@reyemtech/nimbus 1.3.0 → 2.0.1

package/dist/cjs/access/tailscale-dns.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Tailscale split DNS automation via the Tailscale API.
+ *
+ * Configures split DNS nameservers on the tailnet so that
+ * queries for <prefix>.<tld> are routed to the in-cluster CoreDNS.
+ *
+ * Uses PATCH /api/v2/tailnet/{tailnet}/dns/split-dns which merges
+ * with existing config (does not replace).
+ *
+ * @module access/tailscale-dns
+ */
+import * as pulumi from "@pulumi/pulumi";
+/**
+ * Configure Tailscale split DNS to route a domain to specific nameservers.
+ *
+ * Uses the Tailscale API to PATCH the tailnet's split DNS config.
+ * This is a Pulumi dynamic resource — it creates/updates/deletes automatically.
+ */
+export declare class TailscaleSplitDns extends pulumi.dynamic.Resource {
+    constructor(name: string, args: {
+        oauthClientId: pulumi.Input<string>;
+        oauthClientSecret: pulumi.Input<string>;
+        domain: pulumi.Input<string>;
+        nameservers: pulumi.Input<pulumi.Input<string>[]>;
+        tailnet?: pulumi.Input<string>;
+    }, opts?: pulumi.CustomResourceOptions);
+}
+//# sourceMappingURL=tailscale-dns.d.ts.map

package/dist/cjs/access/tailscale-dns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscale-dns.d.ts","sourceRoot":"","sources":["../../../src/access/tailscale-dns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AA6FzC;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,MAAM,CAAC,OAAO,CAAC,QAAQ;gBAE1D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;QACJ,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;KAChC,EACD,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB;CAItC"}

package/dist/cjs/access/tailscale-dns.js

@@ -0,0 +1,131 @@
+"use strict";
+/**
+ * Tailscale split DNS automation via the Tailscale API.
+ *
+ * Configures split DNS nameservers on the tailnet so that
+ * queries for <prefix>.<tld> are routed to the in-cluster CoreDNS.
+ *
+ * Uses PATCH /api/v2/tailnet/{tailnet}/dns/split-dns which merges
+ * with existing config (does not replace).
+ *
+ * @module access/tailscale-dns
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TailscaleSplitDns = void 0;
+const pulumi = __importStar(require("@pulumi/pulumi"));
+/**
+ * Get an OAuth access token from Tailscale.
+ */
+async function getOAuthToken(clientId, clientSecret) {
+    const auth = Buffer.from(`${clientId}:${clientSecret}`).toString("base64");
+    const res = await fetch("https://api.tailscale.com/api/v2/oauth/token", {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            Authorization: `Basic ${auth}`,
+        },
+        body: "grant_type=client_credentials",
+    });
+    if (!res.ok) {
+        throw new Error(`OAuth token request failed: ${res.status} ${await res.text()}`);
+    }
+    const data = await res.json();
+    return data.access_token;
+}
+/**
+ * PATCH split DNS config on the tailnet.
+ */
+async function patchSplitDns(token, tailnet, domain, nameservers) {
+    const res = await fetch(`https://api.tailscale.com/api/v2/tailnet/${tailnet}/dns/split-dns`, {
+        method: "PATCH",
+        headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${token}`,
+        },
+        body: JSON.stringify({ [domain]: nameservers }),
+    });
+    if (!res.ok) {
+        throw new Error(`Split DNS PATCH failed: ${res.status} ${await res.text()}`);
+    }
+}
+/**
+ * Delete a split DNS domain from the tailnet.
+ */
+async function deleteSplitDns(token, tailnet, domain) {
+    await patchSplitDns(token, tailnet, domain, []);
+}
+/**
+ * Pulumi dynamic resource provider for Tailscale split DNS.
+ */
+const tailscaleSplitDnsProvider = {
+    async create(inputs) {
+        const tailnet = inputs.tailnet ?? "-";
+        const token = await getOAuthToken(inputs.oauthClientId, inputs.oauthClientSecret);
+        await patchSplitDns(token, tailnet, inputs.domain, inputs.nameservers);
+        return {
+            id: `tailscale-split-dns-${inputs.domain}`,
+            outs: inputs,
+        };
+    },
+    async update(_id, olds, news) {
+        const tailnet = news.tailnet ?? "-";
+        const token = await getOAuthToken(news.oauthClientId, news.oauthClientSecret);
+        // If domain changed, remove old entry
+        if (olds.domain !== news.domain) {
+            await deleteSplitDns(token, tailnet, olds.domain);
+        }
+        await patchSplitDns(token, tailnet, news.domain, news.nameservers);
+        return { outs: news };
+    },
+    async delete(_id, props) {
+        const tailnet = props.tailnet ?? "-";
+        const token = await getOAuthToken(props.oauthClientId, props.oauthClientSecret);
+        await deleteSplitDns(token, tailnet, props.domain);
+    },
+};
+/**
+ * Configure Tailscale split DNS to route a domain to specific nameservers.
+ *
+ * Uses the Tailscale API to PATCH the tailnet's split DNS config.
+ * This is a Pulumi dynamic resource — it creates/updates/deletes automatically.
+ */
+class TailscaleSplitDns extends pulumi.dynamic.Resource {
+    constructor(name, args, opts) {
+        super(tailscaleSplitDnsProvider, name, args, opts);
+    }
+}
+exports.TailscaleSplitDns = TailscaleSplitDns;
+//# sourceMappingURL=tailscale-dns.js.map

