openshift-descriptors-https-self-signed.yaml

apiVersion: v1
kind: Secret
metadata:
  name: basicauth
type: Opaque
data:
  username: aGFycnk=
  password: c2FsbHk=
  #htpasswd: aGFycnk6JGFwcjEkdnZaV2o4TDEkSWc2dzh2djRJWjRyVVFrd0dicEtHMQo=
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: caddyfile
data:
  Caddyfile: |
    import /app/Caddyfile

    tls self_signed

    jwt {
        path /
        redirect /login
        allow sub demo
        allow sub {$BASIC_AUTH_USERNAME}
    }

    login {
        success-url /
        jwt-expiry 720h # Stay logged in 30 days
        #simple {$BASIC_AUTH_USERNAME}={$BASIC_AUTH_PASSWORD}
        htpasswd file=/gollum/config/.htpasswd
        # See https://github.com/tarent/loginsrv/blob/master/README.md#configuration-and-startup
    }
---
apiVersion: v1
kind: Service
metadata:
  name: gollum-galore
  labels:
    name: gollum-galore
spec:
  ports:
  - name: http
    port: 80
  - name: https
    port: 443
  selector:
    app: gollum-galore
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: gollum-gallore-persistent-storage-claim
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: "1Gi"
---
apiVersion: apps/v1beta1
kind: StatefulSet
metadata:
  name: gollum-galore
spec:
  serviceName: gollum-galore
  replicas: 1
  template:
    metadata:
      labels:
        app: gollum-galore
    spec:
      containers:
      - name: gollum-galore
        image: schnatterer/gollum-galore:0.3.2
        ports:
        - containerPort: 80
        - containerPort: 443
        volumeMounts:
        - name: wiki
          mountPath: /gollum/wiki
        - name: config
          mountPath: /gollum/config
        resources:
          requests:
            memory: 512M
        readinessProbe:
          # don't use http here, because all our resources are protected
          tcpSocket:
            port: 443
          # Wait for volume to get bound
          initialDelaySeconds: 20
          periodSeconds: 1
        livenessProbe:
          tcpSocket:
            port: 443
          initialDelaySeconds: 120
          periodSeconds: 10
        env:
        - name: GOLLUM_PARAMS
          value: --allow-uploads --live-preview
        - name: CADDY_PARAMS
          value: -conf /gollum/config/Caddyfile -log stdout
        - name: HOST
          value: yourdomain.com:443
        - name: BASIC_AUTH_USERNAME
          valueFrom:
            secretKeyRef:
              name: basicauth
              key: username
        - name: BASIC_AUTH_PASSWORD
          valueFrom:
            secretKeyRef:
              name: basicauth
              key: password
      volumes:
      - name: wiki
        persistentVolumeClaim:
          claimName: gollum-gallore-persistent-storage-claim
      - name: config
        projected:
          sources:
          - secret:
              name: credentials
              items:
                - key: htpasswd
                  path: .htpasswd
          - configMap:
              name: caddyfile
              items:
                - key: Caddyfile
                  path: Caddyfile
---
# Creates the following route: <route-name>[-<namespace>].<suffix>
# You can query it like so: oc get route gollum-galore-generated
# Create a CNAME record and point it to the URL created by this route
apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: gollum-galore-generated
spec:
  port:
    targetPort: http
  to:
    kind: Service
    name: gollum-galore
---
apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: gollum-galore
spec:
  # Insert your hostname here
  host: yourdomain.com
  port:
    targetPort: https
  tls:
    insecureEdgeTerminationPolicy: Redirect
    termination: passthrough
  to:
    kind: Service
    name: gollum-galore
---
# Allow unsecure HTTP only for acme challenge does not work. The passthrough route seems to always take precedence.
  #host: yourdomain.com
  #path: /.well-known