diff --git a/apps/templates/authentik-helm.yaml b/apps/templates/authentik-helm.yaml index 11424a8..bbac4a9 100644 --- a/apps/templates/authentik-helm.yaml +++ b/apps/templates/authentik-helm.yaml @@ -66,15 +66,32 @@ spec: secretKeyRef: name: vault-oidc-client-secret key: client_secret + - name: STALWART_OIDC_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: stalwart-oidc-client-secret + key: client_secret server: volumes: - - name: custom-blueprints + - name: blueprint-vault configMap: name: authentik-blueprint-vault + - name: blueprint-mail + configMap: + name: authentik-blueprint-mail + - name: blueprint-ldap + configMap: + name: authentik-blueprint-ldap volumeMounts: - - name: custom-blueprints + - name: blueprint-vault mountPath: /blueprints/custom/vault-oidc.yaml subPath: vault-oidc.yaml + - name: blueprint-mail + mountPath: /blueprints/custom/mail-oidc.yaml + subPath: mail-oidc.yaml + - name: blueprint-ldap + mountPath: /blueprints/custom/ldap.yaml + subPath: ldap.yaml ingress: enabled: true ingressClassName: nginx @@ -88,13 +105,25 @@ spec: - authentik.rubenhensen.nl worker: volumes: - - name: custom-blueprints + - name: blueprint-vault configMap: name: authentik-blueprint-vault + - name: blueprint-mail + configMap: + name: authentik-blueprint-mail + - name: blueprint-ldap + configMap: + name: authentik-blueprint-ldap volumeMounts: - - name: custom-blueprints + - name: blueprint-vault mountPath: /blueprints/custom/vault-oidc.yaml subPath: vault-oidc.yaml + - name: blueprint-mail + mountPath: /blueprints/custom/mail-oidc.yaml + subPath: mail-oidc.yaml + - name: blueprint-ldap + mountPath: /blueprints/custom/ldap.yaml + subPath: ldap.yaml postgresql: enabled: false redis: diff --git a/apps/templates/sogo-mail-helm.yaml b/apps/templates/sogo-mail-helm.yaml new file mode 100644 index 0000000..3883bce --- /dev/null +++ b/apps/templates/sogo-mail-helm.yaml @@ -0,0 +1,56 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: sogo-mail + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + syncPolicy: + syncOptions: + - CreateNamespace=true + automated: + prune: true + selfHeal: true + project: default + sources: + - chart: sogo + repoURL: https://helm.snry.xyz/docker-sogo/ + targetRevision: 0.3.5 + helm: + values: | + sogo: + host: mail.rubenhensen.nl + existingSecrets: + - sogo-mail-secrets + ingress: + enabled: true + className: nginx + annotations: + kubernetes.io/tls-acme: "true" + cert-manager.io/cluster-issuer: prod-cluster-issuer + nginx.ingress.kubernetes.io/server-snippet: |- + proxy_http_version 1.1; + proxy_hide_header X-Powered-By; + + location = / { + rewrite ^(.*)$ /SOGo; + allow all; + } + + tls: + - secretName: sogo-mail-tls + hosts: + - mail.rubenhensen.nl + path: / + pathType: Prefix + memcached: + enabled: true + - repoURL: https://github.com/rubenhensen/k8scd.git + targetRevision: HEAD + path: sogo-mail + directory: + include: "*.yaml" + destination: + server: https://kubernetes.default.svc + namespace: sogo-mail diff --git a/authentik/blueprint-ldap.yaml b/authentik/blueprint-ldap.yaml new file mode 100644 index 0000000..c2ecf25 --- /dev/null +++ b/authentik/blueprint-ldap.yaml @@ -0,0 +1,40 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: authentik-blueprint-ldap +data: + ldap.yaml: | + version: 1 + metadata: + name: LDAP Outpost + entries: + - model: authentik_providers_ldap.ldapprovider + id: ldap-provider + state: present + identifiers: + name: LDAP + attrs: + name: LDAP + authorization_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]] + base_dn: "DC=ldap,DC=goauthentik,DC=io" + bind_mode: direct + search_mode: direct + - model: authentik_core.application + id: ldap-app + state: present + identifiers: + slug: ldap + attrs: + name: LDAP + provider: !KeyOf ldap-provider + - model: authentik_outposts.outpost + id: ldap-outpost + state: present + identifiers: + name: LDAP Outpost + attrs: + name: LDAP Outpost + type: ldap + providers: + - !KeyOf ldap-provider + service_connection: !Find [authentik_outposts.kubernetesserviceconnection, [local, true]] diff --git a/authentik/blueprint-mail-oidc.yaml b/authentik/blueprint-mail-oidc.yaml new file mode 100644 index 0000000..b353b6c --- /dev/null +++ b/authentik/blueprint-mail-oidc.yaml @@ -0,0 +1,40 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: authentik-blueprint-mail +data: + mail-oidc.yaml: | + version: 1 + metadata: + name: Mail OIDC + entries: + - model: authentik_providers_oauth2.oauth2provider + id: stalwart-provider + state: present + identifiers: + name: Stalwart + attrs: + name: Stalwart + authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]] + authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]] + invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]] + client_type: confidential + client_id: stalwart + client_secret: !Env [STALWART_OIDC_CLIENT_SECRET, ""] + redirect_uris: + - matching_mode: strict + url: https://stalwart.rubenhensen.nl/login/callback + signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]] + property_mappings: + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]] + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]] + - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]] + - model: authentik_core.application + id: stalwart-app + state: present + identifiers: + slug: stalwart + attrs: + name: Stalwart Mail + provider: !KeyOf stalwart-provider + meta_launch_url: https://stalwart.rubenhensen.nl diff --git a/authentik/external-secret.yaml b/authentik/external-secret.yaml index db6985e..b65939f 100644 --- a/authentik/external-secret.yaml +++ b/authentik/external-secret.yaml @@ -63,3 +63,21 @@ spec: remoteRef: key: kv/vault-oidc property: client_secret +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: stalwart-oidc-client-secret +spec: + secretStoreRef: + name: vault-backend + kind: ClusterSecretStore + refreshInterval: 15m + target: + name: stalwart-oidc-client-secret + creationPolicy: Owner + data: + - secretKey: client_secret + remoteRef: + key: kv/stalwart-oidc + property: client_secret diff --git a/sogo-mail/external-secret.yaml b/sogo-mail/external-secret.yaml new file mode 100644 index 0000000..e42b2be --- /dev/null +++ b/sogo-mail/external-secret.yaml @@ -0,0 +1,21 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: sogo-mail-postgres-credentials +spec: + secretStoreRef: + name: vault-backend + kind: ClusterSecretStore + refreshInterval: 15m + target: + name: sogo-mail-postgres-credentials + creationPolicy: Owner + data: + - secretKey: username + remoteRef: + key: kv/sogo-mail + property: postgres_user + - secretKey: password + remoteRef: + key: kv/sogo-mail + property: postgres_pw diff --git a/sogo-mail/postgresql-cluster.yaml b/sogo-mail/postgresql-cluster.yaml new file mode 100644 index 0000000..243aada --- /dev/null +++ b/sogo-mail/postgresql-cluster.yaml @@ -0,0 +1,16 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: sogo-mail-postgres +spec: + instances: 1 + primaryUpdateStrategy: unsupervised + bootstrap: + initdb: + database: sogo + owner: sogo + secret: + name: sogo-mail-postgres-credentials + storage: + storageClass: longhorn + size: 20Gi diff --git a/sogo-mail/sogo-config-secret.yaml b/sogo-mail/sogo-config-secret.yaml new file mode 100644 index 0000000..a9e663a --- /dev/null +++ b/sogo-mail/sogo-config-secret.yaml @@ -0,0 +1,46 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: sogo-mail-secrets +spec: + secretStoreRef: + name: vault-backend + kind: ClusterSecretStore + refreshInterval: 15m + target: + name: sogo-mail-secrets + creationPolicy: Owner + template: + engineVersion: v2 + data: + SOGoProfileURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_user_profile" + OCSFolderInfoURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_folder_info" + OCSSessionsFolderURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_sessions_folder" + OCSCacheFolderURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_cache_folder" + OCSStoreURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_store" + OCSAclURL: "postgresql://{{ .postgres_user }}:{{ .postgres_pw }}@sogo-mail-postgres-rw:5432/sogo/sogo_acl" + SOGoUserSources__yaml: | + - type: ldap + id: authentik + CNFieldName: cn + IDFieldName: cn + UIDFieldName: cn + bindDN: "cn={{ .ldap_bind_user }},ou=users,DC=ldap,DC=goauthentik,DC=io" + bindPassword: "{{ .ldap_bind_password }}" + hostname: "ldap://ak-outpost-ldap-outpost.authentik.svc.cluster.local:3389" + baseDN: "ou=users,DC=ldap,DC=goauthentik,DC=io" + canAuthenticate: YES + isAddressBook: YES + bindAsCurrentUser: YES + LoginFieldNames: ("mail") + MailFieldNames: ("mail") + displayName: "Shared Addresses" + filter: "(objectClass=user)" + SOGoIMAPServer: "imaps://mail.rubenhensen.nl:993/?tls=YES&tlsVerifyMode=none" + SOGoSMTPServer: "smtp://mail.rubenhensen.nl:587/?tls=YES&tlsVerifyMode=none" + SOGoSMTPAuthenticationType: "PLAIN" + SOGoMailDomain: "rubenhensen.nl" + SOGoForceExternalLoginWithEmail: "YES" + dataFrom: + - extract: + key: kv/sogo-mail