wn/home-automation
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

new mtls approach
All checks were successful
ci/woodpecker/push/build/1 Pipeline was successful
Details
ci/woodpecker/push/build/4 Pipeline was successful
Details
ci/woodpecker/push/predeploy Pipeline was successful
Details
ci/woodpecker/push/build/3 Pipeline was successful
Details
ci/woodpecker/push/build/2 Pipeline was successful
Details
ci/woodpecker/push/deploy/3 Pipeline was successful
Details
ci/woodpecker/push/deploy/4 Pipeline was successful
Details
ci/woodpecker/push/deploy/2 Pipeline was successful
Details
ci/woodpecker/push/deploy/1 Pipeline was successful
Details
ci/woodpecker/tag/predeploy Pipeline was successful
Details
ci/woodpecker/tag/build/4 Pipeline was successful
Details
ci/woodpecker/tag/build/1 Pipeline was successful
Details
ci/woodpecker/tag/build/3 Pipeline was successful
Details
ci/woodpecker/tag/build/2 Pipeline was successful
Details
ci/woodpecker/tag/deploy/3 Pipeline was successful
Details
ci/woodpecker/tag/deploy/1 Pipeline was successful
Details
ci/woodpecker/tag/deploy/4 Pipeline was successful
Details
ci/woodpecker/tag/deploy/2 Pipeline was successful
Details

Browse Source
This commit is contained in:
Wolfgang Hottgenroth
2025-11-29 22:55:42 +01:00
parent 205baa7e01
commit 8fa81be750
6 changed files with 0 additions and 333 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.woodpecker/predeploy.yml
View File

@@ -33,7 +33,6 @@ steps:
--namespace=$NAMESPACE
--dry-run=client -o yaml | kubectl apply -f -
- kubectl apply -f deployment/configmap.yaml -n $NAMESPACE
- kubectl apply -f deployment/mtls-config.yaml # NO NAMESPACE HERE
when:
event: [tag]

25
deployment/api-deployment.yaml
View File

@@ -100,28 +100,3 @@ spec:
targetPort: 8001
name: http
type: ClusterIP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: api-ingress
annotations:
cert-manager.io/cluster-issuer: letsencrypt-production-http
traefik.ingress.kubernetes.io/router.middlewares: default-mtls-auth@kubernetescrd,default-security-headers@kubernetescrd
traefik.ingress.kubernetes.io/router.tls.options: default-homea2-mtls@kubernetescrd
spec:
tls:
- hosts:
- homea2-api.hottis.de
secretName: homea2-api-cert
rules:
- host: homea2-api.hottis.de
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: api
port:
number: 80

130
deployment/api-deployment.yaml.bak
View File

@@ -1,130 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: api
namespace: homea2
labels:
app: api
component: home-automation
spec:
replicas: 1
selector:
matchLabels:
app: api
template:
metadata:
annotations:
reloader.stakater.com/auto: "true"
configmap.reloader.stakater.com/reload: "home-automation-environment,home-automation-config"
labels:
app: api
component: home-automation
spec:
containers:
- name: api
image: %IMAGE%
ports:
- containerPort: 8001
name: http
env:
- name: MQTT_BROKER
valueFrom:
configMapKeyRef:
name: home-automation-environment
key: SHARED_MQTT_BROKER
- name: MQTT_PORT
valueFrom:
configMapKeyRef:
name: home-automation-environment
key: SHARED_MQTT_PORT
- name: REDIS_HOST
valueFrom:
configMapKeyRef:
name: home-automation-environment
key: SHARED_REDIS_HOST
- name: REDIS_PORT
valueFrom:
configMapKeyRef:
name: home-automation-environment
key: SHARED_REDIS_PORT
- name: REDIS_DB
valueFrom:
configMapKeyRef:
name: home-automation-environment
key: SHARED_REDIS_DB
- name: REDIS_CHANNEL
valueFrom:
configMapKeyRef:
name: home-automation-environment
key: API_REDIS_CHANNEL
volumeMounts:
- name: config-volume
mountPath: /app/config
readOnly: true
livenessProbe:
httpGet:
path: /health
port: 8001
initialDelaySeconds: 30
periodSeconds: 10
readinessProbe:
httpGet:
path: /health
port: 8001
initialDelaySeconds: 5
periodSeconds: 5
resources:
limits:
cpu: 1000m
memory: 1Gi
requests:
cpu: 200m
memory: 256Mi
volumes:
- name: config-volume
configMap:
name: home-automation-config
---
apiVersion: v1
kind: Service
metadata:
name: api
labels:
app: api
component: home-automation
spec:
selector:
app: api
ports:
- port: 80
targetPort: 8001
name: http
type: ClusterIP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: api-ingress
annotations:
cert-manager.io/cluster-issuer: letsencrypt-production-http
traefik.ingress.kubernetes.io/router.middlewares: homea2-mtls-auth@kubernetescrd,homea2-security-headers@kubernetescrd
traefik.ingress.kubernetes.io/router.tls.options: homea2-homea2-mtls@kubernetescrd
# Traefik 2 mTLS Configuration
traefik.ingress.kubernetes.io/router.tls.options: homea2-mtls@kubernetescrd
traefik.ingress.kubernetes.io/router.middlewares: homea2-mtls-auth@kubernetescrd
spec:
tls:
- hosts:
- homea2-api.hottis.de
secretName: homea2-api-cert
rules:
- host: homea2-api.hottis.de
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: api
port:
number: 80

