feat: Netbird | set up netbird vpn

Also improve pki

core-services/cert-manager/index.ts

@@ -6,7 +6,6 @@ import { Construct } from "constructs";
 
 type CertManagerOptions = {
   provider: HelmProvider;
-  version: string;
   name: string;
   namespace: string;
 };
@@ -15,13 +14,12 @@ export class CertManager extends Construct {
   constructor(scope: Construct, id: string, options: CertManagerOptions) {
     super(scope, id);
 
-    const { namespace, name, version, provider } = options;
+    const { namespace, name, provider } = options;
 
     new Release(this, id, {
       provider,
       name,
       namespace,
-      version,
       repository: "https://charts.jetstack.io",
       chart: "cert-manager",
       createNamespace: true,

core-services/cert-manager/values.yaml

@@ -1,6 +1,8 @@
 crds:
   enabled: true
+  keep: true
 prometheus:
   enabled: true
 webhook:
   timeoutSeconds: 4
+enableCertificateOwnerRef: true

core-services/index.ts

@@ -59,7 +59,6 @@ export class CoreServices extends TerraformStack {
       provider: helm,
       name: "cert-manager",
       namespace,
-      version: "1.18.2",
     });
   }
 }

core-services/traefik/values.yaml

@@ -3,7 +3,7 @@ providers:
     allowCrossNamespace: true
 ingress:
   ingressClass:
-    enabled: true
+    enabled: false
     isDefaultClass: true
     name: traefik
 deployment:

gaming-services/minecraft/tfg.ts

@@ -46,7 +46,7 @@ export class TerraFirmaGreg extends Construct {
         },
         {
           name: "CF_FILENAME_MATCHER",
-          value: "0.10.17",
+          value: "0.11.8",
         },
         {
           name: "VERSION",

main.ts

@@ -9,6 +9,7 @@ import { NetworkSecurity } from "./network-security";
 import { GamingServices } from "./gaming-services/minecraft";
 import { MediaServices } from "./media-services";
 import { PKI } from "./pki";
+import { Netbird } from "./netbird";
 
 dotenv.config();
 
@@ -46,6 +47,9 @@ mediaServices.node.addDependency(networkSecurity);
 const caches = new CacheInfrastructure(app, "cache-infrastructure");
 caches.node.addDependency(utilityServices);
 
+const netbird = new Netbird(app, "netbird");
+netbird.node.addDependency(utilityServices);
+
 const deploy: (stack: TerraformStack, key: string) => S3Backend = (
   stack,
   key,
@@ -75,5 +79,6 @@ deploy(utilityServices, "utility-services");
 deploy(caches, "cache-infrastructure");
 deploy(gamingServices, "gaming-services");
 deploy(mediaServices, "media-services");
+deploy(netbird, "netbird");
 
 app.synth();

media-services/index.ts

@@ -76,6 +76,7 @@ export class MediaServices extends TerraformStack {
     new ProwlarrServer(this, "prowlarr", {
       provider,
       namespace,
+      host: "prowlarr.dogar.dev",
     });
   }
 }

media-services/jellyfin/index.ts

@@ -2,7 +2,11 @@ import { Construct } from "constructs";
 import { DeploymentV1 } from "@cdktf/provider-kubernetes/lib/deployment-v1";
 import { ServiceV1 } from "@cdktf/provider-kubernetes/lib/service-v1";
 
-import { InternalIngressRoute, LonghornPvc } from "../../utils";
+import {
+  CloudflareCertificate,
+  InternalIngressRoute,
+  LonghornPvc,
+} from "../../utils";
 import { BaseMediaServiceOptions, getAamil3NodeSelector } from "../types";
 
 type JellyfinServerOptions = BaseMediaServiceOptions & {
@@ -137,6 +141,14 @@ export class JellyfinServer extends Construct {
       },
     });
 
+    new CloudflareCertificate(this, "certificate", {
+      provider,
+      namespace,
+      name,
+      secretName: "jellyfin-tls",
+      dnsNames: [host],
+    });
+
     // Ingress - using internal ingress for secure access
     new InternalIngressRoute(this, "ingress", {
       provider,
@@ -145,6 +157,7 @@ export class JellyfinServer extends Construct {
       host,
       serviceName: name,
       servicePort: 80,
+      tlsSecretName: "jellyfin-tls",
     });
   }
 }

media-services/prowlarr/index.ts

@@ -2,18 +2,27 @@ import { Construct } from "constructs";
 import { DeploymentV1 } from "@cdktf/provider-kubernetes/lib/deployment-v1";
 import { ServiceV1 } from "@cdktf/provider-kubernetes/lib/service-v1";
 
