obtain.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# grant_types:
|
|
||||||
# - refresh_token
|
|
||||||
# - authorization_code
|
|
||||||
|
|
||||||
## Response Types configures which responses this client can be sent.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# response_types:
|
|
||||||
# - code
|
|
||||||
|
|
||||||
## Response Modes configures which response modes this client supports.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# response_modes:
|
|
||||||
# - form_post
|
|
||||||
# - query
|
|
||||||
# - fragment
|
|
||||||
|
|
||||||
## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
|
|
||||||
# userinfo_signing_algorithm: none
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
##
|
|
||||||
# Most other defaults are set in questions.yaml
|
|
||||||
# For other options please refer to the wiki, default_values.yaml or the common library chart
|
|
||||||
##
|
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -1,245 +0,0 @@
|
||||||
{{/* Define the configmap */}}
|
|
||||||
{{- define "authelia.configmap" -}}
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: {{ include "common.names.fullname" . }}-paths
|
|
||||||
data:
|
|
||||||
AUTHELIA_SERVER_DISABLE_HEALTHCHECK: "true"
|
|
||||||
AUTHELIA_JWT_SECRET_FILE: "/secrets/JWT_TOKEN"
|
|
||||||
AUTHELIA_SESSION_SECRET_FILE: "/secrets/SESSION_ENCRYPTION_KEY"
|
|
||||||
AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE: "/secrets/STORAGE_PASSWORD"
|
|
||||||
{{- if .Values.authentication_backend.ldap.enabled }}
|
|
||||||
AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE: "/secrets/LDAP_PASSWORD"
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.notifier.smtp.enabled }}
|
|
||||||
AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE: "/secrets/SMTP_PASSWORD"
|
|
||||||
{{- end }}
|
|
||||||
AUTHELIA_SESSION_REDIS_PASSWORD_FILE: "/secrets/REDIS_PASSWORD"
|
|
||||||
{{- if and .Values.redisProvider.high_availability.enabled}}
|
|
||||||
AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE: "/secrets/REDIS_SENTINEL_PASSWORD"
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.duo_api.enabled }}
|
|
||||||
AUTHELIA_DUO_API_SECRET_KEY_FILE: "/secrets/DUO_API_KEY"
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.identity_providers.oidc.enabled }}
|
|
||||||
AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE: "/secrets/OIDC_HMAC_SECRET"
|
|
||||||
AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE: "/secrets/OIDC_PRIVATE_KEY"
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: {{ include "common.names.fullname" . }}-configfile
|
|
||||||
data:
|
|
||||||
configuration.yaml: |
|
|
||||||
---
|
|
||||||
theme: {{ default "light" .Values.theme }}
|
|
||||||
default_redirection_url: {{ default (printf "https://www.%s" .Values.domain) .Values.default_redirection_url }}
|
|
||||||
server:
|
|
||||||
host: 0.0.0.0
|
|
||||||
port: {{ default 9091 .Values.server.port }}
|
|
||||||
{{- if not (eq "" (default "" .Values.server.path)) }}
|
|
||||||
path: {{ .Values.server.path }}
|
|
||||||
{{- end }}
|
|
||||||
read_buffer_size: {{ default 4096 .Values.server.read_buffer_size }}
|
|
||||||
write_buffer_size: {{ default 4096 .Values.server.write_buffer_size }}
|
|
||||||
enable_pprof: {{ default false .Values.server.enable_pprof }}
|
|
||||||
enable_expvars: {{ default false .Values.server.enable_expvars }}
|
|
||||||
log:
|
|
||||||
level: {{ default "info" .Values.log.level }}
|
|
||||||
format: {{ default "text" .Values.log.format }}
|
|
||||||
{{- if not (eq "" (default "" .Values.log.file_path)) }}
|
|
||||||
file_path: {{ .Values.log.file_path }}
|
|
||||||
keep_stdout: true
|
|
||||||
{{- end }}
|
|
||||||
totp:
|
|
||||||
issuer: {{ default .Values.domain .Values.totp.issuer }}
|
|
||||||
period: {{ default 30 .Values.totp.period }}
|
|
||||||
skew: {{ default 1 .Values.totp.skew }}
|
|
||||||
{{- if .Values.duo_api.enabled }}
|
|
||||||
duo_api:
|
|
||||||
hostname: {{ .Values.duo_api.hostname }}
|
|
||||||
integration_key: {{ .Values.duo_api.integration_key }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with $auth := .Values.authentication_backend }}
|
|
||||||
authentication_backend:
|
|
||||||
disable_reset_password: {{ $auth.disable_reset_password }}
|
|
||||||
{{- if $auth.file.enabled }}
|
|
||||||
file:
|
|
||||||
path: {{ $auth.file.path }}
|
|
||||||
password: {{ toYaml $auth.file.password | nindent 10 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.enabled }}
|
|
||||||
ldap:
|
|
||||||
implementation: {{ default "custom" $auth.ldap.implementation }}
|
|
||||||
url: {{ $auth.ldap.url }}
|
|
||||||
timeout: {{ default "5s" $auth.ldap.timeout }}
|
|
||||||
start_tls: {{ $auth.ldap.start_tls }}
|
|
||||||
tls:
|
|
||||||
{{- if hasKey $auth.ldap.tls "server_name" }}
|
|
||||||
server_name: {{ default $auth.ldap.host $auth.ldap.tls.server_name }}
|
|
||||||
{{- end }}
|
|
||||||
minimum_version: {{ default "TLS1.2" $auth.ldap.tls.minimum_version }}
|
|
||||||
skip_verify: {{ default false $auth.ldap.tls.skip_verify }}
|
|
||||||
{{- if $auth.ldap.base_dn }}
|
|
||||||
base_dn: {{ $auth.ldap.base_dn }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.username_attribute }}
|
|
||||||
username_attribute: {{ $auth.ldap.username_attribute }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.additional_users_dn }}
|
|
||||||
additional_users_dn: {{ $auth.ldap.additional_users_dn }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.users_filter }}
|
|
||||||
users_filter: {{ $auth.ldap.users_filter }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.additional_groups_dn }}
|
|
||||||
additional_groups_dn: {{ $auth.ldap.additional_groups_dn }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.groups_filter }}
|
|
||||||
groups_filter: {{ $auth.ldap.groups_filter }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.group_name_attribute }}
|
|
||||||
group_name_attribute: {{ $auth.ldap.group_name_attribute }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.mail_attribute }}
|
|
||||||
mail_attribute: {{ $auth.ldap.mail_attribute }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $auth.ldap.display_name_attribute }}
|
|
||||||
display_name_attribute: {{ $auth.ldap.display_name_attribute }}
|
|
||||||
{{- end }}
|
|
||||||
user: {{ $auth.ldap.user }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with $session := .Values.session }}
|
|
||||||
session:
|
|
||||||
name: {{ default "authelia_session" $session.name }}
|
|
||||||
domain: {{ required "A valid .Values.domain entry required!" $.Values.domain }}
|
|
||||||
same_site: {{ default "lax" $session.same_site }}
|
|
||||||
expiration: {{ default "1M" $session.expiration }}
|
|
||||||
inactivity: {{ default "5m" $session.inactivity }}
|
|
||||||
remember_me_duration: {{ default "1M" $session.remember_me_duration }}
|
|
||||||
{{- end }}
|
|
||||||
redis:
|
|
||||||
host: {{ ( printf "%v-%v" .Release.Name "redis-master" ) }}
|
|
||||||
{{- with $redis := .Values.redisProvider }}
|
|
||||||
port: {{ default 6379 $redis.port }}
|
|
||||||
{{- if not (eq $redis.username "") }}
|
|
||||||
username: {{ $redis.username }}
|
|
||||||
{{- end }}
|
|
||||||
maximum_active_connections: {{ default 8 $redis.maximum_active_connections }}
|
|
||||||
minimum_idle_connections: {{ default 0 $redis.minimum_idle_connections }}
|
|
||||||
{{- if $redis.tls.enabled }}
|
|
||||||
tls:
|
|
||||||
server_name: {{ $redis.tls.server_name }}
|
|
||||||
minimum_version: {{ default "TLS1.2" $redis.tls.minimum_version }}
|
|
||||||
skip_verify: {{ $redis.tls.skip_verify }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $redis.high_availability.enabled }}
|
|
||||||
high_availability:
|
|
||||||
sentinel_name: {{ $redis.high_availability.sentinel_name }}
|
|
||||||
{{- if $redis.high_availability.nodes }}
|
|
||||||
nodes: {{ toYaml $redis.high_availability.nodes | nindent 10 }}
|
|
||||||
{{- end }}
|
|
||||||
route_by_latency: {{ $redis.high_availability.route_by_latency }}
|
|
||||||
route_randomly: {{ $redis.high_availability.route_randomly }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
regulation: {{ toYaml .Values.regulation | nindent 6 }}
|
|
||||||
storage:
|
|
||||||
postgres:
|
|
||||||
host: {{ printf "%v-%v" .Release.Name "postgresql" }}
|
|
||||||
{{- with $storage := .Values.storage }}
|
|
||||||
port: {{ default 5432 $storage.postgres.port }}
|
|
||||||
database: {{ default "authelia" $storage.postgres.database }}
|
|
||||||
username: {{ default "authelia" $storage.postgres.username }}
|
|
||||||
timeout: {{ default "5s" $storage.postgres.timeout }}
|
|
||||||
sslmode: {{ default "disable" $storage.postgres.sslmode }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with $notifier := .Values.notifier }}
|
|
||||||
notifier:
|
|
||||||
disable_startup_check: {{ $.Values.notifier.disable_startup_check }}
|
|
||||||
{{- if $notifier.filesystem.enabled }}
|
|
||||||
filesystem:
|
|
||||||
filename: {{ $notifier.filesystem.filename }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $notifier.smtp.enabled }}
|
|
||||||
smtp:
|
|
||||||
host: {{ $notifier.smtp.host }}
|
|
||||||
port: {{ default 25 $notifier.smtp.port }}
|
|
||||||
timeout: {{ default "5s" $notifier.smtp.timeout }}
|
|
||||||
username: {{ $notifier.smtp.username }}
|
|
||||||
sender: {{ $notifier.smtp.sender }}
|
|
||||||
identifier: {{ $notifier.smtp.identifier }}
|
|
||||||
subject: {{ $notifier.smtp.subject | quote }}
|
|
||||||
startup_check_address: {{ $notifier.smtp.startup_check_address }}
|
|
||||||
disable_require_tls: {{ $notifier.smtp.disable_require_tls }}
|
|
||||||
disable_html_emails: {{ $notifier.smtp.disable_html_emails }}
|
|
||||||
tls:
|
|
||||||
server_name: {{ default $notifier.smtp.host $notifier.smtp.tls.server_name }}
|
|
||||||
minimum_version: {{ default "TLS1.2" $notifier.smtp.tls.minimum_version }}
|
|
||||||
skip_verify: {{ default false $notifier.smtp.tls.skip_verify }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.identity_providers.oidc.enabled }}
|
|
||||||
identity_providers:
|
|
||||||
oidc:
|
|
||||||
access_token_lifespan: {{ default "1h" .Values.identity_providers.oidc.access_token_lifespan }}
|
|
||||||
authorize_code_lifespan: {{ default "1m" .Values.identity_providers.oidc.authorize_code_lifespan }}
|
|
||||||
id_token_lifespan: {{ default "1h" .Values.identity_providers.oidc.id_token_lifespan }}
|
|
||||||
refresh_token_lifespan: {{ default "90m" .Values.identity_providers.oidc.refresh_token_lifespan }}
|
|
||||||
enable_client_debug_messages: {{ default false .Values.identity_providers.oidc.enable_client_debug_messages }}
|
|
||||||
minimum_parameter_entropy: {{ default 8 .Values.identity_providers.oidc.minimum_parameter_entropy }}
|
|
||||||
{{- if gt (len .Values.identity_providers.oidc.clients) 0 }}
|
|
||||||
clients:
|
|
||||||
{{- range $client := .Values.identity_providers.oidc.clients }}
|
|
||||||
- id: {{ $client.id }}
|
|
||||||
description: {{ default $client.id $client.description }}
|
|
||||||
secret: {{ default (randAlphaNum 128) $client.secret }}
|
|
||||||
{{- if hasKey $client "public" }}
|
|
||||||
public: {{ $client.public }}
|
|
||||||
{{- end }}
|
|
||||||
authorization_policy: {{ default "two_factor" $client.authorization_policy }}
|
|
||||||
redirect_uris: {{ toYaml $client.redirect_uris | nindent 10 }}
|
|
||||||
{{- if hasKey $client "audience" }}
|
|
||||||
audience: {{ toYaml $client.audience | nindent 10 }}
|
|
||||||
{{- end }}
|
|
||||||
scopes: {{ toYaml (default (list "openid" "profile" "email" "groups") $client.scopes) | nindent 10 }}
|
|
||||||
grant_types: {{ toYaml (default (list "refresh_token" "authorization_code") $client.grant_types) | nindent 10 }}
|
|
||||||
response_types: {{ toYaml (default (list "code") $client.response_types) | nindent 10 }}
|
|
||||||
{{- if hasKey $client "response_modes" }}
|
|
||||||
response_modes: {{ toYaml $client.response_modes | nindent 10 }}
|
|
||||||
{{- end }}
|
|
||||||
userinfo_signing_algorithm: {{ default "none" $client.userinfo_signing_algorithm }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
access_control:
|
|
||||||
{{- if (eq (len .Values.access_control.rules) 0) }}
|
|
||||||
{{- if (eq .Values.access_control.default_policy "bypass") }}
|
|
||||||
default_policy: one_factor
|
|
||||||
{{- else if (eq .Values.access_control.default_policy "deny") }}
|
|
||||||
default_policy: two_factor
|
|
||||||
{{- else }}
|
|
||||||
default_policy: {{ .Values.access_control.default_policy }}
|
|
||||||
{{- end }}
|
|
||||||
{{- else }}
|
|
||||||
default_policy: {{ .Values.access_control.default_policy }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if (eq (len .Values.access_control.networks) 0) }}
|
|
||||||
networks: []
|
|
||||||
{{- else }}
|
|
||||||
networks: {{ toYaml .Values.access_control.networks | nindent 6 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if (eq (len .Values.access_control.rules) 0) }}
|
|
||||||
rules: []
|
|
||||||
{{- else }}
|
|
||||||
rules: {{ toYaml .Values.access_control.rules | nindent 6 }}
|
|
||||||
{{- end }}
|
|
||||||
...
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,112 +0,0 @@
|
||||||
{{/* Define the secrets */}}
|
|
||||||
{{- define "authelia.secrets" -}}
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
{{- include "common.labels" . | nindent 4 }}
|
|
||||||
name: {{ .Release.Name }}-dbcreds
|
|
||||||
{{- $dbprevious := lookup "v1" "Secret" .Release.Namespace ( ( printf "%v-%v" .Release.Name "dbcreds" ) | quote ) }}
|
|
||||||
{{- $dbPass := "" }}
|
|
||||||
data:
|
|
||||||
{{- if $dbprevious }}
|
|
||||||
postgresql-password: {{ ( index $dbprevious.data "postgresql-password" ) }}
|
|
||||||
postgresql-postgres-password: {{ ( index $dbprevious.data "postgresql-postgres-password" ) }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $dbPass = randAlphaNum 50 }}
|
|
||||||
postgresql-password: {{ $dbPass | b64enc | quote }}
|
|
||||||
postgresql-postgres-password: {{ randAlphaNum 50 | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
url: {{ ( printf "%v%v:%v@%v-%v:%v/%v" "postgresql://" .Values.postgresql.postgresqlUsername $dbPass .Release.Name "postgresql" "5432" .Values.postgresql.postgresqlDatabase ) | b64enc | quote }}
|
|
||||||
type: Opaque
|
|
||||||
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
{{- include "common.labels" . | nindent 4 }}
|
|
||||||
name: rediscreds
|
|
||||||
{{- $redisprevious := lookup "v1" "Secret" .Release.Namespace "rediscreds" }}
|
|
||||||
{{- $redisPass := "" }}
|
|
||||||
{{- $sentinelPass := "" }}
|
|
||||||
data:
|
|
||||||
{{- if $redisprevious }}
|
|
||||||
redis-password: {{ ( index $redisprevious.data "redis-password" ) }}
|
|
||||||
sentinel-password: {{ ( index $redisprevious.data "sentinel-password" ) }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $redisPass = randAlphaNum 50 }}
|
|
||||||
{{- $sentinelPass = randAlphaNum 50 }}
|
|
||||||
redis-password: {{ $redisPass | b64enc | quote }}
|
|
||||||
sentinel-password: {{ $sentinelPass | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
masterhost: {{ ( printf "%v-%v" .Release.Name "redis-master" ) | b64enc | quote }}
|
|
||||||
slavehost: {{ ( printf "%v-%v" .Release.Name "redis-master" ) | b64enc | quote }}
|
|
||||||
type: Opaque
|
|
||||||
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
type: Opaque
|
|
||||||
metadata:
|
|
||||||
name: {{ include "common.names.fullname" . }}-secrets
|
|
||||||
{{- $autheliaprevious := lookup "v1" "Secret" .Release.Namespace ( ( printf "%v-%v" ( ( include "common.names.fullname" . ) | quote ) "-secrets" ) | quote ) }}
|
|
||||||
{{- $oidckey := "" }}
|
|
||||||
{{- $oidcsecret := "" }}
|
|
||||||
{{- $jwtsecret := "" }}
|
|
||||||
{{- $sessionsecret := "" }}
|
|
||||||
data:
|
|
||||||
{{- if $autheliaprevious }}
|
|
||||||
SESSION_ENCRYPTION_KEY: {{ index $autheliaprevious.data "SESSION_ENCRYPTION_KEY" }}
|
|
||||||
JWT_TOKEN: {{ index $autheliaprevious.data "JWT_TOKEN" }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $jwtsecret := randAlphaNum 50 }}
|
|
||||||
{{- $sessionsecret := randAlphaNum 50 }}
|
|
||||||
SESSION_ENCRYPTION_KEY: {{ $jwtsecret | b64enc | quote }}
|
|
||||||
JWT_TOKEN: {{ $jwtsecret | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.authentication_backend.ldap.enabled }}
|
|
||||||
LDAP_PASSWORD: {{ .Values.authentication_backend.ldap.plain_password }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.notifier.smtp.enabled }}
|
|
||||||
SMTP_PASSWORD: {{ .Values.notifier.smtp.plain_password }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.duo_api.enabled }}
|
|
||||||
DUO_API_KEY: {{ .Values.duo_api.plain_api_key | b64enc }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $dbprevious }}
|
|
||||||
STORAGE_PASSWORD: {{ ( index $dbprevious.data "postgresql-password" ) }}
|
|
||||||
{{- else }}
|
|
||||||
STORAGE_PASSWORD: {{ $dbPass | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if $redisprevious }}
|
|
||||||
REDIS_PASSWORD: {{ ( index $redisprevious.data "redis-password" ) }}
|
|
||||||
{{- if .Values.redisProvider.high_availability.enabled}}
|
|
||||||
REDIS_SENTINEL_PASSWORD: {{ ( index $redisprevious.data "sentinel-password" ) }}
|
|
||||||
{{- end }}
|
|
||||||
{{- else }}
|
|
||||||
REDIS_PASSWORD: {{ $redisPass | b64enc | quote }}
|
|
||||||
{{- if .Values.redisProvider.high_availability.enabled}}
|
|
||||||
REDIS_SENTINEL_PASSWORD: {{ $sentinelPass | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.identity_providers.oidc.enabled }}
|
|
||||||
{{- if $autheliaprevious }}
|
|
||||||
OIDC_PRIVATE_KEY: {{ index $autheliaprevious.data "OIDC_PRIVATE_KEY" }}
|
|
||||||
OIDC_HMAC_SECRET: {{index $autheliaprevious.data "OIDC_HMAC_SECRET" }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $oidckey := genPrivateKey "rsa" }}
|
|
||||||
{{- $oidcsecret := randAlphaNum 32 }}
|
|
||||||
OIDC_PRIVATE_KEY: {{ $oidckey | b64enc }}
|
|
||||||
OIDC_HMAC_SECRET: {{ $oidcsecret | b64enc }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,72 +0,0 @@
|
||||||
{{/* Make sure all variables are set properly */}}
|
|
||||||
{{- include "common.values.setup" . }}
|
|
||||||
|
|
||||||
{{/* Render configmap for authelia */}}
|
|
||||||
{{- include "authelia.configmap" . }}
|
|
||||||
|
|
||||||
{{/* Render secrets for authelia */}}
|
|
||||||
{{- include "authelia.secrets" . }}
|
|
||||||
|
|
||||||
{{/* Append the general configMap volume to the volumes */}}
|
|
||||||
{{- define "authelia.configmapVolume" -}}
|
|
||||||
enabled: "true"
|
|
||||||
mountPath: " /configuration.yaml"
|
|
||||||
readOnly: true
|
|
||||||
subPath: configuration.yaml
|
|
||||||
type: "custom"
|
|
||||||
volumeSpec:
|
|
||||||
configMap:
|
|
||||||
name: {{ include "common.names.fullname" . }}-configfile
|
|
||||||
items:
|
|
||||||
- key: configuration.yaml
|
|
||||||
path: configuration.yaml
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/* Append the general secret volumes to the volumes */}}
|
|
||||||
{{- define "authelia.secretVolumes" -}}
|
|
||||||
enabled: "true"
|
|
||||||
mountPath: " /secrets"
|
|
||||||
readOnly: true
|
|
||||||
type: "custom"
|
|
||||||
volumeSpec:
|
|
||||||
secret:
|
|
||||||
secretName: {{ include "common.names.fullname" . }}-secrets
|
|
||||||
items:
|
|
||||||
- key: "JWT_TOKEN"
|
|
||||||
path: JWT_TOKEN
|
|
||||||
- key: "SESSION_ENCRYPTION_KEY"
|
|
||||||
path: SESSION_ENCRYPTION_KEY
|
|
||||||
- key: "STORAGE_PASSWORD"
|
|
||||||
path: STORAGE_PASSWORD
|
|
||||||
{{- if .Values.authentication_backend.ldap.enabled }}
|
|
||||||
- key: "LDAP_PASSWORD"
|
|
||||||
path: LDAP_PASSWORD
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.notifier.smtp.enabled }}
|
|
||||||
- key: "SMTP_PASSWORD"
|
|
||||||
path: SMTP_PASSWORD
|
|
||||||
{{- end }}
|
|
||||||
- key: "REDIS_PASSWORD"
|
|
||||||
path: REDIS_PASSWORD
|
|
||||||
{{- if .Values.redisProvider.high_availability.enabled}}
|
|
||||||
- key: "REDIS_SENTINEL_PASSWORD"
|
|
||||||
path: REDIS_SENTINEL_PASSWORD
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.duo_api.enabled }}
|
|
||||||
- key: "DUO_API_KEY"
|
|
||||||
path: DUO_API_KEY
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.identity_providers.oidc.enabled }}
|
|
||||||
- key: "OIDC_PRIVATE_KEY"
|
|
||||||
path: OIDC_PRIVATE_KEY
|
|
||||||
- key: "OIDC_HMAC_SECRET"
|
|
||||||
path: OIDC_HMAC_SECRET
|
|
||||||
{{- end }}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- $_ := set .Values.persistence "authelia-configfile" (include "authelia.configmapVolume" . | fromYaml) -}}
|
|
||||||
{{- $_ := set .Values.persistence "authelia-secrets" (include "authelia.secretVolumes" . | fromYaml) -}}
