Initial authentik gitops app
Validate manifests / validate (push) Failing after 8s

This commit is contained in:
2026-04-20 01:03:25 +01:00
commit c85556e327
27 changed files with 1129 additions and 0 deletions
+12
View File
@@ -0,0 +1,12 @@
# Files in this list are expanded by Gitea when a new repository is created
# from this template repository via the web UI.
README.md
.sops.yaml
bootstrap/applicationset.yaml
manifest/base/kustomization.yaml
manifest/base/deployment.yaml
manifest/base/service.yaml
manifest/overlays/production/kustomization.yaml
manifest/overlays/production/ingressroute.yaml
manifest/overlays/production/storage/persistentvolumeclaim.yaml
manifest/overlays/production/storage/persistentvolume-nfs.yaml
+149
View File
@@ -0,0 +1,149 @@
name: Validate manifests
on:
push:
pull_request:
jobs:
validate:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install tools
run: |
curl -sL https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz \
| tar xz -C /usr/local/bin
curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
curl -fsSL https://github.com/getsops/sops/releases/latest/download/sops-v3.x.linux.amd64 \
-o /usr/local/bin/sops
chmod +x /usr/local/bin/sops
curl -fsSL https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 \
-o /usr/local/bin/yq
chmod +x /usr/local/bin/yq
# Traefik IngressRoute is a CRD, so kubeconform needs an extra schema source.
mkdir -p .ci-schemas/traefik.io
curl -fsSL https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/traefik.io/ingressroute_v1alpha1.json \
-o .ci-schemas/traefik.io/ingressroute_v1alpha1.json
cp .ci-schemas/traefik.io/ingressroute_v1alpha1.json .ci-schemas/traefik.io/IngressRoute_v1alpha1.json
cp .ci-schemas/traefik.io/ingressroute_v1alpha1.json .ci-schemas/traefik.io/IngressRoute.json
cp .ci-schemas/traefik.io/ingressroute_v1alpha1.json .ci-schemas/traefik.io/ingressroute.json
# ArgoCD ApplicationSet is also a CRD. It stays dormant until bootstrap
# is enabled, but once enabled we validate it with an explicit schema.
mkdir -p .ci-schemas/argoproj.io
curl -fsSL https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/argoproj.io/applicationset_v1alpha1.json \
-o .ci-schemas/argoproj.io/applicationset_v1alpha1.json
cp .ci-schemas/argoproj.io/applicationset_v1alpha1.json .ci-schemas/argoproj.io/ApplicationSet_v1alpha1.json
cp .ci-schemas/argoproj.io/applicationset_v1alpha1.json .ci-schemas/argoproj.io/ApplicationSet.json
cp .ci-schemas/argoproj.io/applicationset_v1alpha1.json .ci-schemas/argoproj.io/applicationset.json
- name: Helm lint
run: |
found=0
for parent in helm custom-charts; do
[ -d "$parent" ] || continue
for chart in "$parent"/*; do
[ -d "$chart" ] || continue
found=1
echo "Linting $chart"
helm lint "$chart"
done
done
if [ "$found" -eq 0 ]; then
echo "No Helm charts found"
fi
- name: kubeconform - raw YAML
run: |
bootstrap_enabled=false
if [ -f bootstrap/config.yaml ] && grep -Eq '^[[:space:]]*enabled:[[:space:]]*true[[:space:]]*$' bootstrap/config.yaml; then
bootstrap_enabled=true
fi
mapfile -t manifests < <(
find . -type f -name '*.yaml' \
! -path './.gitea/*' \
! -name '.sops.yaml' \
! -name '*.enc.yaml' \
! -name '*.secret.yaml' \
! -name '*kustomization.yaml' \
! -name 'secret-generator.yaml' \
! -path './bootstrap/config.yaml' \
| sort
)
if [ "$bootstrap_enabled" != "true" ]; then
filtered=()
for manifest in "${manifests[@]}"; do
[ "$manifest" = "./bootstrap/applicationset.yaml" ] && continue
filtered+=("$manifest")
done
manifests=("${filtered[@]}")
fi
if [ "${#manifests[@]}" -eq 0 ]; then
echo "No manifests found"
exit 0
fi
printf '%s\n' "${manifests[@]}" \
| xargs kubeconform \
-strict \
-kubernetes-version 1.35.0 \
-schema-location default \
-schema-location '.ci-schemas/{{.Group}}/{{.ResourceKind}}{{.KindSuffix}}.json' \
-schema-location '.ci-schemas/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \
-summary
- name: SOPS - check no secret files committed unencrypted
run: |
fail=0
while IFS= read -r file; do
if ! grep -q 'sops:' "$file"; then
echo "ERROR: $file appears to be unencrypted"
fail=1
fi
done < <(
