adding tfvars
This commit is contained in:
pierre.geeraert
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,471 @@
|
||||
kubernetes = {
|
||||
reverse-proxy = {
|
||||
#enabled = false
|
||||
docker = true
|
||||
image = "nginx:latest"
|
||||
service_port = [80, 443]
|
||||
external_port = true
|
||||
pvc = {
|
||||
nginx-sites-terraform = {
|
||||
name = "nginx-sites-terraform"
|
||||
mount_path = "/etc/nginx/conf.d/"
|
||||
host_path = "/data/kubernetes/reverse-proxy/reverse-proxy-sites"
|
||||
}
|
||||
|
||||
reverse-proxy-log = {
|
||||
name = "reverse-proxy-log"
|
||||
mount_path = "/var/log/nginx/"
|
||||
host_path = "/data/kubernetes/reverse-proxy/reverse-proxy-log"
|
||||
|
||||
}
|
||||
|
||||
reverse-proxy-ssl = {
|
||||
name = "reverse-proxy-ssl"
|
||||
mount_path = "/etc/nginx/ssl/"
|
||||
host_path = "/data/kubernetes/reverse-proxy/reverse-proxy-ssl"
|
||||
|
||||
}
|
||||
nginx-configfile = {
|
||||
name = "nginx-configfile"
|
||||
mount_path = "/etc/nginx/nginx.conf"
|
||||
host_path = "/data/kubernetes/reverse-proxy/reverse-proxy-configfile/nginx.conf"
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
gitea = {
|
||||
#enabled = false
|
||||
docker = true
|
||||
image = "gitea/gitea:1.27.0"
|
||||
# no service_port: nginx reaches http://gitea:3000 over deployment_network
|
||||
database = {
|
||||
image = "postgres:17"
|
||||
mountPath = "/var/lib/postgresql/data"
|
||||
host_path = "/data/kubernetes/gitea/gitea-db-data"
|
||||
}
|
||||
# shared by the gitea and gitea-db containers (the db ignores GITEA__*, gitea ignores POSTGRES_*)
|
||||
environment = {
|
||||
POSTGRES_USER = { value = "gitea-KY56Q" }
|
||||
POSTGRES_PASSWORD = { value = "Modulator-Yearning-Gills3" }
|
||||
POSTGRES_DB = { value = "gitea-database" }
|
||||
|
||||
GITEA__database__DB_TYPE = { value = "postgres" }
|
||||
GITEA__database__HOST = { value = "gitea-db:5432" }
|
||||
GITEA__database__USER = { value = "gitea-KY56Q" }
|
||||
GITEA__database__PASSWD = { value = "Modulator-Yearning-Gills3" }
|
||||
GITEA__database__NAME = { value = "gitea-database" }
|
||||
}
|
||||
pvc = {
|
||||
gitea-data = {
|
||||
name = "gitea-data"
|
||||
mount_path = "/data"
|
||||
host_path = "/data/kubernetes/gitea/gitea-data"
|
||||
}
|
||||
gitea-documents-backup = {
|
||||
name = "gitea-documents-backup"
|
||||
mount_path = "/backup"
|
||||
host_path = "/data/kubernetes/gitea/gitea-documents-backup"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
gitea-runner = {
|
||||
#enabled = false
|
||||
docker = true
|
||||
image = "gitea/act_runner:latest"
|
||||
environment = {
|
||||
GITEA_INSTANCE_URL = { value = "https://gitea.geeraert.eu/" }
|
||||
GITEA_RUNNER_REGISTRATION_TOKEN = { value = "rqi4mFW8LXoc5MhIrUD1rjzdmKVY8n9X14BP6sWd" }
|
||||
GITEA_RUNNER_NAME = { value = "runner" }
|
||||
GITEA_RUNNER_LABELS = { value = "label" }
|
||||
}
|
||||
pvc = {
|
||||
gitea-runner-data = {
|
||||
name = "gitea-runner-data"
|
||||
mount_path = "/data"
|
||||
host_path = "/data/kubernetes/gitea/gitea-runner-data"
|
||||
}
|
||||
docker-sock = {
|
||||
name = "docker-sock"
|
||||
mount_path = "/var/run/docker.sock"
|
||||
host_path = "/var/run/docker.sock"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
echo = {
|
||||
#enabled = false
|
||||
docker = true
|
||||
image = "ealen/echo-server:latest"
|
||||
service_port = [4580]
|
||||
external_port = true
|
||||
command = ["-text=Hello authenticated world!"]
