feat: deploy towonel instead of cloudflare-tunnel

bootstrap/secrets.yaml.tpl

@@ -21,11 +21,3 @@ metadata:
 stringData:
   1password-credentials.json: op://Kubernetes/1password/OP_CREDENTIALS_JSON
   token: op://Kubernetes/1password/OP_CONNECT_TOKEN
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cloudflare-tunnel-id-secret
-  namespace: networking
-stringData:
-  CLOUDFLARE_TUNNEL_ID: op://Kubernetes/cloudflare/CLOUDFLARE_TUNNEL_ID

kubernetes/apps/networking/envoy-gateway/app/policy/clienttrafficpolicy.yaml

@@ -12,6 +12,8 @@ spec:
     - group: gateway.networking.k8s.io
       kind: Gateway
       name: external
+  proxyProtocol:
+    optional: true
   clientIPDetection:
     xForwardedFor:
       numTrustedHops: 1

kubernetes/apps/networking/kustomization.yaml

@@ -9,8 +9,8 @@ replacements:
   - path: ../../components/replacements/ks.yaml
 resources:
   - ./cloudflare-dns/ks.yaml
-  - ./cloudflare-tunnel/ks.yaml
   - ./echo/ks.yaml
   - ./envoy-gateway/ks.yaml
   - ./multus/ks.yaml
+  - ./towonel-agent/ks.yaml
   - ./unifi-dns/ks.yaml

kubernetes/apps/networking/cloudflare-tunnel/app/dnsendpoint.yaml → kubernetes/apps/networking/towonel-agent/app/dnsendpoint.yaml

@@ -3,11 +3,13 @@
 apiVersion: externaldns.k8s.io/v1alpha1
 kind: DNSEndpoint
 metadata:
-  name: cloudflared
+  name: towonel-agent
   labels:
     thisisstupid.ok8.sh: external
+  annotations:
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
 spec:
   endpoints:
     - dnsName: external.ok8.sh
       recordType: CNAME
-      targets: ["${CLOUDFLARE_TUNNEL_MAIN_ID}.cfargotunnel.com"]
+      targets: ["edge-na.towonel.dev"]

kubernetes/apps/networking/towonel-agent/app/externalsecret.yaml

@@ -0,0 +1,18 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.ok8.sh/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: towonel-agent-secret
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword
+  target:
+    name: towonel-agent-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: TOWONEL_INVITE_TOKEN
+      remoteRef:
+        key: towonel-tunnel
+        property: invite_token

kubernetes/apps/networking/towonel-agent/app/helmrelease.yaml

@@ -0,0 +1,37 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.ok8.sh/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: towonel-agent
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: towonel-agent
+  interval: 1h
+  values:
+    replicaCount: 2
+    deploymentAnnotations:
+      reloader.stakater.com/auto: "true"
+    agent:
+      logLevel: info
+      healthPort: 9090
+      services:
+        - hostname: "*.ok8.sh"
+          origin: envoy-external.networking.svc.cluster.local:443
+      inviteTokenSecret:
+        name: towonel-agent-secret
+        key: TOWONEL_INVITE_TOKEN
+    monitoring:
+      serviceMonitor:
+        enabled: true
+        interval: 1m
+      prometheusRule:
+        enabled: true
+      dashboards:
+        enabled: true
+        grafanaOperator:
+          enabled: true
+          allowCrossNamespaceImport: true
+          matchLabels:
+            grafana.internal/instance: grafana

kubernetes/apps/networking/cloudflare-tunnel/app/kustomization.yaml → kubernetes/apps/networking/towonel-agent/app/kustomization.yaml

@@ -3,8 +3,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./externalsecret.yaml
   - ./dnsendpoint.yaml
+  - ./externalsecret.yaml
   - ./helmrelease.yaml
-  - ./grafanadashboard.yaml
-  - ./ocirepository.yaml
+  - ./ocirepository.yaml

kubernetes/apps/networking/cloudflare-tunnel/app/ocirepository.yaml → kubernetes/apps/networking/towonel-agent/app/ocirepository.yaml

@@ -3,12 +3,12 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: OCIRepository
 metadata:
-  name: cloudflare-tunnel
+  name: towonel-agent
 spec:
   interval: 15m
   layerSelector:
     mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
     operation: copy
   ref:
-    tag: 5.0.1
-  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+    tag: 0.1.27
+  url: oci://codeberg.org/towonel/charts/towonel-agent

kubernetes/apps/networking/cloudflare-tunnel/ks.yaml → kubernetes/apps/networking/towonel-agent/ks.yaml

@@ -3,7 +3,7 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: &app cloudflare-tunnel
+  name: &app towonel-agent
   namespace: &namespace networking
   labels:
     substitution.flux.home.arpa/enabled: "true"
@@ -15,11 +15,7 @@ spec:
   dependsOn:
     - name: onepassword
       namespace: external-secrets
-  postBuild:
-    substituteFrom:
-      - kind: Secret
-        name: cloudflare-tunnel-id-secret
-  path: ./kubernetes/apps/networking/cloudflare-tunnel/app
+  path: ./kubernetes/apps/networking/towonel-agent/app
   prune: false
   wait: true
   interval: 30m