find . -type f \( -name '*.secret.yaml' -o -name '*.enc.yaml' \) | sort
)
exit "$fail"
- name: Check SOPS sync
env:
SOPS_SYNC_HMAC_KEY: ${{ secrets.SOPS_SYNC_HMAC_KEY }}
run: scripts/ci/check-sops-sync
- name: Apply bootstrap ApplicationSet
env:
KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
run: |
if [ "${GITHUB_EVENT_NAME:-}" != "push" ] || [ "${GITHUB_REF:-}" != "refs/heads/main" ]; then
echo "Skipping bootstrap apply: only push events on main may apply"
exit 0
fi
if [ ! -f bootstrap/config.yaml ] || ! grep -Eq '^[[:space:]]*enabled:[[:space:]]*true[[:space:]]*$' bootstrap/config.yaml; then
echo "Skipping bootstrap apply: bootstrap/config.yaml is not enabled"
exit 0
fi
if [ -z "${KUBECONFIG_B64:-}" ]; then
echo "KUBECONFIG_B64 secret is required to apply bootstrap/applicationset.yaml"
exit 1
fi
curl -fsSL https://dl.k8s.io/release/$(curl -fsSL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl \
-o /usr/local/bin/kubectl
chmod +x /usr/local/bin/kubectl
mkdir -p "${HOME}/.kube"
printf '%s' "$KUBECONFIG_B64" | base64 -d > "${HOME}/.kube/config"
kubectl apply -f bootstrap/applicationset.yaml
+34
View File
@@ -0,0 +1,34 @@
name: Check SOPS sync
on:
push:
pull_request:
jobs:
check-sops-sync:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install tools
run: |
sudo apt-get update
sudo apt-get install -y openssl
curl -fsSL https://github.com/getsops/sops/releases/latest/download/sops-v3.x.linux.amd64 \
-o /tmp/sops
sudo install -m 0755 /tmp/sops /usr/local/bin/sops
curl -fsSL https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 \
-o /tmp/yq
sudo install -m 0755 /tmp/yq /usr/local/bin/yq
- name: Configure SOPS age key
if: ${{ secrets.SOPS_AGE_KEY != '' }}
run: |
mkdir -p "${HOME}/.config/sops/age"
printf '%s' '${{ secrets.SOPS_AGE_KEY }}' > "${HOME}/.config/sops/age/keys.txt"
chmod 600 "${HOME}/.config/sops/age/keys.txt"
- name: Check SOPS sync
env:
SOPS_SYNC_HMAC_KEY: ${{ secrets.SOPS_SYNC_HMAC_KEY }}
run: scripts/ci/check-sops-sync
+9
View File
@@ -0,0 +1,9 @@
.DS_Store
.idea/
.vscode/
*.swp
*.swo
# Local plaintext twins for sync-managed secrets. Keep these untracked.
manifest/overlays/**/secret.yaml
manifest/components/**/secret.yaml
+7
View File
@@ -0,0 +1,7 @@
# Replace the age recipient below with the public key used by ArgoCD / ksops
# in the target environment before storing real secrets in this repository.
creation_rules:
- path_regex: manifest/(overlays|components)/.*/.*\.enc\.yaml$
age: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
- path_regex: manifest/(overlays|components)/.*/secret\.secret\.yaml$
age: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
+224
View File
@@ -0,0 +1,224 @@
# authentik
Kubernetes deployment source-of-truth repository for `authentik`.
This template is intended for applications deployed with ArgoCD through an
`ApplicationSet`. It uses a `base/` plus `overlays/` layout, stores runtime
secrets as SOPS-encrypted manifests, and includes a Gitea workflow that checks
Kubernetes YAML syntax on every push and pull request. It also ships with a
dormant bootstrap `ApplicationSet` that only becomes active after an explicit
enable change and a promotion into `main`.
## Layout
```text
.
├── .gitea/
│ ├── template
│ └── workflows/validate.yaml
├── .github/
│ └── workflows/check-sops-sync.yml
├── .sops.yaml
├── bootstrap/
│ ├── applicationset.yaml
│ └── config.yaml
├── manifest/
│ ├── base/
│ │ ├── deployment.yaml
│ │ ├── kustomization.yaml
│ │ ├── namespace.yaml
│ │ └── service.yaml
│ ├── components/
│ │ └── example-component/
│ └── overlays/
│ └── production/
│ ├── ingressroute.yaml
│ ├── kustomization.yaml
│ ├── secret-generator.yaml
│ ├── secret.secret.yaml
│ └── storage/
│ ├── persistentvolumeclaim.yaml
│ └── persistentvolume-nfs.yaml
└── scripts/
├── ci/check-sops-sync
├── git-hooks/pre-commit
├── install-git-hooks
└── lib/
├── sops-path-regexes
└── sops-sync-lib
```
## First edits
Update these files before the first deployment:
1. `manifest/base/deployment.yaml`
Set the container image, ports, probes, resource requests, and any required
environment variables.
