Compare commits
3
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 pi-ux-ce
|
85026544e8 | ||
|
pi-ux-ce
|
810fa2951a | ||
|
pi-ux-ce
|
9f83ec215b |
@@ -39,8 +39,3 @@ terraform.rc
|
||||
module.tf.save*
|
||||
terraform.tfstate*
|
||||
.terraform.lock.hcl
|
||||
|
||||
.bw-provider-state
|
||||
|
||||
|
||||
.claude
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
9fdbb94c-0fd5-4ce2-919f-1fbb596cd318
|
||||
@@ -1,119 +0,0 @@
|
||||
variable "cronjob" {
|
||||
type = map(object({
|
||||
name = optional(string)
|
||||
image = string
|
||||
enabled = bool
|
||||
namespace = optional(string)
|
||||
connected_namespace = optional(string, "")
|
||||
schedule = string
|
||||
command = optional(list(string))
|
||||
args = optional(list(string))
|
||||
|
||||
|
||||
pvc = optional(map(object({
|
||||
name = string
|
||||
pvc = optional(bool, false)
|
||||
config_map = optional(bool, false)
|
||||
secret = optional(bool, false)
|
||||
host_path = optional(string)
|
||||
pvc_size = optional(string)
|
||||
storage_class_name = optional(string, "nfs-storage-intelligent")
|
||||
annotations_fileType = optional(string)
|
||||
existing_pvc = optional(bool, false)
|
||||
mount_path = string
|
||||
sub_path = optional(string)
|
||||
})))
|
||||
}))
|
||||
|
||||
}
|
||||
|
||||
|
||||
locals {
|
||||
pvc_list = flatten([
|
||||
for key, value in var.cronjob : [
|
||||
for index, pvc in value.pvc : {
|
||||
key = "${coalesce(value.namespace, value.connected_namespace, key)}/${pvc.name}"
|
||||
index = index
|
||||
pvc = pvc.pvc
|
||||
name = pvc.name
|
||||
pvc_size = pvc.pvc_size
|
||||
mount_path = pvc.mount_path
|
||||
storage_class_name = pvc.storage_class_name
|
||||
annotations_fileType = pvc.annotations_fileType
|
||||
existing_pvc = pvc.existing_pvc
|
||||
sub_path = pvc.sub_path
|
||||
namespace = coalesce(value.namespace, value.connected_namespace, key)
|
||||
}] if value.enabled == true && value.pvc != null
|
||||
])
|
||||
|
||||
# group duplicates instead of throwing an error
|
||||
pvc_map_grouped = {
|
||||
for p in local.pvc_list :
|
||||
p.key => p...
|
||||
}
|
||||
|
||||
# keep only one PVC per key (take the first)
|
||||
pvc_map = {
|
||||
for k, list in local.pvc_map_grouped :
|
||||
k => list[0]
|
||||
}
|
||||
|
||||
pvc_details = values(local.pvc_map)
|
||||
}
|
||||
|
||||
resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-cronjob" {
|
||||
for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc && value.existing_pvc != true }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.key)
|
||||
name = "${each.value.name}-pvc"
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
annotations = {
|
||||
fileType = try(each.value.annotations_fileType, "file")
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
spec {
|
||||
access_modes = ["ReadWriteMany"]
|
||||
storage_class_name = each.value.storage_class_name
|
||||
resources {
|
||||
requests = {
|
||||
storage = each.value.pvc_size
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_cron_job_v1" "automatic_cronjob" {
|
||||
for_each = { for key, value in var.cronjob : key => value if value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-cronjob"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
schedule = each.value.schedule
|
||||
job_template {
|
||||
metadata {}
|
||||
spec {
|
||||
template {
|
||||
metadata {}
|
||||
spec {
|
||||
container {
|
||||
name = coalesce(each.value.name, each.key)
|
||||
image = each.value.image
|
||||
command = each.value.command != null ? each.value.command : []
|
||||
args = each.value.args != null ? each.value.args : []
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,90 +0,0 @@
|
||||
############################################
|
||||
# config file for ${name_site}
|
||||
############################################
|
||||
|
||||
upstream ${name_site}_backend {
|
||||
server ${name_service};
|
||||
server 1.1.1.1 backup;
|
||||
}
|
||||
|
||||
server {
|
||||
server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
|
||||
location / {
|
||||
proxy_pass http://${name_site}_backend;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Host $host;
|
||||
}
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
access_log /var/log/nginx/access.log my_custom_format;
|
||||
access_log /var/log/nginx/ip_audit.log ip_audit;
|
||||
|
||||
listen 443 ssl;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;
|
||||
ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
if ($host = www.${name_site}.tryton.geeraert.eu) {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
|
||||
if ($host = ${name_site}.tryton.geeraert.eu) {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server_name www.${name_site}.tryton.geeraert.eu ${name_site}.tryton.geeraert.eu;
|
||||
listen 80;
|
||||
return 404;
|
||||
|
||||
}
|
||||
############################################
|
||||
# config file for ${name_site}
|
||||
############################################
|
||||
|
||||
upstream ${name_site}_backend_root {
|
||||
server ${name_service};
|
||||
server 1.1.1.1 backup;
|
||||
}
|
||||
|
||||
server {
|
||||
server_name ${name_site}.geeraert.eu www.${name_site}.geeraert.eu;
|
||||
location / {
|
||||
proxy_pass http://${name_site}_backend_root;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Host $host;
|
||||
}
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
access_log /var/log/nginx/access.log my_custom_format;
|
||||
access_log /var/log/nginx/ip_audit.log ip_audit;
|
||||
|
||||
listen 443 ssl;
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/live/geeraert.eu/fullchain.pem;
|
||||
ssl_certificate_key /etc/nginx/ssl/live/geeraert.eu/privkey.pem;
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
if ($host = www.${name_site}.geeraert.eu) {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
|
||||
if ($host = ${name_site}.geeraert.eu) {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server_name www.${name_site}.geeraert.eu ${name_site}.geeraert.eu;
|
||||
listen 80;
|
||||
return 404;
|
||||
|
||||
}
|
||||
@@ -1,56 +0,0 @@
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_host" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
|
||||
key = "${each.key}__redis__host"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.redis.host, "${each.key}-redis-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_port" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
|
||||
key = "${each.key}__redis__port"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.redis.port, 5432)
|
||||
}
|
||||
|
||||
##
|
||||
## Commenting until I use the redis password option
|
||||
##
|
||||
#resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_password" {
|
||||
# for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
|
||||
# key = "${each.key}__redis__password"
|
||||
# project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
# length = 32
|
||||
# special = true
|
||||
# min_special = 5
|
||||
# avoid_ambiguous = true
|
||||
#}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_REPLICATION_MODE" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
|
||||
key = "${each.key}__redis__REPLICATION_MODE"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.redis.REPLICATION_MODE, "master")
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_TLS_ENABLED" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
|
||||
key = "${each.key}__redis__TLS_ENABLED"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.redis.TLS_ENABLED, "no")
|
||||
}
|
||||
|
||||
resource "kubernetes_secret_v1" "automatic-redis-secret" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-redis-terraform"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
}
|
||||
|
||||
data = {
|
||||
REDIS_HOSTNAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_host[each.key].value}"
|
||||
REDIS_PORT = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_port[each.key].value}"
|
||||
REDIS_REPLICATION_MODE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_REPLICATION_MODE[each.key].value}"
|
||||
REDIS_TLS_ENABLED = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_TLS_ENABLED[each.key].value}"
|
||||
}
|
||||
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -1,134 +0,0 @@
|
||||
resource "kubernetes_deployment_v1" "database-automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) && value.docker != true }
|
||||
|
||||
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${coalesce(each.value.name, each.key)}-db"
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
database = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = each.value.replicas
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = "${each.key}-db"
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = "${each.key}-db"
|
||||
deployment_method = "Terraform"
|
||||
database = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
container {
|
||||
image = try(each.value.database.image, "docker.io/library/postgres:latest")
|
||||
name = "${coalesce(each.value.name, each.key)}-db"
|
||||
port {
|
||||
|
||||
container_port = 5432
|
||||
name = "database-port"
|
||||
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/")
|
||||
name = "${each.key}-db-volume"
|
||||
}
|
||||
|
||||
dynamic "volume_mount" {
|
||||
for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
|
||||
content {
|
||||
mount_path = "/backup"
|
||||
name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
|
||||
command = try([each.value.database.command], [])
|
||||
args = each.value.database_args != null ? each.value.database_args : []
|
||||
|
||||
|
||||
dynamic "env" {
|
||||
for_each = each.value.environment != null ? each.value.environment : {}
|
||||
content {
|
||||
name = env.key
|
||||
value = env.value.value != null ? env.value.value : null
|
||||
dynamic "value_from" {
|
||||
for_each = env.value.value_from != null ? env.value.value_from : {}
|
||||
content {
|
||||
dynamic "secret_key_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env.value.value_from.secret_key_ref.name
|
||||
key = env.value.value_from.secret_key_ref.key
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
|
||||
volume {
|
||||
name = "${each.key}-db-volume"
|
||||
host_path {
|
||||
path = try(each.value.database.host_path, join("/", [var.storage_path.main_storage, coalesce(each.value.namespace, each.value.connected_namespace, each.key), join("-", [each.key, "db"])]))
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "volume" {
|
||||
for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
|
||||
content {
|
||||
name = "${each.key}-db-backup"
|
||||
|
||||
host_path {
|
||||
path = join("/", [var.storage_path.fast_access, "Backup", coalesce(each.value.namespace, each.value.connected_namespace, each.key), "${each.key}-db-backup"])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "docker_container" "database-automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) && value.docker == true }
|
||||
|
||||
image = try(each.value.database.image, "docker.io/library/postgres:latest")
|
||||
name = "${coalesce(each.value.name, each.key)}-db"
|
||||
hostname = "${coalesce(each.value.name, each.key)}-db"
|
||||
|
||||
networks_advanced {
|
||||
name = docker_network.terraform_network[0].name
|
||||
}
|
||||
|
||||
#no ports as they should be able to speak within the same network
|
||||
|
||||
volumes {
|
||||
container_path = try(each.value.database.mountPath, "/var/lib/postgresql/")
|
||||
host_path = each.value.database.host_path
|
||||
}
|
||||
|
||||
|
||||
env = [
|
||||
for key, value in(each.value.environment != null ? each.value.environment : {}) :
|
||||
"${key}=${value.value != null ? value.value : ""}"
|
||||
]
|
||||
|
||||
|
||||
}
|
||||
@@ -1,250 +0,0 @@
|
||||
|
||||
resource "kubernetes_deployment_v1" "automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true && value.docker != true }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = coalesce(each.value.name, each.key)
|
||||
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = each.value.replicas
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = each.key
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
container {
|
||||
image = each.value.image
|
||||
name = coalesce(each.value.name, each.key)
|
||||
dynamic "port" {
|
||||
for_each = each.value.service_port != null ? each.value.service_port : []
|
||||
content {
|
||||
container_port = port.value
|
||||
# name = "${each.key}-${port.value}"
|
||||
name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
dynamic "volume_mount" {
|
||||
for_each = each.value.pvc != null ? each.value.pvc : {}
|
||||
content {
|
||||
mount_path = volume_mount.value.mount_path
|
||||
name = "${volume_mount.key}-volume"
|
||||
sub_path = volume_mount.value.sub_path != null ? volume_mount.value.sub_path : ""
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "volume_mount" {
|
||||
for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
|
||||
content {
|
||||
mount_path = "/backup"
|
||||
name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.secret_ref != null ? each.value.secret_ref : []
|
||||
content {
|
||||
dynamic "secret_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.config_map_ref != null ? each.value.config_map_ref : []
|
||||
content {
|
||||
dynamic "config_map_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
command = each.value.command != null ? each.value.command : []
|
||||
|
||||
|
||||
dynamic "env" {
|
||||
for_each = each.value.environment != null ? each.value.environment : {}
|
||||
content {
|
||||
name = env.key
|
||||
value = env.value.value != null ? env.value.value : null
|
||||
dynamic "value_from" {
|
||||
for_each = env.value.value_from != null ? env.value.value_from : {}
|
||||
content {
|
||||
dynamic "secret_key_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env.value.value_from.secret_key_ref.name
