From a7d39e0aeb7925aa83d43129e5f37f778c105fc5 Mon Sep 17 00:00:00 2001
From: kisfenyo <kisfenyo@dooplex.local>
Date: Wed, 31 Dec 2025 17:13:27 +0100
Subject: [PATCH] added privatebin

---
 privatebin-system/privatebin.yaml | 416 ++++++++++++++++++++++++++++++
 1 file changed, 416 insertions(+)
 create mode 100644 privatebin-system/privatebin.yaml

diff --git a/privatebin-system/privatebin.yaml b/privatebin-system/privatebin.yaml
new file mode 100644
index 0000000..61f7d7c
--- /dev/null
+++ b/privatebin-system/privatebin.yaml
@@ -0,0 +1,416 @@
+---
+# PrivateBin - Zero-knowledge pastebin
+# Domain: privatebin.dooplex.hu
+# Authentication: Authentik proxy for POST (create), public GET (read)
+# Version: 2.0.3
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: privatebin-system
+  labels:
+    app.kubernetes.io/name: privatebin
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: privatebin-data
+  namespace: privatebin-system
+  labels:
+    app.kubernetes.io/name: privatebin
+    app.kubernetes.io/instance: privatebin
+    recurring-job-group.longhorn.io/needbackup: enabled
+    recurring-job.longhorn.io/source: enabled
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=false
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: privatebin-configs
+  namespace: privatebin-system
+  labels:
+    app.kubernetes.io/name: privatebin
+    app.kubernetes.io/instance: privatebin
+data:
+  conf.php: |
+    ;<?php http_response_code(403); /*
+    ; PrivateBin configuration
+    ; https://github.com/PrivateBin/PrivateBin/wiki/Configuration
+
+    [main]
+    ; Project name displayed on the website
+    name = "Dooplex Paste"
+
+    ; Base path for OpenGraph/social media previews
+    basepath = "https://privatebin.dooplex.hu/"
+
+    ; Enable discussion/comments feature
+    discussion = true
+
+    ; Don't preselect discussion by default
+    opendiscussion = false
+
+    ; Enable password protection option
+    password = true
+
+    ; Allow file uploads (attached files)
+    fileupload = true
+
+    ; Don't preselect burn after reading
+    burnafterreadingselected = false
+
+    ; Default text formatter
+    defaultformatter = "syntaxhighlighting"
+
+    ; Syntax highlighting theme (empty = default)
+    syntaxhighlightingtheme = "sons-of-obsidian"
+
+    ; Maximum paste size (10 MB)
+    sizelimit = 10485760
+
+    ; Use Bootstrap 5 template (dark mode)
+    template = "bootstrap-dark"
+
+    ; Enable QR code generation for paste URLs
+    qrcode = true
+
+    ; Enable email sharing button
+    email = true
+
+    ; Icon style (identicon/jdenticon/vizhash/none)
+    icon = "jdenticon"
+
+    ; Custom notice (optional)
+    ; notice = "Note: Pastes may be deleted after expiration."
+
+    ; Compression algorithm (zlib/none)
+    compression = "zlib"
+
+    [expire]
+    ; Default expiration time
+    default = "1week"
+
+    [expire_options]
+    ; Available expiration options
+    5min = 300
+    10min = 600
+    1hour = 3600
+    1day = 86400
+    1week = 604800
+    1month = 2592000
+    1year = 31536000
+    never = 0
+
+    [formatter_options]
+    ; Available formatters
+    plaintext = "Plain Text"
+    syntaxhighlighting = "Source Code"
+    markdown = "Markdown"
+
+    [traffic]
+    ; Rate limiting - 10 seconds between paste creations per IP
+    limit = 10
+
+    ; Exempted IPs from rate limiting (internal networks)
+    exempted = "10.42.0.0/16,10.43.0.0/16"
+
+    ; Traffic limit in bytes (0 = no limit)
+    ; creators = 0
+
+    [purge]
+    ; Purge expired pastes probability (1 in X requests)
+    limit = 300
+
+    ; Maximum items to delete per purge
+    batchsize = 10
+
+    [model]
+    ; Use filesystem storage
+    class = Filesystem
+
+    [model_options]
+    ; Data directory (mounted via PVC)
+    dir = PATH "data"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: privatebin
+  namespace: privatebin-system
+  labels:
+    app.kubernetes.io/name: privatebin
+    app.kubernetes.io/instance: privatebin
+    app.kubernetes.io/version: "2.0.3"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: privatebin
+      app.kubernetes.io/instance: privatebin
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: privatebin
+        app.kubernetes.io/instance: privatebin
+        app.kubernetes.io/version: "2.0.3"
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsUser: 65534
+        runAsGroup: 82
+        fsGroup: 82
+      containers:
+        - name: privatebin
+          image: privatebin/nginx-fpm-alpine:2.0.3
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          securityContext:
+            readOnlyRootFilesystem: true
+            privileged: false
+            allowPrivilegeEscalation: false
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 256Mi
+          volumeMounts:
+            - name: configs
+              mountPath: /srv/cfg
+            - name: data
+              mountPath: /srv/data
+            - name: run
+              mountPath: /run
+            - name: tmp
+              mountPath: /tmp
+            - name: nginx-cache
+              mountPath: /var/lib/nginx/tmp
+      volumes:
+        - name: configs
+          configMap:
+            name: privatebin-configs
+        - name: data
+          persistentVolumeClaim:
+            claimName: privatebin-data
+        - name: run
+          emptyDir:
+            medium: Memory
+        - name: tmp
+          emptyDir:
+            medium: Memory
+        - name: nginx-cache
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: privatebin
+  namespace: privatebin-system
+  labels:
+    app.kubernetes.io/name: privatebin
+    app.kubernetes.io/instance: privatebin
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: privatebin
+    app.kubernetes.io/instance: privatebin
+---
+# =============================================================================
+# INGRESS CONFIGURATION
+# =============================================================================
+#
+# OPTION 1 (Current): Public access on both domains
+# - privatebin.dooplex.hu - public HTTPS access
+# - privatebin.home - internal access
+#
+# OPTION 2: Authenticated writes, public reads
+# This requires Authentik configuration (see instructions below).
