Add Helm chart for the expense tracker (app, Postgres, ingress, backups)

- Deployment/Service for the app, StatefulSet/Service for Postgres 17
- Secrets (DB password, session secret, Google client, allowed e-mails) via
  ExternalSecret from OpenBao
- Ingress with a Let's Encrypt certificate, NetworkPolicy for Postgres
- Nightly pg_dump CronJob
- Optional OpenBao OIDC provider setup script

Co-Authored-By: Claude Sonnet 5 <[email protected]>

scripts/openbao-oidc.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Configure OpenBao as an OpenID Connect provider for the expense tracker and store the
+# resulting client credentials + CA certificate in the KV secret the chart reads.
+#
+#   export BAO_ADDR=https://192.168.2.218:30200 BAO_SKIP_VERIFY=true BAO_TOKEN=<admin token>
+#   scripts/openbao-oidc.sh
+#
+# Prerequisites: `bao` and `kubectl` on PATH; the KV secret secret/expense-tracker/app
+# already exists (see README step 1). Afterwards enable it: `auth.openbao.enabled: true`.
+#
+# NOTE: written against the OpenBao OIDC provider API docs; not run against a live server
+# from the machine that authored it - check the output of each step.
+set -euo pipefail
+
+NAME="${NAME:-expense-tracker}"
+# scheme://host:port that both browser and pod can reach; the effective issuer becomes
+# <ISSUER_ADDR>/v1/identity/oidc/provider/<NAME> and must equal auth.openbao.issuer in values.yaml
+ISSUER_ADDR="${ISSUER_ADDR:-https://192.168.2.218:30200}"
+REDIRECT_URI="${REDIRECT_URI:-https://budget.smokyzone.de:30444/auth/callback/openbao}"
+KV_MOUNT="${KV_MOUNT:-secret}"
+KV_PATH="${KV_PATH:-expense-tracker/app}"
+
+echo "1/5 signing key"
+bao write "identity/oidc/key/$NAME" allowed_client_ids="*" algorithm=RS256 rotation_period=24h verification_ttl=24h
+
+echo "2/5 scope 'email' (claim comes from the entity's metadata)"
+bao write identity/oidc/scope/email template='{"email": {{identity.entity.metadata.email}}}'
+
+echo "3/5 client"
+bao write "identity/oidc/client/$NAME" redirect_uris="$REDIRECT_URI" assignments="allow_all" \
+  key="$NAME" id_token_ttl=30m access_token_ttl=1h
+CLIENT_ID="$(bao read -field=client_id "identity/oidc/client/$NAME")"
+CLIENT_SECRET="$(bao read -field=client_secret "identity/oidc/client/$NAME")"
+
+echo "4/5 provider"
+bao write "identity/oidc/provider/$NAME" issuer="$ISSUER_ADDR" allowed_client_ids="$CLIENT_ID" scopes_supported="email"
+
+echo "5/5 store credentials + CA in $KV_MOUNT/$KV_PATH"
+CA_FILE="$(mktemp)"; trap 'rm -f "$CA_FILE"' EXIT
+kubectl -n openbao get secret openbao-tls -o jsonpath='{.data.ca\.crt}' | base64 -d > "$CA_FILE"
+[ -s "$CA_FILE" ] || { echo "could not read the CA from secret openbao/openbao-tls" >&2; exit 1; }
+bao kv patch -mount="$KV_MOUNT" "$KV_PATH" \
+  openbao_client_id="$CLIENT_ID" openbao_client_secret="$CLIENT_SECRET" openbao_ca_cert=@"$CA_FILE"
+
+echo
+echo "Issuer: $ISSUER_ADDR/v1/identity/oidc/provider/$NAME"
+curl -sk "$ISSUER_ADDR/v1/identity/oidc/provider/$NAME/.well-known/openid-configuration" | head -c 300 || true
+echo
+cat <<MSG
+
+Remaining manual steps
+  * The person signing in needs an OpenBao *entity* whose metadata carries their email, e.g.
+      bao write identity/entity name=<name> metadata=email=<address>
+      bao write identity/entity-alias name=<login> canonical_id=<entity id> mount_accessor=<auth mount accessor>
+    (or add metadata to the existing entity of the userpass/OIDC user you log in with).
+  * Set auth.openbao.enabled=true in values.yaml, commit and push.
+  * The address must also be listed in allowed_emails.
+MSG