|
||||
key = env.value.value_from.secret_key_ref.key
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
dynamic "resources" {
|
||||
for_each = each.value.requirements != null ? [1] : []
|
||||
content {
|
||||
limits = {
|
||||
cpu = each.value.requirements.limits-cpu
|
||||
memory = each.value.requirements.limits-memory
|
||||
}
|
||||
requests = {
|
||||
cpu = each.value.requirements.requests-cpu
|
||||
memory = each.value.requirements.requests-memory
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
dynamic "security_context" {
|
||||
for_each = each.value.security_context == true ? [1] : []
|
||||
content {
|
||||
privileged = true
|
||||
#capabilities = {
|
||||
# add : ["NET_ADMIN", "NET_RAW"]
|
||||
#}
|
||||
}
|
||||
}
|
||||
dynamic "liveness_probe" {
|
||||
for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
|
||||
content {
|
||||
dynamic "tcp_socket" {
|
||||
for_each = each.value.liveness_tcp_socket != null ? [""] : []
|
||||
content {
|
||||
port = each.value.liveness_tcp_socket
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "http_get" {
|
||||
for_each = each.value.liveness_http_get != null ? [""] : []
|
||||
content {
|
||||
port = each.value.liveness_http_get
|
||||
path = coalesce(each.value.liveness_http_get_path, "/")
|
||||
}
|
||||
}
|
||||
|
||||
initial_delay_seconds = 3
|
||||
period_seconds = 3
|
||||
}
|
||||
}
|
||||
}
|
||||
dynamic "dns_config" {
|
||||
for_each = each.value.dns_nameservers != null ? [1] : []
|
||||
content {
|
||||
nameservers = [each.value.dns_nameservers]
|
||||
}
|
||||
|
||||
}
|
||||
service_account_name = each.value.service_account_name != null ? each.value.service_account_name : null
|
||||
|
||||
dynamic "volume" {
|
||||
for_each = each.value.pvc != null ? each.value.pvc : {}
|
||||
content {
|
||||
name = "${volume.key}-volume"
|
||||
|
||||
dynamic "config_map" {
|
||||
for_each = volume.value.config_map ? [1] : []
|
||||
content {
|
||||
name = volume.key
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "host_path" {
|
||||
for_each = volume.value.host_path != null || (!(volume.value.config_map) && !(volume.value.secret)) ? [1] : []
|
||||
content {
|
||||
path = coalesce(volume.value.host_path, join("/", [var.storage_path.main_storage, coalesce(each.value.namespace, each.value.connected_namespace, each.key), volume.key]))
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "secret" {
|
||||
for_each = volume.value.secret ? [1] : []
|
||||
content {
|
||||
secret_name = volume.key
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
dynamic "volume" {
|
||||
for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
|
||||
content {
|
||||
name = "${each.key}-db-backup"
|
||||
|
||||
host_path {
|
||||
path = join("/", [var.storage_path.fast_access, "Backup", coalesce(each.value.namespace, each.value.connected_namespace, each.key), "${each.key}-db-backup"])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
resource "docker_container" "deployment-automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true && value.docker == true }
|
||||
image = each.value.image
|
||||
name = coalesce(each.value.name, each.key)
|
||||
hostname = coalesce(each.value.name, each.key)
|
||||
|
||||
depends_on = [docker_container.database-automatic]
|
||||
|
||||
networks_advanced {
|
||||
name = "deployment_network"
|
||||
}
|
||||
|
||||
dynamic "ports" {
|
||||
for_each = each.value.service_port != null ? each.value.service_port : []
|
||||
content {
|
||||
internal = ports.value
|
||||
external = each.value.external_port ? ports.value : null
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "volumes" {
|
||||
for_each = each.value.pvc != null ? each.value.pvc : {}
|
||||
content {
|
||||
container_path = volumes.value.mount_path
|
||||
host_path = volumes.value.host_path
|
||||
}
|
||||
}
|
||||
|
||||
env = [
|
||||
for key, value in(each.value.environment != null ? each.value.environment : {}) :
|
||||
"${key}=${value.value != null ? value.value : ""}"
|
||||
]
|
||||
|
||||
|
||||
# null keeps the image's default command; [] would differ from it in state and force replacement
|
||||
command = each.value.command
|
||||
|
||||
}
|
||||
@@ -1,73 +0,0 @@
|
||||
resource "helm_release" "cert_manager" {
|
||||
name = "cert-manager"
|
||||
repository = "oci://quay.io"
|
||||
chart = "jetstack/charts/cert-manager"
|
||||
version = "v1.21.2"
|
||||
namespace = "cert-manager"
|
||||
create_namespace = true
|
||||
wait = false
|
||||
|
||||
|
||||
set = [
|
||||
{
|
||||
name = "crds.enabled"
|
||||
value = "true"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
|
||||
resource "helm_release" "nginx_ingress" {
|
||||
name = "traefik"
|
||||
repository = "https://traefik.github.io/charts"
|
||||
chart = "traefik"
|
||||
version = "v41.7.1"
|
||||
namespace = "traefik"
|
||||
create_namespace = true
|
||||
wait = false
|
||||
|
||||
|
||||
set = [
|
||||
{
|
||||
name = "ports.web.nodePort"
|
||||
value = "80"
|
||||
},
|
||||
{
|
||||
name = "ports.websecure.nodePort"
|
||||
value = "443"
|
||||
},
|
||||
{
|
||||
name = "service.type"
|
||||
value = "NodePort"
|
||||
}
|
||||
|
||||
]
|
||||
}
|
||||
|
||||
resource "kubernetes_manifest" "letsencrypt_prod" {
|
||||
manifest = {
|
||||
"apiVersion" = "cert-manager.io/v1"
|
||||
"kind" = "ClusterIssuer"
|
||||
"metadata" = {
|
||||
"name" = "letsencrypt-prod"
|
||||
}
|
||||
"spec" = {
|
||||
"acme" = {
|
||||
"email" = "franckrobbin6@gmail.com"
|
||||
"privateKeySecretRef" = {
|
||||
"name" = "letsencrypt-prod-account-key"
|
||||
}
|
||||
"server" = "https://acme-v02.api.letsencrypt.org/directory"
|
||||
"solvers" = [
|
||||
{
|
||||
"http01" = {
|
||||
"ingress" = {
|
||||
"class" = "traefik"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
-143
@@ -1,143 +0,0 @@
|
||||
terraform {
|
||||
required_version = "> 0.8.0"
|
||||
required_providers {
|
||||
docker = {
|
||||
source = "kreuzwerker/docker"
|
||||
version = "4.6.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
config_path = "~/.kube/config"
|
||||
}
|
||||
|
||||
provider "docker" {
|
||||
host = "unix:///var/run/docker.sock"
|
||||
}
|
||||
provider "helm" {
|
||||
kubernetes = {
|
||||
config_path = "~/.kube/config"
|
||||
}
|
||||
}
|
||||
|
||||
variable "kubernetes" {
|
||||
type = map(object({
|
||||
name = optional(string)
|
||||
docker = optional(bool)
|
||||
image = string
|
||||
pvc = optional(map(object({
|
||||
name = optional(string)
|
||||
config_map = optional(bool, false)
|
||||
secret = optional(bool, false)
|
||||
local_path = optional(bool, false)
|
||||
host_path = optional(string)
|
||||
storage_class_name = optional(string, "nfs-storage-intelligent")
|
||||
annotations_fileType = optional(string)
|
||||
mount_path = string
|
||||
sub_path = optional(string)
|
||||
})))
|
||||
environment = optional(map(object({
|
||||
name = optional(string)
|
||||
value = optional(string)
|
||||
value_from = optional(object({
|
||||
secret_key_ref = object({
|
||||
name = string
|
||||
key = optional(string, null)
|
||||
})
|
||||
}))
|
||||
})))
|
||||
replicas = optional(number, 1)
|
||||
namespace = optional(string)
|
||||
connected_namespace = optional(string, "")
|
||||
command = optional(list(string))
|
||||
service_port = optional(list(number))
|
||||
external_port = optional(bool, false)
|
||||
service_type = optional(string, "ClusterIP")
|
||||
service_name = optional(string)
|
||||
domain_name = optional(list(string))
|
||||
legacy_domain = optional(bool, false)
|
||||
exposed = optional(bool, true)
|
||||
liveness_tcp_socket = optional(number)
|
||||
liveness_http_get = optional(string)
|
||||
liveness_http_get_path = optional(string)
|
||||
database = optional(map(string))
|
||||
database_command = optional(list(string))
|
||||
database_args = optional(list(string))
|
||||
redis = optional(map(string))
|
||||
enabled = optional(bool, true)
|
||||
secret_ref = optional(list(string))
|
||||
config_map_ref = optional(list(string))
|
||||
config_map_import = optional(list(string))
|
||||
secret_import = optional(list(string))
|
||||
extra_manifest = optional(list(string))
|
||||
requirements = optional(map(string))
|
||||
dns_nameservers = optional(string)
|
||||
service_account_name = optional(string)
|
||||
environment_variables = optional(map(string), { name = "value" })
|
||||
security_context = optional(bool, false)
|
||||
}))
|
||||
|
||||
}
|
||||
|
||||
variable "shunt_docker" {
|
||||
type = bool
|
||||
default = true
|
||||
}
|
||||
|
||||
variable "storage_path" {
|
||||
type = map(string)
|
||||
default = {
|
||||
main_storage = "/data/kubernetes",
|
||||
fast_access = "/ssd"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
locals {
|
||||
env_details = flatten([
|
||||
for key, value in var.kubernetes : [
|
||||
for index, env in value.environment_variables : {
|
||||
index = index
|
||||
name = env
|
||||
}] if value.enabled == true && value.environment_variables != null && value.docker != true
|
||||
])
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
locals {
|
||||
kubernetes_manifests = flatten([
|
||||
for k, obj in var.kubernetes : [
|
||||
for index, manifest in(obj.extra_manifest != null ? obj.extra_manifest : []) :
|
||||
{
|
||||
key = "${k}_${index}"
|
||||
name = obj.name
|
||||
manifest = manifest
|
||||
enabled = obj.enabled
|
||||
}
|
||||
if obj.enabled == true
|
||||
]
|
||||
])
|
||||
}
|
||||
|
||||
resource "kubernetes_manifest" "manifest" {
|
||||
for_each = { for item in local.kubernetes_manifests : item.key => item }
|
||||
|
||||
manifest = yamldecode(file(each.value.manifest))
|
||||
provider = kubernetes
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace_v1" "automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true && value.connected_namespace == "" }
|
||||
metadata {
|
||||
annotations = {
|
||||
name = coalesce(each.value.namespace, each.key)
|
||||
}
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
name = coalesce(each.value.namespace, each.key)
|
||||
}
|
||||
}
|
||||
-125
@@ -1,125 +0,0 @@
|
||||
|
||||
resource "kubernetes_deployment_v1" "redis-automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true && value.docker != true }
|
||||
|
||||
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${coalesce(each.value.name, each.key)}-redis"
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
redis = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = each.value.replicas
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = "${each.key}-redis"
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = "${each.key}-redis"
|
||||
deployment_method = "Terraform"
|
||||
redis = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
container {
|
||||
image = try(each.value.redis.image, "docker.io/library/redis:7")
|
||||
name = "${coalesce(each.value.name, each.key)}-redis"
|
||||
port {
|
||||
|
||||
container_port = 6379
|
||||
name = "redis-port"
|
||||
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
mount_path = "/data"
|
||||
name = "${each.key}-redis-volume"
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
dynamic "env" {
|
||||
for_each = each.value.environment != null ? each.value.environment : {}
|
||||
content {
|
||||
name = env.key
|
||||
value = env.value.value != null ? env.value.value : null
|
||||
dynamic "value_from" {
|
||||
for_each = env.value.value_from != null ? env.value.value_from : {}
|
||||
content {
|
||||
dynamic "secret_key_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env.value.value_from.secret_key_ref.name
|
||||
key = env.value.value_from.secret_key_ref.key
|
||||
# optional = true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
# resources {
|
||||
# limits = {
|
||||
# cpu = each.value.requirements.limits-cpu
|
||||
# memory = each.value.requirements.limits-memory
|
||||
# }
|
||||
# requests = {
|
||||
# cpu = each.value.requirements.requests-cpu
|
||||
# memory = each.value.requirements.requests-memory
|
||||
# }
|
||||
# }
|
||||
|
||||
# dynamic "liveness_probe" {
|
||||
# for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
|
||||
# content {
|
||||
# dynamic "tcp_socket" {
|
||||
# for_each = each.value.liveness_tcp_socket != null ? [""] : []
|
||||
# content {
|
||||
# port = each.value.liveness_tcp_socket
|
||||
# }
|
||||
# }
|
||||
|
||||
|
||||
# dynamic "http_get" {
|
||||
# for_each = each.value.liveness_http_get != null ? [""] : []
|
||||
# content {
|
||||
# port = each.value.liveness_http_get
|
||||
# path = coalesce(each.value.liveness_http_get_path, "/")
|
||||
# }
|
||||
# }
|
||||
|
||||
# initial_delay_seconds = 3
|
||||
# period_seconds = 3
|
||||
# }
|
||||
# }
|
||||
}
|
||||
|
||||
|
||||
volume {
|
||||
name = "${each.key}-redis-volume"
|
||||
host_path {
|
||||
path = try(each.value.redis.host_path, join("/", [var.storage_path.main_storage, coalesce(each.value.namespace, each.value.connected_namespace, each.key), join("-", [each.key, "redis"])]))
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,18 +0,0 @@
|
||||
module "ingress" {
|
||||
source = "../modules/ingress"
|
||||
kubernetes_input = var.kubernetes
|
||||
}
|
||||
|
||||
|
||||
module "services" {
|
||||
source = "../modules/services"
|
||||
kubernetes_input = var.kubernetes
|
||||
}
|
||||
|
||||
|
||||
resource "docker_network" "terraform_network" {
|
||||
#avoiding this to create if the shunt_docker is on
|
||||
count = var.shunt_docker ? 0 : 1
|
||||
name = "deployment_network"
|
||||
}
|
||||
|
||||
@@ -1,376 +0,0 @@
|
||||
kubernetes = {
|
||||
echo = {
|
||||
#enabled = false
|
||||
#docker = true
|
||||
image = "ealen/echo-server:latest"
|
||||
service_port = [4580]
|
||||
external_port = true
|
||||
service_type = "NodePort"
|
||||
domain_name = ["echo", "hello"]
|
||||
#command = ["-text=Hello authenticated world!"]