|
||||
pvc = {
|
||||
echo-config = {
|
||||
name = "echo-config"
|
||||
host_path = "/tmp/data/kubernetes/echo/"
|
||||
mount_path = "/app/configs"
|
||||
}
|
||||
}
|
||||
environment = {
|
||||
PAPERLESS_REDIS = {
|
||||
value = "redis://paperless-redis-svc:6379"
|
||||
}
|
||||
database = {
|
||||
value = "datgg"
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
bitwarden-admin = {
|
||||
enabled = false
|
||||
namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-admin"
|
||||
image = "ghcr.io/bitwarden/admin:2026.1.0"
|
||||
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/config.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/uid.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/bitwarden-identity-cert-password.secret.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/identity-svc.svc.yaml"]
|
||||
service_port = [5000]
|
||||
config_map_ref = ["global.env", "uid.env", "global.override.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-ca-certificates = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/ca-certificates"
|
||||
name = "bitwarden-ca-certificates"
|
||||
}
|
||||
|
||||
bitwarden-core = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/core"
|
||||
name = "bitwarden-core"
|
||||
}
|
||||
bitwarden-logs = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/logs"
|
||||
name = "bitwarden-logs"
|
||||
sub_path = "admin"
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
bitwarden-api = {
|
||||
enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-api"
|
||||
image = "gitea.tryton.geeraert.eu/pi-ux-ce/bitbetter_api:2026.1.0"
|
||||
service_port = [5000]
|
||||
config_map_ref = ["global.env", "uid.env", "global.override.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-ca-certificates = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/ca-certificates"
|
||||
name = "bitwarden-ca-certificates"
|
||||
}
|
||||
|
||||
bitwarden-core = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/core"
|
||||
name = "bitwarden-core"
|
||||
}
|
||||
bitwarden-logs = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/logs"
|
||||
name = "bitwarden-logs"
|
||||
sub_path = "api"
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
bitwarden-attachments = {
|
||||
enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-attachments"
|
||||
image = "ghcr.io/bitwarden/attachments:2026.1.0"
|
||||
service_port = [5000]
|
||||
config_map_ref = ["global.env", "uid.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-core = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/core/attachments"
|
||||
name = "bitwarden-core"
|
||||
sub_path = "attachments"
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
bitwarden-events = {
|
||||
enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-events"
|
||||
image = "ghcr.io/bitwarden/events:2026.1.0"
|
||||
service_port = [5000]
|
||||
config_map_ref = ["global.env", "uid.env", "global.override.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-ca-certificates = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/ca-certificates"
|
||||
name = "bitwarden-ca-certificates"
|
||||
}
|
||||
bitwarden-logs = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/logs"
|
||||
name = "bitwarden-logs"
|
||||
sub_path = "events"
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
bitwarden-icons = {
|
||||
enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-icons"
|
||||
image = "ghcr.io/bitwarden/icons:2026.1.0"
|
||||
service_port = [5000]
|
||||
config_map_ref = ["global.env", "uid.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-ca-certificates = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/ca-certificates"
|
||||
name = "bitwarden-ca-certificates"
|
||||
}
|
||||
bitwarden-logs = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/logs"
|
||||
name = "bitwarden-logs"
|
||||
sub_path = "icons"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
bitwarden-identity = {
|
||||
enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-identity"
|
||||
image = "gitea.tryton.geeraert.eu/pi-ux-ce/bitbetter_identity:2026.1.0"
|
||||
service_port = [5000]
|
||||
config_map_ref = ["global.env", "uid.env", "global.override.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-identity = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/identity"
|
||||
name = "bitwarden-identity"
|
||||
}
|
||||
bitwarden-ca-certificates = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/ca-certificates"
|
||||
name = "bitwarden-ca-certificates"
|
||||
}
|
||||
|
||||
bitwarden-core = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/core"
|
||||
name = "bitwarden-core"
|
||||
}
|
||||
bitwarden-logs = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/logs"
|
||||
name = "bitwarden-logs"
|
||||
sub_path = "identity"
|
||||
}
|
||||
}
|
||||
}
|
||||
bitwarden-mssql = {
|
||||
enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-mssql"
|
||||
image = "ghcr.io/bitwarden/mssql:2026.1.0"
|
||||
service_port = [1433, 5000]
|
