invoice-ninja: Deploy Invoice Ninja
Invoice Ninja is a small business management tool. Tabitha wants to use it for HLC. I am a bit concerned about the code quality of this application, and definitely alarmed at the data it send upstream, so I have tried to be extra careful with it. All privileges are revoked, including access to the Internet.etcd
parent
a5d186b461
commit
4e15a9d71d
|
|
@ -0,0 +1,13 @@
|
||||||
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
kind: Application
|
||||||
|
metadata:
|
||||||
|
name: invoice-ninja
|
||||||
|
namespace: argocd
|
||||||
|
spec:
|
||||||
|
destination:
|
||||||
|
server: https://kubernetes.default.svc
|
||||||
|
project: default
|
||||||
|
source:
|
||||||
|
path: invoice-ninja
|
||||||
|
repoURL: https://git.pyrocufflink.blue/infra/kubernetes.git
|
||||||
|
targetRevision: master
|
||||||
|
|
@ -0,0 +1,72 @@
|
||||||
|
# Invoice Ninja
|
||||||
|
|
||||||
|
[Invoice Ninja][0] is a free invoice and customer management system. Tabitha
|
||||||
|
uses it to manage her tutoring and learning center billing and payments.
|
||||||
|
|
||||||
|
[0]: https://www.invoiceninja.org/
|
||||||
|
|
||||||
|
|
||||||
|
## Components
|
||||||
|
|
||||||
|
*Invoice Ninja* is a web-based application, written in PHP. The official
|
||||||
|
container image only includes the application itself and PHP-FPM, but no HTTP
|
||||||
|
server, so a separate *nginx* container is necessary. The image is also of
|
||||||
|
dubious quality, doing weird things like copying "backup" files to persistent
|
||||||
|
storage at startup, then deleting them from the container filesystem. To
|
||||||
|
work around this, an init container is necessary to copy the application into
|
||||||
|
writable ephemeral storage.
|
||||||
|
|
||||||
|
Persistent storage is handled in a somewhat ad-hoc way. There are three paths
|
||||||
|
that are expected to be persistent:
|
||||||
|
|
||||||
|
* `/var/www/app/public`
|
||||||
|
* `/var/www/app/storage`
|
||||||
|
* `/var/www/app/public/storage`
|
||||||
|
|
||||||
|
The distinction between these is not really clear. Both "public" directories
|
||||||
|
have to be served by the web server, as well.
|
||||||
|
|
||||||
|
In addition to the main process, a "cron" process is required. This has to
|
||||||
|
run every minute, apparently.
|
||||||
|
|
||||||
|
*Invoice Ninja* also requires a MySQL or MariaDB database. Supposedly,
|
||||||
|
PostgreSQL can be used as well, but it is not supported by upstream and
|
||||||
|
apparently requires patching some PHP code.
|
||||||
|
|
||||||
|
|
||||||
|
## Phone Home
|
||||||
|
|
||||||
|
Although *Invoice Ninja* can be self hosed, it relies on some cloud services
|
||||||
|
for some features. Notably, generating PDF invoices makes a few connections to
|
||||||
|
external services:
|
||||||
|
|
||||||
|
* *fonts.googleapis.com*: Fetches CSS resources
|
||||||
|
* *invoicing.io*: Fetches the *Invoice Ninja* logo to print at the bottom
|
||||||
|
|
||||||
|
Both of these remote resources are hard-coded into the HTML document template
|
||||||
|
that is used to render the PDF. The former is probably innocent, but I suspect
|
||||||
|
the latter is some kind of "phone home," informing upstream of field deployments.
|
||||||
|
Additionally, when certain actions are performed in the web UI, the backend
|
||||||
|
makes requests to *www.google-analytics.com*, obviously for telemetry.
|
||||||
|
Further, the *Invoice Ninja* documentation lists some "terms of service" for
|
||||||
|
self-hosting, which include sending personally identifiable information to
|
||||||
|
the *Invoice Ninja*, including company name and contact information, email
|
||||||
|
addresses, etc.