-import { LonghornPvc } from "../../utils";
+import {
+  InternalIngressRoute,
+  LonghornPvc,
+  PrivateCertificate,
+} from "../../utils";
 import {
   BaseMediaServiceOptions,
   getWorkerNodeSelector,
   getCommonEnv,
 } from "../types";
 
+type ProwlarrOptions = BaseMediaServiceOptions & {
+  /** Hostname for the ingress */
+  host: string;
+};
+
 export class ProwlarrServer extends Construct {
-  constructor(scope: Construct, id: string, options: BaseMediaServiceOptions) {
+  constructor(scope: Construct, id: string, options: ProwlarrOptions) {
     super(scope, id);
 
-    const { provider, namespace } = options;
+    const { provider, namespace, host } = options;
     const name = "prowlarr";
 
     // Config PVC with backup
@@ -102,6 +111,24 @@ export class ProwlarrServer extends Construct {
       },
     });
 
-    // Note: No ingress - Prowlarr is for internal use only
+    new PrivateCertificate(this, "certificate", {
+      provider,
+      namespace,
+      name,
+      commonName: host,
+      dnsNames: [host],
+      secretName: `${name}-tls`,
+    });
+
+    // Ingress
+    new InternalIngressRoute(this, "ingress", {
+      provider,
+      namespace,
+      name,
+      host,
+      serviceName: name,
+      servicePort: 80,
+      tlsSecretName: `${name}-tls`,
+    });
   }
 }

media-services/qbittorrent/index.ts

@@ -2,7 +2,11 @@ import { Construct } from "constructs";
 import { DeploymentV1 } from "@cdktf/provider-kubernetes/lib/deployment-v1";
 import { ServiceV1 } from "@cdktf/provider-kubernetes/lib/service-v1";
 
-import { InternalIngressRoute, LonghornPvc } from "../../utils";
+import {
+  InternalIngressRoute,
+  LonghornPvc,
+  PrivateCertificate,
+} from "../../utils";
 import {
   BaseMediaServiceOptions,
   getAamil3NodeSelector,
@@ -17,11 +21,7 @@ type QBittorrentServerOptions = BaseMediaServiceOptions & {
 };
 
 export class QBittorrentServer extends Construct {
-  constructor(
-    scope: Construct,
-    id: string,
-    options: QBittorrentServerOptions,
-  ) {
+  constructor(scope: Construct, id: string, options: QBittorrentServerOptions) {
     super(scope, id);
 
     const { provider, namespace, downloadsPvcName, host } = options;
@@ -137,6 +137,15 @@ export class QBittorrentServer extends Construct {
       },
     });
 
+    new PrivateCertificate(this, "certificate", {
+      provider,
+      namespace,
+      name,
+      commonName: host,
+      dnsNames: [host],
+      secretName: `${name}-tls`,
+    });
+
     // Ingress
     new InternalIngressRoute(this, "ingress", {
       provider,
@@ -145,6 +154,7 @@ export class QBittorrentServer extends Construct {
       host,
       serviceName: name,
       servicePort: 80,
+      tlsSecretName: `${name}-tls`,
     });
   }
 }

media-services/radarr/index.ts

@@ -2,7 +2,11 @@ import { Construct } from "constructs";
 import { DeploymentV1 } from "@cdktf/provider-kubernetes/lib/deployment-v1";
 import { ServiceV1 } from "@cdktf/provider-kubernetes/lib/service-v1";
 
-import { InternalIngressRoute, LonghornPvc } from "../../utils";
+import {
+  InternalIngressRoute,
+  LonghornPvc,
+  PrivateCertificate,
+} from "../../utils";
 import {
   BaseMediaServiceOptions,
   getAamil3NodeSelector,
@@ -132,6 +136,15 @@ export class RadarrServer extends Construct {
       },
     });
 
+    new PrivateCertificate(this, "certificate", {
+      provider,
+      namespace,
+      name,
+      commonName: host,
+      dnsNames: [host],
+      secretName: `${name}-tls`,
+    });
+
     // Ingress
     new InternalIngressRoute(this, "ingress", {
       provider,
@@ -140,6 +153,7 @@ export class RadarrServer extends Construct {
       host,
       serviceName: name,
       servicePort: 80,
+      tlsSecretName: `${name}-tls`,
     });
   }
 }

media-services/sonarr/index.ts

@@ -2,7 +2,11 @@ import { Construct } from "constructs";
 import { DeploymentV1 } from "@cdktf/provider-kubernetes/lib/deployment-v1";
 import { ServiceV1 } from "@cdktf/provider-kubernetes/lib/service-v1";
 
