Repo for the Weebo5 GitOps
- HCL 62.5%
- Go 22.3%
- Go Template 13.1%
- Shell 1.7%
- Dockerfile 0.4%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
| .docs | ||
| .hooks | ||
| .task | ||
| .tmp | ||
| .vscode | ||
| 0.config | ||
| 0.pulumi | ||
| 0.pulumi-conf | ||
| 0.script | ||
| 1.argo | ||
| 1.helm | ||
| 2.app/monofolio | ||
| .default-go-packages | ||
| .env.global | ||
| .gitignore | ||
| cog.toml | ||
| mise.toml | ||
| Readme.md | ||
| Taskfile.yaml | ||
Weebo 5 Production upgrade
This is the base project for the Weebo 5 production upgrade.
Exist in V4 and need to be upgraded in V5
- SSO Provider
- Secret Storage
- OLD: Vault x BankVault
- NEW: OpenBao or Vault x BankVault x Kubernetes External Secrets
- Add support for numberly/vault-db-injector and migrate existing connection to it
- Monitoring X Logging
- Git Stack
- GitOps - ArgoCD
- Registry - Harbor
- VPN
- OLD : WireGuard
- NEW : NetBird
- Output Node setup with Strict Routing and DNS filtering through Blocky (Thanks SoulKyu/cpg that made the debugging of this super easy)
- DNS
- OLD: Bind9
- NEW:
- Public : Bind9 x ExternalDNS
- Look at Bindy to see if i can replace the combo external-dns + bind9 with it (for now the combo match all my need)
- Private :
- Ingress
- CNI - Cilium
- !TODO: Message a moi meme pour demain, passer en netpol strict avec zero ouverture by default, et n'ouvrir que ce qui est nécessaire
- Eclipse Che
- Tofu Hooks - Translate Terraform Hooks to Tofu one
- CertManager x DNS01-rfc2136
- Rybbit - For tracking
- VaultWarden - For password management
- Gestionaire de Favoris
- Stalward MAIL https://stalw.art/docs/cluster/orchestration/kubernetes/ https://github.com/bilbilak/terraform-provider-stalwart-mail
- KubeArmor
- Mise en place alternative Sonarqube
- Basic Monitoring
- OLD: Uptime Kuma
- New: Gatus
- Matrix
- OLD: Element
- NEW: Tuwunel when OIDC support will be ready
- Matrix Voice
- Matrix Webhook
- Deploy element-web
- Mise en place d'une alternative a Sonarqube pour l'analyse de code statique, a voir si on peut faire quelque chose avec CodeQL ou OpenGrep
- Comment stocker les résultats des analyse (Sarif ?) Forgejo ? Dashboard tierce ?
- Notification
- OLD: Gotify
- NEW: Gotify but with Oidc Support, waiting for Android Support and Documentation to be merged
- Ssh proxy
- Forward ssh connection to selected ressources with SshPiper
- If username == git then forward to git server
- If username == Another thing then forward to something that answer to GTFO
- Forward ssh connection to selected ressources with SshPiper
- RustFS - For S3 compatible storage
- Mise en place de Backup
- VaultWarden
- Tuwunel
- Git
- Vault : Si clef venant de l'extérieur, sinon pas besoin de backup étant donné que 90% des secrets sont générés via Terraform et que les autres sont des secrets de service qui peuvent être régénérés facilement
- A ne pas backup
- Rybbit (c'est juste pour le tracking, pas besoin de backup)
- CertManager (c'est juste pour la gestion des certificats, pas besoin de backup)
- Traefik
- Blocky (Stateless)
- Bind9 (Stateless)
- NetBird (Facile a reconstruire, pas besoin de backup)
- Coroot (Facile a reconstruire, pas besoin de backup)
- Grafana (Stateless, pas besoin de backup)
- Authentik (Facile a reconstruire, pas besoin de backup)
- Vault (Facile a reconstruire, pas besoin de backup sauf pour d'éventuelle clef externe)
- Harbor (Image facilement reconstruite ou provenant d'un cache, pas besoin de backup)
Folder WF
- .* - Global folder
- 0.* - Install folder
- 1.* - Infra folder
- 1.argo - ArgoCD folder, dedicated to infra related ressources deployed directly by ArgoCD
- 1.helm - Helm folder, dedicated to special Helm charts rewriting public one that i don't like/too limited for my use case/too long to be merged in the original one
- 2.* - Apps folder - dedicated for app comming from outside of the scope (like external secret setup, personal project, etc ...)
- 3.* - Post-install folder