|
||||||
|
|
||||||
|
The point of self-hosting applications is not to avoid paying for them (in
|
||||||
|
fact, I pay for some cloud services offered by open source developers, even
|
||||||
|
though I self-host their software), but to avoid dependencies on cloud
|
||||||
|
services. For *Invoice Ninja*, that means we should be able to make invoices
|
||||||
|
any time, even if upstream ceases offering their cloud service. Including a
|
||||||
|
"phone home" in the invoice generation that can prevent the feature from
|
||||||
|
working, even if it is by accident, is unacceptable.
|
||||||
|
|
||||||
|
To that end, I have neutered *Invoice Ninja*'s phone-home capabilities. First,
|
||||||
|
a script runs before the main container starts that replaces the hard-coded
|
||||||
|
URL of the *Invoice Ninja* logo with the URL to the same logo in the local
|
||||||
|
installation. Next, I have blocked all outbound communication from *Invoice
|
||||||
|
Ninja* pods using a NetworkPolicy, except for Kubernetes services and the
|
||||||
|
forward proxy on the firewall. Finally, I have configured the forward proxy
|
||||||
|
(Squid) on the firewall to *only* allow access to *fonts.googleapis.com*, so
|
||||||
|
that invoices render correctly, blocking all telemetry and other phone-home
|
||||||
|
communication.
|
||||||
|
|
@ -0,0 +1,19 @@
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
name: invoice-ninja
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: invoice-ninja
|
||||||
|
app.kubernetes.io/component: invoice-ninja
|
||||||
|
spec:
|
||||||
|
rules:
|
||||||
|
- host: invoiceninja.pyrocufflink.blue
|
||||||
|
http:
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
backend:
|
||||||
|
service:
|
||||||
|
name: invoice-ninja
|
||||||
|
port:
|
||||||
|
name: http
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
cp -r /var/www/app/. /app
|
||||||
|
|
||||||
|
# The Invoice Ninja logo on PDF invoices is always loaded from upstream's
|
||||||
|
# server, despite the APP_URL setting.
|
||||||
|
sed -i \
|
||||||
|
-e 's@invoicing.co/images/new_logo.png@invoiceninja.pyrocufflink.blue/images/logo.png@' \
|
||||||
|
/app/app/Utils/HtmlEngine.php
|
||||||
|
|
||||||
|
chown -R invoiceninja:invoiceninja /app
|
||||||
|
|
||||||
|
if [ "$(stat -c %u /storage)" -ne "$(id -u invoiceninja)" ]; then
|
||||||
|
chown -R invoiceninja:invoiceninja /storage
|
||||||
|
chmod -R u=rwx,go= /storage
|
||||||
|
fi
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
APP_LOGO=https://invoiceninja.pyrocufflink.blue/images/logo.png
|
||||||
|
APP_URL=https://invoiceninja.pyrocufflink.blue
|
||||||
|
TRUSTED_PROXIES=172.30.0.171,172.30.0.172,172.30.0.173
|
||||||
|
|
||||||
|
MAIL_MAILER=smtp
|
||||||
|
MAIL_HOST=mail.pyrocufflink.blue
|
||||||
|
MAIL_PORT=25
|
||||||
|
MAIL_ENCRYPTION=null
|
||||||
|
MAIL_FROM_ADDRESS=invoice-ninja@pyrocufflink.net
|
||||||
|
MAIL_FROM_NAME='Invoice Ninja'
|
||||||
|
|
||||||
|
EXPANDED_LOGGING=true
|
||||||
|
|
||||||
|
http_proxy=http://172.30.0.1:3128
|
||||||
|
https_proxy=http://172.30.0.1:3128
|
||||||
|
NO_PROXY=local,pyrocufflink.blue,localhost
|
||||||
|
|
@ -0,0 +1,218 @@
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: invoice-ninja
