pi-ux-ce/Terraform_kube
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

restructuring the code

Browse Source
This commit is contained in:
pierre.geeraert
2026-10-07 15:18:36 +01:00
parent 013465ffec
commit 8c1b6cdef8
21 changed files with 2160 additions and 56189 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.bw-provider-state
-1
View File
@@ -1 +0,0 @@
2.pYoQjnuN9ZB+IqEypWrFPw==|/nlBG5qPy/zIFwYjjNXMuNWLU8pSt3TLR1/q4L3AEzi5Semc2261DyelXIfVpOn21JOGOV7jiIV6P3CSuASCjvCH+lCZSbjHfcj/MIOl3IBZJWF3vnTBVl3yjYD+Jmf0/zaYXbUW881oiO3Pu5Obc2jiBKNlX2bx5H11Iyi/fOmvR+EgsdequGgRm0FiSkjkbyG8d9bR55XR9NtS5x9a8EOhKWu0yXFGAKkDGV/m+j45z20mVTlAuuNDtIOX/rDKdKJpzg6SF8EuRTGC5RWAHJ+V8BACe3xxHi43YFit5RjpQ83F6rUGc+hc7TTcKyLA0Go7vUnKQ2wljSihM+HgJbGI6Sgnc9/Ys9AyDI0Bfz4EntfUqSeMBoaatvGpe3LYZdGysUMtDUoQWAvEfKbnnTKQRJb6zTD0RjhJ1ZowrrUFXyU9s1kNu3Sx29Q6h926lIiZ7kNejLcBEIJm0NjifAT9E0dwWTC6/bM2NrQpAotQBQGKGOGGRPIQW8vM7EJ6pl3ZSM/RzRnvQEdmWLNTbLd5eUd0efTviQr4BTxhwj7m3UGBUI/ZQhd3UNTU2ZVpt93nY2QPW3EpNpPBdYMnAgqbc3iz9mGZKtUwYpCwEpHj2G0CxCjgoj8il3Ys+vpPbYqpx+/FbibQLsELAbvLtK/TnDT5tq2gCYIHNUYL+iO+rdm8uGVWcFeMUBvyC/sdHEJgnQ3Rf6Up8lhgP3NQu6QgWT5gkGRrJ4RoYYET9919FOas43imUfWLEAaL/iU+NliGj3B0gCnwi1Ljm4+k5MOVHJqgcBdh0LHhNgIQcBurV0Qk8ZkoVnkTBjTMduOGogn9+Ny7B5D28nk8VW4fHL9MsgvYTZXZmI0QKgS2YzTmkle916qGLWgo5hcp5V4MG1EBpchzu0JJUUdPrb06txBr+cCCYvGi1B2epw6nJAJ7OGB4vzcJM/kVQYRVQmV/kfWXxtROCkx3CAKG5oyKMiiPcUiiqIIYuhRUEZYPC9+w67nMANPG8VcyqylcEba/FMSn4ECj7ce2iHCnyAnk9wb78P/YZdNMGbgviJq1nZm+OaGmpMxEoZHpyOe3EmuEKNpuSgqXGygR6ltAqzFRNJJlHm1PLHWxp4n4n5E1VhbaFiN2urTn/Pt2hqh0YEHyRVYYDSJv5QL8Dqq7WVYD2V3waLwi5Q5o6jc2XkaGN3hLg0fH7yO9KMa+MGUIcx5TZX+QGwiB4n/rZijV2h9d7th/tn0+/Gxtz+JcZ9J+4j4/1MR89vGe1EFOl9ZpUYxQVTVNuLoPaql5dXJZf3LeLL3fq05yNyW38NzcT5fFjevSRyRyoTHTrePCr5Tk5D0BaNQDhgDvBtC1kdo72HKR0+y1x31TxzLmc3OMBj2iqMxt0V7snwUfuVYu43LY48YML3wxRe/EVDmP6h8H89JWkw1aCJsLInN7hDSpUJtGBIn30c5r2kSw/87iVskVnQAUsQFMPOzUmDm6E07fnysbPwuAECuha93aMljzQNF4mwd6Pey24Pkfl+K7wypOL94iK1GcM4FqsCpNfD/X1M3Z+AVQahXAtUt82wmaXfQUtQ6Dvt6mfwFnknmWpyI9Pbj3r8lh4M5rffMFucJac32eoq+KY9xdhyPyep0becLQxNog2LiWliSQlfKBoB3X9FSyDalwEasWagUvNdENqkL+GWCxlCZK7g+ibvO5keA0Baqt1ohRcBoigNfmcTsZUPRhq+dy2cvaiPaGRDgX2DKlJdC8LnPDb/qTvk+uP5yZaKSItjdFkYo7c+fbOXH+I93Kd9IK+LJVM+9cWnx6yKBW/TaaEuZCBholtxME8ZQDcnXIelp67IamsfuVb5QNouZuimzb9rP9vEDVTdyE3e5rYzl2AaljMdTIjB1ut5ZqGA8=|hem/6+QHhqSdcTgKycZLP9EDBT3JA8fLIUqETgTITNk=
.bitwarden/device_identifier → applications/.bitwarden/device_identifier
View File
cronjob.tf.20260813 → applications/cronjob.tf.20260813
View File
module.tf → applications/module.tf
View File
nginx_config.tftpl → applications/nginx_config.tftpl
View File
redis.tf → applications/redis.tf
View File
variables.auto.tfvars.save → applications/variables.auto.tfvars.save
View File
variables.auto.tfvars.save.1 → applications/variables.auto.tfvars.save.1
View File
core/database.tf
+146
View File
@@ -0,0 +1,146 @@
resource "kubernetes_deployment_v1" "database-automatic" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) && value.docker != true }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${coalesce(each.value.name, each.key)}-db"
labels = {
app = each.key
deployment_method = "Terraform"
database = "true"
}
}
spec {
replicas = each.value.replicas
selector {
match_labels = {
app = "${each.key}-db"
}
}
template {
metadata {
labels = {
app = "${each.key}-db"
deployment_method = "Terraform"
database = "true"
}
}
spec {
container {
image = try(each.value.database.image, "docker.io/library/postgres:latest")
