From ad69271f0185b3609740df039b3b2ef80a851101 Mon Sep 17 00:00:00 2001 From: pierre Date: Mon, 24 Nov 2025 19:28:18 +0000 Subject: [PATCH] add files before tuching bitwarden --- module.tf | 66 +++-- variables.auto.tfvars | 674 ++++++++++++++++++++++++++++++++++++++---- 2 files changed, 665 insertions(+), 75 deletions(-) diff --git a/module.tf b/module.tf index ca20121..8150812 100644 --- a/module.tf +++ b/module.tf @@ -12,14 +12,16 @@ variable "kubernetes" { name = optional(string) image = string pvc = optional(map(object({ - name = string - pvc = optional(bool, false) - config_map = optional(bool, false) - secret = optional(bool, false) - host_path = optional(string) - pvc_size = optional(string) - storage_class_name = optional(string, "nfs-storage-intelligent") - mount_path = string + name = string + pvc = optional(bool, false) + config_map = optional(bool, false) + secret = optional(bool, false) + host_path = optional(string) + pvc_size = optional(string) + storage_class_name = optional(string, "nfs-storage-intelligent") + annotations_fileType = optional(string) + existing_pvc = optional(bool, false) + mount_path = string }))) environment = optional(map(object({ name = optional(string) @@ -38,6 +40,7 @@ variable "kubernetes" { service_port = optional(list(number)) service_type = optional(string, "ClusterIP") service_name = optional(string) + domain_name = optional(string) liveness_tcp_socket = optional(number) liveness_http_get = optional(string) liveness_http_get_path = optional(string) @@ -65,13 +68,15 @@ locals { pvc_details = flatten([ for key, value in var.kubernetes : [ for index, pvc in value.pvc : { - index = index - pvc = pvc.pvc - name = pvc.name - pvc_size = pvc.pvc_size - mount_path = pvc.mount_path - storage_class_name = pvc.storage_class_name - namespace = coalesce(value.namespace, value.connected_namespace, key) + index = index + pvc = pvc.pvc + name = pvc.name + pvc_size = pvc.pvc_size + mount_path = pvc.mount_path + storage_class_name = pvc.storage_class_name + annotations_fileType = pvc.annotations_fileType + existing_pvc = pvc.existing_pvc + namespace = coalesce(value.namespace, value.connected_namespace, key) }] if value.enabled == true && value.pvc != null ]) } @@ -128,14 +133,19 @@ resource "kubernetes_manifest" "manifest" { resource "kubernetes_persistent_volume_claim" "automatic-pvc" { - for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc } + for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc && value.existing_pvc != true } metadata { namespace = coalesce(each.value.namespace, each.key) name = "${each.value.name}-pvc" labels = { deployment_method = "Terraform" } + annotations = { + fileType = try(each.value.annotations_fileType, "file") + } + } + spec { access_modes = ["ReadWriteMany"] storage_class_name = each.value.storage_class_name @@ -542,9 +552,8 @@ resource "kubernetes_deployment_v1" "database-automatic" { name = "${each.key}-db-pvc" } - - - + command = try([each.value.database.command],[]) + #command = [try(each.value.database.command,"")] dynamic "env" { for_each = each.value.environment != null ? each.value.environment : {} @@ -742,3 +751,22 @@ resource "kubernetes_deployment_v1" "redis-automatic" { } } } + +resource "kubernetes_config_map" "automatic-configmap" { + metadata { + name = "extra-sites-terraform" + namespace = "reverse-proxy" + annotations = { + "reloader.stakater.com/match" : "true", + } + } + + data = { + for key, value in var.kubernetes : + "${value.domain_name}.conf" => templatefile("nginx_config.tftpl", { + name_site = value.domain_name + name_service = "${key}-svc.