pi-ux-ce/Terraform_kube
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

cleanup

Browse Source
This commit is contained in:
pierre.geeraert
2026-10-13 16:15:59 +01:00
parent 6578e10274
commit 56a02818cd
8 changed files with 81 additions and 693 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/storage.tf
View File
core/testing_new_storage.yaml
-33
View File
@@ -1,33 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
labels:
app: nginx
spec:
replicas: 3
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: nginx:1.14.2
ports:
- containerPort: 80
volumeMounts:
- name: data
mountPath: /hello
volumes:
- name: data
hostPath:
path: /data/kubernetes/degoog/degoog-data-pvc
type: DirectoryOrCreate
infrastructure/.tool-versions
+1
View File
@@ -0,0 +1 @@
terraform 1.16.5
infrastructure/deployment.tf
+77
View File
@@ -40,6 +40,83 @@ resource "kubernetes_service_v1" "automatic_service" {
}
resource "kubernetes_ingress_v1" "automatic_ingress" {
for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true && value.docker != true && value.exposed == true }
metadata {
name = "${each.key}-ingress"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
annotations = {
"cert-manager.io/cluster-issuer" = "letsencrypt-prod"
"traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
}
}
spec {
ingress_class_name = "traefik"
# Dynamic TLS configuration for cert-manager
tls {
hosts = [join(".", [coalesce(each.value.domain_name, each.key), "geeraert.eu"])]
secret_name = "${each.key}-tls-secret" # cert-manager will create and manage this secret automatically
}
rule {
host = join(".", [coalesce(each.value.domain_name, each.key), "geeraert.eu"])
http {
path {
path = "/"
backend {
service {
name = "${each.key}-svc"
port {
number = each.value.service_port[0] #selecting the first of the list
}
}
}
}
}
}
}
}
resource "kubernetes_ingress_v1" "automatic_ingress_legacy" {
for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true && value.docker != true && value.exposed == true && value.legacy_domain == true }
metadata {
name = "${each.key}-ingress-legacy"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
annotations = {
"cert-manager.io/cluster-issuer" = "letsencrypt-prod"
"traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
}
}
spec {
ingress_class_name = "traefik"
# Dynamic TLS configuration for cert-manager
tls {
hosts = [join(".", [coalesce(each.value.domain_name, each.key), "tryton.geeraert.eu"])]
secret_name = "${each.key}-tryton-tls-secret" # cert-manager will create and manage this secret automatically
}
rule {
host = join(".", [coalesce(each.value.domain_name, each.key), "tryton.geeraert.eu"])
http {
path {
path = "/"
backend {
service {
name = "${each.key}-svc"
port {
number = each.value.service_port[0] #selecting the first of the list
}
}
}
}
}
}
}
}
resource "kubernetes_deployment_v1" "automatic" {
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
infrastructure/module.tf
+3
View File
@@ -24,6 +24,7 @@ provider "bitwarden-secrets" {
variable "kubernetes" {
type = map(object({
name = optional(string)
docker = optional(bool)
image = string
pvc = optional(map(object({
name = optional(string)
@@ -56,6 +57,8 @@ variable "kubernetes" {
service_type = optional(string, "ClusterIP")
service_name = optional(string)
domain_name = optional(string)
legacy_domain = optional(bool, false)
exposed = optional(bool, true)
liveness_tcp_socket = optional(number)
liveness_http_get = optional(string)
liveness_http_get_path = optional(string)
reverse-proxy/module.tf
-83
View File
@@ -1,83 +0,0 @@
terraform {
required_version = "> 0.8.0"
}
provider "kubernetes" {
config_path = "~/.kube/config"
}
variable "shunt_kubernetes" {
type = bool
default = true
}
variable "nginx_sites" {
type = map(object({
service = string
docker_service = optional(string)
enabled = optional(bool, true)
proxy_cache = optional(bool, false)
extra-value = optional(string, "")
extra-value-location = optional(string, "")
