doing some cleanup

module.tf

@@ -856,37 +856,6 @@ for_each   = { for key, value in data.bitwarden-secrets_secret.secret_import : k
 }
 
 
-data "bitwarden-secrets_secret" "secret" {
-  id = "fee7431a-9f6d-478e-8ee0-b3e800c394b5"
-}
-
-output "example" {
-  value = {
-    id              = data.bitwarden-secrets_secret.secret.id
-    key             = data.bitwarden-secrets_secret.secret.key
-    value           = data.bitwarden-secrets_secret.secret.value #The actual secret value is marked sensitive and will not be printed to stdout
-    note            = data.bitwarden-secrets_secret.secret.note
-    project_id      = data.bitwarden-secrets_secret.secret.project_id
-    organization_id = data.bitwarden-secrets_secret.secret.organization_id
-    creation_date   = data.bitwarden-secrets_secret.secret.creation_date
-    revision_date   = data.bitwarden-secrets_secret.secret.revision_date
-  }
-  sensitive = true
-}
-
-
-
-resource "kubernetes_config_map_v1_data" "tf-bw-configmap" {
-  metadata {
-    name      = "bitwarden-terraform"
-    namespace = "echo-server"
-  }
-
-  data = yamldecode(data.bitwarden-secrets_secret.secret.value)
-  #data = data.bitwarden-secrets_secret.secret.value
-
-}
-
 resource "kubernetes_secret_v1" "automatic-database-secret" {
   for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
   metadata {

nginx_config.tftpl

@@ -0,0 +1,45 @@
+############################################
+#       config file for ${name_site}
+############################################
+
+upstream ${name_site}_backend {
+        server ${name_service};
+        server 1.1.1.1 backup;
+    }
+
+server {
+        server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
+        location / {
+                proxy_pass http://${name_site}_backend;
+                proxy_set_header    Upgrade     $http_upgrade;
+		proxy_set_header Host $host;
+        }
+        location /.well-known/acme-challenge/ {
+                root /var/www/certbot;
+        }
+
+	access_log /var/log/nginx/access.log my_custom_format;
+        access_log /var/log/nginx/ip_audit.log ip_audit;
+
+        listen 443 ssl;
+
+        ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;
+        ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
+
+}
+
+server {
+        if ($host = www.${name_site}.tryton.geeraert.eu) {
+                return 301 https://$host$request_uri;
+        }
+
+
+        if ($host = ${name_site}.tryton.geeraert.eu) {
+                return 301 https://$host$request_uri;
+        }
+
+        server_name www.${name_site}.tryton.geeraert.eu ${name_site}.tryton.geeraert.eu;
+        listen 80;
+        return 404;
+
+}

