vpn

packages/apps/vpn/templates/deployment.yaml

@@ -0,0 +1,83 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-vpn
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}-vpn
+      name: {{ .Release.Name }}-vpn
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}-vpn
+        name: {{ .Release.Name }}-vpn
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+    spec:
+      volumes:
+        - name: cache
+          emptyDir: {}
+        - name: shadowbox-config
+          emptyDir: {}
+        - name: tls
+          secret:
+            secretName: {{ .Release.Name }}-vpn-tls
+            items:
+              - key: tls.crt
+                path: shadowbox.crt
+              - key: tls.key
+                path: shadowbox.key
+            defaultMode: 420
+        - name: shadowbox-server-config
+          secret:
+            secretName: {{ .Release.Name }}-vpn
+            items:
+              - key: shadowbox_config.json
+                path: shadowbox_config.json
+              - key: shadowbox_server_config.json
+                path: shadowbox_server_config.json
+      containers:
+        - name: outline-vpn
+          image: quay.io/outline/shadowbox:stable
+          ports:
+            - containerPort: 40000
+              protocol: TCP
+            #- containerPort: 60000
+            #  protocol: TCP
+          env:
+            - name: SB_API_PORT
+              value: "60000"
+            #- name: SB_API_PREFIX
+            #  value: b782eecb-bb9e-58be-614a-d5de1431d6b3
+            - name: SB_CERTIFICATE_FILE
+              value: /tmp/shadowbox.crt
+            - name: SB_PRIVATE_KEY_FILE
+              value: /tmp/shadowbox.key
+          volumeMounts:
+            - name: cache
+              mountPath: /cache
+            - name: shadowbox-config
+              mountPath: /opt/outline
+            - name: shadowbox-config
+              mountPath: /root/shadowbox
+            - name: shadowbox-server-config
+              readOnly: true
+              mountPath: /root/shadowbox/persisted-state/shadowbox_server_config.json
+              subPath: shadowbox_server_config.json
+            - name: shadowbox-server-config
+              readOnly: true
+              mountPath: /root/shadowbox/persisted-state/shadowbox_config.json
+              subPath: shadowbox_config.json
+            - name: tls
+              readOnly: true
+              mountPath: /tmp/shadowbox.crt
+              subPath: shadowbox.crt
+            - name: tls
+              readOnly: true
+              mountPath: /tmp/shadowbox.key
+              subPath: shadowbox.key
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 30

packages/apps/vpn/templates/secret.yaml

@@ -0,0 +1,55 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-vpn
+type: Opaque
+stringData:
+  shadowbox_server_config.json: |
+    {
+      "rollouts": [
+        {
+          "id": "single-port",
+          "enabled": true
+        }
+      ],
+      "portForNewAccessKeys": 40000,
+      "hostname": "localhost"
+    }
+  shadowbox_config.json: |
+    {
+      "accessKeys": [
+        {
+          "id": "1",
+          "metricsId": "f33f7fbf-6750-485c-9ac0-2ec261b5aa03",
+          "name": "",
+          "password": "UhrU93bi2eBORvo4dwxsEw",
+          "port": 40000,
+          "encryptionMethod": "chacha20-ietf-poly1305"
+        },
+        {
+          "id": "2",
+          "metricsId": "aa72b1f0-f48c-49e2-b153-2fb8817e4b54",
+          "name": "sssss",
+          "password": "7IhWAD1GzaNjLCMyG0LVhK",
+          "port": 40000,
+          "encryptionMethod": "chacha20-ietf-poly1305"
+        },
+        {
+          "id": "3",
+          "metricsId": "aa72b1f0-f48c-49e2-b153-2fb8817e4b54",
+          "name": "foobar",
+          "password": "aaaaaaaaaaaaaaaaaaaaaa",
+          "port": 40000,
+          "encryptionMethod": "chacha20-ietf-poly1305"
+        },
+        {
+          "id": "4",
+          "metricsId": "703c05a9-e4cd-4af2-a7ec-41906525c512",
+          "name": "kvaps",
+          "password": "asdasdASD",
+          "port": 40000,
+          "encryptionMethod": "chacha20-ietf-poly1305"
+        }
+      ],
+      "nextId": 5
+    }

packages/apps/vpn/templates/service.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-vpn
+  labels:
+    app: {{ .Release.Name }}-vpn
+spec:
+  ports:
+    #- name: apiport-tcp
+    #  protocol: TCP
+    #  port: 60000
+    #  targetPort: 60000
+    - name: accessport-tcp
+      protocol: TCP
+      port: 40000
+      targetPort: 40000
+    - name: accessport-udp
+      protocol: UDP
+      port: 40000
+      targetPort: 40000
+  selector:
+    app: {{ .Release.Name }}-vpn
+  type: LoadBalancer
+  internalTrafficPolicy: Cluster

packages/apps/vpn/templates/tls.yaml

@@ -0,0 +1,21 @@
+{{- $cn := "outline" -}}
+{{- $ca := genCA "outline-ca" 3650 -}}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-vpn-tls
+type: kubernetes.io/tls
+data:
+{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace (printf "%s-vpn-tls" .Release.Name) }}
+  {{- if $existingSecret }}
+  ca.crt: {{ index $existingSecret.data "ca.crt" }}
+  tls.crt: {{ index $existingSecret.data "tls.crt" }}
+  tls.key: {{ index $existingSecret.data "tls.key" }}
+  {{- else }}
+  {{- with genSignedCert $cn nil nil 3650 $ca }}
+  cacert: {{ b64enc $ca.Cert }}
+  tls.crt: {{ b64enc .Cert }}
+  tls.key: {{ b64enc .Key }}
+  {{- end }}
+  {{- end }}

packages/apps/vpn/values.yaml

@@ -1,12 +1,7 @@
-# Default values for vpn.
-# This is a YAML-formatted file.
-# Declare variables to be passed into your templates.
-
-replicaCount: 1
+external: false
 
 users:
-- name: user1
-- name: user2
-  limit: 5Gi
-- name: user3
-  limit: 5Gi
+  user1:
+    password: hackme
+  user2:
+    password: tttt