mirror of
https://github.com/allaunthefox/SilverSight.git
synced 2026-07-30 17:16:16 +00:00
allaun
781578001d
- Add .sops.yaml (workstation + cluster age keys) - Add infra/secrets/homarr-values.enc.yaml (SOPS encrypted) - Add infra/secrets/authentik-values.enc.yaml (SOPS encrypted) - Add infra/secrets/webhook-secret.enc.yaml (SOPS encrypted) - Add infra/webhook/hooks.yaml (adnanh/webhook config) - Add infra/webhook/deploy.sh (SOPS decrypt + helm upgrade) - Add infra/webhook/deployment.yaml (k3s Deployment + RBAC) age keys: workstation: age17nzzwaftrkcuerlt4vq2eh98fdfxnv3eqykdxf5c3hqa0pvc2uhq26dxeq cluster: age1s6t5qpt0h7xlj98zkza0e7pjzj686k38xdu7jrz0nsreaw092drq4v7h02 Cluster private key stored only in k8s secret sops-age (namespace: infra).
52 lines
1.6 KiB
Bash
52 lines
1.6 KiB
Bash
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
REPO="${1:-}"
|
|
if [[ -z "$REPO" ]]; then
|
|
echo "Usage: $0 <repo-name>" >&2
|
|
exit 1
|
|
fi
|
|
|
|
export SOPS_AGE_KEY_FILE="/secrets/age.agekey"
|
|
SECRETS_DIR="/repos/SilverSight/infra/secrets"
|
|
KUBECONFIG="/etc/rancher/k3s/k3s.yaml"
|
|
|
|
log() { echo "[$(date -u +%H:%M:%S)] $*"; }
|
|
|
|
log "Deploy triggered for repo: $REPO"
|
|
|
|
# Pull latest from git
|
|
cd "/repos/SilverSight"
|
|
git fetch origin main && git reset --hard origin/main
|
|
log "Git updated to $(git rev-parse --short HEAD)"
|
|
|
|
case "$REPO" in
|
|
SilverSight)
|
|
# Homarr
|
|
if [[ -f "$SECRETS_DIR/homarr-values.enc.yaml" ]]; then
|
|
log "Deploying Homarr..."
|
|
sops --decrypt --output-type yaml "$SECRETS_DIR/homarr-values.enc.yaml" > /tmp/homarr-values.yaml
|
|
helm upgrade --install homarr oci://ghcr.io/homarr-labs/charts/homarr \
|
|
--namespace homarr --kubeconfig "$KUBECONFIG" \
|
|
-f /tmp/homarr-values.yaml --wait --timeout 4m
|
|
rm -f /tmp/homarr-values.yaml
|
|
log "Homarr deployed ✅"
|
|
fi
|
|
|
|
# Authentik
|
|
if [[ -f "$SECRETS_DIR/authentik-values.enc.yaml" ]]; then
|
|
log "Deploying Authentik..."
|
|
sops --decrypt --output-type yaml "$SECRETS_DIR/authentik-values.enc.yaml" > /tmp/authentik-values.yaml
|
|
helm upgrade --install authentik oci://ghcr.io/goauthentik/helm-charts/authentik \
|
|
--namespace authentik --kubeconfig "$KUBECONFIG" \
|
|
-f /tmp/authentik-values.yaml --wait --timeout 8m
|
|
rm -f /tmp/authentik-values.yaml
|
|
log "Authentik deployed ✅"
|
|
fi
|
|
;;
|
|
*)
|
|
log "No deploy handler for repo: $REPO"
|
|
;;
|
|
esac
|
|
|
|
log "Deploy complete."
|