||||
config_map_ref = ["mssql.env", "uid.env", "mssql.override.env"]
|
||||
environment = {}
|
||||
database = {
|
||||
shunt = "true"
|
||||
engine = "sqlserver"
|
||||
username = "sa"
|
||||
host = "bitwarden-mssql-svc"
|
||||
name = "bitwarden_vault"
|
||||
}
|
||||
|
||||
pvc = {
|
||||
bitwarden-mssql = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/var/opt/mssql/data"
|
||||
name = "bitwarden-mssql"
|
||||
sub_path = "data"
|
||||
}
|
||||
bitwarden-logs = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/logs"
|
||||
name = "bitwarden-logs"
|
||||
sub_path = "mssql"
|
||||
}
|
||||
}
|
||||
}
|
||||
bitwarden-nginx = {
|
||||
enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-nginx"
|
||||
image = "ghcr.io/bitwarden/nginx:2026.1.0"
|
||||
service_port = [5000, 8080, 8443]
|
||||
config_map_ref = ["uid.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-nginx = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/nginx"
|
||||
name = "bitwarden-nginx"
|
||||
}
|
||||
bitwarden-letsencrypt = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/letsencrypt"
|
||||
name = "bitwarden-letsencrypt"
|
||||
}
|
||||
|
||||
bitwarden-ssl = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/ssl"
|
||||
name = "bitwarden-ssl"
|
||||
}
|
||||
bitwarden-logs = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/var/log/nginx"
|
||||
name = "bitwarden-logs"
|
||||
sub_path = "nginx"
|
||||
}
|
||||
}
|
||||
}
|
||||
bitwarden-notifications = {
|
||||
enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-notifications"
|
||||
image = "ghcr.io/bitwarden/notifications:2026.1.0"
|
||||
service_port = [5000]
|
||||
config_map_ref = ["global.env", "uid.env", "global.override.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-ca-certificates = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/ca-certificates"
|
||||
name = "bitwarden-ca-certificates"
|
||||
}
|
||||
bitwarden-logs = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/logs"
|
||||
name = "bitwarden-logs"
|
||||
sub_path = "notifications"
|
||||
}
|
||||
}
|
||||
}
|
||||
bitwarden-sso = {
|
||||
enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-sso"
|
||||
image = "ghcr.io/bitwarden/sso:2026.1.0"
|
||||
service_port = [5000]
|
||||
config_map_ref = ["global.env", "uid.env", "global.override.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-identity = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/identity"
|
||||
name = "bitwarden-identity"
|
||||
}
|
||||
bitwarden-core = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/core"
|
||||
name = "bitwarden-core"
|
||||
}
|
||||
bitwarden-ca-certificates = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/ca-certificates"
|
||||
name = "bitwarden-ca-certificates"
|
||||
}
|
||||
bitwarden-logs = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/logs"
|
||||
name = "bitwarden-logs"
|
||||
sub_path = "sso"
|
||||
}
|
||||
}
|
||||
}
|
||||
bitwarden-web = {
|
||||
enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-web"
|
||||
image = "ghcr.io/bitwarden/web:2026.1.0"
|
||||
service_port = [5000]
|
||||
config_map_ref = ["global.env", "uid.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-web = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/etc/bitwarden/web"
|
||||
name = "bitwarden-web"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,372 @@
|
||||
kubernetes = {
|
||||
|
||||
gluetun = {
|
||||
# enabled = false
|
||||
dns_nameservers = "1.1.1.1"
|
||||
replicas = 01
|
||||
image = "qmcgaw/gluetun:latest"
|
||||
service_port = [8888]
|
||||
#extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/gluetun/gluetun-secret-netherlandNL-FREE-280.yaml"]
|
||||
secret_import = ["5527ba11-07e3-415b-8d1f-b3ee0154eb56", "b0d22160-d81a-4702-a3dd-b40e0168d617", "643dbe99-ace0-4ef5-8a2e-b44f014dccb0"]
|
||||
security_context = true
|
||||
# requirements = {
|
||||
# limits-cpu = "800Mi"
|
||||
# limits-memory = "800Mi"
|
||||
# requests-cpu = "800Mi"
|
||||
# requests-memory = "800Mi"
|
||||
# }
|
||||
environment = {
|
||||
WIREGUARD_PRIVATE_KEY = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "gluetun-secret-nl-free-280"
|
||||
key = "WIREGUARD_PRIVATE_KEY"
|
||||
}
|
||||
}
|
||||
}
|
||||
HTTPPROXY = {
|
||||
value = "on"
|
||||
}
|
||||
HTTPPROXY_LOG = {
|
||||
value = "on"
|
||||
}
|
||||
HTTPPROXY_LISTENING_ADDRESS = {
|
||||
value = "0.0.0.0:8888"
|
||||
}
|
||||
# DNS_KEEP_NAMESERVER = {
|
||||
# value = "on"
|
||||
# }
|
||||
VPN_SERVICE_PROVIDER = {
|
||||
value = "protonvpn"
|
||||
}
|
||||
VPN_TYPE = {
|
||||
value = "wireguard"
|
||||
}
|
||||
SERVER_COUNTRIES = {
|
||||
value = "Netherlands"
|
||||
}
|
||||
HEALTH_TARGET_ADDRESS = {
|
||||
value = "0.0.0.0:8888"
|
||||
}
|
||||
|
||||
FREE_ONLY = {
|
||||
value = "on"
|
||||
}
|
||||
|
||||
# WIREGUARD_ADDRESSES = {
|
||||
# value = "10.2.0.2/32"
|
||||
# }
|
||||
FIREWALL_INPUT_PORTS = {
|
||||
value = "8081,7878,9696,9091,51413,8080,6881,8989,8191,8888,8000"
|
||||
}
|
||||
PUBLICIP_API = {
|