|
|
||||||
|
|
||||||
|
|
||||||
{{/* Render the templates */}}
|
|
||||||
{{ include "common.all" . }}
|
|
||||||
|
|
@ -1,662 +0,0 @@
|
||||||
# Default values for Bitwarden.
|
|
||||||
|
|
||||||
image:
|
|
||||||
repository: ghcr.io/authelia/authelia
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
tag: "4.30.4"
|
|
||||||
|
|
||||||
command: ["authelia"]
|
|
||||||
args: ["--config=/configuration.yaml"]
|
|
||||||
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
|
|
||||||
service:
|
|
||||||
main:
|
|
||||||
ports:
|
|
||||||
main:
|
|
||||||
port: 9091
|
|
||||||
|
|
||||||
persistence:
|
|
||||||
config:
|
|
||||||
enabled: true
|
|
||||||
mountPath: "/config"
|
|
||||||
type: pvc
|
|
||||||
accessMode: ReadWriteOnce
|
|
||||||
size: "100Gi"
|
|
||||||
redismaster:
|
|
||||||
noMount: true
|
|
||||||
forceName: "redismaster"
|
|
||||||
enabled: true
|
|
||||||
type: pvc
|
|
||||||
accessMode: ReadWriteOnce
|
|
||||||
size: "100Gi"
|
|
||||||
|
|
||||||
# Enabled postgres
|
|
||||||
postgresql:
|
|
||||||
enabled: true
|
|
||||||
postgresqlUsername: authelia
|
|
||||||
postgresqlDatabase: authelia
|
|
||||||
existingSecret: "{{ .Release.Name }}-dbcreds"
|
|
||||||
|
|
||||||
# Enabled redis
|
|
||||||
# ... for more options see https://github.com/bitnami/charts/tree/master/bitnami/redis
|
|
||||||
redis:
|
|
||||||
volumePermissions:
|
|
||||||
enabled: true
|
|
||||||
architecture: standalone
|
|
||||||
enabled: true
|
|
||||||
auth:
|
|
||||||
existingSecret: rediscreds
|
|
||||||
existingSecretPasswordKey: redis-password
|
|
||||||
master:
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
existingClaim: redismaster
|
|
||||||
replica:
|
|
||||||
replicaCount: 0
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
|
|
||||||
podSecurityContext:
|
|
||||||
runAsUser: 568
|
|
||||||
runAsGroup: 568
|
|
||||||
fsGroup: 568
|
|
||||||
|
|
||||||
securityContext:
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
privileged: false
|
|
||||||
|
|
||||||
|
|
||||||
resources:
|
|
||||||
limits: {}
|
|
||||||
# limits:
|
|
||||||
# cpu: "4.00"
|
|
||||||
# memory: 125Mi
|
|
||||||
requests: {}
|
|
||||||
# requests:
|
|
||||||
# cpu: "0.25"
|
|
||||||
# memory: 50Mi
|
|
||||||
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: '{{ include "common.names.fullname" . }}-paths'
|
|
||||||
|
|
||||||
probes:
|
|
||||||
liveness:
|
|
||||||
type: HTTP
|
|
||||||
path: /api/health"
|
|
||||||
|
|
||||||
readiness:
|
|
||||||
type: HTTP
|
|
||||||
path: "/api/health"
|
|
||||||
|
|
||||||
startup:
|
|
||||||
type: HTTP
|
|
||||||
path: "/api/health"
|
|
||||||
|
|
||||||
domain: example.com
|
|
||||||
|
|
||||||
##
|
|
||||||
## Server Configuration
|
|
||||||
##
|
|
||||||
server:
|
|
||||||
##
|
|
||||||
## Port sets the configured port for the daemon, service, and the probes.
|
|
||||||
## Default is 9091 and should not need to be changed.
|
|
||||||
##
|
|
||||||
port: 9091
|
|
||||||
|
|
||||||
## Buffers usually should be configured to be the same value.
|
|
||||||
## Explanation at https://www.authelia.com/docs/configuration/server.html
|
|
||||||
## Read buffer size adjusts the server's max incoming request size in bytes.
|
|
||||||
## Write buffer size does the same for outgoing responses.
|
|
||||||
read_buffer_size: 4096
|
|
||||||
write_buffer_size: 4096
|
|
||||||
## Set the single level path Authelia listens on.
|
|
||||||
## Must be alphanumeric chars and should not contain any slashes.
|
|
||||||
path: ""
|
|
||||||
|
|
||||||
log:
|
|
||||||
## Level of verbosity for logs: info, debug, trace.
|
|
||||||
level: trace
|
|
||||||
|
|
||||||
## Format the logs are written as: json, text.
|
|
||||||
format: text
|
|
||||||
|
|
||||||
## TODO: Statefulness check should check if this is set, and the configMap should enable it.
|
|
||||||
## File path where the logs will be written. If not set logs are written to stdout.
|
|
||||||
# file_path: /config/authelia.log
|
|
||||||
|
|
||||||
## Default redirection URL
|
|
||||||
##
|
|
||||||
## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
|
|
||||||
## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
|
|
||||||
## in such a case.
|
|
||||||
##
|
|
||||||
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
|
|
||||||
## Default is https://www.<domain> (value at the top of the values.yaml).
|
|
||||||
default_redirection_url: ""
|
|
||||||
# default_redirection_url: https://example.com
|
|
||||||
|
|
||||||
theme: light
|
|
||||||
|
|
||||||
##
|
|
||||||
## TOTP Configuration
|
|
||||||
##
|
|
||||||
## Parameters used for TOTP generation
|
|
||||||
totp:
|
|
||||||
## The issuer name displayed in the Authenticator application of your choice
|
|
||||||
## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names
|
|
||||||
## Defaults to <domain>.
|
|
||||||
issuer: ""
|
|
||||||
## The period in seconds a one-time password is current for. Changing this will require all users to register
|
|
||||||
## their TOTP applications again. Warning: before changing period read the docs link below.
|
|
||||||
period: 30
|
|
||||||
## The skew controls number of one-time passwords either side of the current one that are valid.
|
|
||||||
## Warning: before changing skew read the docs link below.
|
|
||||||
## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation.
|
|
||||||
skew: 1
|
|
||||||
|
|
||||||
##
|
|
||||||
## Duo Push API Configuration
|
|
||||||
##
|
|
||||||
## Parameters used to contact the Duo API. Those are generated when you protect an application of type
|
|
||||||
## "Partner Auth API" in the management panel.
|
|
||||||
duo_api:
|
|
||||||
enabled: false
|
|
||||||
hostname: api-123456789.example.com
|
|
||||||
integration_key: ABCDEF
|
|
||||||
plain_api_key: ""
|
|
||||||
|
|
||||||
##
|
|
||||||
## Authentication Backend Provider Configuration
|
|
||||||
##
|
|
||||||
## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
|
|
||||||
##
|
|
||||||
## The available providers are: `file`, `ldap`. You must use one and only one of these providers.
|
|
||||||
authentication_backend:
|
|
||||||
## Disable both the HTML element and the API for reset password functionality
|
|
||||||
disable_reset_password: false
|
|
||||||
|
|
||||||
## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
|
|
||||||
## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
|
|
||||||
## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
|
|
||||||
## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
|
|
||||||
## See the below documentation for more information.
|
|
||||||
## Duration Notation docs: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
|
||||||
## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval
|
|
||||||
refresh_interval: 5m
|
|
||||||
|
|
||||||
## LDAP backend configuration.
|
|
||||||
##
|
|
||||||
## This backend allows Authelia to be scaled to more
|
|
||||||
## than one instance and therefore is recommended for
|
|
||||||
## production.
|
|
||||||
ldap:
|
|
||||||
|
|
||||||
## Enable LDAP Backend.
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
|
|
||||||
## Acceptable options are as follows:
|
|
||||||
## - 'activedirectory' - For Microsoft Active Directory.
|
|
||||||
## - 'custom' - For custom specifications of attributes and filters.
|
|
||||||
## This currently defaults to 'custom' to maintain existing behaviour.
|
|
||||||
##
|
|
||||||
## Depending on the option here certain other values in this section have a default value, notably all of the
|
|
||||||
## attribute mappings have a default value that this config overrides, you can read more about these default values
|
|
||||||
## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults
|
|
||||||
implementation: activedirectory
|
|
||||||
|
|
||||||
## The url to the ldap server. Format: <scheme>://<address>[:<port>].
|
|
||||||
## Scheme can be ldap or ldaps in the format (port optional).
|
|
||||||
url: ldap://openldap.default.svc.cluster.local
|
|
||||||
|
|
||||||
## Connection Timeout.
|
|
||||||
timeout: 5s
|
|
||||||
|
|
||||||
## Use StartTLS with the LDAP connection.
|
|
||||||
start_tls: false
|
|
||||||
|
|
||||||
tls:
|
|
||||||
## Server Name for certificate validation (in case it's not set correctly in the URL).
|
|
||||||
server_name: ""
|
|
||||||
|
|
||||||
## Skip verifying the server certificate (to allow a self-signed certificate).
|
|
||||||
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
|
||||||
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
|
||||||
skip_verify: false
|
|
||||||
|
|
||||||
## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
|
|
||||||
minimum_version: TLS1.2
|
|
||||||
|
|
||||||
## The base dn for every LDAP query.
|
|
||||||
base_dn: DC=example,DC=com
|
|
||||||
|
|
||||||
## The attribute holding the username of the user. This attribute is used to populate the username in the session
|
|
||||||
## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
|
|
||||||
## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
|
|
||||||
## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.
|
|
||||||
## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user
|
|
||||||
## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
|
|
||||||
## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
|
|
||||||
## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
|
|
||||||
username_attribute: ""
|
|
||||||
|
|
||||||
## An additional dn to define the scope to all users.
|
|
||||||
additional_users_dn: OU=Users
|
|
||||||
|
|
||||||
## The users filter used in search queries to find the user profile based on input filled in login form.
|
|
||||||
## Various placeholders are available in the user filter:
|
|
||||||
## - {input} is a placeholder replaced by what the user inputs in the login form.
|
|
||||||
## - {username_attribute} is a mandatory placeholder replaced by what is configured in `username_attribute`.
|
|
||||||
## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
|
|
||||||
## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
|
|
||||||
## versions, so please don't use it.
|
|
||||||
##
|
|
||||||
## Recommended settings are as follows:
|
|
||||||
## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
|
|
||||||
## - OpenLDAP:
|
|
||||||
## - (&({username_attribute}={input})(objectClass=person))
|
|
||||||
## - (&({username_attribute}={input})(objectClass=inetOrgPerson))
|
|
||||||
##
|
|
||||||
## To allow sign in both with username and email, one can use a filter like
|
|
||||||
## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
|
|
||||||
users_filter: ""
|
|
||||||
|
|
||||||
## An additional dn to define the scope of groups.
|
|
||||||
additional_groups_dn: OU=Groups
|
|
||||||
|
|
||||||
## The groups filter used in search queries to find the groups of the user.
|
|
||||||
## - {input} is a placeholder replaced by what the user inputs in the login form.
|
|
||||||
## - {username} is a placeholder replace by the username stored in LDAP (based on `username_attribute`).
|
|
||||||
## - {dn} is a matcher replaced by the user distinguished name, aka, user DN.
|
|
||||||
## - {username_attribute} is a placeholder replaced by what is configured in `username_attribute`.
|
|
||||||
## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
|
|
||||||
## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
|
|
||||||
## versions, so please don't use it.
|
|
||||||
## - DON'T USE - {1} is an alias for {username} supported for backward compatibility but it will be deprecated in
|
|
||||||
## later version, so please don't use it.
|
|
||||||
##
|
|
||||||
## If your groups use the `groupOfUniqueNames` structure use this instead:
|
|
||||||
## (&(uniquemember={dn})(objectclass=groupOfUniqueNames))
|
|
||||||
groups_filter: ""
|
|
||||||
|
|
||||||
## The attribute holding the name of the group
|
|
||||||
group_name_attribute: ""
|
|
||||||
|
|
||||||
## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
|
|
||||||
## first one returned by the LDAP server is used.
|
|
||||||
mail_attribute: ""
|
|
||||||
|
|
||||||
## The attribute holding the display name of the user. This will be used to greet an authenticated user.
|
|
||||||
display_name_attribute: ""
|
|
||||||
|
|
||||||
## The username of the admin user.
|
|
||||||
user: CN=Authelia,DC=example,DC=com
|
|
||||||
plain_password: ""
|
|
||||||
|
|
||||||
##
|
|
||||||
## File (Authentication Provider)
|
|
||||||
##
|
|
||||||
## With this backend, the users database is stored in a file which is updated when users reset their passwords.
|
|
||||||
## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
|
|
||||||
## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
|
|
||||||
## implications it is highly recommended you leave the default values. Before considering changing these settings
|
|
||||||
## please read the docs page below:
|
|
||||||
## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning
|
|
||||||
##
|
|
||||||
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
|
||||||
##
|
|
||||||
file:
|
|
||||||
enabled: true
|
|
||||||
path: /config/users_database.yml
|
|
||||||
password:
|
|
||||||
algorithm: argon2id
|
|
||||||
iterations: 1
|
|
||||||
key_length: 32
|
|
||||||
salt_length: 16
|
|
||||||
memory: 1024
|
|
||||||
parallelism: 8
|
|
||||||
|
|
||||||
##
|
|
||||||
## Access Control Configuration
|
|
||||||
##
|
|
||||||
## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
|
|
||||||
##
|
|
||||||
## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
|
|
||||||
## to anyone. Otherwise restrictions follow the rules defined.
|
|
||||||
##
|
|
||||||
## Note: One can use the wildcard * to match any subdomain.
|
|
||||||
## It must stand at the beginning of the pattern. (example: *.mydomain.com)
|
|
||||||
##
|
|
||||||
## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
|
|
||||||
##
|
|
||||||
## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
|
|
||||||
##
|
|
||||||
## - 'domain' defines which domain or set of domains the rule applies to.
|
|
||||||
##
|
|
||||||
## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
|
|
||||||
## provided. If provided, the parameter represents either a user or a group. It should be of the form
|
|
||||||
## 'user:<username>' or 'group:<groupname>'.
|
|
||||||
##
|
|
||||||
## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
|
|
||||||
##
|
|
||||||
## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
|
|
||||||
## is optional and matches any resource if not provided.
|
|
||||||
##
|
|
||||||
## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
|
|
||||||
access_control:
|
|
||||||
## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
|
|
||||||
## resource if there is no policy to be applied to the user.
|
|
||||||
default_policy: deny
|
|
||||||
|
|
||||||
networks: []
|
|
||||||
# networks:
|
|
||||||
# - name: private
|
|
||||||
# networks:
|
|
||||||
# - 10.0.0.0/8
|
|
||||||
# - 172.16.0.0/12
|
|
||||||
# - 192.168.0.0/16
|
|
||||||
# - name: vpn
|
|
||||||
# networks:
|
|
||||||
# - 10.9.0.0/16
|
|
||||||
|
|
||||||
rules: []
|
|
||||||
# rules:
|
|
||||||
# - domain: public.example.com
|
|
||||||
# policy: bypass
|
|
||||||
# - domain: "*.example.com"
|
|
||||||
# policy: bypass
|
|
||||||
# methods:
|
|
||||||
# - OPTIONS
|
|
||||||
# - domain: secure.example.com
|
|
||||||
# policy: one_factor
|
|
||||||
# networks:
|
|
||||||
# - private
|
|
||||||
# - vpn
|
|
||||||
# - 192.168.1.0/24
|
|
||||||
# - 10.0.0.1
|
|
||||||
# - domain:
|
|
||||||
# - secure.example.com
|
|
||||||
# - private.example.com
|
|
||||||
# policy: two_factor
|
|
||||||
# - domain: singlefactor.example.com
|
|
||||||
# policy: one_factor
|
|
||||||
# - domain: "mx2.mail.example.com"
|
|
||||||
# subject: "group:admins"
|
|
||||||
# policy: deny
|
|
||||||
# - domain: "*.example.com"
|
|
||||||
# subject:
|
|
||||||
# - "group:admins"
|
|
||||||
# - "group:moderators"
|
|
||||||
# policy: two_factor
|
|
||||||
# - domain: dev.example.com
|
|
||||||
# resources:
|
|
||||||
# - "^/groups/dev/.*$"
|
|
||||||
# subject: "group:dev"
|
|
||||||
# policy: two_factor
|
|
||||||
# - domain: dev.example.com
|
|
||||||
# resources:
|
|
||||||
# - "^/users/john/.*$"
|
|
||||||
# subject:
|
|
||||||
# - ["group:dev", "user:john"]
|
|
||||||
# - "group:admins"
|
|
||||||
# policy: two_factor
|
|
||||||
# - domain: "{user}.example.com"
|
|
||||||
# policy: bypass
|
|
||||||
|
|
||||||
##
|
|
||||||
## Session Provider Configuration
|
|
||||||
##
|
|
||||||
## The session cookies identify the user once logged in.
|
|
||||||
## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
|
|
||||||
session:
|
|
||||||
## The name of the session cookie. (default: authelia_session).
|
|
||||||
name: authelia_session
|
|
||||||
|
|
||||||
## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
|
|
||||||
## Please read https://www.authelia.com/docs/configuration/session.html#same_site
|
|
||||||
same_site: lax
|
|
||||||
|
|
||||||
## The time in seconds before the cookie expires and session is reset.
|
|
||||||
expiration: 1h
|
|
||||||
|
|
||||||
## The inactivity time in seconds before the session is reset.
|
|
||||||
inactivity: 5m
|
|
||||||
|
|
||||||
## The remember me duration.
|
|
||||||
## Value is in seconds, or duration notation. Value of 0 disables remember me.
|
|
||||||
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
|
||||||
## Longer periods are considered less secure because a stolen cookie will last longer giving attackers more time to
|
|
||||||
## spy or attack. Currently the default is 1M or 1 month.
|
|
||||||
remember_me_duration: 1M
|
|
||||||
|
|
||||||
##
|
|
||||||
## Redis Provider
|
|
||||||
##
|
|
||||||
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
|
||||||
##
|
|
||||||
## The redis connection details
|
|
||||||
redisProvider:
|
|
||||||
port: 6379
|
|
||||||
|
|
||||||
## Optional username to be used with authentication.
|
|
||||||
# username: authelia
|
|
||||||
username: ""
|
|
||||||
|
|
||||||
## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
|
|
||||||
database_index: 0
|
|
||||||
|
|
||||||
## The maximum number of concurrent active connections to Redis.
|
|
||||||
maximum_active_connections: 8
|
|
||||||
|
|
||||||
## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
|
|
||||||
minimum_idle_connections: 0
|
|
||||||
|
|
||||||
## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
|
|
||||||
tls:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
|
|
||||||
server_name: ""
|
|
||||||
|
|
||||||
## Skip verifying the server certificate (to allow a self-signed certificate).
|
|
||||||
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
|
||||||
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
|
||||||
skip_verify: false
|
|
||||||
|
|
||||||
## Minimum TLS version for the connection.
|
|
||||||
minimum_version: TLS1.2
|
|
||||||
|
|
||||||
## The Redis HA configuration options.
|
|
||||||
## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
|
|
||||||
high_availability:
|
|
||||||
enabled: false
|
|
||||||
enabledSecret: false
|
|
||||||
## Sentinel Name / Master Name
|
|
||||||
sentinel_name: mysentinel
|
|
||||||
|
|
||||||
## The additional nodes to pre-seed the redis provider with (for sentinel).
|
|
||||||
## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
|
|
||||||
## For high availability to be used you must have either defined; the host above or at least one node below.
|
|
||||||
nodes: []
|
|
||||||
# nodes:
|
|
||||||
# - host: sentinel-0.databases.svc.cluster.local
|
|
||||||
# port: 26379
|
|
||||||
# - host: sentinel-1.databases.svc.cluster.local
|
|
||||||
# port: 26379
|
|
||||||
|
|
||||||
## Choose the host with the lowest latency.
|
|
||||||
route_by_latency: false
|
|
||||||
|
|
||||||
## Choose the host randomly.
|
|
||||||
route_randomly: false
|
|
||||||
|
|
||||||
##
|
|
||||||
## Regulation Configuration
|
|
||||||
##
|
|
||||||
## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are done
|
|
||||||
## in a short period of time.
|
|
||||||
regulation:
|
|
||||||
## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
|
|
||||||
max_retries: 3
|
|
||||||
|
|
||||||
## The time range during which the user can attempt login before being banned. The user is banned if the
|
|
||||||
## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
|
|
||||||
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
|
||||||
find_time: 2m
|
|
||||||
|
|
||||||
## The length of time before a banned user can login again. Ban Time accepts duration notation.
|
|
||||||
## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
|
|
||||||
ban_time: 5m
|
|
||||||
|
|
||||||
|
|
||||||
##
|
|
||||||
## Storage Provider Configuration
|
|
||||||
##
|
|
||||||
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
|
|
||||||
storage:
|
|
||||||
##
|
|
||||||
## PostgreSQL (Storage Provider)
|
|
||||||
##
|
|
||||||
postgres:
|
|
||||||
port: 5432
|
|
||||||
database: authelia
|
|
||||||
username: authelia
|
|
||||||
sslmode: disable
|
|
||||||
timeout: 5s
|
|
||||||
|
|
||||||
##
|
|
||||||
## Notification Provider
|
|
||||||
##
|
|
||||||
##
|
|
||||||
## Notifications are sent to users when they require a password reset, a u2f registration or a TOTP registration.
|
|
||||||
## The available providers are: filesystem, smtp. You must use one and only one of these providers.
|
|
||||||
notifier:
|
|
||||||
## You can disable the notifier startup check by setting this to true.
|
|
||||||
disable_startup_check: false
|
|
||||||
|
|
||||||
##
|
|
||||||
## File System (Notification Provider)
|
|
||||||
##
|
|
||||||
## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
|
|
||||||
##
|
|
||||||
filesystem:
|
|
||||||
enabled: true
|
|
||||||
filename: /config/notification.txt
|
|
||||||
|
|
||||||
##
|
|
||||||
## SMTP (Notification Provider)
|
|
||||||
##
|
|
||||||
## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.
|
|
||||||
## [Security] By default Authelia will:
|
|
||||||
## - force all SMTP connections over TLS including unauthenticated connections
|
|
||||||
## - use the disable_require_tls boolean value to disable this requirement
|
|
||||||
## (only works for unauthenticated connections)
|
|
||||||
## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
|
|
||||||
## (configure in tls section)
|
|
||||||
smtp:
|
|
||||||
enabled: false
|
|
||||||
enabledSecret: false
|
|
||||||
host: smtp.mail.svc.cluster.local
|
|
||||||
port: 25
|
|
||||||
timeout: 5s
|
|
||||||
username: test
|
|
||||||
plain_password: test
|
|
||||||
sender: admin@example.com
|
|
||||||
## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
|
|
||||||
identifier: localhost
|
|
||||||
## Subject configuration of the emails sent.
|
|
||||||
## {title} is replaced by the text from the notifier
|
|
||||||
subject: "[Authelia] {title}"
|
|
||||||
## This address is used during the startup check to verify the email configuration is correct.
|
|
||||||
## It's not important what it is except if your email server only allows local delivery.
|
|
||||||
startup_check_address: test@authelia.com
|
|
||||||
disable_require_tls: false
|
|
||||||
disable_html_emails: false
|
|
||||||
|
|
||||||
tls:
|
|
||||||
## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
|
|
||||||
server_name: ""
|
|
||||||
|
|
||||||
## Skip verifying the server certificate (to allow a self-signed certificate).
|
|
||||||
## In preference to setting this we strongly recommend you add the public portion of the certificate to the
|
|
||||||
## certificates directory which is defined by the `certificates_directory` option at the top of the config.
|
|
||||||
skip_verify: false
|
|
||||||
|
|
||||||
## Minimum TLS version for either StartTLS or SMTPS.
|
|
||||||
minimum_version: TLS1.2
|
|
||||||
|
|
||||||
identity_providers:
|
|
||||||
oidc:
|
|
||||||
## Enables this in the config map. Currently in beta stage.
|
|
||||||
## See https://www.authelia.com/docs/configuration/identity-providers/oidc.html#roadmap
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
access_token_lifespan: 1h
|
|
||||||
authorize_code_lifespan: 1m
|
|
||||||
id_token_lifespan: 1h
|
|
||||||
refresh_token_lifespan: 90m
|
|
||||||
|
|
||||||
enable_client_debug_messages: false
|
|
||||||
|
|
||||||
## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for
|
|
||||||
## security reasons.
|
|
||||||
minimum_parameter_entropy: 8
|
|
||||||
|
|
||||||
clients: []
|
|
||||||
# clients:
|
|
||||||
# -
|
|
||||||
## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
|
|
||||||
# id: myapp
|
|
||||||
|
|
||||||
## The description to show to users when they end up on the consent screen. Defaults to the ID above.
|
|
||||||
# description: My Application
|
|
||||||
|
|
||||||
## The client secret is a shared secret between Authelia and the consumer of this client.
|
|
||||||
# secret: apple123
|
|
||||||
|
|
||||||
## Sets the client to public. This should typically not be set, please see the documentation for usage.
|
|
||||||
# public: false
|
|
||||||
|
|
||||||
## The policy to require for this client; one_factor or two_factor.
|
|
||||||
# authorization_policy: two_factor
|
|
||||||
|
|
||||||
## Audience this client is allowed to request.
|
|
||||||
# audience: []
|
|
||||||
|
|
||||||
## Scopes this client is allowed to request.
|
|
||||||
# scopes:
|
|
||||||
# - openid
|
|
||||||
# - profile
|
|
||||||
# - email
|
|
||||||
# - groups
|
|
||||||
|
|
||||||
## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
|
|
||||||
# redirect_uris:
|
|
||||||
# - https://oidc.example.com/oauth2/callback
|
|
||||||
|
|
||||||
## Grant Types configures which grants this client can obtain.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# grant_types:
|
|
||||||
# - refresh_token
|
|
||||||
# - authorization_code
|
|
||||||
|
|
||||||
## Response Types configures which responses this client can be sent.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# response_types:
|
|
||||||
# - code
|
|
||||||
|
|
||||||
## Response Modes configures which response modes this client supports.
|
|
||||||
## It's not recommended to configure this unless you know what you're doing.
|
|
||||||
# response_modes:
|
|
||||||
# - form_post
|
|
||||||
# - query
|
|
||||||
# - fragment
|
|
||||||
|
|
||||||
## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
|
|
||||||
# userinfo_signing_algorithm: none
|
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
# Configuration Options
|
|
||||||
|
|
||||||
##### Connecting to other apps
|
|
||||||
If you need to connect this App to other Apps on TrueNAS SCALE, please refer to our "Linking Apps Internally" quick-start guide:
|
|
||||||
https://truecharts.org/manual/Quick-Start%20Guides/14-linking-apps/
|
|
||||||
|
|
||||||
##### Available config options
|
|
||||||
In the future this page is going to contain an automated list of options available in the installation/edit UI.