name = "${coalesce(each.value.name, each.key)}-db"
port {
container_port = 5432
name = "database-port"
}
volume_mount {
mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/")
name = "${each.key}-db-pvc"
}
dynamic "volume_mount" {
for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
content {
mount_path = "/backup"
name = "${each.key}-db-backup"
}
}
command = try([each.value.database.command], [])
args = each.value.database_args != null ? each.value.database_args : []
dynamic "env_from" {
for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
content {
dynamic "secret_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
dynamic "env" {
for_each = each.value.environment != null ? each.value.environment : {}
content {
name = env.key
value = env.value.value != null ? env.value.value : null
dynamic "value_from" {
for_each = env.value.value_from != null ? env.value.value_from : {}
content {
dynamic "secret_key_ref" {
for_each = [1]
content {
name = env.value.value_from.secret_key_ref.name
key = env.value.value_from.secret_key_ref.key
# optional = true
}
}
}
}
}
}
}
volume {
name = "${each.key}-db-pvc"
persistent_volume_claim {
claim_name = "${each.key}-db-pvc"
}
}
dynamic "volume" {
for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
content {
name = "${each.key}-db-backup"
persistent_volume_claim {
claim_name = "${each.key}-db-backup"
}
}
}
}
}
}
}
resource "docker_container" "database-automatic" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) && value.docker == true }
image = try(each.value.database.image, "docker.io/library/postgres:latest")
name = "${coalesce(each.value.name, each.key)}-db"
hostname = "${coalesce(each.value.name, each.key)}-db"
networks_advanced {
name = docker_network.terraform_network.name
}
#no ports as they should be able to speak within the same network
volumes {
container_path = try(each.value.database.mountPath, "/var/lib/postgresql/")
host_path = each.value.database.host_path
}
env = [
for key, value in(each.value.environment != null ? each.value.environment : {}) :
"${key}=${value.value != null ? value.value : ""}"
]
}
core/deployment.tf
+280
View File
@@ -0,0 +1,280 @@
resource "kubernetes_deployment_v1" "automatic" {
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true && value.docker != true }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = coalesce(each.value.name, each.key)
labels = {
app = each.key
deployment_method = "Terraform"
}
}
spec {
replicas = each.value.replicas
selector {
match_labels = {
app = each.key
}
}
template {
metadata {
labels = {
app = each.key
deployment_method = "Terraform"
}
}
spec {
container {
image = each.value.image
name = coalesce(each.value.name, each.key)
dynamic "port" {
for_each = each.value.service_port != null ? each.value.service_port : []
content {
container_port = port.value
# name = "${each.key}-${port.value}"
name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
}
}
dynamic "volume_mount" {
for_each = each.value.pvc != null ? each.value.pvc : {}
content {
mount_path = volume_mount.value.mount_path
name = "${volume_mount.value.name}-pvc"
sub_path = volume_mount.value.sub_path != null ? volume_mount.value.sub_path : ""
}
}
dynamic "volume_mount" {
for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
content {
mount_path = "/backup"
name = "${each.key}-db-backup"
}
}
dynamic "env_from" {
for_each = each.value.secret_ref != null ? each.value.secret_ref : []
