doing some cleanup
This commit is contained in:
@@ -856,37 +856,6 @@ for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : k
|
||||
}
|
||||
|
||||
|
||||
data "bitwarden-secrets_secret" "secret" {
|
||||
id = "fee7431a-9f6d-478e-8ee0-b3e800c394b5"
|
||||
}
|
||||
|
||||
output "example" {
|
||||
value = {
|
||||
id = data.bitwarden-secrets_secret.secret.id
|
||||
key = data.bitwarden-secrets_secret.secret.key
|
||||
value = data.bitwarden-secrets_secret.secret.value #The actual secret value is marked sensitive and will not be printed to stdout
|
||||
note = data.bitwarden-secrets_secret.secret.note
|
||||
project_id = data.bitwarden-secrets_secret.secret.project_id
|
||||
organization_id = data.bitwarden-secrets_secret.secret.organization_id
|
||||
creation_date = data.bitwarden-secrets_secret.secret.creation_date
|
||||
revision_date = data.bitwarden-secrets_secret.secret.revision_date
|
||||
}
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
||||
|
||||
resource "kubernetes_config_map_v1_data" "tf-bw-configmap" {
|
||||
metadata {
|
||||
name = "bitwarden-terraform"
|
||||
namespace = "echo-server"
|
||||
}
|
||||
|
||||
data = yamldecode(data.bitwarden-secrets_secret.secret.value)
|
||||
#data = data.bitwarden-secrets_secret.secret.value
|
||||
|
||||
}
|
||||
|
||||
resource "kubernetes_secret_v1" "automatic-database-secret" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
metadata {
|
||||
|
||||
@@ -0,0 +1,45 @@
|
||||
############################################
|
||||
# config file for ${name_site}
|
||||
############################################
|
||||
|
||||
upstream ${name_site}_backend {
|
||||
server ${name_service};
|
||||
server 1.1.1.1 backup;
|
||||
}
|
||||
|
||||
server {
|
||||
server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
|
||||
location / {
|
||||
proxy_pass http://${name_site}_backend;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Host $host;
|
||||
}
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
access_log /var/log/nginx/access.log my_custom_format;
|
||||
access_log /var/log/nginx/ip_audit.log ip_audit;
|
||||
|
||||
listen 443 ssl;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;
|
||||
ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
if ($host = www.${name_site}.tryton.geeraert.eu) {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
|
||||
if ($host = ${name_site}.tryton.geeraert.eu) {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server_name www.${name_site}.tryton.geeraert.eu ${name_site}.tryton.geeraert.eu;
|
||||
listen 80;
|
||||
return 404;
|
||||
|
||||
}
|
||||
+7
-104
@@ -1,35 +1,9 @@
|
||||
{
|
||||
"version": 4,
|
||||
"terraform_version": "1.14.4",
|
||||
"serial": 5397,
|
||||
"serial": 5403,
|
||||
"lineage": "9de68ad6-060f-6b41-b115-a689f60c73a2",
|
||||
"outputs": {
|
||||
"example": {
|
||||
"value": {
|
||||
"creation_date": "2026-02-05 11:52:05.2843411 +0000 UTC",
|
||||
"id": "fee7431a-9f6d-478e-8ee0-b3e800c394b5",
|
||||
"key": "servarr__db__credentials",
|
||||
"note": "",
|
||||
"organization_id": "a6361589-badd-4bde-9cb4-af8901161c0d",
|
||||
"project_id": "b5fc4c48-e951-442f-97ca-b3e800c143cd",
|
||||
"revision_date": "2026-02-09 13:01:31.4122943 +0000 UTC",
|
||||
"value": "DB_DATABASE: cHJvd2xhcnItbWFpbg==testing\nDB_HOST: cHJvd2xhcnItZGItc3Zj\nDB_PASS: R29saWF0aC1EZWVwZW4tRGl2aWRpbmc3\nDB_USER: c2VydmFycl91c2VybmFtZQ=="
|
||||
},
|
||||
"type": [
|
||||
"object",
|
||||
{
|
||||
"creation_date": "string",
|
||||
"id": "string",
|
||||
"key": "string",
|
||||
"note": "string",
|
||||
"organization_id": "string",
|
||||
"project_id": "string",
|
||||
"revision_date": "string",
|
||||
"value": "string"
|
||||
}
|
||||
],
|
||||
"sensitive": true
|
||||
},
|
||||
"fromressource": {
|
||||
"value": {
|
||||
"key": {
|
||||
@@ -1320,36 +1294,6 @@
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"mode": "data",
|
||||
"type": "bitwarden-secrets_secret",
|
||||
"name": "secret",
|
||||
"provider": "provider[\"registry.terraform.io/bitwarden/bitwarden-secrets\"]",
|
||||
"instances": [
|
||||
{
|
||||
"schema_version": 0,
|
||||
"attributes": {
|