-import { InternalIngressRoute, LonghornPvc } from "../../utils";
+import {
+  InternalIngressRoute,
+  LonghornPvc,
+  PrivateCertificate,
+} from "../../utils";
 import {
   BaseMediaServiceOptions,
   getAamil3NodeSelector,
@@ -132,6 +136,15 @@ export class SonarrServer extends Construct {
       },
     });
 
+    new PrivateCertificate(this, "certificate", {
+      provider,
+      namespace,
+      name,
+      commonName: host,
+      dnsNames: [host],
+      secretName: `${name}-tls`,
+    });
+
     // Ingress
     new InternalIngressRoute(this, "ingress", {
       provider,
@@ -140,6 +153,7 @@ export class SonarrServer extends Construct {
       host,
       serviceName: name,
       servicePort: 80,
+      tlsSecretName: `${name}-tls`,
     });
   }
 }

netbird/index.ts

@@ -0,0 +1,95 @@
+import * as fs from "fs";
+import * as path from "path";
+import { Construct } from "constructs";
+import { TerraformStack } from "cdktf";
+import { KubernetesProvider } from "@cdktf/provider-kubernetes/lib/provider";
+import { NamespaceV1 } from "@cdktf/provider-kubernetes/lib/namespace-v1";
+import { DataKubernetesSecretV1 } from "@cdktf/provider-kubernetes/lib/data-kubernetes-secret-v1";
+import { HelmProvider } from "@cdktf/provider-helm/lib/provider";
+import { SecretV1 } from "@cdktf/provider-kubernetes/lib/secret-v1";
+import { Release } from "@cdktf/provider-helm/lib/release";
+import { CloudflareCertificate, OnePasswordSecret } from "../utils";
+
+export class Netbird extends TerraformStack {
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+
+    const kubernetes = new KubernetesProvider(this, "kubernetes", {
+      configPath: "~/.kube/config",
+    });
+
+    const helm = new HelmProvider(this, "helm", {
+      kubernetes: {
+        configPath: "~/.kube/config",
+      },
+    });
+
+    const namespace = "netbird";
+
+    // Create namespace
+    new NamespaceV1(this, "namespace", {
+      metadata: {
+        name: namespace,
+      },
+    });
+
+    new OnePasswordSecret(this, "netbird-secret", {
+      name: "netbird",
+      namespace,
+      provider: kubernetes,
+      itemPath: "vaults/Lab/items/Netbird",
+    });
+
+    const pgClientCert = new DataKubernetesSecretV1(
+      this,
+      "netbird-client-cert",
+      {
+        provider: kubernetes,
+        metadata: {
+          name: "netbird-client-cert",
+          namespace: "homelab",
+        },
+      },
+    );
+
+    const pgCaCert = new DataKubernetesSecretV1(this, "postgres-ca-cert", {
+      provider: kubernetes,
+      metadata: {
+        name: "postgres-server-cert",
+        namespace: "homelab",
+      },
+    });
+
+    const pgSslBundle = new SecretV1(this, "netbird-postgres-ssl", {
+      provider: kubernetes,
+      metadata: {
+        name: "netbird-postgres-ssl-bundle",
+        namespace,
+      },
+      data: {
+        "tls.crt": pgClientCert.data.lookup("tls.crt"),
+        "tls.key": pgClientCert.data.lookup("tls.key"),
+        "ca.crt": pgCaCert.data.lookup("ca.crt"),
+      },
+    });
+
+    new CloudflareCertificate(this, "netbird-cloudflare-cert", {
+      provider: kubernetes,
+      name: "netbird",
+      namespace,
+      dnsNames: ["vpn.dogar.dev"],
+      secretName: "netbird-tls",
+    });
+
+    new Release(this, "netbird", {
+      dependsOn: [pgSslBundle],
+      provider: helm,
+      namespace,
+      createNamespace: true,
+      name: "netbird",
+      repository: "https://netbirdio.github.io/helms",
+      chart: "netbird",
+      values: [fs.readFileSync(path.join(__dirname, "values.yaml"), "utf8")],
+    }).importFrom("netbird/netbird");
+  }
+}