${coalesce(value.namespace, value.connected_namespace, key)}.svc:${value.service_port.0}" + }) if value.domain_name != null && value.enabled == true + } + +} diff --git a/variables.auto.tfvars b/variables.auto.tfvars index 045474e..1ba7272 100644 --- a/variables.auto.tfvars +++ b/variables.auto.tfvars @@ -2,7 +2,7 @@ kubernetes = { bookstack = { #namespace = "bookstack" #enabled = false - replicas = 01 + replicas = 0 extra_manifest = ["/opt/kubernetes/Bookstack_kube/Bookstack.configmap.yaml", "/opt/kubernetes/Bookstack_kube/Bookstack.secret.yaml"] #image = "linuxserver/bookstack:24.10.3" image = "linuxserver/bookstack:latest" @@ -452,21 +452,23 @@ kubernetes = { } - paper = { - enabled = false - namespace = "paper" - image = "ghcr.io/paperless-ngx/paperless-ngx:latest" + paperless = { + #enabled = false + #namespace = "paper" + #replicas = 0 + image = "ghcr.io/paperless-ngx/paperless-ngx:2.18.4" service_port = [8000] + domain_name = "paperless2" database = { - image = "docker.io/library/postgres:15" } + image = "postgres:15.6" } redis = { - image = "docker.io/library/redis:7" } - requirements = { - limits-cpu = "800m" - limits-memory = "800Mi" - requests-cpu = "10m" - requests-memory = "300Mi" - } + image = "redis:7.4.1" } + #requirements = { + # limits-cpu = "800m" + # limits-memory = "800Mi" + # requests-cpu = "10m" + # requests-memory = "300Mi" + #} extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/paperless/Paperless.secret.yaml"] #config_map_ref = ["config"] @@ -496,16 +498,16 @@ kubernetes = { } } PAPERLESS_URL = { - value = "https://paper.tryton.geeraert.eu" + value = "https://paperless.tryton.geeraert.eu" } PAPERLESS_TIKA_ENABLED = { - value = "0" + value = "1" } PAPERLESS_TIKA_GOTENBERG_ENDPOINT = { - value = "http://gotenberg-svc.paper.svc:3000" + value = "http://gotenberg-svc.paperless.svc:3000" } PAPERLESS_TIKA_ENDPOINT = { - value = "http://tika-svc.paper.svc:9998" + value = "http://tika-svc.paperless.svc:9998" } @@ -519,7 +521,7 @@ kubernetes = { } PAPERLESS_REDIS = { - value = "redis://paper-redis-svc:6379" + value = "redis://paperless-redis-svc:6379" } PAPERLESS_ADMIN_USER = { @@ -557,6 +559,12 @@ kubernetes = { pvc_size = "2Mi" mount_path = "/usr/src/paperless/data" } + paperless-media = { + pvc = true + name = "paperless-media" + pvc_size = "2Mi" + mount_path = "/usr/src/paperless/media" + } # export = { # host_path = "/tmp" # name = "export" @@ -572,38 +580,122 @@ kubernetes = { } } gotenberg = { - enabled = false + #enabled = false name = "gotenberg" - connected_namespace = "paper" - image = "gotenberg/gotenberg:7.9.2" - service_port = [3000] + command = ["gotenberg", "--chromium-disable-javascript=true", "--chromium-allow-list=file:///tmp/.