package/dist/cjs/access/tailscale-dns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscale-dns.js","sourceRoot":"","sources":["../../../src/access/tailscale-dns.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uDAAyC;AAUzC;;GAEG;AACH,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,YAAoB;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,8CAA8C,EAAE;QACtE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,aAAa,EAAE,SAAS,IAAI,EAAE;SAC/B;QACD,IAAI,EAAE,+BAA+B;KACtC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAQ,IAAiC,CAAC,YAAY,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CAC1B,KAAa,EACb,OAAe,EACf,MAAc,EACd,WAAqB;IAErB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,4CAA4C,OAAO,gBAAgB,EAAE;QAC3F,MAAM,EAAE,OAAO;QACf,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,KAAK,EAAE;SACjC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,OAAe,EAAE,MAAc;IAC1E,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,yBAAyB,GAAoC;IACjE,KAAK,CAAC,MAAM,CAAC,MAA+B;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,GAAG,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAClF,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QACvE,OAAO;YACL,EAAE,EAAE,uBAAuB,MAAM,CAAC,MAAM,EAAE;YAC1C,IAAI,EAAE,MAAM;SACb,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,IAA6B,EAAE,IAA6B;QACpF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAE9E,sCAAsC;QACtC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,KAA8B;QACtD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAChF,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAa,iBAAkB,SAAQ,MAAM,CAAC,OAAO,CAAC,QAAQ;IAC5D,YACE,IAAY,EACZ,IAMC,EACD,IAAmC;QAEnC,KAAK,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;CACF;AAdD,8CAcC"}

package/dist/cjs/access/tailscale.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Tailscale access gateway provider.
+ *
+ * Deploys the Tailscale K8s Operator + Connector CRD for subnet routing.
+ * Optional split DNS via shared CoreDNS.
+ *
+ * @module access/tailscale
+ */
+import type { ITailscaleGatewayConfig, IAccessGateway } from "./interfaces";
+/**
+ * Deploy Tailscale access gateway.
+ */
+export declare function deployTailscale(name: string, config: ITailscaleGatewayConfig): IAccessGateway;
+//# sourceMappingURL=tailscale.d.ts.map

package/dist/cjs/access/tailscale.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscale.d.ts","sourceRoot":"","sources":["../../../src/access/tailscale.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQ5E;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,GAAG,cAAc,CA8G7F"}