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: invoice-ninja
|
||||||
|
app.kubernetes.io/component: invoice-ninja
|
||||||
|
app.kubernetes.io/part-of: invoice-ninja
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: invoice-ninja
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: invoice-ninja
|
||||||
|
app.kubernetes.io/component: invoice-ninja
|
||||||
|
app.kubernetes.io/part-of: invoice-ninja
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- port: 8000
|
||||||
|
targetPort: http
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: invoice-ninja
|
||||||
|
app.kubernetes.io/component: invoice-ninja
|
||||||
|
type: ClusterIP
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: invoice-ninja
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: invoice-ninja
|
||||||
|
app.kubernetes.io/component: invoice-ninja
|
||||||
|
app.kubernetes.io/part-of: invoice-ninja
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: invoice-ninja
|
||||||
|
app.kubernetes.io/component: invoice-ninja
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: invoice-ninja
|
||||||
|
app.kubernetes.io/component: invoice-ninja
|
||||||
|
app.kubernetes.io/part-of: invoice-ninja
|
||||||
|
spec:
|
||||||
|
initContainers:
|
||||||
|
- name: init
|
||||||
|
image: &image docker.io/invoiceninja/invoiceninja:5.8.16
|
||||||
|
command:
|
||||||
|
- /init.sh
|
||||||
|
securityContext:
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
add:
|
||||||
|
- CHOWN
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsGroup: 0
|
||||||
|
runAsNonRoot: false
|
||||||
|
runAsUser: 0
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /app
|
||||||
|
name: app
|
||||||
|
- mountPath: /init.sh
|
||||||
|
name: init
|
||||||
|
subPath: init.sh
|
||||||
|
- mountPath: /storage
|
||||||
|
name: data
|
||||||
|
subPath: storage
|
||||||
|
containers:
|
||||||
|
- name: invoice-ninja
|
||||||
|
image: *image
|
||||||
|
env: &env
|
||||||
|
- name: DB_HOST
|
||||||
|
value: invoice-ninja-db
|
||||||
|
- name: DB_DATABASE
|
||||||
|
value: ninja
|
||||||
|
- name: DB_USERNAME
|
||||||
|
value: ninja
|
||||||
|
- name: DB_PASSWORD_FILE
|
||||||
|
value: /run/secrets/invoiceninja/db.password
|
||||||
|
- name: APP_KEY_FILE
|
||||||
|
value: /run/secrets/invoiceninja/app.key
|
||||||
|
- name: APP_CIPHER
|
||||||
|
value: AES-256-GCM
|
||||||
|
- name: TRUSTED_PROXIES
|
||||||
|
value: '*'
|
||||||
|
envFrom: &envFrom
|
||||||
|
- configMapRef:
|
||||||
|
name: invoice-ninja
|
||||||
|
readinessProbe: &probe
|
||||||
|
tcpSocket:
|
||||||
|
port: 9000
|
||||||
|
periodSeconds: 60
|
||||||
|
startupProbe:
|
||||||
|
<<: *probe
|
||||||
|
periodSeconds: 1
|
||||||
|
failureThreshold: 60
|
||||||
|
securityContext:
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
volumeMounts: &mounts
|
||||||
|
- mountPath: /run/secrets/invoiceninja
|
||||||
|
name: secrets
|
||||||
|
readOnly: true
|
||||||
|
- mountPath: /tmp
|
||||||
|
name: tmp
|
||||||
|
subPath: tmp
|
||||||
|
- mountPath: /var/www/app
|
||||||
|
name: app
|
||||||
|
- mountPath: /var/www/app/public/storage
|
||||||
|
name: data
|
||||||
|
subPath: storage-public
|
||||||
|
- mountPath: /var/www/app/storage
|
||||||
|