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
dependencies:
|
|
||||||
- name: common
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 6.10.6
|
|
||||||
- name: postgresql
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 1.1.0
|
|
||||||
- name: redis
|
|
||||||
repository: https://charts.bitnami.com/bitnami
|
|
||||||
version: 14.8.11
|
|
||||||
digest: sha256:71e8d9de7d736bd5b9a6a167b86e24b48884272e74a7769e038bf71ad90257d4
|
|
||||||
generated: "2021-08-28T12:12:03.551112773Z"
|
|
||||||
|
|
@ -1,36 +0,0 @@
|
||||||
apiVersion: v2
|
|
||||||
appVersion: auto
|
|
||||||
dependencies:
|
|
||||||
- name: common
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 6.10.6
|
|
||||||
- condition: postgresql.enabled
|
|
||||||
name: postgresql
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 1.1.0
|
|
||||||
- condition: redis.enabled
|
|
||||||
name: redis
|
|
||||||
repository: https://charts.bitnami.com/bitnami
|
|
||||||
version: 14.8.11
|
|
||||||
deprecated: false
|
|
||||||
description: A private cloud server that puts the control and security of your own
|
|
||||||
data back into your hands.
|
|
||||||
home: https://nextcloud.com/
|
|
||||||
icon: https://upload.wikimedia.org/wikipedia/commons/thumb/6/60/Nextcloud_Logo.svg/1280px-Nextcloud_Logo.svg.png
|
|
||||||
keywords:
|
|
||||||
- nextcloud
|
|
||||||
- storage
|
|
||||||
- http
|
|
||||||
- web
|
|
||||||
- php
|
|
||||||
kubeVersion: '>=1.16.0-0'
|
|
||||||
maintainers:
|
|
||||||
- email: info@truecharts.org
|
|
||||||
name: TrueCharts
|
|
||||||
url: truecharts.org
|
|
||||||
name: nextcloud
|
|
||||||
sources:
|
|
||||||
- https://github.com/nextcloud/docker
|
|
||||||
- https://github.com/nextcloud/helm
|
|
||||||
type: application
|
|
||||||
version: 2.3.2
|
|
||||||
|
|
@ -1,45 +0,0 @@
|
||||||
# Introduction
|
|
||||||
|
|
||||||
  
|
|
||||||
|
|
||||||
A private cloud server that puts the control and security of your own data back into your hands.
|
|
||||||
|
|
||||||
TrueCharts are designed to be installed as TrueNAS SCALE app only. We can not guarantee this charts works as a stand-alone helm installation.
|
|
||||||
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/apps/issues/new/choose)**
|
|
||||||
|
|
||||||
## Source Code
|
|
||||||
|
|
||||||
* <https://github.com/nextcloud/docker>
|
|
||||||
* <https://github.com/nextcloud/helm>
|
|
||||||
|
|
||||||
## Requirements
|
|
||||||
|
|
||||||
Kubernetes: `>=1.16.0-0`
|
|
||||||
|
|
||||||
## Dependencies
|
|
||||||
|
|
||||||
| Repository | Name | Version |
|
|
||||||
|------------|------|---------|
|
|
||||||
| https://charts.bitnami.com/bitnami | redis | 14.8.11 |
|
|
||||||
| https://truecharts.org/ | common | 6.10.6 |
|
|
||||||
| https://truecharts.org/ | postgresql | 1.1.0 |
|
|
||||||
|
|
||||||
## Installing the Chart
|
|
||||||
|
|
||||||
To install this App on TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/03-Installing-an-App/).
|
|
||||||
|
|
||||||
## Uninstalling the Chart
|
|
||||||
|
|
||||||
To remove this App from TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/07-Deleting-an-App/).
|
|
||||||
|
|
||||||
## Support
|
|
||||||
|
|
||||||
- Please check our [quick-start guides](https://truecharts.org/manual/Quick-Start%20Guides/01-Open-Apps/) first.
|
|
||||||
- See the [Wiki](https://truecharts.org)
|
|
||||||
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
|
||||||
- Open a [issue](https://github.com/truecharts/apps/issues/new/choose)
|
|
||||||
- Ask a [question](https://github.com/truecharts/apps/discussions)
|
|
||||||
|
|
||||||
----------------------------------------------
|
|
||||||
Autogenerated from chart metadata using [helm-docs v1.5.0](https://github.com/norwoodj/helm-docs/releases/v1.5.0)
|
|
||||||
All Rights Reserved - The TrueCharts Project
|
|
||||||
|
|
@ -1,4 +0,0 @@
|
||||||
A private cloud server that puts the control and security of your own data back into your hands.
|
|
||||||
|
|
||||||
This App is supplied by TrueCharts, for more information please visit https://truecharts.org
|
|
||||||
A private cloud server that puts the control and security of your own
|
|
||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -1,187 +0,0 @@
|
||||||
##
|
|
||||||
# This file contains Values.yaml content that gets added to the output of questions.yaml
|
|
||||||
# It's ONLY meant for content that the user is NOT expected to change.
|
|
||||||
# Example: Everything under "image" is not included in questions.yaml but is included here.
|
|
||||||
##
|
|
||||||
|
|
||||||
image:
|
|
||||||
repository: nextcloud
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
tag: 22.1.0
|
|
||||||
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
|
|
||||||
env: {}
|
|
||||||
|
|
||||||
|
|
||||||
envTpl:
|
|
||||||
POSTGRES_DB: "{{ .Values.postgresql.postgresqlDatabase }}"
|
|
||||||
POSTGRES_USER: "{{ .Values.postgresql.postgresqlUsername }}"
|
|
||||||
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: nextcloudconfig
|
|
||||||
|
|
||||||
envValueFrom:
|
|
||||||
POSTGRES_PASSWORD:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: postgresql-password
|
|
||||||
POSTGRES_HOST:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: host
|
|
||||||
REDIS_HOST:
|
|
||||||
secretKeyRef:
|
|
||||||
name: rediscreds
|
|
||||||
key: masterhost
|
|
||||||
REDIS_HOST_PASSWORD:
|
|
||||||
secretKeyRef:
|
|
||||||
name: rediscreds
|
|
||||||
key: redis-password
|
|
||||||
|
|
||||||
initContainers:
|
|
||||||
- name: init-postgresdb
|
|
||||||
image: postgres:13.1
|
|
||||||
command:
|
|
||||||
- "sh"
|
|
||||||
- "-c"
|
|
||||||
- "until pg_isready -U nextcloud -h ${pghost} ; do sleep 2 ; done"
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
env:
|
|
||||||
- name: pghost
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: plainhost
|
|
||||||
|
|
||||||
additionalContainers:
|
|
||||||
- name: hpb
|
|
||||||
image: nextcloud:21.0.2
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
command:
|
|
||||||
- "/bin/bash"
|
|
||||||
- "-c"
|
|
||||||
- "--"
|
|
||||||
args:
|
|
||||||
- 'while [ ! -f "/var/www/html/custom_apps/notify_push/bin/x86_64/notify_push" ]; do sleep 30; echo "notify_push not found, waiting"; done && /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push /var/www/html/config/config.php'
|
|
||||||
env:
|
|
||||||
- name: PORT
|
|
||||||
value: "7867"
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: hpbconfig
|
|
||||||
ports:
|
|
||||||
- name: hpb
|
|
||||||
containerPort: 7867
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /var/www/html
|
|
||||||
name: data
|
|
||||||
securityContext:
|
|
||||||
runAsUser: 33
|
|
||||||
runAsGroup: 33
|
|
||||||
|
|
||||||
# -- Probe configuration
|
|
||||||
# -- [[ref]](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/)
|
|
||||||
# @default -- See below
|
|
||||||
probes:
|
|
||||||
# -- Liveness probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
liveness:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
# -- Redainess probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
readiness:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
# -- Startup probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
startup:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
## Cronjob to execute Nextcloud background tasks
|
|
||||||
## ref: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/background_jobs_configuration.html#webcron
|
|
||||||
##
|
|
||||||
cronjob:
|
|
||||||
# Every 5 minutes
|
|
||||||
# Note: Setting this to any any other value than 5 minutes might
|
|
||||||
# cause issues with how nextcloud background jobs are executed
|
|
||||||
schedule: "*/5 * * * *"
|
|
||||||
annotations: {}
|
|
||||||
failedJobsHistoryLimit: 5
|
|
||||||
successfulJobsHistoryLimit: 2
|
|
||||||
|
|
||||||
# Enabled postgres
|
|
||||||
postgresql:
|
|
||||||
enabled: true
|
|
||||||
postgresqlUsername: nextcloud
|
|
||||||
postgresqlDatabase: nextcloud
|
|
||||||
existingSecret: dbcreds
|
|
||||||
persistence:
|
|
||||||
db:
|
|
||||||
storageClass: "SCALE-ZFS"
|
|
||||||
dbbackups:
|
|
||||||
storageClass: "SCALE-ZFS"
|
|
||||||
|
|
||||||
# Enabled redis
|
|
||||||
# ... for more options see https://github.com/bitnami/charts/tree/master/bitnami/redis
|
|
||||||
redis:
|
|
||||||
architecture: standalone
|
|
||||||
enabled: true
|
|
||||||
auth:
|
|
||||||
existingSecret: rediscreds
|
|
||||||
existingSecretPasswordKey: redis-password
|
|
||||||
master:
|
|
||||||
persistence:
|
|
||||||
enabled: true
|
|
||||||
existingClaim: redismaster
|
|
||||||
replica:
|
|
||||||
replicaCount: 0
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
##
|
|
||||||
# Most other defaults are set in questions.yaml
|
|
||||||
# For other options please refer to the wiki, default_values.yaml or the common library chart
|
|
||||||
##
|
|
||||||
|
|
@ -1,971 +0,0 @@
|
||||||
groups:
|
|
||||||
- name: "Container Image"
|
|
||||||
description: "Image to be used for container"
|
|
||||||
- name: "Controller"
|
|
||||||
description: "Configure workload deployment"
|
|
||||||
- name: "Container Configuration"
|
|
||||||
description: "additional container configuration"
|
|
||||||
- name: "App Configuration"
|
|
||||||
description: "App specific config options"
|
|
||||||
- name: "Networking and Services"
|
|
||||||
description: "Configure Network and Services for container"
|
|
||||||
- name: "Storage and Persistence"
|
|
||||||
description: "Persist and share data that is separate from the container"
|
|
||||||
- name: "Ingress"
|
|
||||||
description: "Ingress Configuration"
|
|
||||||
- name: "Security and Permissions"
|
|
||||||
description: "Configure security context and permissions"
|
|
||||||
- name: "Resources and Devices"
|
|
||||||
description: "Specify resources/devices to be allocated to workload"
|
|
||||||
- name: "Advanced"
|
|
||||||
description: "Advanced Configuration"
|
|
||||||
portals:
|
|
||||||
web_portal:
|
|
||||||
protocols:
|
|
||||||
- "$kubernetes-resource_configmap_portal_protocol"
|
|
||||||
host:
|
|
||||||
- "$kubernetes-resource_configmap_portal_host"
|
|
||||||
ports:
|
|
||||||
- "$kubernetes-resource_configmap_portal_port"
|
|
||||||
questions:
|
|
||||||
- variable: portal
|
|
||||||
group: "Container Image"
|
|
||||||
label: "Configure Portal Button"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
hidden: true
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable"
|
|
||||||
description: "enable the portal button"
|
|
||||||
schema:
|
|
||||||
hidden: true
|
|
||||||
editable: false
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
- variable: controller
|
|
||||||
group: "Controller"
|
|
||||||
label: ""
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: type
|
|
||||||
description: "Please specify type of workload to deploy"
|
|
||||||
label: "(Advanced) Controller Type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "deployment"
|
|
||||||
required: true
|
|
||||||
enum:
|
|
||||||
- value: "deployment"
|
|
||||||
description: "Deployment"
|
|
||||||
- value: "statefulset"
|
|
||||||
description: "Statefulset"
|
|
||||||
- value: "daemonset"
|
|
||||||
description: "Daemonset"
|
|
||||||
- variable: replicas
|
|
||||||
description: "Number of desired pod replicas"
|
|
||||||
label: "Desired Replicas"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 1
|
|
||||||
required: true
|
|
||||||
- variable: strategy
|
|
||||||
description: "Please specify type of workload to deploy"
|
|
||||||
label: "(Advanced) Update Strategy"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "Recreate"
|
|
||||||
required: true
|
|
||||||
enum:
|
|
||||||
- value: "Recreate"
|
|
||||||
description: "Recreate: Kill existing pods before creating new ones"
|
|
||||||
- value: "RollingUpdate"
|
|
||||||
description: "RollingUpdate: Create new pods and then kill old ones"
|
|
||||||
- value: "OnDelete"
|
|
||||||
description: "(Legacy) OnDelete: ignore .spec.template changes"
|
|
||||||
|
|
||||||
- variable: env
|
|
||||||
group: "Container Configuration"
|
|
||||||
label: "Image Environment"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: TZ
|
|
||||||
label: "Timezone"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "Etc/UTC"
|
|
||||||
$ref:
|
|
||||||
- "definitions/timezone"
|
|
||||||
- variable: UMASK
|
|
||||||
label: "UMASK"
|
|
||||||
description: "Sets the UMASK env var for LinuxServer.io (compatible) containers"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "002"
|
|
||||||
- variable: NEXTCLOUD_ADMIN_USER
|
|
||||||
label: "NEXTCLOUD_ADMIN_USER"
|
|
||||||
description: "Sets nextcloud admin username"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: ""
|
|
||||||
- variable: NEXTCLOUD_ADMIN_PASSWORD
|
|
||||||
label: "NEXTCLOUD_ADMIN_PASSWORD"
|
|
||||||
description: "Sets nextcloud admin password"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: ""
|
|
||||||
- variable: TRUSTED_PROXIES
|
|
||||||
label: "TRUSTED_PROXIES"
|
|
||||||
description: "Sets nextcloud Trusted Proxies"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "172.16.0.0/16"
|
|
||||||
- variable: NODE_IP
|
|
||||||
label: "NODE_IP"
|
|
||||||
description: "Sets nextcloud nodeip for nodeport connections"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
$ref:
|
|
||||||
- "definitions/nodeIP"
|
|
||||||
|
|
||||||
|
|
||||||
# Configure Enviroment Variables
|
|
||||||
- variable: envList
|
|
||||||
label: "Image environment"
|
|
||||||
group: "Container Configuration"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: envItem
|
|
||||||
label: "Environment Variable"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: name
|
|
||||||
label: "Name"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
- variable: value
|
|
||||||
label: "Value"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
|
|
||||||
- variable: hostNetwork
|
|
||||||
group: "Networking and Services"
|
|
||||||
label: "Enable Host Networking"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
|
|
||||||
- variable: service
|
|
||||||
group: "Networking and Services"
|
|
||||||
label: "Configure Service(s)"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: main
|
|
||||||
label: "Main Service"
|
|
||||||
description: "The Primary service on which the healthcheck runs, often the webUI"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the service"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
hidden: true
|
|
||||||
- variable: type
|
|
||||||
label: "Service Type"
|
|
||||||
description: "ClusterIP's are only internally available, nodePorts expose the container to the host node System, Loadbalancer exposes the service using the system loadbalancer"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "NodePort"
|
|
||||||
enum:
|
|
||||||
- value: "NodePort"
|
|
||||||
description: "NodePort"
|
|
||||||
- value: "ClusterIP"
|
|
||||||
description: "ClusterIP"
|
|
||||||
- value: "LoadBalancer"
|
|
||||||
description: "LoadBalancer"
|
|
||||||
- variable: loadBalancerIP
|
|
||||||
label: "LoadBalancer IP"
|
|
||||||
description: "LoadBalancerIP"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "LoadBalancer"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
- variable: externalIPs
|
|
||||||
label: "External IP's"
|
|
||||||
description: "External IP's"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "LoadBalancer"]]
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: externalIP
|
|
||||||
label: "External IP"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
- variable: ports
|
|
||||||
label: "Service's Port(s) Configuration"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: main
|
|
||||||
label: "Main Service Port Configuration"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the port"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
hidden: true
|
|
||||||
- variable: protocol
|
|
||||||
label: "Port Type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "HTTP"
|
|
||||||
enum:
|
|
||||||
- value: HTTP
|
|
||||||
description: "HTTP"
|
|
||||||
- value: "HTTPS"
|
|
||||||
description: "HTTPS"
|
|
||||||
- value: TCP
|
|
||||||
description: "TCP"
|
|
||||||
- value: "UDP"
|
|
||||||
description: "UDP"
|
|
||||||
- variable: port
|
|
||||||
label: "Container Port"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 80
|
|
||||||
editable: false
|
|
||||||
hidden: true
|
|
||||||
- variable: targetport
|
|
||||||
label: "Target Port"
|
|
||||||
description: "This port exposes the container port on the service"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 80
|
|
||||||
editable: true
|
|
||||||
required: true
|
|
||||||
- variable: nodePort
|
|
||||||
label: "Node Port (Optional)"
|
|
||||||
description: "This port gets exposed to the node. Only considered when service type is NodePort"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
min: 9000
|
|
||||||
max: 65535
|
|
||||||
default: 36091
|
|
||||||
required: true
|
|
||||||
- variable: hpb
|
|
||||||
label: "High Performance Backend Service"
|
|
||||||
description: "The service which runs the High Performance Backend"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the service"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
- variable: type
|
|
||||||
label: "Service Type"
|
|
||||||
description: "ClusterIP's are only internally available, nodePorts expose the container to the host node System, Loadbalancer exposes the service using the system loadbalancer"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "NodePort"
|
|
||||||
enum:
|
|
||||||
- value: "NodePort"
|
|
||||||
description: "NodePort"
|
|
||||||
- value: "ClusterIP"
|
|
||||||
description: "ClusterIP"
|
|
||||||
- value: "LoadBalancer"
|
|
||||||
description: "LoadBalancer"
|
|
||||||
- variable: loadBalancerIP
|
|
||||||
label: "LoadBalancer IP"
|
|
||||||
description: "LoadBalancerIP"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "LoadBalancer"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
- variable: externalIPs
|
|
||||||
label: "External IP's"
|
|
||||||
description: "External IP's"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "LoadBalancer"]]
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: externalIP
|
|
||||||
label: "External IP"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
- variable: ports
|
|
||||||
label: "Service's Port(s) Configuration"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: hpb
|
|
||||||
label: "Main Service Port Configuration"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the port"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
hidden: true
|
|
||||||
- variable: protocol
|
|
||||||
label: "Port Type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "HTTP"
|
|
||||||
enum:
|
|
||||||
- value: HTTP
|
|
||||||
description: "HTTP"
|
|
||||||
- value: "HTTPS"
|
|
||||||
description: "HTTPS"
|
|
||||||
- value: TCP
|
|
||||||
description: "TCP"
|
|
||||||
- value: "UDP"
|
|
||||||
description: "UDP"
|
|
||||||
- variable: port
|
|
||||||
label: "Container Port"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 7867
|
|
||||||
editable: false
|
|
||||||
hidden: true
|
|
||||||
- variable: targetport
|
|
||||||
label: "Target Port"
|
|
||||||
description: "This port exposes the container port on the service"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 7867
|
|
||||||
editable: true
|
|
||||||
required: true
|
|
||||||
- variable: nodePort
|
|
||||||
label: "Node Port (Optional)"
|
|
||||||
description: "This port gets exposed to the node. Only considered when service type is NodePort"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
min: 9000
|
|
||||||
max: 65535
|
|
||||||
default: 36092
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- variable: persistence
|
|
||||||
label: "Integrated Persistent Storage"
|
|
||||||
description: "Integrated Persistent Storage"
|
|
||||||
group: "Storage and Persistence"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: data
|
|
||||||
label: "App Data Storage"
|
|
||||||
description: "Stores the Application Data."
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the storage"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
- variable: type
|
|
||||||
label: "(Advanced) Type of Storage"
|
|
||||||
description: "Sets the persistence type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "pvc"
|
|
||||||
enum:
|
|
||||||
- value: "pvc"
|
|
||||||
description: "pvc"
|
|
||||||
- value: "emptyDir"
|
|
||||||
description: "emptyDir"
|
|
||||||
- value: "hostPath"
|
|
||||||
description: "hostPath"
|
|
||||||
- variable: storageClass
|
|
||||||
label: "(Advanced) storageClass"
|
|
||||||
description: " Warning: Anything other than SCALE-ZFS will break rollback!"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "SCALE-ZFS"
|
|
||||||
- variable: setPermissions
|
|
||||||
label: "Automatic Permissions"
|
|
||||||
description: "Automatically set permissions on install"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
- variable: readOnly
|
|
||||||
label: "readOnly"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
- variable: hostPath
|
|
||||||
label: "hostPath"
|
|
||||||
description: "Path inside the container the storage is mounted"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: hostpath
|
|
||||||
- variable: hostPathType
|
|
||||||
label: "hostPath Type"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
enum:
|
|
||||||
- value: ""
|
|
||||||
description: "Default"
|
|
||||||
- value: "DirectoryOrCreate"
|
|
||||||
description: "DirectoryOrCreate"
|
|
||||||
- value: "Directory"
|
|
||||||
description: "Directory"
|
|
||||||
- value: "FileOrCreate"
|
|
||||||
description: "FileOrCreate"
|
|
||||||
- value: "File"
|
|
||||||
description: "File"
|
|
||||||
- value: "Socket"
|
|
||||||
description: "Socket"
|
|
||||||
- value: "CharDevice"
|
|
||||||
description: "CharDevice"
|
|
||||||
- value: "BlockDevice"
|
|
||||||
description: "BlockDevice"
|
|
||||||
- variable: mountPath
|
|
||||||
label: "mountPath"
|
|
||||||
description: "Path inside the container the storage is mounted"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "/var/www/html"
|
|
||||||
hidden: true
|
|
||||||
- variable: medium
|
|
||||||
label: "EmptyDir Medium"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "emptyDir"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
enum:
|
|
||||||
- value: ""
|
|
||||||
description: "Default"
|
|
||||||
- value: "Memory"
|
|
||||||
description: "Memory"
|
|
||||||
- variable: accessMode
|
|
||||||
label: "Access Mode (Advanced)"
|
|
||||||
description: "Allow or disallow multiple PVC's writhing to the same PV"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "ReadWriteOnce"
|
|
||||||
enum:
|
|
||||||
- value: "ReadWriteOnce"
|
|
||||||
description: "ReadWriteOnce"
|
|
||||||
- value: "ReadOnlyMany"
|
|
||||||
description: "ReadOnlyMany"
|
|
||||||
- value: "ReadWriteMany"
|
|
||||||
description: "ReadWriteMany"
|
|
||||||
- variable: size
|
|
||||||
label: "Size quotum of storage"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "100Gi"
|
|
||||||
- variable: redismaster
|
|
||||||
label: "Redis Storage"
|
|
||||||
description: "Stores the Application redis-master-database."