*", "--chromium-auto-start"] + connected_namespace = "paperless" + image = "gotenberg/gotenberg:8" + #image = "gotenberg/gotenberg:7.4.3" + service_port = [3000] + environment = { + CHROMIUM_PAPER_WIDTH = { + value = "595" + } + CHROMIUM_PAPER_HEIGHT = { + value = "842" + } + + CHROMIUM_MARGIN_TOP = { + value = "7.2" + } + + CHROMIUM_MARGIN_BOTTOM = { + value = "7.2" + } + + CHROMIUM_MARGIN_LEFT = { + value = "7.2" + } + + CHROMIUM_MARGIN_RIGHT = { + value = "7.2" + } + GOTENBERG_CHROMIUM_STARTUP_TIMEOUT = { + value = "60s" + } + GOTENBERG_BUILD_DEBUG_DATA = { + value = "false" + } + GOTENBERG_CHROMIUM_ARGS = { + value = "--no-sandbox,--disable-dev-shm-usage,--no-zygote" + } + } + + pvc = { + devshm = { + host_path = "/tmp" + name = "devshm" + pvc_size = "2Mi" + mount_path = "/dev/shm" + } + } requirements = { - limits-cpu = "100m" - limits-memory = "300Mi" - requests-cpu = "50m" - requests-memory = "150Mi" + limits-cpu = "1" + limits-memory = "1000Mi" + requests-cpu = "500m" + requests-memory = "512Mi" } } tika = { - enabled = false + #enabled = false name = "tika" - connected_namespace = "paper" + connected_namespace = "paperless" image = "ghcr.io/paperless-ngx/tika" service_port = [9998] - requirements = { - limits-cpu = "100m" - limits-memory = "300Mi" - requests-cpu = "50m" - requests-memory = "150Mi" + limits-cpu = "1" + limits-memory = "1000Mi" + requests-cpu = "500m" + requests-memory = "512Mi" } } + emailproxy = { + enabled = false + name = "email-oauth2-proxy" + connected_namespace = "paper" + dns_nameservers = "1.1.1.1" + image = "blacktirion/email-oauth2-proxy-docker" + #command = ["python", "emailproxy.py", "--no-gui", "--external-auth", "--debug", "--cache-store", "/config/credstore.config", "--config-file", "/config/emailproxy.config", "--log-file", "/config/emailproxy.log"] + #extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/paperless/emailproxyconfig.configmap.yml"] + service_port = [80, 1993, 1995] + requirements = { + limits-cpu = "1" + limits-memory = "1000Mi" + requests-cpu = "500m" + requests-memory = "512Mi" + } + environment = { + LOGFILE = { + value = true + } + DEBUG = { + value = true + } + CACHE_STORE = { + value = "/config/credstore.config" + } + LOCAL_SERVER_AUTH = { value = true } + } + pvc = { + emailproxy-config = { + #config_map = true + pvc = true + name = "emailproxyconfig" + pvc_size = "2Mi" + #mount_path = "/config/emailproxy.config" + mount_path = "/config/" + } + + } + + + } @@ -1191,11 +1283,14 @@ kubernetes = { } wikijs = { - #enabled = false - image = "ghcr.io/requarks/wiki:2.5" - service_port = [3000] + #enabled = false + image = "ghcr.io/requarks/wiki:2.5" + service_port = [3000] + #domain_name = "wikijs" extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/wikijs/wikijs-db.secret.yaml"] - database = {} + database = { + image = "postgres:17" } + environment = { PUID = { value = "1000" @@ -1273,14 +1368,13 @@ kubernetes = { } - immicht = { - enabled = false + immich = { + #enabled = false #replicas = 0 - namespace = "immicht" - image = "ghcr.io/immich-app/immich-server:v1.134.0" - service_port = [2283] + connected_namespace = "immich" + image = "ghcr.io/immich-app/immich-server:v2.0.0" + service_port = [2283] database = { - #image = "ghcr.io/immich-app/postgres:14-vectorchord0.3.0-pgvectors0.2.0@sha256:fa4f6e0971f454cd95fec5a9aaed2ed93d8f46725cc6bc61e0698e97dba96da1" image = "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0" } @@ -1288,7 +1382,7 @@ kubernetes = { image = "docker.io/bitnami/redis:7.2.5-debian-12-r0" } requirements = { limits-cpu = "800m" - limits-memory = "800Mi" + limits-memory = "2Gi" requests-cpu = "10m" requests-memory = "300Mi" } @@ -1364,7 +1458,7 @@ kubernetes = { } IMMICH_MACHINE_LEARNING_URL = { value = "http://machinelearning-svc:3003" } - REDIS_HOSTNAME = { value = "immicht-redis-svc" } + REDIS_HOSTNAME = { value = "immich-redis-svc" } UPLOAD_LOCATION = { value = "/tmp" } POSTGRESQL_ENABLE_LDAP = { value = "no" } POSTGRESQL_ENABLE_TLS = { value = "no" } @@ -1385,19 +1479,27 @@ kubernetes = { } pvc = { immich-data = { - pvc = true name = "immich-data" - pvc_size = "2Mi" + pvc_size = "10Mi" + pvc = false + host_path = "/ssd/Image/immich/immich-storage-fastaccess" mount_path = "/usr/src/app/upload" } + stash-data = { + name = "stash-data" + pvc_size = "10Mi" + pvc = false + host_path = "/ssd/stash/data-pvc" + mount_path = "/stash/" + } } } machinelearning = { - enabled = false + #enabled = false #replicas = 0 - connected_namespace = "immicht" - image = "ghcr.io/immich-app/immich-machine-learning:v1.134.0" + connected_namespace = "immich" + image = "ghcr.io/immich-app/immich-machine-learning:v2.0.0" service_port = [3003] environment = { DB_DATABASE_NAME = { @@ -1438,7 +1540,7 @@ kubernetes = { } REDIS_HOSTNAME = { - value = "immicht-redis-svc" + value = "immich-redis-svc" } TRANSFORMERS_CACHE = { @@ -1520,11 +1622,16 @@ kubernetes = { mount_path = "/kubeconfig" } + stash-django-pvc = { + host_path = "/ssd/stash/data-pvc/" + name = "stash-django-pvc" + pvc_size = "2Mi" + mount_path = "/stash" + } } } - keycloak = { - #enabled = false + enabled = false name = "keycloak" image = "quay.io/keycloak/keycloak:25.0.1" service_port = [8080] @@ -1567,14 +1674,39 @@ kubernetes = { echo = { - enabled = true + enabled = false image = "ealen/echo-server:latest" service_port = [80] # command = ["-text=Hello authenticated world!"] - + pvc = { + echo-config = { + name = "echo-config" + pvc_size = "10Mi" + pvc = true + mount_path = "/app/configs" + } + } } + + echo2 = { + enabled = false + connected_namespace = "echo" + image = "ealen/echo-server:latest" + service_port = [80] + # command = ["-text=Hello authenticated world!"] + pvc = { + echo-config = { + name = "echo-config" + pvc_size = "10Mi" + pvc = true + mount_path = "/app/configs" + existing_pvc = true + } + } + } + oauth2-proxy = { - #enabled = false + enabled = false image = "quay.io/oauth2-proxy/oauth2-proxy:latest" service_port = [4180] @@ -1593,6 +1725,7 @@ kubernetes = { } OAUTH2_PROXY_COOKIE_DOMAIN = { value = "oauthn.tryton.geeraert.eu" + #value = "*.tryton.geeraert.eu" } OAUTH2_PROXY_OIDC_ISSUER_URL = { @@ -1612,4 +1745,433 @@ kubernetes = { } + tdarr = { + #enabled = false + image = "ghcr.io/haveagitgat/tdarr" + connected_namespace = "servarr" + service_port = [8265, 8266] + pvc = { + tdarr-config = { + name = "tdarr-config" + pvc_size = "10Mi" + pvc = true + mount_path = "/app/configs" + } + tdarr-server = { + name = "tdarr-server" + pvc_size = "10Mi" + pvc = true + mount_path = "/app/server" + } + tdarr-log = { + name = "tdarr-log" + pvc_size = "10Mi" + pvc = true + mount_path = "/app/logs" + } + servarr-data = { + name = "servarr-data" + pvc_size = "10Mi" + pvc = false + host_path = "/data" + mount_path = "/media" + } + stash-data = { + name = "stash-data" + pvc_size = "10Mi" + pvc = false + host_path = "/ssd/stash/data-pvc/" + mount_path = "/stash" + } + + tdarr-dri = { + name = "tdarr-dri" + pvc_size = "10Mi" + pvc = false + host_path = "/dev/dri" + mount_path = "/dev/dri" + } + tdarr-transcode-cache = { + name = "tdarr-transcode-cache" + pvc_size = "10Mi" + pvc = true + mount_path = "/transcode-cache" + } + + } + + environment = { + serverIP = { + value = "0.0.0.0" + } + serverPort = { + value = "8266" + } + webUIPort = { + value = "8265" + } + internalNode = { + value = "true" + } + inContainer = { + value = "true" + } + ffmpegVersion = { + value = "7" + } + nodeName = { + value = "MyInternalNode" + } + auth = { + value = "false" + } + openBrowser = { + value = "true" + } + maxLogSizeMB = { + value = "10" + } + cronPluginUpdate = { + value = "" + } + TZ = { + value = "Europe/London" + } + PUID = { + value = "1000" + } + PGID = { + value = "1000" + } + NVIDIA_DRIVER_CAPABILITIES = { + value = "all" + } + NVIDIA_VISIBLE_DEVICES = { + value = "all" + } + } + + + } + tdarr-node = { + enabled = false + image = "ghcr.io/haveagitgat/tdarr_node" + connected_namespace = "servarr" + replicas = 2 + service_port = [8268] + pvc = { + tdarrnode-config = { + name = "tdarrnode-config" + pvc_size = "10Mi" + pvc = false + host_path = "/data/kubernetes/servarr/tdarr-config-pvc" + mount_path = "/app/configs" + } + tdarrnode-log = { + name = "tdarrnode-log" + pvc_size = "10Mi" + pvc = true + mount_path = "/app/logs" + } + servarr-data = { + name = "servarr-data" + pvc_size = "10Mi" + pvc = false + host_path = "/data" + mount_path = "/media" + } + tdarrnode-dri = { + name = "tdarrnode-dri" + pvc_size = "10Mi" + pvc = false + host_path = "/dev/dri" + mount_path = "/dev/dri" + } + tdarrnode-transcode-cache = { + name = "tdarrnode-transcode-cache" + pvc_size = "10Mi" + pvc = false + host_path = "/data/kubernetes/servarr/tdarr-transcode-cache-pvc" + mount_path = "/transcode-cache" + } + + } + + environment = { + serverIP = { + value = "tdarr-svc" + } + serverPort = { + value = "8266" + } + nodeType = { + value = "mapped" + } + priority = { + value = "-1" + } + inContainer = { + value = "true" + } + ffmpegVersion = { + value = "7" + } + # nodeName = { + # value = "MyExternalNode" + # } + maxLogSizeMB = { + value = "10" + } + cronPluginUpdate = { + value = "" + } + TZ = { + value = "Europe/London" + } + apikey = { + value = "" + } + pollInterval = { + value = "2000" + } + PUID = { + value = "1000" + } + PGID = { + value = "1000" + } + NVIDIA_DRIVER_CAPABILITIES = { + value = "all" + } + NVIDIA_VISIBLE_DEVICES = { + value = "all" + } + startPaused = { + value = "false" + } + transcodegpuWorkers = { + value = "0" + } + transcodecpuWorkers = { + value = "2" + } + healthcheckgpuWorkers = { + value = "0" + } + healthcheckcpuWorkers = { + value = "1" + } + } + + } + tdarr-node2 = { + enabled = false + image = "ghcr.io/haveagitgat/tdarr_node" + connected_namespace = "servarr" + replicas = 1 + service_port = [8268] + pvc = { + tdarrnode2-config = { + name = "tdarrnode2-config" + pvc_size = "10Mi" + pvc = false + host_path = "/data/kubernetes/servarr/tdarr-config-pvc" + mount_path = "/app/configs" + } + tdarrnode2-log = { + name = "tdarrnode2-log" + pvc_size = "10Mi" + pvc = true + mount_path = "/app/logs" + } + nfs-data = { + name = "nfs-data" + pvc_size = "10Mi" + pvc = false + host_path = "/mnt/serie" + mount_path = "/mnt/serie" + } + tdarrnode2-dri = { + name = "tdarrnode2-dri" + pvc_size = "10Mi" + pvc = false + host_path = "/dev/dri" + mount_path = "/dev/dri" + } + tdarrnode2-transcode-cache = { + name = "tdarrnode2-transcode-cache" + pvc_size = "10Mi" + pvc = false + host_path = "/mnt/cache" + mount_path = "/mnt/cache" + } + + } + + environment = { + serverIP = { + #value = "tdarr-svc" + value = "192.168.88.34" + } + serverPort = { + value = "8266" + } + nodeType = { + value = "mapped" + } + priority = { + value = "-1" + } + inContainer = { + value = "true" + } + ffmpegVersion = { + value = "7" + } + #nodeName = { + # value = "MyExternalNode2" + #} + maxLogSizeMB = { + value = "10" + } + pathTranslators = { + value = "W3sic2VydmVyIjoiWjoiLCJub2RlIjoiL21udC9zZXJpZSJ9LHsic2VydmVyIjogIlk6Iiwibm9kZSI6ICIvbW50L2NhY2hlL3RkYXJyLWNhY2hlIn1dCg==" + } + + + cronPluginUpdate = { + value = "" + } + TZ = { + value = "Europe/London" + } + apikey = { + value = "" + } + pollInterval = { + value = "2000" + } + PUID = { + value = "1000" + } + PGID = { + value = "1000" + } + NVIDIA_DRIVER_CAPABILITIES = { + value = "all" + } + NVIDIA_VISIBLE_DEVICES = { + value = "all" + } + startPaused = { + value = "false" + } + transcodegpuWorkers = { + value = "0" + } + transcodecpuWorkers = { + value = "2" + } + healthcheckgpuWorkers = { + value = "0" + } + healthcheckcpuWorkers = { + value = "1" + } + } + + } + + bitwardent = { + enabled = false + replicas = 0 + name = "bitwarden-admin" + image = "bitwarden/admin:2024.5.0" + extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/config.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/kube-root-ca.crt.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/uid.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/bitwarden-identity-cert-password.secret.yml"] + service_port = [5000] + + environment = {} + + pvc = { + bitwarden-ca-certificates = { + pvc = true + pvc_size = "2Mi" + mount_path = "/config" + name = "bitwarden-ca-certificates" + } + + bitwarden-core = { + pvc = true + pvc_size = "2Mi" + mount_path = "/config" + name = "bitwarden-core" + } + + bitwarden-identity = { + pvc = true + pvc_size = "2Mi" + mount_path = "/config" + name = "bitwarden-identity" + } + + bitwarden-letsencrypt = { + pvc = true + pvc_size = "2Mi" + mount_path = "/config" + name = "bitwarden-letsencrypt" + } + + bitwarden-logs = { + pvc = true + pvc_size = "2Mi" + mount_path = "/config" + name = "bitwarden-logs" + } + + bitwarden-mssql = { + pvc = true + pvc_size = "2Mi" + mount_path = "/config" + name = "bitwarden-mssql" + } + + bitwarden-nginx = { + pvc = true + pvc_size = "2Mi" + mount_path = "/config" + name = "bitwarden-nginx" + } + + bitwarden-ssl = { + pvc = true + pvc_size = "2Mi" + mount_path = "/config" + name = "bitwarden-ssl" + } + + bitwarden-web = { + pvc = true + pvc_size = "2Mi" + mount_path = "/config" + name = "bitwarden-web" + } + + } + + } + + sharelatex = { + enabled = false + image = "sharelatex/sharelatex" + replicas = 1 + service_port = [8268] + database = { + "image" = "mongo:4.0" + "port" = 27017 + "mountPath" = "/data/db" + "command" = "--replSet overleaf" + } + redis = { + image = "redis:5.0" } +} }