chore: Minecraft | clean up old servers

cache-infrastructure/go/index.ts

@@ -1,41 +0,0 @@
-import * as fs from "fs";
-import * as path from "path";
-import { Release } from "@cdktf/provider-helm/lib/release";
-import { Construct } from "constructs";
-
-import { PublicIngressRoute } from "../../utils";
-import { Providers } from "../../types";
-
-type GoCacheOptions = {
-  providers: Providers;
-  namespace: string;
-  name: string;
-  host: string;
-};
-
-export class GoCache extends Construct {
-  constructor(scope: Construct, id: string, opts: GoCacheOptions) {
-    super(scope, id);
-
-    const { namespace, name, host } = opts;
-    const { helm, kubernetes } = opts.providers;
-
-    new Release(this, "helm-release", {
-      provider: helm,
-      name,
-      namespace,
-      repository: "https://gomods.github.io/athens-charts",
-      chart: "athens-proxy",
-      values: [fs.readFileSync(path.join(__dirname, "values.yaml"), "utf8")],
-    });
-
-    new PublicIngressRoute(this, "ingress", {
-      provider: kubernetes,
-      namespace,
-      name,
-      host,
-      serviceName: `${name}-athens-proxy`,
-      servicePort: 80,
-    });
-  }
-}

cache-infrastructure/go/values.yaml

@@ -1,20 +0,0 @@
-replicaCount: 3
-image:
-  runAsNonRoot: true
-nodeSelector:
-  nodepool: worker
-strategy:
-  type: Recreate
-storage:
-  disk:
-    persistence:
-      enabled: true
-      accessMode: ReadWriteMany
-      size: 64Gi
-      storageClass: longhorn
-configEnvVars:
-  - name: ATHENS_DOWNLOAD_MODE
-    value: "sync"
-upstreamProxy:
-  enabled: true
-  url: "https://proxy.golang.org"

cache-infrastructure/index.ts

@@ -5,23 +5,15 @@ import { NamespaceV1 } from "@cdktf/provider-kubernetes/lib/namespace-v1";
 import { NixCache } from "./nix";
 import { NpmCache } from "./npm";
 import { PipCache } from "./pip";
-import { GoCache } from "./go";
-import { HelmProvider } from "@cdktf/provider-helm/lib/provider";
 
 export class CacheInfrastructure extends TerraformStack {
   constructor(scope: Construct, id: string) {
     super(scope, id);
 
-    const kubernetes = new KubernetesProvider(this, "kubernetes", {
+    const provider = new KubernetesProvider(this, "kubernetes", {
       configPath: "~/.kube/config",
     });
 
-    const helm = new HelmProvider(this, "helm", {
-      kubernetes: {
-        configPath: "~/.kube/config",
-      },
-    });
-
     const namespace = "package-cache";
 
     new NamespaceV1(this, "package-cache-namespace", {
@@ -32,34 +24,24 @@ export class CacheInfrastructure extends TerraformStack {
 
     // Add cache-related infrastructure components here
     new NixCache(this, "nix-cache", {
-      provider: kubernetes,
+      provider,
       namespace,
       name: "nix-cache",
       host: "nix.dogar.dev",
     });
 
     new NpmCache(this, "npm-cache", {
-      provider: kubernetes,
+      provider,
       namespace,
       name: "npm-cache",
       host: "npm.dogar.dev",
     });
 
     new PipCache(this, "pip-cache", {
-      provider: kubernetes,
+      provider,
       namespace,
       name: "pip-cache",
       host: "pip.dogar.dev",
     });
-
-    new GoCache(this, "go-cache", {
-      providers: {
-        kubernetes,
-        helm,
-      },
-      namespace,
-      name: "go-cache",
-      host: "go.dogar.dev",
-    });
   }
 }

core-services/cert-manager/index.ts

@@ -6,6 +6,7 @@ import { Construct } from "constructs";
 
 type CertManagerOptions = {
   provider: HelmProvider;
+  version: string;
   name: string;
   namespace: string;
 };
@@ -14,12 +15,13 @@ export class CertManager extends Construct {
   constructor(scope: Construct, id: string, options: CertManagerOptions) {
     super(scope, id);
 
-    const { namespace, name, provider } = options;
+    const { namespace, name, version, provider } = options;
 
     new Release(this, id, {
       provider,
       name,
       namespace,
+      version,
       repository: "https://charts.jetstack.io",
       chart: "cert-manager",
       createNamespace: true,

core-services/cert-manager/values.yaml

@@ -1,8 +1,6 @@
 crds:
   enabled: true
-  keep: true
 prometheus:
   enabled: true
 webhook:
   timeoutSeconds: 4
-enableCertificateOwnerRef: true

core-services/index.ts

@@ -59,6 +59,7 @@ export class CoreServices extends TerraformStack {
       provider: helm,
       name: "cert-manager",
       namespace,
+      version: "1.18.2",
     });
   }
 }

core-services/traefik/values.yaml

@@ -3,7 +3,7 @@ providers:
     allowCrossNamespace: true
 ingress:
   ingressClass:
-    enabled: false
+    enabled: true
     isDefaultClass: true
     name: traefik
 deployment:

gaming-services/minecraft/tfg.ts

@@ -46,7 +46,7 @@ export class TerraFirmaGreg extends Construct {
         },
         {
           name: "CF_FILENAME_MATCHER",
-          value: "0.11.8",
+          value: "0.10.17",
         },
         {
           name: "VERSION",

main.ts

@@ -9,7 +9,6 @@ import { NetworkSecurity } from "./network-security";
 import { GamingServices } from "./gaming-services/minecraft";
 import { MediaServices } from "./media-services";
 import { PKI } from "./pki";
-import { Netbird } from "./netbird";
 
 dotenv.config();
 
