flux cd refactoring enable git repo, and global resources deploy

deploy/onlyoffice/.env.d/.gitignore

@@ -0,0 +1,2 @@
+**
+!.gitignore

deploy/onlyoffice/deployment.yaml

@@ -0,0 +1,50 @@
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: onlyoffice
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: onlyoffice
+  template:
+    metadata:
+      labels:
+        app: onlyoffice
+    spec:
+      containers:
+        - name: onlyoffice
+          image: onlyoffice/documentserver:latest
+          ports:
+            - containerPort: 80
+          env:
+            - name: JWT_ENABLED
+              value: "true"
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: onlyoffice
+                  key: secret
+
+          resources:
+            limits:
+              memory: "2048Mi"
+              cpu: "1000m"
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+
+          volumeMounts:
+            - name: onlyoffice-data
+              mountPath: /var/www/onlyoffice/Data
+            - name: onlyoffice-logs
+              mountPath: /var/log/onlyoffice
+
+      volumes:
+        - name: onlyoffice-data
+          persistentVolumeClaim:
+            claimName: onlyoffice-data
+        - name: onlyoffice-logs
+          persistentVolumeClaim:
+            claimName: onlyoffice-logs

deploy/onlyoffice/ingress-web-public.yaml

@@ -0,0 +1,22 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: onlyoffice-web-public
+  annotations:
+    kubernetes.io/ingress.class: traefik-public
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`office.limbosolutions.com`)
+      kind: Rule
+      services:
+        - name: onlyoffice
+          port: 80
+      middlewares:
+          - name: onlyoffice-headers
+          - name: onlyoffice-security-headers
+          - name: rate-limit
+
+  tls:
+    secretName: office-limbosolutions-com-tls

deploy/onlyoffice/ingress-web.yaml

@@ -0,0 +1,23 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: onlyoffice-web
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    kubernetes.io/ingress.class: traefik
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`office.limbosolutions.com`)
+      kind: Rule
+      services:
+        - name: onlyoffice
+          port: 80
+      middlewares:
+          - name: onlyoffice-headers
+          - name: onlyoffice-security-headers
+          - name: rate-limit
+
+  tls:
+    secretName: office-limbosolutions-com-tls

deploy/onlyoffice/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+secretGenerator:
+  - name: onlyoffice
+    envs:
+      - ./.env.d/onlyoffice.env
+
+generatorOptions:
+  disableNameSuffixHash: true
+
+resources:
+  - ./deployment.yaml
+  - ./service.yaml
+  - ./pvc.yaml
+  - ./middlewares.yaml
+  - ./network-policies.yaml
+  - ./ingress-web-public.yaml

deploy/onlyoffice/middlewares.yaml

@@ -0,0 +1,32 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: onlyoffice-security-headers
+spec:
+  headers:
+    stsSeconds: 31536000
+    stsIncludeSubdomains: true
+    stsPreload: true
+    browserXssFilter: true
+    contentTypeNosniff: true
+    referrerPolicy: "no-referrer"
+    customResponseHeaders:
+      X-Content-Type-Options: "nosniff"
+      X-XSS-Protection: "1; mode=block"
+      X-Frame-Options: "ALLOW-FROM https://cloud.limbosolutions.com"
+      Content-Security-Policy: "frame-ancestors https://cloud.limbosolutions.com"
+
+
+---
+# required because of only office, iframes being generated with http
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: onlyoffice-headers
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+      X-Forwarded-Ssl: "on"
+      X-Forwarded-Port: "443"
+

deploy/onlyoffice/network-policies.yaml

@@ -0,0 +1,28 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-traefik-to-onlyoffice-ingress
+spec:
+  endpointSelector:
+    matchLabels:
+      app: onlyoffice
+
+  ingress:
+    # -------------------------------------------------------------
+    # Allow Traefik (internal and public) to reach onlyoffice web port
+    # -------------------------------------------------------------
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: traefik
+          matchExpressions:
+            - key: k8s:io.kubernetes.pod.namespace
+              operator: In
+              values:
+                - traefik
+                - traefik-public
+      toPorts:
+        - ports:
+            - port: "80"
+    
+              protocol: TCP
+---

deploy/onlyoffice/pvc.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: onlyoffice-data
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 8Gi
+---
+
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: onlyoffice-logs
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

deploy/onlyoffice/service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: onlyoffice
+spec:
+  ports:
+    - port: 80
+      targetPort: 80
+  selector:
+    app: onlyoffice