deploy anubis to beta website

2025-05-30 10:57:10 -04:00 · 2025-05-30 10:57:10 -04:00 · 91ce64b61c
parent 5ebd7020dc
commit 91ce64b61c
4 changed files with 180 additions and 1 deletions
--- a/kustomizations/website-beta/anubis-key.enc.yaml
+++ b/kustomizations/website-beta/anubis-key.enc.yaml
@ -0,0 +1,119 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: anubis-key
+stringData:
+    #ENC[AES256_GCM,data:Dc99W4dFJqiVBL9fRNOzMMU=,iv:2j2O+9OsutPALOfeg//dwg5mt0oPbBUpdftjWfxj7tE=,tag:xhzSUXFBTW1lZKDKtl4m9g==,type:comment]
+    #ENC[AES256_GCM,data:98k+fzZjuxguvoe/hpTHir6FTvE9,iv:lwwNyPk7gQm4os/aiCS7R26BmUTgmCaP7QQf8yP+cM8=,tag:Ob8FoM6jsXVLAG71EYEx5g==,type:comment]
+    ED25519_PRIVATE_KEY_HEX: ENC[AES256_GCM,data:kF4zpyJwQyBKuOTpIMYYFKcfTD2eElp2CpiNvpK8snkNHY/Wl/RCN+wnUT7igty/CU0xhqcpoSJj9om64UPKow==,iv:4vmPnSOia+aTm23HJ64EO2I2MoJ9rVRnnC+gugvPs+g=,tag:VVK6WFzRuunwcPVVh2p8DA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2025-04-21T22:07:46Z"
+    mac: ENC[AES256_GCM,data:fIpwCLUxp1ac+E0icLwKUVS/Y/8lyNcug/f3T3pzMkLSfdMoSCW0VHvqQ6COzmIaFlior0Tmetn458tAwbgglwnNS+vW842epRU8vVgbuAwc9qj1b1OncDn1kjSOVY4rHONAEh7sAZjptEl88w00fjAgJQFT/p8+QF3T/PYZ0js=,iv:urZ0ZnnCm4KdkYPwxqPda3GuSfMOTV77kZc7bR0YZL8=,tag:ayDP75zXQLnBbBbQWvQl/g==,type:str]
+    pgp:
+        - created_at: "2024-01-11T20:56:23Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA82rPM2mSf/aAQ/+PJZZk8l5rIqLgeZzumY/oZYbgSLhB1+kfrQSFKuWlWU2
+            wO8dabV77egBrHrViU8ZryJeq9rEmAwEZPTlTbvGdP4YWkXuQvjcnG41a9047p4Y
+            t67hvZbqdrLhtpAbYYC4DqEJAlQIFC9CfCCHybU3NvxDOntmSoXJ1VRdDwxeT4k/
+            2/W/4XbzvrV3mK4pocHryFkWfitplt92TQS+N+Y5mrRZAHioQNvSjD+mB5qllIGE
+            OenplDUOR5K28lAhKwJi9YU+4Q+WwRILn4Anh2kbthkOKbR2V01XEE7rZZ7miSmJ
+            HSSebOokY0KEwc5TS4YJjz4VJ25UTcw74z9oZXFh5UOCCbiOHS3vRqd8ZvbAOtxg
+            N69bHW6I61EvAmNj34r8ZIPYDsAUmVWg3RODzrHv53XH+7TIRAVwtyf0sq49BJz7
+            NYOIoAh3gfdt6AcX1wzE3NPO6GaF9loccKHzjZlgPrcG+OIiCfWvLe/ZSdEfWOz3
+            2ts4TH2GCTt8y5A3YZv6TiJTqkeZp+aTKTWHZ8VPbb1f/K/LZCgy8xJtsdPAm76H
+            Hs0fra+/igXCcsTn1hy8ApBd0kQmtaLfMdABJ4rdeft8M8ZYUE3hx0nk6nAY73TM
+            vUdtLKYYTd+8ZY8e61Hop7MEsxnV1MRCmxQYNTBCCLXyEb7EXBAFI3Dd60C29ZXS
+            UQGgFne06+Ylj2sDkWOEVDe6YJJ9uQpFLuVS0wkZv5k1IkSgQn+vIZLqo5ltWFlN
+            5sovHvmmclSlC7m0G90ReoNpSWP7RbSddqI3ht6H5GVYCQ==
+            =HuH6
+            -----END PGP MESSAGE-----
+          fp: 6B61ECD76088748C70590D55E90A401336C8AAA9
+        - created_at: "2024-01-11T20:56:23Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMAw95Vf08z8oUARAA55KjH0BV0S3PzGBlbxNr2864BRPbHcupAj52Smdh/dwb
+            0GL64ULgfFoytddgYXeXVKPwBw1l8UIZnRDoMZyeTlUGKrwR6UgAtYcs/BId9/jF
+            B8yJzLk19d1ld017Pl/3zGE6/2YxnE56MMeX+4Az8K1z1EBVOI5XFBjYz+r8tG0q
+            9j2ypWtzLK9Az0g4V5kTrnGQwA3NN3siF1Uo8lvJzL+YDVV7d9cfB+slYM0xBOKn
+            6amxxwKwRZegSckPg+/UWXZOdj6NEDpiQz94hQMm4Bm3N0HtrulATAMjAiTFfzst
+            W2R9X7U9FCMwhX1wi9QMVOy5crbBMMc3wmv0b3Ya+5smnrr/91ZDwD8s0fHKk/ju
+            BVMI9DaA7usAvlziX8LQv8Be6EHQSnBF3cDVQSTyM8TFtbQMMKMFQszbsRnvRqs1
+            k4b3veNYev8fJOK5JaQTJ+Wm7uFm22tw7Q6orSoPuD2+gIzfWzPFU1q0I7ROdN9h
+            sMc+/ytwKCU3oGbSLQLAyXI5E5czRJJ2797uwLQ3a5aFUSP3/iR/qfu4/MzGDgnW
+            XNVYadheL5xdgwnugm2CeYNwskZZXgto/bwiL/+jzeTmX9GfKN0+Nl2VqZTSRw+0
+            o9MTmKsZfq7BBJ/eOJhD1xK5rF2bvduQ9re4LJ8+31RGTN0eXWvQ43jU5FA6tF3S
+            UQHrcMjwQaVpVMNRH5AjrMS2ZKfMf+Ehbjoby6c+7W/zkOgYkPLI8dKFpUZGjPAg
+            YifFb+hBtcJTNiNJjVU/QGEenfMho9X9Uu0QmjyEbbXnIA==
+            =upcn
+            -----END PGP MESSAGE-----
+          fp: 88823A75ECAA786B0FF38B148E401478A3FBEF72
+        - created_at: "2024-01-11T20:56:23Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA0/D4ws+/KPtARAAt1m79BSP6vyV/zZNl+2tiI+1KLA4q+lMcWpzD4YAkWof
+            VDKGnr7sxDXA3EP5SZoCz9KJuKHMxc1cDgZ1AGNTNHYRVGyMNmWLbbqfX9XW6pZT
+            MuDr3W4wZc8aJP8sL8VjknbzuXTQPqdu8SYfHSPjXmNz3ai0h1dmYWJBF+2E7Uxa
+            r223JDz6TwS1VMk8TtJvlZgx+hCc1hroMmO5Su3CsbSum8ccRSPCOzXzURloM5Jv
+            xWZrmTWSsvg5lb8MQjnJ2ETG8alQDAZOgsK72Brq2baRZCcWJArFFMx7y0UlbBML
+            PYlC5QzsKFEnCC6lF+V1O1jUFgPYqs5Ck7H0kbfZbSCiF9fs7lhi2tQqRN1My7aX
+            cy5G+rbRg+4+TaA/xBssMiaCVSnI28zotrLX+Q5q+/laL+AdMSWTtfYbGpfEiLx0
+            ejWym/PJfgeozZsUXdcZsrVmMowksVyP0cnczNFBWbUVcSFRZ6+KaNBobjr2hiFC
+            NqX77VhkKnDsNE7HIo42yyqjU5ipqPaLp0qs6pQquWVNb/MBid07S4KBTQ2HJo79
+            tTki8djQBpBGPZJj1hwJvUtb+HuJTWEgI2Az6Pw9S70kmdWLSnp7aJtHAP9/GN+b
+            NainzJJ8mwv+03ohCxPHUercRtlSKjws6miCKQkxdGpqVCMrXlqx5XV1N3BX+PHS
+            UQGLbpsU8EovlP+jyc7WIqPAcGl6UGpHKuEJtk473eWKAwdoGdM2hug/83Iru6DI
+            pQN6SMixNNNpxvhoyaHhFyYFzC5Xj5YO/obEYpDfJa7tWA==
+            =TZtK
+            -----END PGP MESSAGE-----
+          fp: 3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
+        - created_at: "2024-01-11T20:56:23Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA5Wf+FyJ+zFJAQ/+OZlDJaJgpA0OZIXM4zRaDwztjdvrsmEkupUH/mC8sXsJ
+            1Q7/pVDJZqi5z/ewl2EJGyar7uvmgVVauvqOGVP8pIb04hL16M7p385U9VdBMa9V
+            IhBIYDKQi8Ia67xz6kQsMvT4zvzo52Z7opb6Rmxf3qQt919iOLdJRtJXUX0Vhjs3
+            m0zyBw4jji5zeBcfNWFxwLe8Ie5+0E2zZpyakQobTLrinEzTqwOpoEi6p18b6tWw
+            /tLHvi52TejXxkfBVsBzHMDz44WEOMu81BG13BY2JvSmOtj9+yPad5SMBy/4ugti
+            6YN974B7Dsetsm8UavMj9kU44nh14oZ8cPJ+sbf0POttSXJJY98+i5eUFptrIZ0X
+            4SyUo8wMkxHtDiL7rx3nkiglUkpG4H4+uzcaS0y/A9zlQas+igYL5YdE7CL/M5ET
+            V0UWNQEVqCk3EjCFYGR6Ccc3nGOtxnc3eWuBDBCd3oYINjqci6ZK+ds8yIqUY64B
+            Y29bvQvLSBGWkJs7ol86LyuQrFC7vvLZelsGvkSjwaRE/Be8AADgreZe1BHC91cn
+            eE0vr1rY8RcVvFjbLonzBhO9aMC5o1FkTbmKbpYcnrB7VyiierGMe9g7wRxcJrEh
+            SMvquMdOZxPgiB6e1yJ44WPsWHZMQvBjacCToX9LhIPe8QsebnrIHny0GYmYS5XS
+            UQGiVLKMnZJkACJGLtotqZWFPJi0oE1B+X3+wQch5aYTDWqtQqY9aDXSHbKSvZ+u
+            MU7a2nFCcMMrlM3Z/MzQNQxD5az/NivyIXjT1tOjc8PiLQ==
+            =3nk5
+            -----END PGP MESSAGE-----
+          fp: F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+        - created_at: "2024-01-11T20:56:23Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA8KRInHl7Vz+AQ//WXsaXLEl1BDCWBw0sDI02p8QKUosA9JOSr9Za5iO/G8v