||||
value = "ip2location"
|
||||
}
|
||||
|
||||
# HEALTH_TARGET_ADDRESS = {
|
||||
# value = "protonvpn.com:80"
|
||||
# }
|
||||
# FIREWALL_OUTBOUND_SUBNETS = {
|
||||
# value = "10.0.0.0/24" }
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
django = {
|
||||
#enabled =false
|
||||
namespace = "django"
|
||||
image = "gitea.tryton.geeraert.eu/pi-ux-ce/django-python:latest"
|
||||
service_port = [8000]
|
||||
database = {
|
||||
image = "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0"
|
||||
username = "django_username"
|
||||
mountPath = "/var/lib/postgresql/data"
|
||||
}
|
||||
#redis = {}
|
||||
secret_ref = ["django-bitwarden-credentials"]
|
||||
secret_import = ["9fc5a725-75f5-4bab-b595-b474017146c3"]
|
||||
requirements = {
|
||||
limits-cpu = "800m"
|
||||
limits-memory = "800Mi"
|
||||
requests-cpu = "10m"
|
||||
requests-memory = "300Mi"
|
||||
}
|
||||
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/django/kubeconfig.secret.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/django/django-db.secret.yaml"]
|
||||
|
||||
environment = {
|
||||
ALLOWED_HOSTS = {
|
||||
value = "django.geeraert.eu,admin.geeraert.eu,redirect.geeraert.eu,streaming.geeraert.eu,stash.geeraert.eu,simpsons.geeraert.eu,kubernetes.geeraert.eu,cloudmanager.geeraert.eu,podcast.geeraert.eu"
|
||||
}
|
||||
DEBUG = {
|
||||
value = "False"
|
||||
}
|
||||
ENVIRONMENT = {
|
||||
value = "PRODUCTION"
|
||||
}
|
||||
#CELERY_BROKER_URL = {
|
||||
# value = "redis://django-redis-svc:6379"
|
||||
#}
|
||||
#HTTP_PROXY = {
|
||||
#value = "http://gluetun-svc.gluetun.svc:8888" }
|
||||
|
||||
DB_PASSWORD = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "django-db-credentials"
|
||||
key = "DB_PASSWORD"
|
||||
}
|
||||
}
|
||||
}
|
||||
POSTGRES_DB = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "django-db-credentials"
|
||||
key = "DB_DATABASE_NAME"
|
||||
}
|
||||
}
|
||||
}
|
||||
POSTGRES_USER = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "django-db-credentials"
|
||||
key = "DB_USERNAME"
|
||||
}
|
||||
}
|
||||
}
|
||||
POSTGRES_PASSWORD = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "django-db-credentials"
|
||||
key = "DB_PASSWORD"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
DB_HOSTNAME = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "django-db-credentials"
|
||||
key = "DB_HOST"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
pvc = {
|
||||
kubeconfig-secret = {
|
||||
secret = true
|
||||
name = "kubeconfig"
|
||||
mount_path = "/kubeconfig"
|
||||
}
|
||||
|
||||
stash-django-pvc = {
|
||||
host_path = "/ssd/stash/data-pvc/"
|
||||
name = "stash-django-pvc"
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/stash"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
django-testing = {
|
||||
#enabled =false
|
||||
image = "gitea.tryton.geeraert.eu/pi-ux-ce/django-testing:latest"
|
||||
service_port = [8000]
|
||||
database = {}
|
||||
#redis = {}
|
||||
requirements = {
|
||||
limits-cpu = "800m"
|
||||
limits-memory = "800Mi"
|
||||
requests-cpu = "10m"
|
||||
requests-memory = "300Mi"
|
||||
}
|
||||
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/django/kubeconfig-testing.secret.yaml"]
|
||||
secret_ref = ["django-bitwarden-credentials"]
|
||||
secret_import = ["68dce7aa-8e5f-4483-9083-b474016e34fc"]
|
||||
environment = {
|
||||
ALLOWED_HOSTS = {
|
||||
value = "django-testing.geeraert.eu,admin-testing.geeraert.eu,redirect-testing.geeraert.eu,streaming-testing.geeraert.eu,stash-testing.geeraert.eu,simpsons-testing.geeraert.eu,kubernetes-testing.geeraert.eu,cloudmanager-testing.geeraert.eu,podcast-testing.geeraert.eu"
|
||||
}
|
||||
CELERY_BROKER_URL = {
|
||||
value = "redis://django-testing-redis-svc:6379"
|
||||
}
|
||||
|
||||
DEBUG = {
|
||||
value = "true"
|
||||
}
|
||||
DB_PORT = {
|
||||
value = 5432
|
||||
}
|
||||
CUSTOM_DB_DATABASE = {
|
||||
value = "cloudmanager" }
|
||||
}
|
||||
pvc = {
|
||||
kubeconfig-secret = {
|
||||
secret = true
|
||||
name = "kubeconfig"
|
||||
mount_path = "/kubeconfig"
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
fail2ban = {
|
||||
enabled = false
|
||||
#image = "lscr.io/linuxserver/fail2ban:latest"
|
||||
image = "gitea.tryton.geeraert.eu/pi-ux-ce/fail2ban:latest"
|
||||
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.RoleBinding.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.Role.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.ServiceAccount.yaml"]
|
||||
service_account_name = "kubectl-service-account"
|
||||
config_map_import = ["9d8ef71a-de74-478b-aa86-b3ee0160dc43", "50814edb-d190-41cb-8950-b3ee01622dcf", "fb11452e-fec1-489f-9144-b3ee0162ccda"]
|
||||
environment = {
|
||||
PUID = {
|
||||
value = "1000"
|
||||
}
|
||||
PGID = {
|
||||
value = "1000"
|
||||
}
|
||||
TZ = {
|
||||
value = "Etc/UTC"
|
||||
}
|
||||
|
||||
VERBOSITY = {
|
||||
value = "-vv" }
|
||||
}
|
||||
|
||||
security_context = true
|
||||
pvc = {
|
||||
fail2ban-config = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/config"