netbird/values.yaml

@@ -0,0 +1,218 @@
+fullnameOverride: netbird
+management:
+  configmap: |-
+    {
+      "Stuns": [
+        {
+          "Proto": "udp",
+          "URI": "{{ .STUN_SERVER }}",
+          "Username": "",
+          "Password": ""
+        }
+      ],
+      "TURNConfig": {
+        "TimeBasedCredentials": false,
+        "CredentialsTTL": "12h0m0s",
+        "Secret": "secret",
+        "Turns": [
+          {
+            "Proto": "udp",
+            "URI": "{{ .TURN_SERVER }}",
+            "Username": "{{ .TURN_SERVER_USER }}",
+            "Password": "{{ .TURN_SERVER_PASSWORD }}"
+          }
+        ]
+      },
+      "Relay": {
+        "Addresses": ["rels://vpn.dogar.dev:443/relay"],
+        "CredentialsTTL": "24h",
+        "Secret": "{{ .RELAY_PASSWORD }}"
+      },
+      "Signal": {
+        "Proto": "https",
+        "URI": "vpn.dogar.dev:443",
+        "Username": "",
+        "Password": ""
+      },
+      "Datadir": "/var/lib/netbird/",
+      "DataStoreEncryptionKey": "{{ .DATASTORE_ENCRYPTION_KEY }}",
+      "HttpConfig": {
+        "LetsEncryptDomain": "",
+        "CertFile": "",
+        "CertKey": "",
+        "AuthAudience": "{{ .IDP_CLIENT_ID }}",
+        "AuthIssuer": "https://auth.dogar.dev/application/o/netbird/",
+        "AuthUserIDClaim": "",
+        "AuthKeysLocation": "https://auth.dogar.dev/application/o/netbird/jwks/",
+        "OIDCConfigEndpoint": "https://auth.dogar.dev/application/o/netbird/.well-known/openid-configuration",
+        "IdpSignKeyRefreshEnabled": false
+      },
+      "IdpManagerConfig": {
+        "ManagerType": "authentik",
+        "ClientConfig": {
+          "Issuer": "https://auth.dogar.dev/application/o/netbird",
+          "TokenEndpoint": "https://auth.dogar.dev/application/o/token/",
+          "ClientID": "{{ .IDP_CLIENT_ID }}",
+          "ClientSecret": "",
+          "GrantType": "client_credentials"
+        },
+        "ExtraConfig": {
+          "Password": "{{ .IDP_SERVICE_ACCOUNT_PASSWORD }}",
+          "Username": "{{ .IDP_SERVICE_ACCOUNT_USER }}"
+        },
+        "Auth0ClientCredentials": null,
+        "AzureClientCredentials": null,
+        "KeycloakClientCredentials": null,
+        "ZitadelClientCredentials": null
+      },
+      "DeviceAuthorizationFlow": {
+        "Provider": "hosted",
+        "ProviderConfig": {
+          "ClientID": "{{ .IDP_CLIENT_ID }}",
+          "ClientSecret": "",
+          "Domain": "auth.dogar.dev",
+          "Audience": "{{ .IDP_CLIENT_ID }}",
+          "TokenEndpoint": "https://auth.dogar.dev/application/o/token/",
+          "DeviceAuthEndpoint": "https://auth.dogar.dev/application/o/device/",
+          "AuthorizationEndpoint": "",
+          "Scope": "openid",
+          "UseIDToken": false,
+          "RedirectURLs": null
+        }
+      },
+      "PKCEAuthorizationFlow": {
+        "ProviderConfig": {
+          "ClientID": "{{ .IDP_CLIENT_ID }}",
+          "ClientSecret": "",
+          "Domain": "",
+          "Audience": "{{ .IDP_CLIENT_ID }}",
+          "TokenEndpoint": "https://auth.dogar.dev/application/o/token/",
+          "DeviceAuthEndpoint": "",
+          "AuthorizationEndpoint": "https://auth.dogar.dev/application/o/authorize/",
+          "Scope": "openid profile email offline_access api",
+          "UseIDToken": false,
+          "RedirectURLs": ["http://localhost:53000"]
+        }
+      },
+      "StoreConfig": {
+        "Engine": "postgres"
+      },
