diff --git a/external_manifests/servarr/gluetun-secret-netherland.yaml b/external_manifests/servarr/gluetun-secret-netherland.yaml new file mode 100644 index 0000000..f3a93d5 --- /dev/null +++ b/external_manifests/servarr/gluetun-secret-netherland.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +data: + VPN_DNS_IP: MTAuMi4wLjE= + VPN_ENDPOINT_IP: MjEyLjguMjUzLjEzNw== + VPN_ENDPOINT_PORT: NTE4MjA= + WIREGUARD_PRIVATE_KEY: Y0grY0hLd3FMeXV3UlVlZy8wRjFYWVlDQVM4bkQwWGsxNmVOQlVLc2tYbz0= + WIREGUARD_PUBLIC_KEY: VVJwZVp4dHlVWEFVVUEwTVdjRmRDU2E3RitNdmNoSjRlTlNKVWV0S0VHaz0= +kind: Secret +metadata: + creationTimestamp: null + name: gluetun-secret-netherland + namespace: tservarr diff --git a/module.tf b/module.tf index cbb4454..3024112 100644 --- a/module.tf +++ b/module.tf @@ -33,7 +33,7 @@ variable "kubernetes" { replicas = optional(number, 1) namespace = optional(string) connected_namespace = optional(string, "") -# namespace = optional(string,coalesce(connected_namespace,"")) + # namespace = optional(string,coalesce(connected_namespace,"")) #block_namespace_creation = optional(bool, false) service_port = optional(number) service_type = optional(string, "ClusterIP") @@ -54,7 +54,9 @@ variable "kubernetes" { # requests-cpu = "200m" # requests-memory = "200Mi" # }) + dns_nameservers = optional(string) environment_variables = optional(map(string), { name = "value" }) + security_context = optional(bool, false) })) } @@ -69,7 +71,7 @@ locals { pvc_size = pvc.pvc_size mount_path = pvc.mount_path storage_class_name = pvc.storage_class_name - namespace = coalesce(value.namespace,value.connected_namespace, key) + namespace = coalesce(value.namespace, value.connected_namespace, key) }] if value.enabled == true && value.pvc != null ]) } @@ -147,7 +149,7 @@ resource "kubernetes_persistent_volume_claim" "automatic-pvc" { resource "kubernetes_persistent_volume_claim" "automatic-pvc-database" { for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } metadata { - namespace = coalesce(each.value.namespace,each.value.connected_namespace, each.key) + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) name = "${each.key}-db-pvc" labels = { deployment_method = "Terraform" @@ -167,7 +169,7 @@ resource "kubernetes_persistent_volume_claim" "automatic-pvc-database" { resource "kubernetes_persistent_volume_claim" "automatic-pvc-redis" { for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true } metadata { - namespace = coalesce(each.value.namespace,each.value.connected_namespace, each.key) + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) name = "${each.key}-redis-pvc" labels = { deployment_method = "Terraform" @@ -188,7 +190,7 @@ resource "kubernetes_service" "automatic_service" { for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true } metadata { name = "${each.key}-svc" - namespace = coalesce(each.value.namespace,each.value.connected_namespace, each.key) + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) labels = { deployment_method = "Terraform" } @@ -219,7 +221,7 @@ resource "kubernetes_service" "automatic_service_database" { for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } metadata { name = "${each.key}-db-svc" - namespace = coalesce(each.value.namespace,each.value.connected_namespace, each.key) + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) labels = { deployment_method = "Terraform" } @@ -244,7 +246,7 @@ resource "kubernetes_service" "automatic_service_redis" { for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true } metadata { name = "${each.key}-redis-svc" - namespace = coalesce(each.value.namespace,each.value.connected_namespace, each.key) + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) labels = { deployment_method = "Terraform" } @@ -265,7 +267,7 @@ resource "kubernetes_service" "automatic_service_redis" { resource "kubernetes_deployment_v1" "automatic" { for_each = { for key, value in var.kubernetes : key => value if value.enabled == true } metadata { - namespace = coalesce(each.value.namespace,each.value.connected_namespace, each.key) + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) name = coalesce(each.value.name, each.key) labels = { @@ -384,6 +386,15 @@ resource "kubernetes_deployment_v1" "automatic" { # } # } + dynamic "security_context" { + for_each = each.value.security_context == true ? [1] : [] + content { + privileged = true + #capabilities = { + # add : ["NET_ADMIN", "NET_RAW"] + #} + } + } dynamic "liveness_probe" { for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : [] content { @@ -394,7 +405,6 @@ resource "kubernetes_deployment_v1" "automatic" { } } - dynamic "http_get" { for_each = each.value.liveness_http_get != null ? [""] : [] content { @@ -408,7 +418,13 @@ resource "kubernetes_deployment_v1" "automatic" { } } } + dynamic "dns_config" { + for_each = each.value.dns_nameservers != null ? [1] : [] + content { + nameservers = [each.value.dns_nameservers] + } + } dynamic "volume" { for_each = each.value.pvc != null ? each.value.pvc : {} @@ -452,7 +468,7 @@ resource "kubernetes_deployment_v1" "database-automatic" { metadata { - namespace = coalesce(each.value.namespace,each.value.connected_namespace, each.key) + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) name = "${coalesce(each.value.namespace, each.key)}-db" labels = { app = each.key @@ -577,7 +593,7 @@ resource "kubernetes_deployment_v1" "redis-automatic" { metadata { - namespace = coalesce(each.value.namespace,each.value.connected_namespace, each.key) + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) name = "${coalesce(each.value.namespace, each.key)}-redis" labels = { app = each.key diff --git a/variables.auto.tfvars b/variables.auto.tfvars index f3c9968..cfb3594 100644 --- a/variables.auto.tfvars +++ b/variables.auto.tfvars @@ -358,10 +358,10 @@ kubernetes = { redis = { image = "docker.io/library/redis:7" } requirements = { - limits-cpu = "800Mi" + limits-cpu = "800m" limits-memory = "800Mi" - requests-cpu = "800Mi" - requests-memory = "800Mi" + requests-cpu = "10m" + requests-memory = "300Mi" } extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/paperless/Paperless.secret.yaml"] #config_map_ref = ["config"] @@ -395,13 +395,13 @@ kubernetes = { value = "https://paper.tryton.geeraert.eu" } PAPERLESS_TIKA_ENABLED = { - value = "1" + value = "0" } PAPERLESS_TIKA_GOTENBERG_ENDPOINT = { - value = "http://gotenberg-svc.gotenberg.svc:3000" + value = "http://gotenberg-svc.paper.svc:3000" } PAPERLESS_TIKA_ENDPOINT = { - value = "http://tika-svc.tika.svc:9998" + value = "http://tika-svc.paper.svc:9998" } @@ -453,12 +453,12 @@ kubernetes = { pvc_size = "2Mi" mount_path = "/usr/src/paperless/data" } - export = { - host_path = "/tmp" - name = "export" - pvc_size = "2Mi" - mount_path = "/usr/src/paperless/export" - } + # export = { + # host_path = "/tmp" + # name = "export" + # pvc_size = "2Mi" + # mount_path = "/usr/src/paperless/export" + # } consume = { pvc = true name = "consume" @@ -468,12 +468,11 @@ kubernetes = { } } gotenberg = { - enabled = false - name = "gotenberg" - namespace = "paper" - block_namespace_creation = true - image = "gotenberg/gotenberg:7.9.2" - service_port = 3000 + enabled = false + name = "gotenberg" + connected_namespace = "paper" + image = "gotenberg/gotenberg:7.9.2" + service_port = 3000 requirements = { limits-cpu = "100m" @@ -485,10 +484,11 @@ kubernetes = { } tika = { - enabled = false - name = "tika" - image = "ghcr.io/paperless-ngx/tika" - service_port = 9998 + enabled = false + name = "tika" + connected_namespace = "paper" + image = "ghcr.io/paperless-ngx/tika" + service_port = 9998 requirements = { limits-cpu = "100m" @@ -735,10 +735,10 @@ kubernetes = { } pinchflat = { -# enabled = false - connected_namespace = "screeps" - image = "ghcr.io/kieraneglin/pinchflat:latest" - service_port = 8945 + enabled = false + connected_namespace = "screeps" + image = "ghcr.io/kieraneglin/pinchflat:latest" + service_port = 8945 pvc = { pinchflat-config = { @@ -763,10 +763,10 @@ kubernetes = { } jobspy = { - enabled = false + enabled = false connected_namespace = "stash" - image = "rainmanjam/jobspy-api:latest" - service_port = 8000 + image = "rainmanjam/jobspy-api:latest" + service_port = 8000 environment = { ENABLE_API_KEY_AUTH = { value = "true" @@ -784,4 +784,149 @@ kubernetes = { } + gluetun = { + enabled = false + namespace = "tservarr" + dns_nameservers = "10.2.0.1" + replicas = 01 + image = "qmcgaw/gluetun:latest" + service_port = 8888 + extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/servarr/gluetun-secret-netherland.yaml"] + security_context = true + # requirements = { + # limits-cpu = "800Mi" + # limits-memory = "800Mi" + # requests-cpu = "800Mi" + # requests-memory = "800Mi" + # } + environment = { + DNS_ADDRESS = { + value_from = { + secret_key_ref = { + name = "gluetun-secret-netherland" + key = "VPN_DNS_IP" + } + } + } + WIREGUARD_ENDPOINT_IP = { + value_from = { + secret_key_ref = { + name = "gluetun-secret-netherland" + key = "VPN_ENDPOINT_IP" + } + } + } + WIREGUARD_ENDPOINT_PORT = { + value_from = { + secret_key_ref = { + name = "gluetun-secret-netherland" + key = "VPN_ENDPOINT_PORT" + } + } + } + WIREGUARD_PRIVATE_KEY = { + value_from = { + secret_key_ref = { + name = "gluetun-secret-netherland" + key = "WIREGUARD_PRIVATE_KEY" + } + } + } + WIREGUARD_PUBLIC_KEY = { + value_from = { + secret_key_ref = { + name = "gluetun-secret-netherland" + key = "WIREGUARD_PUBLIC_KEY" + } + } + } + # SHADOWSOCKS = { + HTTPPROXY = { + value = "on" + } + #SHADOWSOCKS_LOG = { + HTTPPROXY_LOG = { + value = "on" + } + HTTPPROXY_LISTENING_ADDRESS = { + #SHADOWSOCKS_LISTENING_ADDRESS = { + value = "0.0.0.0:8888" + } + # HTTPPROXY_USER = { + # value = "user" + # } + + #SHADOWSOCKS_PASSWORD = { + # HTTPPROXY_PASSWORD = { + # value = "user" + #} + DNS_KEEP_NAMESERVER = { + value = "off" + } + VPN_SERVICE_PROVIDER = { + value = "custom" + } + VPN_TYPE = { + value = "wireguard" + } + WIREGUARD_ADDRESSES = { + value = "10.2.0.2/32" + } + FIREWALL_INPUT_PORTS = { + value = "8081,7878,9696,9091,51413,8080,6881,8989,8191,8888,8000" + } + PUBLICIP_API = { + value = "ip2location" + } + + HEALTH_TARGET_ADDRESS = { + value = "protonvpn.com" + } + + } + + } + + prowlarr = { + enabled = false + image = "linuxserver/prowlarr:latest" + connected_namespace = "tservarr" + # dns_nameservers = "10.2.0.1" + service_port = 9696 + + environment = { + PUID = { + value = "1000" + } + PGID = { + value = "1000" + } + TZ = { + value = "Etc/UTC" + } + } + # requirements = { + # limits-cpu = "1000m" + # limits-memory = "1Gi" + # requests-cpu = "500m" + # requests-memory = "400Mi" + # } + pvc = { + prowlarr-config = { + name = "prowlarr-config" + pvc_size = "10Mi" + pvc = true + mount_path = "/config" + } + servarr-data = { + name = "servarr-data" + pvc_size = "10Mi" + pvc = false + host_path = "/data" + mount_path = "/disk" + } + } + + } + }