@@ -47,9 +46,6 @@ mediaServices.node.addDependency(networkSecurity);
 const caches = new CacheInfrastructure(app, "cache-infrastructure");
 caches.node.addDependency(utilityServices);
 
-const netbird = new Netbird(app, "netbird");
-netbird.node.addDependency(utilityServices);
-
 const deploy: (stack: TerraformStack, key: string) => S3Backend = (
   stack,
   key,
@@ -79,6 +75,5 @@ deploy(utilityServices, "utility-services");
 deploy(caches, "cache-infrastructure");
 deploy(gamingServices, "gaming-services");
 deploy(mediaServices, "media-services");
-deploy(netbird, "netbird");
 
 app.synth();

media-services/index.ts

@@ -76,7 +76,6 @@ export class MediaServices extends TerraformStack {
     new ProwlarrServer(this, "prowlarr", {
       provider,
       namespace,
-      host: "prowlarr.dogar.dev",
     });
   }
 }

media-services/jellyfin/index.ts

@@ -2,11 +2,7 @@ import { Construct } from "constructs";
 import { DeploymentV1 } from "@cdktf/provider-kubernetes/lib/deployment-v1";
 import { ServiceV1 } from "@cdktf/provider-kubernetes/lib/service-v1";
 
-import {
-  CloudflareCertificate,
-  InternalIngressRoute,
-  LonghornPvc,
-} from "../../utils";
+import { InternalIngressRoute, LonghornPvc } from "../../utils";
 import { BaseMediaServiceOptions, getAamil3NodeSelector } from "../types";
 
 type JellyfinServerOptions = BaseMediaServiceOptions & {
@@ -55,7 +51,7 @@ export class JellyfinServer extends Construct {
             targetPort: "discovery",
           },
         ],
-        type: "LoadBalancer",
+        type: "ClusterIP",
       },
     });
 
@@ -141,14 +137,6 @@ export class JellyfinServer extends Construct {
       },
     });
 
-    new CloudflareCertificate(this, "certificate", {
-      provider,
-      namespace,
-      name,
-      secretName: "jellyfin-tls",
-      dnsNames: [host],
-    });
-
     // Ingress - using internal ingress for secure access
     new InternalIngressRoute(this, "ingress", {
       provider,
@@ -157,7 +145,6 @@ export class JellyfinServer extends Construct {
       host,
       serviceName: name,
       servicePort: 80,
-      tlsSecretName: "jellyfin-tls",
     });
   }
 }

media-services/prowlarr/index.ts

@@ -2,27 +2,18 @@ import { Construct } from "constructs";
 import { DeploymentV1 } from "@cdktf/provider-kubernetes/lib/deployment-v1";
 import { ServiceV1 } from "@cdktf/provider-kubernetes/lib/service-v1";
 
-import {
-  InternalIngressRoute,
-  LonghornPvc,
-  PrivateCertificate,
-} from "../../utils";
+import { LonghornPvc } from "../../utils";
 import {
   BaseMediaServiceOptions,
   getWorkerNodeSelector,
   getCommonEnv,
 } from "../types";
 
-type ProwlarrOptions = BaseMediaServiceOptions & {
-  /** Hostname for the ingress */
-  host: string;
-};
-
 export class ProwlarrServer extends Construct {
-  constructor(scope: Construct, id: string, options: ProwlarrOptions) {
+  constructor(scope: Construct, id: string, options: BaseMediaServiceOptions) {
     super(scope, id);
 
-    const { provider, namespace, host } = options;
+    const { provider, namespace } = options;
     const name = "prowlarr";
 
     // Config PVC with backup
@@ -111,24 +102,6 @@ export class ProwlarrServer extends Construct {
       },
     });
 
-    new PrivateCertificate(this, "certificate", {
-      provider,
-      namespace,
-      name,
-      commonName: host,
-      dnsNames: [host],
-      secretName: `${name}-tls`,
-    });
-
-    // Ingress
-    new InternalIngressRoute(this, "ingress", {
-      provider,
-      namespace,
-      name,
-      host,
-      serviceName: name,
-      servicePort: 80,
-      tlsSecretName: `${name}-tls`,
-    });
+    // Note: No ingress - Prowlarr is for internal use only
   }
 }

media-services/qbittorrent/index.ts

@@ -2,11 +2,7 @@ import { Construct } from "constructs";
 import { DeploymentV1 } from "@cdktf/provider-kubernetes/lib/deployment-v1";
 import { ServiceV1 } from "@cdktf/provider-kubernetes/lib/service-v1";
 
-import {
-  InternalIngressRoute,
-  LonghornPvc,
-  PrivateCertificate,
-} from "../../utils";
+import { InternalIngressRoute, LonghornPvc } from "../../utils";
 import {
   BaseMediaServiceOptions,
   getAamil3NodeSelector,
@@ -21,7 +17,11 @@ type QBittorrentServerOptions = BaseMediaServiceOptions & {
 };
 
 export class QBittorrentServer extends Construct {
-  constructor(scope: Construct, id: string, options: QBittorrentServerOptions) {
+  constructor(
+    scope: Construct,
+    id: string,
+    options: QBittorrentServerOptions,
+  ) {
     super(scope, id);
 
     const { provider, namespace, downloadsPvcName, host } = options;
@@ -137,15 +137,6 @@ export class QBittorrentServer extends Construct {
       },
     });
 