name: data
|
||||||
|
subPath: storage
|
||||||
|
- mountPath: /var/www/app/storage/logs
|
||||||
|
name: tmp
|
||||||
|
subPath: logs
|
||||||
|
- name: nginx
|
||||||
|
image: docker.io/library/nginx:1
|
||||||
|
ports:
|
||||||
|
- containerPort: 8000
|
||||||
|
name: http
|
||||||
|
readinessProbe: &probe
|
||||||
|
httpGet:
|
||||||
|
port: 8000
|
||||||
|
path: /health
|
||||||
|
periodSeconds: 60
|
||||||
|
startupProbe:
|
||||||
|
<<: *probe
|
||||||
|
periodSeconds: 1
|
||||||
|
failureThreshold: 30
|
||||||
|
securityContext:
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsUser: 101
|
||||||
|
runAsGroup: 101
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /etc/nginx/nginx.conf
|
||||||
|
name: nginx-conf
|
||||||
|
subPath: nginx.conf
|
||||||
|
readOnly: true
|
||||||
|
- mountPath: /run/nginx
|
||||||
|
name: run
|
||||||
|
subPath: nginx
|
||||||
|
- mountPath: /var/cache/nginx
|
||||||
|
name: nginx-cache
|
||||||
|
- mountPath: /var/www/app/public
|
||||||
|
name: app
|
||||||
|
subPath: public
|
||||||
|
readOnly: true
|
||||||
|
- mountPath: /var/www/app/public/storage
|
||||||
|
name: data
|
||||||
|
subPath: storage-public
|
||||||
|
readOnly: true
|
||||||
|
- name: cron
|
||||||
|
image: *image
|
||||||
|
command:
|
||||||
|
- sh
|
||||||
|
- -c
|
||||||
|
- |
|
||||||
|
cleanup() { kill -TERM $!; exit; }
|
||||||
|
trap cleanup TERM
|
||||||
|
while sleep 60; do php artisan schedule:run; done
|
||||||
|
env: *env
|
||||||
|
envFrom: *envFrom
|
||||||
|
securityContext:
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
volumeMounts: *mounts
|
||||||
|
enableServiceLinks: false
|
||||||
|
affinity:
|
||||||
|
podAffinity:
|
||||||
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- weight: 1
|
||||||
|
podAffinityTerm:
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
|
labelSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: app.kubernetes.io/name
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- invoice-ninja-db
|
||||||
|
securityContext:
|
||||||
|
runAsNonRoot: True
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
volumes:
|
||||||
|
- name: app
|
||||||
|
emptyDir: {}
|
||||||
|
- name: data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: invoice-ninja
|
||||||
|
- name: init
|
||||||
|
configMap:
|
||||||
|
name: invoice-ninja-init
|
||||||
|
defaultMode: 0755
|
||||||
|
- name: nginx-cache
|
||||||
|
emptyDir: {}
|
||||||
|
- name: nginx-conf
|
||||||
|
configMap:
|
||||||
|
name: nginx
|
||||||
|
- name: run
|
||||||
|
emptyDir:
|
||||||
|
medium: Memory
|
||||||
|
- name: secrets
|
||||||
|
secret:
|
||||||
|
secretName: invoice-ninja
|
||||||
|
- name: tmp
|
||||||
|
emptyDir: {}
|
||||||
|
|
@ -0,0 +1,30 @@
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
|
||||||
|
namespace: invoice-ninja
|
||||||
|
|
||||||
|
labels:
|
||||||
|
- pairs:
|
||||||
|
app.kubernetes.io/instance: invoice-ninja
|
||||||
|
includeSelectors: false
|
||||||
|
|
||||||
|
resources:
|
||||||
|
- namespace.yaml
|
||||||
|
- secrets.yaml
|
||||||
|
- network-policy.yaml
|
||||||
|
- mariadb.yaml
|
||||||
|
- invoice-ninja.yaml
|
||||||
|
- ingress.yaml
|
||||||
|
|
||||||
|
configMapGenerator:
|
||||||
|
- name: invoice-ninja-init
