Skip to content

Commit 7607651

Browse files
wolf31o2wolf31o2
committed
feat: wireguard chart
Signed-off-by: Chris Gianelloni <wolf31o2@blinklabs.io>
1 parent 0ac368c commit 7607651

15 files changed

Lines changed: 577 additions & 0 deletions

‎.github/workflows/publish-wireguard-helm-chart.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: publish-wireguard-helm-chart
2+
3+
on:
4+
push:
5+
branches: ['main']
6+
paths: ['charts/wireguard/**','.github/workflows/publish-wireguard-helm-chart.yml']
7+
8+
jobs:
9+
build-and-push-wireguard-helm-chart:
10+
runs-on: ubuntu-latest
11+
permissions:
12+
contents: read
13+
packages: write
14+
steps:
15+
- uses: actions/checkout@v6.0.1
16+
- name: Install Helm
17+
uses: azure/setup-helm@v4
18+
- name: Package and upload chart
19+
shell: bash
20+
env:
21+
REGISTRY: "ghcr.io"
22+
REPOSITORY: "${{ github.repository }}"
23+
TOKEN: "${{ secrets.GITHUB_TOKEN }}"
24+
USER: "${{ github.repository_owner }}"
25+
run: |
26+
rm -rf dist
27+
mkdir dist
28+
helm package charts/wireguard/ -d dist/
29+
echo "${TOKEN}" | helm registry login "${REGISTRY}" -u "${USER}" --password-stdin
30+
for file in dist/*; do
31+
helm push "$file" "oci://${REGISTRY}/${REPOSITORY,,}/charts"
32+
done

‎charts/wireguard/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/wireguard/Chart.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: v2
2+
name: wireguard
3+
description: WireGuard VPN server with JWT-authenticated peer management API
4+
type: application
5+
version: 0.1.0
6+
appVersion: "0.1.0"
7+
maintainers:
8+
- name: aurora
9+
email: aurora@blinklabs.io
10+
- name: verbotenj
11+
email: verbotenj@blinklabs.io
12+
- name: wolf31o2
13+
email: wolf31o2@blinklabs.io
14+
sources:
15+
- https://github.com/blinklabs-io/docker-wireguard
16+
keywords:
17+
- wireguard
18+
- vpn
19+
- dvpn
20+
- cardano

‎charts/wireguard/templates/_helpers.tpl‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "wireguard.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "wireguard.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "wireguard.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "wireguard.labels" -}}
37+
helm.sh/chart: {{ include "wireguard.chart" . }}
38+
{{ include "wireguard.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "wireguard.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "wireguard.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
app: wireguard
52+
region: {{ .Values.region }}
53+
{{- end }}
54+
55+
{{/*
56+
Create the name of the service account to use
57+
*/}}
58+
{{- define "wireguard.serviceAccountName" -}}
59+
{{- if .Values.serviceAccount.create }}
60+
{{- default (include "wireguard.fullname" .) .Values.serviceAccount.name }}
61+
{{- else }}
62+
{{- default "default" .Values.serviceAccount.name }}
63+
{{- end }}
64+
{{- end }}
65+
66+
{{/*
67+
Get the WireGuard private key secret name
68+
*/}}
69+
{{- define "wireguard.secretName" -}}
70+
{{- if .Values.wireguard.existingSecret }}
71+
{{- .Values.wireguard.existingSecret }}
72+
{{- else }}
73+
{{- include "wireguard.fullname" . }}-keys
74+
{{- end }}
75+
{{- end }}
76+
77+
{{/*
78+
Get the JWT public key ConfigMap name
79+
*/}}
80+
{{- define "wireguard.jwtConfigMapName" -}}
81+
{{- if .Values.api.existingJwtConfigMap }}
82+
{{- .Values.api.existingJwtConfigMap }}
83+
{{- else }}
84+
{{- include "wireguard.fullname" . }}-jwt-pubkey
85+
{{- end }}
86+
{{- end }}

