From cda1d1288305ff72607b9f208087a7fcdbc44eca Mon Sep 17 00:00:00 2001
From: pierre <pierre@geeraert.eu>
Date: Thu, 25 Jul 2024 17:04:03 +0100
Subject: [PATCH] :sparkles: starting to use terraform

---
 terraform/module.tf                |  30 +++++++
 terraform/nginx_config.tftpl       |  57 +++++++++++++
 terraform/terraform.tfstate        | 130 +++++++++++++++++++++++++++++
 terraform/terraform.tfstate.backup | 130 +++++++++++++++++++++++++++++
 terraform/variables.auto.tfvars    |  61 ++++++++++++++
 5 files changed, 408 insertions(+)
 create mode 100644 terraform/module.tf
 create mode 100644 terraform/nginx_config.tftpl
 create mode 100644 terraform/terraform.tfstate
 create mode 100644 terraform/terraform.tfstate.backup
 create mode 100644 terraform/variables.auto.tfvars

diff --git a/terraform/module.tf b/terraform/module.tf
new file mode 100644
index 0000000..91440db
--- /dev/null
+++ b/terraform/module.tf
@@ -0,0 +1,30 @@
+terraform {
+        required_version = "> 0.8.0"
+}
+
+variable "nginx_sites" {
+        type = map(object({
+                service       = string
+                proxy_cache = bool
+                extra-value = string
+                extra_value_bool = bool
+                http2_bool = bool
+        }))
+
+}
+
+resource "local_file" "nginx"{
+        for_each     = var.nginx_sites
+
+        content = templatefile("nginx_config.tftpl", {
+                name_site = each.key
+                name_service = each.value.service
+                proxy_cache = each.value.proxy_cache
+                extra_value_bool = each.value.extra_value_bool
+                extra-value = each.value.extra-value
+                http2_bool = each.value.http2_bool
+        })
+
+        filename = "../conf.d/${each.key}.tryton.geeraert.eu.conf"
+
+}
diff --git a/terraform/nginx_config.tftpl b/terraform/nginx_config.tftpl
new file mode 100644
index 0000000..d8ceb77
--- /dev/null
+++ b/terraform/nginx_config.tftpl
@@ -0,0 +1,57 @@
+############################################
+#       config file for ${name_site}
+############################################
+
+upstream ${name_site}_backend {
+        server ${name_service};
+        server 1.1.1.1 backup;
+    }
+
+server {
+        server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
+        location / {
+                proxy_pass http://${name_site}_backend;
+                %{ if proxy_cache}
+                location ~* \.(html|css|jpg|gif|ico|js)$ {
+	                proxy_cache          cache;
+	                proxy_cache_key      $host$uri$is_args$args;
+	                proxy_cache_valid    200 301 302 30m;
+	                expires              30m;
+	                proxy_pass  http://${name_site}_backend;
+		}
+                %{ endif }
+        }
+        location /.well-known/acme-challenge/ {
+                root /var/www/certbot;
+        }
+
+                %{ if extra_value_bool}
+                        ${extra-value}
+                %{ endif }
+
+
+        %{ if http2_bool}
+        http2 on;
+        ssl_protocols TLSv1.2;
+        %{ endif }
+
+        listen 443 ssl;
+        ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;
+        ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
+
+}
+server {
+        if ($host = www.${name_site}.tryton.geeraert.eu) {
+                return 301 https://$host$request_uri;
+        }
+
+
+        if ($host = ${name_site}.tryton.geeraert.eu) {
+                return 301 https://$host$request_uri;
+        }
+
+        server_name www.${name_site}.tryton.geeraert.eu ${name_site}.tryton.geeraert.eu;
+        listen 80;
+        return 404;
+
+}
diff --git a/terraform/terraform.tfstate b/terraform/terraform.tfstate
new file mode 100644
index 0000000..0258c18
--- /dev/null
+++ b/terraform/terraform.tfstate
@@ -0,0 +1,130 @@
+{
+  "version": 4,
+  "terraform_version": "1.9.2",
+  "serial": 24,
+  "lineage": "a36de74c-83f8-01fe-0504-92c54a21d49e",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "local_file",