-    new PrivateCertificate(this, "certificate", {
-      provider,
-      namespace,
-      name,
-      commonName: host,
-      dnsNames: [host],
-      secretName: `${name}-tls`,
-    });
-
     // Ingress
     new InternalIngressRoute(this, "ingress", {
       provider,
@@ -154,7 +145,6 @@ export class QBittorrentServer extends Construct {
       host,
       serviceName: name,
       servicePort: 80,
-      tlsSecretName: `${name}-tls`,
     });
   }
 }

media-services/radarr/index.ts

@@ -2,11 +2,7 @@ import { Construct } from "constructs";
 import { DeploymentV1 } from "@cdktf/provider-kubernetes/lib/deployment-v1";
 import { ServiceV1 } from "@cdktf/provider-kubernetes/lib/service-v1";
 
-import {
-  InternalIngressRoute,
-  LonghornPvc,
-  PrivateCertificate,
-} from "../../utils";
+import { InternalIngressRoute, LonghornPvc } from "../../utils";
 import {
   BaseMediaServiceOptions,
   getAamil3NodeSelector,
@@ -136,15 +132,6 @@ export class RadarrServer extends Construct {
       },
     });
 
-    new PrivateCertificate(this, "certificate", {
-      provider,
-      namespace,
-      name,
-      commonName: host,
-      dnsNames: [host],
-      secretName: `${name}-tls`,
-    });
-
     // Ingress
     new InternalIngressRoute(this, "ingress", {
       provider,
@@ -153,7 +140,6 @@ export class RadarrServer extends Construct {
       host,
       serviceName: name,
       servicePort: 80,
-      tlsSecretName: `${name}-tls`,
     });
   }
 }

media-services/sonarr/index.ts

@@ -2,11 +2,7 @@ import { Construct } from "constructs";
 import { DeploymentV1 } from "@cdktf/provider-kubernetes/lib/deployment-v1";
 import { ServiceV1 } from "@cdktf/provider-kubernetes/lib/service-v1";
 
-import {
-  InternalIngressRoute,
-  LonghornPvc,
-  PrivateCertificate,
-} from "../../utils";
+import { InternalIngressRoute, LonghornPvc } from "../../utils";
 import {
   BaseMediaServiceOptions,
   getAamil3NodeSelector,
@@ -136,15 +132,6 @@ export class SonarrServer extends Construct {
       },
     });
 
-    new PrivateCertificate(this, "certificate", {
-      provider,
-      namespace,
-      name,
-      commonName: host,
-      dnsNames: [host],
-      secretName: `${name}-tls`,
-    });
-
     // Ingress
     new InternalIngressRoute(this, "ingress", {
       provider,
@@ -153,7 +140,6 @@ export class SonarrServer extends Construct {
       host,
       serviceName: name,
       servicePort: 80,
-      tlsSecretName: `${name}-tls`,
     });
   }
 }

netbird/index.ts

@@ -1,95 +0,0 @@
-import * as fs from "fs";
-import * as path from "path";
-import { Construct } from "constructs";
-import { TerraformStack } from "cdktf";
-import { KubernetesProvider } from "@cdktf/provider-kubernetes/lib/provider";
-import { NamespaceV1 } from "@cdktf/provider-kubernetes/lib/namespace-v1";
-import { DataKubernetesSecretV1 } from "@cdktf/provider-kubernetes/lib/data-kubernetes-secret-v1";
-import { HelmProvider } from "@cdktf/provider-helm/lib/provider";
-import { SecretV1 } from "@cdktf/provider-kubernetes/lib/secret-v1";
-import { Release } from "@cdktf/provider-helm/lib/release";
-import { CloudflareCertificate, OnePasswordSecret } from "../utils";
-
-export class Netbird extends TerraformStack {
-  constructor(scope: Construct, id: string) {
-    super(scope, id);
-
-    const kubernetes = new KubernetesProvider(this, "kubernetes", {
-      configPath: "~/.kube/config",
-    });
-
-    const helm = new HelmProvider(this, "helm", {
-      kubernetes: {
-        configPath: "~/.kube/config",
-      },
-    });
-
-    const namespace = "netbird";
-
-    // Create namespace
-    new NamespaceV1(this, "namespace", {
-      metadata: {
-        name: namespace,
-      },
-    });
-
-    new OnePasswordSecret(this, "netbird-secret", {
-      name: "netbird",
-      namespace,
-      provider: kubernetes,
-      itemPath: "vaults/Lab/items/Netbird",
-    });
-
-    const pgClientCert = new DataKubernetesSecretV1(
-      this,
-      "netbird-client-cert",
-      {
-        provider: kubernetes,
-        metadata: {
-          name: "netbird-client-cert",
-          namespace: "homelab",
-        },
-      },
-    );
-
-    const pgCaCert = new DataKubernetesSecretV1(this, "postgres-ca-cert", {
-      provider: kubernetes,
-      metadata: {
-        name: "postgres-server-cert",
-        namespace: "homelab",
-      },
-    });
-
-    const pgSslBundle = new SecretV1(this, "netbird-postgres-ssl", {
-      provider: kubernetes,
-      metadata: {
-        name: "netbird-postgres-ssl-bundle",
-        namespace,
-      },
-      data: {
-        "tls.crt": pgClientCert.data.lookup("tls.crt"),
-        "tls.key": pgClientCert.data.lookup("tls.key"),
-        "ca.crt": pgCaCert.data.lookup("ca.crt"),
-      },
-    });
-
-    new CloudflareCertificate(this, "netbird-cloudflare-cert", {
-      provider: kubernetes,
-      name: "netbird",
-      namespace,
-      dnsNames: ["vpn.dogar.dev"],
-      secretName: "netbird-tls",
-    });
-
-    new Release(this, "netbird", {
-      dependsOn: [pgSslBundle],
-      provider: helm,
-      namespace,
-      createNamespace: true,
-      name: "netbird",
-      repository: "https://netbirdio.github.io/helms",
-      chart: "netbird",
-      values: [fs.readFileSync(path.join(__dirname, "values.yaml"), "utf8")],
-    }).importFrom("netbird/netbird");
-  }
-}

netbird/values.yaml

@@ -1,218 +0,0 @@
-fullnameOverride: netbird
-management:
-  configmap: |-
-    {
-      "Stuns": [
-        {
-          "Proto": "udp",
-          "URI": "{{ .STUN_SERVER }}",
-          "Username": "",
-          "Password": ""
-        }
-      ],
-      "TURNConfig": {
-        "TimeBasedCredentials": false,
-        "CredentialsTTL": "12h0m0s",
-        "Secret": "secret",
-        "Turns": [
-          {
-            "Proto": "udp",
-            "URI": "{{ .TURN_SERVER }}",
-            "Username": "{{ .TURN_SERVER_USER }}",
-            "Password": "{{ .TURN_SERVER_PASSWORD }}"
-          }
-        ]
-      },
-      "Relay": {
-        "Addresses": ["rels://vpn.dogar.dev:443/relay"],
-        "CredentialsTTL": "24h",
-        "Secret": "{{ .RELAY_PASSWORD }}"
-      },
-      "Signal": {
-        "Proto": "https",
-        "URI": "vpn.dogar.dev:443",
-        "Username": "",
-        "Password": ""
-      },
-      "Datadir": "/var/lib/netbird/",
-      "DataStoreEncryptionKey": "{{ .DATASTORE_ENCRYPTION_KEY }}",
-      "HttpConfig": {
-        "LetsEncryptDomain": "",
-        "CertFile": "",
-        "CertKey": "",
-        "AuthAudience": "{{ .IDP_CLIENT_ID }}",
-        "AuthIssuer": "https://auth.dogar.dev/application/o/netbird/",
-        "AuthUserIDClaim": "",
-        "AuthKeysLocation": "https://auth.dogar.dev/application/o/netbird/jwks/",
-        "OIDCConfigEndpoint": "https://auth.dogar.dev/application/o/netbird/.well-known/openid-configuration",
-        "IdpSignKeyRefreshEnabled": false
-      },
-      "IdpManagerConfig": {
-        "ManagerType": "authentik",
-        "ClientConfig": {
-          "Issuer": "https://auth.dogar.dev/application/o/netbird",
-          "TokenEndpoint": "https://auth.dogar.dev/application/o/token/",
-          "ClientID": "{{ .IDP_CLIENT_ID }}",
-          "ClientSecret": "",
-          "GrantType": "client_credentials"
-        },
-        "ExtraConfig": {
-          "Password": "{{ .IDP_SERVICE_ACCOUNT_PASSWORD }}",
-          "Username": "{{ .IDP_SERVICE_ACCOUNT_USER }}"
-        },
-        "Auth0ClientCredentials": null,
-        "AzureClientCredentials": null,
-        "KeycloakClientCredentials": null,
-        "ZitadelClientCredentials": null
-      },
-      "DeviceAuthorizationFlow": {
-        "Provider": "hosted",
-        "ProviderConfig": {
-          "ClientID": "{{ .IDP_CLIENT_ID }}",
-          "ClientSecret": "",
-          "Domain": "auth.dogar.dev",
-          "Audience": "{{ .IDP_CLIENT_ID }}",
-          "TokenEndpoint": "https://auth.dogar.dev/application/o/token/",
-          "DeviceAuthEndpoint": "https://auth.dogar.dev/application/o/device/",
-          "AuthorizationEndpoint": "",
-          "Scope": "openid",
-          "UseIDToken": false,
-          "RedirectURLs": null
-        }
-      },
-      "PKCEAuthorizationFlow": {
-        "ProviderConfig": {
-          "ClientID": "{{ .IDP_CLIENT_ID }}",
-          "ClientSecret": "",
-          "Domain": "",
-          "Audience": "{{ .IDP_CLIENT_ID }}",
-          "TokenEndpoint": "https://auth.dogar.dev/application/o/token/",
-          "DeviceAuthEndpoint": "",
-          "AuthorizationEndpoint": "https://auth.dogar.dev/application/o/authorize/",
-          "Scope": "openid profile email offline_access api",
-          "UseIDToken": false,
-          "RedirectURLs": ["http://localhost:53000"]
-        }
-      },
-      "StoreConfig": {
-        "Engine": "postgres"
-      },