content {
dynamic "secret_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
dynamic "env_from" {
for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
#for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-terraform"] : []
content {
dynamic "secret_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
dynamic "env_from" {
for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-mapped-terraform"] : []
content {
dynamic "secret_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
dynamic "env_from" {
for_each = each.value.config_map_ref != null ? each.value.config_map_ref : []
content {
dynamic "config_map_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
command = each.value.command != null ? each.value.command : []
dynamic "env" {
for_each = each.value.environment != null ? each.value.environment : {}
content {
name = env.key
value = env.value.value != null ? env.value.value : null
dynamic "value_from" {
for_each = env.value.value_from != null ? env.value.value_from : {}
content {
dynamic "secret_key_ref" {
for_each = [1]
content {
name = env.value.value_from.secret_key_ref.name
key = env.value.value_from.secret_key_ref.key
}
}
}
}
}
}
dynamic "resources" {
for_each = each.value.requirements != null ? [1] : []
content {
limits = {
cpu = each.value.requirements.limits-cpu
memory = each.value.requirements.limits-memory
}
requests = {
cpu = each.value.requirements.requests-cpu
memory = each.value.requirements.requests-memory
}
}
}
dynamic "security_context" {
for_each = each.value.security_context == true ? [1] : []
content {
privileged = true
#capabilities = {
# add : ["NET_ADMIN", "NET_RAW"]
#}
}
}
dynamic "liveness_probe" {
for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
content {
dynamic "tcp_socket" {
for_each = each.value.liveness_tcp_socket != null ? [""] : []
content {
port = each.value.liveness_tcp_socket
}
}
dynamic "http_get" {
for_each = each.value.liveness_http_get != null ? [""] : []
content {
port = each.value.liveness_http_get
path = coalesce(each.value.liveness_http_get_path, "/")
}
}
initial_delay_seconds = 3
period_seconds = 3
}
}
}
dynamic "dns_config" {
for_each = each.value.dns_nameservers != null ? [1] : []
content {
nameservers = [each.value.dns_nameservers]
}
}
service_account_name = each.value.service_account_name != null ? each.value.service_account_name : null
dynamic "volume" {
for_each = each.value.pvc != null ? each.value.pvc : {}
content {
name = "${volume.value.name}-pvc"
dynamic "persistent_volume_claim" {
for_each = volume.value.pvc ? [1] : []
content {
claim_name = "${volume.value.name}-pvc"
}
}
dynamic "config_map" {
for_each = volume.value.config_map ? [1] : []
content {
name = volume.value.name
}
}
dynamic "host_path" {
for_each = volume.value.host_path != null ? [1] : []
content {
path = volume.value.host_path
}
}
dynamic "secret" {
for_each = volume.value.secret ? [1] : []
content {
secret_name = volume.value.name
}
}
}
}
dynamic "volume" {
for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
content {
name = "${each.key}-db-backup"
persistent_volume_claim {
claim_name = "${each.key}-db-backup"
}
}
}
}
}
}
depends_on = [kubernetes_persistent_volume_claim_v1.automatic-pvc]
}
resource "docker_container" "deployment-automatic" {
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true && value.docker == true }
image = each.value.image
name = coalesce(each.value.name, each.key)
hostname = coalesce(each.value.name, each.key)