package/dist/cjs/access/tailscale.js

@@ -0,0 +1,135 @@
+"use strict";
+/**
+ * Tailscale access gateway provider.
+ *
+ * Deploys the Tailscale K8s Operator + Connector CRD for subnet routing.
+ * Optional split DNS via shared CoreDNS.
+ *
+ * @module access/tailscale
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deployTailscale = deployTailscale;
+const k8s = __importStar(require("@pulumi/kubernetes"));
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const dns_1 = require("./dns");
+const proxy_1 = require("./proxy");
+const tailscale_dns_1 = require("./tailscale-dns");
+const ensure_namespace_1 = require("../utils/ensure-namespace");
+const NAMESPACE = "access";
+/**
+ * Deploy Tailscale access gateway.
+ */
+function deployTailscale(name, config) {
+    const provider = config.cluster.provider;
+    const prefix = config.hostnamePrefix ?? name;
+    const tags = config.tailscale.tags ?? ["tag:k8s"];
+    const nsResource = (0, ensure_namespace_1.ensureNamespace)(NAMESPACE, provider);
+    // Tailscale Operator Helm chart — uses OAuth client credentials
+    const helmRelease = new k8s.helm.v3.Release(`${name}-tailscale-operator`, {
+        chart: "tailscale-operator",
+        repositoryOpts: { repo: "https://pkgs.tailscale.com/helmcharts" },
+        version: config.tailscale.version,
+        namespace: NAMESPACE,
+        createNamespace: false,
+        values: {
+            oauth: {
+                clientId: config.tailscale.oauthClientId,
+                clientSecret: config.tailscale.oauthClientSecret,
+            },
+            ...(tags.length > 0 && {
+                operatorConfig: {
+                    defaultTags: tags,
+                },
+            }),
+            ...config.tailscale.values,
+        },
+    }, { provider, dependsOn: [nsResource] });
+    // Connector CRD — advertise subnet routes
+    new k8s.apiextensions.CustomResource(`${name}-tailscale-connector`, {
+        apiVersion: "tailscale.com/v1alpha1",
+        kind: "Connector",
+        metadata: { name: `${name}-subnet-router`, namespace: NAMESPACE },
+        spec: {
+            hostname: prefix,
+            subnetRouter: {
+                advertiseRoutes: config.tailscale.routes,
+            },
+        },
+    }, { provider, dependsOn: [helmRelease] });
+    // Expose services via Tailscale — annotate original K8s Services (not aliases)
+    if (config.tailscale.services) {
+        for (const svc of config.tailscale.services) {
+            const targetName = svc.originalName ?? svc.name;
+            new k8s.core.v1.ServicePatch(`${name}-ts-expose-${svc.label}`, {
+                metadata: {
+                    name: pulumi.output(targetName),
+                    namespace: svc.namespace,
+                    annotations: {
+                        "pulumi.com/patchForce": "true",
+                        "tailscale.com/expose": "true",
+                        "tailscale.com/hostname": `${prefix}-${svc.label}`,
+                    },
+                },
+            }, { provider, dependsOn: [helmRelease] });
+        }
+    }
+    // Reverse proxy — port 80 access to all exposed services
+    if (config.tailscale.services && config.tailscale.services.length > 0 && config.dns?.enabled) {
+        const tld = config.dns.tld ?? "internal";
+        const dnsSuffix = `${prefix}.${tld}`;
+        (0, proxy_1.deployAccessProxy)(name, config.tailscale.services, dnsSuffix, NAMESPACE, provider, [
+            nsResource,
+        ]);
+    }
+    // Split DNS — deploy CoreDNS + configure Tailscale API
+    if (config.dns?.enabled) {
+        const dns = (0, dns_1.deployAccessDns)(name, prefix, config.dns, NAMESPACE, provider, config.tailscale.services ?? [], [nsResource]);
+        // Automatically configure Tailscale split DNS via API
+        new tailscale_dns_1.TailscaleSplitDns(`${name}-tailscale-split-dns`, {
+            oauthClientId: config.tailscale.oauthClientId,
+            oauthClientSecret: config.tailscale.oauthClientSecret,
+            domain: dns.zone,
+            nameservers: [dns.clusterIp],
+        }, { dependsOn: [helmRelease] });
+    }
+    return {
+        name,
+        provider: "tailscale",
+        namespace: NAMESPACE,
+        helmRelease,
+    };
+}
+//# sourceMappingURL=tailscale.js.map