+      "name": "nginx",
+      "provider": "provider[\"registry.terraform.io/hashicorp/local\"]",
+      "instances": [
+        {
+          "index_key": "bitwarden",
+          "schema_version": 0,
+          "attributes": {
+            "content": "############################################\n#       config file for bitwarden\n############################################\n\nupstream bitwarden_backend {\n        server nginx.bitwarden.svc:8080;\n        server 1.1.1.1 backup;\n    }\n\nserver {\n        server_name bitwarden.tryton.geeraert.eu www.bitwarden.tryton.geeraert.eu;\n        location / {\n                proxy_pass http://bitwarden_backend;\n                \n        }\n        location /.well-known/acme-challenge/ {\n                root /var/www/certbot;\n        }\n\n                \n\n\n        \n        http2 on;\n        ssl_protocols TLSv1.2;\n        \n\n        listen 443 ssl;\n        ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;\n        ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;\n\n}\nserver {\n        if ($host = www.bitwarden.tryton.geeraert.eu) {\n                return 301 https://$host$request_uri;\n        }\n\n\n        if ($host = bitwarden.tryton.geeraert.eu) {\n                return 301 https://$host$request_uri;\n        }\n\n        server_name www.bitwarden.tryton.geeraert.eu bitwarden.tryton.geeraert.eu;\n        listen 80;\n        return 404;\n\n}\n",
+            "content_base64": null,
+            "content_base64sha256": "YTpqmEfgRp8OS3TZMNy7SLoTCt3UYNTchR3OITgkjm8=",
+            "content_base64sha512": "OvZDSCJ9qtm67k7gQt+uTV/NDVtneL3vunKndKspzAk/wPJxqmthkzrv/HQ5l5ptm17YmqGOdkTK6bgkLW+y3w==",
+            "content_md5": "befd5d886b1d10376671904baac6be2e",
+            "content_sha1": "5c35d44470c4be38a4513c4211f40cd6e76d5705",
+            "content_sha256": "613a6a9847e0469f0e4b74d930dcbb48ba130addd460d4dc851dce2138248e6f",
+            "content_sha512": "3af64348227daad9baee4ee042dfae4d5fcd0d5b6778bdefba72a774ab29cc093fc0f271aa6b61933aeffc7439979a6d9b5ed89aa18e7644cae9b8242d6fb2df",
+            "directory_permission": "0777",
+            "file_permission": "0777",
+            "filename": "../conf.d/bitwarden.tryton.geeraert.eu.conf",
+            "id": "5c35d44470c4be38a4513c4211f40cd6e76d5705",
+            "sensitive_content": null,
+            "source": null
+          },
+          "sensitive_attributes": [
+            [
+              {
+                "type": "get_attr",
+                "value": "sensitive_content"
+              }
+            ]
+          ]
+        },
+        {
+          "index_key": "keycloak",
+          "schema_version": 0,
+          "attributes": {
+            "content": "############################################\n#       config file for keycloak\n############################################\n\nupstream keycloak_backend {\n        server keycloak.keycloak.svc:8080;\n        server 1.1.1.1 backup;\n    }\n\nserver {\n        server_name keycloak.tryton.geeraert.eu www.keycloak.tryton.geeraert.eu;\n        location / {\n                proxy_pass http://keycloak_backend;\n                \n        }\n        location /.well-known/acme-challenge/ {\n                root /var/www/certbot;\n        }\n\n                \n                        \n        set_real_ip_from 0.0.0.0/0;\n        real_ip_header X-Real-IP;\n        real_ip_recursive on;\n\n                \n\n\n        \n\n        listen 443 ssl;\n        ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;\n        ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;\n\n}\nserver {\n        if ($host = www.keycloak.tryton.geeraert.eu) {\n                return 301 https://$host$request_uri;\n        }\n\n\n        if ($host = keycloak.tryton.geeraert.eu) {\n                return 301 https://$host$request_uri;\n        }\n\n        server_name www.keycloak.tryton.geeraert.eu keycloak.tryton.geeraert.eu;\n        listen 80;\n        return 404;\n\n}\n",
