pschichtel

#!/usr/bin/env bash

# Required binaries:
# * k0s
# * kubectl
# * helm
# * cut
# * grep
# * ip
# * hostname

pschichtel

#!/usr/bin/env bash

set -euo pipefail

username="${USER_NAME?No User-Name found!}"
password="${USER_PASSWORD?No Password found!}"

token_endpoint="${OIDC_TOKEN_ENDPOINT?No Oidc-Token-Endpoint!}"
client_id="${OIDC_CLIENT_ID?No Oidc-Client-Id!}"
client_secret="$(< "${OIDC_CLIENT_SECRET_FILE?No Oidc-Client-Secret-File!}")"

pschichtel

#!/usr/bin/env bash

set -euo pipefail

namespace="${1?no namespace}"
source_pvc="${2?no source pvc}"
target_sc="${3?no target SC}"

tmp_pvc_name="${source_pvc}-tmp"

pschichtel

#!/usr/bin/env bash

set -euo pipefail

fetch_hosts_as_rpz() {
    local action="${1?no action!}"
    local destination="${2?no destination!}"

    shift 2
    if [ $# = 0 ]

pschichtel

#!/usr/bin/env bash

set -euo pipefail

target_dir="${1?no target dir!}"
if [ -e "$target_dir" ]
then
    echo "$target_dir already exists!" >&2
    exit 1
fi

pschichtel

#!/usr/bin/env bash

input="${1?no input}"
key_output="${2?no key output}"
crt_output="${3?no crt output}"
ca_output="${4?no ca output}"

openssl pkcs12 -legacy -in "$input" -out "${key_output}" -nocerts -nodes
openssl pkcs12 -legacy -in "$input" -out "${crt_output}" -clcerts -nokeys
openssl pkcs12 -legacy -in "$input" -out "${ca_output}" -cacerts -nokeys

pschichtel

import org.hibernate.validator.internal.engine.DefaultClockProvider
import org.springframework.core.LocalVariableTableParameterNameDiscoverer
import org.springframework.core.PrioritizedParameterNameDiscoverer
import org.springframework.core.StandardReflectionParameterNameDiscoverer
import org.springframework.validation.beanvalidation.LocalValidatorFactoryBean
import java.lang.reflect.Constructor
import java.lang.reflect.Method
import javax.validation.ClockProvider
import javax.validation.Configuration
import javax.validation.ParameterNameProvider

pschichtel

keycloak_to_pem() {
    input="$(mktemp)"
    echo "-----BEGIN $1-----" > "$input"
    echo "$2" >> "$input"
    echo "-----END $1-----" >> "$input"
    output="$(mktemp)"
    case "$1" in
        "CERTIFICATE")
            openssl x509 -inform PEM -in "$input" -out "$output"
            ;;

pschichtel

services:
  - name: postgres:12-alpine
    alias: bootstrap-postgres
  - name: redis:6
    alias: bootstrap-redis

variables:
  POSTGRES_DB: bootstrap
  POSTGRES_USER: bootstrap
  POSTGRES_PASSWORD: ''

pschichtel

Steps to setup external site

1. Run setup_ip_forwarding.bat script to enable IP forwarding on Windows.
2. Configure Windows firewall to accept traffic from all remote networks.
3. Install wireguard and setup connection to central wireguard server with all remote networks as part of AllowedIPs and a unique IP within the wireguard network.
4. Setup fritzbox to a custom local IP address range (e.g. 192.168.110.0/24) that is unique in all sites.
5. Setup a static DHCP lease or a static IP for the local wireguard system.
6. Setup static routes in fritzbox for each remote network using the local wireguard system's IP as the gateway/nexthop.
7. For central wireguard server setup route for the network address range of the new external site.