|
||||
pvc = {
|
||||
echo-config = {
|
||||
mount_path = "/app/configs"
|
||||
}
|
||||
echo-testing = {
|
||||
mount_path = "/app/test"
|
||||
}
|
||||
}
|
||||
environment = {
|
||||
PORT = {
|
||||
value = 4580
|
||||
}
|
||||
PAPERLESS_REDIS = {
|
||||
value = "redis://paperless-redis-svc:6379"
|
||||
}
|
||||
database = {
|
||||
value = "datgg"
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
gitea = {
|
||||
#enabled = false
|
||||
#docker = true
|
||||
image = "gitea/gitea:1.27.0"
|
||||
service_port = [3000]
|
||||
# no service_port: nginx reaches http://gitea:3000 over deployment_network
|
||||
database = {
|
||||
image = "postgres:17"
|
||||
mountPath = "/var/lib/postgresql/data"
|
||||
host_path = "/data/kubernetes/gitea/gitea-db-data"
|
||||
}
|
||||
# shared by the gitea and gitea-db containers (the db ignores GITEA__*, gitea ignores POSTGRES_*)
|
||||
environment = {
|
||||
POSTGRES_USER = { value = "gitea-KY56Q" }
|
||||
POSTGRES_PASSWORD = { value = "Modulator-Yearning-Gills3" }
|
||||
POSTGRES_DB = { value = "gitea-database" }
|
||||
|
||||
GITEA__database__DB_TYPE = { value = "postgres" }
|
||||
#GITEA__database__HOST = { value = "gitea-db:5432" } # for docker
|
||||
GITEA__database__HOST = { value = "gitea-db-svc:5432" } # for k8s
|
||||
GITEA__database__USER = { value = "gitea-KY56Q" }
|
||||
GITEA__database__PASSWD = { value = "Modulator-Yearning-Gills3" }
|
||||
GITEA__database__NAME = { value = "gitea-database" }
|
||||
}
|
||||
pvc = {
|
||||
gitea-data = {
|
||||
name = "gitea-data"
|
||||
mount_path = "/data"
|
||||
host_path = "/data/kubernetes/gitea/gitea-data"
|
||||
}
|
||||
gitea-documents-backup = {
|
||||
name = "gitea-documents-backup"
|
||||
mount_path = "/backup"
|
||||
host_path = "/data/kubernetes/gitea/gitea-documents-backup"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
gitea-runner = {
|
||||
#enabled = false
|
||||
#docker = true
|
||||
image = "gitea/act_runner:latest"
|
||||
exposed = false
|
||||
connected_namespace = "gitea"
|
||||
environment = {
|
||||
GITEA_INSTANCE_URL = { value = "https://gitea.geeraert.eu/" }
|
||||
GITEA_RUNNER_REGISTRATION_TOKEN = { value = "rqi4mFW8LXoc5MhIrUD1rjzdmKVY8n9X14BP6sWd" }
|
||||
GITEA_RUNNER_NAME = { value = "runner" }
|
||||
GITEA_RUNNER_LABELS = { value = "label" }
|
||||
}
|
||||
pvc = {
|
||||
gitea-runner-data = {
|
||||
name = "gitea-runner-data"
|
||||
mount_path = "/data"
|
||||
host_path = "/data/kubernetes/gitea/gitea-runner-data"
|
||||
}
|
||||
docker-sock = {
|
||||
name = "docker-sock"
|
||||
mount_path = "/var/run/docker.sock"
|
||||
host_path = "/var/run/docker.sock"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
bitwarden-admin = {
|
||||
#enabled = false
|
||||
namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-admin"
|
||||
image = "ghcr.io/bitwarden/admin:2026.1.0"
|
||||
extra_manifest = ["../external_manifests/bitwarden/config.configmap.yml", "../external_manifests/bitwarden/global.env.configmap.yml", "../external_manifests/bitwarden/global.override.env.configmap.yml", "../external_manifests/bitwarden/mssql.env.configmap.yml", "../external_manifests/bitwarden/mssql.override.env.configmap.yml", "../external_manifests/bitwarden/uid.env.configmap.yml", "../external_manifests/bitwarden/bitwarden-identity-cert-password.secret.yml"]
|
||||
service_port = [5000]
|
||||
exposed = false
|
||||
config_map_ref = ["global.env", "uid.env", "global.override.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-ca-certificates-pvc = {
|
||||
mount_path = "/etc/bitwarden/ca-certificates"
|
||||
}
|
||||
|
||||
bitwarden-core-pvc = {
|
||||
mount_path = "/etc/bitwarden/core"
|
||||
}
|
||||
bitwarden-logs-pvc = {
|
||||
mount_path = "/etc/bitwarden/logs"
|
||||
sub_path = "admin"
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
bitwarden-api = {
|
||||
#enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-api"
|
||||
image = "gitea.tryton.geeraert.eu/pi-ux-ce/bitbetter_api:2026.1.0"
|
||||
service_port = [5000]
|
||||
exposed = false
|
||||
config_map_ref = ["global.env", "uid.env", "global.override.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-ca-certificates-pvc = {
|
||||
mount_path = "/etc/bitwarden/ca-certificates"
|
||||
}
|
||||
|
||||
bitwarden-core-pvc = {
|
||||
mount_path = "/etc/bitwarden/core"
|
||||
}
|
||||
bitwarden-logs-pvc = {
|
||||
mount_path = "/etc/bitwarden/logs"
|
||||
sub_path = "api"
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
bitwarden-attachments = {
|
||||
#enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-attachments"
|
||||
image = "ghcr.io/bitwarden/attachments:2026.1.0"
|
||||
service_port = [5000]
|
||||
exposed = false
|
||||
config_map_ref = ["global.env", "uid.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-core-pvc = {
|
||||
mount_path = "/etc/bitwarden/core/attachments"
|
||||
sub_path = "attachments"
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
bitwarden-events = {
|
||||
#enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-events"
|
||||
image = "ghcr.io/bitwarden/events:2026.1.0"
|
||||
service_port = [5000]
|
||||
exposed = false
|
||||
config_map_ref = ["global.env", "uid.env", "global.override.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-ca-certificates-pvc = {
|
||||
mount_path = "/etc/bitwarden/ca-certificates"
|
||||
}
|
||||
bitwarden-logs-pvc = {
|
||||
mount_path = "/etc/bitwarden/logs"
|
||||
sub_path = "events"
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
bitwarden-icons = {
|
||||
#enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-icons"
|
||||
image = "ghcr.io/bitwarden/icons:2026.1.0"
|
||||
service_port = [5000]
|
||||
exposed = false
|
||||
config_map_ref = ["global.env", "uid.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-ca-certificates-pvc = {
|
||||
mount_path = "/etc/bitwarden/ca-certificates"
|
||||
}
|
||||
bitwarden-logs-pvc = {
|
||||
mount_path = "/etc/bitwarden/logs"
|
||||
sub_path = "icons"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
bitwarden-identity = {
|
||||
#enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-identity"
|
||||
image = "gitea.tryton.geeraert.eu/pi-ux-ce/bitbetter_identity:2026.1.0"
|
||||
service_port = [5000]
|
||||
exposed = false
|
||||
config_map_ref = ["global.env", "uid.env", "global.override.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-identity-pvc = {
|
||||
mount_path = "/etc/bitwarden/identity"
|
||||
}
|
||||
bitwarden-ca-certificates-pvc = {
|
||||
mount_path = "/etc/bitwarden/ca-certificates"
|
||||
}
|
||||
|
||||
bitwarden-core-pvc = {
|
||||
mount_path = "/etc/bitwarden/core"
|
||||
}
|
||||
bitwarden-logs-pvc = {
|
||||
mount_path = "/etc/bitwarden/logs"
|
||||
sub_path = "identity"
|
||||
}
|
||||
}
|
||||
}
|
||||
bitwarden-mssql = {
|
||||
#enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-mssql"
|
||||
image = "ghcr.io/bitwarden/mssql:2026.1.0"
|
||||
service_port = [1433, 5000]
|
||||
exposed = false
|
||||
config_map_ref = ["mssql.env", "uid.env", "mssql.override.env"]
|
||||
environment = {}
|
||||
database = {
|
||||
shunt = "true"
|
||||
engine = "sqlserver"
|
||||
username = "sa"
|
||||
host = "bitwarden-mssql-svc"
|
||||
name = "bitwarden_vault"
|
||||
}
|
||||
|
||||
pvc = {
|
||||
bitwarden-mssql-pvc = {
|
||||
mount_path = "/var/opt/mssql/data"
|
||||
sub_path = "data"
|
||||
}
|
||||
bitwarden-logs-pvc = {
|
||||
mount_path = "/etc/bitwarden/logs"
|
||||
sub_path = "mssql"
|
||||
}
|
||||
}
|
||||
}
|
||||
bitwarden-nginx = {
|
||||
#enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-nginx"
|
||||
image = "ghcr.io/bitwarden/nginx:2026.1.0"
|
||||
service_port = [8080, 5000, 8443]
|
||||
exposed = true #no need to set as true but I did it for easy access
|
||||
legacy_domain = true
|
||||
domain_name = ["bitwarden"]
|
||||
config_map_ref = ["uid.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-nginx-pvc = {
|
||||
mount_path = "/etc/bitwarden/nginx"
|
||||
}
|
||||
bitwarden-letsencrypt-pvc = {
|
||||
mount_path = "/etc/letsencrypt"
|
||||
}
|
||||
|
||||
bitwarden-ssl-pvc = {
|
||||
mount_path = "/etc/ssl"
|
||||
}
|
||||
bitwarden-logs-pvc = {
|
||||
mount_path = "/var/log/nginx"
|
||||
sub_path = "nginx"
|
||||
}
|
||||
}
|
||||
}
|
||||
bitwarden-notifications = {
|
||||
#enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-notifications"
|
||||
image = "ghcr.io/bitwarden/notifications:2026.1.0"
|
||||
service_port = [5000]
|
||||
exposed = false
|
||||
config_map_ref = ["global.env", "uid.env", "global.override.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-ca-certificates-pvc = {
|
||||
mount_path = "/etc/bitwarden/ca-certificates"
|
||||
name = "bitwarden-ca-certificates-pvc"
|
||||
}
|
||||
bitwarden-logs-pvc = {
|
||||
mount_path = "/etc/bitwarden/logs"
|
||||
sub_path = "notifications"
|
||||
}
|
||||
}
|
||||
}
|
||||
bitwarden-sso = {
|
||||
#enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-sso"
|
||||
image = "ghcr.io/bitwarden/sso:2026.1.0"
|
||||
service_port = [5000]
|
||||
exposed = false
|
||||
config_map_ref = ["global.env", "uid.env", "global.override.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-identity-pvc = {
|
||||
mount_path = "/etc/bitwarden/identity"
|
||||
}
|
||||
bitwarden-core-pvc = {
|
||||
mount_path = "/etc/bitwarden/core"
|
||||
}
|
||||
bitwarden-ca-certificates-pvc = {
|
||||
mount_path = "/etc/bitwarden/ca-certificates"
|
||||
}
|
||||
bitwarden-logs-pvc = {
|
||||
mount_path = "/etc/bitwarden/logs"
|
||||
sub_path = "sso"
|
||||
}
|
||||
}
|
||||
}
|
||||
bitwarden-web = {
|
||||
#enabled = false
|
||||
connected_namespace = "bitwarden"
|
||||
replicas = 1
|
||||
name = "bitwarden-web"
|
||||
image = "ghcr.io/bitwarden/web:2026.1.0"
|
||||
service_port = [5000]
|
||||
exposed = false
|
||||
config_map_ref = ["global.env", "uid.env"]
|
||||
environment = {}
|
||||
|
||||
pvc = {
|
||||
bitwarden-web-pvc = {
|
||||
mount_path = "/etc/bitwarden/web"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: bitwarden-identity-cert-password
|
||||
namespace: bitwarden
|
||||
type: Opaque
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: bitwarden-mssql-nodeport
|
||||
namespace: bitwarden
|
||||
spec:
|
||||
ports:
|
||||
- name: 1433bitwarden-m
|
||||
nodePort: 31433
|
||||
port: 1433
|
||||
protocol: TCP
|
||||
targetPort: 1433
|
||||
selector:
|
||||
app: bitwarden-mssql
|
||||
type: NodePort
|
||||
@@ -1,46 +0,0 @@
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: bitwarden-calendar-backup
|
||||
namespace: bitwarden
|
||||
spec:
|
||||
schedule: "0 0 * * *"
|
||||
jobTemplate:
|
||||
spec:
|
||||
backoffLimit: 4
|
||||
ttlSecondsAfterFinished: 100
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: bitwarden-database-backup
|
||||
image: mcr.microsoft.com/mssql-tools
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: bitwarden-mssql-db-terraform
|
||||
optional: false
|
||||
command: ["/bin/sh","-c"]
|
||||
#args: ["mysqldump -h $DB_HOST -u $MYSQL_USER -p$MYSQL_ROOT_PASSWORD $MYSQL_DATABASE |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz "]
|
||||
args: ["sleep 3600"]
|
||||
volumeMounts:
|
||||
- name: backup
|
||||
mountPath: /backup
|
||||
volumes:
|
||||
- name: backup
|
||||
persistentVolumeClaim:
|
||||
claimName: bitwarden-database-backup
|
||||
restartPolicy: Never
|
||||
---
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: bitwarden-database-backup
|
||||
namespace: bitwarden
|
||||
annotations:
|
||||
fileType: Backup
|
||||
spec:
|
||||
storageClassName: nfs-storage-fastaccess
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 2Gi
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,11 +0,0 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
APP_URL: https://bookstack.tryton.geeraert.eu
|
||||
LOCAL_GID: "1000"
|
||||
LOCAL_UID: "1000"
|
||||
TZ: Europe/London
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: config
|
||||
namespace: bitwarden
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
ACCEPT_EULA: "Y"
|
||||
ASPNETCORE_ENVIRONMENT: Production
|
||||
globalSettings__baseServiceUri__vault: http://localhost
|
||||
globalSettings__pushRelayBaseUri: https://push.bitwarden.com
|
||||
globalSettings__selfHosted: "true"
|
||||
globalSettings__baseServiceUri__internalNotifications: "http://bitwarden-notifications-svc:5000"
|
||||
globalSettings__baseServiceUri__internalAdmin: "http://bitwarden-admin-svc:5000"
|
||||
globalSettings__baseServiceUri__internalIdentity: "http://bitwarden-identity-svc:5000"
|
||||
globalSettings__baseServiceUri__internalApi: "http://bitwarden-api-svc:5000"
|
||||
globalSettings__baseServiceUri__internalVault: "http://bitwarden-web-svc:5000"
|
||||
globalSettings__baseServiceUri__internalSso: "http://bitwarden-sso-svc:5000"
|
||||
globalSettings__baseServiceUri__internalScim: "http://bitwarden-self-host-scim:5000"
|
||||
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: global.env
|
||||
namespace: bitwarden
|
||||
|
||||
@@ -1,28 +0,0 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
ACCEPT_EULA: "Y"
|
||||
adminSettings__admins: pierre@geeraert.eu
|
||||
globalSettings__baseServiceUri__vault: http://bitwarden.tryton.geeraert.eu
|
||||
globalSettings__disableUserRegistration: "false"
|
||||
globalSettings__duo__aKey: p9jCHtnG4NZNZu4SThpVlCuOF1oePGhu53Wa4RJwuyeqRAWQ0aJN7GsKYrGbYIYO
|
||||
globalSettings__hibpApiKey: REPLACE
|
||||
globalSettings__identityServer__certificatePassword: test
|
||||
globalSettings__installation__id: c36aded0-b0f1-4252-920b-ac4c008fc920
|
||||
globalSettings__installation__key: CtQE5U1tMJE4Dzk7N9DU
|
||||
globalSettings__internalIdentityKey: I5TMbqmEjhw9uBNmFZ9rU6s1KN5xqAKXh7RSPfgyj2XQ4sjlP22SCupFn4IVhYX7
|
||||
globalSettings__mail__replyToEmail: no-reply@bitwarden.tryton.geeraert.eu
|
||||
globalSettings__mail__smtp__host: smtp.gmail.com
|
||||
globalSettings__mail__smtp__password: vmxkiidikqwirpuh
|
||||
globalSettings__mail__smtp__port: "587"
|
||||
globalSettings__mail__smtp__ssl: "false"
|
||||
globalSettings__mail__smtp__username: p3jh6qa2@gmail.com
|
||||
globalSettings__oidcIdentityClientKey: w47pWOkPa6mrTkiPuKizitsiRTR6NH8ufI01u77zbZt3LUcKWJ4wchMn6ouiwN7V
|
||||
globalSettings__sqlServer__connectionString: Data Source=tcp:bitwarden-mssql-svc,1433;Initial
|
||||
Catalog=bitwarden_vault;Persist Security Info=False;User ID=sa;Password=ChQKWDIW73eSHzX1UyvGDAv4pFw6DVKM;MultipleActiveResultSets=False;Connect
|
||||
Timeout=30;Encrypt=True;TrustServerCertificate=True
|
||||
globalSettings__yubico__clientId: REPLACE
|
||||
globalSettings__yubico__key: REPLACE
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: global.override.env
|
||||
namespace: bitwarden
|
||||
@@ -1,9 +0,0 @@
|
||||
globalSettings__duo__aKey=p9jCHtnG4NZNZu4SThpVlCuOF1oePGhu53Wa4RJwuyeqRAWQ0aJN7GsKYrGbYIYO
|
||||
globalSettings__hibpApiKey=REPLACE
|
||||
globalSettings__identityServer__certificatePassword=test
|
||||
globalSettings__installation__key=CtQE5U1tMJE4Dzk7N9DU
|
||||
globalSettings__internalIdentityKey=I5TMbqmEjhw9uBNmFZ9rU6s1KN5xqAKXh7RSPfgyj2XQ4sjlP22SCupFn4IVhYX7
|
||||
globalSettings__mail__smtp__password=vmxkiidikqwirpuh
|
||||
globalSettings__oidcIdentityClientKey=w47pWOkPa6mrTkiPuKizitsiRTR6NH8ufI01u77zbZt3LUcKWJ4wchMn6ouiwN7V
|
||||
globalSettings__sqlServer__connectionString=Data Source=tcp:bitwarden-mssql-svc,1433;Initial Catalog=bitwarden_vault;Persist Security Info=False;User ID=sa;Password=ChQKWDIW73eSHzX1UyvGDAv4pFw6DVKM;MultipleActiveResultSets=False;Connect Timeout=30;Encrypt=True;TrustServerCertificate=True
|
||||
globalSettings__yubico__key=REPLACE
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
deployment_method: manually
|
||||
name: identity
|
||||
namespace: bitwarden
|
||||
spec:
|
||||
ports:
|
||||
- name: 5000bitwarden-i
|
||||
port: 5000
|
||||
protocol: TCP
|
||||
targetPort: 5000
|
||||
selector:
|
||||
app: bitwarden-identity
|
||||
type: ClusterIP
|
||||
@@ -1,9 +0,0 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
ACCEPT_EULA: "Y"
|
||||
MSSQL_PID: Express
|
||||
SA_PASSWORD: SECRET
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: mssql.env
|
||||
namespace: bitwarden
|
||||
@@ -1,7 +0,0 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
SA_PASSWORD: ChQKWDIW73eSHzX1UyvGDAv4pFw6DVKM
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: mssql.override.env
|
||||
namespace: bitwarden
|
||||
@@ -1 +0,0 @@
|
||||
SA_PASSWORD=ChQKWDIW73eSHzX1UyvGDAv4pFw6DVKM
|
||||
@@ -1,8 +0,0 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
LOCAL_GID: "1001"
|
||||
LOCAL_UID: "1001"
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: uid.env
|
||||
namespace: bitwarden
|
||||
@@ -1,10 +0,0 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
DB_DATABASE_NAME: ZGphbmdv
|
||||
DB_HOST: ZGphbmdvLWRiLXN2Yw==
|
||||
DB_PASSWORD: U3VmZnJhZ2UtTW9uZXliYWdzLUlsbHVzaW9uNw==
|
||||
DB_USERNAME: ZGphbmdvX3VzZXJuYW1l
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: django-db-credentials
|
||||
namespace: django
|
||||
@@ -1,17 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: django-db-nodeport
|
||||
namespace: django
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
nodePort: 32345
|
||||
port: 5432
|
||||
protocol: TCP
|
||||
targetPort: 5432
|
||||
selector:
|
||||
app: django-db
|
||||
type: NodePort
|
||||
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -1 +0,0 @@
|
||||
kubectl exec -it -n reverse-proxy deploy/reverse-proxy -c reverse-proxy -- nginx -s reload
|
||||
@@ -1,23 +0,0 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
nginx-http-auth.local: |
|
||||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for nginx-http-auth
|
||||
|
||||
# To use more aggressive http-auth modes set filter parameter "mode" in jail.local:
|
||||
# normal (default), aggressive (combines all), auth or fallback
|
||||
# See "tests/files/logs/nginx-http-auth" or "filter.d/nginx-http-auth.conf" for usage example and details.
|
||||
|
||||
[nginx-http-auth]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
filter = nginx-unauthorized
|
||||
action = nginx-block-map
|
||||
logpath = /var/log/nginx/backend_debug.log
|
||||
maxretry = 5
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: fail2ban-nginx-http-auth-jail
|
||||
namespace: fail2ban
|
||||
@@ -1,30 +0,0 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
nginx-unauthorized.local: |
|
||||
## Version 2022/08/06
|
||||
# Fail2Ban filter configuration for nginx unauthorized
|
||||
|
||||
[INCLUDES]
|
||||
before = common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
#original
|
||||
#failregex = ^<HOST>.*"(GET|POST|HEAD).*" (401) .*$
|
||||
|
||||
|
||||
#try this one
|
||||
failregex = ^<HOST> - .* "(?:GET|POST|HEAD) [^"]+" 401
|
||||
^<HOST> - .* upstream_status=401
|
||||
#for servarr
|
||||
^<HOST> -.*"GET /login\?returnUrl=/&loginFailed=true HTTP/.*" 200
|
||||
^<HOST> -.*"POST /login\?returnUrl=/&loginFailed=true HTTP/.*" 200
|
||||
#for bitwarden
|
||||
^<HOST> -.*"POST /identity/accounts/prelogin *HTTP/.*" 200
|
||||
#actionban = touch /tmp/<name>.ban
|
||||
#actionunban = touch /tmp/<name>.unban
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: fail2ban-nginx-unauthorized-filter
|
||||
namespace: fail2ban
|
||||
@@ -1,19 +0,0 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: role:service-acc
|
||||
namespace: reverse-proxy
|
||||
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- pods
|
||||
- pods/exec
|
||||
verbs:
|
||||
- create
|
||||
- list
|
||||
- apiGroups: ["apps"]
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- get
|
||||
@@ -1,15 +0,0 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: rolebinding:service-acc
|
||||
namespace: reverse-proxy
|
||||
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: role:service-acc
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kubectl-service-account
|
||||
namespace: fail2ban
|
||||
@@ -1,6 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: kubectl-service-account
|
||||
namespace: fail2ban
|
||||
@@ -1,58 +0,0 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
nginx-block-map.local: "## Version 2022/08/06\n# Fail2Ban configuration file for
|
||||
black-listing via nginx\n#\n# Author: Serg G. Brester (aka sebres)\n#\n# To use
|
||||
'nginx-block-map' action you should define some special blocks in your nginx configuration,\n#
|
||||
and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx
|
||||
by ban).\n#\n# Example (argument \"token_id\" resp. cookie \"session_id\" used
|
||||
here as unique identifier for user):\n#\n# http {\n# ...\n# # maps to
|
||||
check user is blacklisted (banned in f2b):\n# #map $arg_token_id $blck_lst_tok
|
||||
{ include blacklisted-tokens.map; }\n# map $cookie_session_id $blck_lst_ses
|
||||
{ include blacklisted-sessions.map; }\n# ...\n# # special log-format to
|
||||
notify fail2ban about failures:\n# log_format f2b_session_errors '$msec failure
|
||||
\"$cookie_session_id\" - $remote_addr - $remote_user '\n# ;# '\"$request\"
|
||||
$status $bytes_sent '\n# # '\"$http_referer\" \"$http_user_agent\"';\n#\n#
|
||||
\ # location checking blacklisted values:\n# location ... {\n# #
|
||||
check banned sessionid:\n# if ($blck_lst_ses != \"\") {\n# try_files
|
||||
\"\" @f2b-banned;\n# }\n# ...\n# # notify fail2ban about a failure
|
||||
inside nginx:\n# error_page 401 = @notify-f2b;\n# ...\n# }\n#
|
||||
\ ...\n# # location for return with \"403 Forbidden\" if banned:\n# location
|
||||
@f2b-banned {\n# default_type text/html;\n# return 403 \"<br/><center>\n#
|
||||
\ <b style=\\\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\\\">\n#
|
||||
\ You are banned!</b></center>\";\n# }\n# ...\n# # location
|
||||
to notify fail2ban about a failure inside nginx:\n# location @notify-f2b {\n#
|
||||
\ access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;\n# }\n#
|
||||
\ }\n# ...\n#\n# Note that quote-character (and possibly other special characters)
|
||||
are not allowed currently as session-id.\n# Thus please add any session-id validation
|
||||
rule in your locations (or in the corresponding backend-service), \n# like in
|
||||
example below:\n#\n# location ... {\n# if ($cookie_session_id !~ \"^[\\w\\-]+$\")
|
||||
{\n# return 403 \"Wrong session-id\"\n# }\n# ...\n# }\n#\n# The
|
||||
parameters for jail corresponding log-format (f2b_session_errors):\n#\n# [nginx-blck-lst]\n#
|
||||
\ filter =\n# datepattern = ^Epoch\n# failregex = ^ failure \"<F-ID>[^\"]+</F-ID>\"
|
||||
- <ADDR>\n# usedns = no\n#\n# The same log-file can be used for IP-related jail
|
||||
(additionally to session-related, to ban very bad IPs):\n#\n# [nginx-blck-ip]\n#
|
||||
\ maxretry = 100\n# filter =\n# datepattern = ^Epoch\n# failregex = ^ failure
|
||||
\"[^\"]+\" - <ADDR>\n# usedns = no\n#\n\n[Definition]\n\n# path to configuration
|
||||
of nginx (used to target nginx-instance in multi-instance system,\n# and as path
|
||||
for the blacklisted map):\n#srv_cfg_path = /etc/nginx/\n\nsrv_cfg_path = /blacklisted.d/\n\n#
|
||||
cmd-line arguments to supply to test/reload nginx:\n#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf\nsrv_cmd
|
||||
= nginx\n\n# pid file (used to check nginx is running):\nsrv_pid = /run/nginx.pid\n\n#
|
||||
command used to check whether nginx is running and configuration is valid:\nsrv_is_running
|
||||
= [ -f \"%(srv_pid)s\" ]\nsrv_check_cmd = %(srv_is_running)s && %(srv_cmd)s -qt\n\n#
|
||||
first test nginx is running and configuration is correct, hereafter send reload
|
||||
signal:\n#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then\n# %(srv_cmd)s
|
||||
-s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;\n# fi;\n\nrestart_file
|
||||
= /restart-signal/restart.txt\n\nblck_lst_reload = touch %(restart_file)s;sleep
|
||||
20; rm %(restart_file)s;\n\n# map-file for nginx, can be redefined using `action
|
||||
= nginx-block-map[blck_lst_file=\"/path/file.map\"]`:\nblck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf\n\n#
|
||||
Action definition:\n\nactionstart_on_demand = false\nactionstart = touch '%(blck_lst_file)s'\n\nactionflush
|
||||
= truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s\n\nactionstop = %(actionflush)s\n\nactioncheck
|
||||
= \n\n_echo_blck_row = printf '\\%%s 1;\\n' \"<fid>\"\n\nactionban = echo <ip>
|
||||
| awk -F. '{print \"deny \"$1\".\"$2\".\"$3\".\"$4\";\"}' >> '%(blck_lst_file)s';
|
||||
%(blck_lst_reload)s\n\nactionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\\/$*.^|[]/\\\\&/g');
|
||||
sed -i \"/^$id$/d\" %(blck_lst_file)s; %(blck_lst_reload)s\n"
