Switch external services to k3s-managed SSL certs using cert-manager

cert-manager/letsencrypt-cluster-issuer.yaml

@@ -0,0 +1,16 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: nest@mynest.love
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+    - dns01:
+        cloudflare:
+          apiTokenSecretRef:
+            name: cloudflare-api-token-secret
+            key: api-token

external-secrets/cloudflare-api-token.yaml

@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: cloudflare-api-token
+  namespace: cert-manager
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-external-secrets-store
+    kind: ClusterSecretStore
+  target:
+    name: cloudflare-api-token-secret
+    creationPolicy: Owner
+  data:
+  - secretKey: api-token
+    remoteRef:
+      key: cloudflare
+      property: api-key

external-secrets/secretstores/vault-secretstore.yaml

@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: vault-external-secrets-store
+  namespace: external-secrets
+spec:
+  provider:
+    vault:
+      server: "http://vault.vault.svc.cluster.local:8200"
+      path: "secret"
+      version: "v2"
+      auth:
+        kubernetes:
+          mountPath: "kubernetes"
+          role: "eso-role"
+          serviceAccountRef:
+            name: "external-secrets"
+            namespace: "external-secrets"

services/audiobookshelf/audiobookshelf-ingress.yaml

@@ -1,11 +1,29 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: audiobookshelf-proxy-headers
+  namespace: default
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: audiobookshelf-ingress
   namespace: default
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: default-audiobookshelf-proxy-headers@kubernetescrd
+
 spec:
+  tls:
+  - hosts:
+    - lyrebird.mynest.love
+    secretName: audiobookshelf-tls
   rules:
   - host: lyrebird.mynest.love
     http:

services/calibre-web/calibre-web-deployment.yaml

@@ -4,6 +4,8 @@ metadata:
   labels:
     io.kompose.service: calibre-web
   name: calibre-web
+  annotations:
+    reloader.stakater.com/auto: "true"
 spec:
   replicas: 1
   selector:

services/calibre-web/calibre-web-ingress.yaml

@@ -1,11 +1,28 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: calibre-web-proxy-headers
+  namespace: default
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: calibre-web-ingress
   namespace: default
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: default-calibre-web-proxy-headers@kubernetescrd
 spec:
+  tls:
+  - hosts:
+    - rookery.mynest.love
+    secretName: calibre-web-tls
   rules:
   - host: rookery.mynest.love
     http:

services/foundryvtt/foundry-vtt-deployment.yaml

@@ -1,12 +1,11 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f foundry-compose.yml
-    kompose.version: 1.38.0 (HEAD)
   labels:
     io.kompose.service: foundry-vtt
   name: foundry-vtt
+  annotations:
+    reloader.stakater.com/auto: "true"
 spec:
   replicas: 1
   selector:
@@ -16,23 +15,9 @@ spec:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f foundry-compose.yml
-        kompose.version: 1.38.0 (HEAD)
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/role: "foundry-role"
-        vault.hashicorp.com/agent-inject-secret-credentials: "secret/data/foundry-vtt/config"
-        vault.hashicorp.com/agent-inject-template-credentials: |
-          {{- with secret "secret/data/foundry-vtt/config" -}}
-          export FOUNDRY_ADMIN_KEY="{{ .Data.data.admin_key }}"
-          export FOUNDRY_LICENSE_KEY="{{ .Data.data.license_key }}"
-          export FOUNDRY_PASSWORD="{{ .Data.data.password }}"
-          export FOUNDRY_USERNAME="{{ .Data.data.username }}"
-          {{- end -}}
       labels:
         io.kompose.service: foundry-vtt
     spec:
-      serviceAccountName: foundry-vtt-sa
       containers:
         - name: foundry-vtt
           image: felddy/foundryvtt:release
@@ -40,15 +25,21 @@ spec:
             - containerPort: 30000
               protocol: TCP
               name: web-ui
+          envFrom:
+            - secretRef:
+                name: foundry-vtt-secret
           env:
-            - name: CONTAINER_PRESERVE_CONFIG
-              value: "true"
             - name: FOUNDRY_MINIFY_STATIC_FILES
               value: "true"
+            - name: FOUNDRY_HOSTNAME
+              value: "foundry.mynest.love"
+            - name: FOUNDRY_PROXY_PORT
+              value: "443"
+            - name: FOUNDRY_PROXY_SSL
+              value: "true"
           volumeMounts:
             - mountPath: /data
               name: foundry-vtt-volume
-      hostname: 8a7c791facf9
       restartPolicy: Always
       volumes:
         - name: foundry-vtt-volume

services/foundryvtt/foundry-vtt-external-secrets.yaml

@@ -0,0 +1,30 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: foundry-vtt-credentials
+  namespace: default
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-external-secrets-store
+    kind: ClusterSecretStore
+  target:
+    name: foundry-vtt-secret
+    creationPolicy: Owner
+  data:
+  - secretKey: FOUNDRY_ADMIN_KEY
+    remoteRef:
+      key: foundry-vtt/config
+      property: admin_key
+  - secretKey: FOUNDRY_LICENSE_KEY
+    remoteRef:
+      key: foundry-vtt/config
+      property: license_key
+  - secretKey: FOUNDRY_PASSWORD
+    remoteRef:
+      key: foundry-vtt/config
+      property: password
+  - secretKey: FOUNDRY_USERNAME
+    remoteRef:
+      key: foundry-vtt/config
+      property: username

services/foundryvtt/foundry-vtt-ingress.yaml

@@ -1,11 +1,28 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: foundry-proxy-headers
+  namespace: default
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: foundry-ingress
   namespace: default
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: default-foundry-proxy-headers@kubernetescrd
 spec:
+  tls:
+  - hosts:
+    - foundry.mynest.love
+    secretName: foundry-vtt-tls
   rules:
   - host: foundry.mynest.love
     http:

services/jellyfin/jellyfin-ingress.yaml

@@ -1,11 +1,28 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: jellyfin-proxy-headers
+  namespace: default
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: jellyfin-ingress
   namespace: default
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: default-jellyfin-proxy-headers@kubernetescrd
 spec:
+  tls:
+  - hosts:
+    - beak.mynest.love
+    secretName: jellyfin-tls
   rules:
   - host: beak.mynest.love
     http:

services/navidrome/navidrome-ingress.yaml

@@ -1,11 +1,28 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: navidrome-proxy-headers
+  namespace: default
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: navidrome-ingress
   namespace: default
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: default-navidrome-proxy-headers@kubernetescrd
 spec:
+  tls:
+  - hosts:
+    - chirp.mynest.love
+    secretName: navidrome-tls
   rules:
   - host: chirp.mynest.love
     http:

services/vaultwarden/vaultwarden-ingress.yaml

@@ -1,11 +1,29 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vaultwarden-proxy-headers
+  namespace: default
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: vaultwarden-ingress
   namespace: default
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: default-vaultwarden-proxy-headers@kubernetescrd
+
 spec:
+  tls:
+  - hosts:
+    - vault.mynest.love
+    secretName: vaultwarden-tls
   rules:
   - host: vault.mynest.love
     http: