chore: enable access to gitea

- add gitea to gitea-dl remote

apps/base/artifactapi/resources/conf.d/remote-generic.yaml

@@ -81,6 +81,8 @@ remotes:
     description: "Gitea download site"
     immutable_patterns:
       - "act_runner/.*/act_runner-.*-linux-amd64$"
+      - "gitea/.*/gitea-.*-linux-amd64$"
+      - "gitea/.*/gitea-.*-linux-amd64.xz$"
       - "tea/.*/tea-.*-linux-amd64$"
     cache:
       immutable_ttl: 0

apps/base/artifactapi/resources/conf.d/remote-rpm.yaml

@@ -17,6 +17,24 @@ remotes:
       immutable_ttl: 0
       mutable_ttl: 7200
 
+  almalinux-vault:
+    base_url: "https://vault.almalinux.org"
+    package: "rpm"
+    description: "AlmaLinux Vault RPM package repository"
+    immutable_patterns:
+      - ".*/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.sqlite.*$"
+      - ".*/repodata/.*\\.xml.*$"
+      - ".*/repodata/.*\\.yaml.*$"
+      - ".*/install.img"
+      - ".*/squashfs.img"
+      - ".*/updates.img"
+      - ".*/RPM-GPG-KEY-.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
   ceph-reef:
     base_url: "https://download.ceph.com/rpm-reef/"
     package: "rpm"

apps/base/kanidm/kustomization.yaml

@@ -25,5 +25,3 @@ configMapGenerator:
         app.kubernetes.io/instance: kanidm
     files:
       - server-0.toml=resources/server-0.toml
-      - server-1.toml=resources/server-1.toml
-      - server-2.toml=resources/server-2.toml

apps/base/kanidm/resources/server-0.toml

@@ -13,7 +13,3 @@ log_level = "info"
 path = "/data/backups/"
 schedule = "0 22 * * *"
 versions = 7
-
-[replication]
-origin = "repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"
-bindaddress = "[::]:8444"

apps/base/kanidm/resources/server-1.toml

@@ -1,19 +0,0 @@
-version = "2"
-
-domain = "auth.unkin.net"
-origin = "https://auth.unkin.net"
-bindaddress = "[::]:8443"
-db_path = "/data/kanidm.db"
-db_arc_size = 2048
-tls_chain = "/data/tls/tls.crt"
-tls_key = "/data/tls/tls.key"
-log_level = "info"
-
-[online_backup]
-path = "/data/backups/"
-schedule = "0 22 * * *"
-versions = 7
-
-[replication]
-origin = "repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"
-bindaddress = "[::]:8444"

apps/base/kanidm/resources/server-2.toml

@@ -1,19 +0,0 @@
-version = "2"
-
-domain = "auth.unkin.net"
-origin = "https://auth.unkin.net"
-bindaddress = "[::]:8443"
-db_path = "/data/kanidm.db"
-db_arc_size = 2048
-tls_chain = "/data/tls/tls.crt"
-tls_key = "/data/tls/tls.key"
-log_level = "info"
-
-[online_backup]
-path = "/data/backups/"
-schedule = "0 22 * * *"
-versions = 7
-
-[replication]
-origin = "repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"
-bindaddress = "[::]:8444"

apps/base/kanidm/service.yaml

@@ -9,6 +9,10 @@ metadata:
     app.kubernetes.io/instance: kanidm
 spec:
   type: ClusterIP
+  sessionAffinity: ClientIP
+  sessionAffinityConfig:
+    clientIP:
+      timeoutSeconds: 10800
   ports:
     - name: https
       port: 8443
@@ -34,10 +38,6 @@ spec:
       port: 8443
       targetPort: https
       protocol: TCP
-    - name: replication
-      port: 8444
-      targetPort: replication
-      protocol: TCP
   selector:
     app.kubernetes.io/name: kanidm
     app.kubernetes.io/instance: kanidm

apps/base/kanidm/statefulset.yaml

@@ -11,7 +11,7 @@ metadata:
     app.kubernetes.io/instance: kanidm
 spec:
   serviceName: kanidm-headless
-  replicas: 3
+  replicas: 1
   selector:
     matchLabels:
       app.kubernetes.io/name: kanidm
@@ -23,52 +23,11 @@ spec:
         app.kubernetes.io/instance: kanidm
     spec:
       serviceAccountName: kanidm
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchLabels:
-                  app.kubernetes.io/name: kanidm
-                  app.kubernetes.io/instance: kanidm
-              topologyKey: kubernetes.io/hostname
       securityContext:
         runAsUser: 1000
         runAsGroup: 1000
         runAsNonRoot: true
         fsGroup: 1000
-      initContainers:
-        - name: config-init
-          image: busybox:1.36
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              set -e
-              cp "/config-template/server-${POD_NAME##*-}.toml" /config/server.toml
-              for peer in kanidm-0 kanidm-1 kanidm-2; do
-                [ "${peer}" = "${POD_NAME}" ] && continue
-                cert_file="/repl-certs/${peer}"
-                [ -s "${cert_file}" ] || continue
-                fqdn="${peer}.kanidm-headless.kanidm.svc.cluster.local"
-                printf '\n[replication."repl://%s:8444"]\ntype = "mutual-pull"\npartner_cert = "%s"\n' \
-                  "${fqdn}" "$(cat ${cert_file})" >> /config/server.toml
-              done
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-          volumeMounts:
-            - name: config-template
-              mountPath: /config-template
-              readOnly: true
-            - name: config
-              mountPath: /config
-            - name: repl-certs
-              mountPath: /repl-certs
-              readOnly: true
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
       containers:
         - name: kanidm
           image: kanidm/server:1.10.3
@@ -78,14 +37,12 @@ spec:
             - name: https
               containerPort: 8443
               protocol: TCP
-            - name: replication
-              containerPort: 8444
-              protocol: TCP
           volumeMounts:
             - name: data
               mountPath: /data
             - name: config
-              mountPath: /config
+              mountPath: /config/server.toml
+              subPath: server-0.toml
               readOnly: true
             - name: tls
               mountPath: /data/tls
@@ -111,14 +68,9 @@ spec:
             initialDelaySeconds: 30
             periodSeconds: 30
       volumes:
-        - name: config-template
+        - name: config
           configMap:
             name: kanidm-config
-        - name: config
-          emptyDir: {}
-        - name: repl-certs
-          secret:
-            secretName: kanidm-repl-certs
         - name: tls
           secret:
             secretName: kanidm-tls

apps/base/kanidm/vaultstaticsecret.yaml

@@ -18,3 +18,6 @@ spec:
     create: true
     overwrite: true
   hmacSecretData: true
+  rolloutRestartTargets:
+    - kind: StatefulSet
+      name: kanidm