|
||||||
|
files:
|
||||||
|
- init.sh
|
||||||
|
|
||||||
|
- name: invoice-ninja
|
||||||
|
envs:
|
||||||
|
- invoice-ninja.env
|
||||||
|
|
||||||
|
- name: nginx
|
||||||
|
files:
|
||||||
|
- nginx.conf
|
||||||
|
|
@ -0,0 +1,111 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: invoice-ninja-db
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: invoice-ninja-db
|
||||||
|
app.kubernetes.io/component: mysql
|
||||||
|
app.kubernetes.io/part-of: invoice-ninja
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 1Gi
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: invoice-ninja-db
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: invoice-ninja-db
|
||||||
|
app.kubernetes.io/component: mysql
|
||||||
|
app.kubernetes.io/part-of: invoice-ninja
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- port: 3306
|
||||||
|
targetPort: mysql
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: invoice-ninja-db
|
||||||
|
app.kubernetes.io/component: mysql
|
||||||
|
type: ClusterIP
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: StatefulSet
|
||||||
|
metadata:
|
||||||
|
name: invoice-ninja-db
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: invoice-ninja-db
|
||||||
|
app.kubernetes.io/component: mysql
|
||||||
|
app.kubernetes.io/part-of: invoice-ninja
|
||||||
|
spec:
|
||||||
|
serviceName: invoice-ninja-db
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: invoice-ninja-db
|
||||||
|
app.kubernetes.io/component: mysql
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: invoice-ninja-db
|
||||||
|
app.kubernetes.io/component: mysql
|
||||||
|
app.kubernetes.io/part-of: invoice-ninja
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: mariadb
|
||||||
|
image: docker.io/library/mariadb:10.11.6
|
||||||
|
env:
|
||||||
|
- name: MARIADB_ROOT_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: mysql-root
|
||||||
|
key: password
|
||||||
|
- name: MARIADB_DATABASE
|
||||||
|
value: ninja
|
||||||
|
- name: MARIADB_USER
|
||||||
|
value: ninja
|
||||||
|
- name: MARIADB_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: invoice-ninja
|
||||||
|
key: db.password
|
||||||
|
ports:
|
||||||
|
- containerPort: 3306
|
||||||
|
name: mysql
|
||||||
|
readinessProbe: &probe
|
||||||
|
tcpSocket:
|
||||||
|
port: mysql
|
||||||
|
periodSeconds: 60
|
||||||
|
startupProbe:
|
||||||
|
<<: *probe
|
||||||
|
periodSeconds: 1
|
||||||
|
failureThreshold: 60
|
||||||
|
securityContext:
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /run/mysqld
|
||||||
|
name: run
|
||||||
|
subPath: mysqld
|
||||||
|
- mountPath: /tmp
|
||||||
|
name: tmp
|
||||||
|
subPath: tmp
|
||||||
|
- mountPath: /var/lib/mysql
|
||||||
|
name: data
|
||||||
|
subPath: mysql
|
||||||
|
enableServiceLinks: false
|
||||||
|
securityContext:
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 3306
|
||||||
|
runAsGroup: 3306
|
||||||
|
fsGroup: 3306
|
||||||
|
volumes:
|
||||||
|
- name: data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: invoice-ninja-db
|
||||||
|
- name: run
|
||||||
|
emptyDir:
|
||||||
|
medium: Memory
|
||||||
|
- name: tmp
|
||||||
|
emptyDir: {}
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: invoice-ninja
