fkf9/ungleich-k8s
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

++working letsencrypt / staging setup!!!

Browse source
This commit is contained in:
Nico Schottelius 2021-06-18 22:17:57 +02:00
parent cda1990935
commit 2c303122fb
2 changed files with 120 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

123
apps/nginx-certbot/base/deployment.yaml
View file

@ -1,16 +1,43 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: tls1-letsencrypt-certs
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 50Mi
storageClassName: rook-cephfs
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: tls1-webroot
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 100Mi
storageClassName: rook-cephfs
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: tls1
name: tls1-http
spec:
selector:
matchLabels:
app: tls1
app: tls1-nginx
ssl: no
replicas: 1
template:
metadata:
labels:
app: tls1
app: tls1-nginx
ssl: no
spec:
containers:
- name: nginx-80
@ -20,6 +47,39 @@ spec:
volumeMounts:
- name: nginx-config-80
mountPath: "/etc/nginx/conf.d/"
- name: etcletsencrypt
mountPath: "/etc/letsencrypt"
- name: webroot
mountPath: "/usr/share/nginx/html"
volumes:
- name: nginx-config-80
configMap:
name: nginx-80-config
- name: etcletsencrypt
persistentVolumeClaim:
claimName: tls1-letsencrypt-certs
- name: webroot
persistentVolumeClaim:
claimName: tls1-webroot
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: tls1-https
spec:
selector:
matchLabels:
app: tls1-nginx
ssl: yes
replicas: 1
template:
metadata:
labels:
app: tls1-nginx
ssl: yes
spec:
containers:
- name: nginx-443
image: nginx:1.20.0-alpine
ports:
@ -27,13 +87,21 @@ spec:
volumeMounts:
- name: nginx-config-443
mountPath: "/etc/nginx/conf.d/"
- name: etcletsencrypt
mountPath: "/etc/letsencrypt"
- name: webroot
mountPath: "/usr/share/nginx/html"
volumes:
- name: nginx-config-80
configMap:
name: nginx-80-config
- name: nginx-config-443
configMap:
name: nginx-443-config
- name: etcletsencrypt
persistentVolumeClaim:
claimName: tls1-letsencrypt-certs
- name: webroot
persistentVolumeClaim:
claimName: tls1-webroot
---
apiVersion: v1
kind: Service
@ -45,6 +113,49 @@ spec:
type: ClusterIP
ports:
- port: 80
name: http
- port: 443
name: https
selector:
app: tls1-nginx
---
apiVersion: batch/v1
kind: Job
metadata:
name: tls1-getcert
spec:
template:
spec:
restartPolicy: Never
containers:
- name: certbot
image: ungleich/ungleich-certbot
command:
- certbot
- certonly
- --agree-tos
- --cert-name
- 'tls1.default.svc.c2.k8s.ooo'
- --email
- sre@ungleich.ch
- --expand
- --non-interactive
- --webroot
- --webroot-path
- /usr/share/nginx/html
- --domain
- 'tls1.default.svc.c2.k8s.ooo'
- --staging
volumeMounts:
- name: etcletsencrypt
mountPath: "/etc/letsencrypt"
- name: webroot
mountPath: "/usr/share/nginx/html"
volumes:
- name: etcletsencrypt
persistentVolumeClaim:
claimName: tls1-letsencrypt-certs
- name: webroot
persistentVolumeClaim:
claimName: tls1-webroot
backoffLimit: 3

6
apps/nginx-certbot/base/nginx-443
View file

@ -2,10 +2,10 @@ server {
listen 443 ssl;
listen [::]:443 ssl;
server_name tls1.svc.c2.k8s.ooo;
server_name tls1.default.svc.c2.k8s.ooo;
ssl_certificate /etc/letsencrypt/live/tls1.svc.c2.k8s.ooo/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/tls1.svc.c2.k8s.ooo/privkey.pem;
ssl_certificate /etc/letsencrypt/live/tls1.default.svc.c2.k8s.ooo/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/tls1.default.svc.c2.k8s.ooo/privkey.pem;
client_max_body_size 256m;