pi-ux-ce/Terraform_kube
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

find a way to add gluetun as proxy instead as a sidecar container

Browse Source
This commit is contained in:
pi-ux-ce
2025-05-08 00:28:18 +01:00
parent b094e78620
commit 0327588463
3 changed files with 213 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
external_manifests/servarr/gluetun-secret-netherland.yaml
+12
View File
@@ -0,0 +1,12 @@
apiVersion: v1
data:
VPN_DNS_IP: MTAuMi4wLjE=
VPN_ENDPOINT_IP: MjEyLjguMjUzLjEzNw==
VPN_ENDPOINT_PORT: NTE4MjA=
WIREGUARD_PRIVATE_KEY: Y0grY0hLd3FMeXV3UlVlZy8wRjFYWVlDQVM4bkQwWGsxNmVOQlVLc2tYbz0=
WIREGUARD_PUBLIC_KEY: VVJwZVp4dHlVWEFVVUEwTVdjRmRDU2E3RitNdmNoSjRlTlNKVWV0S0VHaz0=
kind: Secret
metadata:
creationTimestamp: null
name: gluetun-secret-netherland
namespace: tservarr
module.tf
+27 -11
View File
@@ -33,7 +33,7 @@ variable "kubernetes" {
replicas = optional(number, 1) replicas = optional(number, 1)
namespace = optional(string) namespace = optional(string)
connected_namespace = optional(string, "") connected_namespace = optional(string, "")
# namespace = optional(string,coalesce(connected_namespace,"")) # namespace = optional(string,coalesce(connected_namespace,""))
#block_namespace_creation = optional(bool, false) #block_namespace_creation = optional(bool, false)
service_port = optional(number) service_port = optional(number)
service_type = optional(string, "ClusterIP") service_type = optional(string, "ClusterIP")
@@ -54,7 +54,9 @@ variable "kubernetes" {
# requests-cpu = "200m" # requests-cpu = "200m"
# requests-memory = "200Mi" # requests-memory = "200Mi"
# }) # })
dns_nameservers = optional(string)
environment_variables = optional(map(string), { name = "value" }) environment_variables = optional(map(string), { name = "value" })
security_context = optional(bool, false)
})) }))
} }
@@ -69,7 +71,7 @@ locals {
pvc_size = pvc.pvc_size pvc_size = pvc.pvc_size
mount_path = pvc.mount_path mount_path = pvc.mount_path
storage_class_name = pvc.storage_class_name storage_class_name = pvc.storage_class_name
namespace = coalesce(value.namespace,value.connected_namespace, key) namespace = coalesce(value.namespace, value.connected_namespace, key)
}] if value.enabled == true && value.pvc != null }] if value.enabled == true && value.pvc != null
]) ])
} }
@@ -147,7 +149,7 @@ resource "kubernetes_persistent_volume_claim" "automatic-pvc" {
resource "kubernetes_persistent_volume_claim" "automatic-pvc-database" { resource "kubernetes_persistent_volume_claim" "automatic-pvc-database" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
metadata { metadata {
namespace = coalesce(each.value.namespace,each.value.connected_namespace, each.key) namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${each.key}-db-pvc" name = "${each.key}-db-pvc"
labels = { labels = {
deployment_method = "Terraform" deployment_method = "Terraform"
@@ -167,7 +169,7 @@ resource "kubernetes_persistent_volume_claim" "automatic-pvc-database" {
resource "kubernetes_persistent_volume_claim" "automatic-pvc-redis" { resource "kubernetes_persistent_volume_claim" "automatic-pvc-redis" {
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true } for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
metadata { metadata {
namespace = coalesce(each.value.namespace,each.value.connected_namespace, each.key) namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${each.key}-redis-pvc" name = "${each.key}-redis-pvc"
labels = { labels = {
deployment_method = "Terraform" deployment_method = "Terraform"
@@ -188,7 +190,7 @@ resource "kubernetes_service" "automatic_service" {
for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true } for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true }
metadata { metadata {
name = "${each.key}-svc" name = "${each.key}-svc"
namespace = coalesce(each.value.namespace,each.value.connected_namespace, each.key) namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
labels = { labels = {
deployment_method = "Terraform" deployment_method = "Terraform"
} }
@@ -219,7 +221,7 @@ resource "kubernetes_service" "automatic_service_database" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
metadata { metadata {
name = "${each.key}-db-svc" name = "${each.key}-db-svc"