http2_bool = optional(bool, false)
proxy_pass_https = optional(bool, false)
authentication_required = optional(bool, false)
redirect_to_https_bool = optional(bool, true)
listen_port_80_bool = optional(bool, false)
geoip_blocking = optional(bool, false)
geoip_allow = optional(list(string), ["FR", "GB"])
redirect_to_root_domain = optional(bool, true)
}))
}
resource "kubernetes_config_map" "automatic-configmap" {
#avoiding this to create if the shunt_kubernetes is on
count = var.shunt_kubernetes ? 0 : 1
metadata {
name = "sites-terraform"
namespace = "reverse-proxy"
annotations = {
"reloader.stakater.com/match" : "true",
}
}
data = {
for key, value in var.nginx_sites :
"${key}.conf" => templatefile("nginx_config.tftpl", {
name_site = key
name_service = value.service
proxy_cache = value.proxy_cache
extra-value = value.extra-value
extra-value-location = value.extra-value-location
http2_bool = value.http2_bool
proxy_pass_https = value.proxy_pass_https
authentication_required = value.authentication_required
redirect_to_https_bool = value.redirect_to_https_bool
listen_port_80_bool = value.listen_port_80_bool
geoip_blocking = value.geoip_blocking
geoip_allow = value.geoip_allow
redirect_to_root_domain = value.redirect_to_root_domain
}) if value.enabled == true
}
}
resource "local_file" "nginx_configs" {
for_each = { for key, value in var.nginx_sites : key => value if value.enabled == true && value.docker_service != null }
filename = "/data/kubernetes/reverse-proxy/reverse-proxy-sites/${each.key}.conf"
content = templatefile("nginx_config.tftpl", {
name_site = each.key
name_service = each.value.docker_service
proxy_cache = each.value.proxy_cache
extra-value = each.value.extra-value
extra-value-location = each.value.extra-value-location
http2_bool = each.value.http2_bool
proxy_pass_https = each.value.proxy_pass_https
authentication_required = each.value.authentication_required
redirect_to_https_bool = each.value.redirect_to_https_bool
listen_port_80_bool = each.value.listen_port_80_bool
redirect_to_root_domain = each.value.redirect_to_root_domain
})
}
reverse-proxy/nginx_config.tftpl
-144
View File
@@ -1,144 +0,0 @@
############################################
# config file for ${name_site}
############################################
upstream ${name_site}_backend {
server ${name_service};
server 1.1.1.1 backup;
}
server {
server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
%{~ if redirect_to_root_domain~}
if ($host = www.${name_site}.tryton.geeraert.eu) {
return 301 https://${name_site}.geeraert.eu$request_uri;
}
if ($host = ${name_site}.tryton.geeraert.eu) {
return 301 https://${name_site}.geeraert.eu$request_uri;
}
%{~ endif ~}
%{ if redirect_to_root_domain != true }
location / {
proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Host $host;
${extra-value-location}
}
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
%{ endif }
access_log /var/log/nginx/access.log my_custom_format;
access_log /var/log/nginx/ip_audit.log ip_audit;
access_log /var/log/nginx/backend_debug.log backend_debug;
${extra-value}
%{~ if http2_bool~}
http2 on;
ssl_protocols TLSv1.2;
%{~ endif ~}
listen 443 ssl;
%{~ if listen_port_80_bool~}
listen 80;
%{~ endif ~}
ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
}
%{~ if redirect_to_https_bool~}
server {
if ($host = www.${name_site}.tryton.geeraert.eu) {
return 301 https://$host$request_uri;
}
if ($host = ${name_site}.tryton.geeraert.eu) {
return 301 https://$host$request_uri;
}
server_name www.${name_site}.tryton.geeraert.eu ${name_site}.tryton.geeraert.eu ;
listen 80;
return 404;
}
%{~ endif ~}
############################################
# config file for ${name_site}
############################################
upstream ${name_site}_backend_root {
server ${name_service};
server 1.1.1.1 backup;
}
server {
server_name ${name_site}.geeraert.eu www.${name_site}.geeraert.eu;
location / {
proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend_root;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Host $host;
${extra-value-location}
}
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
access_log /var/log/nginx/access.log my_custom_format;
access_log /var/log/nginx/ip_audit.log ip_audit;
access_log /var/log/nginx/backend_debug.log backend_debug;
${extra-value}
%{~ if http2_bool~}
http2 on;
ssl_protocols TLSv1.2;
%{~ endif ~}
listen 443 ssl;
%{~ if listen_port_80_bool~}
listen 80;
%{~ endif ~}
ssl_certificate /etc/nginx/ssl/live/geeraert.eu/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/live/geeraert.eu/privkey.pem;
}
%{~ if redirect_to_https_bool~}
server {
if ($host = www.${name_site}.geeraert.eu) {
return 301 https://$host$request_uri;
}
if ($host = ${name_site}.geeraert.eu) {
return 301 https://$host$request_uri;
}
server_name www.${name_site}.geeraert.eu ${name_site}.geeraert.eu ;
listen 80;
return 404;
}
%{~ endif ~}
reverse-proxy/variables.auto.tfvars
-433
View File
@@ -1,433 +0,0 @@
nginx_sites = {
bitwarden = {
service = "bitwarden-nginx-svc.bitwarden.svc:8080"
http2_bool = true
redirect_to_root_domain = false
}
bookstack = {
enabled = false
service = "bookstack-svc.bookstack.svc"
proxy_cache = false
}
django = {
enabled = false
service = "django-svc.django:8000"
proxy_cache = true
http2_bool = true
}
admin = {
enabled = false
service = "django-svc.django:8000"
proxy_cache = true
http2_bool = true
}
redirect = {
enabled = false
service = "django-svc.django:8000"
proxy_cache = true
http2_bool = true
}
streaming = {
enabled = false
service = "django-svc.django:8000"
proxy_cache = true
http2_bool = true
}
stash = {
enabled = false
service = "django-svc.django:8000"
proxy_cache = true
http2_bool = true
}
simpsons = {
enabled = false
service = "django-svc.django:8000"
proxy_cache = true
http2_bool = true
}
kubernetes = {
enabled = false
service = "django-svc.django:8000"
proxy_cache = true
http2_bool = true
}
cloudmanager = {
enabled = false
service = "django-svc.django:8000"
proxy_cache = true
http2_bool = true
}
podcast = {
enabled = false
service = "django-svc.django:8000"
proxy_cache = true
http2_bool = true
}
django-testing = {
service = "django-testing-svc.django-testing.svc:8000"
proxy_cache = true
http2_bool = true
}
admin-testing = {
service = "django-testing-svc.django-testing.svc:8000"
proxy_cache = true
http2_bool = true
}
redirect-testing = {
service = "django-testing-svc.django-testing.svc:8000"
proxy_cache = true
http2_bool = true
}
streaming-testing = {
service = "django-testing-svc.django-testing.svc:8000"
proxy_cache = true
http2_bool = true
}
stash-testing = {
service = "django-testing-svc.django-testing.svc:8000"
proxy_cache = true
http2_bool = true
}
simpsons-testing = {
service = "django-testing-svc.django-testing.svc:8000"
proxy_cache = true
http2_bool = true
}
kubernetes-testing = {
service = "django-testing-svc.django-testing.svc:8000"
proxy_cache = true
http2_bool = true
}
cloudmanager-testing = {
service = "django-testing-svc.django-testing.svc:8000"
proxy_cache = true
http2_bool = true
}
podcast-testing = {
service = "django-testing-svc.django-testing.svc:8000"
proxy_cache = true
http2_bool = true
}
echo = {
enabled = true
service = "echo-svc.echo.svc"
docker_service = "echo-svc.echo.svc"
proxy_cache = true
http2_bool = true
}
sonarr = {
enabled = false
service = "sonarr-svc.servarr.svc:8989"
geoip_allow = ["FR", "GB", "NL"]
}
nextcloud = {
enabled = false
redirect_to_root_domain = false
service = "webserver.nextcloud.svc"
#service = "nextcloud-svc.next.svc"
proxy_cache = true
http2_bool = true
extra-value = <<EOT
location /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav;
}
location /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav;
}
location = /health {
default_type text/html;
return 200 "<!DOCTYPE html><h2>health check</h2>\n";
}
EOT
}
router = {
enabled = false
service = "192.168.88.1"
