Fresh repo - removed all old commits

2025-06-21 21:36:29 +01:00
commit 6fa64414f8
99 changed files with 35021 additions and 0 deletions
@@ -0,0 +1,8 @@
+Apply the files with "kubectl apply -f XXXX.yaml" in this order:
+
+wireguard-pvc.yaml
+wireguard-secret.yaml
+wireguard-deployment.yaml
+
+Server MTU is 1420 by default and wouldn't normally need to be adjusted (most local Internet connections use 1500 MTU which allows for the Wireguard overhead without causing issues due to fragmentation)
+Peer MTU should be set to 1360 to make sure the tunnels work over 4G/5G tethered connections without issues.
@@ -0,0 +1,117 @@
+kind: Service
+apiVersion: v1
+metadata:
+    labels:
+        app: wireguard
+    name: wireguard-listener-svc
+    namespace: home-stuff
+spec:
+    ports:
+        - port: ENC[AES256_GCM,data:bSOgn3w=,iv:XGMogH8J1/UWkl7QdjNNIxfhgMq8jKxhF1Kxsvvvr/M=,tag:Pk2l844gXiDr+OVhePp40Q==,type:int]
+          targetPort: ENC[AES256_GCM,data:B2SwsX4=,iv:0z+NKjO397L9O7japSoiozbEXFjmSB6SH7yossqTR+Y=,tag:VSvXpwpNm++2we6pm8CRZA==,type:int]
+          protocol: ENC[AES256_GCM,data:TYVf,iv:CvR9pbX1Jdl5vg2pZP0i5w1/LODiZDDzPAdpR0EYqdQ=,tag:zPEh+yjVui+kBBHz5F5bnQ==,type:str]
+    selector:
+        app: ENC[AES256_GCM,data:YGOvDsgpd1xJ,iv:8j1nfMdAsrNgkXjYOmpx8DrhWyRmuEnjH9FbGmacvpc=,tag:KlPp4XsB5bbfupi5McGaZA==,type:str]
+    type: LoadBalancer
+    loadBalancerIP: ENC[AES256_GCM,data:3Jfc8/hQk/EkYYFOeA==,iv:dZXTSUJqC8+JmDzMnrGjpkWYkH3WTXT7Um8L+55rsiQ=,tag:ZzjPlHXWVdTdA6pPTKoPiA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMeGwvWjIrSWVNN0tOOUNr
+            M3RscGVQZXZEaDZpVEplQXMyY1YrVm1YcURRCnN1SkNqaHVYTXdNdWZnZHE1Qmo5
+            RkhvdGdBVkdGZ1VPbDU3UHFabHFlQXMKLS0tIHVMY3hzME1pZzBSUDUvZnl0b0VY
+            UlJJclA1bjVWMk1uQWhpdEVYR0owNWMKI8ACinc5dveiZgpEL9EOyUj9t/ZeiGRE
+            k7kpB2S1YTmAwu99Y2N6Sd+aPlM2ZKT68pNYOzb7CEOOxJrNKMuwCw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-06-21T20:34:12Z"
+    mac: ENC[AES256_GCM,data:XPS4Wil5WhdoYuCwHogm3yzo2jBjtMrH0b8v7POwzobwkC7tW4dxgO9w8HGZhiOR1Gs08dlOpAtwiSYmAlUcbQFPuoQoz/MdwCi8hlzspTdMEq6mW+77SB7UB8PGRhlkRPT8EWvvN2eP/AfGY6Ss4Gq4q8NSG2oHrObaxCK0D9I=,iv:Frv/lax03XdmxshpfiN57nqpoKqxQeLAp6EAHOv8P4Q=,tag:xHoewf533DhYjnL6cRMv4A==,type:str]
+    pgp: []
+    unencrypted_regex: ^(apiVersion|metadata|kind|type)$
+    version: 3.9.1
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+    name: wireguard-vpn
+    namespace: home-stuff