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the storage"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
hidden: true
|
|
||||||
- variable: noMount
|
|
||||||
label: "Do not mount this storage inside the main pod"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
hidden: true
|
|
||||||
- variable: forceName
|
|
||||||
label: "Override PVC Name (advanced)"
|
|
||||||
description: "Forces a certain name for the PVC"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "redismaster"
|
|
||||||
hidden: true
|
|
||||||
- variable: type
|
|
||||||
label: "(Advanced) Type of Storage"
|
|
||||||
description: "Sets the persistence type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "pvc"
|
|
||||||
hidden: true
|
|
||||||
enum:
|
|
||||||
- value: "pvc"
|
|
||||||
description: "pvc"
|
|
||||||
- value: "emptyDir"
|
|
||||||
description: "emptyDir"
|
|
||||||
- value: "hostPath"
|
|
||||||
description: "hostPath"
|
|
||||||
- variable: storageClass
|
|
||||||
label: "(Advanced) storageClass"
|
|
||||||
description: " Warning: Anything other than SCALE-ZFS will break rollback!"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "SCALE-ZFS"
|
|
||||||
- variable: mountPath
|
|
||||||
label: "mountPath"
|
|
||||||
description: "Path inside the container the storage is mounted"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
hidden: true
|
|
||||||
- variable: medium
|
|
||||||
label: "EmptyDir Medium"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "emptyDir"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
enum:
|
|
||||||
- value: ""
|
|
||||||
description: "Default"
|
|
||||||
- value: "Memory"
|
|
||||||
description: "Memory"
|
|
||||||
- variable: accessMode
|
|
||||||
label: "Access Mode (Advanced)"
|
|
||||||
description: "Allow or disallow multiple PVC's writhing to the same PV"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "ReadWriteOnce"
|
|
||||||
enum:
|
|
||||||
- value: "ReadWriteOnce"
|
|
||||||
description: "ReadWriteOnce"
|
|
||||||
- value: "ReadOnlyMany"
|
|
||||||
description: "ReadOnlyMany"
|
|
||||||
- value: "ReadWriteMany"
|
|
||||||
description: "ReadWriteMany"
|
|
||||||
- variable: size
|
|
||||||
label: "Size quotum of storage"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "100Gi"
|
|
||||||
|
|
||||||
- variable: persistenceList
|
|
||||||
label: "Additional app storage"
|
|
||||||
group: "Storage and Persistence"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: persistenceListEntry
|
|
||||||
label: "Custom Storage"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the storage"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
- variable: type
|
|
||||||
label: "(Advanced) Type of Storage"
|
|
||||||
description: "Sets the persistence type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "hostPath"
|
|
||||||
enum:
|
|
||||||
- value: "pvc"
|
|
||||||
description: "pvc"
|
|
||||||
- value: "emptyDir"
|
|
||||||
description: "emptyDir"
|
|
||||||
- value: "hostPath"
|
|
||||||
description: "hostPath"
|
|
||||||
- variable: storageClass
|
|
||||||
label: "(Advanced) storageClass"
|
|
||||||
description: " Warning: Anything other than SCALE-ZFS will break rollback!"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "SCALE-ZFS"
|
|
||||||
- variable: setPermissions
|
|
||||||
label: "Automatic Permissions"
|
|
||||||
description: "Automatically set permissions on install"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
- variable: readOnly
|
|
||||||
label: "readOnly"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
- variable: hostPath
|
|
||||||
label: "hostPath"
|
|
||||||
description: "Path inside the container the storage is mounted"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: hostpath
|
|
||||||
- variable: hostPathType
|
|
||||||
label: "hostPath Type"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
enum:
|
|
||||||
- value: ""
|
|
||||||
description: "Default"
|
|
||||||
- value: "DirectoryOrCreate"
|
|
||||||
description: "DirectoryOrCreate"
|
|
||||||
- value: "Directory"
|
|
||||||
description: "Directory"
|
|
||||||
- value: "FileOrCreate"
|
|
||||||
description: "FileOrCreate"
|
|
||||||
- value: "File"
|
|
||||||
description: "File"
|
|
||||||
- value: "Socket"
|
|
||||||
description: "Socket"
|
|
||||||
- value: "CharDevice"
|
|
||||||
description: "CharDevice"
|
|
||||||
- value: "BlockDevice"
|
|
||||||
description: "BlockDevice"
|
|
||||||
- variable: mountPath
|
|
||||||
label: "mountPath"
|
|
||||||
description: "Path inside the container the storage is mounted"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: ""
|
|
||||||
- variable: medium
|
|
||||||
label: "EmptyDir Medium"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "emptyDir"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
enum:
|
|
||||||
- value: ""
|
|
||||||
description: "Default"
|
|
||||||
- value: "Memory"
|
|
||||||
description: "Memory"
|
|
||||||
- variable: accessMode
|
|
||||||
label: "Access Mode (Advanced)"
|
|
||||||
description: "Allow or disallow multiple PVC's writhing to the same PVC"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "ReadWriteOnce"
|
|
||||||
enum:
|
|
||||||
- value: "ReadWriteOnce"
|
|
||||||
description: "ReadWriteOnce"
|
|
||||||
- value: "ReadOnlyMany"
|
|
||||||
description: "ReadOnlyMany"
|
|
||||||
- value: "ReadWriteMany"
|
|
||||||
description: "ReadWriteMany"
|
|
||||||
- variable: size
|
|
||||||
label: "Size quotum of storage"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "100Gi"
|
|
||||||
|
|
||||||
- variable: ingress
|
|
||||||
label: ""
|
|
||||||
group: "Ingress"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: main
|
|
||||||
label: "Main Ingress"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable Ingress"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
show_subquestions_if: true
|
|
||||||
subquestions:
|
|
||||||
- variable: hosts
|
|
||||||
label: "Hosts"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: hostEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: host
|
|
||||||
label: "HostName"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
- variable: paths
|
|
||||||
label: "Paths"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: pathEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: path
|
|
||||||
label: "path"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: "/"
|
|
||||||
- variable: pathType
|
|
||||||
label: "pathType"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: "Prefix"
|
|
||||||
- variable: tls
|
|
||||||
label: "TLS-Settings"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: tlsEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: hosts
|
|
||||||
label: "Certificate Hosts"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: host
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
- variable: scaleCert
|
|
||||||
label: "Select TrueNAS SCALE Certificate"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
$ref:
|
|
||||||
- "definitions/certificate"
|
|
||||||
- variable: entrypoint
|
|
||||||
label: "Traefik Entrypoint"
|
|
||||||
description: "Entrypoint used by Traefik when using Traefik as Ingress Provider"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "websecure"
|
|
||||||
required: true
|
|
||||||
- variable: middlewares
|
|
||||||
label: "Traefik Middlewares"
|
|
||||||
description: "Add previously created Traefik Middlewares to this Ingress"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: name
|
|
||||||
label: "Name"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- variable: hpb
|
|
||||||
label: "High Performance Backend Ingress"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable Ingress"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
show_subquestions_if: true
|
|
||||||
subquestions:
|
|
||||||
- variable: hosts
|
|
||||||
label: "Hosts"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: hostEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: host
|
|
||||||
label: "HostName"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
- variable: paths
|
|
||||||
label: "Paths"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: pathEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: path
|
|
||||||
label: "path"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: "/push"
|
|
||||||
- variable: pathType
|
|
||||||
label: "pathType"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: "Prefix"
|
|
||||||
- variable: service
|
|
||||||
label: "Service"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
hidden: true
|
|
||||||
attrs:
|
|
||||||
- variable: name
|
|
||||||
label: "service name"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
hidden: true
|
|
||||||
default: "{{ .Release.Name }}-nextcloud-hpb"
|
|
||||||
- variable: port
|
|
||||||
label: "serviceport"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
hidden: true
|
|
||||||
default: 7867
|
|
||||||
- variable: tls
|
|
||||||
label: "TLS-Settings"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: tlsEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: hosts
|
|
||||||
label: "Certificate Hosts"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: host
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
- variable: scaleCert
|
|
||||||
label: "Select TrueNAS SCALE Certificate"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
$ref:
|
|
||||||
- "definitions/certificate"
|
|
||||||
- variable: entrypoint
|
|
||||||
label: "Traefik Entrypoint"
|
|
||||||
description: "Entrypoint used by Traefik when using Traefik as Ingress Provider"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "websecure"
|
|
||||||
required: true
|
|
||||||
- variable: middlewares
|
|
||||||
label: "Traefik Middlewares"
|
|
||||||
description: "Add previously created Traefik Middlewares to this Ingress"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: name
|
|
||||||
label: "Name"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- variable: podSecurityContext
|
|
||||||
group: "Security and Permissions"
|
|
||||||
label: "Pod Security Context"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: fsGroup
|
|
||||||
label: "fsGroup"
|
|
||||||
description: "The group that should own ALL storage."
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 33
|
|
||||||
- variable: fsGroupChangePolicy
|
|
||||||
label: "When should we take ownership?"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "OnRootMismatch"
|
|
||||||
enum:
|
|
||||||
- value: "OnRootMismatch"
|
|
||||||
description: "OnRootMismatch"
|
|
||||||
- value: "Always"
|
|
||||||
description: "Always"
|
|
||||||
- variable: resources
|
|
||||||
group: "Resources and Devices"
|
|
||||||
label: ""
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: limits
|
|
||||||
label: "Advanced Limit Resource Consumption"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: cpu
|
|
||||||
label: "CPU"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "2000m"
|
|
||||||
- variable: memory
|
|
||||||
label: "Memory RAM"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "2Gi"
|
|
||||||
- variable: requests
|
|
||||||
label: "Advanced Request minimum resources required"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: cpu
|
|
||||||
label: "CPU"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "10m"
|
|
||||||
- variable: memory
|
|
||||||
label: "Memory RAM"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "50Mi"
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
{{/* Define the configmap */}}
|
|
||||||
{{- define "nextcloud.configmap" -}}
|
|
||||||
|
|
||||||
{{- $hosts := "" }}
|
|
||||||
{{- if .Values.ingress.main.enabled }}
|
|
||||||
{{ range $index, $host := .Values.ingress.main.hosts }}
|
|
||||||
{{- if $index }}
|
|
||||||
{{ $hosts = ( printf "%v %v" $hosts $host.host ) }}
|
|
||||||
{{- else }}
|
|
||||||
{{ $hosts = ( printf "%s" $host.host ) }}
|
|
||||||
{{- end }}
|
|
||||||
{{ end }}
|
|
||||||
{{- end }}
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: nextcloudconfig
|
|
||||||
data:
|
|
||||||
NEXTCLOUD_TRUSTED_DOMAINS: {{ ( printf "%v %v %v %v %v" "test.fakedomain.dns" ( .Values.env.NODE_IP | default "localhost" ) ( printf "%v-%v" .Release.Name "nextcloud" ) ( printf "%v-%v" .Release.Name "nextcloud-hpb" ) $hosts ) | quote }}
|
|
||||||
{{- if .Values.ingress.main.enabled }}
|
|
||||||
APACHE_DISABLE_REWRITE_IP: "1"
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: hpbconfig
|
|
||||||
data:
|
|
||||||
NEXTCLOUD_URL: {{ ( printf "%v-%v" .Release.Name "nextcloud" ) | quote }}
|
|
||||||
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,51 +0,0 @@
|
||||||
{{/* Define the cronjob */}}
|
|
||||||
{{- define "nextcloud.cronjob" -}}
|
|
||||||
{{- $jobName := include "common.names.fullname" . -}}
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: batch/v1beta1
|
|
||||||
kind: CronJob
|
|
||||||
metadata:
|
|
||||||
name: {{ printf "%s-cronjob" $jobName }}
|
|
||||||
labels:
|
|
||||||
{{- include "common.labels" . | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
schedule: "{{ .Values.cronjob.schedule }}"
|
|
||||||
concurrencyPolicy: Forbid
|
|
||||||
{{- with .Values.cronjob.failedJobsHistoryLimit }}
|
|
||||||
failedJobsHistoryLimit: {{ . }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.cronjob.successfulJobsHistoryLimit }}
|
|
||||||
successfulJobsHistoryLimit: {{ . }}
|
|
||||||
{{- end }}
|
|
||||||
jobTemplate:
|
|
||||||
metadata:
|
|
||||||
spec:
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
spec:
|
|
||||||
restartPolicy: Never
|
|
||||||
{{- with (include "common.controller.volumes" . | trim) }}
|
|
||||||
volumes:
|
|
||||||
{{- nindent 12 . }}
|
|
||||||
{{- end }}
|
|
||||||
containers:
|
|
||||||
- name: {{ .Chart.Name }}
|
|
||||||
image: "{{ .Values.image.repository }}:{{ default .Values.image.tag }}"
|
|
||||||
imagePullPolicy: {{ default .Values.image.pullPolicy }}
|
|
||||||
command: [ "php" ]
|
|
||||||
args:
|
|
||||||
- "-f"
|
|
||||||
- "/var/www/html/cron.php"
|
|
||||||
# Will mount configuration files as www-data (id: 33) by default for nextcloud
|
|
||||||
{{- with (include "common.controller.volumeMounts" . | trim) }}
|
|
||||||
volumeMounts:
|
|
||||||
{{ nindent 16 . }}
|
|
||||||
{{- end }}
|
|
||||||
securityContext:
|
|
||||||
runAsUser: 33
|
|
||||||
runAsGroup: 33
|
|
||||||
resources:
|
|
||||||
{{ toYaml .Values.resources | indent 16 }}
|
|
||||||
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,50 +0,0 @@
|
||||||
{{/* Define the secrets */}}
|
|
||||||
{{- define "nextcloud.secrets" -}}
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
{{- include "common.labels" . | nindent 4 }}
|
|
||||||
name: dbcreds
|
|
||||||
{{- $previous := lookup "v1" "Secret" .Release.Namespace "dbcreds" }}
|
|
||||||
{{- $dbPass := "" }}
|
|
||||||
data:
|
|
||||||
{{- if $previous }}
|
|
||||||
{{- $dbPass = ( index $previous.data "postgresql-password" ) | b64dec }}
|
|
||||||
postgresql-password: {{ ( index $previous.data "postgresql-password" ) }}
|
|
||||||
postgresql-postgres-password: {{ ( index $previous.data "postgresql-postgres-password" ) }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $dbPass = randAlphaNum 50 }}
|
|
||||||
postgresql-password: {{ $dbPass | b64enc | quote }}
|
|
||||||
postgresql-postgres-password: {{ randAlphaNum 50 | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
url: {{ ( printf "%v%v:%v@%v-%v:%v/%v" "postgresql://" .Values.postgresql.postgresqlUsername $dbPass .Release.Name "postgresql" "5432" .Values.postgresql.postgresqlDatabase ) | b64enc | quote }}
|
|
||||||
host: {{ ( printf "%v-%v:5432" .Release.Name "postgresql" ) | b64enc | quote }}
|
|
||||||
plainhost: {{ ( printf "%v-%v" .Release.Name "postgresql" ) | b64enc | quote }}
|
|
||||||
type: Opaque
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
{{- include "common.labels" . | nindent 4 }}
|
|
||||||
name: rediscreds
|
|
||||||
{{- $redisprevious := lookup "v1" "Secret" .Release.Namespace "rediscreds" }}
|
|
||||||
{{- $redisPass := "" }}
|
|
||||||
data:
|
|
||||||
{{- if $redisprevious }}
|
|
||||||
{{- $redisPass = ( index $redisprevious.data "redis-password" ) | b64dec }}
|
|
||||||
redis-password: {{ ( index $redisprevious.data "redis-password" ) }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $redisPass = randAlphaNum 50 }}
|
|
||||||
redis-password: {{ $redisPass | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
masterhost: {{ ( printf "%v-%v" .Release.Name "redis-master" ) | b64enc | quote }}
|
|
||||||
slavehost: {{ ( printf "%v-%v" .Release.Name "redis-master" ) | b64enc | quote }}
|
|
||||||
type: Opaque
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,14 +0,0 @@
|
||||||
{{/* Make sure all variables are set properly */}}
|
|
||||||
{{- include "common.values.setup" . }}
|
|
||||||
|
|
||||||
{{/* Render the templates */}}
|
|
||||||
{{ include "common.all" . }}
|
|
||||||
|
|
||||||
{{/* Render configmap for nextcloud */}}
|
|
||||||
{{- include "nextcloud.configmap" . }}
|
|
||||||
|
|
||||||
{{/* Render secrets for nextcloud */}}
|
|
||||||
{{- include "nextcloud.secrets" . }}
|
|
||||||
|
|
||||||
{{/* Render cronjob for nextcloud */}}
|
|
||||||
{{- include "nextcloud.cronjob" . }}
|
|
||||||
|
|
@ -1,210 +0,0 @@
|
||||||
# Default values for Bitwarden.
|
|
||||||
|
|
||||||
image:
|
|
||||||
repository: nextcloud
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
tag: 22.1.0
|
|
||||||
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
|
|
||||||
service:
|
|
||||||
main:
|
|
||||||
ports:
|
|
||||||
main:
|
|
||||||
port: 80
|
|
||||||
hpb:
|
|
||||||
enabled: true
|
|
||||||
ports:
|
|
||||||
hpb:
|
|
||||||
enabled: true
|
|
||||||
port: 7867
|
|
||||||
|
|
||||||
env:
|
|
||||||
NEXTCLOUD_ADMIN_USER: "admin"
|
|
||||||
NEXTCLOUD_ADMIN_PASSWORD: "adminpass"
|
|
||||||
TRUSTED_PROXIES: "172.16.0.0/16"
|
|
||||||
|
|
||||||
envTpl:
|
|
||||||
POSTGRES_DB: "{{ .Values.postgresql.postgresqlDatabase }}"
|
|
||||||
POSTGRES_USER: "{{ .Values.postgresql.postgresqlUsername }}"
|
|
||||||
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: nextcloudconfig
|
|
||||||
|
|
||||||
envValueFrom:
|
|
||||||
POSTGRES_PASSWORD:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: postgresql-password
|
|
||||||
POSTGRES_HOST:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: host
|
|
||||||
REDIS_HOST:
|
|
||||||
secretKeyRef:
|
|
||||||
name: rediscreds
|
|
||||||
key: masterhost
|
|
||||||
REDIS_HOST_PASSWORD:
|
|
||||||
secretKeyRef:
|
|
||||||
name: rediscreds
|
|
||||||
key: redis-password
|
|
||||||
|
|
||||||
persistence:
|
|
||||||
data:
|
|
||||||
enabled: true
|
|
||||||
mountPath: "/var/www/html"
|
|
||||||
type: pvc
|
|
||||||
accessMode: ReadWriteOnce
|
|
||||||
size: "100Gi"
|
|
||||||
|
|
||||||
redismaster:
|
|
||||||
noMount: true
|
|
||||||
forceName: "redismaster"
|
|
||||||
enabled: true
|
|
||||||
type: pvc
|
|
||||||
accessMode: ReadWriteOnce
|
|
||||||
size: "100Gi"
|
|
||||||
|
|
||||||
initContainers:
|
|
||||||
- name: init-postgresdb
|
|
||||||
image: postgres:13.1
|
|
||||||
command:
|
|
||||||
- "sh"
|
|
||||||
- "-c"
|
|
||||||
- "until pg_isready -U nextcloud -h ${pghost} ; do sleep 2 ; done"
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
env:
|
|
||||||
- name: pghost
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: plainhost
|
|
||||||
|
|
||||||
additionalContainers:
|
|
||||||
- name: hpb
|
|
||||||
image: nextcloud:21.0.2
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
command:
|
|
||||||
- "/bin/bash"
|
|
||||||
- "-c"
|
|
||||||
- "--"
|
|
||||||
args:
|
|
||||||
- 'while [ ! -f "/var/www/html/custom_apps/notify_push/bin/x86_64/notify_push" ]; do sleep 30; echo "notify_push not found, waiting"; done && /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push /var/www/html/config/config.php'
|
|
||||||
env:
|
|
||||||
- name: PORT
|
|
||||||
value: "7867"
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: hpbconfig
|
|
||||||
ports:
|
|
||||||
- name: hpb
|
|
||||||
containerPort: 7867
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /var/www/html
|
|
||||||
name: data
|
|
||||||
securityContext:
|
|
||||||
runAsUser: 33
|
|
||||||
runAsGroup: 33
|
|
||||||
|
|
||||||
|
|
||||||
podSecurityContext:
|
|
||||||
fsGroup: 33
|
|
||||||
|
|
||||||
# -- Probe configuration
|
|
||||||
# -- [[ref]](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/)
|
|
||||||
# @default -- See below
|
|
||||||
probes:
|
|
||||||
# -- Liveness probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
liveness:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
# -- Redainess probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
readiness:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
# -- Startup probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
startup:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
|
|
||||||
## Cronjob to execute Nextcloud background tasks
|
|
||||||
## ref: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/background_jobs_configuration.html#webcron
|
|
||||||
##
|
|
||||||
cronjob:
|
|
||||||
# Every 5 minutes
|
|
||||||
# Note: Setting this to any any other value than 5 minutes might
|
|
||||||
# cause issues with how nextcloud background jobs are executed
|
|
||||||
schedule: "*/5 * * * *"
|
|
||||||
annotations: {}
|
|
||||||
failedJobsHistoryLimit: 5
|
|
||||||
successfulJobsHistoryLimit: 2
|
|
||||||
|
|
||||||
# Enabled postgres
|
|
||||||
postgresql:
|
|
||||||
enabled: true
|
|
||||||
postgresqlUsername: nextcloud
|
|
||||||
postgresqlDatabase: nextcloud
|
|
||||||
existingSecret: dbcreds
|
|
||||||
|
|
||||||
# Enabled redis
|
|
||||||
# ... for more options see https://github.com/bitnami/charts/tree/master/bitnami/redis
|
|
||||||
redis:
|
|
||||||
volumePermissions:
|
|
||||||
enabled: true
|
|
||||||
architecture: standalone
|
|
||||||
enabled: true
|
|
||||||
auth:
|
|
||||||
existingSecret: rediscreds
|
|
||||||
existingSecretPasswordKey: redis-password
|
|
||||||
master:
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
existingClaim: redismaster
|
|
||||||
replica:
|
|
||||||
replicaCount: 0
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
# Configuration Options
|
|
||||||
|
|
||||||
##### Connecting to other apps
|
|
||||||
If you need to connect this App to other Apps on TrueNAS SCALE, please refer to our "Linking Apps Internally" quick-start guide:
|
|
||||||
https://truecharts.org/manual/Quick-Start%20Guides/14-linking-apps/
|
|
||||||
|
|
||||||
##### Available config options
|
|
||||||
In the future this page is going to contain an automated list of options available in the installation/edit UI.
