147 lines
4.1 KiB
Terraform
147 lines
4.1 KiB
Terraform
terraform {
|
|
required_version = "> 0.8.0"
|
|
backend "http" {
|
|
address = "https://gitea.geeraert.eu/api/packages/pi-ux-ce/terraform/state/reverse-proxy"
|
|
lock_address = "https://gitea.geeraert.eu/api/packages/pi-ux-ce/terraform/state/reverse-proxy/lock"
|
|
unlock_address = "https://gitea.geeraert.eu/api/packages/pi-ux-ce/terraform/state/reverse-proxy/lock"
|
|
lock_method = "POST"
|
|
unlock_method = "DELETE"
|
|
username = "pierre@geeraert.eu"
|
|
password = "a624d4613a6d35f6093eb5f3d12492c6a7676354"
|
|
}
|
|
}
|
|
|
|
variable "nginx_sites" {
|
|
type = map(object({
|
|
service = string
|
|
enabled = optional(bool, true)
|
|
proxy_cache = optional(bool, false)
|
|
extra-value = optional(string, "")
|
|
extra-value-location = optional(string, "")
|
|
http2_bool = optional(bool, false)
|
|
proxy_pass_https = optional(bool, false)
|
|
authentication_required = optional(bool, false)
|
|
redirect_to_https_bool = optional(bool, true)
|
|
listen_port_80_bool = optional(bool, false)
|
|
geoip_blocking = optional(bool, false)
|
|
geoip_allow = optional(list(string), ["FR", "GB"])
|
|
redirect_to_root_domain = optional(bool, true)
|
|
}))
|
|
|
|
}
|
|
variable "deny_ip" {
|
|
type = list(string)
|
|
}
|
|
|
|
locals {
|
|
geoip_allow_list = distinct(flatten([
|
|
for key, value in var.nginx_sites : [{
|
|
name = join("_", sort(value.geoip_allow))
|
|
country_list = sort(value.geoip_allow)
|
|
}] if value.enabled == true && value.geoip_allow != null
|
|
]))
|
|
|
|
geoip_allow_list_test = distinct([
|
|
for key, value in var.nginx_sites : [{
|
|
value = sort(value.geoip_allow)
|
|
}] if value.enabled == true && value.geoip_allow != null
|
|
])
|
|
|
|
}
|
|
|
|
|
|
resource "kubernetes_config_map" "deny_ip_configmap" {
|
|
metadata {
|
|
name = "deny-ip-terraform"
|
|
namespace = "reverse-proxy"
|
|
annotations = {
|
|
"reloader.stakater.com/match" : "true",
|
|
}
|
|
}
|
|
|
|
data = {
|
|
"deny.conf" = templatefile("deny_ip.json.tftpl", {
|
|
deny_ip = var.deny_ip })
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_config_map" "websites_configmap" {
|
|
metadata {
|
|
name = "sites-terraform"
|
|
namespace = "netdata"
|
|
}
|
|
|
|
data = {
|
|
"websites.json" = templatefile("httpcheck.yaml.tftpl", {
|
|
map_of_params = var.nginx_sites })
|
|
}
|
|
}
|
|
|
|
|
|
resource "kubernetes_config_map" "automatic-configmap" {
|
|
metadata {
|
|
name = "sites-terraform"
|
|
namespace = "reverse-proxy"
|
|
annotations = {
|
|
"reloader.stakater.com/match" : "true",
|
|
}
|
|
}
|
|
|
|
data = {
|
|
for key, value in var.nginx_sites :
|
|
"${key}.conf" => templatefile("nginx_config.tftpl", {
|
|
name_site = key
|
|
name_service = value.service
|
|
proxy_cache = value.proxy_cache
|
|
extra-value = value.extra-value
|
|
extra-value-location = value.extra-value-location
|
|
http2_bool = value.http2_bool
|
|
proxy_pass_https = value.proxy_pass_https
|
|
authentication_required = value.authentication_required
|
|
redirect_to_https_bool = value.redirect_to_https_bool
|
|
listen_port_80_bool = value.listen_port_80_bool
|
|
geoip_blocking = value.geoip_blocking
|
|
geoip_allow = value.geoip_allow
|
|
redirect_to_root_domain = value.redirect_to_root_domain
|
|
}) if value.enabled == true
|
|
}
|
|
|
|
}
|
|
|
|
resource "kubernetes_config_map" "automatic-geoip-allow" {
|
|
metadata {
|
|
name = "geoip-allow"
|
|
namespace = "reverse-proxy"
|
|
annotations = {
|
|
"reloader.stakater.com/match" : "true",
|
|
}
|
|
}
|
|
|
|
data = {
|
|
for key, value in local.geoip_allow_list :
|
|
"${value.name}.conf" => templatefile("geoip.conf.tftpl", {
|
|
name = value.name
|
|
allowed_country_list = value.country_list
|
|
})
|
|
}
|
|
}
|
|
|
|
|
|
|
|
#resource "null_resource" "cluster" {
|
|
# provisioner "local-exec" {
|
|
# command = "kubectl get pods -n reverse-proxy -o name | xargs -I{} kubectl delete -n reverse-proxy {}"
|
|
# }
|
|
#}
|
|
|
|
#https://github.com/stakater/Reloader
|
|
|
|
|
|
output "Nginx_status" {
|
|
value = "Nginx pod restarted"
|
|
}
|
|
provider "kubernetes" {
|
|
config_path = "~/.kube/config"
|
|
}
|
|
|