+    labels:
+        app: wireguard
+spec:
+    replicas: ENC[AES256_GCM,data:8w==,iv:ujwV3GLhfqKhiNZPPYUUh74asr/YZaFM0fTmc/zbBPE=,tag:InOy+/INMRM3Srg11Ojpyg==,type:int]
+    selector:
+        matchLabels:
+            app: ENC[AES256_GCM,data:5vU4yj1jtV5m,iv:c/ZM9lIe2kmec9n3nrZpheIHh18ymfUzZMBTQyuqYhk=,tag:wI/F40QhsS5iNWvUc1XpfA==,type:str]
+    template:
+        metadata:
+            labels:
+                app: wireguard
+        spec:
+            containers:
+                - name: ENC[AES256_GCM,data:1MSVlgc34CAb8nbXWA==,iv:UYDEbLTG36YgH+nPBWU5xfmYBSzHkk52r8qNmexxrLo=,tag:gCpwgMVW1mMvrCUcyeGBBA==,type:str]
+                  image: ENC[AES256_GCM,data:MRqJrsbkrC1+/jCBCcNI0gK4vqt16rjPdgZr5TZRn83GMziF/rOIx44=,iv:vOx14SlXaKdwizpqyoDz1JLbKrK4+Tur0d7O7yLdn6k=,tag:x8X+jwvS/Qli4gWRNKjx0g==,type:str]
+                  imagePullPolicy: ENC[AES256_GCM,data:syq5eZG5OiD8CpCD,iv:UsmqKyd/J8R0ysoqas50oInWw6uY7ykhBprX3ehra6M=,tag:OFr+xKSrBu451EgktGsYiw==,type:str]
+                  env:
+                    - name: ENC[AES256_GCM,data:I1Y=,iv:inQIMls6pqjXMTfeRcgAmhCCJWlD7g672ztDxcMRFWg=,tag:aIQhqPXCVXPH9DBZ2ZyfEA==,type:str]
+                      value: ENC[AES256_GCM,data:4pU6,iv:hoztYodWKFoXBJN+uO75kcrmktdqNZ/EFrllGqwxcX8=,tag:QWcpxr7WfyLE4CHFGJH+ng==,type:str]
+                    - name: ENC[AES256_GCM,data:E/6H1rhmgNNO,iv:dXUZ8+I82ivMCCVd4oM7nbPBXxj24y3shfHbK5NOkFM=,tag:lsYMB8DJ+qiS/GebF8xB+w==,type:str]
+                      value: ENC[AES256_GCM,data:xGRfT1g19XBPyTivxNnBxkDBOSzqkg==,iv:iGIQyksGPy5YZKqXxvcUTsjx/2iayCPWBGuCWcPWI3U=,tag:pRZOd/e+N71PhSTaw5ZExA==,type:str]
+                    - name: ENC[AES256_GCM,data:eH2nAbakX19wGA==,iv:2aUly8M6v3B/T/R8DorY6fKgMzfigKE2q9a1Ip4KnjQ=,tag:7iWLZb83mZS2qJsKs/chbw==,type:str]
+                      value: ENC[AES256_GCM,data:rWH7Eos=,iv:sYKlk6A4TUHOMqV41XIerzjQDVM+2VmgvwQG4npypBg=,tag:vDg7cto4Y9adv2c4/7GU3g==,type:str]
+                    - name: ENC[AES256_GCM,data:z7plLA==,iv:gAvyYsCac5XH2FZjJyaXSwPIlQflYIgSXTzdkcM7ARY=,tag:kMc75v6pYKi6DWYye8VW2g==,type:str]
+                      value: ENC[AES256_GCM,data:aRICQw==,iv:57j1AhXc+glVO3casIm/w2sGXHDADTkEs8RThdfTDRs=,tag:dat0nF9RyN6rINT42JPFqQ==,type:str]
+                    - name: ENC[AES256_GCM,data:dDEZZw==,iv:IbLOEyOOmT/Lmjsqsswqgospd1iFu7fRfoSguU7oOAk=,tag:DNeU6MPbzsGR05ML5ojMng==,type:str]
+                      value: ENC[AES256_GCM,data:gYj/Fw==,iv:DC1usnz9EQC4XeyFdq+rbmF58PEQ/TFxU5HoiK1ctAU=,tag:6KFSqLDFaG1r5FEzTRDhpQ==,type:str]