+            "content_base64": null,
+            "content_base64sha256": "vMjUSlJ4sOt9OjvUk9swHCnclYlT5JkBDFI7uxKFksg=",
+            "content_base64sha512": "7ej/8qY1Iib7KUN7Y7ccRzX0DdqZgf5PzTqk7eaAjIx7jjJ6GkohETcoPEeoqccHyhsYeusBpckrWn7HaoT4TQ==",
+            "content_md5": "9e976349fe8b513ccab4a37263fff3b2",
+            "content_sha1": "d63c4468f16a1a854e04bc24fab60d08e61988de",
+            "content_sha256": "bcc8d44a5278b0eb7d3a3bd493db301c29dc958953e499010c523bbb128592c8",
+            "content_sha512": "ede8fff2a6352226fb29437b63b71c4735f40dda9981fe4fcd3aa4ede6808c8c7b8e327a1a4a211137283c47a8a9c707ca1b187aeb01a5c92b5a7ec76a84f84d",
+            "directory_permission": "0777",
+            "file_permission": "0777",
+            "filename": "../conf.d/keycloak.tryton.geeraert.eu.conf",
+            "id": "d63c4468f16a1a854e04bc24fab60d08e61988de",
+            "sensitive_content": null,
+            "source": null
+          },
+          "sensitive_attributes": [
+            [
+              {
+                "type": "get_attr",
+                "value": "sensitive_content"
+              }
+            ]
+          ]
+        },
+        {
+          "index_key": "nextcloud",
+          "schema_version": 0,
+          "attributes": {
+            "content": "############################################\n#       config file for nextcloud\n############################################\n\nupstream nextcloud_backend {\n        server webserver.nextcloud.svc;\n        server 1.1.1.1 backup;\n    }\n\nserver {\n        server_name nextcloud.tryton.geeraert.eu www.nextcloud.tryton.geeraert.eu;\n        location / {\n                proxy_pass http://nextcloud_backend;\n                \n                location ~* \\.(html|css|jpg|gif|ico|js)$ {\n\t                proxy_cache          cache;\n\t                proxy_cache_key      $host$uri$is_args$args;\n\t                proxy_cache_valid    200 301 302 30m;\n\t                expires              30m;\n\t                proxy_pass  http://nextcloud_backend;\n\t\t}\n                \n        }\n        location /.well-known/acme-challenge/ {\n                root /var/www/certbot;\n        }\n\n                \n                        \n\n        location /.well-known/carddav {\n                return 301 $scheme://$host/remote.php/dav;\n        }\n\n        location /.well-known/caldav {\n                return 301 $scheme://$host/remote.php/dav;\n        }\n\n        location = /health {\n                default_type text/html;\n                return 200 \"\u003c!DOCTYPE html\u003e\u003ch2\u003ehealth check\u003c/h2\u003e\\n\";\n        }\n\n                \n\n\n        \n        http2 on;\n        ssl_protocols TLSv1.2;\n        \n\n        listen 443 ssl;\n        ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;\n        ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;\n\n}\nserver {\n        if ($host = www.nextcloud.tryton.geeraert.eu) {\n                return 301 https://$host$request_uri;\n        }\n\n\n        if ($host = nextcloud.tryton.geeraert.eu) {\n                return 301 https://$host$request_uri;\n        }\n\n        server_name www.nextcloud.tryton.geeraert.eu nextcloud.tryton.geeraert.eu;\n        listen 80;\n        return 404;\n\n}\n",
+            "content_base64": null,
+            "content_base64sha256": "bYH6+PkvYOS+Dv+d3rimq14gkFybnmQd2GqdJCbU5Zc=",
+            "content_base64sha512": "PjQFc3QIJZSpxIkJjjPJBYPx9I2qT1VAdhZYFYhuq6rXMBFBgLLIRlynp9bPR0JU564H4sT9Gdfa0K6IhOYCbg==",
+            "content_md5": "9dceef0d6bbbd36c41c200fe5afefd1e",
+            "content_sha1": "e136bd3d9fc0b1208ac49d15eb56887d55c51a10",
+            "content_sha256": "6d81faf8f92f60e4be0eff9ddeb8a6ab5e20905c9b9e641dd86a9d2426d4e597",
+            "content_sha512": "3e34057374082594a9c489098e33c90583f1f48daa4f554076165815886eabaad730114180b2c8465ca7a7d6cf474254e7ae07e2c4fd19d7dad0ae8884e6026e",
