From 5a09bc627e5bb248dd38936bcac97cd7b7175b44 Mon Sep 17 00:00:00 2001 From: David Landry Date: Sat, 25 May 2024 14:50:39 -0400 Subject: [PATCH] chore(syncthing): attempt to inject sops-encrypted secrets into syncthing's config folder --- apps/syncthing/base/sync-deployment.yaml | 6 +- apps/syncthing/overlays/media/cert.sops.pem | 20 + apps/syncthing/overlays/media/config.json | 11 + apps/syncthing/overlays/media/config.xml | 783 ++++++++++++++++++ .../overlays/media/deployment-patch.yaml | 24 + apps/syncthing/overlays/media/key.sops.pem | 20 + .../overlays/media/kustomization.yaml | 11 + apps/syncthing/overlays/media/secrets.yaml | 15 + 8 files changed, 887 insertions(+), 3 deletions(-) create mode 100644 apps/syncthing/overlays/media/cert.sops.pem create mode 100644 apps/syncthing/overlays/media/config.json create mode 100644 apps/syncthing/overlays/media/config.xml create mode 100644 apps/syncthing/overlays/media/deployment-patch.yaml create mode 100644 apps/syncthing/overlays/media/key.sops.pem create mode 100644 apps/syncthing/overlays/media/kustomization.yaml create mode 100644 apps/syncthing/overlays/media/secrets.yaml diff --git a/apps/syncthing/base/sync-deployment.yaml b/apps/syncthing/base/sync-deployment.yaml index cd51009..a3319ae 100644 --- a/apps/syncthing/base/sync-deployment.yaml +++ b/apps/syncthing/base/sync-deployment.yaml @@ -27,15 +27,15 @@ spec: - containerPort: 22000 hostPort: 22000 protocol: TCP - name: syncthing-tcp + name: sync-tcp - containerPort: 22000 hostPort: 22000 protocol: UDP - name: syncthing-quic + name: sync-quic - containerPort: 21027 hostPort: 21027 protocol: UDP - name: syncthing-discovery + name: sync-discovery - containerPort: 8384 name: http volumeMounts: diff --git a/apps/syncthing/overlays/media/cert.sops.pem b/apps/syncthing/overlays/media/cert.sops.pem new file mode 100644 index 0000000..f2a484a --- /dev/null +++ b/apps/syncthing/overlays/media/cert.sops.pem @@ -0,0 +1,20 @@ +{ + "data": "ENC[AES256_GCM,data:uVfizKnFIFJStCPtdNEJBe4apghX/DbJim4kM75KtuL/TQJ/WJ8Cas5o2Q1cwMggkpuSLCyo6BUwWQoYjSvTonVkFU26O8n2m1Y62Lukg7fOY2ZYvzj79c+YlWPDGstdh1CtGMPdgmZfmC/YlJDyXxx/it4jiCvK2ADF4s+HECfwgOyN5YMwrliPgj3J3maVQAMjnDcs540k1uh3l8bWA+keLE9bqSIEZSQ/e/RkaZ02JDYssFEhCTWBY9RYzaQ5DvXvN8UjdeCz5EtfSeZICxitvkYPjEfLZ9CNAhVnnGTM8/6p1xWNiEnnSwrNqpJ+zK3cixkQNlTgcDA8tcOtTzqU8POtj5itOrJV0mCwpyArK2DfungDR4P0nVlBBuqPxiWjufpDxUfg+IPFhxFKHHGZaOvDZfiXwT/mZFwp31wUbdaKLQkqWAHcAyUN/pabjWzOhSdCWEFh/VlPX4a1CW/yl8YYPEqGz4gzJ9SUM29cUH4GoyLksC/bFf5J92sZ50dj5QD12duuVqYmJGLqTphSjsnRv7AO4EdpFSvO69WoxzkcGzx92dK5mw4RcuW5SCEfu4XaZWCVLCBpnp9Rl3R6BPUdckh5nbDp6L99++swgReZ4z4wWgeUZ60yTgcO+wH5FBGIWBTNlA8Z+C/d3ZGboU4zGqIr6X3ohDu/jKjgA0+2OBcEXPm/zHp2QfqQmUk48AlDUnxcX7wGEB4l48ErBNjhyreNWkmuoZtLwdQUeQc+vstnLOdx3sbMEUVEvyvZVzTfLMhJvkCfFjZyIF7fynNtvMn8wnUSumPkGQ5FqVh1uNnX,iv:zsUQSb6qkBpr5TLYy0FCV4X6b4exTYxmlp+q5wCZoCw=,tag:EIPkQItZvaLUkm9HoQdILw==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age1y26vr5qt6th3wu92rnsgkqcpxxah3pqkqa4khcjjycm3kg40aqyqjgfzx9", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByYnVhODBJV091cXFTbk13\nWUhWREgvMTlGSUtxRUptazA3OUlONjZMV0g0CmhwTFJiZk1zZjA2a2RncHNmdmZX\nckRyNVpPWVJsTlp5ZDlaWWhHcG5TQzgKLS0tIC9EUEFJOFlBWVBVc285RzdYVXlq\nc0RBRW5SNy9wL2s2Q0Fpa21JREVwVlkKIHnlUKipzptrJUyzQumGiSRVm+hsEuq8\n+o7772jG0rwsLt0xQ3cKaQP2Rfeiul3QQXde7bEuT8T/iN6fBZPYkg==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2024-05-25T13:09:08Z", + "mac": "ENC[AES256_GCM,data:c84fztj6EhtZtm9IdIy3qEq0EFjl4Id5IG1B8kaZChnScTNFLTKb8Hlbc6GMVFM11FfOjscfe6/oa1eZAk6bM4V0LNFi5ysXIbByPcUy5ZaA1agUtSKOlQOD0lIaONhzaAVuQWD7W7m7vz1nYVoUEBNvFplkoZqVgllenJiq4Jo=,iv:CeOKU8Vfls5Bc//n/uTKNJlz6ZwtNskPVj7Da3otw0U=,tag:wkh25T/s1p+oRRuAlYQdZw==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.8.1" + } +} \ No newline at end of file diff --git a/apps/syncthing/overlays/media/config.json b/apps/syncthing/overlays/media/config.json new file mode 100644 index 0000000..7ab532f --- /dev/null +++ b/apps/syncthing/overlays/media/config.json @@ -0,0 +1,11 @@ +{ + "appName": "syncthing", + "userGivenName": "syncthing", + "destNamespace": "media", + "destServer": "https://kubernetes.default.svc", + "srcPath": "apps/syncthing/overlays/media", + "srcRepoURL": "ssh://git@gitea-ssh.gitops.svc.cluster.local:2222/davad/argo.git", + "srcTargetRevision": "", + "labels": null, + "annotations": null +} diff --git a/apps/syncthing/overlays/media/config.xml b/apps/syncthing/overlays/media/config.xml new file mode 100644 index 0000000..6a64a88 --- /dev/null +++ b/apps/syncthing/overlays/media/config.xml @@ -0,0 +1,783 @@ + + + basic + + + + + + + + + + + + + + + + + + + + + + + + + 1 + + 0 + + basic + + 0 + 0 + 0 + random + false + 0 + 0 + -1 + false + false + false + 25 + .stfolder + false + 0 + 2 + false + standard + standard + false + true + false + false + false + false + + 0 + 0 + + + + basic + + + + 1 + + 3600 + + basic + + 0 + 0 + 0 + random + false + 0 + 0 + 10 + false + false + false + 25 + .stfolder + false + 0 + 2 + false + standard + standard + false + true + false + false + false + false + + 0 + 0 + + + + basic + + + + + + + + + + + + + + + + + + + + + + + + + 1 + + 3600 + + basic + + 0 + 0 + 0 + random + false + 0 + 0 + 10 + false + false + false + 25 + .stfolder + false + 0 + 2 + false + standard + standard + false + true + false + false + false + false + + 0 + 0 + + + + basic + + + + + + + + + + + + + + + + 1 + + 3600 + + basic + + 0 + 0 + 0 + random + false + 0 + 0 + -1 + false + false + false + 25 + .stfolder + false + 0 + 2 + false + standard + standard + false + true + false + false + false + false + + 0 + 0 + + + + basic + + + + + + + + + + + + + + + + 1 + + 3600 + + basic + + 0 + 0 + 0 + random + false + 0 + 0 + 10 + false + false + false + 25 + .stfolder + false + 0 + 2 + false + standard + standard + false + true + false + false + false + false + + 0 + 0 + + + + basic + + + + + + + 1 + + 3600 + + basic + + 0 + 0 + 0 + random + false + 0 + 0 + -1 + false + false + false + 25 + .stfolder + false + 0 + 2 + false + standard + standard + false + true + false + false + false + false + + 0 + 0 + + + + basic + + + + + + + + + + 1 + + 3600 + + basic + + 0 + 0 + 0 + random + false + 0 + 0 + -1 + false + false + false + 25 + .stfolder + false + 0 + 2 + false + standard + standard + false + true + false + false + false + false + + 0 + 0 + + + + basic + + + + + + + + + + 1 + + 3600 + + basic + + 0 + 0 + 0 + random + false + 0 + 0 + 10 + false + false + false + 25 + .stfolder + false + 0 + 2 + false + standard + standard + false + true + false + false + false + false + + 0 + 0 + + + + basic + + + + + + + + + + + + + + + + + + + + + + + + + 1 + + 3600 + + basic + + 0 + 0 + 0 + random + false + 0 + 0 + 10 + false + false + false + 25 + .stfolder + false + 0 + 2 + false + standard + standard + false + true + false + false + false + false + + 0 + 0 + + + + basic + + + + 1 + + 3600 + + basic + + 0 + 0 + 0 + random + false + 0 + 0 + -1 + false + false + false + 25 + .stfolder + false + 0 + 2 + false + standard + standard + false + true + false + false + false + false + + 0 + 0 + + + + basic + + + + 1 + + 3600 + + basic + + 0 + 0 + 0 + random + false + 0 + 0 + -1 + false + false + false + 25 + .stfolder + false + 0 + 2 + false + standard + standard + false + true + false + false + false + false + + 0 + 0 + + + +
dynamic
+ false + false + 0 + 0 + 0 + false + 0 + + +
dynamic
+ false + false + 0 + 0 + 0 + false + 0 + + +
dynamic
+ false + true + 0 + 0 + 0 + false + 0 + + +
dynamic
+ false + false + 0 + 0 + 0 + false + 0 + + +
dynamic
+ false + false + 0 + 0 + 0 + false + 0 + + +
dynamic
+ false + false + 0 + 0 + 0 + false + 0 + + +
dynamic
+ false + false + 0 + 0 + 0 + false + 0 + + +
dynamic
+ false + false + 0 + 0 + 0 + false + 0 + + +
dynamic
+ false + false + 0 + 0 + 0 + false + 0 + + +
dynamic
+ false + false + 0 + 0 + 0 + false + 0 + + +
dynamic
+ false + false + 0 + 0 + 0 + false + 0 + + +
0.0.0.0:8384
+ admin + $2a$10$dd/m.ut08qmfEhEA71J1..ZEXaed6XVK4gnE0oQOyz3awkjVU5vte + 94Ne6vTVebdMXsZgauKv5tohwpdvdRsN + default + + + + default + default + true + true + 21027 + [ff12::8384]:21027 + 0 + 0 + 60 + true + 10 + true + true + 60 + 30 + 10 + 3 + 3 + DEeXiP4q + https://data.syncthing.net/newdata + false + 1800 + 12 + false + 24 + false + 5 + false + 1 + https://upgrades.syncthing.net/meta.json + false + 10 + 0 + true + 0 + https://crash.syncthing.net/newcrash + true + 180 + 20 + default + auto + 0 + true + false + 0 + 0 + false + 10 + 20 + 30 + 40 + 50 + 0 + + + + + basic + + + + 1 + + 3600 + + basic + + 0 + 0 + 0 + random + false + 0 + 0 + 10 + false + false + false + 25 + .stfolder + false + 0 + 2 + false + standard + standard + false + false + false + false + false + false + + 1024 + 4096 + + + +
dynamic