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: invoice-ninja
|
||||||
|
app.kubernetes.io/component: invoice-ninja
|
||||||
|
|
@ -0,0 +1,46 @@
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
metadata:
|
||||||
|
name: invoice-ninja
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: invoice-ninja
|
||||||
|
app.kubernetes.io/component: invoice-ninja
|
||||||
|
spec:
|
||||||
|
egress:
|
||||||
|
- to:
|
||||||
|
- podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/part-of: invoice-ninja
|
||||||
|
- to:
|
||||||
|
- namespaceSelector:
|
||||||
|
matchLabels:
|
||||||
|
kubernetes.io/metadata.name: kube-system
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
k8s-app: kube-dns
|
||||||
|
ports:
|
||||||
|
- port: 53
|
||||||
|
protocol: UDP
|
||||||
|
- port: 53
|
||||||
|
protocol: TCP
|
||||||
|
- to:
|
||||||
|
- ipBlock:
|
||||||
|
cidr: 172.30.0.12/32
|
||||||
|
ports:
|
||||||
|
- port: 25
|
||||||
|
- to:
|
||||||
|
- ipBlock:
|
||||||
|
cidr: 172.30.0.160/28
|
||||||
|
ports:
|
||||||
|
- port: 80
|
||||||
|
- port: 443
|
||||||
|
- to:
|
||||||
|
- ipBlock:
|
||||||
|
cidr: 172.30.0.1/32
|
||||||
|
ports:
|
||||||
|
- port: 3128
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/component: invoice-ninja
|
||||||
|
policyTypes:
|
||||||
|
- Egress
|
||||||
|
|
@ -0,0 +1,68 @@
|
||||||
|
worker_processes auto;
|
||||||
|
|
||||||
|
error_log /var/log/nginx/error.log notice;
|
||||||
|
|
||||||
|
pid /run/nginx/nginx.pid;
|
||||||
|
|
||||||
|
events {
|
||||||
|
worker_connections 1024;
|
||||||
|
}
|
||||||
|
|
||||||
|
http {
|
||||||
|
include /etc/nginx/mime.types;
|
||||||
|
default_type application/octet-stream;
|
||||||
|
|
||||||
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||||
|
'$status $body_bytes_sent "$http_referer" '
|
||||||
|
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||||
|
access_log /var/log/nginx/access.log main;
|
||||||
|
|
||||||
|
sendfile on;
|
||||||
|
|
||||||
|
gzip on;
|
||||||
|
|
||||||
|
keepalive_timeout 65;
|
||||||
|
|
||||||
|
upstream backend {
|
||||||
|
server 127.0.0.1:9000;
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 8000 default;
|
||||||
|
server_name _;
|
||||||
|
|
||||||
|
root /var/www/app/public;
|
||||||
|
|
||||||
|
index index.php;
|
||||||
|
|
||||||
|
charset utf-8;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
try_files $uri $uri/ /index.php?$query_string;
|
||||||
|
}
|
||||||
|
|
||||||
|
location /health {
|
||||||
|
return 200 'UP';
|
||||||
|
}
|
||||||
|
|
||||||
|
location ~ \.php$ {
|
||||||
|
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||||
|
fastcgi_pass backend;
|
||||||
|
fastcgi_index index.php;
|
||||||
|
include fastcgi_params;
|
||||||
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||||
|
fastcgi_intercept_errors on;
|
||||||
|
fastcgi_buffer_size 16k;
|
||||||
|
fastcgi_buffers 4 16k;
|
||||||
|
}
|
||||||
|
|
||||||
|
location ~ /\.ht {
|
||||||
|
deny all;
|
||||||
|
}
|
||||||
|
|
||||||
|
error_page 500 502 503 504 /50x.html;
|
||||||
|
location = /50x.html {
|
||||||
|
root /usr/share/nginx/html;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,32 @@
|
||||||
|
---
|
||||||
|
apiVersion: bitnami.com/v1alpha1
