penpot/.gimlet/penpot-infra.yaml

app: penpot-infra
env: prod
manifests: |
  apiVersion: v1
  kind: Namespace
  metadata:
    name: penpot
    labels:
      toolkit.fluxcd.io/tenant: penpot-team
  ---
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: mailslurper
    namespace: penpot
    labels:
      app: mailslurper
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: mailslurper
    template:
      metadata:
        labels:
          app: mailslurper
      spec:
        containers:
        - name: mailslurper
          image: sj26/mailcatcher:latest
          ports:
          - containerPort: 1025
          - containerPort: 1080
  ---
  apiVersion: v1
  kind: Service
  metadata:
    name: mailslurper
    namespace: penpot
  spec:
    selector:
      app: mailslurper
    ports:
      - protocol: TCP
        port: 1025
        targetPort: 1025
  ---
  apiVersion: v1
  kind: Service
  metadata:
    name: mailslurper-ui
    namespace: penpot
  spec:
    selector:
      app: mailslurper
    ports:
      - protocol: TCP
        port: 1080
        targetPort: 1080
  ---
  apiVersion: bitnami.com/v1alpha1
  kind: SealedSecret
  metadata:
    creationTimestamp: null
    name: db-penpot-secrets
    namespace: penpot
  spec:
    encryptedData:
      password: AgBzAKLzhBGDrga3ojwgBnbaDmzxQkfoIcu90ji4iutq7t2OQCuJ/8NFD1KUw8hmQ6FlwQY3reaGqRnONdzdM2VyHQmXkaoXEzCAiARh9CWiwzwW2PG6KbSmHzo/YAt17Vkux0euc0z4JAceWqbXdm8Tl8FgUktFmJNY0OGIJ8CfLFNX8p6YujSoYpIRwjG0juiGhbPGeSkJguAAR7uwLwtjCNfFRuSqEDYeaRYHvhxGgh6pyJ70+qVzUQClFJEkVzNJu9CyGx48WSPDDpPbp+h84AWIIY25Cphk48DK/oNVikQitgMVOVBU8swcpz7MSVmKxs407vKRAWN4MGV2HkNrFwFjpQsksNAQ0KTfQrVigz1Hf985w4hji1gjifK7GbSgD9Kzz8pMni3gPMj0mr4y6Nhes+hc8AGTD3N+bhpJsAZKMzSZesdamWDiwyLi+ZPuPu+1/LBVLL68DAp6odKaposQfxeTKAkxqt/6s5jvKWPl3kQ9ud2cg/8Mw3B5pqzKK4dUwUdI1pNV4GyLTj9b+M1aDYaqGmYLzZVcYxeBVh27EFC2aon8/3zkXy6Hm/BZK/aZkrmO5sJTQRYRjnlG6rRtHCWcnXI6KKqKjU5GDFk2otqrlxPMQyXyjbwycP3rTHmhAaHWkR+fOETcq+kNbVUcaR3XTCw7T1qFZ4dtaBN02RHbRE3qxs/SjGMPnzfKQs1626gHAayZqxprpfz6mT0u0Hkn2NGg6RlJr36CxfE=
      username: AgBw5ALuBj1TpQc5dmyLW927WQO9AXgdyqYeXHwzXbLKIdyAkyihVIkTSD/MS/InTbsiFIYPvZptpAjpWc9p2IN8nvLbEjc8JXS7DA3NDr/SN7J70oDOKS/vT4Vlz4yX/6fmU8pGvjMh22ELBbruxWS+a6Nty/XcZPqJ8gMuj/vAnticq+i4Rmuy1aghEfsYzPVSigS5QfnnFsMBA5lZS7rgiv4voudi5aAh8luIsDx9eCk2WxcN+9f816MYXBxcZL853h4lIQziOfs8LK0jCZm62yOeckmuMt0EznGEwAS1Magrw9PnZdSDOHvTrugRT/sx8JzkpEorJQXTA/6hXT9tqTbZuLnHMcdVGAcU9+1QcJPtlhYH05irbDqMs5IgxqCW7ch3gtiIS1hTRGpaG+LoNGREcZZtiWxkgcVhJG8E+5ailyt0B/NO+RgjYjjK+tH/hcGd2hABvkmS1f9FUHIRdE0uiwvwM/hWU9qTJcSHdN3mJ96/7lQvfnDoDDP8zS09Co0E0zLmLFSAEvOIz7HMvE0Bw2UPzcy4N8J2y+u4m0327FUUN96Y3e2L+o1SrVw/CJO1/haN34j1SMUFh/4q63VvNLDfUD69QbpjMtjNrvhqNWyyET1QNWl4SFsfbMdC7/rXM9Lpg4GEZ6R5G/QcTb27Zo5UuOeFP060XiWJ1/bD8tiZKU1K1QTwJ0Uur3MDcrYRvGw=