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
dependencies:
|
|
||||||
- name: common
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 6.10.7
|
|
||||||
- name: postgresql
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 1.1.0
|
|
||||||
- name: redis
|
|
||||||
repository: https://charts.bitnami.com/bitnami
|
|
||||||
version: 14.8.11
|
|
||||||
digest: sha256:f424036a376deb87b242f665b6fe1f19f7a903fbe48a3efd59d7314912c763f6
|
|
||||||
generated: "2021-08-28T12:41:54.259313034Z"
|
|
||||||
|
|
@ -1,36 +0,0 @@
|
||||||
apiVersion: v2
|
|
||||||
appVersion: auto
|
|
||||||
dependencies:
|
|
||||||
- name: common
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 6.10.7
|
|
||||||
- condition: postgresql.enabled
|
|
||||||
name: postgresql
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 1.1.0
|
|
||||||
- condition: redis.enabled
|
|
||||||
name: redis
|
|
||||||
repository: https://charts.bitnami.com/bitnami
|
|
||||||
version: 14.8.11
|
|
||||||
deprecated: false
|
|
||||||
description: A private cloud server that puts the control and security of your own
|
|
||||||
data back into your hands.
|
|
||||||
home: https://nextcloud.com/
|
|
||||||
icon: https://upload.wikimedia.org/wikipedia/commons/thumb/6/60/Nextcloud_Logo.svg/1280px-Nextcloud_Logo.svg.png
|
|
||||||
keywords:
|
|
||||||
- nextcloud
|
|
||||||
- storage
|
|
||||||
- http
|
|
||||||
- web
|
|
||||||
- php
|
|
||||||
kubeVersion: '>=1.16.0-0'
|
|
||||||
maintainers:
|
|
||||||
- email: info@truecharts.org
|
|
||||||
name: TrueCharts
|
|
||||||
url: truecharts.org
|
|
||||||
name: nextcloud
|
|
||||||
sources:
|
|
||||||
- https://github.com/nextcloud/docker
|
|
||||||
- https://github.com/nextcloud/helm
|
|
||||||
type: application
|
|
||||||
version: 2.3.3
|
|
||||||
|
|
@ -1,45 +0,0 @@
|
||||||
# Introduction
|
|
||||||
|
|
||||||
  
|
|
||||||
|
|
||||||
A private cloud server that puts the control and security of your own data back into your hands.
|
|
||||||
|
|
||||||
TrueCharts are designed to be installed as TrueNAS SCALE app only. We can not guarantee this charts works as a stand-alone helm installation.
|
|
||||||
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/apps/issues/new/choose)**
|
|
||||||
|
|
||||||
## Source Code
|
|
||||||
|
|
||||||
* <https://github.com/nextcloud/docker>
|
|
||||||
* <https://github.com/nextcloud/helm>
|
|
||||||
|
|
||||||
## Requirements
|
|
||||||
|
|
||||||
Kubernetes: `>=1.16.0-0`
|
|
||||||
|
|
||||||
## Dependencies
|
|
||||||
|
|
||||||
| Repository | Name | Version |
|
|
||||||
|------------|------|---------|
|
|
||||||
| https://charts.bitnami.com/bitnami | redis | 14.8.11 |
|
|
||||||
| https://truecharts.org/ | common | 6.10.6 |
|
|
||||||
| https://truecharts.org/ | postgresql | 1.1.0 |
|
|
||||||
|
|
||||||
## Installing the Chart
|
|
||||||
|
|
||||||
To install this App on TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/03-Installing-an-App/).
|
|
||||||
|
|
||||||
## Uninstalling the Chart
|
|
||||||
|
|
||||||
To remove this App from TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/07-Deleting-an-App/).
|
|
||||||
|
|
||||||
## Support
|
|
||||||
|
|
||||||
- Please check our [quick-start guides](https://truecharts.org/manual/Quick-Start%20Guides/01-Open-Apps/) first.
|
|
||||||
- See the [Wiki](https://truecharts.org)
|
|
||||||
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
|
||||||
- Open a [issue](https://github.com/truecharts/apps/issues/new/choose)
|
|
||||||
- Ask a [question](https://github.com/truecharts/apps/discussions)
|
|
||||||
|
|
||||||
----------------------------------------------
|
|
||||||
Autogenerated from chart metadata using [helm-docs v1.5.0](https://github.com/norwoodj/helm-docs/releases/v1.5.0)
|
|
||||||
All Rights Reserved - The TrueCharts Project
|
|
||||||
|
|
@ -1,4 +0,0 @@
|
||||||
A private cloud server that puts the control and security of your own data back into your hands.
|
|
||||||
|
|
||||||
This App is supplied by TrueCharts, for more information please visit https://truecharts.org
|
|
||||||
A private cloud server that puts the control and security of your own
|
|
||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -1,187 +0,0 @@
|
||||||
##
|
|
||||||
# This file contains Values.yaml content that gets added to the output of questions.yaml
|
|
||||||
# It's ONLY meant for content that the user is NOT expected to change.
|
|
||||||
# Example: Everything under "image" is not included in questions.yaml but is included here.
|
|
||||||
##
|
|
||||||
|
|
||||||
image:
|
|
||||||
repository: nextcloud
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
tag: 22.1.0
|
|
||||||
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
|
|
||||||
env: {}
|
|
||||||
|
|
||||||
|
|
||||||
envTpl:
|
|
||||||
POSTGRES_DB: "{{ .Values.postgresql.postgresqlDatabase }}"
|
|
||||||
POSTGRES_USER: "{{ .Values.postgresql.postgresqlUsername }}"
|
|
||||||
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: nextcloudconfig
|
|
||||||
|
|
||||||
envValueFrom:
|
|
||||||
POSTGRES_PASSWORD:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: postgresql-password
|
|
||||||
POSTGRES_HOST:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: host
|
|
||||||
REDIS_HOST:
|
|
||||||
secretKeyRef:
|
|
||||||
name: rediscreds
|
|
||||||
key: masterhost
|
|
||||||
REDIS_HOST_PASSWORD:
|
|
||||||
secretKeyRef:
|
|
||||||
name: rediscreds
|
|
||||||
key: redis-password
|
|
||||||
|
|
||||||
initContainers:
|
|
||||||
- name: init-postgresdb
|
|
||||||
image: postgres:13.1
|
|
||||||
command:
|
|
||||||
- "sh"
|
|
||||||
- "-c"
|
|
||||||
- "until pg_isready -U nextcloud -h ${pghost} ; do sleep 2 ; done"
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
env:
|
|
||||||
- name: pghost
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: plainhost
|
|
||||||
|
|
||||||
additionalContainers:
|
|
||||||
- name: hpb
|
|
||||||
image: nextcloud:21.0.2
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
command:
|
|
||||||
- "/bin/bash"
|
|
||||||
- "-c"
|
|
||||||
- "--"
|
|
||||||
args:
|
|
||||||
- 'while [ ! -f "/var/www/html/custom_apps/notify_push/bin/x86_64/notify_push" ]; do sleep 30; echo "notify_push not found, waiting"; done && /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push /var/www/html/config/config.php'
|
|
||||||
env:
|
|
||||||
- name: PORT
|
|
||||||
value: "7867"
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: hpbconfig
|
|
||||||
ports:
|
|
||||||
- name: hpb
|
|
||||||
containerPort: 7867
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /var/www/html
|
|
||||||
name: data
|
|
||||||
securityContext:
|
|
||||||
runAsUser: 33
|
|
||||||
runAsGroup: 33
|
|
||||||
|
|
||||||
# -- Probe configuration
|
|
||||||
# -- [[ref]](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/)
|
|
||||||
# @default -- See below
|
|
||||||
probes:
|
|
||||||
# -- Liveness probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
liveness:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
# -- Redainess probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
readiness:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
# -- Startup probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
startup:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
## Cronjob to execute Nextcloud background tasks
|
|
||||||
## ref: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/background_jobs_configuration.html#webcron
|
|
||||||
##
|
|
||||||
cronjob:
|
|
||||||
# Every 5 minutes
|
|
||||||
# Note: Setting this to any any other value than 5 minutes might
|
|
||||||
# cause issues with how nextcloud background jobs are executed
|
|
||||||
schedule: "*/5 * * * *"
|
|
||||||
annotations: {}
|
|
||||||
failedJobsHistoryLimit: 5
|
|
||||||
successfulJobsHistoryLimit: 2
|
|
||||||
|
|
||||||
# Enabled postgres
|
|
||||||
postgresql:
|
|
||||||
enabled: true
|
|
||||||
postgresqlUsername: nextcloud
|
|
||||||
postgresqlDatabase: nextcloud
|
|
||||||
existingSecret: dbcreds
|
|
||||||
persistence:
|
|
||||||
db:
|
|
||||||
storageClass: "SCALE-ZFS"
|
|
||||||
dbbackups:
|
|
||||||
storageClass: "SCALE-ZFS"
|
|
||||||
|
|
||||||
# Enabled redis
|
|
||||||
# ... for more options see https://github.com/bitnami/charts/tree/master/bitnami/redis
|
|
||||||
redis:
|
|
||||||
architecture: standalone
|
|
||||||
enabled: true
|
|
||||||
auth:
|
|
||||||
existingSecret: rediscreds
|
|
||||||
existingSecretPasswordKey: redis-password
|
|
||||||
master:
|
|
||||||
persistence:
|
|
||||||
enabled: true
|
|
||||||
existingClaim: redismaster
|
|
||||||
replica:
|
|
||||||
replicaCount: 0
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
##
|
|
||||||
# Most other defaults are set in questions.yaml
|
|
||||||
# For other options please refer to the wiki, default_values.yaml or the common library chart
|
|
||||||
##
|
|
||||||
|
|
@ -1,971 +0,0 @@
|
||||||
groups:
|
|
||||||
- name: "Container Image"
|
|
||||||
description: "Image to be used for container"
|
|
||||||
- name: "Controller"
|
|
||||||
description: "Configure workload deployment"
|
|
||||||
- name: "Container Configuration"
|
|
||||||
description: "additional container configuration"
|
|
||||||
- name: "App Configuration"
|
|
||||||
description: "App specific config options"
|
|
||||||
- name: "Networking and Services"
|
|
||||||
description: "Configure Network and Services for container"
|
|
||||||
- name: "Storage and Persistence"
|
|
||||||
description: "Persist and share data that is separate from the container"
|
|
||||||
- name: "Ingress"
|
|
||||||
description: "Ingress Configuration"
|
|
||||||
- name: "Security and Permissions"
|
|
||||||
description: "Configure security context and permissions"
|
|
||||||
- name: "Resources and Devices"
|
|
||||||
description: "Specify resources/devices to be allocated to workload"
|
|
||||||
- name: "Advanced"
|
|
||||||
description: "Advanced Configuration"
|
|
||||||
portals:
|
|
||||||
web_portal:
|
|
||||||
protocols:
|
|
||||||
- "$kubernetes-resource_configmap_portal_protocol"
|
|
||||||
host:
|
|
||||||
- "$kubernetes-resource_configmap_portal_host"
|
|
||||||
ports:
|
|
||||||
- "$kubernetes-resource_configmap_portal_port"
|
|
||||||
questions:
|
|
||||||
- variable: portal
|
|
||||||
group: "Container Image"
|
|
||||||
label: "Configure Portal Button"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
hidden: true
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable"
|
|
||||||
description: "enable the portal button"
|
|
||||||
schema:
|
|
||||||
hidden: true
|
|
||||||
editable: false
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
- variable: controller
|
|
||||||
group: "Controller"
|
|
||||||
label: ""
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: type
|
|
||||||
description: "Please specify type of workload to deploy"
|
|
||||||
label: "(Advanced) Controller Type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "deployment"
|
|
||||||
required: true
|
|
||||||
enum:
|
|
||||||
- value: "deployment"
|
|
||||||
description: "Deployment"
|
|
||||||
- value: "statefulset"
|
|
||||||
description: "Statefulset"
|
|
||||||
- value: "daemonset"
|
|
||||||
description: "Daemonset"
|
|
||||||
- variable: replicas
|
|
||||||
description: "Number of desired pod replicas"
|
|
||||||
label: "Desired Replicas"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 1
|
|
||||||
required: true
|
|
||||||
- variable: strategy
|
|
||||||
description: "Please specify type of workload to deploy"
|
|
||||||
label: "(Advanced) Update Strategy"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "Recreate"
|
|
||||||
required: true
|
|
||||||
enum:
|
|
||||||
- value: "Recreate"
|
|
||||||
description: "Recreate: Kill existing pods before creating new ones"
|
|
||||||
- value: "RollingUpdate"
|
|
||||||
description: "RollingUpdate: Create new pods and then kill old ones"
|
|
||||||
- value: "OnDelete"
|
|
||||||
description: "(Legacy) OnDelete: ignore .spec.template changes"
|
|
||||||
|
|
||||||
- variable: env
|
|
||||||
group: "Container Configuration"
|
|
||||||
label: "Image Environment"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: TZ
|
|
||||||
label: "Timezone"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "Etc/UTC"
|
|
||||||
$ref:
|
|
||||||
- "definitions/timezone"
|
|
||||||
- variable: UMASK
|
|
||||||
label: "UMASK"
|
|
||||||
description: "Sets the UMASK env var for LinuxServer.io (compatible) containers"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "002"
|
|
||||||
- variable: NEXTCLOUD_ADMIN_USER
|
|
||||||
label: "NEXTCLOUD_ADMIN_USER"
|
|
||||||
description: "Sets nextcloud admin username"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: ""
|
|
||||||
- variable: NEXTCLOUD_ADMIN_PASSWORD
|
|
||||||
label: "NEXTCLOUD_ADMIN_PASSWORD"
|
|
||||||
description: "Sets nextcloud admin password"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: ""
|
|
||||||
- variable: TRUSTED_PROXIES
|
|
||||||
label: "TRUSTED_PROXIES"
|
|
||||||
description: "Sets nextcloud Trusted Proxies"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "172.16.0.0/16"
|
|
||||||
- variable: NODE_IP
|
|
||||||
label: "NODE_IP"
|
|
||||||
description: "Sets nextcloud nodeip for nodeport connections"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
$ref:
|
|
||||||
- "definitions/nodeIP"
|
|
||||||
|
|
||||||
|
|
||||||
# Configure Enviroment Variables
|
|
||||||
- variable: envList
|
|
||||||
label: "Image environment"
|
|
||||||
group: "Container Configuration"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: envItem
|
|
||||||
label: "Environment Variable"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: name
|
|
||||||
label: "Name"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
- variable: value
|
|
||||||
label: "Value"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
|
|
||||||
- variable: hostNetwork
|
|
||||||
group: "Networking and Services"
|
|
||||||
label: "Enable Host Networking"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
|
|
||||||
- variable: service
|
|
||||||
group: "Networking and Services"
|
|
||||||
label: "Configure Service(s)"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: main
|
|
||||||
label: "Main Service"
|
|
||||||
description: "The Primary service on which the healthcheck runs, often the webUI"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the service"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
hidden: true
|
|
||||||
- variable: type
|
|
||||||
label: "Service Type"
|
|
||||||
description: "ClusterIP's are only internally available, nodePorts expose the container to the host node System, Loadbalancer exposes the service using the system loadbalancer"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "NodePort"
|
|
||||||
enum:
|
|
||||||
- value: "NodePort"
|
|
||||||
description: "NodePort"
|
|
||||||
- value: "ClusterIP"
|
|
||||||
description: "ClusterIP"
|
|
||||||
- value: "LoadBalancer"
|
|
||||||
description: "LoadBalancer"
|
|
||||||
- variable: loadBalancerIP
|
|
||||||
label: "LoadBalancer IP"
|
|
||||||
description: "LoadBalancerIP"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "LoadBalancer"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
- variable: externalIPs
|
|
||||||
label: "External IP's"
|
|
||||||
description: "External IP's"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "LoadBalancer"]]
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: externalIP
|
|
||||||
label: "External IP"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
- variable: ports
|
|
||||||
label: "Service's Port(s) Configuration"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: main
|
|
||||||
label: "Main Service Port Configuration"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the port"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
hidden: true
|
|
||||||
- variable: protocol
|
|
||||||
label: "Port Type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "HTTP"
|
|
||||||
enum:
|
|
||||||
- value: HTTP
|
|
||||||
description: "HTTP"
|
|
||||||
- value: "HTTPS"
|
|
||||||
description: "HTTPS"
|
|
||||||
- value: TCP
|
|
||||||
description: "TCP"
|
|
||||||
- value: "UDP"
|
|
||||||
description: "UDP"
|
|
||||||
- variable: port
|
|
||||||
label: "Container Port"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 80
|
|
||||||
editable: false
|
|
||||||
hidden: true
|
|
||||||
- variable: targetport
|
|
||||||
label: "Target Port"
|
|
||||||
description: "This port exposes the container port on the service"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 80
|
|
||||||
editable: true
|
|
||||||
required: true
|
|
||||||
- variable: nodePort
|
|
||||||
label: "Node Port (Optional)"
|
|
||||||
description: "This port gets exposed to the node. Only considered when service type is NodePort"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
min: 9000
|
|
||||||
max: 65535
|
|
||||||
default: 36091
|
|
||||||
required: true
|
|
||||||
- variable: hpb
|
|
||||||
label: "High Performance Backend Service"
|
|
||||||
description: "The service which runs the High Performance Backend"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the service"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
- variable: type
|
|
||||||
label: "Service Type"
|
|
||||||
description: "ClusterIP's are only internally available, nodePorts expose the container to the host node System, Loadbalancer exposes the service using the system loadbalancer"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "NodePort"
|
|
||||||
enum:
|
|
||||||
- value: "NodePort"
|
|
||||||
description: "NodePort"
|
|
||||||
- value: "ClusterIP"
|
|
||||||
description: "ClusterIP"
|
|
||||||
- value: "LoadBalancer"
|
|
||||||
description: "LoadBalancer"
|
|
||||||
- variable: loadBalancerIP
|
|
||||||
label: "LoadBalancer IP"
|
|
||||||
description: "LoadBalancerIP"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "LoadBalancer"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
- variable: externalIPs
|
|
||||||
label: "External IP's"
|
|
||||||
description: "External IP's"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "LoadBalancer"]]
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: externalIP
|
|
||||||
label: "External IP"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
- variable: ports
|
|
||||||
label: "Service's Port(s) Configuration"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: hpb
|
|
||||||
label: "Main Service Port Configuration"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the port"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
hidden: true
|
|
||||||
- variable: protocol
|
|
||||||
label: "Port Type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "HTTP"
|
|
||||||
enum:
|
|
||||||
- value: HTTP
|
|
||||||
description: "HTTP"
|
|
||||||
- value: "HTTPS"
|
|
||||||
description: "HTTPS"
|
|
||||||
- value: TCP
|
|
||||||
description: "TCP"
|
|
||||||
- value: "UDP"
|
|
||||||
description: "UDP"
|
|
||||||
- variable: port
|
|
||||||
label: "Container Port"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 7867
|
|
||||||
editable: false
|
|
||||||
hidden: true
|
|
||||||
- variable: targetport
|
|
||||||
label: "Target Port"
|
|
||||||
description: "This port exposes the container port on the service"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 7867
|
|
||||||
editable: true
|
|
||||||
required: true
|
|
||||||
- variable: nodePort
|
|
||||||
label: "Node Port (Optional)"
|
|
||||||
description: "This port gets exposed to the node. Only considered when service type is NodePort"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
min: 9000
|
|
||||||
max: 65535
|
|
||||||
default: 36092
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- variable: persistence
|
|
||||||
label: "Integrated Persistent Storage"
|
|
||||||
description: "Integrated Persistent Storage"
|
|
||||||
group: "Storage and Persistence"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: data
|
|
||||||
label: "App Data Storage"
|
|
||||||
description: "Stores the Application Data."
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the storage"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
- variable: type
|
|
||||||
label: "(Advanced) Type of Storage"
|
|
||||||
description: "Sets the persistence type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "pvc"
|
|
||||||
enum:
|
|
||||||
- value: "pvc"
|
|
||||||
description: "pvc"
|
|
||||||
- value: "emptyDir"
|
|
||||||
description: "emptyDir"
|
|
||||||
- value: "hostPath"
|
|
||||||
description: "hostPath"
|
|
||||||
- variable: storageClass
|
|
||||||
label: "(Advanced) storageClass"
|
|
||||||
description: " Warning: Anything other than SCALE-ZFS will break rollback!"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "SCALE-ZFS"
|
|
||||||
- variable: setPermissions
|
|
||||||
label: "Automatic Permissions"
|
|
||||||
description: "Automatically set permissions on install"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
- variable: readOnly
|
|
||||||
label: "readOnly"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
- variable: hostPath
|
|
||||||
label: "hostPath"
|
|
||||||
description: "Path inside the container the storage is mounted"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: hostpath
|
|
||||||
- variable: hostPathType
|
|
||||||
label: "hostPath Type"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
enum:
|
|
||||||
- value: ""
|
|
||||||
description: "Default"
|
|
||||||
- value: "DirectoryOrCreate"
|
|
||||||
description: "DirectoryOrCreate"
|
|
||||||
- value: "Directory"
|
|
||||||
description: "Directory"
|
|
||||||
- value: "FileOrCreate"
|
|
||||||
description: "FileOrCreate"
|
|
||||||
- value: "File"
|
|
||||||
description: "File"
|
|
||||||
- value: "Socket"
|
|
||||||
description: "Socket"
|
|
||||||
- value: "CharDevice"
|
|
||||||
description: "CharDevice"
|
|
||||||
- value: "BlockDevice"
|
|
||||||
description: "BlockDevice"
|
|
||||||
- variable: mountPath
|
|
||||||
label: "mountPath"
|
|
||||||
description: "Path inside the container the storage is mounted"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "/var/www/html"
|
|
||||||
hidden: true
|
|
||||||
- variable: medium
|
|
||||||
label: "EmptyDir Medium"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "emptyDir"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
enum:
|
|
||||||
- value: ""
|
|
||||||
description: "Default"
|
|
||||||
- value: "Memory"
|
|
||||||
description: "Memory"
|
|
||||||
- variable: accessMode
|
|
||||||
label: "Access Mode (Advanced)"
|
|
||||||
description: "Allow or disallow multiple PVC's writhing to the same PV"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "ReadWriteOnce"
|
|
||||||
enum:
|
|
||||||
- value: "ReadWriteOnce"
|
|
||||||
description: "ReadWriteOnce"
|
|
||||||
- value: "ReadOnlyMany"
|
|
||||||
description: "ReadOnlyMany"
|
|
||||||
- value: "ReadWriteMany"
|
|
||||||
description: "ReadWriteMany"
|
|
||||||
- variable: size
|
|
||||||
label: "Size quotum of storage"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "100Gi"
|
|
||||||
- variable: redismaster
|
|
||||||
label: "Redis Storage"
|
|
||||||
description: "Stores the Application redis-master-database."
