From 823049e14ba65772bc854818cf32705e5869f119 Mon Sep 17 00:00:00 2001
From: Wolfgang Hottgenroth <wolfgang.hottgenroth@icloud.com>
Date: Thu, 19 Oct 2023 12:39:29 +0200
Subject: [PATCH] stuff

---
 database/main.yml             |  35 +++++++++++
 database/restart.yml          |   8 +++
 database/setup-database.sh    |  48 +++++++++++++++
 grafana/ingress.yml           |  22 +++++++
 grafana/install.sh            |  28 +++++++++
 grafana/namespace             |   1 +
 grafana/provisioning.json     | 108 ++++++++++++++++++++++++++++++++++
 grafana/readme.md             |   5 ++
 grafana/roll-db-credential.sh |  33 +++++++++++
 grafana/test.yml              |  22 +++++++
 grafana/values.yml            |  51 ++++++++++++++++
 install.sh                    |  18 ++++++
 namespace                     |   1 +
 nodered/install.sh            |   9 +++
 nodered/values.yml            |   8 +++
 sinkserver/deploy.yml         |  93 +----------------------------
 16 files changed, 398 insertions(+), 92 deletions(-)
 create mode 100644 database/main.yml
 create mode 100644 database/restart.yml
 create mode 100755 database/setup-database.sh
 create mode 100644 grafana/ingress.yml
 create mode 100755 grafana/install.sh
 create mode 100644 grafana/namespace
 create mode 100644 grafana/provisioning.json
 create mode 100644 grafana/readme.md
 create mode 100755 grafana/roll-db-credential.sh
 create mode 100644 grafana/test.yml
 create mode 100644 grafana/values.yml
 create mode 100755 install.sh
 create mode 100644 namespace
 create mode 100755 nodered/install.sh
 create mode 100644 nodered/values.yml

diff --git a/database/main.yml b/database/main.yml
new file mode 100644
index 0000000..d324835
--- /dev/null
+++ b/database/main.yml
@@ -0,0 +1,35 @@
+---
+apiVersion: stackgres.io/v1
+kind: SGPostgresConfig
+metadata:
+  name: database
+  namespace: mainscnt
+spec:
+  postgresVersion: '15'
+  postgresql.conf:
+    shared_preload_libraries: timescaledb
+    max_worker_processes: '32'
+    max_parallel_workers: '16'
+---    
+apiVersion: stackgres.io/v1
+kind: SGCluster
+metadata:
+  name: database
+  namespace: mainscnt
+spec:
+  instances: 1
+  postgres:
+    version: '15'
+    extensions:
+      - name: timescaledb
+    ssl:
+      enabled: true
+  configurations:
+    sgPostgresConfig: database    
+  pods:
+    persistentVolume:
+      size: '1000Gi'
+      storageClass: nfs-client
+    disableConnectionPooling: true
+
+
diff --git a/database/restart.yml b/database/restart.yml
new file mode 100644
index 0000000..8e4c033
--- /dev/null
+++ b/database/restart.yml
@@ -0,0 +1,8 @@
+apiVersion: stackgres.io/v1
+kind: SGDbOps
+metadata:
+  name: restart-002
+spec:
+  sgCluster: database
+  op: restart
+
diff --git a/database/setup-database.sh b/database/setup-database.sh
new file mode 100755
index 0000000..ed6ade4
--- /dev/null
+++ b/database/setup-database.sh
@@ -0,0 +1,48 @@
+#!/bin/bash
+
+
+DATABASE=mainscnt
+LOGIN=sink
+PASSWORD=`openssl rand -base64 24`
+SUPERUSER_LOGIN=$(kubectl get secret -n mainscnt database -o jsonpath="{.data.superuser-username}" | base64 --decode)
+SUPERUSER_PASSWORD=$(kubectl get secret -n mainscnt database -o jsonpath="{.data.superuser-password}" | base64 --decode)
+
+
+kubectl run psql \
+  --stdin=true \
+  --tty=true \
+  --rm=true \
+  --image=postgres:15-alpine \
+  -n $NAMESPACE \
+  --restart=Never \
+  --env="PGPASSWORD=$SUPERUSER_PASSWORD" \
+  --env="PGUSER=$SUPERUSER_LOGIN" \
+  -- \
+  psql -h database.mainscnt.svc.cluster.local <<EOF
+do
+\$\$
+begin
+  if not exists (SELECT * FROM pg_database WHERE datname = '$DATABASE') then
+    CREATE DATABASE $DATABASE;
+  end if;
+  if not exists (SELECT * FROM pg_user WHERE usename = '$LOGIN') then
+    CREATE USER $LOGIN WITH PASSWORD '$PASSWORD';
+  else
+    ALTER USER $LOGIN WITH PASSWORD '$PASSWORD';
+  end if;
+  GRANT ALL PRIVILEGES ON DATABASE $DATABASE TO $LOGIN;