+            Pn5JU1Fk5hAPvy874pk5jlGSSyXsO9b1PAY0i18kZ8/MMZgolyNgi/mK2B8QvixY
+            zOr6tQ2aG84tbVmBO9rt+AVkhggOx/gu3ZF3gWskjs3dY7/mD2krhNynIReQfTUc
+            MpOWmVsPh2x+8zJ7siECIkD4stNcgRGKAabQHRNig0Zg0dJhsL7z8tVuGzZGCDbu
+            q5fXPF0bM5Rb38g9DC0pXp1WAfdpCoSh8LoOrF7UbWsQFws4+looAoarFzk0tUM4
+            /XTZTzBEAhf/f/RX9yJku+14erwC7hnWnM7Yr2O19lfQ1ZNuOqkZKFLT8kV4PPcR
+            vB/3OD15HGvQD3T7DQUe9C1kFs3u1Kymk0SUocv5xTRTvbQQSEqe3KkEhh3yjb87
+            0ZsEczDafx9b6BSG7hEUyBhND9Rk1FjbGM0u1Kowy+oLMFrEQ0Z/wtm4bam5Nyho
+            5i7BBvFUquSfqh3zM+uzd/69G5AD4B+E3VDtz04cVqzNYbCmRP9Tof1czxiPYJ+1
+            kyqlk1Kd53zU2RtH1K66Dy3VNHtjVheccEHhRYCMv1q1g1+4LgdaBkouqfNld9Zc
+            9OfK8ZYeeH1iiTjgvSB2FN5ZBZYSEfs1Hnfw0XpyZcPXxPw+UA3h0awellWk7D3S
+            UQFE/ARKfbhBbLgbaCduwrF2sWLMAj5WlQv+z4QLJkWire4Z9A13qUEvUNvys+i7
+            /nOXorVH9UnvqXobQSAT8I91/LzkyGZB7lZrTnHzKQm6pQ==
+            =tZkd
+            -----END PGP MESSAGE-----
+          fp: C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3
--- a/kustomizations/website-beta/anubis.yaml
+++ b/kustomizations/website-beta/anubis.yaml
@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: anubis
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: anubis
+  template:
+    metadata:
+      labels:
+        app: anubis
+    spec:
+      containers:
+      - name: anubis
+        image: git.distrust.co/ryan/anubis@sha256:2660a2e873ae555380463faa3430495062c009fc6d1e641d3dbc273335235dd9
+        imagePullPolicy: Always
+        command: ["/usr/bin/anubis"]
+        env:
+        - name: "BIND"
+          value: ":8080"
+        - name: "DIFFICULTY"
+          value: "5"
+        - name: "SERVE_ROBOTS_TXT"
+          value: "true"
+        - name: "OG_PASSTHROUGH"
+          value: "true"
+        - name: "COOKIE_DOMAIN"
+          value: "distrust.co"
+        - name: "TARGET"
+          value: "http://website"
+        envFrom:
+        - secretRef:
+            name: anubis-key
+        ports:
+        - containerPort: 8080
+        securityContext:
+          runAsUser: 1000
+          runAsGroup: 1000
+          runAsNonRoot: true
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          seccompProfile:
+            type: RuntimeDefault
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: anubis
+spec:
+  ports:
+  - name: http
+    port: 80
+    targetPort: 8080
+  selector:
+    app: anubis
--- a/kustomizations/website-beta/ingress.yaml
+++ b/kustomizations/website-beta/ingress.yaml
@ -16,7 +16,7 @@ spec:
        pathType: Prefix
        backend:
          service:
-            name: website
+            name: anubis
            port:
              number: 80
      - path: /submit-email
--- a/kustomizations/website-beta/kustomization.yaml
+++ b/kustomizations/website-beta/kustomization.yaml
@ -6,5 +6,6 @@ resources:
 - ingress.yaml
 - website.yaml
 - docs.yaml
+- anubis.yaml
 generators:
 - secret-generator.yaml