feat(apps): Add wireguard

apps/wireguard/configmap.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+data:
+  wg0.conf: |
+    # Based on the image's /defaults/server.conf. The init container adds
+    # PrivateKey from the SealedSecret. After editing peers, bump
+    # wireguard.whyredfire.dev/config-revision on the Deployment to restart it.
+    [Interface]
+    Address = 10.13.13.1
+    ListenPort = 51820
+    MTU = 1280
+    PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE
+    PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth+ -j MASQUERADE
+
+    [Peer]
+    # macbook
+    PublicKey = xuWFr3AHPeh/gRO5NiCGnwHcr0e/8InaroXcY8S5eC0=
+    AllowedIPs = 10.13.13.2/32
+
+    [Peer]
+    # phone
+    PublicKey = 8VBoG0Bpwv1UhAOethIgRJXmaNWPErSWkqcfdjGmhHs=
+    AllowedIPs = 10.13.13.3/32
+kind: ConfigMap
+metadata:
+  name: wireguard
+  namespace: wireguard

apps/wireguard/deployment.yaml

@@ -0,0 +1,83 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: wireguard
+  namespace: wireguard
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: wireguard
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      annotations:
+        wireguard.whyredfire.dev/config-revision: "1"
+      labels:
+        app.kubernetes.io/name: wireguard
+    spec:
+      containers:
+        - env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: TZ
+              value: Etc/UTC
+          image: lscr.io/linuxserver/wireguard:1.0.20260223-r0-ls123
+          livenessProbe:
+            exec:
+              command:
+                - wg
+                - show
+                - wg0
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          name: wireguard
+          ports:
+            - containerPort: 51820
+              name: wireguard
+              protocol: UDP
+          securityContext:
+            capabilities:
+              add:
+                - NET_ADMIN
+          volumeMounts:
+            - mountPath: /config
+              name: config
+      initContainers:
+        - args:
+            - |
+              set -euo pipefail
+              umask 077
+              mkdir -p /config/wg_confs
+              awk -v keyfile=/secret/private-key '
+                { print }
+                /^\[Interface\]/ { getline key < keyfile; print "PrivateKey = " key }
+              ' /template/wg0.conf > /config/wg_confs/wg0.conf
+          command:
+            - /bin/bash
+            - -c
+          image: lscr.io/linuxserver/wireguard:1.0.20260223-r0-ls123
+          name: render-config
+          volumeMounts:
+            - mountPath: /config
+              name: config
+            - mountPath: /template
+              name: template
+              readOnly: true
+            - mountPath: /secret
+              name: secret
+              readOnly: true
+      volumes:
+        - emptyDir:
+            medium: Memory
+          name: config
+        - configMap:
+            name: wireguard
+          name: template
+        - name: secret
+          secret:
+            defaultMode: 256
+            secretName: wireguard

apps/wireguard/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
+  - configmap.yaml
+  - deployment.yaml
+  - service.yaml

apps/wireguard/sealed-secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: wireguard
+  namespace: wireguard
+spec:
+  encryptedData:
+    private-key: AgCyimGRHeoQAc4xVkr09bpRHYtZBG2Gjc1IkOM9D/p+f7n7/Va2hJixDL1ieVBXufEm485MYcLV74j1dG6q/Xyad+Y2VsAlWGIFlC+1rCO0V/dEKGOav8bxxhcMV56YUDgNR4ZtBOnN5aLgq2P/72CIbRpa9I4ofNUmoMV+Eh50hY9oVJgdmeb6Dx+03q5Zkf1LTJZMxnYi5r6bbzznT1bqQM9gZml4N2b3cBBVrtLIBlPFkHeyxhmS+0ZnQgXiu+oFEkAvXLKB44AmerJ6UFYjX5ly933UzOm2KsTR4pIGHRsj6vZvjCb6cJUxCAhFOn9Nq+B984TeNTomCglYVc3p5XRVAsSVL+MBT1EfNoz9qSec8sHiufnsgHG6cre6DDriv0HD+yfg8tCK7IX0HbETb2aQXgNNFvdnSL5S6rqbffctl/ivfj3RsZmJCcaxwrWR6khmn6nzOkqNeKSMjmpAxSTdAlve6EFFWqvFz4D0LpYpk/73kyaWvczuzV//cGlYBwVOBA9CPCyAexdrQ78wbzn0zaCdo7yKqTQtgZestXnyCICUyrXm+1WQzd8W/lGHtr/hV7D3H//RQAGxnlWERvWCZlYIF6xkz9eApvWl72gE4cwzcgme+1+EkyPgSmLgtyh78B/kucEZC2Qy2chGJEAlwJln02HxbJ0RX8Bo1ko+kxCHzZl12zA02A1yzQGzEt7Oya9K/wrhWX8plYFK4Zq811yHmVqJEeu5bseCSi+O0tHmnl5vafRFyjw=
+  template:
+    metadata:
+      name: wireguard
+      namespace: wireguard

apps/wireguard/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: wireguard
+  namespace: wireguard
+spec:
+  externalIPs:
+    - 192.168.2.5
+  ports:
+    - name: wireguard
+      port: 51820
+      protocol: UDP
+      targetPort: wireguard
+  selector:
+    app.kubernetes.io/name: wireguard

argocd-apps/services/kustomization.yaml

@@ -11,3 +11,4 @@ resources:
   - redoost.yaml
   - rustbin.yaml
   - scriptscribe.yaml
+  - wireguard.yaml

argocd-apps/services/wireguard.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  name: wireguard
+  namespace: argocd
+spec:
+  destination:
+    namespace: wireguard
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: apps/wireguard
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+    targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true