‎charts/wireguard/templates/configmap.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{{- if not .Values.api.existingJwtConfigMap }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: {{ include "wireguard.fullname" . }}-jwt-pubkey
6+
labels:
7+
{{- include "wireguard.labels" . | nindent 4 }}
8+
data:
9+
jwt-verify.pub: |
10+
{{- .Values.api.jwtPublicKey | nindent 4 }}
11+
{{- end }}

‎charts/wireguard/templates/deployment.yaml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "wireguard.fullname" . }}
5+
labels:
6+
{{- include "wireguard.labels" . | nindent 4 }}
7+
spec:
8+
replicas: {{ .Values.replicaCount }}
9+
selector:
10+
matchLabels:
11+
{{- include "wireguard.selectorLabels" . | nindent 6 }}
12+
template:
13+
metadata:
14+
annotations:
15+
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
16+
{{- with .Values.podAnnotations }}
17+
{{- toYaml . | nindent 8 }}
18+
{{- end }}
19+
labels:
20+
{{- include "wireguard.selectorLabels" . | nindent 8 }}
21+
spec:
22+
{{- with .Values.imagePullSecrets }}
23+
imagePullSecrets:
24+
{{- toYaml . | nindent 8 }}
25+
{{- end }}
26+
serviceAccountName: {{ include "wireguard.serviceAccountName" . }}
27+
{{- with .Values.podSecurityContext }}
28+
securityContext:
29+
{{- toYaml . | nindent 8 }}
30+
{{- end }}
31+
containers:
32+
- name: {{ .Chart.Name }}
33+
{{- with .Values.securityContext }}
34+
securityContext:
35+
{{- toYaml . | nindent 12 }}
36+
{{- end }}
37+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
38+
imagePullPolicy: {{ .Values.image.pullPolicy }}
39+
ports:
40+
- name: wireguard
41+
containerPort: {{ .Values.wireguard.port }}
42+
protocol: UDP
43+
- name: api
44+
containerPort: {{ .Values.api.port }}
45+
protocol: TCP
46+
env:
47+
- name: WG_PRIVATE_KEY
48+
valueFrom:
49+
secretKeyRef:
50+
name: {{ include "wireguard.secretName" . }}
51+
key: private-key
52+
- name: WG_ENDPOINT
53+
value: {{ .Values.wireguard.endpoint | quote }}
54+
- name: WG_PORT
55+
value: {{ .Values.wireguard.port | quote }}
56+
- name: WG_SUBNET
57+
value: {{ .Values.wireguard.subnet | quote }}
58+
- name: WG_DNS
59+
value: {{ .Values.wireguard.dns | quote }}
60+
- name: ENABLE_NAT
61+
value: {{ .Values.wireguard.enableNat | ternary "1" "0" | quote }}
62+
- name: NAT_DEVICE
63+
value: {{ .Values.wireguard.natDevice | quote }}
64+
- name: API_LISTEN
65+
value: {{ .Values.api.listen | quote }}
66+
- name: JWT_PUBLIC_KEY_FILE
67+
value: /etc/wireguard/jwt-verify.pub
68+
- name: DEBUG
69+
value: {{ .Values.debug | ternary "1" "0" | quote }}
70+
volumeMounts:
71+
- name: jwt-pubkey
72+
mountPath: /etc/wireguard/jwt-verify.pub
73+
subPath: jwt-verify.pub
74+
readOnly: true
75+
{{- with .Values.livenessProbe }}
76+
livenessProbe:
77+
{{- toYaml . | nindent 12 }}
78+
{{- end }}
79+
{{- with .Values.readinessProbe }}
80+
readinessProbe:
81+
{{- toYaml . | nindent 12 }}
82+
{{- end }}
83+
{{- with .Values.resources }}
84+
resources:
85+
{{- toYaml . | nindent 12 }}
86+
{{- end }}
87+
volumes:
88+
- name: jwt-pubkey
89+
configMap:
90+
name: {{ include "wireguard.jwtConfigMapName" . }}
91+
{{- with .Values.nodeSelector }}
92+
nodeSelector:
93+
{{- toYaml . | nindent 8 }}
94+
{{- end }}
95+
{{- with .Values.affinity }}
96+
affinity:
97+
{{- toYaml . | nindent 8 }}
98+
{{- end }}
99+
{{- with .Values.tolerations }}
100+
tolerations:
101+
{{- toYaml . | nindent 8 }}
102+
{{- end }}