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: nginx-block-map-action
|
||||
namespace: fail2ban
|
||||
@@ -1,124 +0,0 @@
|
||||
## Version 2022/08/06
|
||||
# Fail2Ban configuration file for black-listing via nginx
|
||||
#
|
||||
# Author: Serg G. Brester (aka sebres)
|
||||
#
|
||||
# To use 'nginx-block-map' action you should define some special blocks in your nginx configuration,
|
||||
# and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx by ban).
|
||||
#
|
||||
# Example (argument "token_id" resp. cookie "session_id" used here as unique identifier for user):
|
||||
#
|
||||
# http {
|
||||
# ...
|
||||
# # maps to check user is blacklisted (banned in f2b):
|
||||
# #map $arg_token_id $blck_lst_tok { include blacklisted-tokens.map; }
|
||||
# map $cookie_session_id $blck_lst_ses { include blacklisted-sessions.map; }
|
||||
# ...
|
||||
# # special log-format to notify fail2ban about failures:
|
||||
# log_format f2b_session_errors '$msec failure "$cookie_session_id" - $remote_addr - $remote_user '
|
||||
# ;# '"$request" $status $bytes_sent '
|
||||
# # '"$http_referer" "$http_user_agent"';
|
||||
#
|
||||
# # location checking blacklisted values:
|
||||
# location ... {
|
||||
# # check banned sessionid:
|
||||
# if ($blck_lst_ses != "") {
|
||||
# try_files "" @f2b-banned;
|
||||
# }
|
||||
# ...
|
||||
# # notify fail2ban about a failure inside nginx:
|
||||
# error_page 401 = @notify-f2b;
|
||||
# ...
|
||||
# }
|
||||
# ...
|
||||
# # location for return with "403 Forbidden" if banned:
|
||||
# location @f2b-banned {
|
||||
# default_type text/html;
|
||||
# return 403 "<br/><center>
|
||||
# <b style=\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\">
|
||||
# You are banned!</b></center>";
|
||||
# }
|
||||
# ...
|
||||
# # location to notify fail2ban about a failure inside nginx:
|
||||
# location @notify-f2b {
|
||||
# access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;
|
||||
# }
|
||||
# }
|
||||
# ...
|
||||
#
|
||||
# Note that quote-character (and possibly other special characters) are not allowed currently as session-id.
|
||||
# Thus please add any session-id validation rule in your locations (or in the corresponding backend-service),
|
||||
# like in example below:
|
||||
#
|
||||
# location ... {
|
||||
# if ($cookie_session_id !~ "^[\w\-]+$") {
|
||||
# return 403 "Wrong session-id"
|
||||
# }
|
||||
# ...
|
||||
# }
|
||||
#
|
||||
# The parameters for jail corresponding log-format (f2b_session_errors):
|
||||
#
|
||||
# [nginx-blck-lst]
|
||||
# filter =
|
||||
# datepattern = ^Epoch
|
||||
# failregex = ^ failure "<F-ID>[^"]+</F-ID>" - <ADDR>
|
||||
# usedns = no
|
||||
#
|
||||
# The same log-file can be used for IP-related jail (additionally to session-related, to ban very bad IPs):
|
||||
#
|
||||
# [nginx-blck-ip]
|
||||
# maxretry = 100
|
||||
# filter =
|
||||
# datepattern = ^Epoch
|
||||
# failregex = ^ failure "[^"]+" - <ADDR>
|
||||
# usedns = no
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
# path to configuration of nginx (used to target nginx-instance in multi-instance system,
|
||||
# and as path for the blacklisted map):
|
||||
#srv_cfg_path = /etc/nginx/
|
||||
|
||||
srv_cfg_path = /blacklisted.d/
|
||||
|
||||
# cmd-line arguments to supply to test/reload nginx:
|
||||
#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf
|
||||
srv_cmd = nginx
|
||||
|
||||
# pid file (used to check nginx is running):
|
||||
srv_pid = /run/nginx.pid
|
||||
|
||||
# command used to check whether nginx is running and configuration is valid:
|
||||
srv_is_running = [ -f "%(srv_pid)s" ]
|
||||
srv_check_cmd = %(srv_is_running)s && %(srv_cmd)s -qt
|
||||
|
||||
# first test nginx is running and configuration is correct, hereafter send reload signal:
|
||||
#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then
|
||||
# %(srv_cmd)s -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;
|
||||
# fi;
|
||||
|
||||
restart_file = /restart-signal/restart.txt
|
||||
|
||||
blck_lst_reload = kubectl exec -it -n reverse-proxy deploy/reverse-proxy -c reverse-proxy -- nginx -s reload
|
||||
|
||||
# map-file for nginx, can be redefined using `action = nginx-block-map[blck_lst_file="/path/file.map"]`:
|
||||
blck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf
|
||||
|
||||
# Action definition:
|
||||
|
||||
actionstart_on_demand = false
|
||||
actionstart = touch '%(blck_lst_file)s'
|
||||
|
||||
actionflush = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s
|
||||
|
||||
actionstop = %(actionflush)s
|
||||
|
||||
actioncheck =
|
||||
|
||||
_echo_blck_row = printf '\%%s 1;\n' "<fid>"
|
||||
|
||||
actionban = kubectl exec -it -n reverse-proxy deploy/reverse-proxy -c reverse-proxy -- sh -c "echo 'deny <ip>;' > /etc/nginx/blacklisted.d/blacklisted-sessions.conf"; %(blck_lst_reload)s
|
||||
|
||||
actionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\/$*.^|[]/\\&/g'); sed -i "/^$id$/d" %(blck_lst_file)s; %(blck_lst_reload)s
|
||||
@@ -1,12 +0,0 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
VPN_DNS_IP: MTAuMi4wLjE=
|
||||
VPN_ENDPOINT_IP: ODkuMTA1LjIxNC4xOTY=
|
||||
VPN_ENDPOINT_PORT: NTE4MjA=
|
||||
WIREGUARD_PRIVATE_KEY: Q0h3OHNkVUliaVRPbTgxTzZGOWRyMm9Nc2k1ZFl4SnZValo1Z2Jwd3UzWT0=
|
||||
WIREGUARD_PUBLIC_KEY: WG4yQkwrdmhJZ2dsMnVKZ29HY2NqMG4wQ3Z3N09hZU5LMXdPZk91dElTUT0=
|
||||
kind: Secret
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: gluetun-secret-nl-free-280
|
||||
namespace: gluetun
|
||||
@@ -1,10 +0,0 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
DB_DATABASE_NAME: aW1taWNo
|
||||
DB_HOST: aW1taWNoLWRiLXN2Yw==
|
||||
DB_PASSWORD: U3Bvb24tQm9yb3VnaC1CYXNpczg=
|
||||
DB_USERNAME: aW1taWNo
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: immich-db-credentials
|
||||
namespace: immich
|
||||
@@ -5,9 +5,9 @@ data:
|
||||
POSTGRES_PASSWORD: cGFwZXJsZXNz
|
||||
PAPERLESS_ADMIN_USER: YWRtaW4=
|
||||
PAPERLESS_ADMIN_PASSWORD: YWRtaW4=
|
||||
POSTGRES_HOST: cGFwZXJsZXNzLWRiLXN2Yw==
|
||||
POSTGRES_HOST: cGFwZXItZGItc3Zj
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: paperless-credentials
|
||||
namespace: paperless
|
||||
namespace: paper
|
||||
type: Opaque
|
||||
|
||||
@@ -1,5 +0,0 @@
|
||||
[IMAP-1993]
|
||||
documentation = *** note: this server will work for both Office 365 and personal Outlook/Hotmail accounts ***
|
||||
server_address = outlook.office365.com
|
||||
server_port = 993
|
||||
local_address = 127.0.0.1
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
emailproxy.config: |
|
||||
[IMAP-1993]
|
||||
documentation = *** note: this server will work for both Office 365 and personal Outlook/Hotmail accounts ***
|
||||
server_address = outlook.office365.com
|
||||
server_port = 993
|
||||
local_address = 127.0.0.1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: emailproxyconfig
|
||||
namespace: paperless
|
||||
@@ -1,45 +0,0 @@
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: paperless-calendar-backup
|
||||
namespace: paperless
|
||||
spec:
|
||||
schedule: "0 0 * * *"
|
||||
jobTemplate:
|
||||
spec:
|
||||
backoffLimit: 4
|
||||
ttlSecondsAfterFinished: 100
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: paperless-database-backup
|
||||
image: alpine/psql
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: paperless-db-terraform
|
||||
optional: false
|
||||
command: ["/bin/sh","-c"]
|
||||
args: ["pg_dump |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz "]
|
||||
volumeMounts:
|
||||
- name: backup
|
||||
mountPath: /backup
|
||||
volumes:
|
||||
- name: backup
|
||||
persistentVolumeClaim:
|
||||
claimName: paperless-database-backup
|
||||
restartPolicy: Never
|
||||
---
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: paperless-database-backup
|
||||
namespace: paperless
|
||||
annotations:
|
||||
fileType: Backup
|
||||
spec:
|
||||
storageClassName: nfs-storage-fastaccess
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 2Gi
|
||||
@@ -6,5 +6,6 @@ data:
|
||||
DB_USER: cHJvd2xhcnJfdXNlcm5hbWU=
|
||||
kind: Secret
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: prowlarr-credentials
|
||||
namespace: bookstack
|
||||
|
||||
@@ -6,5 +6,6 @@ data:
|
||||
DB_USER: c2VydmFycl91c2VybmFtZQ==
|
||||
kind: Secret
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: servarr-db-credentials
|
||||
namespace: servarr
|
||||
|
||||
@@ -35,8 +35,8 @@ PROXY_HTTP="http://gluetun-svc.gluetun.svc:8888"
|
||||
#BASE_URL="https://www.pornpics.com/pornstars/eiby-shine/"
|
||||
#pornstars="eiby-shine"
|
||||
|
||||
#BASE_URL="https://www.pornpics.com/pornstars/chloe-camilla/"
|
||||
#pornstars="chloe-camilla"
|
||||
BASE_URL="https://www.pornpics.com/?q=shy+imp"
|
||||
pornstars="shy-imp"
|
||||
|
||||
#BASE_URL="https://www.pornpics.com/pornstars/becky-summer"
|
||||
#pornstars="becky-summer"
|
||||
@@ -44,9 +44,6 @@ PROXY_HTTP="http://gluetun-svc.gluetun.svc:8888"
|
||||
|
||||
#clear files beforehand
|
||||
|
||||
echo "Pornstar: "$pornstars
|
||||
echo "URL: "$BASE_URL
|
||||
|
||||
|
||||
mkdir -p $DESTINATION_FOLDER/$pornstars
|
||||
|
||||
@@ -66,7 +63,7 @@ echo "" > $DESTINATION_FOLDER/$pornstars-image_to_download.txt
|
||||
|
||||
|
||||
for f in $(cat $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt ); do
|
||||
$curl_command $f | grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | grep "https://cdni.pornpics.com/" >> $DESTINATION_FOLDER/$pornstars-image_to_download.txt
|
||||
$curl_command $f | grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | grep "https://cdni.pornpics.com/1280" >> $DESTINATION_FOLDER/$pornstars-image_to_download.txt
|
||||
echo $f
|
||||
done
|
||||
|
||||
@@ -76,3 +73,4 @@ for g in $(cat $DESTINATION_FOLDER/$pornstars-image_to_download.txt ); do
|
||||
# wget -e use_proxy=yes -e http_proxy=$PROXY_HTTP $g -P $DESTINATION_FOLDER/$pornstars
|
||||
echo $g
|
||||
done
|
||||
exit 0
|
||||
|
||||
@@ -1,85 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
#install required packages
|
||||
apk add curl wget
|
||||
|
||||
#named argument generation
|
||||
skip_searching_gallery="${skip_searching_gallery:-false}"
|
||||
|
||||
|
||||
while [ $# -gt 0 ]; do
|
||||
if [[ $1 == "--"* ]]; then
|
||||
v="${1/--/}"
|
||||
declare "$v"="$2"
|
||||
shift
|
||||
fi
|
||||
shift
|
||||
done
|
||||
|
||||
#check if we will use a HTTP proxy or not
|
||||
|
||||
if [[ -z $http_proxy ]]; then
|
||||
echo "not using proxy"
|
||||
curl_command="curl"
|
||||
else
|
||||
echo "using proxy"
|
||||
echo $http_proxy
|
||||
curl_command="curl -x $http_proxy"
|
||||
|
||||
fi
|
||||
|
||||
|
||||
#dowload from https://www.pornpics.com/pornstars/eiby-shine/
|
||||
DESTINATION_FOLDER="/data"
|
||||
PROXY_HTTP="http://gluetun-svc.gluetun.svc:8888"
|
||||
|
||||
#BASE_URL="https://www.pornpics.com/pornstars/eiby-shine/"
|
||||
#pornstars="eiby-shine"
|
||||
|
||||
#BASE_URL="https://www.pornpics.com/?q=shy+imp"
|
||||
#pornstars="shy-imp"
|
||||
|
||||
#BASE_URL="https://www.pornpics.com/pornstars/gloria-sol/"
|
||||
#pornstars="gloria-sol"
|
||||
|
||||
|
||||
#BASE_URL="https://www.pornpics.com/pornstars/becky-summer"
|
||||
#pornstars="becky-summer"
|
||||
|
||||
|
||||
#clear files beforehand
|
||||
|
||||
echo "Pornstar: "$pornstars
|
||||
echo "URL: "$BASE_URL
|
||||
|
||||
mkdir -p $DESTINATION_FOLDER/$pornstars
|
||||
|
||||
if [[ $skip_searching_gallery == true ]]; then
|
||||
echo "not looping through galleries"
|
||||
echo "using existing file instead"
|
||||
#because we need to keep the file $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt with the existing URL , in this condition,
