Add Helm chart for the expense tracker (app, Postgres, ingress, backups)

- Deployment/Service for the app, StatefulSet/Service for Postgres 17 - Secrets (DB password, session secret, Google client, allowed e-mails) via ExternalSecret from OpenBao - Ingress with a Let's Encrypt certificate, NetworkPolicy for Postgres - Nightly pg_dump CronJob - Optional OpenBao OIDC provider setup script Co-Authored-By: Claude Sonnet 5 <[email protected]>
2026-09-20 18:46:19 +02:00
commit 2ee46ceb4a
13 changed files with 881 additions and 0 deletions
@@ -0,0 +1,74 @@
+# Both Secrets are created by External Secrets Operator from OpenBao (KV v2).
+# If a referenced key is missing in OpenBao the ExternalSecret reports an error and the
+# Secret is not created - so pods wait in CreateContainerConfigError until it exists.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: expense-tracker-db
+  namespace: {{ .Values.namespace.name }}
+  labels:
+    app.kubernetes.io/name: expense-tracker
+    {{- include "expense-tracker.labels" . | nindent 4 }}
+spec:
+  refreshInterval: {{ .Values.externalSecret.refreshInterval }}
+  secretStoreRef:
+    kind: {{ .Values.externalSecret.storeKind }}
+    name: {{ .Values.externalSecret.storeName }}
+  target:
+    name: expense-tracker-db
+    creationPolicy: Owner
+  data:
+    - secretKey: POSTGRES_PASSWORD
+      remoteRef:
+        key: {{ .Values.externalSecret.db.remoteKey }}
+        property: {{ .Values.externalSecret.db.properties.password }}
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: expense-tracker-app
+  namespace: {{ .Values.namespace.name }}
+  labels:
+    app.kubernetes.io/name: expense-tracker
+    {{- include "expense-tracker.labels" . | nindent 4 }}
+spec:
+  refreshInterval: {{ .Values.externalSecret.refreshInterval }}
+  secretStoreRef:
+    kind: {{ .Values.externalSecret.storeKind }}
+    name: {{ .Values.externalSecret.storeName }}
+  target:
+    name: expense-tracker-app
+    creationPolicy: Owner
+  data:
+    - secretKey: SESSION_SECRET
+      remoteRef:
+        key: {{ .Values.externalSecret.app.remoteKey }}
+        property: {{ .Values.externalSecret.app.properties.sessionSecret }}
+    - secretKey: ALLOWED_EMAILS
+      remoteRef:
+        key: {{ .Values.externalSecret.app.remoteKey }}
+        property: {{ .Values.externalSecret.app.properties.allowedEmails }}
+    {{- if .Values.auth.google.enabled }}
+    - secretKey: GOOGLE_CLIENT_ID
+      remoteRef:
+        key: {{ .Values.externalSecret.app.remoteKey }}
+        property: {{ .Values.externalSecret.app.properties.googleClientId }}
+    - secretKey: GOOGLE_CLIENT_SECRET
+      remoteRef:
+        key: {{ .Values.externalSecret.app.remoteKey }}
+        property: {{ .Values.externalSecret.app.properties.googleClientSecret }}
+    {{- end }}
+    {{- if .Values.auth.openbao.enabled }}
+    - secretKey: OPENBAO_CLIENT_ID
+      remoteRef:
+        key: {{ .Values.externalSecret.app.remoteKey }}
+        property: {{ .Values.externalSecret.app.properties.openbaoClientId }}
+    - secretKey: OPENBAO_CLIENT_SECRET
+      remoteRef:
+        key: {{ .Values.externalSecret.app.remoteKey }}
+        property: {{ .Values.externalSecret.app.properties.openbaoClientSecret }}
+    - secretKey: openbao-ca.crt
+      remoteRef:
+        key: {{ .Values.externalSecret.app.remoteKey }}
+        property: {{ .Values.externalSecret.app.properties.openbaoCaCert }}
+    {{- end }}