depends_on = [docker_container.database-automatic]
networks_advanced {
name = "deployment_network"
}
dynamic "ports" {
for_each = each.value.service_port != null ? each.value.service_port : []
content {
internal = ports.value
external = each.value.external_port ? ports.value : null
}
}
dynamic "volumes" {
for_each = each.value.pvc != null ? each.value.pvc : {}
content {
container_path = volumes.value.mount_path
host_path = volumes.value.host_path
}
}
env = [
for key, value in(each.value.environment != null ? each.value.environment : {}) :
"${key}=${value.value != null ? value.value : ""}"
]
# null keeps the image's default command; [] would differ from it in state and force replacement
command = each.value.command
}
core/module.tf
+146
View File
@@ -0,0 +1,146 @@
terraform {
required_version = "> 0.8.0"
required_providers {
docker = {
source = "kreuzwerker/docker"
version = "4.6.0"
}
}
}
provider "kubernetes" {
config_path = "~/.kube/config"
}
provider "docker" {
host = "unix:///var/run/docker.sock"
}
variable "kubernetes" {
type = map(object({
name = optional(string)
docker = optional(bool)
image = string
pvc = optional(map(object({
name = string
pvc = optional(bool, false)
config_map = optional(bool, false)
secret = optional(bool, false)
host_path = optional(string)
pvc_size = optional(string)
storage_class_name = optional(string, "nfs-storage-intelligent")
annotations_fileType = optional(string)
existing_pvc = optional(bool, false)
mount_path = string
sub_path = optional(string)
})))
environment = optional(map(object({
name = optional(string)
value = optional(string)
value_from = optional(object({
secret_key_ref = object({
name = string
key = optional(string, null)
})
}))
})))
replicas = optional(number, 1)
namespace = optional(string)
connected_namespace = optional(string, "")
command = optional(list(string))
service_port = optional(list(number))
external_port = optional(bool, false)
service_type = optional(string, "ClusterIP")
service_name = optional(string)
domain_name = optional(string)
liveness_tcp_socket = optional(number)
liveness_http_get = optional(string)
liveness_http_get_path = optional(string)
database = optional(map(string))
database_command = optional(list(string))
database_args = optional(list(string))
redis = optional(map(string))
enabled = optional(bool, true)
secret_ref = optional(list(string))
config_map_ref = optional(list(string))
config_map_import = optional(list(string))
secret_import = optional(list(string))
extra_manifest = optional(list(string))
requirements = optional(map(string))
dns_nameservers = optional(string)
service_account_name = optional(string)
environment_variables = optional(map(string), { name = "value" })
security_context = optional(bool, false)
}))
}
locals {
pvc_list = flatten([
for key, value in var.kubernetes : [
for index, pvc in value.pvc : {
key = "${coalesce(value.namespace, value.connected_namespace, key)}/${pvc.name}"
index = index
pvc = pvc.pvc
name = pvc.name
pvc_size = pvc.pvc_size
mount_path = pvc.mount_path
storage_class_name = pvc.storage_class_name
annotations_fileType = pvc.annotations_fileType
existing_pvc = pvc.existing_pvc
sub_path = pvc.sub_path
namespace = coalesce(value.namespace, value.connected_namespace, key)
}] if value.enabled == true && value.pvc != null && value.docker != true
])
# group duplicates instead of throwing an error
pvc_map_grouped = {
for p in local.pvc_list :
p.key => p...