+end
+\$\$
+;
+commit;
+EOF
+
+kubectl create secret generic sinkserver-secret \
+  --dry-run=client \
+  -o yaml \
+  --save-config \
+  --from-literal=dbpass="$PASSWORD" | \
+kubectl apply -f - -n $NAMESPACE
+
+
+
diff --git a/grafana/ingress.yml b/grafana/ingress.yml
new file mode 100644
index 0000000..b53300e
--- /dev/null
+++ b/grafana/ingress.yml
@@ -0,0 +1,22 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: grafana
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production-http
+spec:
+  tls:
+    - hosts:
+        - grafana.mainscnt.eu
+      secretName: grafana-cert
+  rules:
+    - host: grafana.mainscnt.eu
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service: 
+                name: mainscntgrafana
+                port: 
+                  number: 80
diff --git a/grafana/install.sh b/grafana/install.sh
new file mode 100755
index 0000000..637d18d
--- /dev/null
+++ b/grafana/install.sh
@@ -0,0 +1,28 @@
+#!/bin/bash
+
+ARG1=$1
+NAMESPACE=$(cat namespace)
+
+echo "Namespace: $NAMESPACE"
+
+
+
+
+if [ "$ARG1" = "initial" ]; then
+  psql << EOF
+create user mainscntgrafana;
+commit;
+create database mainscntgrafana with owner mainscntgrafana;
+EOF
+fi
+
+./roll-db-credential.sh
+
+helm repo add grafana https://grafana.github.io/helm-charts
+helm repo update
+helm upgrade --install -f values.yml mainscntgrafana grafana/grafana --version 6.59.0 --namespace=$NAMESPACE
+
+kubectl annotate deployments mainscntgrafana -n $NAMESPACE --overwrite=true secret.reloader.stakater.com/reload=grafana-db-cred
+
+kubectl -f ingress.yml -n $NAMESPACE apply
+
diff --git a/grafana/namespace b/grafana/namespace
new file mode 100644
index 0000000..3d00bb7
--- /dev/null
+++ b/grafana/namespace
@@ -0,0 +1 @@
+mainscnt
diff --git a/grafana/provisioning.json b/grafana/provisioning.json
new file mode 100644
index 0000000..e1342b6
--- /dev/null
+++ b/grafana/provisioning.json
@@ -0,0 +1,108 @@
+[
+  {
+    "name": "createClientMainscntGrafana",
+    "method": "POST",
+    "url": "https://auth2.hottis.de/admin/realms/hottis/clients",
+    "data": {
+      "protocol": "openid-connect",
+      "enabled": "true",
+      "clientId": "mainscnt-grafana",
+      "name": "Grafana2",
+      "baseUrl": "https://grafana.mainscnt.eu",
+      "redirectUris": [
+        "https://grafana.mainscnt.eu/login/generic_oauth"
+      ],
+      "standardFlowEnabled": "true",
+      "implicitFlowEnabled": "false",
+      "publicClient": "false"
+    }
+  },
+  {
+    "name": "createClientRoleMaincntGrafanaAdmin",
+    "method": "POST",
+    "url": "https://auth2.hottis.de/admin/realms/hottis/clients/$result/roles",
+    "use": {
+      "url": "https://auth2.hottis.de/admin/realms/hottis/clients",
+      "data": { "clientId": "mainscnt-grafana" },
+      "resultIndexes": [ 0, "id" ]
+    },
+    "data": {
+      "name": "Admin"
+    }
+  },
+  {
+    "name": "createClientRoleMainscntGrafanaGrafanaAdmin",
+    "method": "POST",
+    "url": "https://auth2.hottis.de/admin/realms/hottis/clients/$result/roles",
+    "use": {
+      "url": "https://auth2.hottis.de/admin/realms/hottis/clients",
+      "data": { "clientId": "mainscnt-grafana" },
+      "resultIndexes": [ 0, "id" ]
+    },
+    "data": {
+      "name": "GrafanaAdmin"
+    }
+  },
+  {
+    "name": "createClientRoleMainscntGrafanaViewer",
+    "method": "POST",
+    "url": "https://auth2.hottis.de/admin/realms/hottis/clients/$result/roles",
+    "use": {
+      "url": "https://auth2.hottis.de/admin/realms/hottis/clients",
+      "data": { "clientId": "mainscnt-grafana" },
+      "resultIndexes": [ 0, "id" ]
+    },
+    "data": {
+      "name": "Viewer"
+    }
+  },
+  {
+    "name": "createClientRoleMainscntGrafanaEditor",
+    "method": "POST",
+    "url": "https://auth2.hottis.de/admin/realms/hottis/clients/$result/roles",
+    "use": {
+      "url": "https://auth2.hottis.de/admin/realms/hottis/clients",