namespace = coalesce(each.value.namespace,each.value.connected_namespace, each.key) namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
labels = { labels = {
deployment_method = "Terraform" deployment_method = "Terraform"
} }
@@ -244,7 +246,7 @@ resource "kubernetes_service" "automatic_service_redis" {
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true } for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
metadata { metadata {
name = "${each.key}-redis-svc" name = "${each.key}-redis-svc"
namespace = coalesce(each.value.namespace,each.value.connected_namespace, each.key) namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
labels = { labels = {
deployment_method = "Terraform" deployment_method = "Terraform"
} }
@@ -265,7 +267,7 @@ resource "kubernetes_service" "automatic_service_redis" {
resource "kubernetes_deployment_v1" "automatic" { resource "kubernetes_deployment_v1" "automatic" {
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true } for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
metadata { metadata {
namespace = coalesce(each.value.namespace,each.value.connected_namespace, each.key) namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = coalesce(each.value.name, each.key) name = coalesce(each.value.name, each.key)
labels = { labels = {
@@ -384,6 +386,15 @@ resource "kubernetes_deployment_v1" "automatic" {
# } # }
# } # }
dynamic "security_context" {
for_each = each.value.security_context == true ? [1] : []
content {
privileged = true
#capabilities = {
# add : ["NET_ADMIN", "NET_RAW"]
#}
}
}
dynamic "liveness_probe" { dynamic "liveness_probe" {
for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : [] for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
content { content {
@@ -394,7 +405,6 @@ resource "kubernetes_deployment_v1" "automatic" {
} }
} }
dynamic "http_get" { dynamic "http_get" {
for_each = each.value.liveness_http_get != null ? [""] : [] for_each = each.value.liveness_http_get != null ? [""] : []
content { content {
@@ -408,7 +418,13 @@ resource "kubernetes_deployment_v1" "automatic" {
} }
} }
} }
dynamic "dns_config" {
for_each = each.value.dns_nameservers != null ? [1] : []
content {
nameservers = [each.value.dns_nameservers]
}
}
dynamic "volume" { dynamic "volume" {
for_each = each.value.pvc != null ? each.value.pvc : {} for_each = each.value.pvc != null ? each.value.pvc : {}
@@ -452,7 +468,7 @@ resource "kubernetes_deployment_v1" "database-automatic" {
metadata { metadata {
namespace = coalesce(each.value.namespace,each.value.connected_namespace, each.key) namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${coalesce(each.value.namespace, each.key)}-db" name = "${coalesce(each.value.namespace, each.key)}-db"
labels = { labels = {
app = each.key app = each.key
@@ -577,7 +593,7 @@ resource "kubernetes_deployment_v1" "redis-automatic" {
metadata { metadata {
namespace = coalesce(each.value.namespace,each.value.connected_namespace, each.key) namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${coalesce(each.value.namespace, each.key)}-redis" name = "${coalesce(each.value.namespace, each.key)}-redis"
labels = { labels = {
app = each.key app = each.key
variables.auto.tfvars
+174 -29
View File
@@ -358,10 +358,10 @@ kubernetes = {
redis = { redis = {
image = "docker.io/library/redis:7" } image = "docker.io/library/redis:7" }
requirements = { requirements = {
limits-cpu = "800Mi" limits-cpu = "800m"
limits-memory = "800Mi" limits-memory = "800Mi"
requests-cpu = "800Mi" requests-cpu = "10m"
requests-memory = "800Mi" requests-memory = "300Mi"
} }
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/paperless/Paperless.secret.yaml"] extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/paperless/Paperless.secret.yaml"]
#config_map_ref = ["config"] #config_map_ref = ["config"]
@@ -395,13 +395,13 @@ kubernetes = {
value = "https://paper.tryton.geeraert.eu" value = "https://paper.tryton.geeraert.eu"
} }
PAPERLESS_TIKA_ENABLED = { PAPERLESS_TIKA_ENABLED = {
value = "1" value = "0"
} }
PAPERLESS_TIKA_GOTENBERG_ENDPOINT = { PAPERLESS_TIKA_GOTENBERG_ENDPOINT = {
value = "http://gotenberg-svc.gotenberg.svc:3000" value = "http://gotenberg-svc.paper.svc:3000"
} }
PAPERLESS_TIKA_ENDPOINT = { PAPERLESS_TIKA_ENDPOINT = {
value = "http://tika-svc.tika.svc:9998" value = "http://tika-svc.paper.svc:9998"
