feat: add more

clusters/cl01tl/helm/tubearchivist/templates/_helpers.tpl

@@ -12,3 +12,13 @@ Selector labels
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/part-of: {{ .Release.Name }}
 {{- end }}
+
+{{/*
+NFS names
+*/}}
+{{- define "custom.storageNfsName" -}}
+tubearchivist-nfs-storage
+{{- end -}}
+{{- define "custom.storageSnapshotNfsName" -}}
+tubearchivist-snapshot-nfs-storage
+{{- end -}}

clusters/cl01tl/helm/tubearchivist/templates/elasticsearch.yaml

@@ -11,7 +11,7 @@ spec:
   version: 9.3.3
   auth:
     fileRealm:
-      - secretName: tubearchivist-elasticsearch-secret
+      - secretName: tubearchivist-elasticsearch-config
   nodeSets:
     - name: default
       count: 2
@@ -21,14 +21,14 @@ spec:
       podTemplate:
         spec:
           volumes:
-            - name: tubearchivist-snapshot-nfs-storage
+            - name: {{ include "custom.storageSnapshotNfsName" . }}
               nfs:
                 path: /volume2/Storage/TubeArchivist
                 server: synologybond.alexlebens.net
           containers:
             - name: elasticsearch
               volumeMounts:
-                - name: tubearchivist-snapshot-nfs-storage
+                - name: {{ include "custom.storageSnapshotNfsName" . }}
                   mountPath: /usr/share/elasticsearch/data/snapshot
       volumeClaimTemplates:
         - metadata:

clusters/cl01tl/helm/tubearchivist/templates/external-secret.yaml

@@ -1,38 +1,38 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: tubearchivist-config-secret
+  name: tubearchivist-config
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: tubearchivist-config-secret
+    app.kubernetes.io/name: tubearchivist-config
     {{- include "custom.labels" . | nindent 4 }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: ELASTIC_PASSWORD
       remoteRef:
-        key: /cl01tl/tubearchivist/env
-        property: ELASTIC_PASSWORD
+        key: /cl01tl/tubearchivist/elasticsearch
+        property: password
     - secretKey: TA_PASSWORD
       remoteRef:
-        key: /cl01tl/tubearchivist/env
-        property: TA_PASSWORD
+        key: /cl01tl/tubearchivist/config
+        property: password
 
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: tubearchivist-elasticsearch-secret
+  name: tubearchivist-elasticsearch-config
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: tubearchivist-elasticsearch-secret
+    app.kubernetes.io/name: tubearchivist-elasticsearch-config
     {{- include "custom.labels" . | nindent 4 }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: username
       remoteRef:
@@ -51,29 +51,29 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: tubearchivist-wireguard-conf
+  name: protonvpn-wireguard-conf
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: tubearchivist-wireguard-conf
+    app.kubernetes.io/name: protonvpn-wireguard-conf
     {{- include "custom.labels" . | nindent 4 }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
+    - secretKey: conf
+      remoteRef:
+        key: /protonvpn/config
+        property: conf
+    - secretKey: email
+      remoteRef:
+        key: /protonvpn/config
+        property: email
+    - secretKey: password
+      remoteRef:
+        key: /protonvpn/config
+        property: password
     - secretKey: private-key
       remoteRef:
-        key: /airvpn/conf/cl01tl
+        key: /protonvpn/config
         property: private-key
-    - secretKey: preshared-key
-      remoteRef:
-        key: /airvpn/conf/cl01tl
-        property: preshared-key
-    - secretKey: addresses
-      remoteRef:
-        key: /airvpn/conf/cl01tl
-        property: addresses
-    - secretKey: input-ports
-      remoteRef:
-        key: /airvpn/conf/cl01tl
-        property: input-ports

clusters/cl01tl/helm/tubearchivist/templates/namespace.yaml

@@ -1,9 +1,9 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: tubearchivist
+  name: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: tubearchivist
+    app.kubernetes.io/name: {{ .Release.Namespace }}
     {{- include "custom.labels" . | nindent 4 }}
     pod-security.kubernetes.io/audit: privileged
     pod-security.kubernetes.io/enforce: privileged

clusters/cl01tl/helm/tubearchivist/templates/persistent-volume-claim.yaml

@@ -1,13 +1,13 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: tubearchivist-nfs-storage
+  name: {{ include "custom.storageNfsName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: tubearchivist-nfs-storage
+    app.kubernetes.io/name: {{ include "custom.storageNfsName" . }}
     {{- include "custom.labels" . | nindent 4 }}
 spec:
-  volumeName: tubearchivist-nfs-storage
+  volumeName: {{ include "custom.storageNfsName" . }}
   storageClassName: nfs-client
   accessModes:
     - ReadWriteMany

clusters/cl01tl/helm/tubearchivist/templates/persistent-volume.yaml

@@ -1,10 +1,10 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: tubearchivist-nfs-storage
+  name: {{ include "custom.storageNfsName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: tubearchivist-nfs-storage
+    app.kubernetes.io/name: {{ include "custom.storageNfsName" . }}
     {{- include "custom.labels" . | nindent 4 }}
 spec:
   persistentVolumeReclaimPolicy: Retain

clusters/cl01tl/helm/tubearchivist/values.yaml

@@ -34,7 +34,7 @@ tubearchivist:
               value: admin
           envFrom:
             - secretRef:
-                name: tubearchivist-config-secret
+                name: tubearchivist-config
           resources:
             requests:
               cpu: 10m
@@ -53,26 +53,16 @@ tubearchivist:
                 command: ["/bin/sh", "-c", "(ip rule del table 51820; ip -6 rule del table 51820) || true"]
           env:
             - name: VPN_SERVICE_PROVIDER
-              value: airvpn
+              value: protonvpn
             - name: VPN_TYPE
               value: wireguard
             - name: WIREGUARD_PRIVATE_KEY
               valueFrom:
                 secretKeyRef:
-                  name: tubearchivist-wireguard-conf
+                  name: protonvpn-wireguard-conf
                   key: private-key
-            - name: WIREGUARD_PRESHARED_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: tubearchivist-wireguard-conf
-                  key: preshared-key
-            - name: WIREGUARD_ADDRESSES
-              valueFrom:
-                secretKeyRef:
-                  name: tubearchivist-wireguard-conf
-                  key: addresses
             - name: FIREWALL_OUTBOUND_SUBNETS
-              value: 10.0.0.0/8
+              value: 192.168.1.0/24,10.244.0.0/16
             - name: FIREWALL_INPUT_PORTS
               value: 80,8000,24000
             - name: DNS_UPSTREAM_RESOLVER_TYPE