+      "ReverseProxy": {
+        "TrustedHTTPProxies": null,
+        "TrustedHTTPProxiesCount": 0,
+        "TrustedPeers": null
+      }
+    }
+
+  persistentVolume:
+    enabled: true
+    storageClass: longhorn
+    size: 1Gi
+  envFromSecret:
+    NETBIRD_STORE_ENGINE_POSTGRES_DSN: netbird/postgresDSN
+    STUN_SERVER: netbird/stunServer
+    TURN_SERVER: netbird/turnServer
+    TURN_SERVER_USER: netbird/turnServerUser
+    TURN_SERVER_PASSWORD: netbird/turnServerPassword
+    RELAY_PASSWORD: netbird/relayPassword
+    IDP_CLIENT_ID: netbird/idpClientID
+    IDP_SERVICE_ACCOUNT_USER: netbird/idpServiceAccountUser
+    IDP_SERVICE_ACCOUNT_PASSWORD: netbird/idpServiceAccountPassword
+    DATASTORE_ENCRYPTION_KEY: netbird/datastoreEncryptionKey
+  livenessProbe:
+    failureThreshold: 3
+    initialDelaySeconds: 180
+    periodSeconds: 10
+    timeoutSeconds: 3
+    tcpSocket:
+      port: http
+  volumes:
+    - name: postgres-ssl-bundle
+      secret:
+        secretName: netbird-postgres-ssl-bundle
+  volumeMounts:
+    - name: postgres-ssl-bundle
+      mountPath: /etc/ssl/certs/postgres-ssl-bundle
+      readOnly: true
+
+signal:
+  enabled: true
+
+relay:
+  envFromSecret:
+    NB_AUTH_SECRET: netbird/relayPassword
+  env:
+    NB_LOG_LEVEL: info
+    NB_LISTEN_ADDRESS: ":33080"
+    NB_EXPOSED_ADDRESS: rels://vpn.dogar.dev:443/relay
+
+dashboard:
+  enabled: true
+  env:
+    # Endpoints
+    NETBIRD_MGMT_API_ENDPOINT: https://vpn.dogar.dev:443
+    NETBIRD_MGMT_GRPC_API_ENDPOINT: https://vpn.dogar.dev:443
+    # OIDC
+    AUTH_CLIENT_SECRET:
+    AUTH_AUTHORITY: https://auth.dogar.dev/application/o/netbird/
+    USE_AUTH0: false
+    AUTH_SUPPORTED_SCOPES: openid profile email offline_access api
+    AUTH_REDIRECT_URI:
+    AUTH_SILENT_REDIRECT_URI:
+    NETBIRD_TOKEN_SOURCE: accessToken
+    NGINX_SSL_PORT:
+    LETSENCRYPT_DOMAIN:
+    LETSENCRYPT_EMAIL:
+  envFromSecret:
+    AUTH_CLIENT_ID: netbird/idpClientID
+    AUTH_AUDIENCE: netbird/idpClientID
+
+extraManifests:
+  - apiVersion: traefik.io/v1alpha1
+    kind: IngressRoute
+    metadata:
+      name: netbird
+      namespace: netbird
+    spec:
+      entryPoints:
+      - websecure
+      routes:
+      - kind: Rule
+        match: Host(`vpn.dogar.dev`) && !PathPrefix(`/api`) && !PathPrefix(`/management`) && !PathPrefix(`/signalexchange`) && !PathPrefix(`/relay`)
+        services:
+        - name: netbird-dashboard
+          namespace: netbird
+          passHostHeader: true
+          port: 80
+      - kind: Rule
+        match: Host(`vpn.dogar.dev`) && PathPrefix(`/api`)
+        services:
+        - name: netbird-management
+          namespace: netbird
+          passHostHeader: true
+          port: 80
+      - kind: Rule
+        match: Host(`vpn.dogar.dev`) && PathPrefix(`/relay`)
+        services:
+        - name: netbird-relay
+          namespace: netbird
+          passHostHeader: true
+          port: 33080
+      - kind: Rule
+        match: Host(`vpn.dogar.dev`) && PathPrefix(`/management`)
+        services:
+        - name: netbird-management
+          namespace: netbird
+          passHostHeader: true
+          port: 80
+          scheme: h2c
+      - kind: Rule
+        match: Host(`vpn.dogar.dev`) && PathPrefix(`/signalexchange`)
+        services:
+        - name: netbird-signal
+          namespace: netbird
+          passHostHeader: true
+          port: 80
+          scheme: h2c
+      tls:
+        secretName: netbird-tls

