feat(apps): Add pgweb

add-ons/authentik/blueprint-outpost.yaml

@@ -14,6 +14,11 @@ data:
           identifiers:
             path: mounted/cm-blueprint-garage-ui/garage-ui.yaml
           required: true
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: mounted/cm-blueprint-pgweb/pgweb.yaml
+          required: true
       - model: authentik_blueprints.metaapplyblueprint
         attrs:
           identifiers:
@@ -26,4 +31,5 @@ data:
         attrs:
           providers:
             - !Find [authentik_providers_proxy.proxyprovider, [name, garage-ui]]
+            - !Find [authentik_providers_proxy.proxyprovider, [name, pgweb]]
             - !Find [authentik_providers_proxy.proxyprovider, [name, qbittorrent]]

add-ons/authentik/blueprint-pgweb.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-pgweb
+  namespace: authentik
+data:
+  pgweb.yaml: |
+    version: 1
+    metadata:
+      name: pgweb
+    entries:
+      - model: authentik_providers_proxy.proxyprovider
+        id: pgweb-provider
+        identifiers:
+          name: pgweb
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          mode: forward_single
+          external_host: https://pgweb.whyredfire.dev
+      - model: authentik_core.application
+        id: pgweb
+        identifiers:
+          slug: pgweb
+        attrs:
+          name: pgweb
+          provider: !KeyOf pgweb-provider
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf pgweb
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/kustomization.yaml

@@ -7,6 +7,7 @@ resources:
   - blueprint-google-login.yaml
   - blueprint-grafana.yaml
   - blueprint-outpost.yaml
+  - blueprint-pgweb.yaml
   - blueprint-qbittorrent.yaml
   - blueprint-wireguard-admin.yaml
   - httproute.yaml

add-ons/authentik/referencegrant.yaml

@@ -8,6 +8,9 @@ spec:
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
       namespace: garage
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: pgweb
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
       namespace: qbit

add-ons/postgres/cluster.yaml

@@ -24,6 +24,13 @@ spec:
         name: legislative
         passwordSecret:
           name: legislative-db
+      - ensure: present
+        inRoles:
+          - pg_read_all_data
+        login: true
+        name: pgweb
+        passwordSecret:
+          name: pgweb-db
       - ensure: present
         login: true
         name: redoost
@@ -31,8 +38,12 @@ spec:
           name: redoost-db
   postgresql:
     # Each app role may only connect to the database of the same name.
+    # pgweb is read-only and may browse every database except authentik's,
+    # which holds credentials and session tokens.
     pg_hba:
       - host sameuser all all scram-sha-256
+      - host authentik pgweb all reject
+      - host all pgweb all scram-sha-256
       - host all all all reject
   resources:
     limits:

add-ons/postgres/kustomization.yaml

@@ -8,5 +8,6 @@ resources:
   - grafana-database.yaml
   - legislative-db-sealedsecret.yaml
   - legislative-database.yaml
+  - pgweb-db-sealedsecret.yaml
   - redoost-db-sealedsecret.yaml
   - redoost-database.yaml

add-ons/postgres/pgweb-db-sealedsecret.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: pgweb-db
+  namespace: postgres
+spec:
+  encryptedData:
+    password: AgBOEIc6OuRugdd6OZGVRCFItD5XUaHxrRSfh4VDc5JION8/p+5KBlXd8wtHzNyGXCxHIFnenkGxWEZKWiaMAQS9v/At6tMJFRQYYwRHzFPx1u16H3lzmnE5+GgUhmoIayiRkhLA4Qs9aub/+mSzIW3sPo5RykLzhGZbnVbF0y7jQ39X01Sb6UFVJBGBXFjHuBkM9B5Iep01EgCM4a7SpWVgn0+kPzopfABbjJKAQM1ah0DMaXTFMCkKm2N0/e5KyGw1FNWC+Aor8mVkm6irCz9O2rFBJ3b/jY44cEoJ7zVIAfGN8y1HxTGOrVuBb7LkfrYTxIVVAT2CrxUaEdutAlGXgWyXmJ+wMgiQ4qds5rD5+T5ePdErCAiY74Jb8LWuyuZXG0uI/lGL0QTECcNiXJ/dvX8PNuq+L+Y6IZTK+WgxBvJXIgsfs2a3QyT7vIaB/k8QTQ7uF2KBBV1ol/cXhW45Dewu8yWz9Sjhb2roK1yNHvCiZaS79sUo9VPjEhGKZ3TcyWvi+eqWMFsLLxmXCz4wefU1XO83aLg8oPqZkfbo1IhcUC6oonv1dLX/jTy8RKudCPbkrytrlffKoVZ4aLhi+3ehkPY1d2J1oa1Nmmu2Vr5wDEXxtvQwtBJavB80ep5/esv89EYqjYYJglzUm4UBMv18v50E0dpGymem6mx/5yG5Ym+RI1hvE37x2Ed5GO9rX29BAjqob3H69Jd44OVlAuF6/Gz4fwVstPexi9gEbp2m2Mpiz+WOtrww2ofktENCKi211Qr+woc9h4Tq4DGI
+    username: AgAAdKsgTKEFmQTw0VxAdiocOEaT9WbTurBlaQVpdvneGMry2A6iAmKvrszFT1RaG+Iy0nRtxu1XM8bkpn5QDML0H6AB3O25QDrEOkhBd0feBBKjgaFCAwrcp64Wu3o8q+yEXTZcDJ5Ah3cXwvXDpc3PPMyvkDnIcGTqDKXEplJQY533NrE0iw3hPsBFztavb4QiH6Txlnq+JpPu/F2G++nRCcNh1kuaMG1kQ61IImj4xSdOoYDO7RLbIxA/cRcQYju4UkSliU2uMHTw4pDT7mDqP1GjSN/tvoezk9FjNHIgaBUg2WFk6cBzdLIFY/zafwchkUAeM0AX+kFpeAIhzRmI0uknyH8fuZWHkYxU07PuanE3kNJkhSbCQWQ0TtKTXCtccxgUYHaucskVk3ZC66cVJj+NCRQbV1lvUGaNHEuoF/lGueosdM5saCIChuidbJbJsmDIztf6OBBJM0nyOoQjV6cMwirXxO2Ap+vxb/tI5eLsoUkVORe/nxoiGF7P+529mv2S1KE7PWwd0A82s6A30RoovTmTyxFOTT2p9TmxYIzzzymiz52hRiGI4YBSDirajfGleOmxILDxWwLdiXpBhUNwgjaZ39taumgsZ+wyxxIaD6OxdHKGGI/u+fRyJMdvIITPn3CMbl16+MTwQkrvx/Qw7+52Pm5mp/gW5AQQqJHBSKdSGGosNYMV1Tx9UHHZ12GDnw==
+  template:
+    metadata:
+      labels:
+        cnpg.io/reload: "true"
+      name: pgweb-db
+      namespace: postgres
+    type: kubernetes.io/basic-auth