2. `manifest/overlays/production/ingressroute.yaml`
Set the real hostname, entry point names, and middleware references if used.
3. `manifest/overlays/production/storage/persistentvolumeclaim.yaml`
Set the requested size, access mode, and storage class for the environment.
4. `.sops.yaml`
Replace the sample age recipient with the public key that ArgoCD should use
for decryption.
5. `manifest/overlays/production/secret.secret.yaml`
Re-encrypt the placeholder secret values with your own data.
## Bootstrap activation model
This template is designed to start on an `init` branch. The intended flow is:
1. Create the repository from this template with `init` as the initial branch.
2. Tailor the manifests, secrets, storage, and ingress on `init`.
3. Keep `bootstrap/config.yaml` set to `enabled: false` while the repository is
being prepared.
4. Create `main` by merging `init` only when the repository is ready to be part
of the delivery pipeline.
5. Deliberately change `bootstrap/config.yaml` to `enabled: true` on `main` to
allow the workflow to apply the bootstrap `ApplicationSet`.
The workflow behavior is:
- `bootstrap/applicationset.yaml` is ignored by validation while bootstrap is disabled
- no cluster apply is attempted unless the workflow runs on `main`
- cluster apply also requires the `KUBECONFIG_B64` Gitea secret
## Bootstrap files
- `bootstrap/config.yaml`
Repository-local activation switch. Default is disabled.
- `bootstrap/applicationset.yaml`
ArgoCD `ApplicationSet` manifest template for this repository.
If the repository is created by copying files with plain Git instead of Gitea's
template expansion, you must replace the `${REPO_NAME...}` placeholders in
`bootstrap/applicationset.yaml` before enabling bootstrap.
## Storage model
Storage is overlay-owned, so each environment can request different backing
storage without sharing claims across environments.
- `manifest/overlays/production/storage/persistentvolumeclaim.yaml`
Default writable application storage. With the default `longhorn`
`storageClassName`, Kubernetes dynamically provisions the backing PV when the
claim is created.
- `manifest/overlays/production/storage/persistentvolume-nfs.yaml`
Optional static PV example for NFS-backed or pre-provisioned shared storage.
This file is not referenced by default. Add it to the overlay kustomization
only when you need a static PV.
The base deployment mounts the claim at `/data`.
If storage should be shared between multiple applications in different
repositories, keep those applications in the same namespace and have a single
repository own the PVC resource. The other repositories should reference the
same claim name from their deployments instead of creating a duplicate PVC.
## Secret workflow
1. Generate an age key pair.
2. Store the private key where ArgoCD / ksops can read it.
3. Update `.sops.yaml` with the matching public recipient.
4. Re-encrypt `manifest/overlays/production/secret.secret.yaml`.
Example:
```bash
age-keygen -o age-key.txt
sops --encrypt --in-place manifest/overlays/production/secret.secret.yaml
```
## Repo-managed SOPS sync
This repo also supports sync-managed secrets using the naming convention:
```text
foo.yaml -> foo.enc.yaml -> foo.enc.yaml.sync-hmac
```
- `foo.yaml`
Local plaintext source. Keep it gitignored and untracked.
- `foo.enc.yaml`
Tracked SOPS-encrypted file.
- `foo.enc.yaml.sync-hmac`
Tracked HMAC sidecar used to prove the encrypted file still matches the last
synced plaintext content.
Requirements:
- `SOPS_SYNC_HMAC_KEY` must be set locally for hooks and in CI
- `sops`, `openssl`, and either `yq` or `python3` with `PyYAML` must be available
- CI also needs access to the repo's SOPS decryption mechanism, such as an age key
Generate a local HMAC key:
```bash
openssl rand -hex 32
```
Set it for the current shell session:
```bash
export SOPS_SYNC_HMAC_KEY='<paste-generated-key-here>'
```
Persist it in `zsh`:
```bash
echo "export SOPS_SYNC_HMAC_KEY='<paste-generated-key-here>'" >> ~/.zshrc
source ~/.zshrc
```
Persist it in `bash`:
```bash
echo "export SOPS_SYNC_HMAC_KEY='<paste-generated-key-here>'" >> ~/.bashrc
source ~/.bashrc
```
Verify it is set:
```bash
printenv SOPS_SYNC_HMAC_KEY
```
Install the local hook:
```bash
scripts/install-git-hooks
```
Local workflow:
1. Keep your plaintext secret local-only, for example `manifest/overlays/production/secret.yaml`.
2. Stage either the plaintext file or its `.enc.yaml` twin.
3. On pre-commit, the hook encrypts the plaintext if needed, updates the
`.sync-hmac` sidecar, and stages both tracked files.