network-security/index.ts

@@ -7,9 +7,10 @@ import {
   RateLimitMiddleware,
   IpAllowListMiddleware,
   IpAllowListMiddlewareTCP,
+  TLSOptions,
 } from "./traefik";
 import { ValkeyCluster } from "./valkey";
-import { InternalIngressRoute } from "../utils";
+import { InternalIngressRoute, PrivateCertificate } from "../utils";
 
 export class NetworkSecurity extends TerraformStack {
   constructor(scope: Construct, id: string) {
@@ -67,6 +68,11 @@ export class NetworkSecurity extends TerraformStack {
       name: "rate-limit",
     });
 
+    new TLSOptions(this, "tls-options", {
+      provider: kubernetes,
+      namespace,
+    });
+
     new IpAllowListMiddleware(this, "internal-ip-allow-list", {
       provider: kubernetes,
       namespace,
@@ -81,6 +87,15 @@ export class NetworkSecurity extends TerraformStack {
       sourceRanges: ["192.168.18.0/24", "10.42.0.0/16"],
     });
 
+    new PrivateCertificate(this, "longhorn-cert", {
+      provider: kubernetes,
+      namespace: "longhorn-system",
+      name: "longhorn-ui",
+      dnsNames: ["longhorn.dogar.dev"],
+      commonName: "longhorn.dogar.dev",
+      secretName: "longhorn-tls",
+    });
+
     new InternalIngressRoute(this, "longhorn-ui", {
       provider: kubernetes,
       namespace: "longhorn-system",
@@ -88,6 +103,16 @@ export class NetworkSecurity extends TerraformStack {
       host: "longhorn.dogar.dev",
       serviceName: "longhorn-frontend",
       servicePort: 80,
+      tlsSecretName: "longhorn-tls",
+    });
+
+    new PrivateCertificate(this, "grafana-cert", {
+      provider: kubernetes,
+      namespace: "monitoring",
+      name: "grafana-ui",
+      dnsNames: ["grafana.dogar.dev"],
+      commonName: "grafana.dogar.dev",
+      secretName: "grafana-tls",
     });
 
     new InternalIngressRoute(this, "grafana-ui", {
@@ -97,6 +122,7 @@ export class NetworkSecurity extends TerraformStack {
       host: "grafana.dogar.dev",
       serviceName: "prometheus-operator-grafana",
       servicePort: 80,
+      tlsSecretName: "grafana-tls",
     });
   }
 }

network-security/traefik/index.ts

@@ -1,2 +1,3 @@
 export { RateLimitMiddleware } from "./rateLimit";
 export { IpAllowListMiddleware, IpAllowListMiddlewareTCP } from "./ipAllowList";
+export { TLSOptions } from "./tlsOpts";

network-security/traefik/tlsOpts.ts

@@ -0,0 +1,31 @@
+import { Construct } from "constructs";
+import { Manifest } from "@cdktf/provider-kubernetes/lib/manifest";
+import { KubernetesProvider } from "@cdktf/provider-kubernetes/lib/provider";
+
+export class TLSOptions extends Construct {
+  constructor(
+    scope: Construct,
+    id: string,
+    opts: { provider: KubernetesProvider; namespace: string },
+  ) {
+    super(scope, id);
+
+    const { provider, namespace } = opts;
+
+    new Manifest(this, "traefik-tls-options", {
+      provider,
+      manifest: {
+        apiVersion: "traefik.io/v1alpha1",
+        kind: "TLSOption",
+        metadata: {
+          namespace,
+          name: "tls-options",
+        },
+        spec: {
+          minVersion: "VersionTLS13",
+          sniStrict: true,
+        },
+      },
+    });
+  }
+}

pki/index.ts

@@ -52,12 +52,9 @@ export class PKI extends TerraformStack {
       provider: kubernetes,
       namespace,
       apiVersion: "cert-manager.io/v1",
-      secretName: "root-secret",
+      rootSecretName: "root-secret",
+      intermediateSecretName: `${namespace}-ca-secret`,
       commonName: "Homelab Root CA",
-      privateKey: {
-        algorithm: "Ed25519",
-        size: 256,
-      },
     });
 
     new PublicIssuer(this, "public-issuer", {

pki/issuers/private.ts

@@ -7,11 +7,8 @@ type PrivateIssuerOptions = {
   namespace: string;
   apiVersion: string;
   commonName: string;
-  secretName: string;
-  privateKey: {
-    algorithm: "RSA" | "ECDSA" | "Ed25519";
-    size: number;
-  };
+  rootSecretName: string;
+  intermediateSecretName: string;
 };
 
 export class PrivateIssuer extends Construct {
@@ -21,44 +18,41 @@ export class PrivateIssuer extends Construct {
     const {
       provider,
       namespace,
-      commonName,
-      privateKey,
-      secretName,
       apiVersion,
+      commonName,
+      rootSecretName,
+      intermediateSecretName,
     } = options;
 
-    // Self-signed ClusterIssuer for initial CA
-    new Manifest(this, "ca-issuer", {
+    //
+    // 1. Root CA (self-signed)
+    //
+    new Manifest(this, "root-ca-issuer", {
       provider,
       manifest: {
         apiVersion,
         kind: "ClusterIssuer",
-        metadata: {
-          name: "ca-issuer",
-        },
-        spec: {
-          selfSigned: {},
-        },
+        metadata: { name: "root-ca-selfsigned" },
+        spec: { selfSigned: {} },
       },
     });
 