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the storage"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
hidden: true
|
|
||||||
- variable: noMount
|
|
||||||
label: "Do not mount this storage inside the main pod"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
hidden: true
|
|
||||||
- variable: forceName
|
|
||||||
label: "Override PVC Name (advanced)"
|
|
||||||
description: "Forces a certain name for the PVC"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "redismaster"
|
|
||||||
hidden: true
|
|
||||||
- variable: type
|
|
||||||
label: "(Advanced) Type of Storage"
|
|
||||||
description: "Sets the persistence type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "pvc"
|
|
||||||
hidden: true
|
|
||||||
enum:
|
|
||||||
- value: "pvc"
|
|
||||||
description: "pvc"
|
|
||||||
- value: "emptyDir"
|
|
||||||
description: "emptyDir"
|
|
||||||
- value: "hostPath"
|
|
||||||
description: "hostPath"
|
|
||||||
- variable: storageClass
|
|
||||||
label: "(Advanced) storageClass"
|
|
||||||
description: " Warning: Anything other than SCALE-ZFS will break rollback!"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "SCALE-ZFS"
|
|
||||||
- variable: mountPath
|
|
||||||
label: "mountPath"
|
|
||||||
description: "Path inside the container the storage is mounted"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
hidden: true
|
|
||||||
- variable: medium
|
|
||||||
label: "EmptyDir Medium"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "emptyDir"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
enum:
|
|
||||||
- value: ""
|
|
||||||
description: "Default"
|
|
||||||
- value: "Memory"
|
|
||||||
description: "Memory"
|
|
||||||
- variable: accessMode
|
|
||||||
label: "Access Mode (Advanced)"
|
|
||||||
description: "Allow or disallow multiple PVC's writhing to the same PV"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "ReadWriteOnce"
|
|
||||||
enum:
|
|
||||||
- value: "ReadWriteOnce"
|
|
||||||
description: "ReadWriteOnce"
|
|
||||||
- value: "ReadOnlyMany"
|
|
||||||
description: "ReadOnlyMany"
|
|
||||||
- value: "ReadWriteMany"
|
|
||||||
description: "ReadWriteMany"
|
|
||||||
- variable: size
|
|
||||||
label: "Size quotum of storage"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "100Gi"
|
|
||||||
|
|
||||||
- variable: persistenceList
|
|
||||||
label: "Additional app storage"
|
|
||||||
group: "Storage and Persistence"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: persistenceListEntry
|
|
||||||
label: "Custom Storage"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the storage"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
- variable: type
|
|
||||||
label: "(Advanced) Type of Storage"
|
|
||||||
description: "Sets the persistence type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "hostPath"
|
|
||||||
enum:
|
|
||||||
- value: "pvc"
|
|
||||||
description: "pvc"
|
|
||||||
- value: "emptyDir"
|
|
||||||
description: "emptyDir"
|
|
||||||
- value: "hostPath"
|
|
||||||
description: "hostPath"
|
|
||||||
- variable: storageClass
|
|
||||||
label: "(Advanced) storageClass"
|
|
||||||
description: " Warning: Anything other than SCALE-ZFS will break rollback!"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "SCALE-ZFS"
|
|
||||||
- variable: setPermissions
|
|
||||||
label: "Automatic Permissions"
|
|
||||||
description: "Automatically set permissions on install"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
- variable: readOnly
|
|
||||||
label: "readOnly"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
- variable: hostPath
|
|
||||||
label: "hostPath"
|
|
||||||
description: "Path inside the container the storage is mounted"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: hostpath
|
|
||||||
- variable: hostPathType
|
|
||||||
label: "hostPath Type"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
enum:
|
|
||||||
- value: ""
|
|
||||||
description: "Default"
|
|
||||||
- value: "DirectoryOrCreate"
|
|
||||||
description: "DirectoryOrCreate"
|
|
||||||
- value: "Directory"
|
|
||||||
description: "Directory"
|
|
||||||
- value: "FileOrCreate"
|
|
||||||
description: "FileOrCreate"
|
|
||||||
- value: "File"
|
|
||||||
description: "File"
|
|
||||||
- value: "Socket"
|
|
||||||
description: "Socket"
|
|
||||||
- value: "CharDevice"
|
|
||||||
description: "CharDevice"
|
|
||||||
- value: "BlockDevice"
|
|
||||||
description: "BlockDevice"
|
|
||||||
- variable: mountPath
|
|
||||||
label: "mountPath"
|
|
||||||
description: "Path inside the container the storage is mounted"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: ""
|
|
||||||
- variable: medium
|
|
||||||
label: "EmptyDir Medium"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "emptyDir"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
enum:
|
|
||||||
- value: ""
|
|
||||||
description: "Default"
|
|
||||||
- value: "Memory"
|
|
||||||
description: "Memory"
|
|
||||||
- variable: accessMode
|
|
||||||
label: "Access Mode (Advanced)"
|
|
||||||
description: "Allow or disallow multiple PVC's writhing to the same PVC"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "ReadWriteOnce"
|
|
||||||
enum:
|
|
||||||
- value: "ReadWriteOnce"
|
|
||||||
description: "ReadWriteOnce"
|
|
||||||
- value: "ReadOnlyMany"
|
|
||||||
description: "ReadOnlyMany"
|
|
||||||
- value: "ReadWriteMany"
|
|
||||||
description: "ReadWriteMany"
|
|
||||||
- variable: size
|
|
||||||
label: "Size quotum of storage"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "100Gi"
|
|
||||||
|
|
||||||
- variable: ingress
|
|
||||||
label: ""
|
|
||||||
group: "Ingress"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: main
|
|
||||||
label: "Main Ingress"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable Ingress"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
show_subquestions_if: true
|
|
||||||
subquestions:
|
|
||||||
- variable: hosts
|
|
||||||
label: "Hosts"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: hostEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: host
|
|
||||||
label: "HostName"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
- variable: paths
|
|
||||||
label: "Paths"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: pathEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: path
|
|
||||||
label: "path"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: "/"
|
|
||||||
- variable: pathType
|
|
||||||
label: "pathType"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: "Prefix"
|
|
||||||
- variable: tls
|
|
||||||
label: "TLS-Settings"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: tlsEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: hosts
|
|
||||||
label: "Certificate Hosts"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: host
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
- variable: scaleCert
|
|
||||||
label: "Select TrueNAS SCALE Certificate"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
$ref:
|
|
||||||
- "definitions/certificate"
|
|
||||||
- variable: entrypoint
|
|
||||||
label: "Traefik Entrypoint"
|
|
||||||
description: "Entrypoint used by Traefik when using Traefik as Ingress Provider"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "websecure"
|
|
||||||
required: true
|
|
||||||
- variable: middlewares
|
|
||||||
label: "Traefik Middlewares"
|
|
||||||
description: "Add previously created Traefik Middlewares to this Ingress"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: name
|
|
||||||
label: "Name"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- variable: hpb
|
|
||||||
label: "High Performance Backend Ingress"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable Ingress"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
show_subquestions_if: true
|
|
||||||
subquestions:
|
|
||||||
- variable: hosts
|
|
||||||
label: "Hosts"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: hostEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: host
|
|
||||||
label: "HostName"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
- variable: paths
|
|
||||||
label: "Paths"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: pathEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: path
|
|
||||||
label: "path"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: "/push"
|
|
||||||
- variable: pathType
|
|
||||||
label: "pathType"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: "Prefix"
|
|
||||||
- variable: service
|
|
||||||
label: "Service"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
hidden: true
|
|
||||||
attrs:
|
|
||||||
- variable: name
|
|
||||||
label: "service name"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
hidden: true
|
|
||||||
default: "{{ .Release.Name }}-nextcloud-hpb"
|
|
||||||
- variable: port
|
|
||||||
label: "serviceport"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
hidden: true
|
|
||||||
default: 7867
|
|
||||||
- variable: tls
|
|
||||||
label: "TLS-Settings"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: tlsEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: hosts
|
|
||||||
label: "Certificate Hosts"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: host
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
- variable: scaleCert
|
|
||||||
label: "Select TrueNAS SCALE Certificate"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
$ref:
|
|
||||||
- "definitions/certificate"
|
|
||||||
- variable: entrypoint
|
|
||||||
label: "Traefik Entrypoint"
|
|
||||||
description: "Entrypoint used by Traefik when using Traefik as Ingress Provider"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "websecure"
|
|
||||||
required: true
|
|
||||||
- variable: middlewares
|
|
||||||
label: "Traefik Middlewares"
|
|
||||||
description: "Add previously created Traefik Middlewares to this Ingress"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: name
|
|
||||||
label: "Name"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- variable: podSecurityContext
|
|
||||||
group: "Security and Permissions"
|
|
||||||
label: "Pod Security Context"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: fsGroup
|
|
||||||
label: "fsGroup"
|
|
||||||
description: "The group that should own ALL storage."
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 33
|
|
||||||
- variable: fsGroupChangePolicy
|
|
||||||
label: "When should we take ownership?"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "OnRootMismatch"
|
|
||||||
enum:
|
|
||||||
- value: "OnRootMismatch"
|
|
||||||
description: "OnRootMismatch"
|
|
||||||
- value: "Always"
|
|
||||||
description: "Always"
|
|
||||||
- variable: resources
|
|
||||||
group: "Resources and Devices"
|
|
||||||
label: ""
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: limits
|
|
||||||
label: "Advanced Limit Resource Consumption"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: cpu
|
|
||||||
label: "CPU"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "2000m"
|
|
||||||
- variable: memory
|
|
||||||
label: "Memory RAM"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "2Gi"
|
|
||||||
- variable: requests
|
|
||||||
label: "Advanced Request minimum resources required"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: cpu
|
|
||||||
label: "CPU"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "10m"
|
|
||||||
- variable: memory
|
|
||||||
label: "Memory RAM"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "50Mi"
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
{{/* Define the configmap */}}
|
|
||||||
{{- define "nextcloud.configmap" -}}
|
|
||||||
|
|
||||||
{{- $hosts := "" }}
|
|
||||||
{{- if .Values.ingress.main.enabled }}
|
|
||||||
{{ range $index, $host := .Values.ingress.main.hosts }}
|
|
||||||
{{- if $index }}
|
|
||||||
{{ $hosts = ( printf "%v %v" $hosts $host.host ) }}
|
|
||||||
{{- else }}
|
|
||||||
{{ $hosts = ( printf "%s" $host.host ) }}
|
|
||||||
{{- end }}
|
|
||||||
{{ end }}
|
|
||||||
{{- end }}
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: nextcloudconfig
|
|
||||||
data:
|
|
||||||
NEXTCLOUD_TRUSTED_DOMAINS: {{ ( printf "%v %v %v %v %v" "test.fakedomain.dns" ( .Values.env.NODE_IP | default "localhost" ) ( printf "%v-%v" .Release.Name "nextcloud" ) ( printf "%v-%v" .Release.Name "nextcloud-hpb" ) $hosts ) | quote }}
|
|
||||||
{{- if .Values.ingress.main.enabled }}
|
|
||||||
APACHE_DISABLE_REWRITE_IP: "1"
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: hpbconfig
|
|
||||||
data:
|
|
||||||
NEXTCLOUD_URL: {{ ( printf "%v-%v" .Release.Name "nextcloud" ) | quote }}
|
|
||||||
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,51 +0,0 @@
|
||||||
{{/* Define the cronjob */}}
|
|
||||||
{{- define "nextcloud.cronjob" -}}
|
|
||||||
{{- $jobName := include "common.names.fullname" . -}}
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: batch/v1beta1
|
|
||||||
kind: CronJob
|
|
||||||
metadata:
|
|
||||||
name: {{ printf "%s-cronjob" $jobName }}
|
|
||||||
labels:
|
|
||||||
{{- include "common.labels" . | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
schedule: "{{ .Values.cronjob.schedule }}"
|
|
||||||
concurrencyPolicy: Forbid
|
|
||||||
{{- with .Values.cronjob.failedJobsHistoryLimit }}
|
|
||||||
failedJobsHistoryLimit: {{ . }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.cronjob.successfulJobsHistoryLimit }}
|
|
||||||
successfulJobsHistoryLimit: {{ . }}
|
|
||||||
{{- end }}
|
|
||||||
jobTemplate:
|
|
||||||
metadata:
|
|
||||||
spec:
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
spec:
|
|
||||||
restartPolicy: Never
|
|
||||||
{{- with (include "common.controller.volumes" . | trim) }}
|
|
||||||
volumes:
|
|
||||||
{{- nindent 12 . }}
|
|
||||||
{{- end }}
|
|
||||||
containers:
|
|
||||||
- name: {{ .Chart.Name }}
|
|
||||||
image: "{{ .Values.image.repository }}:{{ default .Values.image.tag }}"
|
|
||||||
imagePullPolicy: {{ default .Values.image.pullPolicy }}
|
|
||||||
command: [ "php" ]
|
|
||||||
args:
|
|
||||||
- "-f"
|
|
||||||
- "/var/www/html/cron.php"
|
|
||||||
# Will mount configuration files as www-data (id: 33) by default for nextcloud
|
|
||||||
{{- with (include "common.controller.volumeMounts" . | trim) }}
|
|
||||||
volumeMounts:
|
|
||||||
{{ nindent 16 . }}
|
|
||||||
{{- end }}
|
|
||||||
securityContext:
|
|
||||||
runAsUser: 33
|
|
||||||
runAsGroup: 33
|
|
||||||
resources:
|
|
||||||
{{ toYaml .Values.resources | indent 16 }}
|
|
||||||
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,50 +0,0 @@
|
||||||
{{/* Define the secrets */}}
|
|
||||||
{{- define "nextcloud.secrets" -}}
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
{{- include "common.labels" . | nindent 4 }}
|
|
||||||
name: dbcreds
|
|
||||||
{{- $previous := lookup "v1" "Secret" .Release.Namespace "dbcreds" }}
|
|
||||||
{{- $dbPass := "" }}
|
|
||||||
data:
|
|
||||||
{{- if $previous }}
|
|
||||||
{{- $dbPass = ( index $previous.data "postgresql-password" ) | b64dec }}
|
|
||||||
postgresql-password: {{ ( index $previous.data "postgresql-password" ) }}
|
|
||||||
postgresql-postgres-password: {{ ( index $previous.data "postgresql-postgres-password" ) }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $dbPass = randAlphaNum 50 }}
|
|
||||||
postgresql-password: {{ $dbPass | b64enc | quote }}
|
|
||||||
postgresql-postgres-password: {{ randAlphaNum 50 | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
url: {{ ( printf "%v%v:%v@%v-%v:%v/%v" "postgresql://" .Values.postgresql.postgresqlUsername $dbPass .Release.Name "postgresql" "5432" .Values.postgresql.postgresqlDatabase ) | b64enc | quote }}
|
|
||||||
host: {{ ( printf "%v-%v:5432" .Release.Name "postgresql" ) | b64enc | quote }}
|
|
||||||
plainhost: {{ ( printf "%v-%v" .Release.Name "postgresql" ) | b64enc | quote }}
|
|
||||||
type: Opaque
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
{{- include "common.labels" . | nindent 4 }}
|
|
||||||
name: rediscreds
|
|
||||||
{{- $redisprevious := lookup "v1" "Secret" .Release.Namespace "rediscreds" }}
|
|
||||||
{{- $redisPass := "" }}
|
|
||||||
data:
|
|
||||||
{{- if $redisprevious }}
|
|
||||||
{{- $redisPass = ( index $redisprevious.data "redis-password" ) | b64dec }}
|
|
||||||
redis-password: {{ ( index $redisprevious.data "redis-password" ) }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $redisPass = randAlphaNum 50 }}
|
|
||||||
redis-password: {{ $redisPass | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
masterhost: {{ ( printf "%v-%v" .Release.Name "redis-master" ) | b64enc | quote }}
|
|
||||||
slavehost: {{ ( printf "%v-%v" .Release.Name "redis-master" ) | b64enc | quote }}
|
|
||||||
type: Opaque
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,14 +0,0 @@
|
||||||
{{/* Make sure all variables are set properly */}}
|
|
||||||
{{- include "common.values.setup" . }}
|
|
||||||
|
|
||||||
{{/* Render the templates */}}
|
|
||||||
{{ include "common.all" . }}
|
|
||||||
|
|
||||||
{{/* Render configmap for nextcloud */}}
|
|
||||||
{{- include "nextcloud.configmap" . }}
|
|
||||||
|
|
||||||
{{/* Render secrets for nextcloud */}}
|
|
||||||
{{- include "nextcloud.secrets" . }}
|
|
||||||
|
|
||||||
{{/* Render cronjob for nextcloud */}}
|
|
||||||
{{- include "nextcloud.cronjob" . }}
|
|
||||||
|
|
@ -1,210 +0,0 @@
|
||||||
# Default values for Bitwarden.
|
|
||||||
|
|
||||||
image:
|
|
||||||
repository: nextcloud
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
tag: 22.1.0
|
|
||||||
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
|
|
||||||
service:
|
|
||||||
main:
|
|
||||||
ports:
|
|
||||||
main:
|
|
||||||
port: 80
|
|
||||||
hpb:
|
|
||||||
enabled: true
|
|
||||||
ports:
|
|
||||||
hpb:
|
|
||||||
enabled: true
|
|
||||||
port: 7867
|
|
||||||
|
|
||||||
env:
|
|
||||||
NEXTCLOUD_ADMIN_USER: "admin"
|
|
||||||
NEXTCLOUD_ADMIN_PASSWORD: "adminpass"
|
|
||||||
TRUSTED_PROXIES: "172.16.0.0/16"
|
|
||||||
|
|
||||||
envTpl:
|
|
||||||
POSTGRES_DB: "{{ .Values.postgresql.postgresqlDatabase }}"
|
|
||||||
POSTGRES_USER: "{{ .Values.postgresql.postgresqlUsername }}"
|
|
||||||
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: nextcloudconfig
|
|
||||||
|
|
||||||
envValueFrom:
|
|
||||||
POSTGRES_PASSWORD:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: postgresql-password
|
|
||||||
POSTGRES_HOST:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: host
|
|
||||||
REDIS_HOST:
|
|
||||||
secretKeyRef:
|
|
||||||
name: rediscreds
|
|
||||||
key: masterhost
|
|
||||||
REDIS_HOST_PASSWORD:
|
|
||||||
secretKeyRef:
|
|
||||||
name: rediscreds
|
|
||||||
key: redis-password
|
|
||||||
|
|
||||||
persistence:
|
|
||||||
data:
|
|
||||||
enabled: true
|
|
||||||
mountPath: "/var/www/html"
|
|
||||||
type: pvc
|
|
||||||
accessMode: ReadWriteOnce
|
|
||||||
size: "100Gi"
|
|
||||||
|
|
||||||
redismaster:
|
|
||||||
noMount: true
|
|
||||||
forceName: "redismaster"
|
|
||||||
enabled: true
|
|
||||||
type: pvc
|
|
||||||
accessMode: ReadWriteOnce
|
|
||||||
size: "100Gi"
|
|
||||||
|
|
||||||
initContainers:
|
|
||||||
- name: init-postgresdb
|
|
||||||
image: postgres:13.1
|
|
||||||
command:
|
|
||||||
- "sh"
|
|
||||||
- "-c"
|
|
||||||
- "until pg_isready -U nextcloud -h ${pghost} ; do sleep 2 ; done"
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
env:
|
|
||||||
- name: pghost
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: plainhost
|
|
||||||
|
|
||||||
additionalContainers:
|
|
||||||
- name: hpb
|
|
||||||
image: nextcloud:21.0.2
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
command:
|
|
||||||
- "/bin/bash"
|
|
||||||
- "-c"
|
|
||||||
- "--"
|
|
||||||
args:
|
|
||||||
- 'while [ ! -f "/var/www/html/custom_apps/notify_push/bin/x86_64/notify_push" ]; do sleep 30; echo "notify_push not found, waiting"; done && /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push /var/www/html/config/config.php'
|
|
||||||
env:
|
|
||||||
- name: PORT
|
|
||||||
value: "7867"
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: hpbconfig
|
|
||||||
ports:
|
|
||||||
- name: hpb
|
|
||||||
containerPort: 7867
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /var/www/html
|
|
||||||
name: data
|
|
||||||
securityContext:
|
|
||||||
runAsUser: 33
|
|
||||||
runAsGroup: 33
|
|
||||||
|
|
||||||
|
|
||||||
podSecurityContext:
|
|
||||||
fsGroup: 33
|
|
||||||
|
|
||||||
# -- Probe configuration
|
|
||||||
# -- [[ref]](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/)
|
|
||||||
# @default -- See below
|
|
||||||
probes:
|
|
||||||
# -- Liveness probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
liveness:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
# -- Redainess probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
readiness:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
# -- Startup probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
startup:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
|
|
||||||
## Cronjob to execute Nextcloud background tasks
|
|
||||||
## ref: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/background_jobs_configuration.html#webcron
|
|
||||||
##
|
|
||||||
cronjob:
|
|
||||||
# Every 5 minutes
|
|
||||||
# Note: Setting this to any any other value than 5 minutes might
|
|
||||||
# cause issues with how nextcloud background jobs are executed
|
|
||||||
schedule: "*/5 * * * *"
|
|
||||||
annotations: {}
|
|
||||||
failedJobsHistoryLimit: 5
|
|
||||||
successfulJobsHistoryLimit: 2
|
|
||||||
|
|
||||||
# Enabled postgres
|
|
||||||
postgresql:
|
|
||||||
enabled: true
|
|
||||||
postgresqlUsername: nextcloud
|
|
||||||
postgresqlDatabase: nextcloud
|
|
||||||
existingSecret: dbcreds
|
|
||||||
|
|
||||||
# Enabled redis
|
|
||||||
# ... for more options see https://github.com/bitnami/charts/tree/master/bitnami/redis
|
|
||||||
redis:
|
|
||||||
volumePermissions:
|
|
||||||
enabled: true
|
|
||||||
architecture: standalone
|
|
||||||
enabled: true
|
|
||||||
auth:
|
|
||||||
existingSecret: rediscreds
|
|
||||||
existingSecretPasswordKey: redis-password
|
|
||||||
master:
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
existingClaim: redismaster
|
|
||||||
replica:
|
|
||||||
replicaCount: 0
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
# Configuration Options
|
|
||||||
|
|
||||||
##### Connecting to other apps
|
|
||||||
If you need to connect this App to other Apps on TrueNAS SCALE, please refer to our "Linking Apps Internally" quick-start guide:
|
|
||||||
https://truecharts.org/manual/Quick-Start%20Guides/14-linking-apps/
|
|
||||||
|
|
||||||
##### Available config options
|
|
||||||
In the future this page is going to contain an automated list of options available in the installation/edit UI.