CI behavior:
- CI fails if a tracked `.enc.yaml` file is not valid SOPS content
- CI fails if the `.sync-hmac` sidecar is missing
- CI fails if decrypted plaintext no longer matches the tracked sidecar HMAC
Security tradeoffs:
- The sidecar is an HMAC, not a plain checksum, so the plaintext fingerprint is
keyed and not directly reusable without `SOPS_SYNC_HMAC_KEY`
- Anyone who can decrypt the repo secret files and also access the HMAC key can
recompute sidecars, so protect both inputs appropriately
- Plaintext local files must remain gitignored and never be committed
## ArgoCD ApplicationSet path
Point the generated ArgoCD `Application` at:
```text
manifest/overlays/production
```
If your `ApplicationSet` uses repository scanning, this repository is designed
to be the single source of truth for one application, with ArgoCD rendering the
selected overlay.
+40
View File
@@ -0,0 +1,40 @@
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
name: authentik
namespace: argocd
spec:
goTemplate: true
goTemplateOptions:
- missingkey=error
generators:
- list:
elements:
- environment: production
namespace: security
path: manifest/overlays/production
template:
metadata:
name: 'authentik-{{ .environment }}'
labels:
app.kubernetes.io/managed-by: argocd
app.kubernetes.io/name: authentik
spec:
project: default
source:
repoURL: http://gitea-ha-http.apps:3000/olb42/authentik.git
targetRevision: main
path: '{{ .path }}'
plugin:
name: ksops
destination:
server: https://kubernetes.default.svc
namespace: '{{ .namespace }}'
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=false
- ApplyOutOfSyncOnly=true
- ServerSideApply=true
+3
View File
@@ -0,0 +1,3 @@
enabled: false
target_namespace: argocd
apply_from_branch: main
+84
View File
@@ -0,0 +1,84 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: authentik-server
namespace: security
labels:
app: authentik-server
spec:
replicas: 1
selector:
matchLabels:
app: authentik-server
template:
metadata:
labels:
app: authentik-server
app.kubernetes.io/name: authentik-server
spec:
automountServiceAccountToken: false
securityContext:
runAsUser: 1000
runAsGroup: 988
containers:
- name: server
image: ghcr.io/goauthentik/server:2026.2
imagePullPolicy: IfNotPresent
args:
- server
ports:
- name: http
containerPort: 9000
- name: https
containerPort: 9443
env:
- name: AUTHENTIK_LISTEN__HTTP
value: 0.0.0.0:9000
- name: AUTHENTIK_LISTEN__HTTPS
value: 0.0.0.0:9443
- name: AUTHENTIK_POSTGRESQL__HOST
value: shared-postgres-rw.data.svc.cluster.local
- name: AUTHENTIK_POSTGRESQL__NAME
value: authentik
- name: AUTHENTIK_POSTGRESQL__USER
value: authentik
- name: AUTHENTIK_POSTGRESQL__PORT
value: "5432"
- name: AUTHENTIK_POSTGRESQL__SSLMODE
value: disable
- name: AUTHENTIK_POSTGRESQL__PASSWORD
value: file:///run/secrets/db_password
- name: AUTHENTIK_SECRET_KEY
value: file:///run/secrets/secret_key
- name: AUTHENTIK_ERROR_REPORTING__ENABLED
value: "false"
volumeMounts:
- name: secrets
mountPath: /run/secrets/db_password
readOnly: true
subPath: db_password
- name: secrets
mountPath: /run/secrets/secret_key
readOnly: true
subPath: secret_key
- name: authentik-data
mountPath: /data
readinessProbe:
httpGet:
path: /-/health/ready/
port: http
initialDelaySeconds: 15
periodSeconds: 10
livenessProbe:
httpGet:
path: /-/health/live/
port: http
initialDelaySeconds: 30
periodSeconds: 30
volumes:
- name: secrets
secret:
secretName: authentik-secrets
- name: authentik-data
persistentVolumeClaim:
claimName: authentik-data
+10
View File
