Skip to content

Commit 39c5253

Browse files
wolf31o2wolf31o2
authored
feat: wireguard chart (#319)
Signed-off-by: Chris Gianelloni <wolf31o2@blinklabs.io>
1 parent 0ac368c commit 39c5253

17 files changed

Lines changed: 617 additions & 1 deletion

‎.github/workflows/helmchart-testing.yml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,9 +61,18 @@ jobs:
6161
for chart_path in "${chart_array[@]}"; do
6262
chart_name=$(basename "$chart_path")
6363
echo "Installing $chart_name from $chart_path..."
64+
# Build values file arguments from ci/ directory (same pattern as ct install)
65+
values_args=""
66+
for values_file in "$chart_path"/ci/*-values.yaml "$chart_path"/ci/values-*.yaml; do
67+
if [[ -f "$values_file" ]]; then
68+
echo " Using values file: $values_file"
69+
values_args="$values_args -f $values_file"
70+
fi
71+
done
6472
helm install "$chart_name" "$chart_path" \
6573
--namespace "${chart_name}-ci" \
6674
--create-namespace \
6775
--wait=false \
68-
--timeout 30s
76+
--timeout 30s \
77+
$values_args
6978
done

‎.github/workflows/publish-wireguard-helm-chart.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: publish-wireguard-helm-chart
2+
3+
on:
4+
push:
5+
branches: ['main']
6+
paths: ['charts/wireguard/**','.github/workflows/publish-wireguard-helm-chart.yml']
7+
8+
jobs:
9+
build-and-push-wireguard-helm-chart:
10+
runs-on: ubuntu-latest
11+
permissions:
12+
contents: read
13+
packages: write
14+
steps:
15+
- uses: actions/checkout@v6.0.1
16+
- name: Install Helm
17+
uses: azure/setup-helm@v4
18+
- name: Package and upload chart
19+
shell: bash
20+
env:
21+
REGISTRY: "ghcr.io"
22+
REPOSITORY: "${{ github.repository }}"
23+
TOKEN: "${{ secrets.GITHUB_TOKEN }}"
24+
USER: "${{ github.repository_owner }}"
25+
run: |
26+
set -eo pipefail
27+
rm -rf dist
28+
mkdir dist
29+
helm package charts/wireguard/ -d dist/
30+
echo "${TOKEN}" | helm registry login "${REGISTRY}" -u "${USER}" --password-stdin
31+
for file in dist/*; do
32+
helm push "$file" "oci://${REGISTRY}/${REPOSITORY,,}/charts"
33+
done

‎charts/wireguard/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/wireguard/Chart.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: v2
2+
name: wireguard
3+
description: WireGuard VPN server with JWT-authenticated peer management API
4+
type: application
5+
version: 0.1.0
6+
appVersion: "0.1.0"
7+
maintainers:
8+
- name: aurora
9+
email: aurora@blinklabs.io
10+
- name: verbotenj
11+
email: verbotenj@blinklabs.io
12+
- name: wolf31o2
13+
email: wolf31o2@blinklabs.io
14+
sources:
15+
- https://github.com/blinklabs-io/docker-wireguard
16+
keywords:
17+
- wireguard
18+
- vpn
19+
- dvpn
20+
- cardano

‎charts/wireguard/ci/test-values.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# CI test values for chart-testing
2+
# These values satisfy required fields for Helm install tests
3+
4+
wireguard:
5+
# Test endpoint for CI
6+
endpoint: "test.wireguard.example.com:51820"
7+
# Test private key (base64 encoded, for CI only)
8+
privateKey: "YUd3Z0dIRGRnZGdmZ2hkZ2hkZ2hkZmdoZGZnaGRmZ2g="
9+
10+
api:
11+
# Test JWT public key (Ed25519 PEM format, for CI only)
12+
jwtPublicKey: |
13+
-----BEGIN PUBLIC KEY-----
14+
MCowBQYDK2VwAyEAtest1234567890abcdefghijklmnopqrstuvwxyz=
15+
-----END PUBLIC KEY-----
16+
17+
# Use ClusterIP for CI (no LoadBalancer in kind cluster)
18+
service:
19+
type: ClusterIP