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
dependencies:
|
|
||||||
- name: common
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 6.10.7
|
|
||||||
- name: postgresql
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 1.2.4
|
|
||||||
- name: redis
|
|
||||||
repository: https://charts.bitnami.com/bitnami
|
|
||||||
version: 15.0.3
|
|
||||||
digest: sha256:c143830b5616998587eb49dc5674fba102aa344fce208d264cd3ab16d71c4e04
|
|
||||||
generated: "2021-08-28T13:15:27.522547176Z"
|
|
||||||
|
|
@ -1,36 +0,0 @@
|
||||||
apiVersion: v2
|
|
||||||
appVersion: auto
|
|
||||||
dependencies:
|
|
||||||
- name: common
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 6.10.7
|
|
||||||
- condition: postgresql.enabled
|
|
||||||
name: postgresql
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 1.2.4
|
|
||||||
- condition: redis.enabled
|
|
||||||
name: redis
|
|
||||||
repository: https://charts.bitnami.com/bitnami
|
|
||||||
version: 15.0.3
|
|
||||||
deprecated: false
|
|
||||||
description: A private cloud server that puts the control and security of your own
|
|
||||||
data back into your hands.
|
|
||||||
home: https://nextcloud.com/
|
|
||||||
icon: https://upload.wikimedia.org/wikipedia/commons/thumb/6/60/Nextcloud_Logo.svg/1280px-Nextcloud_Logo.svg.png
|
|
||||||
keywords:
|
|
||||||
- nextcloud
|
|
||||||
- storage
|
|
||||||
- http
|
|
||||||
- web
|
|
||||||
- php
|
|
||||||
kubeVersion: '>=1.16.0-0'
|
|
||||||
maintainers:
|
|
||||||
- email: info@truecharts.org
|
|
||||||
name: TrueCharts
|
|
||||||
url: truecharts.org
|
|
||||||
name: nextcloud
|
|
||||||
sources:
|
|
||||||
- https://github.com/nextcloud/docker
|
|
||||||
- https://github.com/nextcloud/helm
|
|
||||||
type: application
|
|
||||||
version: 3.1.1
|
|
||||||
|
|
@ -1,45 +0,0 @@
|
||||||
# Introduction
|
|
||||||
|
|
||||||
  
|
|
||||||
|
|
||||||
A private cloud server that puts the control and security of your own data back into your hands.
|
|
||||||
|
|
||||||
TrueCharts are designed to be installed as TrueNAS SCALE app only. We can not guarantee this charts works as a stand-alone helm installation.
|
|
||||||
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/apps/issues/new/choose)**
|
|
||||||
|
|
||||||
## Source Code
|
|
||||||
|
|
||||||
* <https://github.com/nextcloud/docker>
|
|
||||||
* <https://github.com/nextcloud/helm>
|
|
||||||
|
|
||||||
## Requirements
|
|
||||||
|
|
||||||
Kubernetes: `>=1.16.0-0`
|
|
||||||
|
|
||||||
## Dependencies
|
|
||||||
|
|
||||||
| Repository | Name | Version |
|
|
||||||
|------------|------|---------|
|
|
||||||
| https://charts.bitnami.com/bitnami | redis | 14.8.11 |
|
|
||||||
| https://truecharts.org/ | common | 6.10.6 |
|
|
||||||
| https://truecharts.org/ | postgresql | 1.1.0 |
|
|
||||||
|
|
||||||
## Installing the Chart
|
|
||||||
|
|
||||||
To install this App on TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/03-Installing-an-App/).
|
|
||||||
|
|
||||||
## Uninstalling the Chart
|
|
||||||
|
|
||||||
To remove this App from TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/07-Deleting-an-App/).
|
|
||||||
|
|
||||||
## Support
|
|
||||||
|
|
||||||
- Please check our [quick-start guides](https://truecharts.org/manual/Quick-Start%20Guides/01-Open-Apps/) first.
|
|
||||||
- See the [Wiki](https://truecharts.org)
|
|
||||||
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
|
||||||
- Open a [issue](https://github.com/truecharts/apps/issues/new/choose)
|
|
||||||
- Ask a [question](https://github.com/truecharts/apps/discussions)
|
|
||||||
|
|
||||||
----------------------------------------------
|
|
||||||
Autogenerated from chart metadata using [helm-docs v1.5.0](https://github.com/norwoodj/helm-docs/releases/v1.5.0)
|
|
||||||
All Rights Reserved - The TrueCharts Project
|
|
||||||
|
|
@ -1,4 +0,0 @@
|
||||||
A private cloud server that puts the control and security of your own data back into your hands.
|
|
||||||
|
|
||||||
This App is supplied by TrueCharts, for more information please visit https://truecharts.org
|
|
||||||
A private cloud server that puts the control and security of your own
|
|
||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -1,187 +0,0 @@
|
||||||
##
|
|
||||||
# This file contains Values.yaml content that gets added to the output of questions.yaml
|
|
||||||
# It's ONLY meant for content that the user is NOT expected to change.
|
|
||||||
# Example: Everything under "image" is not included in questions.yaml but is included here.
|
|
||||||
##
|
|
||||||
|
|
||||||
image:
|
|
||||||
repository: nextcloud
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
tag: 22.1.0
|
|
||||||
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
|
|
||||||
env: {}
|
|
||||||
|
|
||||||
|
|
||||||
envTpl:
|
|
||||||
POSTGRES_DB: "{{ .Values.postgresql.postgresqlDatabase }}"
|
|
||||||
POSTGRES_USER: "{{ .Values.postgresql.postgresqlUsername }}"
|
|
||||||
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: nextcloudconfig
|
|
||||||
|
|
||||||
envValueFrom:
|
|
||||||
POSTGRES_PASSWORD:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: postgresql-password
|
|
||||||
POSTGRES_HOST:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: host
|
|
||||||
REDIS_HOST:
|
|
||||||
secretKeyRef:
|
|
||||||
name: rediscreds
|
|
||||||
key: masterhost
|
|
||||||
REDIS_HOST_PASSWORD:
|
|
||||||
secretKeyRef:
|
|
||||||
name: rediscreds
|
|
||||||
key: redis-password
|
|
||||||
|
|
||||||
initContainers:
|
|
||||||
- name: init-postgresdb
|
|
||||||
image: postgres:13.1
|
|
||||||
command:
|
|
||||||
- "sh"
|
|
||||||
- "-c"
|
|
||||||
- "until pg_isready -U nextcloud -h ${pghost} ; do sleep 2 ; done"
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
env:
|
|
||||||
- name: pghost
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: plainhost
|
|
||||||
|
|
||||||
additionalContainers:
|
|
||||||
- name: hpb
|
|
||||||
image: nextcloud:21.0.2
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
command:
|
|
||||||
- "/bin/bash"
|
|
||||||
- "-c"
|
|
||||||
- "--"
|
|
||||||
args:
|
|
||||||
- 'while [ ! -f "/var/www/html/custom_apps/notify_push/bin/x86_64/notify_push" ]; do sleep 30; echo "notify_push not found, waiting"; done && /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push /var/www/html/config/config.php'
|
|
||||||
env:
|
|
||||||
- name: PORT
|
|
||||||
value: "7867"
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: hpbconfig
|
|
||||||
ports:
|
|
||||||
- name: hpb
|
|
||||||
containerPort: 7867
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /var/www/html
|
|
||||||
name: data
|
|
||||||
securityContext:
|
|
||||||
runAsUser: 33
|
|
||||||
runAsGroup: 33
|
|
||||||
|
|
||||||
# -- Probe configuration
|
|
||||||
# -- [[ref]](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/)
|
|
||||||
# @default -- See below
|
|
||||||
probes:
|
|
||||||
# -- Liveness probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
liveness:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
# -- Redainess probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
readiness:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
# -- Startup probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
startup:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
## Cronjob to execute Nextcloud background tasks
|
|
||||||
## ref: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/background_jobs_configuration.html#webcron
|
|
||||||
##
|
|
||||||
cronjob:
|
|
||||||
# Every 5 minutes
|
|
||||||
# Note: Setting this to any any other value than 5 minutes might
|
|
||||||
# cause issues with how nextcloud background jobs are executed
|
|
||||||
schedule: "*/5 * * * *"
|
|
||||||
annotations: {}
|
|
||||||
failedJobsHistoryLimit: 5
|
|
||||||
successfulJobsHistoryLimit: 2
|
|
||||||
|
|
||||||
# Enabled postgres
|
|
||||||
postgresql:
|
|
||||||
enabled: true
|
|
||||||
postgresqlUsername: nextcloud
|
|
||||||
postgresqlDatabase: nextcloud
|
|
||||||
existingSecret: dbcreds
|
|
||||||
persistence:
|
|
||||||
db:
|
|
||||||
storageClass: "SCALE-ZFS"
|
|
||||||
dbbackups:
|
|
||||||
storageClass: "SCALE-ZFS"
|
|
||||||
|
|
||||||
# Enabled redis
|
|
||||||
# ... for more options see https://github.com/bitnami/charts/tree/master/bitnami/redis
|
|
||||||
redis:
|
|
||||||
architecture: standalone
|
|
||||||
enabled: true
|
|
||||||
auth:
|
|
||||||
existingSecret: rediscreds
|
|
||||||
existingSecretPasswordKey: redis-password
|
|
||||||
master:
|
|
||||||
persistence:
|
|
||||||
enabled: true
|
|
||||||
existingClaim: redismaster
|
|
||||||
replica:
|
|
||||||
replicaCount: 0
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
##
|
|
||||||
# Most other defaults are set in questions.yaml
|
|
||||||
# For other options please refer to the wiki, default_values.yaml or the common library chart
|
|
||||||
##
|
|
||||||
|
|
@ -1,971 +0,0 @@
|
||||||
groups:
|
|
||||||
- name: "Container Image"
|
|
||||||
description: "Image to be used for container"
|
|
||||||
- name: "Controller"
|
|
||||||
description: "Configure workload deployment"
|
|
||||||
- name: "Container Configuration"
|
|
||||||
description: "additional container configuration"
|
|
||||||
- name: "App Configuration"
|
|
||||||
description: "App specific config options"
|
|
||||||
- name: "Networking and Services"
|
|
||||||
description: "Configure Network and Services for container"
|
|
||||||
- name: "Storage and Persistence"
|
|
||||||
description: "Persist and share data that is separate from the container"
|
|
||||||
- name: "Ingress"
|
|
||||||
description: "Ingress Configuration"
|
|
||||||
- name: "Security and Permissions"
|
|
||||||
description: "Configure security context and permissions"
|
|
||||||
- name: "Resources and Devices"
|
|
||||||
description: "Specify resources/devices to be allocated to workload"
|
|
||||||
- name: "Advanced"
|
|
||||||
description: "Advanced Configuration"
|
|
||||||
portals:
|
|
||||||
web_portal:
|
|
||||||
protocols:
|
|
||||||
- "$kubernetes-resource_configmap_portal_protocol"
|
|
||||||
host:
|
|
||||||
- "$kubernetes-resource_configmap_portal_host"
|
|
||||||
ports:
|
|
||||||
- "$kubernetes-resource_configmap_portal_port"
|
|
||||||
questions:
|
|
||||||
- variable: portal
|
|
||||||
group: "Container Image"
|
|
||||||
label: "Configure Portal Button"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
hidden: true
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable"
|
|
||||||
description: "enable the portal button"
|
|
||||||
schema:
|
|
||||||
hidden: true
|
|
||||||
editable: false
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
- variable: controller
|
|
||||||
group: "Controller"
|
|
||||||
label: ""
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: type
|
|
||||||
description: "Please specify type of workload to deploy"
|
|
||||||
label: "(Advanced) Controller Type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "deployment"
|
|
||||||
required: true
|
|
||||||
enum:
|
|
||||||
- value: "deployment"
|
|
||||||
description: "Deployment"
|
|
||||||
- value: "statefulset"
|
|
||||||
description: "Statefulset"
|
|
||||||
- value: "daemonset"
|
|
||||||
description: "Daemonset"
|
|
||||||
- variable: replicas
|
|
||||||
description: "Number of desired pod replicas"
|
|
||||||
label: "Desired Replicas"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 1
|
|
||||||
required: true
|
|
||||||
- variable: strategy
|
|
||||||
description: "Please specify type of workload to deploy"
|
|
||||||
label: "(Advanced) Update Strategy"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "Recreate"
|
|
||||||
required: true
|
|
||||||
enum:
|
|
||||||
- value: "Recreate"
|
|
||||||
description: "Recreate: Kill existing pods before creating new ones"
|
|
||||||
- value: "RollingUpdate"
|
|
||||||
description: "RollingUpdate: Create new pods and then kill old ones"
|
|
||||||
- value: "OnDelete"
|
|
||||||
description: "(Legacy) OnDelete: ignore .spec.template changes"
|
|
||||||
|
|
||||||
- variable: env
|
|
||||||
group: "Container Configuration"
|
|
||||||
label: "Image Environment"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: TZ
|
|
||||||
label: "Timezone"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "Etc/UTC"
|
|
||||||
$ref:
|
|
||||||
- "definitions/timezone"
|
|
||||||
- variable: UMASK
|
|
||||||
label: "UMASK"
|
|
||||||
description: "Sets the UMASK env var for LinuxServer.io (compatible) containers"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "002"
|
|
||||||
- variable: NEXTCLOUD_ADMIN_USER
|
|
||||||
label: "NEXTCLOUD_ADMIN_USER"
|
|
||||||
description: "Sets nextcloud admin username"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: ""
|
|
||||||
- variable: NEXTCLOUD_ADMIN_PASSWORD
|
|
||||||
label: "NEXTCLOUD_ADMIN_PASSWORD"
|
|
||||||
description: "Sets nextcloud admin password"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: ""
|
|
||||||
- variable: TRUSTED_PROXIES
|
|
||||||
label: "TRUSTED_PROXIES"
|
|
||||||
description: "Sets nextcloud Trusted Proxies"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "172.16.0.0/16"
|
|
||||||
- variable: NODE_IP
|
|
||||||
label: "NODE_IP"
|
|
||||||
description: "Sets nextcloud nodeip for nodeport connections"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
$ref:
|
|
||||||
- "definitions/nodeIP"
|
|
||||||
|
|
||||||
|
|
||||||
# Configure Enviroment Variables
|
|
||||||
- variable: envList
|
|
||||||
label: "Image environment"
|
|
||||||
group: "Container Configuration"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: envItem
|
|
||||||
label: "Environment Variable"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: name
|
|
||||||
label: "Name"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
- variable: value
|
|
||||||
label: "Value"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
|
|
||||||
- variable: hostNetwork
|
|
||||||
group: "Networking and Services"
|
|
||||||
label: "Enable Host Networking"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
|
|
||||||
- variable: service
|
|
||||||
group: "Networking and Services"
|
|
||||||
label: "Configure Service(s)"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: main
|
|
||||||
label: "Main Service"
|
|
||||||
description: "The Primary service on which the healthcheck runs, often the webUI"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the service"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
hidden: true
|
|
||||||
- variable: type
|
|
||||||
label: "Service Type"
|
|
||||||
description: "ClusterIP's are only internally available, nodePorts expose the container to the host node System, Loadbalancer exposes the service using the system loadbalancer"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "NodePort"
|
|
||||||
enum:
|
|
||||||
- value: "NodePort"
|
|
||||||
description: "NodePort"
|
|
||||||
- value: "ClusterIP"
|
|
||||||
description: "ClusterIP"
|
|
||||||
- value: "LoadBalancer"
|
|
||||||
description: "LoadBalancer"
|
|
||||||
- variable: loadBalancerIP
|
|
||||||
label: "LoadBalancer IP"
|
|
||||||
description: "LoadBalancerIP"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "LoadBalancer"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
- variable: externalIPs
|
|
||||||
label: "External IP's"
|
|
||||||
description: "External IP's"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "LoadBalancer"]]
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: externalIP
|
|
||||||
label: "External IP"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
- variable: ports
|
|
||||||
label: "Service's Port(s) Configuration"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: main
|
|
||||||
label: "Main Service Port Configuration"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the port"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
hidden: true
|
|
||||||
- variable: protocol
|
|
||||||
label: "Port Type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "HTTP"
|
|
||||||
enum:
|
|
||||||
- value: HTTP
|
|
||||||
description: "HTTP"
|
|
||||||
- value: "HTTPS"
|
|
||||||
description: "HTTPS"
|
|
||||||
- value: TCP
|
|
||||||
description: "TCP"
|
|
||||||
- value: "UDP"
|
|
||||||
description: "UDP"
|
|
||||||
- variable: port
|
|
||||||
label: "Container Port"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 80
|
|
||||||
editable: false
|
|
||||||
hidden: true
|
|
||||||
- variable: targetport
|
|
||||||
label: "Target Port"
|
|
||||||
description: "This port exposes the container port on the service"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 80
|
|
||||||
editable: true
|
|
||||||
required: true
|
|
||||||
- variable: nodePort
|
|
||||||
label: "Node Port (Optional)"
|
|
||||||
description: "This port gets exposed to the node. Only considered when service type is NodePort"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
min: 9000
|
|
||||||
max: 65535
|
|
||||||
default: 36091
|
|
||||||
required: true
|
|
||||||
- variable: hpb
|
|
||||||
label: "High Performance Backend Service"
|
|
||||||
description: "The service which runs the High Performance Backend"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the service"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
- variable: type
|
|
||||||
label: "Service Type"
|
|
||||||
description: "ClusterIP's are only internally available, nodePorts expose the container to the host node System, Loadbalancer exposes the service using the system loadbalancer"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "NodePort"
|
|
||||||
enum:
|
|
||||||
- value: "NodePort"
|
|
||||||
description: "NodePort"
|
|
||||||
- value: "ClusterIP"
|
|
||||||
description: "ClusterIP"
|
|
||||||
- value: "LoadBalancer"
|
|
||||||
description: "LoadBalancer"
|
|
||||||
- variable: loadBalancerIP
|
|
||||||
label: "LoadBalancer IP"
|
|
||||||
description: "LoadBalancerIP"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "LoadBalancer"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
- variable: externalIPs
|
|
||||||
label: "External IP's"
|
|
||||||
description: "External IP's"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "LoadBalancer"]]
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: externalIP
|
|
||||||
label: "External IP"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
- variable: ports
|
|
||||||
label: "Service's Port(s) Configuration"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: hpb
|
|
||||||
label: "Main Service Port Configuration"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the port"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
hidden: true
|
|
||||||
- variable: protocol
|
|
||||||
label: "Port Type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "HTTP"
|
|
||||||
enum:
|
|
||||||
- value: HTTP
|
|
||||||
description: "HTTP"
|
|
||||||
- value: "HTTPS"
|
|
||||||
description: "HTTPS"
|
|
||||||
- value: TCP
|
|
||||||
description: "TCP"
|
|
||||||
- value: "UDP"
|
|
||||||
description: "UDP"
|
|
||||||
- variable: port
|
|
||||||
label: "Container Port"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 7867
|
|
||||||
editable: false
|
|
||||||
hidden: true
|
|
||||||
- variable: targetport
|
|
||||||
label: "Target Port"
|
|
||||||
description: "This port exposes the container port on the service"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 7867
|
|
||||||
editable: true
|
|
||||||
required: true
|
|
||||||
- variable: nodePort
|
|
||||||
label: "Node Port (Optional)"
|
|
||||||
description: "This port gets exposed to the node. Only considered when service type is NodePort"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
min: 9000
|
|
||||||
max: 65535
|
|
||||||
default: 36092
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- variable: persistence
|
|
||||||
label: "Integrated Persistent Storage"
|
|
||||||
description: "Integrated Persistent Storage"
|
|
||||||
group: "Storage and Persistence"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: data
|
|
||||||
label: "App Data Storage"
|
|
||||||
description: "Stores the Application Data."
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the storage"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
- variable: type
|
|
||||||
label: "(Advanced) Type of Storage"
|
|
||||||
description: "Sets the persistence type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "pvc"
|
|
||||||
enum:
|
|
||||||
- value: "pvc"
|
|
||||||
description: "pvc"
|
|
||||||
- value: "emptyDir"
|
|
||||||
description: "emptyDir"
|
|
||||||
- value: "hostPath"
|
|
||||||
description: "hostPath"
|
|
||||||
- variable: storageClass
|
|
||||||
label: "(Advanced) storageClass"
|
|
||||||
description: " Warning: Anything other than SCALE-ZFS will break rollback!"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "SCALE-ZFS"
|
|
||||||
- variable: setPermissions
|
|
||||||
label: "Automatic Permissions"
|
|
||||||
description: "Automatically set permissions on install"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
- variable: readOnly
|
|
||||||
label: "readOnly"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
- variable: hostPath
|
|
||||||
label: "hostPath"
|
|
||||||
description: "Path inside the container the storage is mounted"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: hostpath
|
|
||||||
- variable: hostPathType
|
|
||||||
label: "hostPath Type"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
enum:
|
|
||||||
- value: ""
|
|
||||||
description: "Default"
|
|
||||||
- value: "DirectoryOrCreate"
|
|
||||||
description: "DirectoryOrCreate"
|
|
||||||
- value: "Directory"
|
|
||||||
description: "Directory"
|
|
||||||
- value: "FileOrCreate"
|
|
||||||
description: "FileOrCreate"
|
|
||||||
- value: "File"
|
|
||||||
description: "File"
|
|
||||||
- value: "Socket"
|
|
||||||
description: "Socket"
|
|
||||||
- value: "CharDevice"
|
|
||||||
description: "CharDevice"
|
|
||||||
- value: "BlockDevice"
|
|
||||||
description: "BlockDevice"
|
|
||||||
- variable: mountPath
|
|
||||||
label: "mountPath"
|
|
||||||
description: "Path inside the container the storage is mounted"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "/var/www/html"
|
|
||||||
hidden: true
|
|
||||||
- variable: medium
|
|
||||||
label: "EmptyDir Medium"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "emptyDir"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
enum:
|
|
||||||
- value: ""
|
|
||||||
description: "Default"
|
|
||||||
- value: "Memory"
|
|
||||||
description: "Memory"
|
|
||||||
- variable: accessMode
|
|
||||||
label: "Access Mode (Advanced)"
|
|
||||||
description: "Allow or disallow multiple PVC's writhing to the same PV"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "ReadWriteOnce"
|
|
||||||
enum:
|
|
||||||
- value: "ReadWriteOnce"
|
|
||||||
description: "ReadWriteOnce"
|
|
||||||
- value: "ReadOnlyMany"
|
|
||||||
description: "ReadOnlyMany"
|
|
||||||
- value: "ReadWriteMany"
|
|
||||||
description: "ReadWriteMany"
|
|
||||||
- variable: size
|
|
||||||
label: "Size quotum of storage"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "100Gi"
|
|
||||||
- variable: redismaster
|
|
||||||
label: "Redis Storage"
|
|
||||||
description: "Stores the Application redis-master-database."
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the storage"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
hidden: true
|
|
||||||
- variable: noMount
|
|
||||||
label: "Do not mount this storage inside the main pod"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
hidden: true
|
|
||||||
- variable: forceName
|
|
||||||
label: "Override PVC Name (advanced)"
|
|
||||||
description: "Forces a certain name for the PVC"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "redismaster"
|
|
||||||
hidden: true
|
|
||||||
- variable: type
|
|
||||||
label: "(Advanced) Type of Storage"
|
|
||||||
description: "Sets the persistence type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "pvc"
|
|
||||||
hidden: true
|
|
||||||
enum:
|
|
||||||
- value: "pvc"
|
|
||||||
description: "pvc"
|
|
||||||
- value: "emptyDir"
|
|
||||||
description: "emptyDir"
|
|
||||||
- value: "hostPath"
|
|
||||||
description: "hostPath"
|
|
||||||
- variable: storageClass
|
|
||||||
label: "(Advanced) storageClass"
|
|
||||||
description: " Warning: Anything other than SCALE-ZFS will break rollback!"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "SCALE-ZFS"
|
|
||||||
- variable: mountPath
|
|
||||||
label: "mountPath"
|
|
||||||
description: "Path inside the container the storage is mounted"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
hidden: true
|
|
||||||
- variable: medium
|
|
||||||
label: "EmptyDir Medium"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "emptyDir"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
enum:
|
|
||||||
- value: ""
|
|
||||||
description: "Default"
|
|
||||||
- value: "Memory"
|
|
||||||
description: "Memory"
|
|
||||||
- variable: accessMode
|
|
||||||
label: "Access Mode (Advanced)"
|
|
||||||
description: "Allow or disallow multiple PVC's writhing to the same PV"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "ReadWriteOnce"
|
|
||||||
enum:
|
|
||||||
- value: "ReadWriteOnce"
|
|
||||||
description: "ReadWriteOnce"
|
|
||||||
- value: "ReadOnlyMany"
|
|
||||||
description: "ReadOnlyMany"
|
|
||||||
- value: "ReadWriteMany"
|
|
||||||
description: "ReadWriteMany"
|
|
||||||
- variable: size
|
|
||||||
label: "Size quotum of storage"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "100Gi"
|
|
||||||
|
|
||||||
- variable: persistenceList
|
|
||||||
label: "Additional app storage"
|
|
||||||
group: "Storage and Persistence"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: persistenceListEntry
|
|
||||||
label: "Custom Storage"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable the storage"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
- variable: type
|
|
||||||
label: "(Advanced) Type of Storage"
|
|
||||||
description: "Sets the persistence type"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "hostPath"
|
|
||||||
enum:
|
|
||||||
- value: "pvc"
|
|
||||||
description: "pvc"
|
|
||||||
- value: "emptyDir"
|
|
||||||
description: "emptyDir"
|
|
||||||
- value: "hostPath"
|
|
||||||
description: "hostPath"
|
|
||||||
- variable: storageClass
|
|
||||||
label: "(Advanced) storageClass"
|
|
||||||
description: " Warning: Anything other than SCALE-ZFS will break rollback!"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "SCALE-ZFS"
|
|
||||||
- variable: setPermissions
|
|
||||||
label: "Automatic Permissions"
|
|
||||||
description: "Automatically set permissions on install"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
- variable: readOnly
|
|
||||||
label: "readOnly"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
- variable: hostPath
|
|
||||||
label: "hostPath"
|
|
||||||
description: "Path inside the container the storage is mounted"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: hostpath
|
|
||||||
- variable: hostPathType
|
|
||||||
label: "hostPath Type"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "hostPath"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
enum:
|
|
||||||
- value: ""
|
|
||||||
description: "Default"
|
|
||||||
- value: "DirectoryOrCreate"
|
|
||||||
description: "DirectoryOrCreate"
|
|
||||||
- value: "Directory"
|
|
||||||
description: "Directory"
|
|
||||||
- value: "FileOrCreate"
|
|
||||||
description: "FileOrCreate"
|
|
||||||
- value: "File"
|
|
||||||
description: "File"
|
|
||||||
- value: "Socket"
|
|
||||||
description: "Socket"
|
|
||||||
- value: "CharDevice"
|
|
||||||
description: "CharDevice"
|
|
||||||
- value: "BlockDevice"
|
|
||||||
description: "BlockDevice"
|
|
||||||
- variable: mountPath
|
|
||||||
label: "mountPath"
|
|
||||||
description: "Path inside the container the storage is mounted"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: ""
|
|
||||||
- variable: medium
|
|
||||||
label: "EmptyDir Medium"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "emptyDir"]]
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
enum:
|
|
||||||
- value: ""
|
|
||||||
description: "Default"
|
|
||||||
- value: "Memory"
|
|
||||||
description: "Memory"
|
|
||||||
- variable: accessMode
|
|
||||||
label: "Access Mode (Advanced)"
|
|
||||||
description: "Allow or disallow multiple PVC's writhing to the same PVC"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "ReadWriteOnce"
|
|
||||||
enum:
|
|
||||||
- value: "ReadWriteOnce"
|
|
||||||
description: "ReadWriteOnce"
|
|
||||||
- value: "ReadOnlyMany"
|
|
||||||
description: "ReadOnlyMany"
|
|
||||||
- value: "ReadWriteMany"
|
|
||||||
description: "ReadWriteMany"
|
|
||||||
- variable: size
|
|
||||||
label: "Size quotum of storage"
|
|
||||||
schema:
|
|
||||||
show_if: [["type", "=", "pvc"]]
|
|
||||||
type: string
|
|
||||||
default: "100Gi"
|
|
||||||
|
|
||||||
- variable: ingress
|
|
||||||
label: ""
|
|
||||||
group: "Ingress"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: main
|
|
||||||
label: "Main Ingress"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable Ingress"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
show_subquestions_if: true
|
|
||||||
subquestions:
|
|
||||||
- variable: hosts
|
|
||||||
label: "Hosts"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: hostEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: host
|
|
||||||
label: "HostName"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
- variable: paths
|
|
||||||
label: "Paths"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: pathEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: path
|
|
||||||
label: "path"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: "/"
|
|
||||||
- variable: pathType
|
|
||||||
label: "pathType"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: "Prefix"
|
|
||||||
- variable: tls
|
|
||||||
label: "TLS-Settings"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: tlsEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: hosts
|
|
||||||
label: "Certificate Hosts"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: host
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
- variable: scaleCert
|
|
||||||
label: "Select TrueNAS SCALE Certificate"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
$ref:
|
|
||||||
- "definitions/certificate"
|
|
||||||
- variable: entrypoint
|
|
||||||
label: "Traefik Entrypoint"
|
|
||||||
description: "Entrypoint used by Traefik when using Traefik as Ingress Provider"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "websecure"
|
|
||||||
required: true
|
|
||||||
- variable: middlewares
|
|
||||||
label: "Traefik Middlewares"
|
|
||||||
description: "Add previously created Traefik Middlewares to this Ingress"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: name
|
|
||||||
label: "Name"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- variable: hpb
|
|
||||||
label: "High Performance Backend Ingress"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: enabled
|
|
||||||
label: "Enable Ingress"
|
|
||||||
schema:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
show_subquestions_if: true
|
|
||||||
subquestions:
|
|
||||||
- variable: hosts
|
|
||||||
label: "Hosts"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: hostEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: host
|
|
||||||
label: "HostName"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
- variable: paths
|
|
||||||
label: "Paths"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: pathEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: path
|
|
||||||
label: "path"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: "/push"
|
|
||||||
- variable: pathType
|
|
||||||
label: "pathType"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
default: "Prefix"
|
|
||||||
- variable: service
|
|
||||||
label: "Service"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
hidden: true
|
|
||||||
attrs:
|
|
||||||
- variable: name
|
|
||||||
label: "service name"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
hidden: true
|
|
||||||
default: "{{ .Release.Name }}-nextcloud-hpb"
|
|
||||||
- variable: port
|
|
||||||
label: "serviceport"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
hidden: true
|
|
||||||
default: 7867
|
|
||||||
- variable: tls
|
|
||||||
label: "TLS-Settings"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: tlsEntry
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: hosts
|
|
||||||
label: "Certificate Hosts"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: host
|
|
||||||
label: "Host"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
- variable: scaleCert
|
|
||||||
label: "Select TrueNAS SCALE Certificate"
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
$ref:
|
|
||||||
- "definitions/certificate"
|
|
||||||
- variable: entrypoint
|
|
||||||
label: "Traefik Entrypoint"
|
|
||||||
description: "Entrypoint used by Traefik when using Traefik as Ingress Provider"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "websecure"
|
|
||||||
required: true
|
|
||||||
- variable: middlewares
|
|
||||||
label: "Traefik Middlewares"
|
|
||||||
description: "Add previously created Traefik Middlewares to this Ingress"
|
|
||||||
schema:
|
|
||||||
type: list
|
|
||||||
default: []
|
|
||||||
items:
|
|
||||||
- variable: name
|
|
||||||
label: "Name"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: ""
|
|
||||||
required: true
|
|
||||||
|
|
||||||
- variable: podSecurityContext
|
|
||||||
group: "Security and Permissions"
|
|
||||||
label: "Pod Security Context"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: fsGroup
|
|
||||||
label: "fsGroup"
|
|
||||||
description: "The group that should own ALL storage."
