feat(apps): Put garage-ui behind anubis

apps/garage-ui/anubis-key-sealedsecret.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: anubis-key
+  namespace: garage
+spec:
+  encryptedData:
+    ED25519_PRIVATE_KEY_HEX: AgCviDZEvLfdKldhAtWubXmCxvCym6nEFBERMBDbfMftsCQdRdWFwAZ3IkQF5PqyBCjZ8jirQMttmXqL1GNKvJfEDkK4rwwYGkLpRM56IpRtkGhGHgYQOIYTa9RHzJm5OjPKnVppCRpb4Qe2MKczg8Uhp7Z3hW1HMDzK85Rzn2k41qcGqMRwEgDdmFVJxB9gviM76jcrgjnyNJvoIMinNwqRdTHmXnY451xDkBofEzkTXZC7plW42/3Vz/66bdqtHCmM68hZJkluki86ubHJqPIMuA55BJM7CRJTgKhk5va4Ex3j4RlTSF7ai+EGmF+jq6ls8Dn1QU12Osak97MulOEyCBHBQg3nnu5TZoFJKWT/Bgg0M9r1RuFyr6mrphVu6yMIIiROcyl95E3LjtMVC4o7+tWgkYmIOjYafQdpf7p6I2QPG4P6o/6qkEUWL1tqqYjk9RZ+OuOuBWe399in4OnRgfV+ZOJcCKXIsgbW1uVAiQL3lGMGI9/sDLxKtimpybGOX5F9f3O7mqFZ7FzkdvhgUtWkY+PUJIZHFNUSlF+ttmrj3wtq4JOpFdPYZqcnTCFFtwk+yDos8YWWjF0TX1RhM8Yq/+VBOVVaJnlhaolIKHiMds5JBGypsPjEBmP9fJ1ip4TjCyCP3p1/YscksgqjUWOCeASO9b50ce0OJzL9yHMGurffianLWR768q/1Zi5WQv6B9vJxCICa9TCCYgLOz0LUu0iiMd5hlPX0/i4gWi9KykIcSYHJ/RuE9+4jaqkYsTyhOipKPpkpjsqou9y1
+  template:
+    metadata:
+      name: anubis-key
+      namespace: garage

apps/garage-ui/anubis-proxy.yaml

@@ -0,0 +1,44 @@
+apiVersion: anubis.techaro.dev/v1alpha1
+kind: AnubisProxy
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: anubis
+  namespace: garage
+spec:
+  anubis:
+    envExtra:
+      - name: DIFFICULTY
+        value: "5"
+      - name: SERVE_ROBOTS_TXT
+        value: "true"
+      - name: COOKIE_DOMAIN
+        value: garage.whyredfire.dev
+      - name: REDIRECT_DOMAINS
+        value: garage.whyredfire.dev
+      - name: COOKIE_PARTITIONED
+        value: "true"
+      - name: COOKIE_HTTP_ONLY
+        value: "true"
+      - name: COOKIE_SAME_SITE
+        value: Lax
+      - name: DIFFICULTY_IN_JWT
+        value: "true"
+    image:
+      tag: v1.26.2
+    keys:
+      existingSecret: anubis-key
+    metrics:
+      enabled: false
+    persistence:
+      enabled: false
+    resources:
+      limits:
+        memory: 128Mi
+      requests:
+        cpu: 50m
+        memory: 64Mi
+  target:
+    service:
+      name: garage-ui
+      port: 80

apps/garage-ui/httproute.yaml

@@ -2,7 +2,7 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
   annotations:
-    argocd.argoproj.io/sync-wave: "1"
+    argocd.argoproj.io/sync-wave: "2"
   name: garage-ui
   namespace: garage
 spec:
@@ -15,7 +15,7 @@ spec:
       sectionName: websecure
   rules:
     - backendRefs:
-        - name: garage-ui
+        - name: anubis
           port: 80
       matches:
         - path:

apps/garage-ui/kustomization.yaml

@@ -2,4 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
+  - anubis-key-sealedsecret.yaml
+  - anubis-proxy.yaml
   - httproute.yaml