package/dist/cjs/access/tailscale.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscale.js","sourceRoot":"","sources":["../../../src/access/tailscale.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeH,0CA8GC;AA3HD,wDAA0C;AAC1C,uDAAyC;AAEzC,+BAAwC;AACxC,mCAA4C;AAC5C,mDAAoD;AACpD,gEAA4D;AAE5D,MAAM,SAAS,GAAG,QAAQ,CAAC;AAE3B;;GAEG;AACH,SAAgB,eAAe,CAAC,IAAY,EAAE,MAA+B;IAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,IAAA,kCAAe,EAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAExD,gEAAgE;IAChE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CACzC,GAAG,IAAI,qBAAqB,EAC5B;QACE,KAAK,EAAE,oBAAoB;QAC3B,cAAc,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE;QACjE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO;QACjC,SAAS,EAAE,SAAS;QACpB,eAAe,EAAE,KAAK;QACtB,MAAM,EAAE;YACN,KAAK,EAAE;gBACL,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,aAAa;gBACxC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,iBAAiB;aACjD;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI;gBACrB,cAAc,EAAE;oBACd,WAAW,EAAE,IAAI;iBAClB;aACF,CAAC;YACF,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM;SAC3B;KACF,EACD,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,CACtC,CAAC;IAEF,0CAA0C;IAC1C,IAAI,GAAG,CAAC,aAAa,CAAC,cAAc,CAClC,GAAG,IAAI,sBAAsB,EAC7B;QACE,UAAU,EAAE,wBAAwB;QACpC,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE;QACjE,IAAI,EAAE;YACJ,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE;gBACZ,eAAe,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;aACzC;SACF;KACF,EACD,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,CACvC,CAAC;IAEF,+EAA+E;IAC/E,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YAC5C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,IAAI,CAAC;YAChD,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAC1B,GAAG,IAAI,cAAc,GAAG,CAAC,KAAK,EAAE,EAChC;gBACE,QAAQ,EAAE;oBACR,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;oBAC/B,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,WAAW,EAAE;wBACX,uBAAuB,EAAE,MAAM;wBAC/B,sBAAsB,EAAE,MAAM;wBAC9B,wBAAwB,EAAE,GAAG,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE;qBACnD;iBACF;aACF,EACD,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,CACvC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;QAC7F,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,UAAU,CAAC;QACzC,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC;QACrC,IAAA,yBAAiB,EAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE;YACjF,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,IAAI,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,IAAA,qBAAe,EACzB,IAAI,EACJ,MAAM,EACN,MAAM,CAAC,GAAG,EACV,SAAS,EACT,QAAQ,EACR,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,EAC/B,CAAC,UAAU,CAAC,CACb,CAAC;QAEF,sDAAsD;QACtD,IAAI,iCAAiB,CACnB,GAAG,IAAI,sBAAsB,EAC7B;YACE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,aAAa;YAC7C,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC,iBAAiB;YACrD,MAAM,EAAE,GAAG,CAAC,IAAI;YAChB,WAAW,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;SAC7B,EACD,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,CAC7B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,SAAS;QACpB,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/cjs/access/wireguard.d.ts

@@ -0,0 +1,14 @@
+/**
+ * WireGuard access gateway provider.
+ *
+ * Deploys a self-hosted WireGuard server pod with LoadBalancer,
+ * generates client configs, and optional split DNS.
+ *
+ * @module access/wireguard
+ */
+import type { IWireGuardGatewayConfig, IAccessGateway } from "./interfaces";
+/**
+ * Deploy WireGuard access gateway.
+ */
+export declare function deployWireGuard(name: string, config: IWireGuardGatewayConfig): IAccessGateway;
+//# sourceMappingURL=wireguard.d.ts.map

package/dist/cjs/access/wireguard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wireguard.d.ts","sourceRoot":"","sources":["../../../src/access/wireguard.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,uBAAuB,EAAkB,cAAc,EAAE,MAAM,cAAc,CAAC;AAyC5F;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,GAAG,cAAc,CAsF7F"}

package/dist/cjs/access/wireguard.js

@@ -0,0 +1,140 @@
+"use strict";
+/**
+ * WireGuard access gateway provider.
+ *
+ * Deploys a self-hosted WireGuard server pod with LoadBalancer,
+ * generates client configs, and optional split DNS.
+ *
+ * @module access/wireguard
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deployWireGuard = deployWireGuard;
+const k8s = __importStar(require("@pulumi/kubernetes"));
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const dns_1 = require("./dns");
+const ensure_namespace_1 = require("../utils/ensure-namespace");
+const NAMESPACE = "access";
+const DEFAULT_PORT = 51820;
+/**
+ * Build WireGuard client config for a peer.
+ */
+function buildClientConfig(peer, serverPublicKey, endpoint, listenPort, routes, serverCidr, dnsIp) {
+    return pulumi.all([serverPublicKey, dnsIp ?? pulumi.output("")]).apply(([pubKey, dns]) => {
+        const lines = [
+            "[Interface]",
+            "PrivateKey = <YOUR_PRIVATE_KEY>",
+            `Address = ${peer.allowedIps[0]}`,
+        ];
+        if (dns) {
+            lines.push(`DNS = ${dns}`);
+        }
+        lines.push("");
+        lines.push("[Peer]");
+        lines.push(`PublicKey = ${pubKey}`);
+        lines.push(`Endpoint = ${endpoint}:${listenPort}`);
+        lines.push(`AllowedIPs = ${[...routes, serverCidr].join(", ")}`);
+        lines.push("PersistentKeepalive = 25");
+        return lines.join("\n");
+    });
+}
+/**
+ * Deploy WireGuard access gateway.
+ */
+function deployWireGuard(name, config) {
+    const k8sProvider = config.cluster.provider;
+    const prefix = config.hostnamePrefix ?? name;
+    const listenPort = config.wireguard.listenPort ?? DEFAULT_PORT;
+    const nsResource = (0, ensure_namespace_1.ensureNamespace)(NAMESPACE, k8sProvider);
+    const helmRelease = new k8s.helm.v3.Release(`${name}-wireguard`, {
+        chart: "wireguard",
+        repositoryOpts: { repo: "https://bryopsida.github.io/wireguard-chart" },
+        version: config.wireguard.version,
+        namespace: NAMESPACE,
+        createNamespace: false,
+        values: {
+            interface: {
+                address: config.wireguard.serverCidr,
+                listenPort,
+                peers: config.wireguard.peers.map((peer) => ({
+                    publicKey: peer.publicKey,
+                    allowedIPs: peer.allowedIps.join(", "),
+                })),
+                routes: config.wireguard.routes,
+            },
+            service: {
+                type: "LoadBalancer",
+                port: listenPort,
+                annotations: {
+                    "external-dns.alpha.kubernetes.io/hostname": config.wireguard.endpoint,
+                },
+            },
+            persistence: {
+                enabled: true,
+                size: "100Mi",
+            },
+            ...config.wireguard.values,
+        },
+    }, { provider: k8sProvider, dependsOn: [nsResource] });
+    // Split DNS
+    let dnsClusterIp;
+    if (config.dns?.enabled) {
+        const dns = (0, dns_1.deployAccessDns)(name, prefix, config.dns, NAMESPACE, k8sProvider, [], [nsResource]);
+        dnsClusterIp = dns.clusterIp;
+    }
+    // Server public key: must be read from the running pod after first deploy
+    const serverPublicKey = pulumi.output("<run 'kubectl exec wireguard-0 -n access -- wg show wg0 public-key' after first deploy>");
+    const clientConfigs = pulumi
+        .output(Object.fromEntries(config.wireguard.peers.map((peer) => [
+        peer.name,
+        buildClientConfig(peer, serverPublicKey, config.wireguard.endpoint, listenPort, config.wireguard.routes, config.wireguard.serverCidr, dnsClusterIp),
+    ])))
+        .apply((entries) => {
+        const result = {};
+        for (const [key, value] of Object.entries(entries)) {
+            result[key] = value;
+        }
+        return result;
+    });
+    return {
+        name,
+        provider: "wireguard",
+        namespace: NAMESPACE,
+        helmRelease,
+        serverPublicKey,
+        clientConfigs,
+    };
+}
+//# sourceMappingURL=wireguard.js.map