    template:
      metadata:
        creationTimestamp: null
        name: db-penpot-secrets
        namespace: penpot
      type: Opaque
  ---
  apiVersion: bitnami.com/v1alpha1
  kind: SealedSecret
  metadata:
    creationTimestamp: null
    name: db-penpot-superuser-secret
    namespace: penpot
  spec:
    encryptedData:
      password: AgBwTdp950SD3x9c1CjlAz4MGEN3tTDQH0iKLW1e4itCEB+W7c6hf+t2nc4VYLAhxCbMfs+sS2onSuoIuzr7/wTLtia3gSaRAgPFu2t91m6s51ewMMrPxoAmIdpHiojCnBXdhuc6XjinOs40MOoS6/qY1WjEXaPyvKBeMdFkKAdDTvMW6WA9xel8Jyf3U6Tz8/Onj1VAAnhgehFvPMZ1uDCEtUfKDPAe+za4S1SRAL81iNwJCVQJrQdetDpcIMnKkMbUvy8RFDmPPKJ6lxZHFk8ztJgCXlj55ViWlEmUC3QHtktnB0QYd+B2rFf6j/66ozgzyiqHd4nXCuRiCxnFSgFMrWYbaDheJEN4rgDNZBITIBiqnlH5HntieQHj9YohsVkr7r0FObtKpePV1t+Sb0RptJ9+LWexkSs6Rvq3HNj7JdOLN/QVsIZbiU4ctRMjxiVsyl7PDZe84tx3Kl6BiUOrClN8QR6huLLnIdVXetMbrPDDQOCI4FiH5UghLRlPdNkvpoeYLfL79Mxy5yOG+xkydM5HR7//NMGDqP7hf+vZFe8/EKuaSExUX6S0AT+hQVkmWcwy7OKq2Ra37XezjmWf6KGiHAL8Idn47E+PQ5axAlkZ1MgkjB+pc/2Lpyo3bfINa7avf03nOKwJl01cChB9O4bDkUfDh7N+26YkqlwMm6aU4dm80fydsPRBikTKTWafpLsQqtimv1ANTYHvbDDEsufK95O/cq8ER/fTAmmrcg==
      username: AgAIwqIbS5Ze9e4sefyg77opd801epCHPewxEb+VuuJrxIl4+gFroopQNf/lhRQRFX1unI0PaR/iV5szaIaDmIYz3JQ3OxCyF1zeDYr6YhYNQMtkLgRJRrBr0j7TQPAKwLmgtZok7hDIvTj5bQ2dydibQ1Zg8N1valb03X6Vs/ivvvO3KvQEDckdGgD7UauL8onapU6KAFU5Hu9aEkvMTk4CGNpuLxGhYdA1+HLpLdQYBQPaJyEblGoko4wyv+pF/3m1tRBSQ1L8HsUXfAEn5dAd+0qkS5IvwOM8zXnZcT0ohXmY2mXjvPyv2phOKElQYURPwq9PPI+Sc5Ff7QHcVLjwQ+DYtSMDlRSt5BektWC+peBJfxZQ/X6w2AmICtdkOT03rrMxn0sWKIgQkvmJ0jkERAYlvifcoRmbof0wbFh+ANa0NpGLvxwiG+DsQ6eAsTB0Nu3wPCCBFZOUuTxS+yb4BjE3KPNGgVI6XtArxPnO3z3xglfI/nKDTY1rC2e0ZE72BDnhsLAwQTTgb/R/X2mvS7a0YXJ0gOpAgwP92K9zy1GA9ov2uTVZ2wbb39E69OxMKcbetDWirQrSYMqLYzJ1+W2cBbNdCcYQ2xnSM9cdEd2sPcFJ3NDVQeQRhxSTI6UfKWphUeksqwdW+VN7aODlUzMSxBCwGnxuaS6OVzOdLzQnORdyhyD8zclh5e0AXJpvqs+Z4CuvZA==
    template:
      metadata:
        creationTimestamp: null
        name: db-penpot-superuser-secret
        namespace: penpot
      type: Opaque
  ---
  apiVersion: source.toolkit.fluxcd.io/v1beta2
  kind: HelmRepository
  metadata:
    name: redis
    namespace: penpot
  spec:
    interval: 5m
    url: https://charts.bitnami.com/bitnami
  ---
  apiVersion: helm.toolkit.fluxcd.io/v2beta2
  kind: HelmRelease
  metadata:
    name: redis
    namespace: penpot
  spec:
    chart:
      spec:
        chart: redis 
        sourceRef:
          kind: HelmRepository
          name: redis
        version: 17.17.1
    install:
      remediation:
        retries: 3
    interval: 50m
    releaseName: penpot-redis
    values:
      auth:
        enabled: false
      replica:
        replicaCount: 0
  ---
  apiVersion: source.toolkit.fluxcd.io/v1beta1
  kind: HelmRepository
  metadata:
    name: oauth
    namespace: penpot
  spec:
    interval: 60m
    url: https://oauth2-proxy.github.io/manifests
  ---
  apiVersion: bitnami.com/v1alpha1
  kind: SealedSecret
  metadata:
    creationTimestamp: null
    name: oauth-secret
    namespace: penpot
  spec:
    encryptedData:
      client-id: AgAAdMf9uIqEgGAij4ovrpmCHU5lVU3vjnJyOwBoolqbHGFDwL4u1NxzZmMyjjtLeP7vdF8U9A6mO7C9ti2/1KSZQN0TXj0pT8Yz85GxGVMPCOPSZPq6Bi88cV+KmgU7j1XGK+xoXD3w+fP8trOYcv6d5ZUOfnbZ9tHHF09922/U4gV5HXlSdLVSo4dSJvKSOG8lzTkac9kvmQqGIKxbpcH4HHijgj0gGpLGdEectKb38vnCob1Vk2iVTIdmyr2UGzHMATdPK5bbY7gyBcTvxsOQK4XMKd03/hbvF3SsmhDgSy1VOqUx4cGhONT0LEYABmPT7rFmsKk+2/rESYcUMGX7HVgV1vmV37vbsFuAq34vgOZX9hLecF4kyRjPXiuLdhW23APzEWzb7m/GFSlM3oqalBznYUJtJMNd9fF2OH5tyHstJqnNYFNdumW+6gIWQ2GmyTV7k2ESqThNkTEcZivBpO40hAj/uVg/2nRXMba4iEw3bg+cq47fedEtQaSd6zIbf5N5YKm4+TUq5UnK7n/NYP2pPO/uvCm3oXg1AV9DaDmHRBzHkTdaSF4HrNdEfa7o7OS+aieOl/Qf9HhmkEd6YAY/98pdtmdobRdr4pwv2aCiScqI/UMRBJN8Kr85JI5NtjJGk6C2aFoeiBb/kTtNlzPvuSEvPSLCeMHH3UbTb9e/ktQptRuGRqRdLCwZyJrAlAEBxLIl956WgFjH4qbIFay8gfXhf/BgYlpNrkp6IzZkLRMSODpB
      client-secret: AgAveYBq0zhGemNt6NsnFDymHFBW1PqTCLZW2pXhPTv2xZgy1863/S0YaN341gpD+Ny81r8X/5zhvWQ/vWEOL805yrP/F9Zui6axsuuaMtf018azgmU5Ddn4FyxI6TKzgWTFdRpm5LfmLj2P6ttxoM5Uxe5p15HyKzuSKslK2N0IufT8x2d+qDtOpWzOgNk6jMPVE0NUvhzoX0YySG/AeOqF//oFM9h3F/ywjGiEm3JW4AvTU+zHI9dD97ECWJ7bFp1ffi9Q9cKpoM/2mC1/K/qzkxTdZsQpI5fjZmhimU7HAxzgsswSYNg53RA3XbpSm7K6seo7BKnrX4gXKRj+w2ApOAkmpQAND3j7/w5yTxuzr2I+9ihyh9V1z6bpPqMM7TbnOyF2Ze/MFnx07/gnzbcQ5VhEhjZiXFAwEv/kekEAtiscK9KNriTA4AlHB9o6k92WPso8YLzZYE4GZflerpGlRVdlRoroSFmngvZUQFzCw2JvvHiY/nTBys1R8BSLYcQ7a6bDGOcIk+94RGZGEZS/1utmirJCUWWA8F4tdawB9fkd7NNOrzkAG2Po1wnW0ZkNhT9uOOwPB+msLupKL/SrDGUv7kQKwIf/eELi1xVWCMJl0+iz3NnCPfRIMldbrjP0k8BCUQkjxHH0/AO1xBmgXjCpcPyX7rvHzuE1IRcHOvI6ADewCcqWueu8eSCIFzUYjtFxlH6dLeh/rsUdwbdqdm6MTbD5OhYtmRedHxLIWboKF2tV6fnrJPCygj0enhciHqrPfKbLk0ZeF0f8C3s92pnSQHaYyHSNdePv2gKYs4RPoL3QEFZbLm1aWDWhIJ8697jtCtyVMaMeDKClTotBm6VSaFbH9s0WWmA5ugsYVA==