+      "data": { "clientId": "mainscnt-grafana" },
+      "resultIndexes": [ 0, "id" ]
+    },
+    "data": {
+      "name": "Editor"
+    }
+  },
+  {
+    "name": "createRoleMapperMainscntGrafana",
+    "method": "POST",
+    "url": "https://auth2.hottis.de/admin/realms/hottis/clients/$result/protocol-mappers/add-models",
+    "use": {
+      "url": "https://auth2.hottis.de/admin/realms/hottis/clients",
+      "data": { "clientId": "mainscnt-grafana" },
+      "resultIndexes": [ 0, "id" ]
+    },
+    "data": [
+      {
+        "name": "client roles",
+        "protocol": "openid-connect",
+        "protocolMapper": "oidc-usermodel-client-role-mapper",
+        "consentRequired": false,
+        "config": {
+          "multivalued": "true",
+          "user.attribute": "foo",
+          "access.token.claim": "true",
+          "claim.name": "roles",
+          "jsonType.label": "String",
+          "id.token.claim": "true",
+          "access.token.claim": "true",
+          "clientId": "mainscnt-grafana"
+        }
+      }
+    ]
+  },
+  {
+    "name": "getClientMainscntGrafana",
+    "method": "GET",
+    "url": "https://auth2.hottis.de/admin/realms/hottis/clients",
+    "data": { "clientId": "mainscnt-grafana" }
+  }
+]
+
+
diff --git a/grafana/readme.md b/grafana/readme.md
new file mode 100644
index 0000000..bba01b1
--- /dev/null
+++ b/grafana/readme.md
@@ -0,0 +1,5 @@
+For the OAuth configuration follow the docs at
+https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/generic-oauth/
+
+With keycloak create under "client scopes" a dedicated mapper to fill the client roles into the claim roles.
+
diff --git a/grafana/roll-db-credential.sh b/grafana/roll-db-credential.sh
new file mode 100755
index 0000000..34d72d6
--- /dev/null
+++ b/grafana/roll-db-credential.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+
+
+DATABASE=mainscntgrafana
+LOGIN=mainscntgrafana
+PASSWORD=`openssl rand -base64 24`
+NAMESPACE=$(cat namespace)
+
+psql <<EOF
+do
+\$\$
+begin
+  if not exists (SELECT * FROM pg_user WHERE usename = '$LOGIN') then
+    CREATE USER $LOGIN WITH PASSWORD '$PASSWORD';
+  else
+    ALTER USER $LOGIN WITH PASSWORD '$PASSWORD';
+  end if;
+  GRANT ALL PRIVILEGES ON DATABASE $DATABASE TO $LOGIN;
+end
+\$\$
+;
+commit;
+EOF
+
+kubectl create secret generic grafana-db-cred \
+  --dry-run=client \
+  -o yaml \
+  --save-config \
+  --from-literal=GF_DATABASE_USER="$LOGIN" \
+  --from-literal=GF_DATABASE_PASSWORD="$PASSWORD" | \
+kubectl apply -f - -n $NAMESPACE
+
+
diff --git a/grafana/test.yml b/grafana/test.yml
new file mode 100644
index 0000000..8d396bd
--- /dev/null
+++ b/grafana/test.yml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: secretloader
+  labels:
+    app: secretloader
+spec:
+  containers:
+    - name: secretloader
+      image: nginx
+      env:
+        - name: USERNAME
+          valueFrom:
+            secretKeyRef:
+              name: grafana-admin-credentials
+              key: username
+        - name: PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: grafana-admin-credentials
+              key: password
+
diff --git a/grafana/values.yml b/grafana/values.yml
new file mode 100644
index 0000000..3fc5852
--- /dev/null
+++ b/grafana/values.yml
@@ -0,0 +1,51 @@
+persistence:
+  enabled: true
+  storageClassName: nfs-client
+
+grafana.ini:
+  server:
+    root_url: https://grafana.mainscnt.eu
+  smtp:
+    enabled: true
+    host: smtp.system.svc.cluster.local
+    from_address: grafana@mainscnt.eu
+    from_name: "Mainscnt Grafana Pseudouser"
+  log:
+    level: debug
+  emails:
+    welcome_email_on_sign_up: true
+  security:
+    cookie_secure: true
+    cookie_samesite: none
+  auth:
+    disable_login_form: true
+  auth.generic_oauth:
+    enabled: true
+    name: Mainscnt Grafana via Keycloak
+    allow_sign_up: true
+    client_id: mainscnt-grafana
+    client_secret: ...