+                    - name: ENC[AES256_GCM,data:MOo5GvSxDXzt,iv:jh0FI+8EuP5PyosZccf60ZJP0knqqukbKtrMKGOb5ok=,tag:x0QK9f92LsrlFiot6O4hyA==,type:str]
+                      value: ENC[AES256_GCM,data:8UWe3g==,iv:ih/ekDJgRVtZqhO/H75ycpsOAa5xHKR6McTP3G/jwbQ=,tag:zeOdo+UgtyFjekoQbdbI9Q==,type:str]
+                    - name: ENC[AES256_GCM,data:to1jyZA=,iv:WRtgTCIHHuzn392knPmvBUWj36TLt6Nz1VeZFvRRzsE=,tag:LXJPYcksiyzdbJQHZ3LT/Q==,type:str]
+                      value: ENC[AES256_GCM,data:MfvrBSy/2/zr826W1IanOzhwJHE8O+c=,iv:qUO8ZGEqYBWu5ll2PeoiZXHYUWUKwYZSRsGEpys1CWQ=,tag:dLdb4D36tKqNTh5IUMFS+w==,type:str]
+                    - name: ENC[AES256_GCM,data:sHhUnFlFAQ==,iv:7nLKqTP2AwmFdj0Qc0TjPPtQh4a9F75oOdsmw5Tr3Bg=,tag:1+J3oOu+6fjXmoU/BWo7tQ==,type:str]
+                      value: ENC[AES256_GCM,data:Y1lCq/HnFw==,iv:53LNDQJ8QshG4MN/iH23E/fcUNrObT5w7U3f+2hUR8w=,tag:OzFpO533STtTzizjwPNmVg==,type:str]
+                  volumeMounts:
+                    - name: ENC[AES256_GCM,data:Tk70qUArQkFF/NnXbIPMnw==,iv:bkZ9r3MrJHYe3DjSfZJzUt9b+ZnoF20RbB1Lmz2L94c=,tag:nXSyU34FpVJNDzCTg4ajMw==,type:str]
+                      mountPath: ENC[AES256_GCM,data:zvbxaot+KA==,iv:cyoNykSFPZ7BsouN9bfDvPTesq8DfeXp1fSD1jSI9gI=,tag:p/AFXQngiLK7bFnpNBpS7w==,type:str]
+                      readOnly: ENC[AES256_GCM,data:mQAlYSE=,iv:NW76weYJpXwomsmtkyTXsFE2UbLP0AgVe+H54mKLXWc=,tag:y9lCdGzzjhn27f77xfYf8Q==,type:bool]
+                  securityContext:
+                    privileged: ENC[AES256_GCM,data:GFd3Lg==,iv:kPlBOrcrCPhh4hHhbO2KbOpUtPSFdIAZa6GaI+G9p+U=,tag:1CJ136fwxhsmFgBC/Jw2ng==,type:bool]
+                    allowPrivilegeEscalation: ENC[AES256_GCM,data:xXIREA==,iv:ZX3H653vW8YJ4r+E2sV3xJNRULK09qGNtjKbqRDt5XU=,tag:JBnzI1LNL+UlNYZAtyi2Xg==,type:bool]
+                    capabilities:
+                        add:
+                            - ENC[AES256_GCM,data:ZyYO+ayxU3cy,iv:GcO8MH9WhIwa1hiwxU67BY4uwje8nMtdJiCv8YQXJAw=,tag:9hljr43iCzIUbYDnpyZO8Q==,type:str]
+                            - ENC[AES256_GCM,data:b3Z9GIhHlZaqBw==,iv:9Qqu7R1muVfbcg3h2vQL55VjKu5jNmNVmSWO/5bkp6c=,tag:DQ3RiISvaEPg3C+oc8evEQ==,type:str]
+                  ports:
+                    - containerPort: ENC[AES256_GCM,data:cZ3zT7s=,iv:ls+fjIZq8zacin6eYFr1JOs6nS0XyTa3RFcT84x3trE=,tag:AQ0LoeXxQ7gr55LZuukRBA==,type:int]