terraform.tfstate

@@ -1,35 +1,9 @@
 {
   "version": 4,
   "terraform_version": "1.14.4",
-  "serial": 5397,
+  "serial": 5403,
   "lineage": "9de68ad6-060f-6b41-b115-a689f60c73a2",
   "outputs": {
-    "example": {
-      "value": {
-        "creation_date": "2026-02-05 11:52:05.2843411 +0000 UTC",
-        "id": "fee7431a-9f6d-478e-8ee0-b3e800c394b5",
-        "key": "servarr__db__credentials",
-        "note": "",
-        "organization_id": "a6361589-badd-4bde-9cb4-af8901161c0d",
-        "project_id": "b5fc4c48-e951-442f-97ca-b3e800c143cd",
-        "revision_date": "2026-02-09 13:01:31.4122943 +0000 UTC",
-        "value": "DB_DATABASE: cHJvd2xhcnItbWFpbg==testing\nDB_HOST: cHJvd2xhcnItZGItc3Zj\nDB_PASS: R29saWF0aC1EZWVwZW4tRGl2aWRpbmc3\nDB_USER: c2VydmFycl91c2VybmFtZQ=="
-      },
-      "type": [
-        "object",
-        {
-          "creation_date": "string",
-          "id": "string",
-          "key": "string",
-          "note": "string",
-          "organization_id": "string",
-          "project_id": "string",
-          "revision_date": "string",
-          "value": "string"
-        }
-      ],
-      "sensitive": true
-    },
     "fromressource": {
       "value": {
         "key": {
@@ -1320,36 +1294,6 @@
         }
       ]
     },
-    {
-      "mode": "data",
-      "type": "bitwarden-secrets_secret",
-      "name": "secret",
-      "provider": "provider[\"registry.terraform.io/bitwarden/bitwarden-secrets\"]",
-      "instances": [
-        {
-          "schema_version": 0,
-          "attributes": {
-            "creation_date": "2026-02-05 11:52:05.2843411 +0000 UTC",
-            "id": "fee7431a-9f6d-478e-8ee0-b3e800c394b5",
-            "key": "servarr__db__credentials",
-            "note": "",
-            "organization_id": "a6361589-badd-4bde-9cb4-af8901161c0d",
-            "project_id": "b5fc4c48-e951-442f-97ca-b3e800c143cd",
-            "revision_date": "2026-02-09 13:01:31.4122943 +0000 UTC",
-            "value": "DB_DATABASE: cHJvd2xhcnItbWFpbg==testing\nDB_HOST: cHJvd2xhcnItZGItc3Zj\nDB_PASS: R29saWF0aC1EZWVwZW4tRGl2aWRpbmc3\nDB_USER: c2VydmFycl91c2VybmFtZQ=="
-          },
-          "sensitive_attributes": [
-            [
-              {
-                "type": "get_attr",
-                "value": "value"
-              }
-            ]
-          ],
-          "identity_schema_version": 0
-        }
-      ]
-    },
     {
       "mode": "data",
       "type": "bitwarden-secrets_secret",
@@ -2521,7 +2465,7 @@
           "index_key": "fail2ban-50814edb-d190-41cb-8950-b3ee01622dcf",
           "schema_version": 0,
           "attributes": {
-            "binary_data": null,
+            "binary_data": {},
             "data": {
               "nginx-block-map.local": "## Version 2022/08/06\n# Fail2Ban configuration file for black-listing via nginx\n#\n# Author: Serg G. Brester (aka sebres)\n#\n# To use 'nginx-block-map' action you should define some special blocks in your nginx configuration,\n# and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx by ban).\n#\n# Example (argument \"token_id\" resp. cookie \"session_id\" used here as unique identifier for user):\n#\n#   http {\n#     ...\n#     # maps to check user is blacklisted (banned in f2b):\n#     #map $arg_token_id      $blck_lst_tok { include blacklisted-tokens.map; }\n#     map  $cookie_session_id $blck_lst_ses { include blacklisted-sessions.map; }\n#     ...\n#     # special log-format to notify fail2ban about failures:\n#     log_format f2b_session_errors '$msec failure \"$cookie_session_id\" - $remote_addr - $remote_user '\n#      ;#                  '\"$request\" $status $bytes_sent '\n#       #                  '\"$http_referer\" \"$http_user_agent\"';\n#\n#     # location checking blacklisted values:\n#     location ... {\n#       # check banned sessionid:\n#       if ($blck_lst_ses != \"\") {\n#         try_files \"\" @f2b-banned;\n#       }\n#       ...\n#       # notify fail2ban about a failure inside nginx:\n#       error_page 401 = @notify-f2b;\n#       ...\n#     }\n#     ...\n#     # location for return with \"403 Forbidden\" if banned:\n#     location @f2b-banned {\n#       default_type text/html;\n#       return 403 \"\u003cbr/\u003e\u003ccenter\u003e\n#         \u003cb style=\\\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\\\"\u003e\n#         You are banned!\u003c/b\u003e\u003c/center\u003e\";\n#     }\n#     ...\n#     # location to notify fail2ban about a failure inside nginx:\n#     location @notify-f2b {\n#       access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;\n#     }\n#   }\n#   ...\n#\n# Note that quote-character (and possibly other special characters) are not allowed currently as session-id.\n# Thus please add any session-id validation rule in your locations (or in the corresponding backend-service), \n# like in example below:\n#\n#   location ... {\n#     if ($cookie_session_id !~ \"^[\\w\\-]+$\") {\n#       return  403 \"Wrong session-id\"\n#     }\n#     ...