add TLS config

2025-04-24 16:19:58 +02:00
parent 9baca6a5cf
commit 266e2cdeb7
6 changed files with 89 additions and 39 deletions
@@ -0,0 +1,58 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: mosquitto-selfsigned
+  namespace: mosquitto
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: mosquitto-ca
+  namespace: mosquitto
+spec:
+  isCA: true
+  commonName: mosquitto-ca
+  secretName: mosquitto-ca-secret
+  issuerRef:
+    name: mosquitto-selfsigned
+    kind: Issuer
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: mosquitto-ca-issuer
+  namespace: mosquitto
+spec:
+  ca:
+    secretName: mosquitto-ca-secret
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: mosquitto-internal-cert
+  namespace: mosquitto
+spec:
+  secretName: mosquitto-tls
+  duration: 8760h # 1 year
+  renewBefore: 720h # 30 days before expiration
+  subject:
+    organizations:
+      - internal
+  commonName: mosquitto.mosquitto.svc
+  dnsNames:
+    - mosquitto.infrastructure.helmholz.cloud
+    - mosquitto
+    - mosquitto.mosquitto
+    - mosquitto.mosquitto.svc
+    - mosquitto-mqtts
+    - mosquitto-mqtts.mosquitto
+    - mosquitto-mqtts.mosquitto.svc
+    - mosquitto-wss
+    - mosquitto-wss.mosquitto
+    - mosquitto-wss.mosquitto.svc
+  issuerRef:
+    name: mosquitto-ca-issuer
+    kind: Issuer