‎charts/wireguard/templates/networkpolicy.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{{- if .Values.networkPolicy.enabled }}
2+
apiVersion: networking.k8s.io/v1
3+
kind: NetworkPolicy
4+
metadata:
5+
name: {{ include "wireguard.fullname" . }}
6+
labels:
7+
{{- include "wireguard.labels" . | nindent 4 }}
8+
spec:
9+
podSelector:
10+
matchLabels:
11+
{{- include "wireguard.selectorLabels" . | nindent 6 }}
12+
policyTypes:
13+
- Ingress
14+
- Egress
15+
ingress:
16+
{{- if .Values.networkPolicy.allowWireguardFromAnywhere }}
17+
# WireGuard UDP from anywhere
18+
- ports:
19+
- port: {{ .Values.wireguard.port }}
20+
protocol: UDP
21+
{{- end }}
22+
# API only from allowed pods (e.g., vpn-indexer)
23+
- from:
24+
- podSelector:
25+
matchLabels:
26+
{{- toYaml .Values.networkPolicy.apiAllowedPodLabels | nindent 14 }}
27+
ports:
28+
- port: {{ .Values.api.port }}
29+
protocol: TCP
30+
egress:
31+
# Allow all outbound (VPN traffic needs internet access)
32+
- {}
33+
{{- end }}

‎charts/wireguard/templates/poddisruptionbudget.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{{- if .Values.podDisruptionBudget.enabled }}
2+
apiVersion: policy/v1
3+
kind: PodDisruptionBudget
4+
metadata:
5+
name: {{ include "wireguard.fullname" . }}
6+
labels:
7+
{{- include "wireguard.labels" . | nindent 4 }}
8+
spec:
9+
{{- if .Values.podDisruptionBudget.minAvailable }}
10+
minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
11+
{{- end }}
12+
{{- if .Values.podDisruptionBudget.maxUnavailable }}
13+
maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
14+
{{- end }}
15+
selector:
16+
matchLabels:
17+
{{- include "wireguard.selectorLabels" . | nindent 6 }}
18+
{{- end }}

‎charts/wireguard/templates/podmonitor.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{{- if .Values.podMonitor.enabled }}
2+
apiVersion: monitoring.coreos.com/v1
3+
kind: PodMonitor
4+
metadata:
5+
name: {{ include "wireguard.fullname" . }}
6+
labels:
7+
{{- include "wireguard.labels" . | nindent 4 }}
8+
{{- with .Values.podMonitor.extraLabels }}
9+
{{- toYaml . | nindent 4 }}
10+
{{- end }}
11+
spec:
12+
{{- with .Values.podMonitor.fallbackScrapeProtocol }}
13+
fallbackScrapeProtocol: {{ . | quote }}
14+
{{- end }}
15+
selector:
16+
matchLabels:
17+
{{- include "wireguard.selectorLabels" . | nindent 6 }}
18+
namespaceSelector:
19+
matchNames:
20+
- {{ .Release.Namespace }}
21+
podMetricsEndpoints:
22+
{{- toYaml .Values.podMonitor.podMetricsEndpoints | nindent 4 }}
23+
{{- end }}

‎charts/wireguard/templates/secret.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{{- if and (not .Values.wireguard.existingSecret) .Values.wireguard.privateKey }}
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: {{ include "wireguard.fullname" . }}-keys
6+
labels:
7+
{{- include "wireguard.labels" . | nindent 4 }}
8+
type: Opaque
9+
data:
10+
private-key: {{ .Values.wireguard.privateKey | b64enc | quote }}
11+
{{- end }}

0 commit comments

Comments
 (0)