restructuring the code
This commit is contained in:
pierre.geeraert
@@ -0,0 +1,83 @@
|
||||
terraform {
|
||||
required_version = "> 0.8.0"
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
config_path = "~/.kube/config"
|
||||
}
|
||||
|
||||
variable "shunt_kubernetes" {
|
||||
type = bool
|
||||
default = true
|
||||
}
|
||||
|
||||
variable "nginx_sites" {
|
||||
type = map(object({
|
||||
service = string
|
||||
docker_service = optional(string)
|
||||
enabled = optional(bool, true)
|
||||
proxy_cache = optional(bool, false)
|
||||
extra-value = optional(string, "")
|
||||
extra-value-location = optional(string, "")
|
||||
http2_bool = optional(bool, false)
|
||||
proxy_pass_https = optional(bool, false)
|
||||
authentication_required = optional(bool, false)
|
||||
redirect_to_https_bool = optional(bool, true)
|
||||
listen_port_80_bool = optional(bool, false)
|
||||
geoip_blocking = optional(bool, false)
|
||||
geoip_allow = optional(list(string), ["FR", "GB"])
|
||||
redirect_to_root_domain = optional(bool, true)
|
||||
}))
|
||||
|
||||
}
|
||||
|
||||
resource "kubernetes_config_map" "automatic-configmap" {
|
||||
#avoiding this to create if the shunt_kubernetes is on
|
||||
count = var.shunt_kubernetes ? 0 : 1
|
||||
metadata {
|
||||
name = "sites-terraform"
|
||||
namespace = "reverse-proxy"
|
||||
annotations = {
|
||||
"reloader.stakater.com/match" : "true",
|
||||
}
|
||||
}
|
||||
|
||||
data = {
|
||||
for key, value in var.nginx_sites :
|
||||
"${key}.conf" => templatefile("nginx_config.tftpl", {
|
||||
name_site = key
|
||||
name_service = value.service
|
||||
proxy_cache = value.proxy_cache
|
||||
extra-value = value.extra-value
|
||||
extra-value-location = value.extra-value-location
|
||||
http2_bool = value.http2_bool
|
||||
proxy_pass_https = value.proxy_pass_https
|
||||
authentication_required = value.authentication_required
|
||||
redirect_to_https_bool = value.redirect_to_https_bool
|
||||
listen_port_80_bool = value.listen_port_80_bool
|
||||
geoip_blocking = value.geoip_blocking
|
||||
geoip_allow = value.geoip_allow
|
||||
redirect_to_root_domain = value.redirect_to_root_domain
|
||||
}) if value.enabled == true
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
resource "local_file" "nginx_configs" {
|
||||
for_each = { for key, value in var.nginx_sites : key => value if value.enabled == true && value.docker_service != null }
|
||||
|
||||
filename = "/data/kubernetes/reverse-proxy/reverse-proxy-sites/${each.key}.conf"
|
||||
content = templatefile("nginx_config.tftpl", {
|
||||
name_site = each.key
|
||||
name_service = each.value.docker_service
|
||||
proxy_cache = each.value.proxy_cache
|
||||
extra-value = each.value.extra-value
|
||||
extra-value-location = each.value.extra-value-location
|
||||
http2_bool = each.value.http2_bool
|
||||
proxy_pass_https = each.value.proxy_pass_https
|
||||
authentication_required = each.value.authentication_required
|
||||
redirect_to_https_bool = each.value.redirect_to_https_bool
|
||||
listen_port_80_bool = each.value.listen_port_80_bool
|
||||
redirect_to_root_domain = each.value.redirect_to_root_domain
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,144 @@
|
||||
############################################
|
||||
# config file for ${name_site}
|
||||
############################################
|
||||
|
||||
upstream ${name_site}_backend {
|
||||
server ${name_service};
|
||||
server 1.1.1.1 backup;
|
||||
}
|
||||
|
||||
|
||||
server {
|
||||
server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
|
||||
|
||||
|
||||
%{~ if redirect_to_root_domain~}
|
||||
if ($host = www.${name_site}.tryton.geeraert.eu) {
|
||||
return 301 https://${name_site}.geeraert.eu$request_uri;
|
||||
}
|
||||
|
||||
|
||||
if ($host = ${name_site}.tryton.geeraert.eu) {
|
||||
return 301 https://${name_site}.geeraert.eu$request_uri;
|
||||
}
|
||||
|
||||
%{~ endif ~}
|
||||
%{ if redirect_to_root_domain != true }
|
||||
|
||||
location / {
|
||||
proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Host $host;
|
||||
${extra-value-location}
|
||||
|
||||
|
||||
}
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
%{ endif }
|
||||
|
||||
access_log /var/log/nginx/access.log my_custom_format;
|
||||
access_log /var/log/nginx/ip_audit.log ip_audit;
|
||||
access_log /var/log/nginx/backend_debug.log backend_debug;
|
||||
${extra-value}
|
||||
%{~ if http2_bool~}
|
||||
http2 on;
|
||||
ssl_protocols TLSv1.2;
|
||||
%{~ endif ~}
|
||||
|
||||
listen 443 ssl;
|
||||
%{~ if listen_port_80_bool~}
|
||||
listen 80;
|
||||
%{~ endif ~}
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;
|
||||
ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
|
||||
|
||||
|
||||
|
||||
}
|
||||
%{~ if redirect_to_https_bool~}
|
||||
|
||||
server {
|
||||
if ($host = www.${name_site}.tryton.geeraert.eu) {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
|
||||
if ($host = ${name_site}.tryton.geeraert.eu) {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
server_name www.${name_site}.tryton.geeraert.eu ${name_site}.tryton.geeraert.eu ;
|
||||
listen 80;
|
||||
return 404;
|
||||
|
||||
}
|
||||
%{~ endif ~}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
############################################
|
||||
# config file for ${name_site}
|
||||
############################################
|
||||
|
||||
upstream ${name_site}_backend_root {
|
||||
server ${name_service};
|
||||
server 1.1.1.1 backup;
|
||||
}
|
||||
|
||||
server {
|
||||
server_name ${name_site}.geeraert.eu www.${name_site}.geeraert.eu;
|
||||
|
||||
location / {
|
||||
proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend_root;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Host $host;
|
||||
${extra-value-location}
|
||||
|
||||
|
||||
}
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
|
||||
access_log /var/log/nginx/access.log my_custom_format;
|
||||
access_log /var/log/nginx/ip_audit.log ip_audit;
|
||||
access_log /var/log/nginx/backend_debug.log backend_debug;
|
||||
${extra-value}
|
||||
%{~ if http2_bool~}
|
||||
http2 on;
|
||||
ssl_protocols TLSv1.2;
|
||||
%{~ endif ~}
|
||||
|
||||
listen 443 ssl;
|
||||
%{~ if listen_port_80_bool~}
|
||||
listen 80;
|
||||
%{~ endif ~}
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/live/geeraert.eu/fullchain.pem;
|
||||
ssl_certificate_key /etc/nginx/ssl/live/geeraert.eu/privkey.pem;
|
||||
|
||||
|
||||
|
||||
}
|
||||
%{~ if redirect_to_https_bool~}
|
||||
|
||||
server {
|
||||
if ($host = www.${name_site}.geeraert.eu) {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
|
||||
if ($host = ${name_site}.geeraert.eu) {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
server_name www.${name_site}.geeraert.eu ${name_site}.geeraert.eu ;
|
||||
listen 80;
|
||||
return 404;
|
||||
|
||||
}
|
||||
%{~ endif ~}
|
||||
Reference in New Issue
Block a user