48
deployment/mtls-config.yaml
View File

@@ -1,48 +0,0 @@
apiVersion: traefik.containo.us/v1alpha1
kind: TLSOption
metadata:
name: homea2-mtls
namespace: default
spec:
clientAuth:
secretNames:
- mtls-ca-cert
clientAuthType: RequireAndVerifyClientCert
minVersion: "VersionTLS12"
cipherSuites:
- "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
- "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
- "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
- "TLS_RSA_WITH_AES_256_GCM_SHA384"
- "TLS_RSA_WITH_AES_128_GCM_SHA256"
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: mtls-auth
namespace: default
spec:
headers:
customRequestHeaders:
X-Client-Cert: ""
customResponseHeaders:
X-mTLS-Verified: "true"
# Optional: Add IP whitelist for additional security
# ipWhiteList:
# sourceRange:
# - "10.0.0.0/8"
# - "192.168.0.0/16"
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: security-headers
namespace: default
spec:
headers:
customResponseHeaders:
X-Frame-Options: "SAMEORIGIN"
X-Content-Type-Options: "nosniff"
X-XSS-Protection: "1; mode=block"
Strict-Transport-Security: "max-age=31536000; includeSubDomains; preload"
contentSecurityPolicy: "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'"

25
deployment/ui-deployment.yaml
View File

@@ -77,28 +77,3 @@ spec:
targetPort: 8002
name: http
type: ClusterIP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ui-ingress
annotations:
cert-manager.io/cluster-issuer: letsencrypt-production-http
traefik.ingress.kubernetes.io/router.middlewares: default-mtls-auth@kubernetescrd,default-security-headers@kubernetescrd
traefik.ingress.kubernetes.io/router.tls.options: default-homea2-mtls@kubernetescrd
spec:
tls:
- hosts:
- homea2.hottis.de
secretName: homea2-ui-cert
rules:
- host: homea2.hottis.de
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: ui
port:
number: 80

104
deployment/ui-deployment.yaml.bak
View File

@@ -1,104 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: ui
namespace: homea2
labels:
app: ui
component: home-automation
spec:
replicas: 1
selector:
matchLabels:
app: ui
template:
metadata:
annotations:
reloader.stakater.com/auto: "true"
configmap.reloader.stakater.com/reload: "home-automation-environment"
labels:
app: ui
component: home-automation
spec:
containers:
- name: ui
image: %IMAGE%
ports:
- containerPort: 8002
name: http
env:
- name: UI_PORT
valueFrom:
configMapKeyRef:
name: home-automation-environment
key: UI_UI_PORT
- name: API_BASE
valueFrom:
configMapKeyRef:
name: home-automation-environment
key: UI_API_BASE
- name: BASE_PATH
valueFrom:
configMapKeyRef:
name: home-automation-environment
key: UI_BASE_PATH
livenessProbe:
httpGet:
path: /
port: 8002
initialDelaySeconds: 30
periodSeconds: 10
readinessProbe:
httpGet:
path: /
port: 8002
initialDelaySeconds: 5
periodSeconds: 5
resources:
limits:
cpu: 500m
memory: 512Mi
requests:
cpu: 100m
memory: 128Mi
---
apiVersion: v1
kind: Service
metadata:
name: ui
labels:
app: ui
component: home-automation
spec:
selector:
app: ui
ports:
- port: 80
targetPort: 8002
name: http
type: ClusterIP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ui-ingress
annotations:
cert-manager.io/cluster-issuer: letsencrypt-production-http
traefik.ingress.kubernetes.io/router.middlewares: homea2-mtls-auth@kubernetescrd,homea2-security-headers@kubernetescrd
traefik.ingress.kubernetes.io/router.tls.options: homea2-homea2-mtls@kubernetescrd
spec:
tls:
- hosts:
- homea2.hottis.de
secretName: homea2-ui-cert
rules:
- host: homea2.hottis.de
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: ui
port:
number: 80