apiVersion: apps/v1
kind: Deployment
metadata:
  name: wireguard
  namespace: wireguard
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: wireguard
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: wireguard
    spec:
      containers:
        - args:
            - |
              # The node's kernel only has nftables, the image defaults to legacy iptables.
              for b in iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore; do
                ln -sf xtables-nft-multi "/usr/sbin/$b"
              done
              # Only skips the setup wizard; password login is disabled.
              INIT_PASSWORD="$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
              export INIT_PASSWORD
              exec /usr/bin/dumb-init node server/index.mjs
          command:
            - /bin/sh
            - -c
          env:
            - name: DISABLE_IPV6
              value: "true"
            - name: DISABLE_PASSWORD_AUTH
              value: "true"
            - name: INIT_ALLOWED_IPS
              value: 192.168.2.0/24
            - name: INIT_DNS
              value: 192.168.2.1
            - name: INIT_ENABLED
              value: "true"
            - name: INIT_HOST
              value: wg.whyredfire.dev
            - name: INIT_PORT
              value: "27299"
            - name: INIT_USERNAME
              value: admin
            - name: OAUTH_AUTO_LAUNCH
              value: oidc
            - name: OAUTH_AUTO_REGISTER
              value: "true"
            - name: OAUTH_OIDC_CLIENT_ID
              value: wireguard-admin
            - name: OAUTH_OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  key: oidc-client-secret
                  name: wireguard
            - name: OAUTH_OIDC_NAME
              value: authentik
            - name: OAUTH_OIDC_SERVER
              value: https://auth.whyredfire.dev/application/o/wireguard-admin/
            - name: OAUTH_PROVIDERS
              value: oidc
          image: ghcr.io/wg-easy/wg-easy:15.5.0
          name: wg-easy
          ports:
            - containerPort: 27299
              name: wireguard
              protocol: UDP
            - containerPort: 51821
              name: http
          securityContext:
            capabilities:
              add:
                - NET_ADMIN
          volumeMounts:
            - mountPath: /etc/wireguard
              name: data
      initContainers:
        - args:
            - |
              # VPN clients may reach the LAN, not this pod or the cluster networks.
              set -eu
              iptables-nft -t mangle -A PREROUTING -i wg0 -m addrtype --dst-type LOCAL -j DROP
              iptables-nft -t mangle -A PREROUTING -i wg0 -d 10.42.0.0/16 -j DROP
              iptables-nft -t mangle -A PREROUTING -i wg0 -d 10.43.0.0/16 -j DROP
          command:
            - /bin/sh
            - -c
          image: ghcr.io/wg-easy/wg-easy:15.5.0
          name: firewall
          securityContext:
            capabilities:
              add:
                - NET_ADMIN
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: wireguard-data