Skip to content

Commit 66fa778

Browse files
bendehaanbendehaan
committed
initial try for ctfd
1 parent 6e80e82 commit 66fa778

File tree

3 files changed

+189
-4
lines changed

3 files changed

+189
-4
lines changed

‎aws/build-an-deploy-aws.sh

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,4 +112,26 @@ wait
112112
DEFAULT_PASSWORD=thankyou
113113
#TODO: REWRITE ABOVE, REWRITE THE HARDCODED DEPLOYMENT VALS INTO VALUES AND OVERRIDE THEM HERE!
114114
echo "default password is ${DEFAULT_PASSWORD}"
115-
helm upgrade --install mj ../helm/wrongsecrets-ctf-party --set="imagePullPolicy=Always" --set="balancer.env.K8S_ENV=aws" --set="balancer.env.IRSA_ROLE=arn:aws:iam::${ACCOUNT_ID}:role/wrongsecrets-secret-manager" --set="balancer.env.REACT_APP_ACCESS_PASSWORD=${DEFAULT_PASSWORD}" --set="balancer.cookie.cookieParserSecret=thisisanewrandomvaluesowecanworkatit" --set="balancer.repository=jeroenwillemsen/wrongsecrets-balancer" --set="balancer.tag=1.0aws" --set="balancer.replicas=4" --set="wrongsecretsCleanup.repository=jeroenwillemsen/wrongsecrets-ctf-cleaner" --set="wrongsecretsCleanup.tag=0.2"
115+
helm upgrade --install mj ../helm/wrongsecrets-ctf-party \
116+
--set="imagePullPolicy=Always" \
117+
--set="balancer.env.K8S_ENV=aws" \
118+
--set="balancer.env.IRSA_ROLE=arn:aws:iam::${ACCOUNT_ID}:role/wrongsecrets-secret-manager" \
119+
--set="balancer.env.REACT_APP_ACCESS_PASSWORD=${DEFAULT_PASSWORD}" \
120+
--set="balancer.cookie.cookieParserSecret=thisisanewrandomvaluesowecanworkatit" \
121+
--set="balancer.repository=jeroenwillemsen/wrongsecrets-balancer" \
122+
--set="balancer.tag=1.0aws"\
123+
--set="balancer.replicas=4" \
124+
--set="wrongsecretsCleanup.repository=jeroenwillemsen/wrongsecrets-ctf-cleaner" \
125+
--set="wrongsecretsCleanup.tag=0.2" \
126+
--set="wrongsecrets.ctfKey=test"
127+
128+
# Install CTFd
129+
130+
export HELM_EXPERIMENTAL_OCI=1
131+
kubectl create namespace ctfd
132+
helm -n ctfd install ctfd oci://ghcr.io/bman46/ctfd/ctfd \
133+
--set="redis.auth.password=${$(openssl rand -base64 24)}" \
134+
--set="mariadb.auth.rootPassword=${$(openssl rand -base64 24)}" \
135+
--set="mariadb.auth.password=${$(openssl rand -base64 24)}" \
136+
--set="mariadb.auth.replicationPassword=${$(openssl rand -base64 24)}" \
137+
--set="env.open.SECRET_KEY=test"