-      "ReverseProxy": {
-        "TrustedHTTPProxies": null,
-        "TrustedHTTPProxiesCount": 0,
-        "TrustedPeers": null
-      }
-    }
-
-  persistentVolume:
-    enabled: true
-    storageClass: longhorn
-    size: 1Gi
-  envFromSecret:
-    NETBIRD_STORE_ENGINE_POSTGRES_DSN: netbird/postgresDSN
-    STUN_SERVER: netbird/stunServer
-    TURN_SERVER: netbird/turnServer
-    TURN_SERVER_USER: netbird/turnServerUser
-    TURN_SERVER_PASSWORD: netbird/turnServerPassword
-    RELAY_PASSWORD: netbird/relayPassword
-    IDP_CLIENT_ID: netbird/idpClientID
-    IDP_SERVICE_ACCOUNT_USER: netbird/idpServiceAccountUser
-    IDP_SERVICE_ACCOUNT_PASSWORD: netbird/idpServiceAccountPassword
-    DATASTORE_ENCRYPTION_KEY: netbird/datastoreEncryptionKey
-  livenessProbe:
-    failureThreshold: 3
-    initialDelaySeconds: 180
-    periodSeconds: 10
-    timeoutSeconds: 3
-    tcpSocket:
-      port: http
-  volumes:
-    - name: postgres-ssl-bundle
-      secret:
-        secretName: netbird-postgres-ssl-bundle
-  volumeMounts:
-    - name: postgres-ssl-bundle
-      mountPath: /etc/ssl/certs/postgres-ssl-bundle
-      readOnly: true
-
-signal:
-  enabled: true
-
-relay:
-  envFromSecret:
-    NB_AUTH_SECRET: netbird/relayPassword
-  env:
-    NB_LOG_LEVEL: info
-    NB_LISTEN_ADDRESS: ":33080"
-    NB_EXPOSED_ADDRESS: rels://vpn.dogar.dev:443/relay
-
-dashboard:
-  enabled: true
-  env:
-    # Endpoints
-    NETBIRD_MGMT_API_ENDPOINT: https://vpn.dogar.dev:443
-    NETBIRD_MGMT_GRPC_API_ENDPOINT: https://vpn.dogar.dev:443
-    # OIDC
-    AUTH_CLIENT_SECRET:
-    AUTH_AUTHORITY: https://auth.dogar.dev/application/o/netbird/
-    USE_AUTH0: false
-    AUTH_SUPPORTED_SCOPES: openid profile email offline_access api
-    AUTH_REDIRECT_URI:
-    AUTH_SILENT_REDIRECT_URI:
-    NETBIRD_TOKEN_SOURCE: accessToken
-    NGINX_SSL_PORT:
-    LETSENCRYPT_DOMAIN:
-    LETSENCRYPT_EMAIL:
-  envFromSecret:
-    AUTH_CLIENT_ID: netbird/idpClientID
-    AUTH_AUDIENCE: netbird/idpClientID
-
-extraManifests:
-  - apiVersion: traefik.io/v1alpha1
-    kind: IngressRoute
-    metadata:
-      name: netbird
-      namespace: netbird
-    spec:
-      entryPoints:
-      - websecure
-      routes:
-      - kind: Rule
-        match: Host(`vpn.dogar.dev`) && !PathPrefix(`/api`) && !PathPrefix(`/management`) && !PathPrefix(`/signalexchange`) && !PathPrefix(`/relay`)
-        services:
-        - name: netbird-dashboard
-          namespace: netbird
-          passHostHeader: true
-          port: 80
-      - kind: Rule
-        match: Host(`vpn.dogar.dev`) && PathPrefix(`/api`)
-        services:
-        - name: netbird-management
-          namespace: netbird
-          passHostHeader: true
-          port: 80
-      - kind: Rule
-        match: Host(`vpn.dogar.dev`) && PathPrefix(`/relay`)
-        services:
-        - name: netbird-relay
-          namespace: netbird
-          passHostHeader: true
-          port: 33080
-      - kind: Rule
-        match: Host(`vpn.dogar.dev`) && PathPrefix(`/management`)
-        services:
-        - name: netbird-management
-          namespace: netbird
-          passHostHeader: true
-          port: 80
-          scheme: h2c
-      - kind: Rule
-        match: Host(`vpn.dogar.dev`) && PathPrefix(`/signalexchange`)
-        services:
-        - name: netbird-signal
-          namespace: netbird
-          passHostHeader: true
-          port: 80
-          scheme: h2c
-      tls:
-        secretName: netbird-tls