||||
"creation_date": "2026-02-05 11:52:05.2843411 +0000 UTC",
|
||||
"id": "fee7431a-9f6d-478e-8ee0-b3e800c394b5",
|
||||
"key": "servarr__db__credentials",
|
||||
"note": "",
|
||||
"organization_id": "a6361589-badd-4bde-9cb4-af8901161c0d",
|
||||
"project_id": "b5fc4c48-e951-442f-97ca-b3e800c143cd",
|
||||
"revision_date": "2026-02-09 13:01:31.4122943 +0000 UTC",
|
||||
"value": "DB_DATABASE: cHJvd2xhcnItbWFpbg==testing\nDB_HOST: cHJvd2xhcnItZGItc3Zj\nDB_PASS: R29saWF0aC1EZWVwZW4tRGl2aWRpbmc3\nDB_USER: c2VydmFycl91c2VybmFtZQ=="
|
||||
},
|
||||
"sensitive_attributes": [
|
||||
[
|
||||
{
|
||||
"type": "get_attr",
|
||||
"value": "value"
|
||||
}
|
||||
]
|
||||
],
|
||||
"identity_schema_version": 0
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"mode": "data",
|
||||
"type": "bitwarden-secrets_secret",
|
||||
@@ -2521,7 +2465,7 @@
|
||||
"index_key": "fail2ban-50814edb-d190-41cb-8950-b3ee01622dcf",
|
||||
"schema_version": 0,
|
||||
"attributes": {
|
||||
"binary_data": null,
|
||||
"binary_data": {},
|
||||
"data": {
|
||||
"nginx-block-map.local": "## Version 2022/08/06\n# Fail2Ban configuration file for black-listing via nginx\n#\n# Author: Serg G. Brester (aka sebres)\n#\n# To use 'nginx-block-map' action you should define some special blocks in your nginx configuration,\n# and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx by ban).\n#\n# Example (argument \"token_id\" resp. cookie \"session_id\" used here as unique identifier for user):\n#\n# http {\n# ...\n# # maps to check user is blacklisted (banned in f2b):\n# #map $arg_token_id $blck_lst_tok { include blacklisted-tokens.map; }\n# map $cookie_session_id $blck_lst_ses { include blacklisted-sessions.map; }\n# ...\n# # special log-format to notify fail2ban about failures:\n# log_format f2b_session_errors '$msec failure \"$cookie_session_id\" - $remote_addr - $remote_user '\n# ;# '\"$request\" $status $bytes_sent '\n# # '\"$http_referer\" \"$http_user_agent\"';\n#\n# # location checking blacklisted values:\n# location ... {\n# # check banned sessionid:\n# if ($blck_lst_ses != \"\") {\n# try_files \"\" @f2b-banned;\n# }\n# ...\n# # notify fail2ban about a failure inside nginx:\n# error_page 401 = @notify-f2b;\n# ...\n# }\n# ...\n# # location for return with \"403 Forbidden\" if banned:\n# location @f2b-banned {\n# default_type text/html;\n# return 403 \"\u003cbr/\u003e\u003ccenter\u003e\n# \u003cb style=\\\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\\\"\u003e\n# You are banned!\u003c/b\u003e\u003c/center\u003e\";\n# }\n# ...\n# # location to notify fail2ban about a failure inside nginx:\n# location @notify-f2b {\n# access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;\n# }\n# }\n# ...\n#\n# Note that quote-character (and possibly other special characters) are not allowed currently as session-id.\n# Thus please add any session-id validation rule in your locations (or in the corresponding backend-service), \n# like in example below:\n#\n# location ... {\n# if ($cookie_session_id !~ \"^[\\w\\-]+$\") {\n# return 403 \"Wrong session-id\"\n# }\n# ...\n# }\n#\n# The parameters for jail corresponding log-format (f2b_session_errors):\n#\n# [nginx-blck-lst]\n# filter =\n# datepattern = ^Epoch\n# failregex = ^ failure \"\u003cF-ID\u003e[^\"]+\u003c/F-ID\u003e\" - \u003cADDR\u003e\n# usedns = no\n#\n# The same log-file can be used for IP-related jail (additionally to session-related, to ban very bad IPs):\n#\n# [nginx-blck-ip]\n# maxretry = 100\n# filter =\n# datepattern = ^Epoch\n# failregex = ^ failure \"[^\"]+\" - \u003cADDR\u003e\n# usedns = no\n#\n\n[Definition]\n\n# path to configuration of nginx (used to target nginx-instance in multi-instance system,\n# and as path for the blacklisted map):\n#srv_cfg_path = /etc/nginx/\n\nsrv_cfg_path = /blacklisted.d/\n\n# cmd-line arguments to supply to test/reload nginx:\n#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf\nsrv_cmd = nginx\n\n# pid file (used to check nginx is running):\nsrv_pid = /run/nginx.pid\n\n# command used to check whether nginx is running and configuration is valid:\nsrv_is_running = [ -f \"%(srv_pid)s\" ]\nsrv_check_cmd = %(srv_is_running)s \u0026\u0026 %(srv_cmd)s -qt\n\n# first test nginx is running and configuration is correct, hereafter send reload signal:\n#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then\n# %(srv_cmd)s -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;\n# fi;\n\nrestart_file = /restart-signal/restart.txt\n\nblck_lst_reload = touch %(restart_file)s;sleep 20; rm %(restart_file)s;\n\n# map-file for nginx, can be redefined using `action = nginx-block-map[blck_lst_file=\"/path/file.map\"]`:\nblck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf\n\n# Action definition:\n\nactionstart_on_demand = false\nactionstart = touch '%(blck_lst_file)s'\n\nactionflush = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s\n\nactionstop = %(actionflush)s\n\nactioncheck = \n\n_echo_blck_row = printf '\\%%s 1;\\n' \"\u003cfid\u003e\"\n\nactionban = echo \u003cip\u003e | awk -F. '{print \"deny \"$1\".\"$2\".\"$3\".\"$4\";\"}' \u003e\u003e '%(blck_lst_file)s'; %(blck_lst_reload)s\n\nactionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\\/$*.^|[]/\\\\\u0026/g'); sed -i \"/^$id$/d\" %(blck_lst_file)s; %(blck_lst_reload)s\n"
|
||||
},
|
||||
@@ -2529,10 +2473,10 @@
|
||||
"immutable": false,
|
||||
"metadata": [
|
||||
{
|
||||
"annotations": null,
|
||||
"annotations": {},
|
||||
"generate_name": "",
|
||||
"generation": 0,
|
||||
"labels": null,
|
||||
"labels": {},
|
||||
"name": "nginx-block-map-action",
|
||||
"namespace": "fail2ban",
|
||||
"resource_version": "218713306",
|
||||
@@ -2607,7 +2551,7 @@
|
||||
"index_key": "fail2ban-fb11452e-fec1-489f-9144-b3ee0162ccda",
|
||||
"schema_version": 0,
|
||||
"attributes": {
|
||||
"binary_data": null,
|
||||
"binary_data": {},
|
||||
"data": {
|
||||
"nginx-unauthorized.local": "## Version 2022/08/06\n# Fail2Ban filter configuration for nginx unauthorized\n\n[INCLUDES]\nbefore = common.conf\n\n[Definition]\n\n#original\n#failregex = ^\u003cHOST\u003e.*\"(GET|POST|HEAD).*\" (401) .*$\n\n\n#try this one\nfailregex = ^\u003cHOST\u003e - .* \"(?:GET|POST|HEAD) [^\"]+\" 401\n ^\u003cHOST\u003e - .* upstream_status=401\n #for servarr\n ^\u003cHOST\u003e -.*\"GET /login\\?returnUrl=/\u0026loginFailed=true HTTP/.*\" 200\n ^\u003cHOST\u003e -.*\"POST /login\\?returnUrl=/\u0026loginFailed=true HTTP/.*\" 200\n #for bitwarden\n ^\u003cHOST\u003e -.*\"POST /identity/accounts/prelogin *HTTP/.*\" 200\n#actionban = touch /tmp/\u003cname\u003e.ban\n#actionunban = touch /tmp/\u003cname\u003e.unban\n"
|
||||
},
|
||||
@@ -2615,10 +2559,10 @@
|
||||
"immutable": false,
|
||||
"metadata": [
|
||||
{
|
||||
"annotations": null,
|
||||
"annotations": {},
|
||||
"generate_name": "",
|
||||
"generation": 0,
|
||||
"labels": null,
|
||||
"labels": {},
|
||||
"name": "fail2ban-nginx-unauthorized-filter",
|
||||
"namespace": "fail2ban",
|
||||
"resource_version": "218713307",
|
||||
@@ -2648,47 +2592,6 @@
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"mode": "managed",
|
||||
"type": "kubernetes_config_map_v1_data",
|
||||
"name": "tf-bw-configmap",
|
||||
"provider": "provider[\"registry.terraform.io/hashicorp/kubernetes\"]",
|
||||
"instances": [
|
||||
{
|
||||
"schema_version": 0,
|
||||
"attributes": {
|
||||
"data": {
|
||||
"DB_DATABASE": "cHJvd2xhcnItbWFpbg==testing",
|
||||
"DB_HOST": "cHJvd2xhcnItZGItc3Zj",
|
||||
"DB_PASS": "R29saWF0aC1EZWVwZW4tRGl2aWRpbmc3",
|
||||
"DB_USER": "c2VydmFycl91c2VybmFtZQ=="
|
||||
},
|
||||
"field_manager": "Terraform",
|
||||
"force": null,
|
||||
"id": "echo-server/bitwarden-terraform",
|
||||
"metadata": [
|
||||
{
|
||||
"name": "bitwarden-terraform",
|
||||
"namespace": "echo-server"
|
||||
}
|
||||
]
|
||||
},
|
||||
"sensitive_attributes": [
|
||||
[
|
||||
{
|
||||
"type": "get_attr",
|
||||
"value": "data"
|
||||
}
|
||||
]
|
||||
],
|
||||
"identity_schema_version": 0,
|
||||
"private": "bnVsbA==",
|
||||
"dependencies": [
|
||||
"data.bitwarden-secrets_secret.secret"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"mode": "managed",
|
||||
"type": "kubernetes_deployment_v1",
|
||||
|
||||
+21
-21
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user