+    scopes: openid email profile offline_access roles
+    email_attribute_path: email
+    login_attribute_path: username
+    name_attribute_path: fullname
+    auth_url: https://auth2.hottis.de/realms/hottis/protocol/openid-connect/auth
+    token_url: https://auth2.hottis.de/realms/hottis/protocol/openid-connect/token
+    api_url: https://auth2.hottis.de/realms/hottis/protocol/openid-connect/userinfo
+    role_attribute_path: "contains(roles[*], 'GrafanaAdmin') && 'GrafanaAdmin' || contains(roles[*], 'Admin') && 'Admin' || contains(roles[*], 'Editor') && 'Editor' || contains(roles[*], 'Viewer') && 'Viewer'"
+    role_attribute_strict: true
+    allow_assign_grafana_admin: true
+    tls_skip_verify_insecure: true
+  database:
+    type: postgres
+    host: timescaledb.database.svc.cluster.local
+    name: mainscntgrafana
+    ssl_mode: require
+
+# add the oauth client secret in this secret with the key GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
+# example:
+# kubectl create secret generic grafana-oauth-secret --from-literal=GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET="geheim"
+envFromSecrets:
+  - name: grafana-oauth-secret
+  - name: grafana-db-cred
+
diff --git a/install.sh b/install.sh
new file mode 100755
index 0000000..f1647a6
--- /dev/null
+++ b/install.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+export NAMESPACE=$(cat namespace)
+
+kubectl create namespace $NAMESPACE --dry-run=client -o yaml | kubectl -f - apply
+
+kubectl apply -f ./database/main.yml -n $NAMESPACE
+while true; do
+  kubectl get -n $NAMESPACE pod database-0 && break
+  echo "pod not yet available"
+  sleep 5
+done
+echo "waiting for database to get ready"
+kubectl wait --for=condition=ready -n $NAMESPACE --timeout=600s pod database-0
+
+./database/setup-database.sh
+
+
diff --git a/namespace b/namespace
new file mode 100644
index 0000000..3d00bb7
--- /dev/null
+++ b/namespace
@@ -0,0 +1 @@
+mainscnt
diff --git a/nodered/install.sh b/nodered/install.sh
new file mode 100755
index 0000000..8df3e52
--- /dev/null
+++ b/nodered/install.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+if [ "$NAMESPACE" = "" ]; then
+  NAMESPACE=$(cat ../namespace)
+fi
+
+helm repo add geek-cookbook https://geek-cookbook.github.io/charts/
+helm repo update
+helm upgrade --install -n $NAMESPACE -f values.yml nodered geek-cookbook/node-red --version 10.3.2
diff --git a/nodered/values.yml b/nodered/values.yml
new file mode 100644
index 0000000..45be557
--- /dev/null
+++ b/nodered/values.yml
@@ -0,0 +1,8 @@
+env:
+  NODE_RED_ENABLE_PROJECTS: true
+persistence:
+  data:
+    enabled: true
+    storageClass: nfs-client
+    accessMode: ReadWriteOnce
+    size: 1Gi
diff --git a/sinkserver/deploy.yml b/sinkserver/deploy.yml
index ef33396..7e7adbc 100644
--- a/sinkserver/deploy.yml
+++ b/sinkserver/deploy.yml
@@ -1,25 +1,3 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  namespace: mainscnt
-  name: deny-all-but-dns
-spec:
-  podSelector:
-    matchLabels: {}
-  policyTypes:
-    - Egress
-    - Ingress
-  egress:
-    - to:
-      - namespaceSelector:
-          matchLabels:
-            kubernetes.io/metadata.name: kube-system
-      ports:
-        - protocol: UDP
-          port: 53
-        - protocol: TCP
-          port: 53
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -28,7 +6,7 @@ metadata:
   labels:
     app: sinkserver
 spec:
-  replicas: 3
+  replicas: 1
   selector:
     matchLabels:
       app: sinkserver
@@ -70,72 +48,3 @@ spec:
     - protocol: UDP
       port: 20169
       targetPort: 20169
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-database-sinkserver
-  namespace: database
-spec:
-  podSelector:
-    matchLabels:
-      app: timescaledb
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-      - podSelector:
-          matchLabels:
-            app: sinkserver
-      - namespaceSelector:
-          matchLabels:
-            kubernetes.io/metadata.name: mainscnt
-      ports:
-        - protocol: TCP
-          port: 5432
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-sinkserver-database
-  namespace: mainscnt
-spec:
-  podSelector:
-    matchLabels:
-      app: sinkserver
-  policyTypes:
-    - Egress
-  egress:
-    - to:
-      - podSelector:
-          matchLabels:
-            app: timescaledb
-      - namespaceSelector:
-          matchLabels:
-            kubernetes.io/metadata.name: database
-      ports:
-        - protocol: TCP
-          port: 5432
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: allow-sinkserver-ingress
-  namespace: mainscnt
-spec:
-  podSelector:
-    matchLabels:
-      app: sinkserver
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-      - ipBlock:
-          cidr: 0.0.0.0/0
-      ports:
-        - protocol: UDP
-          port: 20169
-
-
-
-