@@ -0,0 +1,10 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: security
resources:
- serviceaccount.yaml
- deployment.yaml
- worker-deployment.yaml
- service.yaml
+17
View File
@@ -0,0 +1,17 @@
apiVersion: v1
kind: Service
metadata:
name: authentik
namespace: security
labels:
app: authentik-server
spec:
selector:
app: authentik-server
ports:
- name: http
port: 9000
targetPort: http
- name: https
port: 9443
targetPort: https
+5
View File
@@ -0,0 +1,5 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: authentik-worker
namespace: security
+64
View File
@@ -0,0 +1,64 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: authentik-worker
namespace: security
labels:
app: authentik-worker
spec:
replicas: 1
selector:
matchLabels:
app: authentik-worker
template:
metadata:
labels:
app: authentik-worker
spec:
serviceAccountName: authentik-worker
securityContext:
runAsUser: 1000
runAsGroup: 988
containers:
- name: worker
image: ghcr.io/goauthentik/server:2026.2
imagePullPolicy: IfNotPresent
args:
- worker
env:
- name: AUTHENTIK_POSTGRESQL__HOST
value: shared-postgres-rw.data.svc.cluster.local
- name: AUTHENTIK_POSTGRESQL__NAME
value: authentik
- name: AUTHENTIK_POSTGRESQL__USER
value: authentik
- name: AUTHENTIK_POSTGRESQL__PORT
value: "5432"
- name: AUTHENTIK_POSTGRESQL__SSLMODE
value: disable
- name: AUTHENTIK_POSTGRESQL__PASSWORD
value: file:///run/secrets/db_password
- name: AUTHENTIK_SECRET_KEY
value: file:///run/secrets/secret_key
- name: AUTHENTIK_ERROR_REPORTING__ENABLED
value: "false"
- name: AUTHENTIK_WORKER__THREADS
value: "2"
volumeMounts:
- name: secrets
mountPath: /run/secrets/db_password
readOnly: true
subPath: db_password
- name: secrets
mountPath: /run/secrets/secret_key
readOnly: true
subPath: secret_key
- name: authentik-data
mountPath: /data
volumes:
- name: secrets
secret:
secretName: authentik-secrets
- name: authentik-data
persistentVolumeClaim:
claimName: authentik-data
@@ -0,0 +1,7 @@
# +argocd:skip-file-rendering
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
configMapGenerator:
- files:
- example-test.env
@@ -0,0 +1,3 @@
# +argocd:skip-file-rendering
test=works
@@ -0,0 +1,10 @@
apiVersion: postgresql.cnpg.io/v1
kind: Database
metadata:
name: shared-postgres-authentik-db
namespace: data
spec:
name: authentik
owner: authentik
cluster:
name: shared-postgres
@@ -0,0 +1,31 @@
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: authentik
namespace: security
annotations:
gethomepage.dev/app: authentik-server
gethomepage.dev/enabled: "false"
gethomepage.dev/group: Security
gethomepage.dev/href: https://auth.olb42.com/
gethomepage.dev/icon: authentik
gethomepage.dev/name: Authentik
gethomepage.dev/namespace: security
gethomepage.dev/widget.key: "{{HOMEPAGE_VAR_AUTHENTIK_KEY}}"
gethomepage.dev/widget.type: authentik
gethomepage.dev/widget.url: http://authentik.security:9000
gethomepage.dev/widget.version: "2"
spec:
entryPoints:
- websecure
routes:
- kind: Rule
match: Host(`auth.olb42.com`)
middlewares:
- name: lan-only
namespace: infra
services:
- name: authentik
port: 9000
tls:
secretName: olb42-wildcard-tls
@@ -0,0 +1,13 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: security
resources:
- ../../base
- database.yaml
- ingressroute.yaml
- storage/persistentvolumeclaim.yaml
generators:
- secret-generator.yaml
@@ -0,0 +1,10 @@
apiVersion: viaduct.ai/v1
kind: ksops
metadata:
name: authentik-secret-generator
annotations:
config.kubernetes.io/function: |
exec:
path: ksops
files:
- ./secret.secret.yaml