network-security/index.ts

@@ -7,10 +7,9 @@ import {
   RateLimitMiddleware,
   IpAllowListMiddleware,
   IpAllowListMiddlewareTCP,
-  TLSOptions,
 } from "./traefik";
 import { ValkeyCluster } from "./valkey";
-import { InternalIngressRoute, PrivateCertificate } from "../utils";
+import { InternalIngressRoute } from "../utils";
 
 export class NetworkSecurity extends TerraformStack {
   constructor(scope: Construct, id: string) {
@@ -68,11 +67,6 @@ export class NetworkSecurity extends TerraformStack {
       name: "rate-limit",
     });
 
-    new TLSOptions(this, "tls-options", {
-      provider: kubernetes,
-      namespace,
-    });
-
     new IpAllowListMiddleware(this, "internal-ip-allow-list", {
       provider: kubernetes,
       namespace,
@@ -87,15 +81,6 @@ export class NetworkSecurity extends TerraformStack {
       sourceRanges: ["192.168.18.0/24", "10.42.0.0/16"],
     });
 
-    new PrivateCertificate(this, "longhorn-cert", {
-      provider: kubernetes,
-      namespace: "longhorn-system",
-      name: "longhorn-ui",
-      dnsNames: ["longhorn.dogar.dev"],
-      commonName: "longhorn.dogar.dev",
-      secretName: "longhorn-tls",
-    });
-
     new InternalIngressRoute(this, "longhorn-ui", {
       provider: kubernetes,
       namespace: "longhorn-system",
@@ -103,16 +88,6 @@ export class NetworkSecurity extends TerraformStack {
       host: "longhorn.dogar.dev",
       serviceName: "longhorn-frontend",
       servicePort: 80,
-      tlsSecretName: "longhorn-tls",
-    });
-
-    new PrivateCertificate(this, "grafana-cert", {
-      provider: kubernetes,
-      namespace: "monitoring",
-      name: "grafana-ui",
-      dnsNames: ["grafana.dogar.dev"],
-      commonName: "grafana.dogar.dev",
-      secretName: "grafana-tls",
     });
 
     new InternalIngressRoute(this, "grafana-ui", {
@@ -122,7 +97,6 @@ export class NetworkSecurity extends TerraformStack {
       host: "grafana.dogar.dev",
       serviceName: "prometheus-operator-grafana",
       servicePort: 80,
-      tlsSecretName: "grafana-tls",
     });
   }
 }

network-security/traefik/index.ts

@@ -1,3 +1,2 @@
 export { RateLimitMiddleware } from "./rateLimit";
 export { IpAllowListMiddleware, IpAllowListMiddlewareTCP } from "./ipAllowList";
-export { TLSOptions } from "./tlsOpts";

network-security/traefik/rateLimit.ts

@@ -7,8 +7,8 @@ type RateLimitMiddlewareOptions = {
   namespace: string;
   name: string;
 
-  average?: number; // default 60
-  burst?: number; // default 120
+  average?: number; // default 10
+  burst?: number; // default 50
   period?: string; // default "1s"
 };
 
@@ -18,8 +18,8 @@ export class RateLimitMiddleware extends Construct {
   constructor(scope: Construct, id: string, opts: RateLimitMiddlewareOptions) {
     super(scope, id);
 
-    const average = opts.average ?? 60;
-    const burst = opts.burst ?? 120;
+    const average = opts.average ?? 10;
+    const burst = opts.burst ?? 50;
     const period = opts.period ?? "1s";
 
     this.ref = `${opts.namespace}/${opts.name}`;

network-security/traefik/tlsOpts.ts

@@ -1,31 +0,0 @@
-import { Construct } from "constructs";
-import { Manifest } from "@cdktf/provider-kubernetes/lib/manifest";
-import { KubernetesProvider } from "@cdktf/provider-kubernetes/lib/provider";
-
-export class TLSOptions extends Construct {
-  constructor(
-    scope: Construct,
-    id: string,
-    opts: { provider: KubernetesProvider; namespace: string },
-  ) {
-    super(scope, id);
-
-    const { provider, namespace } = opts;
-
-    new Manifest(this, "traefik-tls-options", {
-      provider,
-      manifest: {
-        apiVersion: "traefik.io/v1alpha1",
-        kind: "TLSOption",
-        metadata: {
-          namespace,
-          name: "tls-options",
-        },
-        spec: {
-          minVersion: "VersionTLS13",
-          sniStrict: true,
-        },
-      },
-    });
-  }
-}

pki/index.ts

@@ -52,9 +52,12 @@ export class PKI extends TerraformStack {
       provider: kubernetes,
       namespace,
       apiVersion: "cert-manager.io/v1",
-      rootSecretName: "root-secret",
-      intermediateSecretName: `${namespace}-ca-secret`,
+      secretName: "root-secret",
       commonName: "Homelab Root CA",
+      privateKey: {
+        algorithm: "Ed25519",
+        size: 256,
+      },
     });
 
     new PublicIssuer(this, "public-issuer", {

pki/issuers/private.ts

@@ -7,8 +7,11 @@ type PrivateIssuerOptions = {
   namespace: string;
   apiVersion: string;
   commonName: string;
-  rootSecretName: string;
-  intermediateSecretName: string;
+  secretName: string;
+  privateKey: {
+    algorithm: "RSA" | "ECDSA" | "Ed25519";
+    size: number;
+  };
 };
 
 export class PrivateIssuer extends Construct {
@@ -18,41 +21,44 @@ export class PrivateIssuer extends Construct {
     const {
       provider,
       namespace,
-      apiVersion,
       commonName,
-      rootSecretName,
-      intermediateSecretName,
+      privateKey,
+      secretName,
+      apiVersion,
     } = options;
 
-    //
-    // 1. Root CA (self-signed)
-    //
-    new Manifest(this, "root-ca-issuer", {
+    // Self-signed ClusterIssuer for initial CA
+    new Manifest(this, "ca-issuer", {
       provider,
       manifest: {
         apiVersion,
         kind: "ClusterIssuer",
-        metadata: { name: "root-ca-selfsigned" },
-        spec: { selfSigned: {} },
+        metadata: {
+          name: "ca-issuer",
+        },
+        spec: {
+          selfSigned: {},
+        },
       },
     });
 
-    new Manifest(this, "root-ca", {
+    // Self-signed CA Certificate
+    new Manifest(this, "selfsigned-ca", {
       provider,
       manifest: {
         apiVersion,
         kind: "Certificate",
-        metadata: { name: "root-ca", namespace },
+        metadata: {
+          name: "selfsigned-ca",
+          namespace,
+        },
         spec: {
           isCA: true,
-          commonName: `${commonName} Root CA`,
-          secretName: rootSecretName,
-          privateKey: {
-            algorithm: "RSA",
-            size: 4096,
-          },
+          commonName,
+          secretName,
+          privateKey,
           issuerRef: {
-            name: "root-ca-selfsigned",
+            name: "ca-issuer",
             kind: "ClusterIssuer",
             group: "cert-manager.io",
           },
@@ -60,55 +66,19 @@ export class PrivateIssuer extends Construct {
       },
     });
 