+            "directory_permission": "0777",
+            "file_permission": "0777",
+            "filename": "../conf.d/nextcloud.tryton.geeraert.eu.conf",
+            "id": "e136bd3d9fc0b1208ac49d15eb56887d55c51a10",
+            "sensitive_content": null,
+            "source": null
+          },
+          "sensitive_attributes": [
+            [
+              {
+                "type": "get_attr",
+                "value": "sensitive_content"
+              }
+            ]
+          ]
+        },
+        {
+          "index_key": "sonarr",
+          "schema_version": 0,
+          "attributes": {
+            "content": "############################################\n#       config file for sonarr\n############################################\n\nupstream sonarr_backend {\n        server sonarr.servarr.svc;\n        server 1.1.1.1 backup;\n    }\n\nserver {\n        server_name sonarr.tryton.geeraert.eu www.sonarr.tryton.geeraert.eu;\n        location / {\n                proxy_pass http://sonarr_backend;\n                \n        }\n        location /.well-known/acme-challenge/ {\n                root /var/www/certbot;\n        }\n\n                \n\n\n        \n\n        listen 443 ssl;\n        ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;\n        ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;\n\n}\nserver {\n        if ($host = www.sonarr.tryton.geeraert.eu) {\n                return 301 https://$host$request_uri;\n        }\n\n\n        if ($host = sonarr.tryton.geeraert.eu) {\n                return 301 https://$host$request_uri;\n        }\n\n        server_name www.sonarr.tryton.geeraert.eu sonarr.tryton.geeraert.eu;\n        listen 80;\n        return 404;\n\n}\n",
+            "content_base64": null,
+            "content_base64sha256": "A6ElmqlK5iz/RYdJ/AUwPhjtSrw+V2TMi7gS4fCLPTI=",
+            "content_base64sha512": "vdB+UAwb4ZQEWHJp0QFo8RHjdAmrxrhyDhZMlLbanI7WHZwpwNbkkqSD6k0lzjBeviWdwQ8kJ508nNjt1vSXig==",
+            "content_md5": "5626714858f4af5f2cba1d314804b819",
+            "content_sha1": "bb789b145b467d0b4f6a2bc0e3ddc3c2ac048946",
+            "content_sha256": "03a1259aa94ae62cff458749fc05303e18ed4abc3e5764cc8bb812e1f08b3d32",
+            "content_sha512": "bdd07e500c1be19404587269d10168f111e37409abc6b8720e164c94b6da9c8ed61d9c29c0d6e492a483ea4d25ce305ebe259dc10f24279d3c9cd8edd6f4978a",
+            "directory_permission": "0777",
+            "file_permission": "0777",
+            "filename": "../conf.d/sonarr.tryton.geeraert.eu.conf",
+            "id": "bb789b145b467d0b4f6a2bc0e3ddc3c2ac048946",
+            "sensitive_content": null,
+            "source": null
+          },
+          "sensitive_attributes": [
+            [
+              {
+                "type": "get_attr",
+                "value": "sensitive_content"
+              }
+            ]
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/terraform/terraform.tfstate.backup b/terraform/terraform.tfstate.backup
new file mode 100644
index 0000000..a0901a6
--- /dev/null
+++ b/terraform/terraform.tfstate.backup
@@ -0,0 +1,130 @@
+{
+  "version": 4,
+  "terraform_version": "1.9.2",
+  "serial": 21,
+  "lineage": "a36de74c-83f8-01fe-0504-92c54a21d49e",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "local_file",
+      "name": "nginx",
+      "provider": "provider[\"registry.terraform.io/hashicorp/local\"]",
+      "instances": [
+        {
+          "index_key": "bitwarden",
+          "schema_version": 0,
+          "attributes": {
