diff --git a/manifests/ca-installer/ca-installer.yaml b/manifests/ca-installer/ca-installer.yaml new file mode 100644 index 0000000..d35adf4 --- /dev/null +++ b/manifests/ca-installer/ca-installer.yaml @@ -0,0 +1,130 @@ +# ca-installer.yaml +# CA Trust Installer — serves CA cert + iOS mobileconfig at ca.home.arpa +# +# Pre-requisites (run once, or after CA cert rotation): +# kubectl create configmap ca-installer-web -n ca-installer \ +# --from-file=index.html=manifests/ca-installer/web/index.html +# +# kubectl create configmap ca-installer-files -n ca-installer \ +# --from-file=ca.crt=/tmp/homelab-ca.crt \ +# --from-file=ca.mobileconfig=/tmp/homelab-ca.mobileconfig +# +# Apply: kubectl apply -f manifests/ca-installer/ca-installer.yaml +--- +apiVersion: v1 +kind: Namespace +metadata: + name: ca-installer +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: nginx-config + namespace: ca-installer +data: + default.conf: | + server { + listen 80; + server_name ca.home.arpa; + root /usr/share/nginx/html; + + # CA cert — must be application/x-x509-ca-cert for iOS to recognise it + location = /ca.crt { + default_type application/x-x509-ca-cert; + try_files /ca.crt =404; + } + + # iOS mobileconfig — must be this exact MIME type + location = /ca.mobileconfig { + default_type application/x-apple-aspen-config; + try_files /ca.mobileconfig =404; + } + + location / { + try_files $uri $uri/ /index.html; + } + } +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ca-installer + namespace: ca-installer + labels: + app: ca-installer +spec: + replicas: 1 + selector: + matchLabels: + app: ca-installer + template: + metadata: + labels: + app: ca-installer + spec: + containers: + - name: nginx + image: nginx:alpine + ports: + - containerPort: 80 + volumeMounts: + - name: web-files + mountPath: /usr/share/nginx/html/index.html + subPath: index.html + - name: ca-cert + mountPath: /usr/share/nginx/html/ca.crt + subPath: ca.crt + - name: ca-mobileconfig + mountPath: /usr/share/nginx/html/ca.mobileconfig + subPath: ca.mobileconfig + - name: nginx-config + mountPath: /etc/nginx/conf.d/default.conf + subPath: default.conf + volumes: + - name: web-files + configMap: + name: ca-installer-web + - name: ca-cert + configMap: + name: ca-installer-files + - name: ca-mobileconfig + configMap: + name: ca-installer-files + - name: nginx-config + configMap: + name: nginx-config +--- +apiVersion: v1 +kind: Service +metadata: + name: ca-installer + namespace: ca-installer +spec: + selector: + app: ca-installer + ports: + - port: 80 + targetPort: 80 +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: ca-installer + namespace: ca-installer + annotations: + # No TLS — this page is how you GET the CA, serving over HTTP avoids + # the chicken-and-egg problem. Once CA is trusted, *.home.arpa is fine. + traefik.ingress.kubernetes.io/router.entrypoints: web,websecure +spec: + ingressClassName: traefik + rules: + - host: ca.home.arpa + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: ca-installer + port: + number: 80 \ No newline at end of file diff --git a/manifests/ca-installer/web/index.html b/manifests/ca-installer/web/index.html new file mode 100644 index 0000000..9d2d876 --- /dev/null +++ b/manifests/ca-installer/web/index.html @@ -0,0 +1,750 @@ + + + + + +Homelab CA — Trust Installer + + + + + +
+ +
+
homelab.internal
+

Trust the
homelab CA

+

Install the internal certificate authority to access homelab services without browser warnings.

+
+ +
+ ⚠ + This page itself may show a certificate warning — that's expected. Once you install the CA, all *.home.arpa services will be trusted automatically. +
+ + +
+
+
DETECTED DEVICE
+
detecting...
+
+
+ +
+
+ + +
OTHER DEVICES
+
+ +
+ + + +
+ + + + diff --git a/values/pihole.yaml b/values/pihole.yaml index 17a618b..8241adc 100644 --- a/values/pihole.yaml +++ b/values/pihole.yaml @@ -78,4 +78,5 @@ dnsmasq: - address=/qbittorrent.home.arpa/192.168.7.77 - address=/jdownloader.home.arpa/192.168.7.77 - address=/glances.home.arpa/192.168.7.77 - - address=/glances-debian.home.arpa/192.168.7.77 \ No newline at end of file + - address=/glances-debian.home.arpa/192.168.7.77 + - address=/ca.home.arpa/1 \ No newline at end of file