deply vpn-gateway

[jgilfoil]

No description provided.

[github-actions]

--- kubernetes/flux Kustomization: flux-system/cluster HelmRepository: flux-system/angelnu

+++ kubernetes/flux Kustomization: flux-system/cluster HelmRepository: flux-system/angelnu

@@ -0,0 +1,14 @@

+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: angelnu
+  namespace: flux-system
+spec:
+  interval: 1h
+  timeout: 15m
+  url: https://angelnu.github.io/helm-charts
+
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/vpn-gateway

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/vpn-gateway

@@ -0,0 +1,40 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: vpn-gateway
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: vpn-gateway
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  interval: 30m
+  path: ./kubernetes/apps/network/vpn-gateway/app
+  postBuild:
+    substituteFrom:
+    - kind: ConfigMap
+      name: cluster-settings
+    - kind: Secret
+      name: cluster-secrets
+    - kind: ConfigMap
+      name: cluster-settings-user
+      optional: true
+    - kind: Secret
+      name: cluster-secrets-user
+      optional: true
+  prune: false
+  retryInterval: 5m30s
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  targetNamespace: network
+  timeout: 5m
+  wait: true
+
--- kubernetes/apps/network/vpn-gateway/app Kustomization: flux-system/vpn-gateway HelmRelease: network/vpn-gateway

+++ kubernetes/apps/network/vpn-gateway/app Kustomization: flux-system/vpn-gateway HelmRelease: network/vpn-gateway

@@ -0,0 +1,94 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: vpn-gateway
+    kustomize.toolkit.fluxcd.io/name: vpn-gateway
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+    kustomize.toolkit.fluxcd.io/substitute: disabled
+  name: vpn-gateway
+  namespace: network
+spec:
+  chart:
+    spec:
+      chart: pod-gateway
+      interval: 15m
+      sourceRef:
+        kind: HelmRepository
+        name: angelnu-helm-charts
+        namespace: flux-system
+      version: 6.5.1
+  interval: 5m
+  values:
+    addons:
+      vpn:
+        enabled: true
+        env:
+        - name: VPN_TYPE
+          value: wireguard
+        - name: VPN_INTERFACE
+          value: wg0
+        - name: FIREWALL
+          value: 'off'
+        - name: DOT
+          value: 'off'
+        envFrom:
+        - secretRef:
+            name: vpn-gateway-config
+        gluetun:
+          image:
+            repository: docker.io/qmcgaw/gluetun
+            tag: v3.37.0
+        livenessProbe:
+          exec:
+            command:
+            - sh
+            - -c
+            - if [ $(wget -q -O- https://ipinfo.io/country) == 'NO' ]; then exit 0;
+              else exit $?; fi
+          failureThreshold: 3
+          initialDelaySeconds: 30
+          periodSeconds: 60
+        networkPolicy:
+          egress:
+          - ports:
+            - port: ${SECRET_VPN_GATEWAY_PORT}
+              protocol: UDP
+            to:
+            - ipBlock:
+                cidr: 0.0.0.0/0
+          - to:
+            - ipBlock:
+                cidr: 10.0.0.0/8
+          enabled: true
+        type: gluetun
+    image:
+      repository: ghcr.io/angelnu/pod-gateway
+      tag: v1.10.0
+    publicPorts:
+    - IP: 10
+      hostname: transmission
+      ports:
+      - port: 27071
+        type: udp
+      - port: 27071
+        type: tcp
+    routed_namespaces:
+    - media
+    settings:
+      VPN_BLOCK_OTHER_TRAFFIC: true
+      VPN_INTERFACE: wg0
+      VPN_LOCAL_CIDRS: 10.69.0.0/16 10.96.0.0/16 192.168.1.0/24
+      VPN_TRAFFIC_PORT: ${SECRET_VPN_GATEWAY_PORT}
+    webhook:
+      gatewayAnnotation: routeToVPN
+      gatewayDefault: false
+      gatewayLabel: routeToVPN
+      image:
+        pullPolicy: Always
+        repository: ghcr.io/angelnu/gateway-admision-controller
+        tag: v3.9.0
+      namespaceSelector:
+        label: vpn-routed-gateway
+