-    //
-    // 2. Intermediate CA (signed by root CA)
-    //
-    new Manifest(this, "intermediate-ca-issuer", {
-      provider,
-      manifest: {
-        apiVersion,
-        kind: "ClusterIssuer",
-        metadata: { name: "root-ca-signer" },
-        spec: {
-          ca: { secretName: rootSecretName },
-        },
-      },
-    });
-
-    new Manifest(this, "intermediate-ca", {
-      provider,
-      manifest: {
-        apiVersion,
-        kind: "Certificate",
-        metadata: { name: "intermediate-ca", namespace },
-        spec: {
-          isCA: true,
-          commonName: `${commonName} Intermediate CA`,
-          secretName: intermediateSecretName,
-          privateKey: {
-            algorithm: "ECDSA",
-            size: 384,
-          },
-          issuerRef: {
-            name: "root-ca-signer",
-            kind: "ClusterIssuer",
-            group: "cert-manager.io",
-          },
-        },
-      },
-    });
-
-    //
-    // 3. Final public cluster issuer (used by your apps)
-    //
+    // CA-based ClusterIssuer
     new Manifest(this, "cluster-issuer", {
       provider,
       manifest: {
         apiVersion,
         kind: "ClusterIssuer",
-        metadata: { name: "cluster-issuer" },
+        metadata: {
+          name: "cluster-issuer",
+        },
         spec: {
-          ca: { secretName: intermediateSecretName },
+          ca: {
+            secretName,
+          },
         },
       },
     });

utility-services/gitea/server/values.yaml

@@ -179,7 +179,7 @@ extraVolumes:
                 path: root.crt
   - name: gitea-tls-internal
     secret:
-      secretName: gitea-http-tls-internal
+      secretName: gitea-tls-internal
   - name: gitea-temp
     emptyDir: {}
 extraInitVolumeMounts:

utility-services/index.ts

@@ -78,7 +78,7 @@ export class UtilityServices extends TerraformStack {
       name: "postgres-cluster",
       namespace,
       provider: kubernetes,
-      users: ["shahab", "budget-tracker", "authentik", "gitea", "netbird"],
+      users: ["shahab", "budget-tracker", "authentik", "gitea"],
       primaryUser: "shahab",
       initSecretName: "postgres-password",
       backupR2EndpointURL: `https://${r2Endpoint}`,

utility-services/postgres/index.ts

@@ -357,7 +357,6 @@ export class PostgresCluster extends Construct {
             {
               name: "barman-cloud.cloudnative-pg.io",
               isWALArchiver: true,
-              enabled: true,
               parameters: {
                 barmanObjectName: barmanStoreName,
                 serverName: backupServerName,

utils/cert-manager/cloudflare.ts

@@ -19,7 +19,7 @@ export class CloudflareCertificate extends Certificate {
   constructor(
     scope: Construct,
     id: string,
-    opts: Omit<CertificateOptions, "issuerRef" | "privateKey">,
+    opts: Omit<CertificateOptions, "issuerRef">,
   ) {
     super(scope, id, {
       ...opts,
@@ -27,10 +27,6 @@ export class CloudflareCertificate extends Certificate {
         name: "cloudflare-issuer",
         kind: "ClusterIssuer",
       },
-      privateKey: {
-        algorithm: "RSA",
-        size: 4096,
-      },
     });
   }
 }

utils/cert-manager/internal.ts

@@ -23,7 +23,7 @@ export class PrivateCertificate extends Certificate {
   constructor(
     scope: Construct,
     id: string,
-    opts: Omit<CertificateOptions, "issuerRef" | "privateKey">,
+    opts: Omit<CertificateOptions, "issuerRef">,
   ) {
     super(scope, id, {
       ...opts,
@@ -31,11 +31,6 @@ export class PrivateCertificate extends Certificate {
         name: "cluster-issuer", // internal CA
         kind: "ClusterIssuer",
       },
-      privateKey: {
-        algorithm: "ECDSA",
-        size: 384,
-      },
-      usages: ["digital signature", "key encipherment", "server auth"],
     });
   }
 }

utils/traefik/ingress/ingress.ts

@@ -2,7 +2,7 @@ import { Construct } from "constructs";
 import { Manifest } from "@cdktf/provider-kubernetes/lib/manifest";
 import { KubernetesProvider } from "@cdktf/provider-kubernetes/lib/provider";
 
-import { PrivateCertificate } from "../../cert-manager";
+import { CloudflareCertificate, PrivateCertificate } from "../../cert-manager";
 
 export type IngressRouteOptions = {
   provider: KubernetesProvider;
@@ -83,7 +83,6 @@ export class IngressRoute extends Construct {
       kind: "Rule",
       services: [
         {
-          namespace,
           name: opts.serviceName,
           port: opts.servicePort,
           scheme: opts.serviceProtocol ?? "http",
@@ -110,11 +109,15 @@ export class IngressRoute extends Construct {
     if (opts.tlsSecretName) {
       spec.tls = {
         secretName: opts.tlsSecretName,
-        options: {
-          name: "tls-options",
-          namespace: "homelab",
-        },
       };
+
+      new CloudflareCertificate(this, `${name}-cert`, {
+        provider,
+        namespace,
+        name: opts.host,
+        secretName: opts.tlsSecretName,
+        dnsNames: [opts.host],
+      });
     }
 
     this.manifest = new Manifest(this, name, {

utils/traefik/ingress/internalIngress.ts

@@ -1,16 +1,63 @@
 import { Construct } from "constructs";
 import { IngressRoute, IngressRouteOptions } from "./ingress";
+import { DataTerraformRemoteStateS3 } from "cdktf";
+import { DataKubernetesNamespaceV1 } from "@cdktf/provider-kubernetes/lib/data-kubernetes-namespace-v1";
 