+# Comment out the public ingress and uncomment the authenticated one.
+#
+# =============================================================================
+
+# PUBLIC INGRESS - No authentication required
+# Anyone can create and view pastes
+#apiVersion: networking.k8s.io/v1
+#kind: Ingress
+#metadata:
+#  name: privatebin
+#  namespace: privatebin-system
+#  labels:
+#    app.kubernetes.io/name: privatebin
+#    app.kubernetes.io/instance: privatebin
+#  annotations:
+#    cert-manager.io/cluster-issuer: letsencrypt-prod
+#    external-dns.alpha.kubernetes.io/hostname: privatebin.home,privatebin.dooplex.hu
+#    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+#    nginx.ingress.kubernetes.io/proxy-body-size: "12m"
+#spec:
+#  ingressClassName: nginx-internal
+#  tls:
+#    - hosts:
+#        - privatebin.dooplex.hu
+#      secretName: privatebin-tls
+#  rules:
+#    - host: privatebin.dooplex.hu
+#      http:
+#        paths:
+#          - path: /
+#            pathType: Prefix
+#            backend:
+#              service:
+#                name: privatebin
+#                port:
+#                  number: 80
+#    - host: privatebin.home
+#      http:
+#        paths:
+#          - path: /
+#            pathType: Prefix
+#            backend:
+#              service:
+#                name: privatebin
+#                port:
+#                  number: 80
+#
+# =============================================================================
+# AUTHENTICATED INGRESS (Optional)
+# =============================================================================
+# To enable authentication for creating pastes while keeping viewing public,
+# follow these steps:
+#
+# 1. AUTHENTIK SETUP:
+#    a) Create Application:
+#       - Name: PrivateBin
+#       - Slug: privatebin
+#       - Provider: (create new proxy provider below)
+#
+#    b) Create Proxy Provider:
+#       - Name: privatebin-provider
+#       - Authorization flow: default-provider-authorization-implicit-consent
+#       - Mode: Forward auth (single application)
+#       - External host: https://privatebin.dooplex.hu
+#
+#    c) Create Expression Policy for conditional auth:
+#       - Name: privatebin-method-check
+#       - Expression:
+#         # GET/HEAD requests pass through without requiring login
+#         # POST requests require authentication
+#         if request.http_request.method in ["GET", "HEAD", "OPTIONS"]:
+#             # Pass the policy - but note: user may still not be authenticated
+#             # The key is setting "Unauthenticated URLs" below
+#             return True
+#         # For POST/PUT/DELETE, require the user to be authenticated
+#         if request.user.is_authenticated:
+#             return True
+#         return False
+#
+#    d) Configure Provider settings:
+#       - Unauthenticated URLs: ^https://privatebin\.dooplex\.hu/\?[a-f0-9]+.*$
+#         (This regex matches paste view URLs)
+#       - Or simpler: Check "Intercept header authentication" in advanced settings
+#         and handle auth at ingress level
+#
+#    e) Create/Update Outpost:
+#       - Name: privatebin-outpost
+#       - Type: Proxy
+#       - Add the PrivateBin application
+#
+# 2. UPDATE INGRESS:
+#    Comment out the public ingress above and uncomment this one:
+#
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: privatebin
+  namespace: privatebin-system
+  labels:
+    app.kubernetes.io/name: privatebin
+    app.kubernetes.io/instance: privatebin
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    external-dns.alpha.kubernetes.io/hostname: privatebin.home,privatebin.dooplex.hu
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "12m"
+    nginx.ingress.kubernetes.io/auth-url: http://ak-outpost-privatebin-outpost.auth-system.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx
+    nginx.ingress.kubernetes.io/auth-signin: https://privatebin.dooplex.hu/outpost.goauthentik.io/start?rd=$escaped_request_uri
+    nginx.ingress.kubernetes.io/auth-response-headers: Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email
+    nginx.ingress.kubernetes.io/auth-snippet: |
+      proxy_set_header X-Forwarded-Host $http_host;
+    nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
+    nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
+    nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "32k"
+spec:
+  ingressClassName: nginx-internal
+  tls:
+    - hosts:
+        - privatebin.dooplex.hu
+      secretName: privatebin-tls
+  rules:
+    - host: privatebin.dooplex.hu
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: privatebin
+                port:
+                  number: 80
+    - host: privatebin.home
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: privatebin
+                port:
+                  number: 80
+#
+# 3. ALTERNATIVE: Use existing outpost
+#    If you want to use an existing outpost (like arr-outpost), 
+#    just add privatebin.dooplex.hu to that outpost's applications
+#    and update the auth-url to point to that outpost.
+---
+# ServiceAccount (minimal, not needed but good practice)
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: privatebin
+  namespace: privatebin-system
+  labels:
+    app.kubernetes.io/name: privatebin
+    app.kubernetes.io/instance: privatebin
+automountServiceAccountToken: false