+            "content": "############################################\n#       config file for bitwarden\n############################################\n\nupstream bitwarden_backend {\n        server nginx.bitwarden.svc:8080;\n        server 1.1.1.1 backup;\n    }\n\nserver {\n        server_name bitwarden.tryton.geeraert.eu www.bitwarden.tryton.geeraert.eu;\n        location / {\n                proxy_pass http://bitwarden_backend;\n                \n        }\n        location /.well-known/acme-challenge/ {\n                root /var/www/certbot;\n        }\n\n                \n\n\n        \n        http2 on;\n        ssl_protocols TLSv1.2;\n        \n\n        listen 443 ssl;\n        ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;\n        ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;\n\n}\nserver {\n        if ($host = www.bitwarden.tryton.geeraert.eu) {\n                return 301 https://$host$request_uri;\n        }\n\n\n        if ($host = bitwarden.tryton.geeraert.eu) {\n                return 301 https://$host$request_uri;\n        }\n\n        server_name www.bitwarden.tryton.geeraert.eu bitwarden.tryton.geeraert.eu;\n        listen 80;\n        return 404;\n\n}\n",
+            "content_base64": null,
+            "content_base64sha256": "YTpqmEfgRp8OS3TZMNy7SLoTCt3UYNTchR3OITgkjm8=",
+            "content_base64sha512": "OvZDSCJ9qtm67k7gQt+uTV/NDVtneL3vunKndKspzAk/wPJxqmthkzrv/HQ5l5ptm17YmqGOdkTK6bgkLW+y3w==",
+            "content_md5": "befd5d886b1d10376671904baac6be2e",
+            "content_sha1": "5c35d44470c4be38a4513c4211f40cd6e76d5705",
+            "content_sha256": "613a6a9847e0469f0e4b74d930dcbb48ba130addd460d4dc851dce2138248e6f",
+            "content_sha512": "3af64348227daad9baee4ee042dfae4d5fcd0d5b6778bdefba72a774ab29cc093fc0f271aa6b61933aeffc7439979a6d9b5ed89aa18e7644cae9b8242d6fb2df",
+            "directory_permission": "0777",
+            "file_permission": "0777",
+            "filename": "../conf.d/bitwarden.tryton.geeraert.eu.conf",
+            "id": "5c35d44470c4be38a4513c4211f40cd6e76d5705",
+            "sensitive_content": null,
+            "source": null
+          },
+          "sensitive_attributes": [
+            [
+              {
+                "type": "get_attr",
+                "value": "sensitive_content"
+              }
+            ]
+          ]
+        },
+        {
+          "index_key": "keycloak",
+          "schema_version": 0,
+          "attributes": {
+            "content": "############################################\n#       config file for keycloak\n############################################\n\nupstream keycloak_backend {\n        server keycloak.keycloak.svc:8080;\n        server 1.1.1.1 backup;\n    }\n\nserver {\n        server_name keycloak.tryton.geeraert.eu www.keycloak.tryton.geeraert.eu;\n        location / {\n                proxy_pass http://keycloak_backend;\n                \n        }\n        location /.well-known/acme-challenge/ {\n                root /var/www/certbot;\n        }\n\n                \n                        \n        set_real_ip_from 0.0.0.0/0;\n        real_ip_header X-Real-IP;\n        real_ip_recursive on;\n\n                \n\n\n        \n\n        listen 443 ssl;\n        ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;\n        ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;\n\n}\nserver {\n        if ($host = www.keycloak.tryton.geeraert.eu) {\n                return 301 https://$host$request_uri;\n        }\n\n\n        if ($host = keycloak.tryton.geeraert.eu) {\n                return 301 https://$host$request_uri;\n        }\n\n        server_name www.keycloak.tryton.geeraert.eu keycloak.tryton.geeraert.eu;\n        listen 80;\n        return 404;\n\n}\n",
+            "content_base64": null,
+            "content_base64sha256": "vMjUSlJ4sOt9OjvUk9swHCnclYlT5JkBDFI7uxKFksg=",
+            "content_base64sha512": "7ej/8qY1Iib7KUN7Y7ccRzX0DdqZgf5PzTqk7eaAjIx7jjJ6GkohETcoPEeoqccHyhsYeusBpckrWn7HaoT4TQ==",
+            "content_md5": "9e976349fe8b513ccab4a37263fff3b2",
+            "content_sha1": "d63c4468f16a1a854e04bc24fab60d08e61988de",
+            "content_sha256": "bcc8d44a5278b0eb7d3a3bd493db301c29dc958953e499010c523bbb128592c8",
+            "content_sha512": "ede8fff2a6352226fb29437b63b71c4735f40dda9981fe4fcd3aa4ede6808c8c7b8e327a1a4a211137283c47a8a9c707ca1b187aeb01a5c92b5a7ec76a84f84d",