authentication_required = true
}
octoprint = {
service = "192.168.0.32:5000"
extra-value-location = <<EOT
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme; # Crucial for HTTPS to HTTP matching
# Required for OctoPrint WebSockets to function properly
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
client_max_body_size 0; # Allows large file uploads like gcode
EOT
}
onitama = {
service = "onitama-svc.onitama.svc:8080"
enabled = false
}
paperless = {
enabled = false
#service = "webserver.paperless.svc:8000"
service = "paperless-svc.paperless.svc:8000"
}
pihole = {
enabled = false
service = "172.16.0.60:8081"
enabled = false
}
prowlarr = {
enabled = false
service = "prowlarr-svc.servarr.svc:9696"
geoip_allow = ["FR", "GB", "NL"]
}
qbittorrent = {
enabled = false
service = "qbittorrent-svc.servarr.svc:8080"
geoip_allow = ["FR", "GB", "NL"]
}
radarr = {
enabled = false
service = "radarr-svc.servarr.svc:7878"
geoip_allow = ["FR", "GB", "NL"]
}
unifi = {
enabled = false
# service = "unifi.unifi.svc:8443"
service = "192.168.88.244:8443"
proxy_pass_https = true
}
unifi-inform = {
enabled = false
service = "192.168.88.50:8082"
}
immich = {
enabled = false
#service = "immich-server.immich.svc:2283"
service = "immich-svc.immich.svc:2283"
geoip_allow = ["FR", "GB", "NL"]
extra-value-location = <<EOT
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 60000s;
#adding websocket , usefull for reverse proxy
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_cache_bypass $http_upgrade;
#end of working
EOT
}
stirling = {
enabled = false
service = "stirling-svc.stirling.svc:8080"
extra-value-location = <<EOT
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 60000s;
#working
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_cache_bypass $http_upgrade;
#end of working
EOT
}
openmediavault = {
service = "192.168.88.29"
}
pihole = {
enabled = false
service = "web.piholenew.svc"
}
synology = {
enabled = true
service = "192.168.88.39:5000"
}
gitea = {
enabled = true
service = "gitea-svc.gitea.svc:3000"
docker_service = "gitea-svc.gitea.svc:3000"
redirect_to_root_domain = false
}
next = {
enabled = false
service = "next-svc.next.svc"
proxy_cache = true
http2_bool = true
extra-value = <<EOT
location /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav;
}
location /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav;
}
location = /health {
default_type text/html;
return 200 "<!DOCTYPE html><h2>health check</h2>\n";
}
EOT
}
stash = {
enabled = false
service = "stash-svc.stash.svc:9999"
#geoip_blocking = false
#extra-value= <<EOT
# proxy_protocol on;
#EOT
extra-value-location = <<EOT
#don't use this as this needs to be run as root or have the CAP_NET_RAW capability) to bind to a non-local IP address.
#Because the backend thinks the request is coming directly from the client, it will try to send the response directly back to that client IP. To prevent this (which would break the connection), you must force the response back through the NGINX server.
#proxy_bind $remote_addr transparent;
##used to be working
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 60000s;
#working
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_cache_bypass $http_upgrade;
#end of working
EOT
geoip_allow = ["FR", "GB", "NL"]
}
neko = {
enabled = false
service = "neko-svc.neko.svc:8080"
http2_bool = true
extra-value-location = <<EOT
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_cache_bypass $http_upgrade;
EOT
}
wikijs = {
#enabled = false
geoip_blocking = false
service = "wikijs-svc.wikijs.svc:3000"
extra-value = <<EOT
client_max_body_size 20m;
proxy_request_buffering off;
EOT
}
tdarr = {
enabled = false
service = "tdarr-svc.servarr.svc:8265"
extra-value-location = <<EOT
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 60000s;
#working
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_cache_bypass $http_upgrade;
#end of working
EOT
}
}
deny_ip = ["1.2.3.4"]