+                      protocol: ENC[AES256_GCM,data:N97f,iv:K10I+5MW2V21Mq6ZwM7Obe1syEACJg3qUTgeGmer3cM=,tag:CfixqxYvU49zCgLxJ2Ii3w==,type:str]
+            restartPolicy: ENC[AES256_GCM,data:q4rx2QWh,iv:3YA9akuyANKE/YmuOl8ZLhcSGMJXGt+VoqvKRpI8xM4=,tag:GVc3tL1QRQsdtoo+EiucYw==,type:str]
+            volumes:
+                - name: ENC[AES256_GCM,data:EwGdOHox9vY0O0FkPKtNXw==,iv:xZY7J1CS7cpPFiFS3wz/RihyacbKv3KCfHo1yTERHsQ=,tag:RuSX8x60DCK68KfDLdMSrw==,type:str]
+                  persistentVolumeClaim:
+                    claimName: ENC[AES256_GCM,data:4WLfc+IA3+Qs6iQE7ntVBwl3sV8=,iv:BceQTMb7SXOnBXpOiZMgqWS3IrIExq8itEAX0u1Ulfk=,tag:G7ubssWPTmei/TTbjB5a3Q==,type:str]
+                - name: ENC[AES256_GCM,data:ymoNIqTbh7UKcty2m3jTkw==,iv:F+yINlG0U61N09zx8S58Nzwy9SxpqH/kr6HyfVSRd5o=,tag:I7YS2inGLTKeUATxqKl4DA==,type:str]
+                  secret:
+                    secretName: ENC[AES256_GCM,data:0HkIk97Xe8wERxOJOQt7sR2r0/IQvEQ=,iv:Df6/Fok/WvH4wMaqfTFwvPXUhHVFLmR/9kViYYmFMag=,tag:/HRfXbDE0E5EJRgZOT6fGg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMeGwvWjIrSWVNN0tOOUNr
+            M3RscGVQZXZEaDZpVEplQXMyY1YrVm1YcURRCnN1SkNqaHVYTXdNdWZnZHE1Qmo5
+            RkhvdGdBVkdGZ1VPbDU3UHFabHFlQXMKLS0tIHVMY3hzME1pZzBSUDUvZnl0b0VY
+            UlJJclA1bjVWMk1uQWhpdEVYR0owNWMKI8ACinc5dveiZgpEL9EOyUj9t/ZeiGRE
+            k7kpB2S1YTmAwu99Y2N6Sd+aPlM2ZKT68pNYOzb7CEOOxJrNKMuwCw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-06-21T20:34:12Z"
+    mac: ENC[AES256_GCM,data:XPS4Wil5WhdoYuCwHogm3yzo2jBjtMrH0b8v7POwzobwkC7tW4dxgO9w8HGZhiOR1Gs08dlOpAtwiSYmAlUcbQFPuoQoz/MdwCi8hlzspTdMEq6mW+77SB7UB8PGRhlkRPT8EWvvN2eP/AfGY6Ss4Gq4q8NSG2oHrObaxCK0D9I=,iv:Frv/lax03XdmxshpfiN57nqpoKqxQeLAp6EAHOv8P4Q=,tag:xHoewf533DhYjnL6cRMv4A==,type:str]
+    pgp: []
+    unencrypted_regex: ^(apiVersion|metadata|kind|type)$
+    version: 3.9.1
@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+    name: wireguard-config-pvc
+    namespace: home-stuff
+spec:
+    accessModes:
+        - ENC[AES256_GCM,data:GjeUE4w+rVVElUdc+w==,iv:paivblm/EUqoJulUuKdVSqR+qQOSEpLyfNQ6B346kjk=,tag:9uMJwWiSB2J2aFd8lLMJRQ==,type:str]
+    storageClassName: ENC[AES256_GCM,data:FQZgf66SHhttIg==,iv:kyCg/josGCf+HnZCJIA2Dpd99xpgQKBlb6OCQTkO6kw=,tag:PFBOWfCLdCa0gdgk21bHUA==,type:str]
+    resources:
+        requests:
+            storage: ENC[AES256_GCM,data:Gpg6jcQ=,iv:ulO8OeZjwQqvvV6syKe4npU/Jd6J9liBPIgDVexgJRo=,tag:zfSPuCL02pqSDD8CTcr8mQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxN3JLWnE5QnZCTkFLdm1r
