feat(apps): Put redoost behind anubis

apps/redoost/anubis-key-sealedsecret.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: anubis-key
+  namespace: redoost
+spec:
+  encryptedData:
+    ED25519_PRIVATE_KEY_HEX: AgBM3dp5L0MgvKQxGM0ljAHXqhTDcebV8emcKAeWbIdWn/749Dz4W5n0e3JuFEm7cHwl5nSomY6iccM1aX2h77u8ip8PBB4SWvnj0ymDEDPii3p4Z50tz9qkWU+IzqJiXcOX75NdVVaTsbzRARW/0+V8Df0/1T6C2xTIXITqlWoxsLlXwREdTdwBiSosuMUYDbXAAiNOVZ6B8yQgT/J9kjS9quUD3T9/nYet8iinJ+4AuCD3Ib/M0KQY+/pMQbhOfsBP8MdP2vDUoh05sh5G3N+sRju0ROHLK53KrqNkn0ROxPIW5zs+WmBaG92HALjojJbWQbvlDjs+IpeUDnBRz8hZ7jmz60X1+nqSm/nMUKvTh3IS9+gQwxtt+ModWETj69yKcx0DXi4Q/hMi+LvFBULcmU0VDvu0uOvnbR3J873Bj/1PlF0VSWGdOL7J18GXWwMLVoo2rrRU/sbntasiScbxs9HPqGmkdWGOObbgb9eSdrlN9AK1EmeGOkYcwx9WMML/40TfhxjObkK9Cp5yJ+z8F/zeIEYW51PEeqGWvwgKomLSeOy3BDFaqI09VUa3+6jp/+QB3CSdWLZlEGdKVu1OKLS7W8aOLH6MDIpPQ33JJcbW1SoZvm6MbKlSCdpOvNg7zZb6o7qtrfi9RmAiO5lv+4AQ5o/RSpfL5EElXULOjef/XajT5yhIiIJ6ZaRT5f6kVZcQZx2dkhp1cfrIfzGEdQX0Lnc+2Uq06+oUrplO/wwM+2qTD3XI6qGecnC10zBwq8A3rD2QXOi4vWXPL1K3
+  template:
+    metadata:
+      name: anubis-key
+      namespace: redoost

apps/redoost/anubis-proxy-api.yaml

@@ -0,0 +1,44 @@
+apiVersion: anubis.techaro.dev/v1alpha1
+kind: AnubisProxy
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: anubis-api
+  namespace: redoost
+spec:
+  anubis:
+    envExtra:
+      - name: DIFFICULTY
+        value: "5"
+      - name: SERVE_ROBOTS_TXT
+        value: "true"
+      - name: COOKIE_DOMAIN
+        value: redoost.whyredfire.dev
+      - name: REDIRECT_DOMAINS
+        value: redoost.whyredfire.dev
+      - name: COOKIE_PARTITIONED
+        value: "true"
+      - name: COOKIE_HTTP_ONLY
+        value: "true"
+      - name: COOKIE_SAME_SITE
+        value: Lax
+      - name: DIFFICULTY_IN_JWT
+        value: "true"
+    image:
+      tag: v1.26.2
+    keys:
+      existingSecret: anubis-key
+    metrics:
+      enabled: false
+    persistence:
+      enabled: false
+    resources:
+      limits:
+        memory: 128Mi
+      requests:
+        cpu: 50m
+        memory: 64Mi
+  target:
+    service:
+      name: redoost-api
+      port: 8000

apps/redoost/anubis-proxy-frontend.yaml

@@ -0,0 +1,44 @@
+apiVersion: anubis.techaro.dev/v1alpha1
+kind: AnubisProxy
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: anubis-frontend
+  namespace: redoost
+spec:
+  anubis:
+    envExtra:
+      - name: DIFFICULTY
+        value: "5"
+      - name: SERVE_ROBOTS_TXT
+        value: "true"
+      - name: COOKIE_DOMAIN
+        value: redoost.whyredfire.dev
+      - name: REDIRECT_DOMAINS
+        value: redoost.whyredfire.dev
+      - name: COOKIE_PARTITIONED
+        value: "true"
+      - name: COOKIE_HTTP_ONLY
+        value: "true"
+      - name: COOKIE_SAME_SITE
+        value: Lax
+      - name: DIFFICULTY_IN_JWT
+        value: "true"
+    image:
+      tag: v1.26.2
+    keys:
+      existingSecret: anubis-key
+    metrics:
+      enabled: false
+    persistence:
+      enabled: false
+    resources:
+      limits:
+        memory: 128Mi
+      requests:
+        cpu: 50m
+        memory: 64Mi
+  target:
+    service:
+      name: redoost-frontend
+      port: 8080

apps/redoost/kustomization.yaml

@@ -2,3 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
+  - anubis-key-sealedsecret.yaml
+  - anubis-proxy-api.yaml
+  - anubis-proxy-frontend.yaml

argocd-apps/services/redoost.yaml

@@ -27,6 +27,12 @@ spec:
                   name: traefik-gateway
                   namespace: traefik
                   sectionName: websecure
+              apiBackendRef:
+                name: anubis-api
+                port: 80
+              frontendBackendRef:
+                name: anubis-frontend
+                port: 80
             sites:
               parentRefs:
                 - kind: Gateway