-    // Self-signed CA Certificate
-    new Manifest(this, "selfsigned-ca", {
+    new Manifest(this, "root-ca", {
       provider,
       manifest: {
         apiVersion,
         kind: "Certificate",
-        metadata: {
-          name: "selfsigned-ca",
-          namespace,
-        },
+        metadata: { name: "root-ca", namespace },
         spec: {
           isCA: true,
-          commonName,
-          secretName,
-          privateKey,
+          commonName: `${commonName} Root CA`,
+          secretName: rootSecretName,
+          privateKey: {
+            algorithm: "RSA",
+            size: 4096,
+          },
           issuerRef: {
-            name: "ca-issuer",
+            name: "root-ca-selfsigned",
             kind: "ClusterIssuer",
             group: "cert-manager.io",
           },
@@ -66,19 +60,55 @@ export class PrivateIssuer extends Construct {
       },
     });
 
-    // CA-based ClusterIssuer
+    //
+    // 2. Intermediate CA (signed by root CA)
+    //
+    new Manifest(this, "intermediate-ca-issuer", {
+      provider,
+      manifest: {
+        apiVersion,
+        kind: "ClusterIssuer",
+        metadata: { name: "root-ca-signer" },
+        spec: {
+          ca: { secretName: rootSecretName },
+        },
+      },
+    });
+
+    new Manifest(this, "intermediate-ca", {
+      provider,
+      manifest: {
+        apiVersion,
+        kind: "Certificate",
+        metadata: { name: "intermediate-ca", namespace },
+        spec: {
+          isCA: true,
+          commonName: `${commonName} Intermediate CA`,
+          secretName: intermediateSecretName,
+          privateKey: {
+            algorithm: "ECDSA",
+            size: 384,
+          },
+          issuerRef: {
+            name: "root-ca-signer",
+            kind: "ClusterIssuer",
+            group: "cert-manager.io",
+          },
+        },
+      },
+    });
+
+    //
+    // 3. Final public cluster issuer (used by your apps)
+    //
     new Manifest(this, "cluster-issuer", {
       provider,
       manifest: {
         apiVersion,
         kind: "ClusterIssuer",
-        metadata: {
-          name: "cluster-issuer",
-        },
+        metadata: { name: "cluster-issuer" },
         spec: {
-          ca: {
-            secretName,
-          },
+          ca: { secretName: intermediateSecretName },
         },
       },
     });

utility-services/gitea/server/values.yaml

@@ -179,7 +179,7 @@ extraVolumes:
                 path: root.crt
   - name: gitea-tls-internal
     secret:
-      secretName: gitea-tls-internal
+      secretName: gitea-http-tls-internal
   - name: gitea-temp
     emptyDir: {}
 extraInitVolumeMounts:

utility-services/index.ts

@@ -78,7 +78,7 @@ export class UtilityServices extends TerraformStack {
       name: "postgres-cluster",
       namespace,
       provider: kubernetes,
-      users: ["shahab", "budget-tracker", "authentik", "gitea"],
+      users: ["shahab", "budget-tracker", "authentik", "gitea", "netbird"],
       primaryUser: "shahab",
       initSecretName: "postgres-password",
       backupR2EndpointURL: `https://${r2Endpoint}`,

utility-services/postgres/index.ts

@@ -357,6 +357,7 @@ export class PostgresCluster extends Construct {
             {
               name: "barman-cloud.cloudnative-pg.io",
               isWALArchiver: true,
+              enabled: true,
               parameters: {
                 barmanObjectName: barmanStoreName,
                 serverName: backupServerName,

utils/cert-manager/internal.ts

@@ -32,9 +32,10 @@ export class PrivateCertificate extends Certificate {
         kind: "ClusterIssuer",
       },
       privateKey: {
-        algorithm: "Ed25519",
+        algorithm: "ECDSA",
         size: 384,
       },
+      usages: ["digital signature", "key encipherment", "server auth"],
     });
   }
 }

utils/traefik/ingress/ingress.ts

@@ -83,6 +83,7 @@ export class IngressRoute extends Construct {
       kind: "Rule",
       services: [
         {
+          namespace,
           name: opts.serviceName,
           port: opts.servicePort,
           scheme: opts.serviceProtocol ?? "http",
@@ -109,6 +110,10 @@ export class IngressRoute extends Construct {
     if (opts.tlsSecretName) {
       spec.tls = {
         secretName: opts.tlsSecretName,
+        options: {
+          name: "tls-options",
+          namespace: "homelab",
+        },
       };
     }
 

utils/traefik/ingress/internalIngress.ts

@@ -1,78 +1,16 @@
 import { Construct } from "constructs";
 import { IngressRoute, IngressRouteOptions } from "./ingress";
-import { DataTerraformRemoteStateS3 } from "cdktf";
-import { DataKubernetesNamespaceV1 } from "@cdktf/provider-kubernetes/lib/data-kubernetes-namespace-v1";
-import { PrivateCertificate } from "../../cert-manager";
 