-export class InternalIngressRoute extends IngressRoute {
-  constructor(
-    scope: Construct,
-    id: string,
-    opts: Omit<IngressRouteOptions, "entryPoints" | "middlewares">,
-  ) {
-    super(scope, id, {
-      ...opts,
+type InternalIngressRouteOptions = Omit<
+  IngressRouteOptions,
+  "entryPoints" | "tlsSecretName" | "middlewares"
+>;
+
+export class InternalIngressRoute extends Construct {
+  constructor(scope: Construct, id: string, opts: InternalIngressRouteOptions) {
+    super(scope, id);
+
+    const r2Endpoint = `${process.env.ACCOUNT_ID!}.r2.cloudflarestorage.com`;
+
+    const coreServicesState = new DataTerraformRemoteStateS3(
+      this,
+      "core-services-state",
+      {
+        usePathStyle: true,
+        skipRegionValidation: true,
+        skipCredentialsValidation: true,
+        skipRequestingAccountId: true,
+        skipS3Checksum: true,
+        encrypt: true,
+        bucket: "terraform-state",
+        key: "core-services/terraform.tfstate",
+        endpoints: {
+          s3: `https://${r2Endpoint}`,
+        },
+        region: "auto",
+        accessKey: process.env.ACCESS_KEY,
+        secretKey: process.env.SECRET_KEY,
+      },
+    );
+    const namespaceName = coreServicesState.getString("namespace-output");
+    const namespaceResource = new DataKubernetesNamespaceV1(
+      this,
+      "core-services-namespace",
+      {
+        provider: opts.provider,
+        metadata: {
+          name: namespaceName,
+        },
+      },
+    );
+    const namespace = namespaceResource.metadata.name;
+
+    new IngressRoute(this, opts.name, {
+      provider: opts.provider,
+      namespace: opts.namespace,
+      host: opts.host,
+      path: opts.path ?? "/",
+      serviceName: opts.serviceName,
+      servicePort: opts.servicePort,
       entryPoints: ["websecure"],
-      middlewares: ["homelab/ip-allow-list"],
+      tlsSecretName: `${opts.name}-tls`,
+      middlewares: [`${namespace}/ip-allow-list`],
+      name: opts.name,
     });
   }
 }

utils/traefik/ingress/publicIngress.ts

@@ -1,33 +1,64 @@
 import { Construct } from "constructs";
 import { IngressRoute, IngressRouteOptions } from "./ingress";
-import { CloudflareCertificate } from "../../cert-manager";
+import { DataTerraformRemoteStateS3 } from "cdktf";
+import { DataKubernetesNamespaceV1 } from "@cdktf/provider-kubernetes/lib/data-kubernetes-namespace-v1";
 
-export class PublicIngressRoute extends IngressRoute {
-  constructor(
-    scope: Construct,
-    id: string,
-    opts: Omit<
+type PublicIngressRouteOptions = Omit<
   IngressRouteOptions,
   "entryPoints" | "tlsSecretName" | "middlewares"
-    >,
-  ) {
-    const tlsSecretName = `${opts.name}-tls`;
+>;
 
-    super(scope, id, {
-      ...opts,
-      tlsSecretName,
+export class PublicIngressRoute extends Construct {
+  constructor(scope: Construct, id: string, opts: PublicIngressRouteOptions) {
+    super(scope, id);
+
+    const r2Endpoint = `${process.env.ACCOUNT_ID!}.r2.cloudflarestorage.com`;
+
+    const coreServicesState = new DataTerraformRemoteStateS3(
+      this,
+      "core-services-state",
+      {
+        usePathStyle: true,
+        skipRegionValidation: true,
+        skipCredentialsValidation: true,
+        skipRequestingAccountId: true,
+        skipS3Checksum: true,
+        encrypt: true,
+        bucket: "terraform-state",
+        key: "core-services/terraform.tfstate",
+        endpoints: {
+          s3: `https://${r2Endpoint}`,
+        },
+        region: "auto",
+        accessKey: process.env.ACCESS_KEY,
+        secretKey: process.env.SECRET_KEY,
+      },
+    );
+    const namespaceName = coreServicesState.getString("namespace-output");
+    const namespaceResource = new DataKubernetesNamespaceV1(
+      this,
+      "core-services-namespace",
+      {
+        provider: opts.provider,
+        metadata: {
+          name: namespaceName,
+        },
+      },
+    );
+    const namespace = namespaceResource.metadata.name;
+
+    new IngressRoute(this, opts.name, {
+      provider: opts.provider,
+      namespace: opts.namespace,
+      host: opts.host,
+      path: opts.path ?? "/",
+      serviceName: opts.serviceName,
+      servicePort: opts.servicePort,
+      serviceProtocol: opts.serviceProtocol,
       entryPoints: ["websecure"],
-      middlewares: ["homelab/rate-limit"],
-    });
-
-    const { provider, name, namespace, host } = opts;
-
-    new CloudflareCertificate(this, `${name}-cert`, {
-      provider,
-      namespace,
-      name: host,
-      secretName: tlsSecretName,
-      dnsNames: [host],
+      tlsSecretName: `${opts.name}-tls`,
+      middlewares: [`${namespace}/rate-limit`],
+      name: opts.name,
     });
   }
 }