mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-18 21:16:47 +00:00
Maurice
650451bdf7
A fourth built-in channel next to email, webhook and ntfy. Browsers register per device, the server encrypts per RFC 8291 and signs per RFC 8292 with node:crypto and sends only to known push services through the SSRF guard. The event matrix decides per category what arrives by push; admins switch the channel on under Notifications. VAPID keys come from the environment or are generated once, only while neither stored row exists, and kept encrypted. A pair that does not decrypt or match is never overwritten and never swapped for another one: push stays off with an error in the log and every device stays registered until the key is fixed. The subject is VAPID_SUBJECT, then an https APP_URL, then the project URL. Only chat messages collapse into one notification per trip, and a replacement still alerts. A 403 removes a device only after three failures in a row; 404 and 410 remove it at once. Password change, reset and an admin setting a password drop the user's devices with the other credentials. The request log redacts subscriptions and endpoints, boot errors print *** for every secret variable, and logout forgets the device with a plain fetch so an expired session cannot redirect midway. Addresses discussion #894.
78 lines
3.0 KiB
YAML
78 lines
3.0 KiB
YAML
{{- if and (not .Values.existingSecret) (not .Values.generateEncryptionKey) }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ include "trek.fullname" . }}-secret
|
|
labels:
|
|
app: {{ include "trek.name" . }}
|
|
type: Opaque
|
|
data:
|
|
{{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ .Values.secretEnv.ENCRYPTION_KEY | b64enc | quote }}
|
|
{{- if .Values.secretEnv.ADMIN_EMAIL }}
|
|
ADMIN_EMAIL: {{ .Values.secretEnv.ADMIN_EMAIL | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if .Values.secretEnv.ADMIN_PASSWORD }}
|
|
ADMIN_PASSWORD: {{ .Values.secretEnv.ADMIN_PASSWORD | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if .Values.secretEnv.OIDC_CLIENT_SECRET }}
|
|
OIDC_CLIENT_SECRET: {{ .Values.secretEnv.OIDC_CLIENT_SECRET | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if .Values.secretEnv.UNSPLASH_ACCESS_KEY }}
|
|
UNSPLASH_ACCESS_KEY: {{ .Values.secretEnv.UNSPLASH_ACCESS_KEY | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if .Values.secretEnv.PLACES_API_KEY }}
|
|
PLACES_API_KEY: {{ .Values.secretEnv.PLACES_API_KEY | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if .Values.secretEnv.AMAP_API_KEY }}
|
|
AMAP_API_KEY: {{ .Values.secretEnv.AMAP_API_KEY | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if .Values.secretEnv.AMAP_API_SECRET }}
|
|
AMAP_API_SECRET: {{ .Values.secretEnv.AMAP_API_SECRET | b64enc | quote }}
|
|
{{- end }}
|
|
{{- if .Values.secretEnv.VAPID_PRIVATE_KEY }}
|
|
VAPID_PRIVATE_KEY: {{ .Values.secretEnv.VAPID_PRIVATE_KEY | b64enc | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- if and (not .Values.existingSecret) (.Values.generateEncryptionKey) }}
|
|
{{- $secretName := printf "%s-secret" (include "trek.fullname" .) }}
|
|
{{- $existingSecret := (lookup "v1" "Secret" .Release.Namespace $secretName) }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ $secretName }}
|
|
labels:
|
|
app: {{ include "trek.name" . }}
|
|
type: Opaque
|
|
stringData:
|
|
{{- if and $existingSecret $existingSecret.data }}
|
|
{{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ index $existingSecret.data (.Values.existingSecretKey | default "ENCRYPTION_KEY") | b64dec }}
|
|
{{- else }}
|
|
{{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ randAlphaNum 32 }}
|
|
{{- end }}
|
|
{{- if .Values.secretEnv.ADMIN_EMAIL }}
|
|
ADMIN_EMAIL: {{ .Values.secretEnv.ADMIN_EMAIL }}
|
|
{{- end }}
|
|
{{- if .Values.secretEnv.ADMIN_PASSWORD }}
|
|
ADMIN_PASSWORD: {{ .Values.secretEnv.ADMIN_PASSWORD }}
|
|
{{- end }}
|
|
{{- if .Values.secretEnv.OIDC_CLIENT_SECRET }}
|
|
OIDC_CLIENT_SECRET: {{ .Values.secretEnv.OIDC_CLIENT_SECRET }}
|
|
{{- end }}
|
|
{{- if .Values.secretEnv.UNSPLASH_ACCESS_KEY }}
|
|
UNSPLASH_ACCESS_KEY: {{ .Values.secretEnv.UNSPLASH_ACCESS_KEY }}
|
|
{{- end }}
|
|
{{- if .Values.secretEnv.PLACES_API_KEY }}
|
|
PLACES_API_KEY: {{ .Values.secretEnv.PLACES_API_KEY }}
|
|
{{- end }}
|
|
{{- if .Values.secretEnv.AMAP_API_KEY }}
|
|
AMAP_API_KEY: {{ .Values.secretEnv.AMAP_API_KEY }}
|
|
{{- end }}
|
|
{{- if .Values.secretEnv.AMAP_API_SECRET }}
|
|
AMAP_API_SECRET: {{ .Values.secretEnv.AMAP_API_SECRET }}
|
|
{{- end }}
|
|
{{- if .Values.secretEnv.VAPID_PRIVATE_KEY }}
|
|
VAPID_PRIVATE_KEY: {{ .Values.secretEnv.VAPID_PRIVATE_KEY }}
|
|
{{- end }}
|
|
{{- end }}
|