|
|
||||||
schema:
|
|
||||||
type: int
|
|
||||||
default: 33
|
|
||||||
- variable: fsGroupChangePolicy
|
|
||||||
label: "When should we take ownership?"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "OnRootMismatch"
|
|
||||||
enum:
|
|
||||||
- value: "OnRootMismatch"
|
|
||||||
description: "OnRootMismatch"
|
|
||||||
- value: "Always"
|
|
||||||
description: "Always"
|
|
||||||
- variable: resources
|
|
||||||
group: "Resources and Devices"
|
|
||||||
label: ""
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: limits
|
|
||||||
label: "Advanced Limit Resource Consumption"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: cpu
|
|
||||||
label: "CPU"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "2000m"
|
|
||||||
- variable: memory
|
|
||||||
label: "Memory RAM"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "2Gi"
|
|
||||||
- variable: requests
|
|
||||||
label: "Advanced Request minimum resources required"
|
|
||||||
schema:
|
|
||||||
type: dict
|
|
||||||
attrs:
|
|
||||||
- variable: cpu
|
|
||||||
label: "CPU"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "10m"
|
|
||||||
- variable: memory
|
|
||||||
label: "Memory RAM"
|
|
||||||
schema:
|
|
||||||
type: string
|
|
||||||
default: "50Mi"
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
{{/* Define the configmap */}}
|
|
||||||
{{- define "nextcloud.configmap" -}}
|
|
||||||
|
|
||||||
{{- $hosts := "" }}
|
|
||||||
{{- if .Values.ingress.main.enabled }}
|
|
||||||
{{ range $index, $host := .Values.ingress.main.hosts }}
|
|
||||||
{{- if $index }}
|
|
||||||
{{ $hosts = ( printf "%v %v" $hosts $host.host ) }}
|
|
||||||
{{- else }}
|
|
||||||
{{ $hosts = ( printf "%s" $host.host ) }}
|
|
||||||
{{- end }}
|
|
||||||
{{ end }}
|
|
||||||
{{- end }}
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: nextcloudconfig
|
|
||||||
data:
|
|
||||||
NEXTCLOUD_TRUSTED_DOMAINS: {{ ( printf "%v %v %v %v %v" "test.fakedomain.dns" ( .Values.env.NODE_IP | default "localhost" ) ( printf "%v-%v" .Release.Name "nextcloud" ) ( printf "%v-%v" .Release.Name "nextcloud-hpb" ) $hosts ) | quote }}
|
|
||||||
{{- if .Values.ingress.main.enabled }}
|
|
||||||
APACHE_DISABLE_REWRITE_IP: "1"
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: hpbconfig
|
|
||||||
data:
|
|
||||||
NEXTCLOUD_URL: {{ ( printf "%v-%v" .Release.Name "nextcloud" ) | quote }}
|
|
||||||
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,51 +0,0 @@
|
||||||
{{/* Define the cronjob */}}
|
|
||||||
{{- define "nextcloud.cronjob" -}}
|
|
||||||
{{- $jobName := include "common.names.fullname" . -}}
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: batch/v1beta1
|
|
||||||
kind: CronJob
|
|
||||||
metadata:
|
|
||||||
name: {{ printf "%s-cronjob" $jobName }}
|
|
||||||
labels:
|
|
||||||
{{- include "common.labels" . | nindent 4 }}
|
|
||||||
spec:
|
|
||||||
schedule: "{{ .Values.cronjob.schedule }}"
|
|
||||||
concurrencyPolicy: Forbid
|
|
||||||
{{- with .Values.cronjob.failedJobsHistoryLimit }}
|
|
||||||
failedJobsHistoryLimit: {{ . }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.cronjob.successfulJobsHistoryLimit }}
|
|
||||||
successfulJobsHistoryLimit: {{ . }}
|
|
||||||
{{- end }}
|
|
||||||
jobTemplate:
|
|
||||||
metadata:
|
|
||||||
spec:
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
spec:
|
|
||||||
restartPolicy: Never
|
|
||||||
{{- with (include "common.controller.volumes" . | trim) }}
|
|
||||||
volumes:
|
|
||||||
{{- nindent 12 . }}
|
|
||||||
{{- end }}
|
|
||||||
containers:
|
|
||||||
- name: {{ .Chart.Name }}
|
|
||||||
image: "{{ .Values.image.repository }}:{{ default .Values.image.tag }}"
|
|
||||||
imagePullPolicy: {{ default .Values.image.pullPolicy }}
|
|
||||||
command: [ "php" ]
|
|
||||||
args:
|
|
||||||
- "-f"
|
|
||||||
- "/var/www/html/cron.php"
|
|
||||||
# Will mount configuration files as www-data (id: 33) by default for nextcloud
|
|
||||||
{{- with (include "common.controller.volumeMounts" . | trim) }}
|
|
||||||
volumeMounts:
|
|
||||||
{{ nindent 16 . }}
|
|
||||||
{{- end }}
|
|
||||||
securityContext:
|
|
||||||
runAsUser: 33
|
|
||||||
runAsGroup: 33
|
|
||||||
resources:
|
|
||||||
{{ toYaml .Values.resources | indent 16 }}
|
|
||||||
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,50 +0,0 @@
|
||||||
{{/* Define the secrets */}}
|
|
||||||
{{- define "nextcloud.secrets" -}}
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
{{- include "common.labels" . | nindent 4 }}
|
|
||||||
name: dbcreds
|
|
||||||
{{- $previous := lookup "v1" "Secret" .Release.Namespace "dbcreds" }}
|
|
||||||
{{- $dbPass := "" }}
|
|
||||||
data:
|
|
||||||
{{- if $previous }}
|
|
||||||
{{- $dbPass = ( index $previous.data "postgresql-password" ) | b64dec }}
|
|
||||||
postgresql-password: {{ ( index $previous.data "postgresql-password" ) }}
|
|
||||||
postgresql-postgres-password: {{ ( index $previous.data "postgresql-postgres-password" ) }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $dbPass = randAlphaNum 50 }}
|
|
||||||
postgresql-password: {{ $dbPass | b64enc | quote }}
|
|
||||||
postgresql-postgres-password: {{ randAlphaNum 50 | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
url: {{ ( printf "%v%v:%v@%v-%v:%v/%v" "postgresql://" .Values.postgresql.postgresqlUsername $dbPass .Release.Name "postgresql" "5432" .Values.postgresql.postgresqlDatabase ) | b64enc | quote }}
|
|
||||||
host: {{ ( printf "%v-%v:5432" .Release.Name "postgresql" ) | b64enc | quote }}
|
|
||||||
plainhost: {{ ( printf "%v-%v" .Release.Name "postgresql" ) | b64enc | quote }}
|
|
||||||
type: Opaque
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
{{- include "common.labels" . | nindent 4 }}
|
|
||||||
name: rediscreds
|
|
||||||
{{- $redisprevious := lookup "v1" "Secret" .Release.Namespace "rediscreds" }}
|
|
||||||
{{- $redisPass := "" }}
|
|
||||||
data:
|
|
||||||
{{- if $redisprevious }}
|
|
||||||
{{- $redisPass = ( index $redisprevious.data "redis-password" ) | b64dec }}
|
|
||||||
redis-password: {{ ( index $redisprevious.data "redis-password" ) }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $redisPass = randAlphaNum 50 }}
|
|
||||||
redis-password: {{ $redisPass | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
masterhost: {{ ( printf "%v-%v" .Release.Name "redis-master" ) | b64enc | quote }}
|
|
||||||
slavehost: {{ ( printf "%v-%v" .Release.Name "redis-master" ) | b64enc | quote }}
|
|
||||||
type: Opaque
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,14 +0,0 @@
|
||||||
{{/* Make sure all variables are set properly */}}
|
|
||||||
{{- include "common.values.setup" . }}
|
|
||||||
|
|
||||||
{{/* Render the templates */}}
|
|
||||||
{{ include "common.all" . }}
|
|
||||||
|
|
||||||
{{/* Render configmap for nextcloud */}}
|
|
||||||
{{- include "nextcloud.configmap" . }}
|
|
||||||
|
|
||||||
{{/* Render secrets for nextcloud */}}
|
|
||||||
{{- include "nextcloud.secrets" . }}
|
|
||||||
|
|
||||||
{{/* Render cronjob for nextcloud */}}
|
|
||||||
{{- include "nextcloud.cronjob" . }}
|
|
||||||
|
|
@ -1,210 +0,0 @@
|
||||||
# Default values for Bitwarden.
|
|
||||||
|
|
||||||
image:
|
|
||||||
repository: nextcloud
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
tag: 22.1.0
|
|
||||||
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
|
|
||||||
service:
|
|
||||||
main:
|
|
||||||
ports:
|
|
||||||
main:
|
|
||||||
port: 80
|
|
||||||
hpb:
|
|
||||||
enabled: true
|
|
||||||
ports:
|
|
||||||
hpb:
|
|
||||||
enabled: true
|
|
||||||
port: 7867
|
|
||||||
|
|
||||||
env:
|
|
||||||
NEXTCLOUD_ADMIN_USER: "admin"
|
|
||||||
NEXTCLOUD_ADMIN_PASSWORD: "adminpass"
|
|
||||||
TRUSTED_PROXIES: "172.16.0.0/16"
|
|
||||||
|
|
||||||
envTpl:
|
|
||||||
POSTGRES_DB: "{{ .Values.postgresql.postgresqlDatabase }}"
|
|
||||||
POSTGRES_USER: "{{ .Values.postgresql.postgresqlUsername }}"
|
|
||||||
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: nextcloudconfig
|
|
||||||
|
|
||||||
envValueFrom:
|
|
||||||
POSTGRES_PASSWORD:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: postgresql-password
|
|
||||||
POSTGRES_HOST:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: host
|
|
||||||
REDIS_HOST:
|
|
||||||
secretKeyRef:
|
|
||||||
name: rediscreds
|
|
||||||
key: masterhost
|
|
||||||
REDIS_HOST_PASSWORD:
|
|
||||||
secretKeyRef:
|
|
||||||
name: rediscreds
|
|
||||||
key: redis-password
|
|
||||||
|
|
||||||
persistence:
|
|
||||||
data:
|
|
||||||
enabled: true
|
|
||||||
mountPath: "/var/www/html"
|
|
||||||
type: pvc
|
|
||||||
accessMode: ReadWriteOnce
|
|
||||||
size: "100Gi"
|
|
||||||
|
|
||||||
redismaster:
|
|
||||||
noMount: true
|
|
||||||
forceName: "redismaster"
|
|
||||||
enabled: true
|
|
||||||
type: pvc
|
|
||||||
accessMode: ReadWriteOnce
|
|
||||||
size: "100Gi"
|
|
||||||
|
|
||||||
initContainers:
|
|
||||||
- name: init-postgresdb
|
|
||||||
image: postgres:13.1
|
|
||||||
command:
|
|
||||||
- "sh"
|
|
||||||
- "-c"
|
|
||||||
- "until pg_isready -U nextcloud -h ${pghost} ; do sleep 2 ; done"
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
env:
|
|
||||||
- name: pghost
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dbcreds
|
|
||||||
key: plainhost
|
|
||||||
|
|
||||||
additionalContainers:
|
|
||||||
- name: hpb
|
|
||||||
image: nextcloud:21.0.2
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
command:
|
|
||||||
- "/bin/bash"
|
|
||||||
- "-c"
|
|
||||||
- "--"
|
|
||||||
args:
|
|
||||||
- 'while [ ! -f "/var/www/html/custom_apps/notify_push/bin/x86_64/notify_push" ]; do sleep 30; echo "notify_push not found, waiting"; done && /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push /var/www/html/config/config.php'
|
|
||||||
env:
|
|
||||||
- name: PORT
|
|
||||||
value: "7867"
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: hpbconfig
|
|
||||||
ports:
|
|
||||||
- name: hpb
|
|
||||||
containerPort: 7867
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /var/www/html
|
|
||||||
name: data
|
|
||||||
securityContext:
|
|
||||||
runAsUser: 33
|
|
||||||
runAsGroup: 33
|
|
||||||
|
|
||||||
|
|
||||||
podSecurityContext:
|
|
||||||
fsGroup: 33
|
|
||||||
|
|
||||||
# -- Probe configuration
|
|
||||||
# -- [[ref]](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/)
|
|
||||||
# @default -- See below
|
|
||||||
probes:
|
|
||||||
# -- Liveness probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
liveness:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
# -- Redainess probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
readiness:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
# -- Startup probe configuration
|
|
||||||
# @default -- See below
|
|
||||||
startup:
|
|
||||||
custom: true
|
|
||||||
# -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
|
|
||||||
# @default -- "/"
|
|
||||||
spec:
|
|
||||||
httpGet:
|
|
||||||
path: /status.php
|
|
||||||
port: 80
|
|
||||||
httpHeaders:
|
|
||||||
- name: Host
|
|
||||||
value: "test.fakedomain.dns"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
|
|
||||||
## Cronjob to execute Nextcloud background tasks
|
|
||||||
## ref: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/background_jobs_configuration.html#webcron
|
|
||||||
##
|
|
||||||
cronjob:
|
|
||||||
# Every 5 minutes
|
|
||||||
# Note: Setting this to any any other value than 5 minutes might
|
|
||||||
# cause issues with how nextcloud background jobs are executed
|
|
||||||
schedule: "*/5 * * * *"
|
|
||||||
annotations: {}
|
|
||||||
failedJobsHistoryLimit: 5
|
|
||||||
successfulJobsHistoryLimit: 2
|
|
||||||
|
|
||||||
# Enabled postgres
|
|
||||||
postgresql:
|
|
||||||
enabled: true
|
|
||||||
postgresqlUsername: nextcloud
|
|
||||||
postgresqlDatabase: nextcloud
|
|
||||||
existingSecret: dbcreds
|
|
||||||
|
|
||||||
# Enabled redis
|
|
||||||
# ... for more options see https://github.com/bitnami/charts/tree/master/bitnami/redis
|
|
||||||
redis:
|
|
||||||
volumePermissions:
|
|
||||||
enabled: true
|
|
||||||
architecture: standalone
|
|
||||||
enabled: true
|
|
||||||
auth:
|
|
||||||
existingSecret: rediscreds
|
|
||||||
existingSecretPasswordKey: redis-password
|
|
||||||
master:
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
existingClaim: redismaster
|
|
||||||
replica:
|
|
||||||
replicaCount: 0
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
# Configuration Options
|
|
||||||
|
|
||||||
##### Connecting to other apps
|
|
||||||
If you need to connect this App to other Apps on TrueNAS SCALE, please refer to our "Linking Apps Internally" quick-start guide:
|
|
||||||
https://truecharts.org/manual/Quick-Start%20Guides/14-linking-apps/
|
|
||||||
|
|
||||||
##### Available config options
|
|
||||||
In the future this page is going to contain an automated list of options available in the installation/edit UI.
|
|
||||||
|
|
@ -1,6 +0,0 @@
|
||||||
dependencies:
|
|
||||||
- name: common
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 6.10.6
|
|
||||||
digest: sha256:b4bf4983bf57b47bd2c23cfa38cf9ffbf029eb690a4c5a968c4580bf0ffe5b8d
|
|
||||||
generated: "2021-08-28T12:06:36.498267738Z"
|
|
||||||
|
|
@ -1,22 +0,0 @@
|
||||||
apiVersion: v2
|
|
||||||
appVersion: auto
|
|
||||||
dependencies:
|
|
||||||
- name: common
|
|
||||||
repository: https://truecharts.org/
|
|
||||||
version: 6.10.6
|
|
||||||
description: Airsonic is a Free and Open Source community driven media server
|
|
||||||
home: https://github.com/truecharts/apps/tree/master/charts/incubator/airsonic
|
|
||||||
icon: https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/airsonic-logo.png
|
|
||||||
keywords:
|
|
||||||
- airsonic
|
|
||||||
kubeVersion: '>=1.16.0-0'
|
|
||||||
maintainers:
|
|
||||||
- email: info@truecharts.org
|
|
||||||
name: TrueCharts
|
|
||||||
url: truecharts.org
|
|
||||||
name: airsonic
|
|
||||||
sources:
|
|
||||||
- https://github.com/airsonic/airsonic
|
|
||||||
- https://github.com/linuxserver/docker-airsonic
|
|
||||||
- https://github.com/k8s-at-home/charts/tree/master/charts/airsonic
|
|
||||||
version: 1.8.2
|
|
||||||
|
|
@ -1,44 +0,0 @@
|
||||||
# Introduction
|
|
||||||
|
|
||||||
 
|
|
||||||
|
|
||||||
Airsonic is a Free and Open Source community driven media server
|
|
||||||
|
|
||||||
TrueCharts are designed to be installed as TrueNAS SCALE app only. We can not guarantee this charts works as a stand-alone helm installation.
|
|
||||||
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/apps/issues/new/choose)**
|
|
||||||
|
|
||||||
## Source Code
|
|
||||||
|
|
||||||
* <https://github.com/airsonic/airsonic>
|
|
||||||
* <https://github.com/linuxserver/docker-airsonic>
|
|
||||||
* <https://github.com/k8s-at-home/charts/tree/master/charts/airsonic>
|
|
||||||
|
|
||||||
## Requirements
|
|
||||||
|
|
||||||
Kubernetes: `>=1.16.0-0`
|
|
||||||
|
|
||||||
## Dependencies
|
|
||||||
|
|
||||||
| Repository | Name | Version |
|
|
||||||
|------------|------|---------|
|
|
||||||
| https://truecharts.org/ | common | 6.10.6 |
|
|
||||||
|
|
||||||
## Installing the Chart
|
|
||||||
|
|
||||||
To install this App on TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/03-Installing-an-App/).
|
|
||||||
|
|
||||||
## Uninstalling the Chart
|
|
||||||
|
|
||||||
To remove this App from TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/07-Deleting-an-App/).
|
|
||||||
|
|
||||||
## Support
|
|
||||||
|
|
||||||
- Please check our [quick-start guides](https://truecharts.org/manual/Quick-Start%20Guides/01-Open-Apps/) first.
|
|
||||||
- See the [Wiki](https://truecharts.org)
|
|
||||||
- Check our [Discord](https://discord.gg/tVsPTHWTtr)
|
|
||||||
- Open a [issue](https://github.com/truecharts/apps/issues/new/choose)
|
|
||||||
- Ask a [question](https://github.com/truecharts/apps/discussions)
|
|
||||||
|
|
||||||
----------------------------------------------
|
|
||||||
Autogenerated from chart metadata using [helm-docs v1.5.0](https://github.com/norwoodj/helm-docs/releases/v1.5.0)
|
|
||||||
All Rights Reserved - The TrueCharts Project
|
|
||||||
|
|
@ -1,4 +0,0 @@
|
||||||
Airsonic is a Free and Open Source community driven media server
|
|
||||||
|
|
||||||
This App is supplied by TrueCharts, for more information please visit https://truecharts.org
|
|
||||||
Airsonic is a Free and Open Source community driven media server
|
|
||||||
Binary file not shown.
|
|
@ -1,19 +0,0 @@
|
||||||
##
|
|
||||||
# This file contains Values.yaml content that gets added to the output of questions.yaml
|
|
||||||
# It's ONLY meant for content that the user is NOT expected to change.
|
|
||||||
# Example: Everything under "image" is not included in questions.yaml but is included here.
|
|
||||||
##
|
|
||||||
|
|
||||||
image:
|
|
||||||
# -- image repository
|
|
||||||
repository: linuxserver/airsonic
|
|
||||||
# -- image tag
|
|
||||||
tag: version-v10.6.2
|
|
||||||
# -- image pull policy
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
|
|
||||||
|
|
||||||
##
|
|
||||||
# Most other defaults are set in questions.yaml
|
|
||||||
# For other options please refer to the wiki, default_values.yaml or the common library chart
|
|
||||||
##
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue