feat(inbucket): Expose on tailnet

kubenix-modules/bootstrap-default.nix

@@ -27,11 +27,6 @@
           };
         };
       };
-
-      # argo-workflows = {
-      #   chart = nixhelm.chartsDerivations.${system}.argoproj.argo-workflows;
-      #   includeCRDs = true;
-      # };
     };
 
     resources = {

kubenix-modules/custom/default.nix

@@ -2,6 +2,5 @@
   imports = [
     ./ingress.nix
     ./longhorn-volume.nix
-    ./nfs-volume.nix
   ];
 }

kubenix-modules/custom/nfs-volume.nix

@@ -1,47 +0,0 @@
-{ lib, config, ... }:
-let
-  nfsVolumeOpts = { name, ... }: {
-    options = {
-      path = lib.mkOption {
-        type = lib.types.str;
-      };
-    };
-  };
-in
-{
-  options = {
-    lab.nfsVolumes = lib.mkOption {
-      type = with lib.types; attrsOf (submodule nfsVolumeOpts);
-      default = { };
-    };
-  };
-
-  config = {
-    kubernetes.resources = {
-      persistentVolumes = builtins.mapAttrs
-        (name: nfsVolume: {
-          spec = {
-            capacity.storage = "1Mi";
-            accessModes = [ "ReadWriteMany" ];
-
-            nfs = {
-              server = "lewis.dmz";
-              path = "/mnt/longhorn/persistent/${nfsVolume.path}";
-            };
-          };
-        })
-        config.lab.nfsVolumes;
-
-      persistentVolumeClaims = builtins.mapAttrs
-        (name: nfsVolume: {
-          spec = {
-            accessModes = [ "ReadWriteMany" ];
-            storageClassName = "";
-            resources.requests.storage = "1Mi";
-            volumeName = name;
-          };
-        })
-        config.lab.nfsVolumes;
-    };
-  };
-}

kubenix-modules/inbucket.nix

@@ -1,5 +1,42 @@
-{ myLib, ... }: {
+{ myLib, ... }:
+let
+  # TODO: make module of this.
+  tailscaleSecretName = "tailscale-auth";
+  inbucketSAName = "inbucket";
+in
+{
   kubernetes.resources = {
+    secrets.${tailscaleSecretName}.stringData.TS_AUTHKEY = "ref+sops://secrets/kubernetes.yaml#/tailscale/authKey";
+
+    roles.tailscale.rules = [
+      {
+        apiGroups = [ "" ];
+        resources = [ "secrets" ];
+        verbs = [ "create" ];
+      }
+      {
+        apiGroups = [ "" ];
+        resourceNames = [ tailscaleSecretName ];
+        resources = [ "secrets" ];
+        verbs = [ "get" "update" "patch" ];
+      }
+    ];
+
+    roleBindings.inbucket-tailscale = {
+      subjects = [{
+        kind = "ServiceAccount";
+        name = inbucketSAName;
+      }];
+
+      roleRef = {
+        kind = "Role";
+        name = "tailscale";
+        apiGroup = "rbac.authorization.k8s.io";
+      };
+    };
+
+    serviceAccounts.${inbucketSAName} = { };
+
     deployments.inbucket.spec = {
       selector.matchLabels.app = "inbucket";
 
@@ -7,12 +44,37 @@
         metadata.labels.app = "inbucket";
 
         spec = {
-          containers.inbucket = {
-            image = "inbucket/inbucket:edge";
+          serviceAccountName = inbucketSAName;
 
-            ports = {
-              web.containerPort = 9000;
-              smtp.containerPort = 2500;
+          containers = {
+            inbucket = {
+              image = "inbucket/inbucket:edge";
+
+              env.INBUCKET_WEB_ADDR.value = "0.0.0.0:80";
+
+              ports = {
+                web.containerPort = 80;
+                smtp.containerPort = 2500;
+              };
+            };
+
+            tailscale-sidecar = {
+              imagePullPolicy = "Always";
+              image = "ghcr.io/tailscale/tailscale:latest";
+
+              env = {
+                TS_HOSTNAME.value = "inbucket";
+                TS_KUBE_SECRET.value = tailscaleSecretName;
+                TS_USERSPACE.value = "false";
+                TS_DEBUG_FIREWALL_MODE.value = "auto";
+                TS_AUTHKEY.valueFrom.secretKeyRef = {
+                  name = tailscaleSecretName;
+                  key = "TS_AUTHKEY";
+                  optional = true;
+                };
+              };
+
+              securityContext.capabilities.add = [ "NET_ADMIN" ];
             };
           };
         };
@@ -21,6 +83,8 @@
 
     services = {
       web.spec = {
+        type = "LoadBalancer";
+        loadBalancerIP = myLib.globals.inbucketWebIPv4;
         selector.app = "inbucket";
 
         ports.web = {
@@ -31,7 +95,7 @@
 
       email.spec = {
         type = "LoadBalancer";
-        loadBalancerIP = myLib.globals.inbucketIPv4;
+        loadBalancerIP = myLib.globals.inbucketEmailIPv4;
         selector.app = "inbucket";
 
         ports = [{
@@ -41,14 +105,4 @@
       };
     };
   };
-
-  lab.ingresses.inbucket = {
-    host = "inbucket.kun.is";
-    entrypoint = "localsecure";
-
-    service = {
-      name = "web";
-      portName = "web";
-    };
-  };
 }