init

.github/dependabot.yml

@@ -0,0 +1,11 @@
+---
+version: 2
+updates:
+  - package-ecosystem: "terraform"
+    directory: "/contrib/terraform/"
+    schedule:
+      interval: "daily"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/diagrams.yaml

@@ -0,0 +1,36 @@
+---
+name: Render Diagrams
+
+on:
+  push:
+    paths:
+      - '**.d2'
+
+jobs:
+  render:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Set up D2
+        run: |
+          curl -fsSL https://d2lang.com/install.sh | sh -s --
+
+      - name: Run make generate
+        run: make diagrams
+
+      - name: Check for differences
+        run: |
+          if [[ -n $(git status --porcelain) ]]; then
+            echo "Changes in diagrams detected"
+            git status
+            git diff
+            git config --global user.name 'diagrambot'
+            git config --global user.email '[email protected]'
+            git commit -am "Automated diagram"
+            git push
+          else
+            echo "No changes detected"
+          fi

.github/workflows/lint.yaml

@@ -0,0 +1,30 @@
+---
+name: "lint"
+on:
+  push:
+    branches:
+      - "master"
+      - "main"
+  pull_request: {}
+  workflow_dispatch: {}
+jobs:
+  kube-linter:
+    runs-on: "ubuntu-latest"
+    steps:
+      - uses: "actions/checkout@v4"
+      - name: "Scan yamls"
+        id: "kube-lint-scan"
+        uses: "stackrox/kube-linter-action@v1"
+        with:
+          directory: "apps"
+          config: ".kube-linter.yaml"
+  yamllint:
+    runs-on: "ubuntu-latest"
+    steps:
+      - uses: "actions/checkout@v4"
+      - name: "Install yamllint"
+        run: |
+          pip install yamllint
+      - name: "Run yamllint"
+        run: |
+          yamllint .

.github/workflows/pr.yaml

@@ -0,0 +1,29 @@
+---
+name: Pull Request Action
+on:
+  push:
+    branches:
+      - updates
+jobs:
+  create-pull-request:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Create Pull Request
+        uses: actions/[email protected]
+        with:
+          script: |
+            try {
+              const { repo, owner } = context.repo;
+              const result = await github.rest.pulls.create({
+                title: '[Auto-generated] Update Container Image',
+                owner,
+                repo,
+                head: '${{ github.ref_name }}',
+                base: 'main',
+                body: [
+                  '${{ github.event.head_commit.message }}'
+                ].join('\n')
+              });
+            } catch(err) {
+              console.log(err);
+            }

.github/workflows/security-scanners.yaml

@@ -0,0 +1,31 @@
+---
+name: "security-scanners"
+on:
+  push:
+    branches:
+      - "master"
+      - "main"
+  pull_request: {}
+  workflow_dispatch: {}
+jobs:
+  trivy:
+    name: "trivy"
+    runs-on: "ubuntu-latest"
+    steps:
+      - uses: "actions/checkout@v4"
+      - name: "Run Trivy vulnerability scanner in fs mode"
+        uses: "aquasecurity/trivy-action@master"
+        with:
+          scan-type: "fs"
+          scan-ref: "."
+          trivy-config: "trivy.yaml"
+  gitleaks:
+    name: "gitleaks"
+    runs-on: "ubuntu-latest"
+    steps:
+      - uses: "actions/checkout@v4"
+        with:
+          fetch-depth: 0
+      - uses: "gitleaks/gitleaks-action@v2"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -0,0 +1,7 @@
+**/.terraform/*
+*.tfstate
+*.tfstate.*
+*secret*.y*ml
+!sops-*.y*ml
+*.swp
+/.idea

.kube-linter.yaml

@@ -0,0 +1,4 @@
+---
+checks:
+  exclude:
+    - "unset-cpu-requirements"

.pre-commit-config.yaml

@@ -0,0 +1,7 @@
+---
+repos:
+  - repo: https://github.com/soerenschneider/pre-commit-hooks
+    rev: v1.5.1
+    hooks:
+      - id: yamllint
+      - id: gitleaks

.trivyignore.yaml

@@ -0,0 +1,39 @@
+---
+misconfigurations:
+  - id: "AVD-KSV-0011"
+  - id: "AVD-KSV-0012"
+    paths:
+      - "apps/vector/daemonset.yaml"
+  - id: "AVD-KSV-0014"
+    paths:
+      - "apps/keycloak/deployment.yaml"
+  - id: "AVD-KSV-0020"
+    paths:
+      - "apps/vector/daemonset.yaml"
+      - "apps/**/postgres-deployment.yaml"
+      - "apps/immich/components/pgvector/postgres-sts.yaml"
+      - "apps/paperless-ngx/paperless-ngx-deployment.yaml"
+      - "apps/keycloak/deployment.yaml" # errors if not running as 1000
+  - id: "AVD-KSV-0021"
+    paths:
+      - "apps/vector/daemonset.yaml"
+      - "apps/**/postgres-deployment.yaml"
+      - "apps/paperless-ngx/paperless-ngx-deployment.yaml"
+      - "apps/immich/components/pgvector/postgres-sts.yaml"
+      - "apps/keycloak/deployment.yaml" # errors if not running as 1000
+  - id: "AVD-KSV-0023"
+    paths:
+      - "apps/vector/daemonset.yaml"
+  - id: "AVD-KSV-0048"
+    paths:
+      - "apps/reloader/components/rbac/clusterrole.yaml"
+  - id: "AVD-KSV-0041"
+    paths:
+      - "apps/reloader/components/rbac/clusterrole.yaml"
+  - id: "AVD-KSV-0109"
+    paths:
+      - "clusters/common/taskd/configmap-ca.yaml"
+  - id: "AVD-KSV-01010"
+    paths:
+      - "**/taskwarrior-configmap.yaml" # false positive
+      - "apps/mariadb-galera/components/tls-wsrep/cm-sst-cnf.yaml" # false positive