|
||||
name = "fail2ban-config"
|
||||
}
|
||||
fail2ban-log = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/var/log"
|
||||
name = "fail2ban-log"
|
||||
}
|
||||
nginx-fail2ban-logs = {
|
||||
host_path = "/data/kubernetes/reverse-proxy/reverse-proxy-log/"
|
||||
name = "nginx-fail2ban-logs"
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/remotelogs/nginx/"
|
||||
}
|
||||
fail2ban-nginx-http-auth-jail = {
|
||||
config_map = true
|
||||
name = "fail2ban-nginx-http-auth-jail"
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/config/fail2ban/jail.d/"
|
||||
}
|
||||
fail2ban-nginx-unauthorized-filter = {
|
||||
config_map = true
|
||||
name = "fail2ban-nginx-unauthorized-filter"
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/config/fail2ban/filter.d/"
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
netdatat = {
|
||||
image = "debian"
|
||||
enabled = false
|
||||
service_port = [19999]
|
||||
domain_name = "netdata"
|
||||
command = ["sleep", "3600"]
|
||||
security_context = true
|
||||
|
||||
environment = {
|
||||
NETDATA_CLAIM_TOKEN = {
|
||||
value = "wN6wJV1M5jvLbcpQTT78s0WRWiCkxz-s4l9tzeIqwA86upIkVSTk6TbaPbA5L6h_5HH9LoemluBqSPAGzi8DnJ2LBp4e8JGRVuWwOv8EWcKfrV0winCPce4xXtuD780KUW5CR6k"
|
||||
}
|
||||
NETDATA_CLAIM_URL = {
|
||||
value = "https://app.netdata.cloud"
|
||||
}
|
||||
NETDATA_CLAIM_ROOMS = {
|
||||
value = "28654d7b-4767-4b8e-bddc-8d134624bb3b"
|
||||
}
|
||||
}
|
||||
|
||||
pvc = {
|
||||
netdata-config = {
|
||||
name = "netdata-config"
|
||||
pvc = true
|
||||
pvc_size = "1Gi"
|
||||
mount_path = "/etc/netdata"
|
||||
}
|
||||
netdata-lib = {
|
||||
name = "netdata-lib"
|
||||
pvc = true
|
||||
pvc_size = "1Gi"
|
||||
mount_path = "/var/lib/netdata"
|
||||
}
|
||||
netdata-cache = {
|
||||
name = "netdata-cache"
|
||||
pvc = true
|
||||
pvc_size = "1Gi"
|
||||
mount_path = "/var/cache/netdata"
|
||||
}
|
||||
netdata-host-root = {
|
||||
host_path = "/"
|
||||
name = "netdata-host-root"
|
||||
mount_path = "/host/root"
|
||||
}
|
||||
netdata-host-passwd = {
|
||||
host_path = "/etc/passwd"
|
||||
name = "netdata-host-passwd"
|
||||
mount_path = "/host/etc/passwd"
|
||||
}
|
||||
netdata-host-group = {
|
||||
host_path = "/etc/group"
|
||||
name = "netdata-host-group"
|
||||
mount_path = "/host/etc/group"
|
||||
}
|
||||
netdata-host-localtime = {
|
||||
host_path = "/etc/localtime"
|
||||
name = "netdata-host-localtime"
|
||||
mount_path = "/etc/localtime"
|
||||
}
|
||||
netdata-host-proc = {
|
||||
host_path = "/proc"
|
||||
name = "netdata-host-proc"
|
||||
mount_path = "/host/proc"
|
||||
}
|
||||
netdata-host-sys = {
|
||||
host_path = "/sys"
|
||||
name = "netdata-host-sys"
|
||||
mount_path = "/host/sys"
|
||||
}
|
||||
netdata-host-os-release = {
|
||||
host_path = "/etc/os-release"
|
||||
name = "netdata-host-os-release"
|
||||
mount_path = "/host/etc/os-release"
|
||||
}
|
||||
netdata-host-var-log = {
|
||||
host_path = "/var/log"
|
||||
name = "netdata-host-var-log"
|
||||
mount_path = "/host/var/log"
|
||||
}
|
||||
netdata-docker-sock = {
|
||||
host_path = "/var/run/docker.sock"
|
||||
name = "netdata-docker-sock"
|
||||
mount_path = "/var/run/docker.sock"
|
||||
}
|
||||
netdata-host-dbus = {
|
||||
host_path = "/run/dbus"
|
||||
name = "netdata-host-dbus"
|
||||
mount_path = "/run/dbus"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
@@ -0,0 +1,600 @@
|
||||
nginx_sites = {
|
||||
bitwarden = {
|
||||
#service = "nginx.bitwarden.svc:8080"
|
||||
#extra-value-location = <<EOT
|
||||
#proxy_set_header Host $host;
|
||||
#proxy_set_header X-Real-IP $remote_addr;
|
||||
#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
#proxy_set_header Proxy "";
|
||||
# EOT
|
||||
service = "bitwarden-nginx-svc.bitwarden.svc:8080"
|
||||
http2_bool = true
|
||||
redirect_to_root_domain = false
|
||||
}
|
||||
|
||||
bookstack = {
|
||||
enabled = false
|
||||
# service = "webserver.bookstack.svc"
|
||||
service = "bookstack-svc.bookstack.svc"
|
||||
proxy_cache = false
|
||||
}
|
||||
|
||||
|
||||
django = {
|
||||
service = "django-svc.django:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
|
||||
}
|
||||
admin = {
|
||||
service = "django-svc.django:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
|
||||
}
|
||||
redirect = {
|
||||
service = "django-svc.django:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
|
||||
}
|
||||
streaming = {
|
||||
service = "django-svc.django:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
|
||||
}
|
||||
stash = {
|
||||
service = "django-svc.django:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
|
||||
}
|
||||
simpsons = {
|
||||
service = "django-svc.django:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
|
||||
}
|
||||
kubernetes = {
|
||||
service = "django-svc.django:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
|
||||
}
|
||||
cloudmanager = {
|
||||
service = "django-svc.django:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
|
||||
}
|
||||
