cleanup

core/testing_new_storage.yaml

@@ -1,33 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nginx-deployment
-  labels:
-    app: nginx
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      app: nginx
-  template:
-    metadata:
-      labels:
-        app: nginx
-    spec:
-      containers:
-        - name: nginx
-          image: nginx:1.14.2
-          ports:
-            - containerPort: 80
-          
-          
-          volumeMounts:
-            - name: data
-              mountPath: /hello
-
-      volumes:
-        - name: data
-          hostPath:
-            path: /data/kubernetes/degoog/degoog-data-pvc
-            type: DirectoryOrCreate
-

infrastructure/.tool-versions

@@ -0,0 +1 @@
+terraform 1.16.5

infrastructure/deployment.tf

@@ -40,6 +40,83 @@ resource "kubernetes_service_v1" "automatic_service" {
 
 }
 
+resource "kubernetes_ingress_v1" "automatic_ingress" {
+  for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true && value.docker != true && value.exposed == true }
+  metadata {
+    name      = "${each.key}-ingress"
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
+
+    annotations = {
+      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
+      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
+    }
+  }
+
+  spec {
+    ingress_class_name = "traefik"
+    # Dynamic TLS configuration for cert-manager
+    tls {
+      hosts       = [join(".", [coalesce(each.value.domain_name, each.key), "geeraert.eu"])]
+      secret_name = "${each.key}-tls-secret" # cert-manager will create and manage this secret automatically
+    }
+
+    rule {
+      host = join(".", [coalesce(each.value.domain_name, each.key), "geeraert.eu"])
+      http {
+        path {
+          path = "/"
+          backend {
+            service {
+              name = "${each.key}-svc"
+              port {
+                number = each.value.service_port[0] #selecting the first of the list
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+resource "kubernetes_ingress_v1" "automatic_ingress_legacy" {
+  for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true && value.docker != true && value.exposed == true && value.legacy_domain == true }
+  metadata {
+    name      = "${each.key}-ingress-legacy"
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
+
+    annotations = {
+      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
+      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
+    }
+  }
+
+  spec {
+    ingress_class_name = "traefik"
+    # Dynamic TLS configuration for cert-manager
+    tls {
+      hosts       = [join(".", [coalesce(each.value.domain_name, each.key), "tryton.geeraert.eu"])]
+      secret_name = "${each.key}-tryton-tls-secret" # cert-manager will create and manage this secret automatically
+    }
+
+    rule {
+      host = join(".", [coalesce(each.value.domain_name, each.key), "tryton.geeraert.eu"])
+      http {
+        path {
+          path = "/"
+          backend {
+            service {
+              name = "${each.key}-svc"
+              port {
+                number = each.value.service_port[0] #selecting the first of the list
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
 
 resource "kubernetes_deployment_v1" "automatic" {
   for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }

infrastructure/module.tf

@@ -24,6 +24,7 @@ provider "bitwarden-secrets" {
 variable "kubernetes" {
   type = map(object({
     name  = optional(string)
+    docker = optional(bool)
     image = string
     pvc = optional(map(object({
       name                 = optional(string)
@@ -56,6 +57,8 @@ variable "kubernetes" {
     service_type           = optional(string, "ClusterIP")
     service_name           = optional(string)
     domain_name            = optional(string)
+    legacy_domain          = optional(bool, false)
+    exposed                = optional(bool, true)
     liveness_tcp_socket    = optional(number)
     liveness_http_get      = optional(string)
     liveness_http_get_path = optional(string)