.yamllint.yaml

@@ -0,0 +1,6 @@
+---
+extends: default
+rules:
+  line-length: disable
+ignore:
+  - "*sops*.yaml"

Makefile

@@ -0,0 +1,10 @@
+.PHONY: diagrams
+diagrams:
+	find diagrams -iname '*.d2' -print0 | xargs -0 -I {} d2 "{}"
+
+pre-commit-init:
+	pre-commit install
+	pre-commit install --hook-type commit-msg
+
+pre-commit-update:
+	pre-commit autoupdate

apps/acmevault/deployment.yaml

@@ -0,0 +1,82 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: acmevault
+  labels:
+    app: acmevault
+    app.kubernetes.io/name: acmevault
+    app.kubernetes.io/instance: acmevault-prod
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: acmevault
+  template:
+    metadata:
+      labels:
+        app: acmevault
+        app.kubernetes.io/name: acmevault
+        app.kubernetes.io/instance: acmevault-prod
+      annotations:
+        prometheus.io/port: "9191"
+        prometheus.io/scrape: "true"
+    spec:
+      securityContext:
+        runAsUser: 65535
+        runAsGroup: 65535
+        fsGroup: 65535
+        runAsNonRoot: true
+        seccompProfile:
+          type: "RuntimeDefault"
+      containers:
+        - name: acmevault
+          image: "ghcr.io/soerenschneider/acmevault:1.14.0"
+          imagePullPolicy: "IfNotPresent"
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            privileged: false
+            runAsNonRoot: true
+            runAsUser: 65535
+            runAsGroup: 65535
+            capabilities:
+              drop:
+                - "ALL"
+            seccompProfile:
+              type: "RuntimeDefault"
+          command:
+            - "/acmevault"
+            - "-config"
+            - "/config/acmevault-config.yaml"
+          ports:
+            - containerPort: 9191
+              name: "metrics"
+          env:
+            - name: "AWS_REGION"
+              value: "us-east-1"
+          resources:
+            requests:
+              memory: "32Mi"
+              cpu: "5m"
+            limits:
+              memory: "128Mi"
+          volumeMounts:
+            - name: "config-volume"
+              mountPath: "/config"
+      volumes:
+        - name: "config-volume"
+          configMap:
+            name: "config"
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 10
+              preference:
+                matchExpressions:
+                  - key: "cpu_speed"
+                    operator: "NotIn"
+                    values:
+                      - "fast"

apps/acmevault/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: "kustomize.config.k8s.io/v1beta1"
+kind: "Kustomization"
+resources:
+  - "deployment.yaml"
+  - "networkpolicy.yaml"

apps/acmevault/networkpolicy.yaml

@@ -0,0 +1,42 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: acmevault
+spec:
+  podSelector:
+    matchLabels:
+      app: acmevault
+  policyTypes:
+    - Egress
+    - Ingress
+  ingress:
+    - ports:
+        - protocol: TCP
+          port: metrics
+      from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: monitoring
+          podSelector:
+            matchLabels:
+              app: prometheus
+  egress:
+    - ports:
+        - port: 443
+          protocol: TCP
+        - port: 8200
+          protocol: TCP
+    - ports:
+        - port: 53
+          protocol: TCP
+        - port: 53
+          protocol: UDP
+    - to:
+        - namespaceSelector: {}
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - port: 53
+          protocol: UDP

apps/actualbudget/components/istio-proxy/kustomization.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: "kustomize.config.k8s.io/v1alpha1"
+kind: "Component"
+patches:
+  - target:
+      kind: "Namespace"
+    patch: |-
+      - op: add
+        path: "/metadata/labels/istio-injection"
+        value: "enabled"
+  - target:
+      kind: "NetworkPolicy"
+    patch: |-
+      - op: add
+        path: "/spec/egress/-"
+        value:
+          to:
+            - namespaceSelector:
+                matchLabels:
+                  kubernetes.io/metadata.name: kube-system
+              podSelector:
+                matchLabels:
+                  k8s-app: kube-dns
+          ports:
+            - port: 53
+              protocol: UDP
+            - port: 53
+              protocol: TCP
+      - op: add
+        path: "/spec/egress/-"
+        value:
+          to:
+            - namespaceSelector:
+                matchLabels:
+                  kubernetes.io/metadata.name: istio-system
+              podSelector: {}
+          ports:
+            - port: 15012
+              protocol: TCP
+            - port: 15014
+              protocol: TCP