|
||||||
|
kind: SealedSecret
|
||||||
|
metadata:
|
||||||
|
name: mysql-root
|
||||||
|
namespace: invoice-ninja
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: mysql-root
|
||||||
|
app.kubernetes.io/component: mysql
|
||||||
|
app.kubernetes.io/part-of: invoice-ninja
|
||||||
|
spec:
|
||||||
|
encryptedData:
|
||||||
|
password: AgCWJhpMd/GmSzYZv+lofE9vQrTBewpeUO7rPnZGy5n9lvwwSin3DSzqeUCh37byCQ086VjIA1AqcJAXkur8dcZWXRAXY3H26rDoEMjGIyfrUEByCLhSNhL3sK7AcE14QWOuoxtUSbGk5RmYc+qvIw8b4l/dNpEnatLCRUeF9CefMgnTk2phVMlzkasvXjxAvxcBIvDg7DLcBOsenGg1xNG8j8wQ8flGsX6bWHmlt1+EBhyp+8PS+GyOT1BmjnVyQeo2mKwXm+FY9WHlEswypKTVQAsV6F0fUh9gIFoAdklOMwxbaW8321xLfQQvB4Qkbx8N0YJYy1jFNMF6plwcZhE7KwxXoNjW3GQhyGqTq/iFDi/oLJmAjxH9Vz8RPGT5IyOLRIkrQjCDhWrIHAEh1TUVF2BorrV8gIQOLV2xP2Lxa20KIjVZdosntWPc8bp8Br4RiP0JIK/ktRIMt+cCOwwrux8FhJe8WklujnaiZ1HX7G8dgidtjmUXYBxyNOZ9FMs2+c7D3bgqNQsTQ/NMlyP02l5oXUNzQpIVNbY4t+AT0ISn8NP9xDmLVwFw0Y3lJbx5rDtqaSFivkMOsp20l/JVUkeyig3Trm6OLh9FzI6Qr4Qo6fPBSrqKu1ieQPF76C80phrTWwtiK67i2LSmtb2zAvm3Hwj4X4Ag7HIi8F7zF7HjgOcmmS+6fIgyaIufE6IeQtwFwekbWGTHWDFddias9qHBuM1QcnQP/SJZkZrR/A==
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
name: mysql-root
|
||||||
|
namespace: invoice-ninja
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: bitnami.com/v1alpha1
|
||||||
|
kind: SealedSecret
|
||||||
|
metadata:
|
||||||
|
name: invoice-ninja
|
||||||
|
namespace: invoice-ninja
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: invoice-ninja
|
||||||
|
app.kubernetes.io/component: invoice-ninja
|
||||||
|
app.kubernetes.io/part-of: invoice-ninja
|
||||||
|
spec:
|
||||||
|
encryptedData:
|
||||||
|
app.key: AgA1p4ay2avNqkFYzLIB5VXxIjFBoZ8YZksf89Q81vCXrUs9mxd2/PuaRFeVu9WZwYXElT/esF2TV8P0JfXI3OJrRqDTSDnPwphTTxDYokFTvK01kCMwjaGWnINX02aFL+N5rCpETBw2Ptojq3SRltbIG5xe9e1sfe0ltWU2YiwQ7Zp9ekQKV2A5TZjZ55rtjO6C3HqBYWz/AnxiizWGgBAIxHuM4D0mPHOK4u/7tnfC3CIaD8UqINE1Dz3qfeDDgf0rzgVq+b6pbaoEquCkvvbng2rFfY/MVq3tb3gFGR6G1qWA+XKPJwBm9ODWcHxAliqzMsvja26izwtK8ci3VBmaL6mWcyuaWcfA4Wbjo2sb7srcS9COjUvuZf6NiTqehBpplUHkqoyFq9+QO2zfVUZ0PMltEEuTmoG6K0PSnzROUjim5FavnVCzKlvLv8ChG/GE3sYMWxBFfJCpnXhfPkNyghok+WGiTqc4pBIy3KnqbCs1xxZhfJ3UVvd1Rkq1xEW3VnEJSg76EDerj5J526Q6V6i4dbXHnxeeoHLUfIGapIa4Pv63DwxSaH72gJXrtrT4X6XgQjEuZofLvm2q8QToTxSezT4Fc76ojVOJF3ssPJMwC7mx8hcYDjy1cWkw5pNvLgj5QDAspAgKSMuoe0YQU2ES7oOtTHZ7peSAGz+8zoJNoy1gQCGH95uztt/tkCyYPl3JaYF0A9j8oOWxAfJJMVBcxszt9EqD+j246JofJM5Gnn5SpgrIyWngpiK3G2xiM68=
|
||||||
|
db.password: AgCtaz+QGcnKsKonIsAmT9oiZHd9cmj4ntKZ2vhH4cwDzCw0mHu3s1NKGTFxqVkrxyn0S2PbM+6gSXFyz6FtxI+nhb1gP6+QbSLmbJk35+sdC90WYj51r+k1tjugGaw8RpdAACxHSe7Vf8S0fPS5JFqrLR5HzmthoqNwzChcXjALCkArSXEG2kuQj0Dx72NTStYOQCPth0pPFytako3gHlSHFgGrjQ/g/hOnrP/booIFl4GMAZnJ5CgwI4XQKP4VvyK8msF93T278pyFr7fFFVSLrYrzpqFYfpKrHdiwirooed52Xlwpy6tfFsD64kZ0hDd5xbzXStNxDBkPOOgEu+KSbqUuGu5s/TmqOhxD394RU3AcwiFiQ5nASldeTmzVqC1et5Wx2IuD1b0hVcqGTNh/6uaZRSSchM7enja1v++nd9W7eYkCLdzxUjMC5+GDC/MwNYrrPoIOZAjOLii2UTH0WmvvTu8R79wRmgqCzLykS2VQWaBcMlVQsbyj/IjBbAhTwZ1bu0HKwDQbWckCFQTixR1k612U3gK8P/TsqspSkip9WtlaR3eSwrjqImTe4fhdLI8B6oEYm/D6h4ciXthkl2uYtyd3gwMf3TsHlrev+aOV0K98oaAPkV4EkbDTSQfZDEvAlFwoLScPHBIUahWKPADES7O37cFwkYPo8JOC2yLjYGOlWh997EUsnB/rk2cIdlbVaS8HIWwO1QdPWHelOgBYo1lcWesxRswB1SM7bQ==
|
||||||
Loading…
Reference in New Issue