+            UVJwR1MyNG0zQjVOSVlGZjZvR29ab2R0c1JFCkJDZmpDdFI0ODZzMDlKMVJMTlJk
+            Zll6N05wVnJDSk92TFJobVRQb2pWSGMKLS0tIHdLQkprTG5XdENJL3UwMUxwOUZa
+            cjcxd2hCZCtVS1ZKWVNtYmFjQTI5VlEKD3gcOSIrL0H15cCTfDqhwO5tTXXppkvE
+            w03Ei7b5BvMgfPbs5BODJAMKig2IgIjwAMaVJbmO2nrFLIYLfJLQBw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-06-21T20:34:12Z"
+    mac: ENC[AES256_GCM,data:TNSBkk1up3Gx7SuQ4B5ha41z1Wi1S42NGASFfV+RKmoYFNDgjd6srg4lCdPFCOxwncslvRHzTq4qd+iieAOFX8mv0dj6v45Suy543sJfKrvxPI3bsqhQQkM6jpfOEztIeruJmk0DGxmygS2uvNp0yjVlklFHsrLaEAmTMFit/YM=,iv:FVPEJSf8V8HARtIEQG8LR/cIG3LHT9s4d5y/ww5JfTA=,tag:XqtKCoPm6O+xE/xOtUS9Cw==,type:str]
+    pgp: []
+    unencrypted_regex: ^(apiVersion|metadata|kind|type)$
+    version: 3.9.1
@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: wireguard-config-secret
+    namespace: home-stuff
+type: Opaque
+stringData:
+    wg0.conf.template: ENC[AES256_GCM,data:Ur3zI2tspNXyW/mLvBMt/J9lqDClGVl76zCNZDnFsMiL2lN4N/mOmEvabEdoGfoA2O0E5cMhdEkegPL6boxg55ryK07UWbwgpxogvQDvL218G0r817LCL/7aQIdS41SLwaD4b7J7bn3d7hf329tDHmUUT7EfXxo7Nl2KRRZscpQ94UkZQFU6zxCafGuBMpm+2CUr5bMablBbe9igiUtr+/IFHWda+gokgajDMdxdFbfp8w74IzvbOAB+B/+51ZZdWhP8kqPyRbNQC7XE0r8PBL2NgtqGwP2dK/qswbPv968nnSXvLMw70Ka4UHMYUGefjcGDSyV8PpzEAExdEmTmpxIGoYD5BpoBobE0aXMz01HWLgJf6BqjXsotHLqecHd96EHFcD/betDw2JFUwuEcy4Whf2Cv7oS0XAxwLcNPcE5Zj3eZKemFi6X4KN8QezLRrS8IFrn+RIRT5BMwSGHw75uq5wZq92h09toyBFrlIOzIu32OV3QDVZOA7ESpJ4jmGPyPtWDFoHbcqWyxdK0Graw2lvsdCjSayO/VMANU2ESjJmzFOV4=,iv:/80PcILX4ibMRKxgdxFlxhlREu1wAt9mhhkbNLrbRtc=,tag:mAshmTxo3yQ1cLJDYa20JA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvdkkxV2c4VlJ4Zk56dDc3
+            dmYyTHdIMFI2Tm5hRW5aT1dybmdBS0NaVUJNCkRZUWFTZm9TWGpBWk9oR2NYVWdX
+            cDlPdFp0ZjZXZlI2T2lJVXVhQU0wWTQKLS0tIHhjbnlSV1ZvOFZXOGRMaGcyT2NX
+            eWQza3NpOHFETDZiVVhQMENTNXp3U3cKjmoRylSvvPHIEPxE+LZ1ep97AHBB5NLV
+            olUu6XUvwmk3yQEwK9wwEsITnc5R2fQXd5iiIQGwmQN2AM3oujqoEA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-06-21T20:34:12Z"
+    mac: ENC[AES256_GCM,data:qPAyonOi3SecIZNtJARIDYfXLL3H2gFTzaxfqnfNZUS7Cz1GZKBOrEPfqQPNJeTwSXS9ZE5JqO4wPLKBA16061kqoXRooSPHTRj5IClpyu72+l+qN0prXLi6GC0bn0DMEk1sOekqIOgDjnZRKYK1y6aof+DVmimguiDoF+sVuHk=,iv:FyuvxO1gnGwcWR/dD45gLwPG61oAbK8awa9QbrPxWbI=,tag:dHkxhx7Br3Ta2mDfwI6bSA==,type:str]
+    pgp: []
+    unencrypted_regex: ^(apiVersion|metadata|kind|type)$
+    version: 3.9.1