Adds cryptpad app.

cryptpad/app.yaml

@@ -0,0 +1,5 @@
+name: cryptpad
+is: cryptpad
+description: CryptPad is an end-to-end encrypted collaboration suite with documents, spreadsheets, kanban boards, and more.
+icon: https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/cryptpad.svg
+latest: "2024"

cryptpad/versions/2024/README.md

@@ -0,0 +1,30 @@
+# CryptPad
+
+CryptPad is a privacy-first, end-to-end encrypted collaboration suite. Documents are encrypted in the browser before being stored — the server never sees plaintext content.
+
+## Configuration
+
+Key settings in `config.yaml`:
+
+- **domain** - Main domain for CryptPad
+- **sandboxDomain** - Sandbox subdomain for secure iframe isolation (default: `cryptpad-sandbox.{your-cloud-domain}`)
+- **storage** - Persistent volume size (default: `2Gi`)
+
+## Usage
+
+No account is required to create documents. Just visit the app URL and start creating spreadsheets, code pads, presentations, or rich-text documents. Share the document URL with collaborators.
+
+## Admin Setup
+
+To access the admin panel, you need to register an account and then link it to the `adminKey` secret:
+
+1. Register an account at the app URL
+2. Go to your user settings and copy your **Public Signing Key**
+3. The `adminKey` in `secrets.yaml` should match this key — it is pre-populated with a generated value, but you must replace it with your actual account's public signing key after registering
+4. Once set, the **Admin** link will appear in the user menu
+
+## Notes
+
+- Both the main domain and the sandbox domain must be accessible — CryptPad uses the sandbox domain for secure iframe isolation, and the app will not function correctly if one is missing
+- All encryption keys are generated client-side — if you lose your account passphrase, documents cannot be recovered
+- The instance can be configured to require registration before creating documents (via the admin panel)

cryptpad/versions/2024/deployment.yaml

@@ -0,0 +1,90 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cryptpad
+  namespace: cryptpad
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      component: web
+  template:
+    metadata:
+      labels:
+        component: web
+    spec:
+      securityContext:
+        runAsUser: 0
+        runAsNonRoot: false
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        - name: seed-config
+          image: cryptpad/cryptpad:latest
+          command:
+            - sh
+            - -c
+            - |
+              if [ ! -f /config-dest/config.example.js ]; then
+                cp /cryptpad/config/config.example.js /config-dest/config.example.js
+              fi
+          volumeMounts:
+            - name: cryptpad-config
+              mountPath: /config-dest
+      containers:
+        - name: cryptpad
+          image: cryptpad/cryptpad:latest
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+          env:
+            - name: CPAD_CONF
+              value: /cryptpad/config/config.js
+            - name: CPAD_MAIN_DOMAIN
+              value: https://{{ .domain }}
+            - name: CPAD_SANDBOX_DOMAIN
+              value: https://{{ .sandboxDomain }}
+            - name: CPAD_TRUSTED_PROXY
+              value: "true"
+          resources:
+            limits:
+              cpu: 1000m
+              ephemeral-storage: 1Gi
+              memory: 1Gi
+            requests:
+              cpu: 50m
+              ephemeral-storage: 50Mi
+              memory: 256Mi
+          volumeMounts:
+            - name: cryptpad-data
+              mountPath: /cryptpad/data
+            - name: cryptpad-config
+              mountPath: /cryptpad/config
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 90
+            timeoutSeconds: 5
+            periodSeconds: 15
+            failureThreshold: 6
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 60
+            timeoutSeconds: 3
+            periodSeconds: 10
+            failureThreshold: 3
+          securityContext:
+            readOnlyRootFilesystem: false
+      volumes:
+        - name: cryptpad-data
+          persistentVolumeClaim:
+            claimName: cryptpad-data
+        - name: cryptpad-config
+          emptyDir: {}
+      restartPolicy: Always

cryptpad/versions/2024/ingress.yaml

@@ -0,0 +1,37 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cryptpad
+  namespace: cryptpad
+  annotations:
+    external-dns.alpha.kubernetes.io/target: {{ .externalDnsDomain }}
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
+    external-dns.alpha.kubernetes.io/ttl: "60"
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: {{ .domain }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: cryptpad
+                port:
+                  number: 80
+    - host: {{ .sandboxDomain }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: cryptpad
+                port:
+                  number: 80
+  tls:
+    - hosts:
+        - {{ .domain }}
+        - {{ .sandboxDomain }}
+      secretName: {{ .tlsSecretName }}

cryptpad/versions/2024/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cryptpad
+labels:
+  - includeSelectors: true
+    pairs:
+      app: cryptpad
+      managedBy: kustomize
+      partOf: wild-cloud
+resources:
+  - namespace.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - pvc.yaml

cryptpad/versions/2024/manifest.yaml

@@ -0,0 +1,10 @@
+version: 2024.x-1
+defaultConfig:
+  namespace: cryptpad
+  externalDnsDomain: '{{ .cloud.domain }}'
+  domain: cryptpad.{{ .cloud.domain }}
+  sandboxDomain: cryptpad-sandbox.{{ .cloud.domain }}
+  tlsSecretName: wildcard-wild-cloud-tls
+  storage: 2Gi
+defaultSecrets:
+  - key: adminKey

cryptpad/versions/2024/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .namespace }}

cryptpad/versions/2024/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: cryptpad-data
+  namespace: cryptpad
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .storage }}

cryptpad/versions/2024/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: cryptpad
+  namespace: cryptpad
+spec:
+  selector:
+    component: web
+  ports:
+    - name: http
+      port: 80
+      targetPort: 3000
+      protocol: TCP