\n#   }\n#\n# The parameters for jail corresponding log-format (f2b_session_errors):\n#\n#   [nginx-blck-lst]\n#   filter =\n#   datepattern = ^Epoch\n#   failregex = ^ failure \"\u003cF-ID\u003e[^\"]+\u003c/F-ID\u003e\" - \u003cADDR\u003e\n#   usedns = no\n#\n# The same log-file can be used for IP-related jail (additionally to session-related, to ban very bad IPs):\n#\n#   [nginx-blck-ip]\n#   maxretry = 100\n#   filter =\n#   datepattern = ^Epoch\n#   failregex = ^ failure \"[^\"]+\" - \u003cADDR\u003e\n#   usedns = no\n#\n\n[Definition]\n\n# path to configuration of nginx (used to target nginx-instance in multi-instance system,\n# and as path for the blacklisted map):\n#srv_cfg_path = /etc/nginx/\n\nsrv_cfg_path = /blacklisted.d/\n\n# cmd-line arguments to supply to test/reload nginx:\n#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf\nsrv_cmd = nginx\n\n# pid file (used to check nginx is running):\nsrv_pid = /run/nginx.pid\n\n# command used to check whether nginx is running and configuration is valid:\nsrv_is_running = [ -f \"%(srv_pid)s\" ]\nsrv_check_cmd = %(srv_is_running)s \u0026\u0026 %(srv_cmd)s -qt\n\n# first test nginx is running and configuration is correct, hereafter send reload signal:\n#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then\n#                    %(srv_cmd)s -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;\n#                  fi;\n\nrestart_file = /restart-signal/restart.txt\n\nblck_lst_reload = touch %(restart_file)s;sleep 20; rm %(restart_file)s;\n\n# map-file for nginx, can be redefined using `action = nginx-block-map[blck_lst_file=\"/path/file.map\"]`:\nblck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf\n\n# Action definition:\n\nactionstart_on_demand = false\nactionstart = touch '%(blck_lst_file)s'\n\nactionflush = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s\n\nactionstop = %(actionflush)s\n\nactioncheck = \n\n_echo_blck_row = printf '\\%%s 1;\\n' \"\u003cfid\u003e\"\n\nactionban = echo \u003cip\u003e | awk -F. '{print \"deny \"$1\".\"$2\".\"$3\".\"$4\";\"}' \u003e\u003e '%(blck_lst_file)s'; %(blck_lst_reload)s\n\nactionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\\/$*.^|[]/\\\\\u0026/g'); sed -i \"/^$id$/d\" %(blck_lst_file)s; %(blck_lst_reload)s\n"
             },
@@ -2529,10 +2473,10 @@
             "immutable": false,
             "metadata": [
               {
-                "annotations": null,
+                "annotations": {},
                 "generate_name": "",
                 "generation": 0,
-                "labels": null,
+                "labels": {},
                 "name": "nginx-block-map-action",
                 "namespace": "fail2ban",
                 "resource_version": "218713306",
@@ -2607,7 +2551,7 @@
           "index_key": "fail2ban-fb11452e-fec1-489f-9144-b3ee0162ccda",
           "schema_version": 0,
           "attributes": {
-            "binary_data": null,
+            "binary_data": {},
             "data": {
               "nginx-unauthorized.local": "## Version 2022/08/06\n# Fail2Ban filter configuration for nginx unauthorized\n\n[INCLUDES]\nbefore = common.conf\n\n[Definition]\n\n#original\n#failregex = ^\u003cHOST\u003e.*\"(GET|POST|HEAD).*\" (401) .*$\n\n\n#try this one\nfailregex = ^\u003cHOST\u003e - .* \"(?:GET|POST|HEAD) [^\"]+\" 401\n            ^\u003cHOST\u003e - .* upstream_status=401\n            #for servarr\n            ^\u003cHOST\u003e -.*\"GET /login\\?returnUrl=/\u0026loginFailed=true HTTP/.*\" 200\n            ^\u003cHOST\u003e -.*\"POST /login\\?returnUrl=/\u0026loginFailed=true HTTP/.*\" 200\n            #for bitwarden\n            ^\u003cHOST\u003e -.*\"POST /identity/accounts/prelogin *HTTP/.*\" 200\n#actionban = touch /tmp/\u003cname\u003e.ban\n#actionunban = touch /tmp/\u003cname\u003e.unban\n"
             },
@@ -2615,10 +2559,10 @@
             "immutable": false,
             "metadata": [
               {
-                "annotations": null,
+                "annotations": {},
                 "generate_name": "",
                 "generation": 0,
-                "labels": null,
+                "labels": {},
                 "name": "fail2ban-nginx-unauthorized-filter",
                 "namespace": "fail2ban",
                 "resource_version": "218713307",
@@ -2648,47 +2592,6 @@
         }
       ]
     },
-    {
-      "mode": "managed",
-      "type": "kubernetes_config_map_v1_data",
-      "name": "tf-bw-configmap",
-      "provider": "provider[\"registry.terraform.io/hashicorp/kubernetes\"]",
-      "instances": [
-        {
-          "schema_version": 0,
-          "attributes": {
-            "data": {
-              "DB_DATABASE": "cHJvd2xhcnItbWFpbg==testing",
-              "DB_HOST": "cHJvd2xhcnItZGItc3Zj",
-              "DB_PASS": "R29saWF0aC1EZWVwZW4tRGl2aWRpbmc3",
-              "DB_USER": "c2VydmFycl91c2VybmFtZQ=="
-            },
-            "field_manager": "Terraform",
-            "force": null,
-            "id": "echo-server/bitwarden-terraform",
-            "metadata": [
-              {
-                "name": "bitwarden-terraform",
-                "namespace": "echo-server"
-              }
-            ]
-          },
-          "sensitive_attributes": [
-            [
-              {
-                "type": "get_attr",
-                "value": "data"
-              }
-            ]
-          ],
-          "identity_schema_version": 0,
-          "private": "bnVsbA==",
-          "dependencies": [
-            "data.bitwarden-secrets_secret.secret"
-          ]
-        }
-      ]
-    },
     {
       "mode": "managed",
       "type": "kubernetes_deployment_v1",