podcast = {
|
||||
service = "django-svc.django:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
|
||||
}
|
||||
django-testing = {
|
||||
service = "django-testing-svc.django-testing.svc:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
}
|
||||
|
||||
admin-testing = {
|
||||
service = "django-testing-svc.django-testing.svc:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
}
|
||||
|
||||
redirect-testing = {
|
||||
service = "django-testing-svc.django-testing.svc:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
}
|
||||
|
||||
streaming-testing = {
|
||||
service = "django-testing-svc.django-testing.svc:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
}
|
||||
|
||||
stash-testing = {
|
||||
service = "django-testing-svc.django-testing.svc:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
}
|
||||
|
||||
simpsons-testing = {
|
||||
service = "django-testing-svc.django-testing.svc:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
}
|
||||
|
||||
kubernetes-testing = {
|
||||
service = "django-testing-svc.django-testing.svc:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
}
|
||||
|
||||
cloudmanager-testing = {
|
||||
service = "django-testing-svc.django-testing.svc:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
}
|
||||
podcast-testing = {
|
||||
service = "django-testing-svc.django-testing.svc:8000"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
}
|
||||
echo = {
|
||||
enabled = true
|
||||
# service = "echo-server.echo-server.svc:80"
|
||||
service = "echo-svc.echo.svc"
|
||||
docker_service = "echo"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
|
||||
#extra-value-location = <<EOT
|
||||
# auth_request /oauth2/auth;
|
||||
# error_page 401 = @oauth2_signin;
|
||||
# proxy_set_header X-Auth-Request-Redirect $request_uri;
|
||||
# EOT
|
||||
|
||||
#extra-value = <<EOT
|
||||
# location = /oauth2/auth {
|
||||
# internal;
|
||||
#proxy_pass http://oauthn_backend;
|
||||
## proxy_pass https://oauthn.tryton.geeraert.eu/oauth2/auth;
|
||||
# proxy_pass_request_body off;
|
||||
# proxy_set_header Content-Length "";
|
||||
# proxy_set_header X-Original-URI $request_uri;
|
||||
# proxy_set_header X-Real-IP $remote_addr;
|
||||
# proxy_set_header X-Scheme $scheme;
|
||||
#}
|
||||
|
||||
#location @oauth2_signin {
|
||||
# return 302 https://$host/oauth2/start?rd=https://$host$request_uri;
|
||||
# #return 302 https://oauthn.tryton.geeraert.eu/oauth2/start?rd=https://$host$request_uri;
|
||||
#}
|
||||
|
||||
#location /oauth2/ {
|
||||
#proxy_pass http://oauthn_backend;
|
||||
#proxy_set_header Host $host;
|
||||
#proxy_set_header X-Real-IP $remote_addr;
|
||||
#proxy_set_header X-Scheme $scheme;
|
||||
#proxy_set_header X-Auth-Request-Redirect $request_uri;
|
||||
#}
|
||||
|
||||
# EOT
|
||||
|
||||
|
||||
}
|
||||
gitlab = {
|
||||
service = "webserver.gitlab.svc:443"
|
||||
proxy_cache = true
|
||||
extra_value_bool = true
|
||||
enabled = false
|
||||
extra-value = <<EOT
|
||||
client_max_body_size 20m;
|
||||
proxy_request_buffering off;
|
||||
EOT
|
||||
http2_bool = true
|
||||
proxy_pass_https = true
|
||||
}
|
||||
sonarr = {
|
||||
service = "sonarr-svc.servarr.svc:8989"
|
||||
geoip_allow = ["FR", "GB", "NL"]
|
||||
|
||||
}
|
||||
|
||||
keycloak = {
|
||||
service = "keycloak.keycloak.svc:8080"
|
||||
enabled = false
|
||||
extra-value = <<EOT
|
||||
|
||||
set_real_ip_from 0.0.0.0/0;
|
||||
real_ip_header X-Real-IP;
|
||||
real_ip_recursive on;
|
||||
EOT
|
||||
}
|
||||
nextcloud = {
|
||||
redirect_to_root_domain = false
|
||||
service = "webserver.nextcloud.svc"
|
||||
#service = "nextcloud-svc.next.svc"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
extra-value = <<EOT
|
||||
|
||||
|
||||
location /.well-known/carddav {
|
||||
return 301 $scheme://$host/remote.php/dav;
|
||||
}
|
||||
|
||||
location /.well-known/caldav {
|
||||
return 301 $scheme://$host/remote.php/dav;
|
||||
}
|
||||
|
||||
location = /health {
|
||||
default_type text/html;
|
||||
return 200 "<!DOCTYPE html><h2>health check</h2>\n";
|
||||
}
|
||||
EOT
|
||||
}
|
||||
|
||||
|
||||
|
||||
router = {
|
||||
service = "192.168.88.1"
|
||||
authentication_required = true
|
||||
}
|
||||
homeassistant = {
|
||||
enabled = false
|
||||
service = "homeassistant-svc.homeassistant.svc:8123"
|
||||
}
|
||||
octoprint = {
|
||||
service = "192.168.0.32:5000"
|
||||
extra-value-location = <<EOT
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme; # Crucial for HTTPS to HTTP matching
|
||||
|
||||
# Required for OctoPrint WebSockets to function properly
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
|
||||
client_max_body_size 0; # Allows large file uploads like gcode
|
||||
EOT
|
||||
|
||||
}
|
||||
onitama = {
|
||||
service = "onitama-svc.onitama.svc:8080"
|
||||
enabled = false
|
||||
}
|
||||
|
||||
opentrashmail = {
|
||||
# service = "opentrashmail.opentrashmail.svc"
|
||||
service = "1.1.1.1"
|
||||
enabled = false
|
||||
}
|
||||
paperless = {
|
||||
