Dustin C. Hatch
c1d9ee0495
The Firefly III Data Importer does not allow transaction imports by unattended HTTP requests by default, but this can be enabled with the `CAN_POST_FILES` environment variable. Additionally, an `AUTO_IMPORT_SECRET` environment variable must be set containing a shared "secret" value which must be provided in the querystring of autoimport requests. Since we have the Data Importer protected by Authelia, we need to make some additional changes to the Ingress to allow unattended authentication. Authelia supports passing the username and password of an authorized user in the `Proxy-Authorization` HTTP request header. If this header is valid, it will allow the request through. Unfortunately, many HTTP clients will not set this header unless they are also configured to explicitly connect via a forward proxy. To simplify usage of such clients, we can configure nginx to copy the value of the normal `Authorization` header into `Proxy-Authorization`, thus allowing clients to use simple HTTP Basic authentication, even though the Data Importer doesn't actually support it.
54 lines
1.2 KiB
YAML
54 lines
1.2 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
labels:
|
|
- pairs:
|
|
app.kubernetes.io/instance: firefly-iii
|
|
|
|
namespace: firefly-iii
|
|
|
|
resources:
|
|
- secrets.yaml
|
|
- redis.yaml
|
|
- firefly-iii.yaml
|
|
- ingress.yaml
|
|
- importer.yaml
|
|
- importer-ingress.yaml
|
|
|
|
configMapGenerator:
|
|
- name: firefly-iii
|
|
envs:
|
|
- firefly-iii.env
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: firefly-iii-importer
|
|
envs:
|
|
- firefly-iii-importer.env
|
|
|
|
patches:
|
|
# This patch changes the source secret for the PostgreSQL database
|
|
# password from the default (`db.password` inside `firefly-iii`) to
|
|
# a secret managed by the postgres operator.
|
|
- patch: |-
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: firefly-iii
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: firefly-iii
|
|
env:
|
|
- name: DB_PASSWORD_FILE
|
|
value: /run/secrets/postgresql/password
|
|
volumeMounts:
|
|
- name: db-secret
|
|
mountPath: /run/secrets/postgresql
|
|
readOnly: true
|
|
volumes:
|
|
- name: db-secret
|
|
secret:
|
|
secretName: firefly-iii.firefly.default.credentials.postgresql.acid.zalan.do
|
|
defaultMode: 0440
|