@@ -0,0 +1,24 @@
apiVersion: ENC[AES256_GCM,data:nhU=,iv:+igd9RTOMy7mwVDjx05WQIdytoCrWLjcnP2Wq8xBS1s=,tag:61hSvgd/g88pjdhPW6OQsg==,type:str]
kind: ENC[AES256_GCM,data:T9Wrg72s,iv:1+cSHl0Dwwc1ddnw4dQI26r8/aEfMAPpsmz6BxxetrQ=,tag:y8HSeCa9gl7i+rW1Qpzc0Q==,type:str]
metadata:
name: ENC[AES256_GCM,data:VNJIfO/EtW0Pd3xVKG2R1VM=,iv:53UVCYVV07Qdlbq7j9qghT/DHqv+98muUFpapoD7VBs=,tag:hKBPwm7dudPUlRCgp4D9/g==,type:str]
namespace: ENC[AES256_GCM,data:/STezL4E9q4=,iv:mImCvy0lheb1px4+VEm7Z2c6qgQFerRnciPUy+arG2o=,tag:ZJxPwZ7pO6j+8xgHSDK/Og==,type:str]
type: ENC[AES256_GCM,data:ypwwk80m,iv:gbfQojFcmmGCtALVkCcICc4Z4dDXQK8clTGIMkOMOkY=,tag:Y0AskWriaazAlDkNN6Ufuw==,type:str]
stringData:
db_password: ENC[AES256_GCM,data:vx+4cvOPHycDmgp3fhTqsRC6ZjdviJy3svt5Kuhtzg48l8DNlxQpTvLgtdGYZmGS,iv:k84Nwxnuyc3D9ceXuMPhSTwzRrCucyUpJ/b7lrUTBlI=,tag:JOMAcJN9frgVkpeV8pm39A==,type:str]
secret_key: ENC[AES256_GCM,data:ZhH2xkHf/wLXiooCBP+9ZctsGSOMW1de4xz8IGPS0z1GSTReM9h7sSHhw1vJl7iHsr8ne4ehXQYvLd/QcvLVShS2WVDSt1wXcKejnHgRTBk=,iv:xFSp0TRzBl0c4hx6UPv2CdFx9fMQ/oAes8JpWf1Zj7U=,tag:j8jrfilCe2gfyQr1kls4WQ==,type:str]
sops:
age:
- recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSdWlWdTRWOWhTNnFocWlI
QTlLNmJtUkZLSUNOdi9yQmNVQkVkQi94WFc4Cno2NjJCeURlc3FZd0hTK0IzUXJq
STZtU0pBZ25SaFJqMFZNaE41a1p0SkEKLS0tIFg2VlphajFlSjdtSFM1NTVZdjZm
SmVrN2pFQ0MzVS9aUUtrVnFUaUd6TzAKksOI8fvGkE8/Qmk8yT7jvvakFWSLDYKa
7/pcTR0msB9P8zowsfe4pL+BJIObctXpyTRPCyyJg7/vOHqhuUv9Wg==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-04-19T23:31:55Z"
mac: ENC[AES256_GCM,data:sRk5KdZXohSwRWs6jP/jUA1OMBgnxKQu82Wp2w/4q1K0XXe1KRSDyiIIklgdK6JAW5U0291EzKLg8KgTks3YsibteA4L7eFbwFDTXOn7OJwjhKlzTZXqxEjmGHmsKLa7v8Y8nKuJqn2CUrfUuLzyvUaQN2tXfigq/DPC0HyROQs=,iv:zzWBrUcOumbaDArX9xRPzz3J98fA9wAgC1cKafejWT8=,tag:DL9o2cA5Uslq6WWGzlt8QA==,type:str]
unencrypted_suffix: _unencrypted
version: 3.12.2
@@ -0,0 +1,32 @@
# Optional static PV example for NFS-backed storage.
# This file is not referenced from kustomization.yaml by default because the
# default storage flow uses dynamic provisioning via the Longhorn PVC.
#
# To use this file:
# 1. Add storage/persistentvolume-nfs.yaml to resources in this overlay.
# 2. Update persistentvolumeclaim.yaml to set:
# storageClassName: nfs-shared
# volumeName: app-data
# accessModes: [ReadWriteMany]
# 3. Replace the placeholder NFS server and export path below.
apiVersion: v1
kind: PersistentVolume
metadata:
name: app-data
spec:
capacity:
storage: 10Gi
accessModes:
- ReadWriteMany
persistentVolumeReclaimPolicy: Retain
claimRef:
apiVersion: v1
kind: PersistentVolumeClaim
name: app-data
namespace: security
storageClassName: nfs-shared
mountOptions:
- nfsvers=4.1
nfs:
server: nfs.example.internal
path: /exports/app-data
@@ -0,0 +1,11 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: authentik-data
spec:
accessModes:
- ReadWriteOnce
storageClassName: longhorn
resources:
requests:
storage: 1Gi
+77
View File
@@ -0,0 +1,77 @@
#!/usr/bin/env zsh
set -eu
for cmd in git sops openssl; do
if ! command -v "${cmd}" >/dev/null 2>&1; then
echo "check-sops-sync: required command missing: ${cmd}" >&2
exit 1
fi
done
if [ -z "${SOPS_SYNC_HMAC_KEY:-}" ]; then
echo "check-sops-sync: SOPS_SYNC_HMAC_KEY is required" >&2
exit 1
fi
repo_root=$(git rev-parse --show-toplevel)
regex_script="${repo_root}/scripts/lib/sops-path-regexes"
lib_script="${repo_root}/scripts/lib/sops-sync-lib"
if [ ! -x "${regex_script}" ]; then
echo "check-sops-sync: missing helper ${regex_script}" >&2
exit 1
fi