‎aws/k8s/ctfd-values.yaml

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
# Default values for ctfd.
2+
# This is a YAML-formatted file.
3+
# Declare variables to be passed into your templates.
4+
5+
replicaCount: 1
6+
7+
image:
8+
repository: ctfd/ctfd
9+
tag: 3.5.0
10+
pullPolicy: IfNotPresent
11+
12+
# Set K8s securityContext for the CTFd deployment:
13+
security:
14+
fsGroup: 1001
15+
runAsNonRoot: true
16+
runAsUser: 1001
17+
18+
# Bitnami helm redis deployment
19+
# See bitnami redis values.yaml for more details
20+
redis:
21+
# Enable Redis server provided by helm:
22+
enabled: True
23+
auth:
24+
enabled: true
25+
password: "ChangeMe!123"
26+
# Redis® architecture. Allowed values: standalone or replication
27+
architecture: standalone
28+
29+
mariadb:
30+
# Enable mariadb server provided by helm:
31+
enabled: True
32+
# Login credentials:
33+
auth:
34+
rootPassword: "ChangeMe!123"
35+
database: ctfd
36+
username: "ctfd"
37+
password: "ChangeMe!123"
38+
39+
replicationUser: "replicate"
40+
replicationPassword: "ChangeMe!123"
41+
42+
persistence:
43+
enabled: true
44+
storageClass: ""
45+
accessModes:
46+
- ReadWriteOnce
47+
size: 15Gi
48+
49+
externalDB:
50+
# (required if mariadb-galera is disabled) External SQL Database URI. Example: mysql+pymysql://root:ctfd@db/ctfd
51+
DATABASE_URL: ""
52+
# (required if redis is disabled) External Redis URI. Example: redis://cache:6379
53+
REDIS_URL: ""
54+
55+
env:
56+
open:
57+
# Required if more than 1 worker (randomly generate)
58+
SECRET_KEY: "ChangeMe!123"
59+
# Amount of CTFd workers
60+
WORKERS: 5
61+
# If behing ingress proxy or nginx:
62+
REVERSE_PROXY: True
63+
secret:
64+
existingSecret:
65+
# Stores Environment Variable to secret key name mappings
66+
existingSecretMappings:
67+
DATABASE_URL:
68+
REDIS_URL:
69+
70+
# For uploads to the CTFd server (images and other content)
71+
# Not for DB
72+
persistence:
73+
uploads:
74+
enabled: true
75+
#ReadWriteMany may be desired here if using multiple CTFd pods
76+
accessMode: ReadWriteOnce
77+
size: 10Gi
78+
labels: {}
79+
# name: value
80+
# existingClaim:
81+
# storageClass: "-"
82+
83+
service:
84+
type: ClusterIP
85+
port: 80
86+
targetPort: 8000
87+
#if service.type = loadbalancer
88+
# loadBalancerSourceRanges: []
89+
# loadBalancerIP: ""
90+
91+
probes:
92+
liveness:
93+
initialDelaySeconds: 25
94+
periodSeconds: 5
95+
timeoutSeconds: 2
96+
successThreshold: 1
97+
failureThreshold: 5
98+
readiness:
99+
initialDelaySeconds: 20
100+
periodSeconds: 5
101+
timeoutSeconds: 2
102+
successThreshold: 1
103+
failureThreshold: 5
104+
105+
# CTFd ingress:
106+
ingress:
107+
enabled: false
108+
annotations:
109+
{}
110+
# kubernetes.io/ingress.class: nginx
111+
# kubernetes.io/tls-acme: "true"
112+
hosts:
113+
- host: ctf.your.domain.com
114+
path: "/"
115+
116+
tls: []
117+
# - secretName: chart-example-tls
118+
# hosts:
119+
# - chart-example.local
120+
121+
resources:
122+
{}
123+
# limits:
124+
# cpu: 100m
125+
# memory: 128Mi
126+
# requests:
127+
# cpu: 100m
128+
# memory: 128Mi
129+
130+
nodeSelector: {}
131+
132+
tolerations: []
133+
134+
affinity: {}
135+
136+
nameOverride: ""
137+
fullnameOverride: ""
138+
139+
metrics:
140+
enabled: false
141+
image:
142+
registry: docker.io
143+
repository: bitnami/mysqld-exporter
144+
tag: 0.12.1-debian-10-r27
145+
pullPolicy: IfNotPresent
146+
resources: {}
147+
annotations:
148+
prometheus.io/scrape: "true"
149+
prometheus.io/port: "9104"
150+
151+
# Enable this if you're using https://github.com/coreos/prometheus-operator
152+
serviceMonitor:
153+
enabled: false
154+
## Specify a namespace if needed
155+
# namespace: monitoring
156+
# fallback to the prometheus default unless specified
157+
# interval: 10s
158+
# scrapeTimeout: 10s
159+
## Defaults to what's used if you follow CoreOS [Prometheus Install Instructions](https://github.com/helm/charts/tree/master/stable/prometheus-operator#tldr)
160+
## [Prometheus Selector Label](https://github.com/helm/charts/tree/master/stable/prometheus-operator#prometheus-operator-1)
161+
## [Kube Prometheus Selector Label](https://github.com/helm/charts/tree/master/stable/prometheus-operator#exporters)
162+
selector:
163+
prometheus: kube-prometheus

‎aws/main.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -73,12 +73,12 @@ module "eks" {
7373

7474
cluster_endpoint_private_access = true
7575

76-
cluster_endpoint_public_access_cidrs = ["${data.http.ip.body}/32"]
76+
cluster_endpoint_public_access_cidrs = ["${data.http.ip.body}/32", "83.128.178.107/32"]
7777

7878
enable_irsa = true
7979

80-
create_cloudwatch_log_group = true
81-
cluster_enabled_log_types = ["api", "audit", "authenticator"]
80+
create_cloudwatch_log_group = true
81+
cluster_enabled_log_types = ["api", "audit", "authenticator"]
8282
cloudwatch_log_group_retention_in_days = 14 #it's a ctf , we don't need non-necessary costs!
8383

8484
# apply when available: iam_role_permissions_boundary = "arn:aws:iam::${local.account_id}:policy/service-user-creation-permission-boundary"

0 commit comments

Comments
 (0)