|
||||
#no deletion of this file
|
||||
else
|
||||
echo "looping through galleries"
|
||||
#because we will re-generate this file, can be emptied
|
||||
echo "" > $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt
|
||||
$curl_command -s $BASE_URL | grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | grep "https://www.pornpics.com/galleries/" |sort -u >> $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt
|
||||
fi
|
||||
|
||||
echo "" > $DESTINATION_FOLDER/$pornstars-image_to_download.txt
|
||||
|
||||
|
||||
for f in $(cat $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt ); do
|
||||
echo "$curl_command $f"
|
||||
$curl_command "$f"
|
||||
$curl_command "$f" | grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | grep "https://cdni.pornpics.com/1280" >> $DESTINATION_FOLDER/$pornstars-image_to_download.txt
|
||||
echo $f
|
||||
done
|
||||
|
||||
|
||||
for g in $(cat $DESTINATION_FOLDER/$pornstars-image_to_download.txt ); do
|
||||
$curl_command -O --output-dir $DESTINATION_FOLDER/$pornstars "$g"
|
||||
# wget -e use_proxy=yes -e http_proxy=$PROXY_HTTP $g -P $DESTINATION_FOLDER/$pornstars
|
||||
echo $g
|
||||
done
|
||||
exit 0
|
||||
@@ -6,24 +6,25 @@ data:
|
||||
\"$v\"=\"$2\"\n shift\n fi\n shift\ndone\n\n#check if we will use
|
||||
a HTTP proxy or not\n\nif [[ -z $http_proxy ]]; then\n echo \"not using
|
||||
proxy\"\n curl_command=\"curl\"\nelse\n echo \"using proxy\"\n curl_command=\"curl
|
||||
-x $http_proxy\"\n\nfi\n\n\n#dowload from https://www.pornpics.com/pornstars/eiby-shine/\nDESTINATION_FOLDER=\"/data\"\nPROXY_HTTP=\"http://gluetun-svc.gluetun.svc:8888\"\n\n#BASE_URL=\"https://www.pornpics.com/pornstars/eiby-shine/\"\n#pornstars=\"eiby-shine\"\n\n#BASE_URL=\"https://www.pornpics.com/pornstars/chloe-camilla/\"\n#pornstars=\"chloe-camilla\"\n\n#BASE_URL=\"https://www.pornpics.com/pornstars/becky-summer\"\n#pornstars=\"becky-summer\"\n\n\n#clear
|
||||
files beforehand\n\necho \"Pornstar: \"$pornstars\necho \"URL: \"$BASE_URL\n\n\nmkdir
|
||||
-p $DESTINATION_FOLDER/$pornstars\n\nif [[ $skip_searching_gallery == true ]];
|
||||
then\n echo \"not looping through galleries\"\n\t\techo \"using existing
|
||||
file instead\"\n\t\t#because we need to keep the file $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt
|
||||
with the existing URL , in this condition, \n\t\t#no deletion of this file\nelse\n
|
||||
\ echo \"looping through galleries\"\n\t\t#because we will re-generate this
|
||||
file, can be emptied\n\t\techo \"\" > $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt\n
|
||||
-x $http_proxy\"\n\nfi\n\n\n#dowload from https://www.pornpics.com/pornstars/eiby-shine/\nDESTINATION_FOLDER=\"/data\"\nPROXY_HTTP=\"http://gluetun-svc.gluetun.svc:8888\"\n\n#BASE_URL=\"https://www.pornpics.com/pornstars/eiby-shine/\"\n#pornstars=\"eiby-shine\"\n\nBASE_URL=\"https://www.pornpics.com/?q=shy+imp\"\npornstars=\"shy-imp\"\n\n#BASE_URL=\"https://www.pornpics.com/pornstars/becky-summer\"\n#pornstars=\"becky-summer\"\n\n\n#clear
|
||||
files beforehand\n\n\nmkdir -p $DESTINATION_FOLDER/$pornstars\n\nif [[ $skip_searching_gallery
|
||||
== true ]]; then\n echo \"not looping through galleries\"\n\t\techo \"using
|
||||
existing file instead\"\n\t\t#because we need to keep the file $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt
|
||||
with the existing URL , in this condition, \n\t\t#no deletion of this file\necho
|
||||
\"https://www.pornpics.com/galleries/onlyfans-shy-imp-starring-shy-imp-naked-porn-pics-90263490/\nhttps://www.pornpics.com/galleries/onlyfans-shy-imp-featuring-shy-imp-xxx-porn-pics-15741579/\nhttps://www.pornpics.com/galleries/onlyfans-shy-imp-starring-shy-imp-naked-photos-68925414/\nhttps://www.pornpics.com/galleries/onlyfans-shy-imp-shy-imp-20862921/\nhttps://www.pornpics.com/galleries/skinny-girl-with-pink-hair-shy-imp-shows-her-small-tits-during-a-solo-show-50988369/\nhttps://www.pornpics.com/galleries/onlyfans-shy-imp-featuring-shy-imp-hot-gallery-86312934/\"
|
||||
>> $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt\n\nelse\n echo
|
||||
\"looping through galleries\"\n\t\t#because we will re-generate this file, can
|
||||
be emptied\n\t\techo \"\" > $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt\n
|
||||
\ $curl_command -s $BASE_URL | grep -Eo \"(http|https)://[a-zA-Z0-9./?=_%:-]*\"
|
||||
| grep \"https://www.pornpics.com/galleries/\" |sort -u >> $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt\nfi\n\necho
|
||||
\"\" > $DESTINATION_FOLDER/$pornstars-image_to_download.txt\n\n\nfor f in $(cat
|
||||
$DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt ); do\n\t$curl_command $f
|
||||
| grep -Eo \"(http|https)://[a-zA-Z0-9./?=_%:-]*\" | grep \"https://cdni.pornpics.com/\"
|
||||
| grep -Eo \"(http|https)://[a-zA-Z0-9./?=_%:-]*\" | grep \"https://cdni.pornpics.com/1280\"
|
||||
>> $DESTINATION_FOLDER/$pornstars-image_to_download.txt\n\techo $f\ndone\n\n\nfor
|
||||
g in $(cat $DESTINATION_FOLDER/$pornstars-image_to_download.txt ); do \n\t$curl_command
|
||||
-O --output-dir $DESTINATION_FOLDER/$pornstars $g\n# wget -e use_proxy=yes
|
||||
-e http_proxy=$PROXY_HTTP $g -P $DESTINATION_FOLDER/$pornstars\n echo $g
|
||||
\ndone\n"
|
||||
\ndone\nexit 0\n"
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
|
||||
@@ -17,17 +17,13 @@ spec:
|
||||
mountPropagation: None
|
||||
name: data-pvc
|
||||
command:
|
||||
# - /bin/bash
|
||||
# - -c
|
||||
# - sleep 3600
|
||||
- bash
|
||||
- -c
|
||||
- sleep 3600
|
||||
# - bash
|
||||
- /config/download.sh
|
||||
- --http_proxy
|
||||
- "http://gluetun-svc.gluetun.svc:8888"
|
||||
- --BASE_URL
|
||||
- "https://www.pornpics.com/?q=bretona"
|
||||
- --pornstars
|
||||
- "bretona"
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- configMap:
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: tdarr-svc-ext
|
||||
namespace: servarr
|
||||
spec:
|
||||
ports:
|
||||
- name: tdarr
|
||||
nodePort: 30266
|
||||
port: 8266
|
||||
protocol: TCP
|
||||
targetPort: 8266
|
||||
selector:
|
||||
app: tdarr
|
||||
type: NodePort
|
||||
@@ -6,5 +6,6 @@ data:
|
||||
DB_USER: d2lraWpzX3VzZXJuYW1l
|
||||
kind: Secret
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: wikijs-db-credentials
|
||||
namespace: wikijs
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
terraform 1.16.5
|
||||
@@ -1,171 +0,0 @@
|
||||
resource "kubernetes_deployment_v1" "database-automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }
|
||||
|
||||
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${coalesce(each.value.name, each.key)}-db"
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
database = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = each.value.replicas
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = "${each.key}-db"
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = "${each.key}-db"
|
||||
deployment_method = "Terraform"
|
||||
database = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
container {
|
||||
image = try(each.value.database.image, "docker.io/library/postgres:latest")
|
||||
name = "${coalesce(each.value.name, each.key)}-db"
|
||||
port {
|
||||
|
||||
container_port = 5432
|
||||
name = "database-port"
|
||||
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/")
|
||||
name = "${each.key}-db-volume"
|
||||
}
|
||||
|
||||
dynamic "volume_mount" {
|
||||
for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
|
||||
content {
|
||||
mount_path = "/backup"
|
||||
name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
|
||||
command = try([each.value.database.command], [])
|
||||
args = each.value.database_args != null ? each.value.database_args : []
|
||||
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
|
||||
content {
|
||||
dynamic "secret_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "env" {
|
||||
for_each = each.value.environment != null ? each.value.environment : {}
|
||||
content {
|
||||
name = env.key
|
||||
value = env.value.value != null ? env.value.value : null
|
||||
dynamic "value_from" {
|
||||
for_each = env.value.value_from != null ? env.value.value_from : {}
|
||||
content {
|
||||
dynamic "secret_key_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env.value.value_from.secret_key_ref.name
|
||||
key = env.value.value_from.secret_key_ref.key
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
|
||||
volume {
|
||||
name = "${each.key}-db-volume"
|
||||
host_path {
|
||||
path = try(each.value.database.host_path, join("/", [var.storage_path.main_storage, coalesce(each.value.namespace, each.value.connected_namespace, each.key), join("-", [each.key, "db"])]))
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "volume" {
|
||||
for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
|
||||
content {
|
||||
name = "${each.key}-db-backup"
|
||||
|
||||
host_path {
|
||||
path = join("/", [var.storage_path.fast_access, "Backup", coalesce(each.value.namespace, each.value.connected_namespace, each.key), "${each.key}-db-backup"])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_cron_job_v1" "database-backup" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${coalesce(each.value.namespace, each.key)}-db-backup"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
database = "true"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
failed_jobs_history_limit = 5
|
||||
schedule = "1 0 * * *"
|
||||
timezone = "Etc/UTC"
|
||||
successful_jobs_history_limit = 5
|
||||
job_template {
|
||||
metadata {}
|
||||
spec {
|
||||
backoff_limit = 4
|
||||
ttl_seconds_after_finished = 100
|
||||
template {
|
||||
metadata {}
|
||||
spec {
|
||||
container {
|
||||
name = "${coalesce(each.value.namespace, each.key)}-db-backup"
|
||||
image = try(var.database_backup_info[each.value.database.engine].image, var.database_backup_info.postgres.image)
|
||||
command = ["/bin/sh", "-c"]
|
||||
args = [try(var.database_backup_info[each.value.database.engine].command, var.database_backup_info.postgres.command)]
|
||||
env_from {
|
||||
secret_ref {
|
||||
name = "${each.key}-db-terraform"
|
||||
}
|
||||
}
|
||||
volume_mount {
|
||||
mount_path = "/backup"
|
||||
name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
volume {
|
||||
name = "${each.key}-db-backup"
|
||||
persistent_volume_claim {
|
||||
claim_name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,242 +0,0 @@
|
||||
|
||||
module "ingress" {
|
||||
source = "../modules/ingress"
|
||||
kubernetes_input = var.kubernetes
|
||||
}
|
||||
|
||||
module "services" {
|
||||
source = "../modules/services"
|
||||
kubernetes_input = var.kubernetes
|
||||
}
|
||||
|
||||
resource "kubernetes_deployment_v1" "automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = coalesce(each.value.name, each.key)
|
||||
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = each.value.replicas
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = each.key
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
container {
|
||||
image = each.value.image
|
||||
name = coalesce(each.value.name, each.key)
|
||||
dynamic "port" {
|
||||
for_each = each.value.service_port != null ? each.value.service_port : []
|
||||
content {
|
||||
container_port = port.value
|
||||
# name = "${each.key}-${port.value}"
|
||||
name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
dynamic "volume_mount" {
|
||||
for_each = each.value.pvc != null ? each.value.pvc : {}
|
||||
content {
|
||||
mount_path = volume_mount.value.mount_path
|
||||
name = "${volume_mount.key}-volume"
|
||||
sub_path = volume_mount.value.sub_path != null ? volume_mount.value.sub_path : ""