reverse-proxy/module.tf

@@ -1,83 +0,0 @@
-terraform {
-  required_version = "> 0.8.0"
-}
-
-provider "kubernetes" {
-  config_path = "~/.kube/config"
-}
-
-variable "shunt_kubernetes" {
-  type    = bool
-  default = true
-}
-
-variable "nginx_sites" {
-  type = map(object({
-    service                 = string
-    docker_service          = optional(string)
-    enabled                 = optional(bool, true)
-    proxy_cache             = optional(bool, false)
-    extra-value             = optional(string, "")
-    extra-value-location    = optional(string, "")
-    http2_bool              = optional(bool, false)
-    proxy_pass_https        = optional(bool, false)
-    authentication_required = optional(bool, false)
-    redirect_to_https_bool  = optional(bool, true)
-    listen_port_80_bool     = optional(bool, false)
-    geoip_blocking          = optional(bool, false)
-    geoip_allow             = optional(list(string), ["FR", "GB"])
-    redirect_to_root_domain = optional(bool, true)
-  }))
-
-}
-
-resource "kubernetes_config_map" "automatic-configmap" {
-  #avoiding this to create if the shunt_kubernetes is on 
-  count = var.shunt_kubernetes ? 0 : 1
-  metadata {
-    name      = "sites-terraform"
-    namespace = "reverse-proxy"
-    annotations = {
-      "reloader.stakater.com/match" : "true",
-    }
-  }
-
-  data = {
-    for key, value in var.nginx_sites :
-    "${key}.conf" => templatefile("nginx_config.tftpl", {
-      name_site               = key
-      name_service            = value.service
-      proxy_cache             = value.proxy_cache
-      extra-value             = value.extra-value
-      extra-value-location    = value.extra-value-location
-      http2_bool              = value.http2_bool
-      proxy_pass_https        = value.proxy_pass_https
-      authentication_required = value.authentication_required
-      redirect_to_https_bool  = value.redirect_to_https_bool
-      listen_port_80_bool     = value.listen_port_80_bool
-      geoip_blocking          = value.geoip_blocking
-      geoip_allow             = value.geoip_allow
-      redirect_to_root_domain = value.redirect_to_root_domain
-    }) if value.enabled == true
-  }
-
-}
-
-resource "local_file" "nginx_configs" {
-  for_each = { for key, value in var.nginx_sites : key => value if value.enabled == true && value.docker_service != null }
-
-  filename = "/data/kubernetes/reverse-proxy/reverse-proxy-sites/${each.key}.conf"
-  content = templatefile("nginx_config.tftpl", {
-    name_site               = each.key
-    name_service            = each.value.docker_service
-    proxy_cache             = each.value.proxy_cache
-    extra-value             = each.value.extra-value
-    extra-value-location    = each.value.extra-value-location
-    http2_bool              = each.value.http2_bool
-    proxy_pass_https        = each.value.proxy_pass_https
-    authentication_required = each.value.authentication_required
-    redirect_to_https_bool  = each.value.redirect_to_https_bool
-    listen_port_80_bool     = each.value.listen_port_80_bool
-    redirect_to_root_domain = each.value.redirect_to_root_domain
-  })
-}

reverse-proxy/nginx_config.tftpl

@@ -1,144 +0,0 @@
-############################################
-#       config file for ${name_site}
-############################################
-
-upstream ${name_site}_backend {
-        server ${name_service};
-        server 1.1.1.1 backup;
-    }
-
-
-server {
-        server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
-
-
-%{~ if redirect_to_root_domain~}
-        if ($host = www.${name_site}.tryton.geeraert.eu) {
-                return 301 https://${name_site}.geeraert.eu$request_uri;
-        }
-
-
-        if ($host = ${name_site}.tryton.geeraert.eu) {
-                return 301 https://${name_site}.geeraert.eu$request_uri;
-        }
-
-        %{~ endif ~}
-	%{ if redirect_to_root_domain != true }
-
-        location / {
-                proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
-                proxy_set_header    Upgrade     $http_upgrade;
-		proxy_set_header Host $host;
-                ${extra-value-location}
-
-
-        }
-        location /.well-known/acme-challenge/ {
-                root /var/www/certbot;
-        }
-	%{ endif }
-
-	access_log /var/log/nginx/access.log my_custom_format;
-        access_log /var/log/nginx/ip_audit.log ip_audit;
-        access_log /var/log/nginx/backend_debug.log backend_debug;
-	${extra-value}
-        %{~ if http2_bool~}
-        http2 on;
-        ssl_protocols TLSv1.2;
-        %{~ endif ~}
-
-        listen 443 ssl;
-        %{~ if listen_port_80_bool~}
-        listen 80;
-        %{~ endif ~}
-
-        ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;
-        ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
-
-
-
-}
-%{~ if redirect_to_https_bool~}
-
-server {
-        if ($host = www.${name_site}.tryton.geeraert.eu) {
-                return 301 https://$host$request_uri;
-        }
-
-
-        if ($host = ${name_site}.tryton.geeraert.eu) {
-                return 301 https://$host$request_uri;
-        }
-        server_name www.${name_site}.tryton.geeraert.eu ${name_site}.tryton.geeraert.eu ;
-        listen 80;
-        return 404;
-
-}
-%{~ endif ~}
-
-
-
-
-
-############################################
-#       config file for ${name_site}
-############################################
-
-upstream ${name_site}_backend_root {
-        server ${name_service};
-        server 1.1.1.1 backup;
-    }
-
-server {
-        server_name ${name_site}.geeraert.eu www.${name_site}.geeraert.eu;
-
-        location / {
-                proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend_root;
-                proxy_set_header    Upgrade     $http_upgrade;
-		proxy_set_header Host $host;
-                ${extra-value-location}
-
-
-        }
-        location /.well-known/acme-challenge/ {
-                root /var/www/certbot;
-        }
-
-
-	access_log /var/log/nginx/access.log my_custom_format;
-        access_log /var/log/nginx/ip_audit.log ip_audit;
-        access_log /var/log/nginx/backend_debug.log backend_debug;
-	${extra-value}
-        %{~ if http2_bool~}
-        http2 on;
-        ssl_protocols TLSv1.2;
-        %{~ endif ~}
-
-        listen 443 ssl;
-        %{~ if listen_port_80_bool~}
-        listen 80;
-        %{~ endif ~}
-
-        ssl_certificate /etc/nginx/ssl/live/geeraert.eu/fullchain.pem;
-        ssl_certificate_key /etc/nginx/ssl/live/geeraert.eu/privkey.pem;
-
-
-
-}
-%{~ if redirect_to_https_bool~}
-
-server {
-        if ($host = www.${name_site}.geeraert.eu) {
-                return 301 https://$host$request_uri;
-        }
-
-
-        if ($host = ${name_site}.geeraert.eu) {
-                return 301 https://$host$request_uri;
-        }
-        server_name www.${name_site}.geeraert.eu ${name_site}.geeraert.eu ;
-        listen 80;
-        return 404;
-
-}
-%{~ endif ~}

