From 923ecd3461b349b85a055716cb5468c2b047ff0a Mon Sep 17 00:00:00 2001 From: Karan Parashar Date: Sun, 27 Sep 2026 04:06:10 +0530 Subject: [PATCH] feat(apps): Add wireguard --- apps/wireguard/configmap.yaml | 26 ++++++++ apps/wireguard/deployment.yaml | 83 +++++++++++++++++++++++++ apps/wireguard/kustomization.yaml | 7 +++ apps/wireguard/sealed-secret.yaml | 12 ++++ apps/wireguard/service.yaml | 15 +++++ argocd-apps/services/kustomization.yaml | 1 + argocd-apps/services/wireguard.yaml | 22 +++++++ 7 files changed, 166 insertions(+) create mode 100644 apps/wireguard/configmap.yaml create mode 100644 apps/wireguard/deployment.yaml create mode 100644 apps/wireguard/kustomization.yaml create mode 100644 apps/wireguard/sealed-secret.yaml create mode 100644 apps/wireguard/service.yaml create mode 100644 argocd-apps/services/wireguard.yaml diff --git a/apps/wireguard/configmap.yaml b/apps/wireguard/configmap.yaml new file mode 100644 index 0000000..b65af57 --- /dev/null +++ b/apps/wireguard/configmap.yaml @@ -0,0 +1,26 @@ +apiVersion: v1 +data: + wg0.conf: | + # Based on the image's /defaults/server.conf. The init container adds + # PrivateKey from the SealedSecret. After editing peers, bump + # wireguard.whyredfire.dev/config-revision on the Deployment to restart it. + [Interface] + Address = 10.13.13.1 + ListenPort = 51820 + MTU = 1280 + PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE + PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth+ -j MASQUERADE + + [Peer] + # macbook + PublicKey = xuWFr3AHPeh/gRO5NiCGnwHcr0e/8InaroXcY8S5eC0= + AllowedIPs = 10.13.13.2/32 + + [Peer] + # phone + PublicKey = 8VBoG0Bpwv1UhAOethIgRJXmaNWPErSWkqcfdjGmhHs= + AllowedIPs = 10.13.13.3/32 +kind: ConfigMap +metadata: + name: wireguard + namespace: wireguard diff --git a/apps/wireguard/deployment.yaml b/apps/wireguard/deployment.yaml new file mode 100644 index 0000000..22d2b3b --- /dev/null +++ b/apps/wireguard/deployment.yaml @@ -0,0 +1,83 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: wireguard + namespace: wireguard +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: wireguard + strategy: + type: Recreate + template: + metadata: + annotations: + wireguard.whyredfire.dev/config-revision: "1" + labels: + app.kubernetes.io/name: wireguard + spec: + containers: + - env: + - name: PUID + value: "1000" + - name: PGID + value: "1000" + - name: TZ + value: Etc/UTC + image: lscr.io/linuxserver/wireguard:1.0.20260223-r0-ls123 + livenessProbe: + exec: + command: + - wg + - show + - wg0 + initialDelaySeconds: 30 + periodSeconds: 30 + name: wireguard + ports: + - containerPort: 51820 + name: wireguard + protocol: UDP + securityContext: + capabilities: + add: + - NET_ADMIN + volumeMounts: + - mountPath: /config + name: config + initContainers: + - args: + - | + set -euo pipefail + umask 077 + mkdir -p /config/wg_confs + awk -v keyfile=/secret/private-key ' + { print } + /^\[Interface\]/ { getline key < keyfile; print "PrivateKey = " key } + ' /template/wg0.conf > /config/wg_confs/wg0.conf + command: + - /bin/bash + - -c + image: lscr.io/linuxserver/wireguard:1.0.20260223-r0-ls123 + name: render-config + volumeMounts: + - mountPath: /config + name: config + - mountPath: /template + name: template + readOnly: true + - mountPath: /secret + name: secret + readOnly: true + volumes: + - emptyDir: + medium: Memory + name: config + - configMap: + name: wireguard + name: template + - name: secret + secret: + defaultMode: 256 + secretName: wireguard diff --git a/apps/wireguard/kustomization.yaml b/apps/wireguard/kustomization.yaml new file mode 100644 index 0000000..9d38556 --- /dev/null +++ b/apps/wireguard/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - sealed-secret.yaml + - configmap.yaml + - deployment.yaml + - service.yaml diff --git a/apps/wireguard/sealed-secret.yaml b/apps/wireguard/sealed-secret.yaml new file mode 100644 index 0000000..0dd9d96 --- /dev/null +++ b/apps/wireguard/sealed-secret.yaml @@ -0,0 +1,12 @@ +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: wireguard + namespace: wireguard +spec: + encryptedData: + private-key: AgCyimGRHeoQAc4xVkr09bpRHYtZBG2Gjc1IkOM9D/p+f7n7/Va2hJixDL1ieVBXufEm485MYcLV74j1dG6q/Xyad+Y2VsAlWGIFlC+1rCO0V/dEKGOav8bxxhcMV56YUDgNR4ZtBOnN5aLgq2P/72CIbRpa9I4ofNUmoMV+Eh50hY9oVJgdmeb6Dx+03q5Zkf1LTJZMxnYi5r6bbzznT1bqQM9gZml4N2b3cBBVrtLIBlPFkHeyxhmS+0ZnQgXiu+oFEkAvXLKB44AmerJ6UFYjX5ly933UzOm2KsTR4pIGHRsj6vZvjCb6cJUxCAhFOn9Nq+B984TeNTomCglYVc3p5XRVAsSVL+MBT1EfNoz9qSec8sHiufnsgHG6cre6DDriv0HD+yfg8tCK7IX0HbETb2aQXgNNFvdnSL5S6rqbffctl/ivfj3RsZmJCcaxwrWR6khmn6nzOkqNeKSMjmpAxSTdAlve6EFFWqvFz4D0LpYpk/73kyaWvczuzV//cGlYBwVOBA9CPCyAexdrQ78wbzn0zaCdo7yKqTQtgZestXnyCICUyrXm+1WQzd8W/lGHtr/hV7D3H//RQAGxnlWERvWCZlYIF6xkz9eApvWl72gE4cwzcgme+1+EkyPgSmLgtyh78B/kucEZC2Qy2chGJEAlwJln02HxbJ0RX8Bo1ko+kxCHzZl12zA02A1yzQGzEt7Oya9K/wrhWX8plYFK4Zq811yHmVqJEeu5bseCSi+O0tHmnl5vafRFyjw= + template: + metadata: + name: wireguard + namespace: wireguard diff --git a/apps/wireguard/service.yaml b/apps/wireguard/service.yaml new file mode 100644 index 0000000..8d35529 --- /dev/null +++ b/apps/wireguard/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: wireguard + namespace: wireguard +spec: + externalIPs: + - 192.168.2.5 + ports: + - name: wireguard + port: 51820 + protocol: UDP + targetPort: wireguard + selector: + app.kubernetes.io/name: wireguard diff --git a/argocd-apps/services/kustomization.yaml b/argocd-apps/services/kustomization.yaml index 523b6f9..c4964f9 100644 --- a/argocd-apps/services/kustomization.yaml +++ b/argocd-apps/services/kustomization.yaml @@ -11,3 +11,4 @@ resources: - redoost.yaml - rustbin.yaml - scriptscribe.yaml + - wireguard.yaml diff --git a/argocd-apps/services/wireguard.yaml b/argocd-apps/services/wireguard.yaml new file mode 100644 index 0000000..b0c55d2 --- /dev/null +++ b/argocd-apps/services/wireguard.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + annotations: + argocd.argoproj.io/sync-wave: "3" + name: wireguard + namespace: argocd +spec: + destination: + namespace: wireguard + server: https://kubernetes.default.svc + project: default + source: + path: apps/wireguard + repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git + targetRevision: main + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true