}
# keep only one PVC per key (take the first)
pvc_map = {
for k, list in local.pvc_map_grouped :
k => list[0]
}
pvc_details = values(local.pvc_map)
}
locals {
env_details = flatten([
for key, value in var.kubernetes : [
for index, env in value.environment_variables : {
index = index
name = env
}] if value.enabled == true && value.environment_variables != null && value.docker != true
])
}
locals {
kubernetes_manifests = flatten([
for k, obj in var.kubernetes : [
for index, manifest in(obj.extra_manifest != null ? obj.extra_manifest : []) :
{
key = "${k}_${index}"
name = obj.name
manifest = manifest
enabled = obj.enabled
}
if obj.enabled == true
]
])
}
resource "kubernetes_manifest" "manifest" {
for_each = { for item in local.kubernetes_manifests : item.key => item }
manifest = yamldecode(file(each.value.manifest))
provider = kubernetes
}
core/redis.tf
+125
View File
@@ -0,0 +1,125 @@
resource "kubernetes_deployment_v1" "redis-automatic" {
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true && value.docker != true }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${coalesce(each.value.name, each.key)}-redis"
labels = {
app = each.key
deployment_method = "Terraform"
redis = "true"
}
}
spec {
replicas = each.value.replicas
selector {
match_labels = {
app = "${each.key}-redis"
}
}
template {
metadata {
labels = {
app = "${each.key}-redis"
deployment_method = "Terraform"
redis = "true"
}
}
spec {
container {
image = try(each.value.redis.image, "docker.io/library/redis:7")
name = "${coalesce(each.value.name, each.key)}-redis"
port {
container_port = 6379
name = "redis-port"
}
volume_mount {
mount_path = "/data"
name = "${each.key}-redis-pvc"
}
dynamic "env" {
for_each = each.value.environment != null ? each.value.environment : {}
content {
name = env.key
value = env.value.value != null ? env.value.value : null
dynamic "value_from" {
for_each = env.value.value_from != null ? env.value.value_from : {}
content {
dynamic "secret_key_ref" {
for_each = [1]
content {
name = env.value.value_from.secret_key_ref.name
key = env.value.value_from.secret_key_ref.key
# optional = true
}
}
}
}
}
}
# resources {
# limits = {
# cpu = each.value.requirements.limits-cpu
# memory = each.value.requirements.limits-memory
# }
# requests = {
# cpu = each.value.requirements.requests-cpu
# memory = each.value.requirements.requests-memory
# }
# }
# dynamic "liveness_probe" {
# for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
# content {
# dynamic "tcp_socket" {
# for_each = each.value.liveness_tcp_socket != null ? [""] : []
# content {
# port = each.value.liveness_tcp_socket
# }
# }
# dynamic "http_get" {
# for_each = each.value.liveness_http_get != null ? [""] : []
# content {
# port = each.value.liveness_http_get
# path = coalesce(each.value.liveness_http_get_path, "/")
# }
# }
# initial_delay_seconds = 3
# period_seconds = 3
# }
# }
}
volume {
name = "${each.key}-redis-pvc"
persistent_volume_claim {
claim_name = "${each.key}-redis-pvc"
}
}
}
}
}
}
core/services.tf
+93
View File
@@ -0,0 +1,93 @@
resource "kubernetes_service_v1" "automatic_service" {
for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true && value.docker != true }
metadata {
name = "${each.key}-svc"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
labels = {
deployment_method = "Terraform"
}
annotations = each.value.service_type == "LoadBalancer" ? {
"metallb.universe.tf/ip-allocated-from-pool" = "first-pool"
} : {}
}
spec {
selector = {
app = each.key
}
dynamic "port" {
for_each = each.value.service_port != null ? each.value.service_port : []
content {
port = port.value
target_port = port.value
name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
}
}
# port {
# port = each.value.service_port
# target_port = each.value.service_port
# }
type = each.value.service_type
}
}
resource "kubernetes_service_v1" "automatic_service_database" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) && value.docker != true }
metadata {
name = "${each.key}-db-svc"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
labels = {
deployment_method = "Terraform"
#username = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_password[each.key].key}"
}
}
spec {
selector = {
app = "${each.key}-db"