‎charts/wireguard/templates/_helpers.tpl‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "wireguard.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "wireguard.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "wireguard.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "wireguard.labels" -}}
37+
helm.sh/chart: {{ include "wireguard.chart" . }}
38+
{{ include "wireguard.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "wireguard.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "wireguard.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
app: wireguard
52+
region: {{ .Values.region }}
53+
{{- end }}
54+
55+
{{/*
56+
Create the name of the service account to use
57+
*/}}
58+
{{- define "wireguard.serviceAccountName" -}}
59+
{{- if .Values.serviceAccount.create }}
60+
{{- default (include "wireguard.fullname" .) .Values.serviceAccount.name }}
61+
{{- else }}
62+
{{- default "default" .Values.serviceAccount.name }}
63+
{{- end }}
64+
{{- end }}
65+
66+
{{/*
67+
Get the WireGuard private key secret name
68+
*/}}
69+
{{- define "wireguard.secretName" -}}
70+
{{- if .Values.wireguard.existingSecret }}
71+
{{- .Values.wireguard.existingSecret }}
72+
{{- else }}
73+
{{- printf "%s-keys" (include "wireguard.fullname" .) | trunc 63 | trimSuffix "-" }}
74+
{{- end }}
75+
{{- end }}
76+
77+
{{/*
78+
Get the JWT public key ConfigMap name
79+
*/}}
80+
{{- define "wireguard.jwtConfigMapName" -}}
81+
{{- if .Values.api.existingJwtConfigMap }}
82+
{{- .Values.api.existingJwtConfigMap }}
83+
{{- else }}
84+
{{- printf "%s-jwt-pubkey" (include "wireguard.fullname" .) | trunc 63 | trimSuffix "-" }}
85+
{{- end }}
86+
{{- end }}

‎charts/wireguard/templates/configmap.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{{- if not .Values.api.existingJwtConfigMap }}
2+
{{- $jwt := required "api.jwtPublicKey is required when api.existingJwtConfigMap is not set" .Values.api.jwtPublicKey }}
3+
apiVersion: v1
4+
kind: ConfigMap
5+
metadata:
6+
name: {{ include "wireguard.fullname" . }}-jwt-pubkey
7+
labels:
8+
{{- include "wireguard.labels" . | nindent 4 }}
9+
data:
10+
jwt-verify.pub: |
11+
{{- $jwt | nindent 4 }}
12+
{{- end }}

‎charts/wireguard/templates/deployment.yaml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "wireguard.fullname" . }}
5+
labels:
6+
{{- include "wireguard.labels" . | nindent 4 }}
7+
spec:
8+
replicas: {{ .Values.replicaCount }}
9+
selector:
10+
matchLabels:
11+
{{- include "wireguard.selectorLabels" . | nindent 6 }}
12+
template:
13+
metadata:
14+
annotations:
15+
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
16+
{{- with .Values.podAnnotations }}
17+
{{- toYaml . | nindent 8 }}
18+
{{- end }}
19+
labels:
20+
{{- include "wireguard.selectorLabels" . | nindent 8 }}
21+
spec:
22+
{{- with .Values.imagePullSecrets }}
23+
imagePullSecrets:
24+
{{- toYaml . | nindent 8 }}
25+
{{- end }}
26+
serviceAccountName: {{ include "wireguard.serviceAccountName" . }}
27+
{{- with .Values.podSecurityContext }}
28+
securityContext:
29+
{{- toYaml . | nindent 8 }}
30+
{{- end }}
31+
containers:
32+
- name: {{ .Chart.Name }}
33+
{{- with .Values.securityContext }}
34+
securityContext:
35+
{{- toYaml . | nindent 12 }}
36+
{{- end }}
37+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
38+
imagePullPolicy: {{ .Values.image.pullPolicy }}
39+
ports:
40+
- name: wireguard
41+
containerPort: {{ .Values.wireguard.port }}
42+
protocol: UDP
43+
- name: api
44+
containerPort: {{ .Values.api.port }}
45+
protocol: TCP
46+
env:
47+
- name: WG_PRIVATE_KEY
48+
valueFrom:
49+
secretKeyRef:
50+
name: {{ include "wireguard.secretName" . }}
51+
key: private-key
52+
- name: WG_ENDPOINT
53+
value: {{ .Values.wireguard.endpoint | quote }}
54+
- name: WG_PORT
55+
value: {{ .Values.wireguard.port | quote }}
56+
- name: WG_SUBNET
57+
value: {{ .Values.wireguard.subnet | quote }}
58+
- name: WG_DNS
59+
value: {{ .Values.wireguard.dns | quote }}
60+
- name: ENABLE_NAT
61+
value: {{ .Values.wireguard.enableNat | ternary "1" "0" | quote }}
62+
- name: NAT_DEVICE
63+
value: {{ .Values.wireguard.natDevice | quote }}
64+
- name: API_LISTEN
65+
value: {{ .Values.api.listen | quote }}
66+
- name: JWT_PUBLIC_KEY_FILE
67+
value: /etc/wireguard/jwt-verify.pub
68+
- name: DEBUG
69+
value: {{ .Values.debug | ternary "1" "0" | quote }}
70+
volumeMounts:
71+
- name: jwt-pubkey
72+
mountPath: /etc/wireguard/jwt-verify.pub
73+
subPath: jwt-verify.pub
74+
readOnly: true
75+
{{- with .Values.livenessProbe }}
76+
livenessProbe:
77+
{{- toYaml . | nindent 12 }}
78+
{{- end }}
79+
{{- with .Values.readinessProbe }}
80+
readinessProbe:
81+
{{- toYaml . | nindent 12 }}
82+
{{- end }}
83+
{{- with .Values.resources }}
84+
resources:
85+
{{- toYaml . | nindent 12 }}
86+
{{- end }}
87+
volumes:
88+
- name: jwt-pubkey
89+
configMap:
90+
name: {{ include "wireguard.jwtConfigMapName" . }}
91+
{{- with .Values.nodeSelector }}
92+
nodeSelector:
93+
{{- toYaml . | nindent 8 }}
94+
{{- end }}
95+
{{- with .Values.affinity }}
96+
affinity:
97+
{{- toYaml . | nindent 8 }}
98+
{{- end }}
99+
{{- with .Values.tolerations }}
100+
tolerations:
101+
{{- toYaml . | nindent 8 }}
102+
{{- end }}