      cookie-secret: AgA32CK7bAqb1ym43mJo01vgaTQkQnv744gFj+Uw2s6C6/zHirmZ+/rD7bJAQqyIYkxOet3XHRJEBFHLit0npIdk7mHJInwOGEjgxWab20beiqefknMBGi/vzFhK7vyMU516vjfqL2qH7u6wdP7X0W3KuS6yccdV+9G/OJ3X71qB+RRXW8/qsrnBahvkaiqLNK6S+riUMAf72OPZvqy6b010ErM+jfJzxxYDYUUmfJpHiXzNMp68Zo83fZ0vwEMXJNuhaAAY68qYQn6RFT+VRJIaC6gds6+QkbODlWMClQMp11ldix/T8urSG76ng4aQAmAqIhMN65Sj6iF/94P4AVdUaXZVBw5SmxWZx5Ejh0Z981JL9opzbbYsVpOPDoHK/73fhiRVWNDKL87aFFlJogXSfxOHLPJv2i4U8G8uu8gU5ZcVuH+uOewBP3aV+nBcAzTRHyOhx1jriM1UCaeIr3it8Kt7ecAklbwYslFJ2p5sJKr/tNSo/GarLZChfrboCayGjVWgA+QR2rh30bwvsAvo+JwSmAmk3p9lfcChO62KXPqbty5G7l7MC5vZjUDlIg3lYIUJDQOATk+GnkU8rTrrzM3hf8a/JBX18EDbCnJcVEp4AsOETg4ZltxmNej7UkI4AU8Ww35teWsvjrse9wVViNOT0Z6E++1kTD2LjZmhakxzzVIgp65of2ZIiN2Y5zL2a/XuH1yKniBvo2eWQcuYQZvJ7Jz20JXhIb9fzTwrWg==
    template:
      metadata:
        creationTimestamp: null
        name: oauth-secret
        namespace: penpot
      type: Opaque
  ---
  apiVersion: helm.toolkit.fluxcd.io/v2beta2
  kind: HelmRelease
  metadata:
    name: oauth2-proxy-penpot
    namespace: penpot
  spec:
    interval: 60m
    releaseName: oauth2-proxy-penpot
    chart:
      spec:
        chart: oauth2-proxy
        version: 7.5.4
        sourceRef:
          kind: HelmRepository
          name: oauth
        interval: 10m
    values:
      ingress:
        enabled: true
        className: traefik
        annotations: 
          cert-manager.io/cluster-issuer: letsencrypt-prod
          traefik.ingress.kubernetes.io/router.entrypoints: websecure
          traefik.ingress.kubernetes.io/router.tls: 'true'
        hosts:
          - mail.penpot.tokens.studio
        tls:
          - secretName: tls-penpot-mail
            hosts: 
              - mail.penpot.tokens.studio
      config:
        existingSecret: oauth-secret
        configFile: | 
              provider = "oidc"
              http_address = ":80"
              upstreams = ["http://mailslurper-ui.penpot.svc:1080"]
              redirect_url = "https://mail.penpot.tokens.studio/oauth2/callback"
              oidc_issuer_url = "https://auth.tokens.studio/application/o/penpot-mail/"
              email_domains = "*"
              cookie_secure = "true"
              oidc_groups_claim = "groups"
              user_id_claim = "preferred_username"
              skip_provider_button = "true"