+ false + false + 0 + 0 + 0 + false + 0 + + + + diff --git a/apps/syncthing/overlays/media/deployment-patch.yaml b/apps/syncthing/overlays/media/deployment-patch.yaml new file mode 100644 index 0000000..18471c0 --- /dev/null +++ b/apps/syncthing/overlays/media/deployment-patch.yaml @@ -0,0 +1,24 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: syncthing +spec: + template: + containers: + - name: syncthing + volumeMounts: + - name: sync-keys + mountPath: /var/syncthing/config/cert.pem + subPath: cert.pem + readOnly: true + - name: sync-keys + mountPath: /var/syncthing/config/key.pem + readOnly: true + subPath: key.pem + volumes: + - name: sync-keys + secret: + secretName: sync-secret + items: + - key: cert.pem + - key: key.pem diff --git a/apps/syncthing/overlays/media/key.sops.pem b/apps/syncthing/overlays/media/key.sops.pem new file mode 100644 index 0000000..3d313ab --- /dev/null +++ b/apps/syncthing/overlays/media/key.sops.pem @@ -0,0 +1,20 @@ +{ + "data": "ENC[AES256_GCM,data:UeRToJkSGyQUd7AS/5B1ksjtwzwhSrEGNySX/qfqoByWOiTFy+slinkbDRj1Xb/xcqM92/nq3CF1m5K2Kyg+XiixFSh/RTTe9NV8julJqNQ6sMtlGmp+cFh8BwESTqdwqusjS0OztNdInvdzpm2+vfRY5lccwRrqSElobTZ2mr9zewJmIb6BBWyKf4NoTu5vvxGLsTe+caaX4RDjFnsDA7jD3kHKNkk7O8wMVhpf0dYF0xDQUp/BHVRpGQlOidNzCpisDs/Ww1JuXoR2/comp70qTR13mD2EIv3pITyRTVUKzYY7nI3LqDNxr7pUi78Q5gJRayW/TGSejJnMlnCQBvy7axRS94TpmDMBD3OhY5d//sU8l1qJp9bAPZ+cQy52,iv:isJiH3XpfLXflLjwbpeW1/T9OK7JAVEZgKwhNW1oeFU=,tag:j1ozcySXkqPGB1+kCmpNQw==,type:str]", + "sops": { + "kms": null, + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": [ + { + "recipient": "age1y26vr5qt6th3wu92rnsgkqcpxxah3pqkqa4khcjjycm3kg40aqyqjgfzx9", + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpaFdsNW1CYzZQR29SSldV\nSEdudDVHS01vOGRicHhGUjFQb3pwNlBzUUhrCk52YW83VmpLYlBuc2xqWCtadXc0\nK0NJR1JiYUZhak1mSXp2T3dmcXVDTzAKLS0tIFR0dFJZdjMvdWF1QVZTU3pZNG9L\nUXcvSUZUTGZyeVJEVlFoTnVtMXZJL0UKC6Ddfsg6346q2ozfx0v4VbtE099q2SgE\nteD2nQXqGIuVTdifmUWPb4kwRBeb8Zk1w7F5ELME3UQOGVPvGiJB/Q==\n-----END AGE ENCRYPTED FILE-----\n" + } + ], + "lastmodified": "2024-05-25T13:09:11Z", + "mac": "ENC[AES256_GCM,data:GGcmvaZ/h5OMfeNY7EzMGYCFPYnxtce/5yqGvdf6pGwCDGLIBBXSQzYRKCOz4knCFTho1ka9EQAj24EM/z3qz7cGDTbU96WoxZaEaknAY6EaI9SjNxhFJNf1KFgmf6eOimDTLNfieG81jL10i/fAyXV+qgd1s/okDDs2C/pGyRA=,iv:kdfbAtaFeA/pQWwVkJRm3uVNoD/BFz08kFBiekM5lQo=,tag:C+4DNsbG8G0Vm9TbBIti3w==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.8.1" + } +} \ No newline at end of file diff --git a/apps/syncthing/overlays/media/kustomization.yaml b/apps/syncthing/overlays/media/kustomization.yaml new file mode 100644 index 0000000..cf89748 --- /dev/null +++ b/apps/syncthing/overlays/media/kustomization.yaml @@ -0,0 +1,11 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - ../../base + +generators: + - secrets.yaml + +patches: + - path: deployment-patch.yaml diff --git a/apps/syncthing/overlays/media/secrets.yaml b/apps/syncthing/overlays/media/secrets.yaml new file mode 100644 index 0000000..ea9ed74 --- /dev/null +++ b/apps/syncthing/overlays/media/secrets.yaml @@ -0,0 +1,15 @@ +apiVersion: viaduct.ai/v1 +kind: ksops +metadata: + name: ksops-generator + annotations: + config.kubernetes.io/function: | + exec: + path: ksops +secretFrom: + - metadata: + name: sync-secret + type: Opaque + binaryFiles: + - cert.pem=./cert.sops.pem + - key.pem=./key.sops.pem