forked from ungleich-public/ungleich-user
Sajeyks
4eeb25a3ea
A kustomize base with a Deployment (2 replicas, migrate_locked init container, liveness, readiness and startup probes, uid 10001 with a read-only root filesystem, all capabilities dropped, RuntimeDefault seccomp, no service account token, resource requests and limits), plus a Service, an Ingress for account.ungleich.ch, a PodDisruptionBudget and a ConfigMap with every non-secret setting. The Secret is not part of the base, so credentials stay out of git; secret.example.yaml and the README show how to create it. The README also lists what the cluster must provide and what to confirm before going live (StartTLS on the LDAP servers, HSTS).
22 lines
702 B
YAML
22 lines
702 B
YAML
# Example only; do not commit real values. Create the Secret with your
|
|
# secret manager, or fill this in outside git and apply it:
|
|
#
|
|
# kubectl create secret generic ungleich-user \
|
|
# --from-literal=SECRET_KEY="$(python3 -c 'import secrets; print(secrets.token_urlsafe(50))')" \
|
|
# --from-literal=LDAP_ADMIN_DN='...' \
|
|
# --from-literal=LDAP_ADMIN_PASSWORD='...' \
|
|
# --from-literal=DATABASE_PASSWORD='...' \
|
|
# --from-literal=ADMIN_SEED='...'
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ungleich-user
|
|
type: Opaque
|
|
stringData:
|
|
SECRET_KEY: ""
|
|
LDAP_ADMIN_DN: ""
|
|
LDAP_ADMIN_PASSWORD: ""
|
|
DATABASE_PASSWORD: ""
|
|
ADMIN_SEED: ""
|
|
# EMAIL_HOST_USER: ""
|
|
# EMAIL_HOST_PASSWORD: ""
|