+            "directory_permission": "0777",
+            "file_permission": "0777",
+            "filename": "../conf.d/keycloak.tryton.geeraert.eu.conf",
+            "id": "d63c4468f16a1a854e04bc24fab60d08e61988de",
+            "sensitive_content": null,
+            "source": null
+          },
+          "sensitive_attributes": [
+            [
+              {
+                "type": "get_attr",
+                "value": "sensitive_content"
+              }
+            ]
+          ]
+        },
+        {
+          "index_key": "nextcloud",
+          "schema_version": 0,
+          "attributes": {
+            "content": "############################################\n#       config file for nextcloud\n############################################\n\nupstream nextcloud_backend {\n        server webserver.nextcloud.svc;\n        server 1.1.1.1 backup;\n    }\n\nserver {\n        server_name nextcloud.tryton.geeraert.eu www.nextcloud.tryton.geeraert.eu;\n        location / {\n                proxy_pass http://nextcloud_backend;\n                \n                location ~* \\.(html|css|jpg|gif|ico|js)$ {\n\t                proxy_cache          cache;\n\t                proxy_cache_key      $host$uri$is_args$args;\n\t                proxy_cache_valid    200 301 302 30m;\n\t                expires              30m;\n\t                proxy_pass  http://nextcloud_backend;\n\t\t}\n                \n        }\n        location /.well-known/acme-challenge/ {\n                root /var/www/certbot;\n        }\n\n                \n                        \n\n        location /.well-known/carddav {\n                return 301 $scheme://$host/remote.php/dav;\n        }\n\n        location /.well-known/caldav {\n                return 301 $scheme://$host/remote.php/dav;\n        }\n\n        location = /health {\n                default_type text/html;\n                return 200 \"\u003c!DOCTYPE html\u003e\u003ch2\u003ehealth check\u003c/h2\u003e\\n\";\n        }\n\n                \n\n\n        \n        http2 on;\n        ssl_protocols TLSv1.2;\n        \n\n        listen 443 ssl;\n        ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;\n        ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;\n\n}\nserver {\n        if ($host = www.nextcloud.tryton.geeraert.eu) {\n                return 301 https://$host$request_uri;\n        }\n\n\n        if ($host = nextcloud.tryton.geeraert.eu) {\n                return 301 https://$host$request_uri;\n        }\n\n        server_name www.nextcloud.tryton.geeraert.eu nextcloud.tryton.geeraert.eu;\n        listen 80;\n        return 404;\n\n}\n",
+            "content_base64": null,
+            "content_base64sha256": "bYH6+PkvYOS+Dv+d3rimq14gkFybnmQd2GqdJCbU5Zc=",
+            "content_base64sha512": "PjQFc3QIJZSpxIkJjjPJBYPx9I2qT1VAdhZYFYhuq6rXMBFBgLLIRlynp9bPR0JU564H4sT9Gdfa0K6IhOYCbg==",
+            "content_md5": "9dceef0d6bbbd36c41c200fe5afefd1e",
+            "content_sha1": "e136bd3d9fc0b1208ac49d15eb56887d55c51a10",
+            "content_sha256": "6d81faf8f92f60e4be0eff9ddeb8a6ab5e20905c9b9e641dd86a9d2426d4e597",
+            "content_sha512": "3e34057374082594a9c489098e33c90583f1f48daa4f554076165815886eabaad730114180b2c8465ca7a7d6cf474254e7ae07e2c4fd19d7dad0ae8884e6026e",
+            "directory_permission": "0777",
+            "file_permission": "0777",
+            "filename": "../conf.d/nextcloud.tryton.geeraert.eu.conf",
+            "id": "e136bd3d9fc0b1208ac49d15eb56887d55c51a10",
+            "sensitive_content": null,
+            "source": null
+          },
+          "sensitive_attributes": [
+            [
+              {
+                "type": "get_attr",
+                "value": "sensitive_content"
+              }
+            ]
+          ]
+        },
+        {
+          "index_key": "sonarr",
+          "schema_version": 0,
+          "attributes": {