}
port {
port = try(each.value.database.port, 5432)
target_port = try(each.value.database.port, 5432)
}
}
}
resource "kubernetes_service_v1" "automatic_service_redis" {
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true && value.docker != true }
metadata {
name = "${each.key}-redis-svc"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
labels = {
deployment_method = "Terraform"
}
}
spec {
selector = {
app = "${each.key}-redis"
}
port {
port = 6379
target_port = 6379
}
}
}
resource "docker_network" "terraform_network" {
name = "deployment_network"
}
core/storage.tf
+86
View File
@@ -0,0 +1,86 @@
resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc" {
for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc && value.existing_pvc != true && value.docker != true }
metadata {
namespace = coalesce(each.value.namespace, each.key)
name = "${each.value.name}-pvc"
labels = {
deployment_method = "Terraform"
}
annotations = {
fileType = try(each.value.annotations_fileType, "file")
}
}
spec {
access_modes = ["ReadWriteMany"]
storage_class_name = each.value.storage_class_name
resources {
requests = {
storage = each.value.pvc_size
}
}
}
}
resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-database" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) && value.docker != true }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${each.key}-db-pvc"
labels = {
deployment_method = "Terraform"
}
}
spec {
access_modes = ["ReadWriteMany"]
storage_class_name = "nfs-storage-intelligent"
resources {
requests = {
storage = "1Gi"
}
}
}
}
resource "kubernetes_persistent_volume_claim_v1" "backup-pvc-database" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && value.docker != true }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${each.key}-db-backup"
labels = {
deployment_method = "Terraform"
}
annotations = {
fileType = "Backup" }
}
spec {
access_modes = ["ReadWriteMany"]
storage_class_name = "nfs-storage-fastaccess"
resources {
requests = {
storage = "1Gi"
}
}
}
}
resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-redis" {
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true && value.docker != true }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${each.key}-redis-pvc"
labels = {
deployment_method = "Terraform"
}
}
spec {
access_modes = ["ReadWriteMany"]
storage_class_name = "nfs-storage-intelligent"
resources {
requests = {
storage = "1Gi"
}
}
}
}
infrastructure/module.tf
+1057
View File
File diff suppressed because it is too large Load Diff
pvc.claim.yaml
-18
View File
@@ -1,18 +0,0 @@
apiVersion: v1
kind: Namespace
metadata:
name: screeps
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: screeps-storage
namespace: screeps
spec:
storageClassName: nfs-storage-intelligent
accessModes:
- ReadWriteMany
resources:
requests:
storage: 20Gi
reverse-proxy/module.tf
+83
View File
@@ -0,0 +1,83 @@
terraform {
required_version = "> 0.8.0"
}
provider "kubernetes" {
config_path = "~/.kube/config"
}
variable "shunt_kubernetes" {
type = bool
default = true
}
variable "nginx_sites" {
type = map(object({
service = string
docker_service = optional(string)
enabled = optional(bool, true)
proxy_cache = optional(bool, false)
extra-value = optional(string, "")
extra-value-location = optional(string, "")
http2_bool = optional(bool, false)
proxy_pass_https = optional(bool, false)
authentication_required = optional(bool, false)
redirect_to_https_bool = optional(bool, true)
listen_port_80_bool = optional(bool, false)
geoip_blocking = optional(bool, false)
geoip_allow = optional(list(string), ["FR", "GB"])
redirect_to_root_domain = optional(bool, true)
}))
}
resource "kubernetes_config_map" "automatic-configmap" {
#avoiding this to create if the shunt_kubernetes is on
count = var.shunt_kubernetes ? 0 : 1
metadata {
name = "sites-terraform"
namespace = "reverse-proxy"
annotations = {
"reloader.stakater.com/match" : "true",
}
}
data = {
for key, value in var.nginx_sites :
"${key}.conf" => templatefile("nginx_config.tftpl", {
name_site = key
name_service = value.service
proxy_cache = value.proxy_cache
extra-value = value.extra-value
extra-value-location = value.extra-value-location
http2_bool = value.http2_bool
