Snarf/homelab-gitops
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
7c39a30ecb8dd793abb2f2529c72f2792172e93d
homelab-gitops/manifests/spaceport/dns/dns-stack.yaml

377 lines
9.1 KiB
YAML
Raw Blame History

apiVersion: v1
kind: Namespace
metadata:
name: dns
---
# -------------------------------------------------------------
# Persistent Volumes for Technitium & Pi-hole (Longhorn)
# -------------------------------------------------------------
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: technitium-config-pvc
namespace: dns
spec:
accessModes:
- ReadWriteOnce
storageClassName: longhorn
resources:
requests:
storage: 5Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pihole-etc-pvc
namespace: dns
spec:
accessModes:
- ReadWriteOnce
storageClassName: longhorn
resources:
requests:
storage: 5Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pihole-dnsmasq-pvc
namespace: dns
spec:
accessModes:
- ReadWriteOnce
storageClassName: longhorn
resources:
requests:
storage: 2Gi
---
# -------------------------------------------------------------
# Technitium DNS Server (Authoritative, Recursive & DoH Upstream)
# -------------------------------------------------------------
apiVersion: apps/v1
kind: Deployment
metadata:
name: technitium-dns
namespace: dns
labels:
app: technitium-dns
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: technitium-dns
template:
metadata:
labels:
app: technitium-dns
spec:
containers:
- name: technitium-dns
image: technitium/dns-server:latest
imagePullPolicy: IfNotPresent
env:
- name: DNS_SERVER_ADMIN_PASSWORD
value: "snarfnetadmin"
- name: DNS_SERVER_FORWARDERS
value: "https://dns.quad9.net/dns-query,https://1.1.1.1/dns-query"
- name: DNS_SERVER_PREFER_IPV6
value: "false"
- name: DNS_SERVER_LOG_USING_LOCAL_TIME
value: "true"
- name: DNS_SERVER_SSO_ENABLED
value: "true"
- name: DNS_SERVER_SSO_AUTHORITY
value: "https://authentik.snarfnet.net/application/o/dns2/"
- name: DNS_SERVER_SSO_METADATA_ADDRESS
value: "https://authentik.snarfnet.net/application/o/dns2/.well-known/openid-configuration"
- name: DNS_SERVER_SSO_CLIENT_ID
value: "technitium2-dns-oidc"
- name: DNS_SERVER_SSO_CLIENT_SECRET
value: "SnarfNetTechnitiumOIDC2026!"
- name: DNS_SERVER_SSO_SCOPES
value: "openid,profile,email"
- name: DNS_SERVER_SSO_ALLOW_SIGNUP
value: "true"
- name: DNS_SERVER_SSO_ALLOW_SIGNUP_ONLY_FOR_MAPPED_USERS
value: "false"
- name: DNS_SERVER_SSO_GROUP_MAP
value: "authentik Admins:Administrators"
ports:
- name: dns-udp
containerPort: 53
protocol: UDP
- name: dns-tcp
containerPort: 53
protocol: TCP
- name: web-http
containerPort: 5380
protocol: TCP
volumeMounts:
- name: technitium-config
mountPath: /etc/dns
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
cpu: 1000m
memory: 1024Mi
volumes:
- name: technitium-config
persistentVolumeClaim:
claimName: technitium-config-pvc
---
apiVersion: v1
kind: Service
metadata:
name: technitium-service
namespace: dns
labels:
app: technitium-dns
spec:
type: ClusterIP
selector:
app: technitium-dns
ports:
- name: dns-udp
port: 53
targetPort: 53
protocol: UDP
- name: dns-tcp
port: 53
targetPort: 53
protocol: TCP
- name: web-http
port: 5380
targetPort: 5380
protocol: TCP
---
# -------------------------------------------------------------
# Pi-hole (Front-end Filtering, Caching & Ad-blocking)
# -------------------------------------------------------------
apiVersion: apps/v1
kind: Deployment
metadata:
name: pihole
namespace: dns
labels:
app: pihole
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: pihole
template:
metadata:
labels:
app: pihole
spec:
containers:
- name: pihole
image: pihole/pihole:latest
imagePullPolicy: IfNotPresent
env:
- name: TZ
value: "America/New_York"
- name: FTLCONF_rateLimit
value: "0/0"
- name: FTLCONF_dns_upstreams
value: "technitium-service.dns.svc.cluster.local#53"
- name: FTLCONF_dns_listeningMode
value: "all"
- name: FTLCONF_dns_dnssec
value: "false"
- name: FTLCONF_webserver_port
value: "80"
ports:
- name: dns-udp
containerPort: 53
protocol: UDP
- name: dns-tcp
containerPort: 53
protocol: TCP
- name: http
containerPort: 80
protocol: TCP
volumeMounts:
- name: pihole-etc
mountPath: /etc/pihole
- name: pihole-dnsmasq
mountPath: /etc/dnsmasq.d
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
cpu: 1000m
memory: 1024Mi
volumes:
- name: pihole-etc
persistentVolumeClaim:
claimName: pihole-etc-pvc
- name: pihole-dnsmasq
persistentVolumeClaim:
claimName: pihole-dnsmasq-pvc
---
# -------------------------------------------------------------
# MetalLB LoadBalancer VIP on Port 53 (Spaceport Secondary: 140.44.4.65)
# -------------------------------------------------------------
apiVersion: v1
kind: Service
metadata:
name: pihole-dns-vip
namespace: dns
annotations:
metallb.universe.tf/loadBalancerIPs: 140.44.4.65
metallb.universe.tf/allow-shared-ip: "spaceport-dns-key"
labels:
app: pihole
spec:
type: LoadBalancer
selector:
app: pihole
ports:
- name: dns-udp
port: 53
targetPort: 53
protocol: UDP
- name: dns-tcp
port: 53
targetPort: 53
protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
name: pihole-web-service
namespace: dns
labels:
app: pihole
spec:
type: ClusterIP
selector:
app: pihole
ports:
- name: web-http
port: 80
targetPort: 80
protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
name: technitium-web-vip
namespace: dns
annotations:
metallb.universe.tf/loadBalancerIPs: 140.44.4.65
metallb.universe.tf/allow-shared-ip: "spaceport-dns-key"
labels:
app: technitium-dns
spec:
type: LoadBalancer
selector:
app: technitium-dns
ports:
- name: web-http
port: 5380
targetPort: 5380
protocol: TCP
---
# -------------------------------------------------------------
# Traefik Redirect Middleware (Root to /admin/)
# -------------------------------------------------------------
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: pihole-redirect
namespace: dns
spec:
redirectRegex:
regex: "^https?://([^/]+)/?$"
replacement: "https://${1}/admin/"
permanent: false
---
# -------------------------------------------------------------
# Traefik ForwardAuth Middleware (Authentik Outpost)
# -------------------------------------------------------------
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: authentik-forwardauth
namespace: dns
spec:
forwardAuth:
address: https://authentik.snarfnet.net/outpost.goauthentik.io/auth/traefik
authResponseHeaders:
- X-authentik-username
- X-authentik-groups
- X-authentik-email
- X-authentik-name
- X-authentik-uid
trustForwardHeader: true
---
# -------------------------------------------------------------
# Pi-hole Web Ingress (TLS + Authentik ForwardAuth + Root Redirect)
# -------------------------------------------------------------
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: pihole-ingress
namespace: dns
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.middlewares: dns-authentik-forwardauth@kubernetescrd,dns-pihole-redirect@kubernetescrd
spec:
ingressClassName: traefik
rules:
- host: pihole2.snarfnet.net
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: pihole-web-service
port:
number: 80
tls:
- hosts:
- pihole2.snarfnet.net
secretName: tls-snarfnet-wildcard
---
# -------------------------------------------------------------
# Technitium Web Ingress (TLS + Native OIDC)
# -------------------------------------------------------------
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: technitium-ingress
namespace: dns
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.tls: "true"
spec:
ingressClassName: traefik
rules:
- host: dns2.snarfnet.net
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: technitium-web-vip
port:
number: 5380
tls:
- hosts:
- dns2.snarfnet.net
secretName: tls-snarfnet-wildcard
Reference in New Issue View Git Blame Copy Permalink