feat(sftpgo): add TLS support and internal certificate management

terraform/k8sapps/config.tf

@@ -9,9 +9,11 @@ locals {
   primary_domain = "alexpires.me"
   websites = {
     "alexpires.me" = {
-      domain_name = "alexpires.me"
-      fqdn        = ["blog.alexpires.me", "www.alexpires.me", "alexpires.me"]
-      config      = file("${path.module}/resources/alexpires.me.conf")
+      domain_name    = "alexpires.me"
+      fqdn           = ["blog.alexpires.me", "www.alexpires.me", "alexpires.me"]
+      tls            = true
+      issuer         = "internal-ca"
+      custom_snippet = file("${path.module}/resources/alexpires.me.conf")
     }
   }
 

terraform/k8sapps/issuer.tf

@@ -0,0 +1,33 @@
+resource "kubernetes_secret" "root_ca" {
+  metadata {
+    name      = "root-ca"
+    namespace = "cert-manager"
+  }
+  data = {
+    "tls.crt" = var.root_ca_pem
+    "tls.key" = var.root_ca_key
+  }
+
+  type = "kubernetes.io/tls"
+}
+
+resource "kubernetes_manifest" "cluster_issuer" {
+
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "ClusterIssuer"
+    metadata = {
+      name = "internal-ca"
+      annotations = {
+        "cert-manager.io/issuer-group" = "cert-manager.io"
+        "cert-manager.io/issuer-kind"  = "Issuer"
+        "cert-manager.io/issuer-name"  = "internal-ca"
+      }
+    }
+    spec = {
+      ca = {
+        secretName = "root-ca"
+      }
+    }
+  }
+}

terraform/k8sapps/resources/alexpires.me.conf

@@ -1,46 +1,11 @@
-server {
-    listen 8080;
-    server_name localhost;
-    root /tmp/site;
+resolver kube-dns.kube-system.svc.cluster.local valid=10s;
 
-    resolver kube-dns.kube-system.svc.cluster.local valid=10s;
-
-    gzip on;
-    gzip_comp_level 9;
-    gzip_types
-    text/html
-    text/plain
-    text/css
-    text/js
-    text/xml
-    text/javascript
-    application/javascript
-    application/json
-    application/xml
-    application/rss+xml
-    image/svg+xml;
-
-    location ^~ /config/dav {
-        proxy_pass http://http.sftpgo.svc.cluster.local:8080/config/dav;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Forwarded-Port $server_port;
-    }
-
-    location / {
-        index index.html index.htm;
-    }
-
-    location ~* ^/([^/]+) {
-        index index.html index.htm;
-        error_page 404 = @error;
-    }
-
-    error_page 404 /404.html;
-    location @error {
-        try_files /$1/404.html /404.html =404;
-    }
+location ^~ /config/dav {
+    proxy_pass https://web.sftpgo.svc.cluster.local/config/dav;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Forwarded-Port $server_port;
 }

terraform/k8sapps/secrets.tf

@@ -71,3 +71,14 @@ variable "sftpgo_admin_password" {
   sensitive   = true
 }
 
+variable "root_ca_pem" {
+  description = "Root CA PEM"
+  type        = string
+  sensitive   = true
+}
+
+variable "root_ca_key" {
+  description = "Root CA Key"
+  type        = string
+  sensitive   = true
+}

terraform/k8sapps/sectool.env

@@ -21,4 +21,6 @@ TF_VAR_alexpires_me_email_username=$ALEXPIRES_ME_EMAIL_USERNAME
 TF_VAR_alexpires_me_email_password=$ALEXPIRES_ME_EMAIL_PASSWORD
 TF_VAR_mail_crypt_private_key=$DOVECOT_CRYPT_PRIVATE_KEY_FILE
 TF_VAR_mail_crypt_public_key=$DOVECOT_CRYPT_PUB_KEY_FILE
-TF_VAR_sftpgo_admin_password=$SFTPGO_ADMIN_PASSWORD
+TF_VAR_sftpgo_admin_password=$SFTPGO_ADMIN_PASSWORD
+TF_VAR_root_ca_pem=$K8S_ROOT_CA_PEM
+TF_VAR_root_ca_key=$K8S_ROOT_CA_KEY