proxy_pass_https = value.proxy_pass_https
authentication_required = value.authentication_required
redirect_to_https_bool = value.redirect_to_https_bool
listen_port_80_bool = value.listen_port_80_bool
geoip_blocking = value.geoip_blocking
geoip_allow = value.geoip_allow
redirect_to_root_domain = value.redirect_to_root_domain
}) if value.enabled == true
}
}
resource "local_file" "nginx_configs" {
for_each = { for key, value in var.nginx_sites : key => value if value.enabled == true && value.docker_service != null }
filename = "/data/kubernetes/reverse-proxy/reverse-proxy-sites/${each.key}.conf"
content = templatefile("nginx_config.tftpl", {
name_site = each.key
name_service = each.value.docker_service
proxy_cache = each.value.proxy_cache
extra-value = each.value.extra-value
extra-value-location = each.value.extra-value-location
http2_bool = each.value.http2_bool
proxy_pass_https = each.value.proxy_pass_https
authentication_required = each.value.authentication_required
redirect_to_https_bool = each.value.redirect_to_https_bool
listen_port_80_bool = each.value.listen_port_80_bool
redirect_to_root_domain = each.value.redirect_to_root_domain
})
}
reverse-proxy/nginx_config.tftpl
+144
View File
@@ -0,0 +1,144 @@
############################################
# config file for ${name_site}
############################################
upstream ${name_site}_backend {
server ${name_service};
server 1.1.1.1 backup;
}
server {
server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
%{~ if redirect_to_root_domain~}
if ($host = www.${name_site}.tryton.geeraert.eu) {
return 301 https://${name_site}.geeraert.eu$request_uri;
}
if ($host = ${name_site}.tryton.geeraert.eu) {
return 301 https://${name_site}.geeraert.eu$request_uri;
}
%{~ endif ~}
%{ if redirect_to_root_domain != true }
location / {
proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Host $host;
${extra-value-location}
}
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
%{ endif }
access_log /var/log/nginx/access.log my_custom_format;
access_log /var/log/nginx/ip_audit.log ip_audit;
access_log /var/log/nginx/backend_debug.log backend_debug;
${extra-value}
%{~ if http2_bool~}
http2 on;
ssl_protocols TLSv1.2;
%{~ endif ~}
listen 443 ssl;
%{~ if listen_port_80_bool~}
listen 80;
%{~ endif ~}
ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
}
%{~ if redirect_to_https_bool~}
server {
if ($host = www.${name_site}.tryton.geeraert.eu) {
return 301 https://$host$request_uri;
}
if ($host = ${name_site}.tryton.geeraert.eu) {
return 301 https://$host$request_uri;
}
server_name www.${name_site}.tryton.geeraert.eu ${name_site}.tryton.geeraert.eu ;
listen 80;
return 404;
}
%{~ endif ~}
############################################
# config file for ${name_site}
############################################
upstream ${name_site}_backend_root {
server ${name_service};
server 1.1.1.1 backup;
}
server {
server_name ${name_site}.geeraert.eu www.${name_site}.geeraert.eu;
location / {
proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend_root;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Host $host;
${extra-value-location}
}
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
access_log /var/log/nginx/access.log my_custom_format;
access_log /var/log/nginx/ip_audit.log ip_audit;
access_log /var/log/nginx/backend_debug.log backend_debug;
${extra-value}
%{~ if http2_bool~}
http2 on;
ssl_protocols TLSv1.2;
%{~ endif ~}
listen 443 ssl;
%{~ if listen_port_80_bool~}
listen 80;
%{~ endif ~}
ssl_certificate /etc/nginx/ssl/live/geeraert.eu/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/live/geeraert.eu/privkey.pem;
}
%{~ if redirect_to_https_bool~}
server {
if ($host = www.${name_site}.geeraert.eu) {
return 301 https://$host$request_uri;
}
if ($host = ${name_site}.geeraert.eu) {
return 301 https://$host$request_uri;
}
server_name www.${name_site}.geeraert.eu ${name_site}.geeraert.eu ;
listen 80;
return 404;
}
%{~ endif ~}
terraform.tfstate
-26638
View File
File diff suppressed because one or more lines are too long
terraform.tfstate.backup
-26638
View File
File diff suppressed because one or more lines are too long
variables.auto.tfvars
-2894
View File
File diff suppressed because it is too large Load Diff