#service = "webserver.paperless.svc:8000"
|
||||
service = "paperless-svc.paperless.svc:8000"
|
||||
}
|
||||
pihole = {
|
||||
service = "172.16.0.60:8081"
|
||||
enabled = false
|
||||
}
|
||||
portainer = {
|
||||
service = "portainer.portainer.svc"
|
||||
}
|
||||
prowlarr = {
|
||||
service = "prowlarr-svc.servarr.svc:9696"
|
||||
geoip_allow = ["FR", "GB", "NL"]
|
||||
|
||||
}
|
||||
proxmox = {
|
||||
service = "192.168.6.2:8006"
|
||||
enabled = false
|
||||
}
|
||||
qbittorrent = {
|
||||
#enabled = false
|
||||
service = "qbittorrent-svc.servarr.svc:8080"
|
||||
geoip_allow = ["FR", "GB", "NL"]
|
||||
|
||||
}
|
||||
radarr = {
|
||||
service = "radarr-svc.servarr.svc:7878"
|
||||
geoip_allow = ["FR", "GB", "NL"]
|
||||
|
||||
}
|
||||
recommendarr = {
|
||||
service = "recommendarr-svc.servarr.svc:3000"
|
||||
enabled = false
|
||||
}
|
||||
#reverse = {
|
||||
# service = "192.168.88.50:8888"
|
||||
# enabled = false
|
||||
#}
|
||||
sickchill = {
|
||||
service = "sickchill.servarr.svc"
|
||||
enabled = false
|
||||
}
|
||||
transmission = {
|
||||
service = "192.168.88.52:31091"
|
||||
enabled = false
|
||||
}
|
||||
unifi = {
|
||||
# service = "unifi.unifi.svc:8443"
|
||||
service = "192.168.88.244:8443"
|
||||
proxy_pass_https = true
|
||||
}
|
||||
unifi-inform = {
|
||||
service = "192.168.88.50:8082"
|
||||
}
|
||||
dupeguru = {
|
||||
service = "dupeguru.dupeguru.svc:5800"
|
||||
enabled = false
|
||||
authentication_required = true
|
||||
}
|
||||
|
||||
immich = {
|
||||
#service = "immich-server.immich.svc:2283"
|
||||
service = "immich-svc.immich.svc:2283"
|
||||
geoip_allow = ["FR", "GB", "NL"]
|
||||
extra-value-location = <<EOT
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_read_timeout 60000s;
|
||||
|
||||
|
||||
#adding websocket , usefull for reverse proxy
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_cache_bypass $http_upgrade;
|
||||
#end of working
|
||||
EOT
|
||||
}
|
||||
immicht = {
|
||||
service = "immicht-svc.immicht.svc:2283"
|
||||
enabled = false
|
||||
}
|
||||
|
||||
netdata = {
|
||||
enabled = false
|
||||
service = "netdata-agent.netdata.svc:19999"
|
||||
}
|
||||
screeps = {
|
||||
enabled = false
|
||||
redirect_to_https_bool = false
|
||||
listen_port_80_bool = true
|
||||
service = "screeps-svc.screeps.svc:25565"
|
||||
}
|
||||
minecraft = {
|
||||
enabled = false
|
||||
redirect_to_https_bool = false
|
||||
listen_port_80_bool = true
|
||||
service = "minecraft-svc.minecraft.svc:21025"
|
||||
}
|
||||
stirling = {
|
||||
enabled = false
|
||||
service = "stirling-svc.stirling.svc:8080"
|
||||
extra-value-location = <<EOT
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_read_timeout 60000s;
|
||||
#working
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_cache_bypass $http_upgrade;
|
||||
#end of working
|
||||
|
||||
|
||||
|
||||
EOT
|
||||
}
|
||||
vulcan = {
|
||||
service = "vulcan.vulcan.svc:80"
|
||||
enabled = false
|
||||
}
|
||||
|
||||
nginx = {
|
||||
enabled = false
|
||||
service = "nginx-svc.nginx.svc"
|
||||
}
|
||||
openmediavault = {
|
||||
service = "192.168.88.29"
|
||||
# service = "192.168.88.42"
|
||||
}
|
||||
pihole = {
|
||||
service = "web.piholenew.svc"
|
||||
}
|
||||
jellyfin = {
|
||||
enabled = false
|
||||
service = "jellyfin-svc.jellyfin.svc:8096"
|
||||
}
|
||||
gogs = {
|
||||
enabled = false
|
||||
service = "gogs-svc.gogs.svc:3000"
|
||||
}
|
||||
synology = {
|
||||
enabled = true
|
||||
service = "192.168.88.39:5000"
|
||||
}
|
||||
|
||||
gitea = {
|
||||
enabled = true
|
||||
service = "webserver.gitea.svc:3000"
|
||||
docker_service = "gitea:3000"
|
||||
redirect_to_root_domain = false
|
||||
}
|
||||
|
||||
spider = {
|
||||
enabled = false
|
||||
service = "spider-svc.spider.svc:8080"
|
||||
}
|
||||
nextcloud-terraform = {
|
||||
enabled = false
|
||||
service = "nextcloud-web-svc.nextcloud-terraform.svc:80"
|
||||
|
||||
}
|
||||
paper = {
|
||||
enabled = false
|
||||
service = "paper-svc.paper.svc:8000"
|
||||
|
||||
}
|
||||
next = {
|
||||
enabled = false
|
||||
service = "next-svc.next.svc"
|
||||
proxy_cache = true
|
||||
http2_bool = true
|
||||
extra-value = <<EOT
|
||||
|
||||
|
||||
location /.well-known/carddav {
|
||||
return 301 $scheme://$host/remote.php/dav;
|
||||
}
|
||||
|
||||
location /.well-known/caldav {
|
||||
return 301 $scheme://$host/remote.php/dav;
|
||||
}
|
||||
|
||||
location = /health {
|
||||
default_type text/html;
|
||||
return 200 "<!DOCTYPE html><h2>health check</h2>\n";
|
||||
}
|
||||
EOT
|
||||
}
|
||||
|
||||
bookstack-terraform = {
|
||||
enabled = false
|
||||
service = "bookstack-svc.bookstack-terraform.svc"
|
||||
}
|
||||
stash = {
|
||||
# enabled = false
|
||||
service = "stash-svc.stash.svc:9999"
|
||||
#geoip_blocking = false
|
||||
#extra-value= <<EOT
|
||||
# proxy_protocol on;
|
||||
#EOT
|
||||
extra-value-location = <<EOT
|
||||
#don't use this as this needs to be run as root or have the CAP_NET_RAW capability) to bind to a non-local IP address.