if [ ! -f "${lib_script}" ]; then
echo "check-sops-sync: missing helper ${lib_script}" >&2
exit 1
fi
. "${lib_script}"
regexes=("${(@f)$("${regex_script}")}")
fail=0
while IFS= read -r tracked_path; do
[ -n "${tracked_path}" ] || continue
[[ "${tracked_path}" == *.enc.* ]] || continue
if ! matches_any_rule "${tracked_path}" "${regexes[@]}"; then
continue
fi
sidecar_path=$(hmac_sidecar_for_enc "${tracked_path}")
if ! git ls-files --error-unmatch -- "${sidecar_path}" >/dev/null 2>&1; then
echo "check-sops-sync: missing sync sidecar for ${tracked_path}" >&2
fail=1
continue
fi
if ! is_sops_encrypted_file "${tracked_path}"; then
echo "check-sops-sync: file is not valid SOPS-encrypted content: ${tracked_path}" >&2
fail=1
continue
fi
sidecar_value=$(read_sidecar "${sidecar_path}" || true)
if [ -z "${sidecar_value}" ]; then
echo "check-sops-sync: sidecar is empty: ${sidecar_path}" >&2
fail=1
continue
fi
if ! computed_hmac=$(decrypt_enc_to_plain "${tracked_path}" | compute_hmac_for_stdin); then
echo "check-sops-sync: failed to decrypt ${tracked_path}" >&2
fail=1
continue
fi
if [ "${computed_hmac}" != "${sidecar_value}" ]; then
echo "check-sops-sync: decrypted plaintext HMAC does not match sidecar for ${tracked_path}" >&2
fail=1
fi
done < <(git ls-files)
exit "${fail}"
+111
View File
@@ -0,0 +1,111 @@
#!/usr/bin/env zsh
set -eu
for cmd in git sops openssl; do
if ! command -v "${cmd}" >/dev/null 2>&1; then
echo "pre-commit: required command missing: ${cmd}" >&2
exit 1
fi
done
if [ -z "${SOPS_SYNC_HMAC_KEY:-}" ]; then
echo "pre-commit: SOPS_SYNC_HMAC_KEY is required" >&2
exit 1
fi
repo_root=$(git rev-parse --show-toplevel)
regex_script="${repo_root}/scripts/lib/sops-path-regexes"
lib_script="${repo_root}/scripts/lib/sops-sync-lib"
if [ ! -x "${regex_script}" ]; then
echo "pre-commit: missing helper ${regex_script}" >&2
exit 1
fi
if [ ! -f "${lib_script}" ]; then
echo "pre-commit: missing helper ${lib_script}" >&2
exit 1
fi
. "${lib_script}"
regexes=("${(@f)$("${regex_script}")}")
typeset -A candidates
while IFS= read -r staged_path; do
[ -n "${staged_path}" ] || continue
candidate_enc=""
if [[ "${staged_path}" == *.enc.yaml ]]; then
candidate_enc="${staged_path}"
elif [[ "${staged_path}" == *.yaml ]]; then
if git ls-files --error-unmatch -- "${staged_path}" >/dev/null 2>&1; then
continue
fi
candidate_enc=$(plain_to_enc "${staged_path}") || continue
fi
[ -n "${candidate_enc}" ] || continue
if matches_any_rule "${candidate_enc}" "${regexes[@]}"; then
candidates["${candidate_enc}"]=1
fi
done < <(git diff --cached --name-only --diff-filter=ACMR)
for enc_path in "${(@k)candidates}"; do
plain_path=$(enc_to_plain "${enc_path}") || continue
sidecar_path=$(hmac_sidecar_for_enc "${enc_path}")
if [ ! -f "${plain_path}" ]; then
continue
fi
if has_unstaged_changes "${plain_path}"; then
echo "pre-commit: plaintext file has unstaged changes: ${plain_path}" >&2
echo "pre-commit: stage or revert the plaintext change before committing" >&2
exit 1
fi
current_hmac=$(compute_hmac_for_file "${plain_path}")
tracked_hmac=""
if [ -f "${sidecar_path}" ]; then
tracked_hmac=$(read_sidecar "${sidecar_path}" || true)
fi
if [ "${current_hmac}" = "${tracked_hmac}" ] && [ -f "${enc_path}" ]; then
continue
fi
encrypt_plain_to_enc "${plain_path}" "${enc_path}"
write_sidecar "${sidecar_path}" "${current_hmac}"
git add "${enc_path}" "${sidecar_path}"
done
for enc_path in "${(@k)candidates}"; do
sidecar_path=$(hmac_sidecar_for_enc "${enc_path}")
if ! git cat-file -e ":${enc_path}" 2>/dev/null; then