-type InternalIngressRouteOptions = Omit<
-  IngressRouteOptions,
-  "entryPoints" | "tlsSecretName" | "middlewares"
->;
-
-export class InternalIngressRoute extends Construct {
-  constructor(scope: Construct, id: string, opts: InternalIngressRouteOptions) {
-    super(scope, id);
-
-    const r2Endpoint = `${process.env.ACCOUNT_ID!}.r2.cloudflarestorage.com`;
-
-    const coreServicesState = new DataTerraformRemoteStateS3(
-      this,
-      "core-services-state",
-      {
-        usePathStyle: true,
-        skipRegionValidation: true,
-        skipCredentialsValidation: true,
-        skipRequestingAccountId: true,
-        skipS3Checksum: true,
-        encrypt: true,
-        bucket: "terraform-state",
-        key: "core-services/terraform.tfstate",
-        endpoints: {
-          s3: `https://${r2Endpoint}`,
-        },
-        region: "auto",
-        accessKey: process.env.ACCESS_KEY,
-        secretKey: process.env.SECRET_KEY,
-      },
-    );
-    const namespaceName = coreServicesState.getString("namespace-output");
-    const namespaceResource = new DataKubernetesNamespaceV1(
-      this,
-      "core-services-namespace",
-      {
-        provider: opts.provider,
-        metadata: {
-          name: namespaceName,
-        },
-      },
-    );
-    const namespace = namespaceResource.metadata.name;
-
-    const { provider, name, host, serviceName, servicePort, serviceProtocol } =
-      opts;
-
-    const tlsSecretName = `${name}-tls`;
-
-    new PrivateCertificate(this, `${name}-cert`, {
-      provider,
-      namespace,
-      name: host,
-      secretName: tlsSecretName,
-      dnsNames: [host],
-    });
-
-    new IngressRoute(this, opts.name, {
-      provider,
-      namespace,
-      host,
-      serviceName,
-      servicePort,
-      serviceProtocol,
-      tlsSecretName,
-      name,
-      path: opts.path ?? "/",
+export class InternalIngressRoute extends IngressRoute {
+  constructor(
+    scope: Construct,
+    id: string,
+    opts: Omit<IngressRouteOptions, "entryPoints" | "middlewares">,
+  ) {
+    super(scope, id, {
+      ...opts,
       entryPoints: ["websecure"],
-      middlewares: [`${namespace}/ip-allow-list`],
+      middlewares: ["homelab/ip-allow-list"],
     });
   }
 }

utils/traefik/ingress/publicIngress.ts

@@ -2,26 +2,25 @@ import { Construct } from "constructs";
 import { IngressRoute, IngressRouteOptions } from "./ingress";
 import { CloudflareCertificate } from "../../cert-manager";
 
-type PublicIngressRouteOptions = Omit<
-  IngressRouteOptions,
-  "entryPoints" | "tlsSecretName" | "middlewares"
->;
+export class PublicIngressRoute extends IngressRoute {
+  constructor(
+    scope: Construct,
+    id: string,
+    opts: Omit<
+      IngressRouteOptions,
+      "entryPoints" | "tlsSecretName" | "middlewares"
+    >,
+  ) {
+    const tlsSecretName = `${opts.name}-tls`;
 
-export class PublicIngressRoute extends Construct {
-  constructor(scope: Construct, id: string, opts: PublicIngressRouteOptions) {
-    super(scope, id);
+    super(scope, id, {
+      ...opts,
+      tlsSecretName,
+      entryPoints: ["websecure"],
+      middlewares: ["homelab/rate-limit"],
+    });
 
-    const {
-      provider,
-      name,
-      namespace,
-      host,
-      serviceName,
-      servicePort,
-      serviceProtocol,
-    } = opts;
-
-    const tlsSecretName = `${name}-tls`;
+    const { provider, name, namespace, host } = opts;
 
     new CloudflareCertificate(this, `${name}-cert`, {
       provider,
@@ -30,19 +29,5 @@ export class PublicIngressRoute extends Construct {
       secretName: tlsSecretName,
       dnsNames: [host],
     });
-
-    new IngressRoute(this, opts.name, {
-      provider,
-      namespace,
-      host,
-      tlsSecretName,
-      serviceName,
-      servicePort,
-      serviceProtocol,
-      name,
-      path: opts.path ?? "/",
-      entryPoints: ["websecure"],
-      middlewares: [`${namespace}/rate-limit`],
-    });
   }
 }