|
||||
#Because the backend thinks the request is coming directly from the client, it will try to send the response directly back to that client IP. To prevent this (which would break the connection), you must force the response back through the NGINX server.
|
||||
#proxy_bind $remote_addr transparent;
|
||||
|
||||
##used to be working
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_read_timeout 60000s;
|
||||
#working
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_cache_bypass $http_upgrade;
|
||||
#end of working
|
||||
EOT
|
||||
|
||||
geoip_allow = ["FR", "GB", "NL"]
|
||||
}
|
||||
neko = {
|
||||
enabled = false
|
||||
service = "neko-svc.neko.svc:8080"
|
||||
http2_bool = true
|
||||
extra-value-location = <<EOT
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_cache_bypass $http_upgrade;
|
||||
|
||||
EOT
|
||||
|
||||
}
|
||||
pinchflat = {
|
||||
enabled = false
|
||||
service = "pinchflat-svc.pinchflat.svc:8945"
|
||||
}
|
||||
|
||||
jobspy = {
|
||||
enabled = false
|
||||
service = "jobspy-svc.jobspy.svc:8000"
|
||||
}
|
||||
poste = {
|
||||
enabled = false
|
||||
service = "poste-svc.poste.svc:443"
|
||||
proxy_pass_https = true
|
||||
extra-value-location = <<EOT
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_read_timeout 60000s;
|
||||
#working
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_cache_bypass $http_upgrade;
|
||||
#end of working
|
||||
|
||||
|
||||
|
||||
EOT
|
||||
}
|
||||
wikijs = {
|
||||
#enabled = false
|
||||
geoip_blocking = false
|
||||
service = "wikijs-svc.wikijs.svc:3000"
|
||||
extra-value = <<EOT
|
||||
client_max_body_size 20m;
|
||||
proxy_request_buffering off;
|
||||
EOT
|
||||
}
|
||||
|
||||
keycloak = {
|
||||
enabled = false
|
||||
service = "keycloak-svc.keycloak.svc:8080"
|
||||
extra-value = <<EOT
|
||||
|
||||
set_real_ip_from 0.0.0.0/0;
|
||||
real_ip_header X-Real-IP;
|
||||
real_ip_recursive on;
|
||||
EOT
|
||||
}
|
||||
oauthn = {
|
||||
enabled = false
|
||||
service = "oauth2-proxy-svc.oauth2-proxy.svc:4180"
|
||||
|
||||
# extra-value = <<EOT
|
||||
# location /oauth2/ {
|
||||
# proxy_pass http://oauthn_backend;
|
||||
# proxy_set_header Host $host;
|
||||
# proxy_set_header X-Real-IP $remote_addr;
|
||||
# proxy_set_header X-Scheme $scheme;
|
||||
# }
|
||||
# EOT
|
||||
|
||||
|
||||
}
|
||||
emailproxy = {
|
||||
enabled = false
|
||||
service = "emailproxy-svc.paper.svc:80"
|
||||
}
|
||||
tdarr = {
|
||||
enabled = false
|
||||
service = "tdarr-svc.servarr.svc:8265"
|
||||
extra-value-location = <<EOT
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_read_timeout 60000s;
|
||||
#working
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_cache_bypass $http_upgrade;
|
||||
#end of working
|
||||
|
||||
|
||||
|
||||
EOT
|
||||
|
||||
}
|
||||
opencloud = {
|
||||
enabled = false
|
||||
service = "opencloud-svc.opencloud.svc:9200"
|
||||
proxy_pass_https = true
|
||||
|
||||
}
|
||||
owncloud = {
|
||||
enabled = false
|
||||
service = "owncloud-svc.owncloud.svc:8080"
|
||||
}
|
||||
|
||||
#overleaf = {
|
||||
# service = "overleaf-svc.overleaf.svc:80"
|
||||
#}
|
||||
}
|
||||
deny_ip = ["1.2.3.4"]
|
||||
Reference in New Issue
Block a user