reverse-proxy/variables.auto.tfvars

@@ -1,433 +0,0 @@
-nginx_sites = {
-  bitwarden = {
-    service                 = "bitwarden-nginx-svc.bitwarden.svc:8080"
-    http2_bool              = true
-    redirect_to_root_domain = false
-  }
-
-  bookstack = {
-    enabled     = false
-    service     = "bookstack-svc.bookstack.svc"
-    proxy_cache = false
-  }
-
-
-  django = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  admin = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  redirect = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  streaming = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  stash = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  simpsons = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  kubernetes = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  cloudmanager = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  podcast = {
-    enabled = false
-
-    service     = "django-svc.django:8000"
-    proxy_cache = true
-    http2_bool  = true
-
-  }
-  django-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-
-  admin-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-
-  redirect-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-
-  streaming-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-
-  stash-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-
-  simpsons-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-
-  kubernetes-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-
-  cloudmanager-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-  podcast-testing = {
-    service     = "django-testing-svc.django-testing.svc:8000"
-    proxy_cache = true
-    http2_bool  = true
-  }
-  echo = {
-    enabled        = true
-    service        = "echo-svc.echo.svc"
-    docker_service = "echo-svc.echo.svc"
-    proxy_cache    = true
-    http2_bool     = true
-  }
-
-  sonarr = {
-    enabled = false
-
-    service     = "sonarr-svc.servarr.svc:8989"
-    geoip_allow = ["FR", "GB", "NL"]
-
-  }
-
-
-  nextcloud = {
-    enabled = false
-
-    redirect_to_root_domain = false
-    service                 = "webserver.nextcloud.svc"
-    #service     = "nextcloud-svc.next.svc"
-    proxy_cache = true
-    http2_bool  = true
-    extra-value = <<EOT
-
-
-        location /.well-known/carddav {
-                return 301 $scheme://$host/remote.php/dav;
-        }
-
-        location /.well-known/caldav {
-                return 301 $scheme://$host/remote.php/dav;
-        }
-
-        location = /health {
-                default_type text/html;
-                return 200 "<!DOCTYPE html><h2>health check</h2>\n";
-        }
-                        EOT
-  }
-
-
-
-  router = {
-    enabled = false
-
-    service                 = "192.168.88.1"
-    authentication_required = true
-  }
-
-  octoprint = {
-
-    service              = "192.168.0.32:5000"
-    extra-value-location = <<EOT
-    proxy_set_header Host $http_host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme; # Crucial for HTTPS to HTTP matching
-    
-    # Required for OctoPrint WebSockets to function properly
-    proxy_http_version 1.1;
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Connection "upgrade";
-    
-    client_max_body_size 0;    # Allows large file uploads like gcode
-                EOT
-
-  }
-  onitama = {
-    service = "onitama-svc.onitama.svc:8080"
-    enabled = false
-  }
-
-
-  paperless = {
-    enabled = false
-
-    #service = "webserver.paperless.svc:8000"
-    service = "paperless-svc.paperless.svc:8000"
-  }
-  pihole = {
-    enabled = false
-
-    service = "172.16.0.60:8081"
-    enabled = false
-  }
-
-  prowlarr = {
-    enabled = false
-
-    service     = "prowlarr-svc.servarr.svc:9696"
-    geoip_allow = ["FR", "GB", "NL"]
-
-  }
-
-  qbittorrent = {
-    enabled     = false
-    service     = "qbittorrent-svc.servarr.svc:8080"
-    geoip_allow = ["FR", "GB", "NL"]
-
-  }
-  radarr = {
-    enabled = false
-
-    service     = "radarr-svc.servarr.svc:7878"
-    geoip_allow = ["FR", "GB", "NL"]
-
-  }
-
-
-  unifi = {
-    enabled = false
-
-    #    service = "unifi.unifi.svc:8443"
-    service          = "192.168.88.244:8443"
-    proxy_pass_https = true
-  }
-  unifi-inform = {
