Reset git history for making manifests public

passbolt/httproute.yaml

@@ -0,0 +1,51 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: passbolt-route
+  namespace: passbolt
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: passbolt
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-public
+      namespace: envoy-gateway
+      sectionName: passbolt
+  hostnames:
+    - "passbolt.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            set:
+              - name: X-Forwarded-Host
+                value: "passbolt.jsme.be"
+              - name: X-Forwarded-Proto
+                value: https
+        - type: ResponseHeaderModifier
+          responseHeaderModifier:
+            set:
+              - name: Strict-Transport-Security
+                value: "max-age=31536000; includeSubDomains"
+              - name: X-Content-Type-Options
+                value: nosniff
+              - name: X-Frame-Options
+                value: SAMEORIGIN
+              - name: Referrer-Policy
+                value: strict-origin-when-cross-origin
+              - name: Permissions-Policy
+                value: "camera=(), microphone=(), geolocation=(), payment=()"
+      backendRefs:
+        - name: passbolt
+          port: 80
+          kind: Service
+          group: ""
+          weight: 1

passbolt/mariadb/mariadb-pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: passbolt-mariadb-pvc
+  namespace: passbolt
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: longhorn-static
+  resources:
+    requests:
+      storage: 15Gi

passbolt/mariadb/mariadb-svc.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: passbolt-mariadb
+  namespace: passbolt
+spec:
+  selector:
+    app: passbolt-mariadb 
+  ports:
+  - protocol: TCP
+    port: 3306
+    targetPort: 3306
+  type: ClusterIP 

passbolt/mariadb/mariadb.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  namespace: passbolt
+  name: passbolt-mariadb
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: passbolt-mariadb
+  serviceName: passbolt-mariadb
+  template:
+    metadata:
+      labels:
+        app: passbolt-mariadb
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 10
+      containers:
+        - name: passbolt-mariadb
+          image: mariadb:10.11 
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          volumeMounts:
+            - name: passbolt-mariadb-volume
+              mountPath: /var/lib/mysql
+          ports:
+            - containerPort: 3306 
+          env:
+            - name: MYSQL_RANDOM_ROOT_PASSWORD
+              value: "true"
+            - name: MYSQL_DATABASE
+              valueFrom:
+                secretKeyRef:
+                  name: passbolt-secrets
+                  key: db_name
+            - name: MYSQL_USER
+              valueFrom:
+                secretKeyRef:
+                  name: passbolt-secrets
+                  key: db_user
+            - name: MYSQL_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: passbolt-secrets
+                  key: db_password
+      volumes:
+        - name: passbolt-mariadb-volume
+          persistentVolumeClaim:
+            claimName: passbolt-mariadb-pvc

passbolt/passbolt/passbolt-gpg-pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: passbolt-gpg-pvc
+  namespace: passbolt
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 1Gi

passbolt/passbolt/passbolt-jwt-pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: passbolt-jwt-pvc
+  namespace: passbolt
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 1Gi

passbolt/passbolt/passbolt-nginx-configmap.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: passbolt-nginx-ssl
+  namespace: passbolt
+data:
+  passbolt-ssl.conf: |
+    # SSL disabled — TLS is terminated at the gateway

passbolt/passbolt/passbolt-svc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: passbolt
+  namespace: passbolt 
+spec:
+  selector:
+    app: passbolt
+  ports:
+    - name: http
+      protocol: TCP
+      port: 80
+      targetPort: 80
+  type: ClusterIP 

passbolt/passbolt/passbolt.yaml

@@ -0,0 +1,103 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  namespace: passbolt
+  name: passbolt
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: passbolt
+  serviceName: passbolt
+  template:
+    metadata:
+      labels:
+        app: passbolt
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 10
+      containers:
+        - name: passbolt
+          image: passbolt/passbolt:latest-ce
+          resources:
+            requests:
+              cpu: 200m
+              memory: 512Mi
+            limits:
+              cpu: 1000m
+              memory: 1Gi
+          volumeMounts:
+            - name: gpg-volume
+              mountPath: /etc/passbolt/gpg
+            - name: jwt-volume
+              mountPath: /etc/passbolt/jwt
+            - name: nginx-ssl
+              mountPath: /etc/nginx/snippets/passbolt-ssl.conf
+              subPath: passbolt-ssl.conf
+          ports:
+            - containerPort: 80
+          env:
+            - name: APP_FULL_BASE_URL
+              value: https://passbolt.jsme.be
+            - name: APP_DEFAULT_TIMEZONE
+              value: Europe/Brussels
+            - name: PASSBOLT_SECURITY_CSP
+              value: "default-src 'self'; script-src 'self' chrome-extension: moz-extension:; style-src 'self' 'unsafe-inline'; img-src 'self'; frame-src 'self' chrome-extension: moz-extension: https://*.duosecurity.com; connect-src 'self' chrome-extension: moz-extension:; worker-src 'self' chrome-extension: moz-extension:; frame-ancestors 'none'; form-action 'self' https://*.duosecurity.com"
+            - name: DATASOURCES_DEFAULT_PORT
+              valueFrom:
+                secretKeyRef:
+                  name: passbolt-secrets
+                  key: db_port
+            - name: DATASOURCES_DEFAULT_HOST
+              valueFrom:
+                secretKeyRef:
+                  name: passbolt-secrets
+                  key: db_host
+            - name: DATASOURCES_DEFAULT_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: passbolt-secrets
+                  key: db_user
+            - name: DATASOURCES_DEFAULT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: passbolt-secrets
+                  key: db_password
+            - name: DATASOURCES_DEFAULT_DATABASE
+              valueFrom:
+                secretKeyRef:
+                  name: passbolt-secrets
+                  key: db_name
+            - name: EMAIL_DEFAULT_FROM
+              value: passbolt@jsme.be
+            - name: EMAIL_TRANSPORT_DEFAULT_HOST
+              value: smtp.office365.com
+            - name: EMAIL_TRANSPORT_DEFAULT_PORT
+              value: "587"
+            - name: EMAIL_TRANSPORT_DEFAULT_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: passbolt-secrets
+                  key: smtp_username
+            - name: EMAIL_TRANSPORT_DEFAULT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: passbolt-secrets
+                  key: smtp_password
+            - name: EMAIL_TRANSPORT_DEFAULT_TLS
+              value: "true"
+            - name: PASSBOLT_KEY_EMAIL
+              value: passbolt@jsme.be
+            - name: PASSBOLT_GPG_SERVER_KEY_FINGERPRINT_FORCE
+              value: "true"
+      volumes:
+        - name: gpg-volume
+          persistentVolumeClaim:
+            claimName: passbolt-gpg-pvc
+        - name: jwt-volume
+          persistentVolumeClaim:
+            claimName: passbolt-jwt-pvc
+        - name: nginx-ssl
+          configMap:
+            name: passbolt-nginx-ssl
+

passbolt/ratelimit.yaml

@@ -0,0 +1,17 @@
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: passbolt-ratelimit
+  namespace: passbolt
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: passbolt-route
+  rateLimit:
+    type: Local
+    local:
+      rules:
+        - limit:
+            requests: 120
+            unit: Minute