package/dist/cjs/access/wireguard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wireguard.js","sourceRoot":"","sources":["../../../src/access/wireguard.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDH,0CAsFC;AApID,wDAA0C;AAC1C,uDAAyC;AAEzC,+BAAwC;AACxC,gEAA4D;AAE5D,MAAM,SAAS,GAAG,QAAQ,CAAC;AAC3B,MAAM,YAAY,GAAG,KAAK,CAAC;AAE3B;;GAEG;AACH,SAAS,iBAAiB,CACxB,IAAoB,EACpB,eAAsC,EACtC,QAAgB,EAChB,UAAkB,EAClB,MAA6B,EAC7B,UAAkB,EAClB,KAA6B;IAE7B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE;QACvF,MAAM,KAAK,GAAG;YACZ,aAAa;YACb,iCAAiC;YACjC,aAAa,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;SAClC,CAAC;QAEF,IAAI,GAAG,EAAE,CAAC;YACR,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,cAAc,QAAQ,IAAI,UAAU,EAAE,CAAC,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAEvC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,IAAY,EAAE,MAA+B;IAC3E,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,IAAI,YAAY,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAA,kCAAe,EAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAE3D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CACzC,GAAG,IAAI,YAAY,EACnB;QACE,KAAK,EAAE,WAAW;QAClB,cAAc,EAAE,EAAE,IAAI,EAAE,6CAA6C,EAAE;QACvE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO;QACjC,SAAS,EAAE,SAAS;QACpB,eAAe,EAAE,KAAK;QACtB,MAAM,EAAE;YACN,SAAS,EAAE;gBACT,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;gBACpC,UAAU;gBACV,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;iBACvC,CAAC,CAAC;gBACH,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;aAChC;YACD,OAAO,EAAE;gBACP,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,UAAU;gBAChB,WAAW,EAAE;oBACX,2CAA2C,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;iBACvE;aACF;YACD,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,OAAO;aACd;YACD,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM;SAC3B;KACF,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,CACnD,CAAC;IAEF,YAAY;IACZ,IAAI,YAA+C,CAAC;IACpD,IAAI,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,IAAA,qBAAe,EAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAChG,YAAY,GAAG,GAAG,CAAC,SAAS,CAAC;IAC/B,CAAC;IAED,0EAA0E;IAC1E,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CACnC,yFAAyF,CAC1F,CAAC;IAEF,MAAM,aAAa,GAAG,MAAM;SACzB,MAAM,CACL,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI;QACT,iBAAiB,CACf,IAAI,EACJ,eAAe,EACf,MAAM,CAAC,SAAS,CAAC,QAAQ,EACzB,UAAU,EACV,MAAM,CAAC,SAAS,CAAC,MAAM,EACvB,MAAM,CAAC,SAAS,CAAC,UAAU,EAC3B,YAAY,CACb;KACF,CAAC,CACH,CACF;SACA,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAe,CAAC;QAChC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEL,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,SAAS;QACpB,WAAW;QACX,eAAe;QACf,aAAa;KACd,CAAC;AACJ,CAAC"}

package/dist/cjs/argocd/app.d.ts

@@ -0,0 +1,31 @@
+/**
+ * ArgoCD Application management.
+ *
+ * @module argocd/app
+ */
+import * as k8s from "@pulumi/kubernetes";
+import type * as pulumi from "@pulumi/pulumi";
+import type { IArgoAppConfig, IArgoSecretsConfig, IArgoAppSecrets, IExternalSecretsConfig } from "./interfaces";
+import type { IExposedService } from "../types";
+import type { ICluster } from "../cluster";
+export declare class ArgoApp {
+    readonly name: string;
+    readonly namespace: string;
+    readonly project: string;
+    readonly resource: k8s.apiextensions.CustomResource;
+    private readonly cluster;
+    private exposedService?;
+    constructor(resourceName: string, name: string, config: IArgoAppConfig, cluster: ICluster, provider: k8s.Provider, dependsOn: pulumi.Resource[]);
+    /** Create K8s Secret with typed refs for Helm values. */
+    createSecrets(name: string, config: IArgoSecretsConfig): IArgoAppSecrets;
+    /** Create ExternalSecret CRD that ESO syncs from Vault to a K8s Secret. */
+    createExternalSecrets(name: string, config: IExternalSecretsConfig): IArgoAppSecrets;
+    /** Expose this app via the access gateway (Tailscale). */
+    expose(config: {
+        label: string;
+        port: number;
+    }): this;
+    /** Get the exposed service config (if expose() was called). */
+    getExposedService(): IExposedService | undefined;
+}
+//# sourceMappingURL=app.d.ts.map

package/dist/cjs/argocd/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../src/argocd/app.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EACV,cAAc,EAId,kBAAkB,EAClB,eAAe,EAEf,sBAAsB,EACvB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AA6E3C,qBAAa,OAAO;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC,cAAc,CAAC;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;IACnC,OAAO,CAAC,cAAc,CAAC,CAAkB;gBAGvC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,QAAQ,EACjB,QAAQ,EAAE,GAAG,CAAC,QAAQ,EACtB,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE;IAwD9B,yDAAyD;IACzD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,eAAe;IAQxE,2EAA2E;IAC3E,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,eAAe;IAQpF,0DAA0D;IAC1D,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAUrD,+DAA+D;IAC/D,iBAAiB,IAAI,eAAe,GAAG,SAAS;CAGjD"}