-    enabled = false
-
-    service = "192.168.88.50:8082"
-  }
-
-
-  immich = {
-    enabled = false
-
-    #service = "immich-server.immich.svc:2283"
-    service              = "immich-svc.immich.svc:2283"
-    geoip_allow          = ["FR", "GB", "NL"]
-    extra-value-location = <<EOT
-       proxy_set_header Connection "upgrade";
-       proxy_set_header X-Real-IP $remote_addr;
-       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-       proxy_set_header X-Forwarded-Proto $scheme;
-       proxy_read_timeout 60000s;
-
-
-    #adding websocket , usefull for reverse proxy
-       proxy_set_header Connection "upgrade";
-       proxy_set_header X-Real-IP $remote_addr;
-       proxy_cache_bypass $http_upgrade;
-    #end of working
-                EOT  
-  }
-
-
-
-  stirling = {
-    enabled              = false
-    service              = "stirling-svc.stirling.svc:8080"
-    extra-value-location = <<EOT
-    proxy_set_header Connection "upgrade";
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_read_timeout 60000s;
-#working
-proxy_set_header Connection "upgrade";
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_cache_bypass $http_upgrade;
-#end of working
-
-
-
-                EOT
-  }
-
-
-
-  openmediavault = {
-    service = "192.168.88.29"
-  }
-  pihole = {
-    enabled = false
-    service = "web.piholenew.svc"
-  }
-
-  synology = {
-    enabled = true
-    service = "192.168.88.39:5000"
-  }
-
-  gitea = {
-    enabled                 = true
-    service                 = "gitea-svc.gitea.svc:3000"
-    docker_service          = "gitea-svc.gitea.svc:3000"
-    redirect_to_root_domain = false
-  }
-
-  next = {
-    enabled     = false
-    service     = "next-svc.next.svc"
-    proxy_cache = true
-    http2_bool  = true
-    extra-value = <<EOT
-
-
-        location /.well-known/carddav {
-                return 301 $scheme://$host/remote.php/dav;
-        }
-
-        location /.well-known/caldav {
-                return 301 $scheme://$host/remote.php/dav;
-        }
-
-        location = /health {
-                default_type text/html;
-                return 200 "<!DOCTYPE html><h2>health check</h2>\n";
-        }
-                        EOT
-  }
-
-
-  stash = {
-    enabled = false
-    service = "stash-svc.stash.svc:9999"
-    #geoip_blocking = false
-    #extra-value= <<EOT
-    #   proxy_protocol on;
-    #EOT
-    extra-value-location = <<EOT
-    #don't use this as this needs to be run as root or have the CAP_NET_RAW capability) to bind to a non-local IP address.
-    #Because the backend thinks the request is coming directly from the client, it will try to send the response directly back to that client IP. To prevent this (which would break the connection), you must force the response back through the NGINX server.
-    #proxy_bind $remote_addr transparent;
-
-##used to be working
-    proxy_set_header Connection "upgrade";
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_read_timeout 60000s;
-    #working
-    proxy_set_header Connection "upgrade";
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_cache_bypass $http_upgrade;
-    #end of working
-    EOT
-
-    geoip_allow = ["FR", "GB", "NL"]
-  }
-  neko = {
-    enabled              = false
-    service              = "neko-svc.neko.svc:8080"
-    http2_bool           = true
-    extra-value-location = <<EOT
-proxy_set_header Connection "upgrade";
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_cache_bypass $http_upgrade;
-
-                EOT
-
-  }
-
-
-
-
-  wikijs = {
-    #enabled     = false
-    geoip_blocking = false
-    service        = "wikijs-svc.wikijs.svc:3000"
-    extra-value    = <<EOT
-client_max_body_size 20m;
-        proxy_request_buffering off;
-                EOT
-  }
-
-
-
-
-  tdarr = {
-    enabled              = false
-    service              = "tdarr-svc.servarr.svc:8265"
-    extra-value-location = <<EOT
-    proxy_set_header Connection "upgrade";
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_read_timeout 60000s;
-#working
-proxy_set_header Connection "upgrade";
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_cache_bypass $http_upgrade;
-#end of working
-
-
-
-                EOT
-
-  }
-
-}
-deny_ip = ["1.2.3.4"]