} }
@@ -453,12 +453,12 @@ kubernetes = {
pvc_size = "2Mi" pvc_size = "2Mi"
mount_path = "/usr/src/paperless/data" mount_path = "/usr/src/paperless/data"
} }
export = { # export = {
host_path = "/tmp" # host_path = "/tmp"
name = "export" # name = "export"
pvc_size = "2Mi" # pvc_size = "2Mi"
mount_path = "/usr/src/paperless/export" # mount_path = "/usr/src/paperless/export"
} # }
consume = { consume = {
pvc = true pvc = true
name = "consume" name = "consume"
@@ -468,12 +468,11 @@ kubernetes = {
} }
} }
gotenberg = { gotenberg = {
enabled = false enabled = false
name = "gotenberg" name = "gotenberg"
namespace = "paper" connected_namespace = "paper"
block_namespace_creation = true image = "gotenberg/gotenberg:7.9.2"
image = "gotenberg/gotenberg:7.9.2" service_port = 3000
service_port = 3000
requirements = { requirements = {
limits-cpu = "100m" limits-cpu = "100m"
@@ -485,10 +484,11 @@ kubernetes = {
} }
tika = { tika = {
enabled = false enabled = false
name = "tika" name = "tika"
image = "ghcr.io/paperless-ngx/tika" connected_namespace = "paper"
service_port = 9998 image = "ghcr.io/paperless-ngx/tika"
service_port = 9998
requirements = { requirements = {
limits-cpu = "100m" limits-cpu = "100m"
@@ -735,10 +735,10 @@ kubernetes = {
} }
pinchflat = { pinchflat = {
# enabled = false enabled = false
connected_namespace = "screeps" connected_namespace = "screeps"
image = "ghcr.io/kieraneglin/pinchflat:latest" image = "ghcr.io/kieraneglin/pinchflat:latest"
service_port = 8945 service_port = 8945
pvc = { pvc = {
pinchflat-config = { pinchflat-config = {
@@ -763,10 +763,10 @@ kubernetes = {
} }
jobspy = { jobspy = {
enabled = false enabled = false
connected_namespace = "stash" connected_namespace = "stash"
image = "rainmanjam/jobspy-api:latest" image = "rainmanjam/jobspy-api:latest"
service_port = 8000 service_port = 8000
environment = { environment = {
ENABLE_API_KEY_AUTH = { ENABLE_API_KEY_AUTH = {
value = "true" value = "true"
@@ -784,4 +784,149 @@ kubernetes = {
} }
gluetun = {
enabled = false
namespace = "tservarr"
dns_nameservers = "10.2.0.1"
replicas = 01
image = "qmcgaw/gluetun:latest"
service_port = 8888
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/servarr/gluetun-secret-netherland.yaml"]
security_context = true
# requirements = {
# limits-cpu = "800Mi"
# limits-memory = "800Mi"
# requests-cpu = "800Mi"
# requests-memory = "800Mi"
# }
environment = {
DNS_ADDRESS = {
value_from = {
secret_key_ref = {
name = "gluetun-secret-netherland"
key = "VPN_DNS_IP"
}
}
}
WIREGUARD_ENDPOINT_IP = {
value_from = {
secret_key_ref = {
name = "gluetun-secret-netherland"
key = "VPN_ENDPOINT_IP"
}
}
}
WIREGUARD_ENDPOINT_PORT = {
value_from = {
secret_key_ref = {
name = "gluetun-secret-netherland"
key = "VPN_ENDPOINT_PORT"
}
}
}
WIREGUARD_PRIVATE_KEY = {
value_from = {
secret_key_ref = {
name = "gluetun-secret-netherland"
key = "WIREGUARD_PRIVATE_KEY"
}
}
}
WIREGUARD_PUBLIC_KEY = {
value_from = {
secret_key_ref = {
name = "gluetun-secret-netherland"
key = "WIREGUARD_PUBLIC_KEY"
}
}
}
# SHADOWSOCKS = {
HTTPPROXY = {
value = "on"
}
#SHADOWSOCKS_LOG = {
HTTPPROXY_LOG = {
value = "on"
}
HTTPPROXY_LISTENING_ADDRESS = {
#SHADOWSOCKS_LISTENING_ADDRESS = {
value = "0.0.0.0:8888"
}
# HTTPPROXY_USER = {
# value = "user"
# }
#SHADOWSOCKS_PASSWORD = {
# HTTPPROXY_PASSWORD = {
# value = "user"
#}
DNS_KEEP_NAMESERVER = {
value = "off"
}
VPN_SERVICE_PROVIDER = {
value = "custom"
}
VPN_TYPE = {
value = "wireguard"
}
WIREGUARD_ADDRESSES = {
value = "10.2.0.2/32"
}
FIREWALL_INPUT_PORTS = {
value = "8081,7878,9696,9091,51413,8080,6881,8989,8191,8888,8000"
}
PUBLICIP_API = {
value = "ip2location"
}
HEALTH_TARGET_ADDRESS = {
value = "protonvpn.com"
}
}
}
prowlarr = {
enabled = false
image = "linuxserver/prowlarr:latest"
connected_namespace = "tservarr"
# dns_nameservers = "10.2.0.1"
service_port = 9696
environment = {
PUID = {
value = "1000"
}
PGID = {
value = "1000"
}
TZ = {
value = "Etc/UTC"
}
}
# requirements = {
# limits-cpu = "1000m"
# limits-memory = "1Gi"
# requests-cpu = "500m"
# requests-memory = "400Mi"
# }
pvc = {
prowlarr-config = {
name = "prowlarr-config"
pvc_size = "10Mi"
pvc = true
mount_path = "/config"
}
servarr-data = {
name = "servarr-data"
pvc_size = "10Mi"
pvc = false
host_path = "/data"
mount_path = "/disk"
}
}
}
} }