add cert-manager configuration

overlays/dev/resources/cert-manager/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ./resources/cluster-issuer.yaml
+- ./resources/ca.yaml
+- ./resources/issuer.yaml

overlays/dev/resources/cert-manager/resources/ca.yaml

@@ -0,0 +1,19 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: cadoles-selfsigned-ca
+#  namespace: cert-manager
+#  namespace: ingress-nginx
+
+spec:
+  isCA: true
+  commonName: cadoles-selfsigned-ca
+#  secretName: root-secret
+  secretName: cadoles-selfsigned-ca
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: cadoles-selfsigned-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io

overlays/dev/resources/cert-manager/resources/cluster-issuer.yaml

@@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: cadoles-selfsigned-issuer
+spec:
+  selfSigned: {}

overlays/dev/resources/cert-manager/resources/issuer.yaml

@@ -0,0 +1,9 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: cadoles-ca-issuer
+#  namespace: cert-manager
+#  namespace: ingress-nginx
+spec:
+  ca:
+    secretName: cadoles-selfsigned-ca

overlays/dev/resources/ssl.yaml

@@ -0,0 +1,40 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: nextcloud
+spec:
+  # Secret names are always required.
+  #secretName: nextcloud-tls
+  secretName: cadoles-selfsigned-ca
+
+
+  duration: 2160h # 90d
+  renewBefore: 360h # 15d
+  subject:
+    organizations:
+    - cadoles
+  # The use of the common name field has been deprecated since 2000 and is
+  # discouraged from being used.
+  commonName: cadoles.fr
+  isCA: false
+  privateKey:
+    algorithm: RSA
+    encoding: PKCS1
+    size: 2048
+  usages:
+  - server auth
+  - client auth
+  # At least one of a DNS Name, URI, or IP address is required.
+  dnsNames:
+  - nextcloud
+  - nextcloud.cadoles.fr
+  - nxt.cadoles.fr
+  # Issuer references are always required.
+  issuerRef:
+    name: cadoles-ca-issuer
+    # We can reference ClusterIssuers by changing the kind here.
+    # The default value is Issuer (i.e. a locally namespaced Issuer)
+    kind: Issuer
+    # This is optional since cert-manager will default to this value however
+    # if you are using an external issuer, change this to that issuer group.
+    group: cert-manager.io