‎charts/wireguard/templates/networkpolicy.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{{- if .Values.networkPolicy.enabled }}
2+
{{- $apiLabels := required "networkPolicy.apiAllowedPodLabels is required when networkPolicy.enabled is true" .Values.networkPolicy.apiAllowedPodLabels }}
3+
apiVersion: networking.k8s.io/v1
4+
kind: NetworkPolicy
5+
metadata:
6+
name: {{ include "wireguard.fullname" . }}
7+
labels:
8+
{{- include "wireguard.labels" . | nindent 4 }}
9+
spec:
10+
podSelector:
11+
matchLabels:
12+
{{- include "wireguard.selectorLabels" . | nindent 6 }}
13+
policyTypes:
14+
- Ingress
15+
- Egress
16+
ingress:
17+
{{- if .Values.networkPolicy.allowWireguardFromAnywhere }}
18+
# WireGuard UDP from anywhere
19+
- ports:
20+
- port: {{ .Values.wireguard.port }}
21+
protocol: UDP
22+
{{- end }}
23+
# API only from allowed pods (e.g., vpn-indexer)
24+
- from:
25+
- podSelector:
26+
matchLabels:
27+
{{- toYaml $apiLabels | nindent 14 }}
28+
ports:
29+
- port: {{ .Values.api.port }}
30+
protocol: TCP
31+
egress:
32+
# Allow all outbound (VPN traffic needs internet access)
33+
- {}
34+
{{- end }}

‎charts/wireguard/templates/poddisruptionbudget.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{{- if .Values.podDisruptionBudget.enabled }}
2+
{{- $hasMinAvailable := hasKey .Values.podDisruptionBudget "minAvailable" }}
3+
{{- $hasMaxUnavailable := hasKey .Values.podDisruptionBudget "maxUnavailable" }}
4+
{{- if not (or $hasMinAvailable $hasMaxUnavailable) }}
5+
{{- fail "podDisruptionBudget.enabled is true but neither minAvailable nor maxUnavailable is set" }}
6+
{{- end }}
7+
apiVersion: policy/v1
8+
kind: PodDisruptionBudget
9+
metadata:
10+
name: {{ include "wireguard.fullname" . }}
11+
labels:
12+
{{- include "wireguard.labels" . | nindent 4 }}
13+
spec:
14+
{{- if $hasMaxUnavailable }}
15+
maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
16+
{{- else if $hasMinAvailable }}
17+
minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
18+
{{- end }}
19+
selector:
20+
matchLabels:
21+
{{- include "wireguard.selectorLabels" . | nindent 6 }}
22+
{{- end }}

0 commit comments

Comments
 (0)