echo "pre-commit: staged encrypted file missing: ${enc_path}" >&2
exit 1
fi
if ! git cat-file -e ":${sidecar_path}" 2>/dev/null; then
echo "pre-commit: staged sync sidecar missing: ${sidecar_path}" >&2
exit 1
fi
tmp_enc=$(mktemp)
trap 'rm -f "${tmp_enc}"' EXIT INT TERM
git show ":${enc_path}" > "${tmp_enc}"
staged_hmac=$(git show ":${sidecar_path}" | tr -d '\r\n')
computed_hmac=$(decrypt_enc_to_plain "${tmp_enc}" | compute_hmac_for_stdin)
rm -f "${tmp_enc}"
trap - EXIT INT TERM
if [ "${computed_hmac}" != "${staged_hmac}" ]; then
echo "pre-commit: staged encrypted file and sidecar are out of sync: ${enc_path}" >&2
exit 1
fi
done
+16
View File
@@ -0,0 +1,16 @@
#!/usr/bin/env zsh
set -eu
repo_root=$(git rev-parse --show-toplevel)
hook_path="${repo_root}/.git/hooks/pre-commit"
target="${repo_root}/scripts/git-hooks/pre-commit"
mkdir -p "${repo_root}/.git/hooks"
cat > "${hook_path}" <<EOF
#!/usr/bin/env zsh
exec "${target}" "\$@"
EOF
chmod +x "${hook_path}"
echo "Installed git hook: ${hook_path}"
+38
View File
@@ -0,0 +1,38 @@
#!/usr/bin/env zsh
set -eu
repo_root=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
sops_file="${repo_root}/.sops.yaml"
if [ ! -f "${sops_file}" ]; then
exit 0
fi
if command -v yq >/dev/null 2>&1; then
yq -r '.creation_rules[]?.path_regex | select(. != null)' "${sops_file}"
exit 0
fi
if command -v python3 >/dev/null 2>&1; then
python3 - "${sops_file}" <<'PY'
import sys
try:
import yaml
except Exception as exc:
raise SystemExit(f"python3 fallback requires PyYAML: {exc}")
with open(sys.argv[1], "r", encoding="utf-8") as handle:
data = yaml.safe_load(handle) or {}
for rule in data.get("creation_rules") or []:
regex = rule.get("path_regex")
if regex:
print(regex)
PY
exit 0
fi
echo "Unable to read .sops.yaml path_regex values: install yq or python3 with PyYAML" >&2
exit 1
+88
View File
@@ -0,0 +1,88 @@
#!/usr/bin/env zsh
matches_any_rule() {
local path="$1"
shift
local regex
for regex in "$@"; do
[[ -n "${regex}" ]] || continue
if [[ "${path}" =~ ${regex} ]]; then
return 0
fi
done
return 1
}
enc_to_plain() {
local enc="$1"
[[ "${enc}" == *.enc.yaml ]] || return 1
print -r -- "${enc%.enc.yaml}.yaml"
}
plain_to_enc() {
local plain="$1"
[[ "${plain}" == *.yaml ]] || return 1
if [[ "${plain}" == *.enc.yaml ]]; then
print -r -- "${plain}"
else
print -r -- "${plain%.yaml}.enc.yaml"
fi
}
hmac_sidecar_for_enc() {
local enc="$1"
print -r -- "${enc}.sync-hmac"
}
encrypt_plain_to_enc() {
local plain="$1"
local enc="$2"
sops --encrypt --input-type yaml --output-type yaml --output "${enc}" "${plain}"
}
decrypt_enc_to_plain() {
local enc="$1"
sops --decrypt "${enc}"
}
compute_hmac_for_file() {
local path="$1"
openssl dgst -sha256 -hmac "${SOPS_SYNC_HMAC_KEY}" "${path}" | awk '{print $NF}'
}
compute_hmac_for_stdin() {
openssl dgst -sha256 -hmac "${SOPS_SYNC_HMAC_KEY}" | awk '{print $NF}'
}
read_sidecar() {
local sidecar="$1"
[ -f "${sidecar}" ] || return 1
tr -d '\r\n' < "${sidecar}"
}
write_sidecar() {
local sidecar="$1"
local value="$2"
print -r -- "${value}" > "${sidecar}"
}
is_sops_encrypted_file() {
local path="$1"
[ -f "${path}" ] || return 1
grep -q 'sops:' "${path}" && grep -q 'ENC\[' "${path}"
}
has_unstaged_changes() {
local path="$1"
if git ls-files --error-unmatch -- "${path}" >/dev/null 2>&1; then
git diff --quiet -- "${path}" >/dev/null 2>&1
return $?
fi
if git diff --cached --name-only -- "${path}" | grep -Fxq "${path}"; then
git diff --quiet -- "${path}" >/dev/null 2>&1
return $?
fi
return 1
}