+            "content": "############################################\n#       config file for sonarr\n############################################\n\nupstream sonarr_backend {\n        server sonarr.sonarr.svc;\n        server 1.1.1.1 backup;\n    }\n\nserver {\n        server_name sonarr.tryton.geeraert.eu www.sonarr.tryton.geeraert.eu;\n        location / {\n                proxy_pass http://sonarr_backend;\n                \n        }\n        location /.well-known/acme-challenge/ {\n                root /var/www/certbot;\n        }\n\n                \n\n\n        \n\n        listen 443 ssl;\n        ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;\n        ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;\n\n}\nserver {\n        if ($host = www.sonarr.tryton.geeraert.eu) {\n                return 301 https://$host$request_uri;\n        }\n\n\n        if ($host = sonarr.tryton.geeraert.eu) {\n                return 301 https://$host$request_uri;\n        }\n\n        server_name www.sonarr.tryton.geeraert.eu sonarr.tryton.geeraert.eu;\n        listen 80;\n        return 404;\n\n}\n",
+            "content_base64": null,
+            "content_base64sha256": "cBLrCZvVQpCrpd4qrnjo9w6GH72dt9J7JCN9g45jqzw=",
+            "content_base64sha512": "YzksdZjT4t60IWwyT3rOizFUv+kU0Khikgl68M2kFw/TBsj1Tss8KPqWVJZJJlXXI3V//IAdKtGrsKNbD20n8w==",
+            "content_md5": "44ec179b2b43365181418bdcc90c8880",
+            "content_sha1": "f2a88dd0c08df07936593b7dc4fbf239d599aa99",
+            "content_sha256": "7012eb099bd54290aba5de2aae78e8f70e861fbd9db7d27b24237d838e63ab3c",
+            "content_sha512": "63392c7598d3e2deb4216c324f7ace8b3154bfe914d0a86292097af0cda4170fd306c8f54ecb3c28fa965496492655d723757ffc801d2ad1abb0a35b0f6d27f3",
+            "directory_permission": "0777",
+            "file_permission": "0777",
+            "filename": "../conf.d/sonarr.tryton.geeraert.eu.conf",
+            "id": "f2a88dd0c08df07936593b7dc4fbf239d599aa99",
+            "sensitive_content": null,
+            "source": null
+          },
+          "sensitive_attributes": [
+            [
+              {
+                "type": "get_attr",
+                "value": "sensitive_content"
+              }
+            ]
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/terraform/variables.auto.tfvars b/terraform/variables.auto.tfvars
new file mode 100644
index 0000000..78855a7
--- /dev/null
+++ b/terraform/variables.auto.tfvars
@@ -0,0 +1,61 @@
+nginx_sites = {
+        bitwarden = {
+                service       = "nginx.bitwarden.svc:8080"
+                proxy_cache = false
+                extra_value_bool = false
+                extra-value = false
+                http2_bool = true
+        }
+
+        sonarr = {
+                service  = "sonarr.servarr.svc"
+                proxy_cache = false
+                extra_value_bool = false
+                http2_bool = false
+                extra-value = <<EOT
+                EOT
+
+        }
+
+        keycloak = {
+                service  = "keycloak.keycloak.svc:8080"
+                proxy_cache = false
+                extra_value_bool = true
+                http2_bool = false
+                extra-value = <<EOT
+
+        set_real_ip_from 0.0.0.0/0;
+        real_ip_header X-Real-IP;
+        real_ip_recursive on;
+                        EOT
+
+
+
+        }
+        nextcloud = {
+                service  = "webserver.nextcloud.svc"
+                proxy_cache = true
+                extra_value_bool = true
+                http2_bool = true
+                extra-value = <<EOT
+
+
+        location /.well-known/carddav {
+                return 301 $scheme://$host/remote.php/dav;
+        }
+
+        location /.well-known/caldav {
+                return 301 $scheme://$host/remote.php/dav;
+        }
+
+        location = /health {
+                default_type text/html;
+                return 200 "<!DOCTYPE html><h2>health check</h2>\n";
+        }
+                        EOT
+
+
+
+        }
+
+}