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "volume_mount" {
|
||||
for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
|
||||
content {
|
||||
mount_path = "/backup"
|
||||
name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.secret_ref != null ? each.value.secret_ref : []
|
||||
content {
|
||||
dynamic "secret_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
|
||||
#for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-terraform"] : []
|
||||
content {
|
||||
dynamic "secret_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-mapped-terraform"] : []
|
||||
content {
|
||||
dynamic "secret_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.config_map_ref != null ? each.value.config_map_ref : []
|
||||
content {
|
||||
dynamic "config_map_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
command = each.value.command != null ? each.value.command : []
|
||||
|
||||
|
||||
dynamic "env" {
|
||||
for_each = each.value.environment != null ? each.value.environment : {}
|
||||
content {
|
||||
name = env.key
|
||||
value = env.value.value != null ? env.value.value : null
|
||||
dynamic "value_from" {
|
||||
for_each = env.value.value_from != null ? env.value.value_from : {}
|
||||
content {
|
||||
dynamic "secret_key_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env.value.value_from.secret_key_ref.name
|
||||
key = env.value.value_from.secret_key_ref.key
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
dynamic "resources" {
|
||||
for_each = each.value.requirements != null ? [1] : []
|
||||
content {
|
||||
limits = {
|
||||
cpu = each.value.requirements.limits-cpu
|
||||
memory = each.value.requirements.limits-memory
|
||||
}
|
||||
requests = {
|
||||
cpu = each.value.requirements.requests-cpu
|
||||
memory = each.value.requirements.requests-memory
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
dynamic "security_context" {
|
||||
for_each = each.value.security_context == true ? [1] : []
|
||||
content {
|
||||
privileged = true
|
||||
#capabilities = {
|
||||
# add : ["NET_ADMIN", "NET_RAW"]
|
||||
#}
|
||||
}
|
||||
}
|
||||
dynamic "liveness_probe" {
|
||||
for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
|
||||
content {
|
||||
dynamic "tcp_socket" {
|
||||
for_each = each.value.liveness_tcp_socket != null ? [""] : []
|
||||
content {
|
||||
port = each.value.liveness_tcp_socket
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "http_get" {
|
||||
for_each = each.value.liveness_http_get != null ? [""] : []
|
||||
content {
|
||||
port = each.value.liveness_http_get
|
||||
path = coalesce(each.value.liveness_http_get_path, "/")
|
||||
}
|
||||
}
|
||||
|
||||
initial_delay_seconds = 3
|
||||
period_seconds = 3
|
||||
}
|
||||
}
|
||||
}
|
||||
dynamic "dns_config" {
|
||||
for_each = each.value.dns_nameservers != null ? [1] : []
|
||||
content {
|
||||
nameservers = [each.value.dns_nameservers]
|
||||
}
|
||||
|
||||
}
|
||||
service_account_name = each.value.service_account_name != null ? each.value.service_account_name : null
|
||||
|
||||
dynamic "volume" {
|
||||
for_each = each.value.pvc != null ? each.value.pvc : {}
|
||||
content {
|
||||
name = "${volume.key}-volume"
|
||||
|
||||
dynamic "config_map" {
|
||||
for_each = volume.value.config_map ? [1] : []
|
||||
content {
|
||||
name = volume.key
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "host_path" {
|
||||
for_each = volume.value.host_path != null || (!(volume.value.config_map) && !(volume.value.secret)) ? [1] : []
|
||||
content {
|
||||
path = coalesce(volume.value.host_path, join("/", [var.storage_path.main_storage, coalesce(each.value.namespace, each.value.connected_namespace, each.key), volume.key]))
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "secret" {
|
||||
for_each = volume.value.secret ? [1] : []
|
||||
content {
|
||||
secret_name = volume.key
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
dynamic "volume" {
|
||||
for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
|
||||
content {
|
||||
name = "${each.key}-db-backup"
|
||||
|
||||
host_path {
|
||||
path = join("/", [var.storage_path.fast_access, "Backup", coalesce(each.value.namespace, each.value.connected_namespace, each.key), "${each.key}-db-backup"])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,176 +0,0 @@
|
||||
terraform {
|
||||
required_version = "> 0.8.0"
|
||||
required_providers {
|
||||
bitwarden-secrets = {
|
||||
source = "bitwarden/bitwarden-secrets"
|
||||
version = "0.5.4-pre"
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
config_path = "~/.kube/config"
|
||||
}
|
||||
|
||||
|
||||
provider "bitwarden-secrets" {
|
||||
api_url = "https://bitwarden.tryton.geeraert.eu/api"
|
||||
identity_url = "https://bitwarden.tryton.geeraert.eu/identity"
|
||||
access_token = "0.9f4b7c5f-e6e7-4eff-929e-b474016a2b9c.bMRELajGGb7qMuXXvzgCCJdDfxfTCS:mFDT7tHSi43KJSnkwvTSYg=="
|
||||
organization_id = "a6361589-badd-4bde-9cb4-af8901161c0d"
|
||||
}
|
||||
|
||||
variable "kubernetes" {
|
||||
type = map(object({
|
||||
name = optional(string)
|
||||
docker = optional(bool)
|
||||
image = string
|
||||
pvc = optional(map(object({
|
||||
name = optional(string)
|
||||
pvc = optional(bool, false)
|
||||
config_map = optional(bool, false)
|
||||
secret = optional(bool, false)
|
||||
host_path = optional(string)
|
||||
pvc_size = optional(string)
|
||||
storage_class_name = optional(string, "nfs-storage-intelligent")
|
||||
annotations_fileType = optional(string)
|
||||
existing_pvc = optional(bool, false)
|
||||
mount_path = string
|
||||
sub_path = optional(string)
|
||||
})))
|
||||
environment = optional(map(object({
|
||||
name = optional(string)
|
||||
value = optional(string)
|
||||
value_from = optional(object({
|
||||
secret_key_ref = object({
|
||||
name = string
|
||||
key = optional(string, null)
|
||||
})
|
||||
}))
|
||||
})))
|
||||
replicas = optional(number, 1)
|
||||
namespace = optional(string)
|
||||
connected_namespace = optional(string, "")
|
||||
command = optional(list(string))
|
||||
service_port = optional(list(number))
|
||||
service_type = optional(string, "ClusterIP")
|
||||
service_name = optional(string)
|
||||
domain_name = optional(list(string))
|
||||
legacy_domain = optional(bool, false)
|
||||
exposed = optional(bool, true)
|
||||
liveness_tcp_socket = optional(number)
|
||||
liveness_http_get = optional(string)
|
||||
liveness_http_get_path = optional(string)
|
||||
database = optional(map(string))
|
||||
database_command = optional(list(string))
|
||||
database_args = optional(list(string))
|
||||
redis = optional(map(string))
|
||||
enabled = optional(bool, true)
|
||||
secret_ref = optional(list(string))
|
||||
config_map_ref = optional(list(string))
|
||||
config_map_import = optional(list(string))
|
||||
secret_import = optional(list(string))
|
||||
extra_manifest = optional(list(string))
|
||||
requirements = optional(map(string))
|
||||
# requirements = optional(map(string), {
|
||||
# limits-cpu = "800m"
|
||||
# limits-memory = "500Mi"
|
||||
# requests-cpu = "200m"
|
||||
# requests-memory = "200Mi"
|
||||
# })
|
||||
dns_nameservers = optional(string)
|
||||
service_account_name = optional(string)
|
||||
environment_variables = optional(map(string), { name = "value" })
|
||||
security_context = optional(bool, false)
|
||||
import_database_secret = optional(object({
|
||||
#putting them a non optional as the code doesn't allow optional value
|
||||
host = string
|
||||
name = string
|
||||
password = string
|
||||
port = string
|
||||
username = string
|
||||
}))
|
||||
}))
|
||||
|
||||
}
|
||||
|
||||
variable "database_backup_info" {
|
||||
type = map(object({
|
||||
image = optional(string)
|
||||
command = optional(string)
|
||||
}))
|
||||
description = "based on DB engine, give the docker image and the command used to backup"
|
||||
default = {
|
||||
postgres = {
|
||||
image = "alpine/psql"
|
||||
command = "pg_dump |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz"
|
||||
}
|
||||
mysql = {
|
||||
image = "mysql"
|
||||
command = "mysqldump -h $DB_HOST -u $MYSQL_USER -p$MYSQL_ROOT_PASSWORD $MYSQL_DATABASE |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz"
|
||||
}
|
||||
sqlserver = {
|
||||
image = "mcr.microsoft.com/mssql-tools"
|
||||
command = "/opt/mssql-tools/bin/sqlcmd -S $DB_HOST -U $DB_USERNAME -P $DB_PASSWORD -Q \"BACKUP DATABASE $DB_DATABASE_NAME TO DISK = '/backup/$DB_DATABASE_NAME-$(date +%Y%m%d).bak' WITH COPY_ONLY, CHECKSUM,FORMAT, MEDIANAME = 'SQLServerBackups',NAME = 'Full Backup of SQLTestDB'\";exit"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
variable "storage_path" {
|
||||
type = map(string)
|
||||
default = {
|
||||
main_storage = "/data/kubernetes",
|
||||
fast_access = "/ssd"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
locals {
|
||||
env_details = flatten([
|
||||
for key, value in var.kubernetes : [
|
||||
for index, env in value.environment_variables : {
|
||||
index = index
|
||||
name = env
|
||||
}] if value.enabled == true && value.environment_variables != null
|
||||
])
|
||||
}
|
||||
|
||||
|
||||
|
||||
resource "kubernetes_namespace_v1" "automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true && value.connected_namespace == "" }
|
||||
metadata {
|
||||
annotations = {
|
||||
name = coalesce(each.value.namespace, each.key)
|
||||
}
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
name = coalesce(each.value.namespace, each.key)
|
||||
}
|
||||
}
|
||||
|
||||
locals {
|
||||
kubernetes_manifests = flatten([
|
||||
for k, obj in var.kubernetes : [
|
||||
for index, manifest in(obj.extra_manifest != null ? obj.extra_manifest : []) :
|
||||
{
|
||||
key = "${k}_${index}"
|
||||
name = obj.name
|
||||
manifest = manifest
|
||||
enabled = obj.enabled
|
||||
}
|
||||
if obj.enabled == true
|
||||
]
|
||||
])
|
||||
}
|
||||
|
||||
resource "kubernetes_manifest" "manifest" {
|
||||
for_each = { for item in local.kubernetes_manifests : item.key => item }
|
||||
|
||||
manifest = yamldecode(file(each.value.manifest))
|
||||
provider = kubernetes
|
||||
}
|
||||
|
||||
@@ -1,123 +0,0 @@
|
||||
resource "kubernetes_deployment_v1" "redis-automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
|
||||
|
||||
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${coalesce(each.value.name, each.key)}-redis"
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
redis = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = each.value.replicas
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = "${each.key}-redis"
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = "${each.key}-redis"
|
||||
deployment_method = "Terraform"
|
||||
redis = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
container {
|
||||
image = try(each.value.redis.image, "docker.io/library/redis:7")
|
||||
name = "${coalesce(each.value.name, each.key)}-redis"
|
||||
port {
|
||||
|
||||
container_port = 6379
|
||||
name = "redis-port"
|
||||
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
mount_path = "/data"
|
||||
name = "${each.key}-redis-volume"
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
dynamic "env" {
|
||||
for_each = each.value.environment != null ? each.value.environment : {}
|
||||
content {
|
||||
name = env.key
|
||||
value = env.value.value != null ? env.value.value : null
|
||||
dynamic "value_from" {
|
||||
for_each = env.value.value_from != null ? env.value.value_from : {}
|
||||
content {
|
||||
dynamic "secret_key_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env.value.value_from.secret_key_ref.name
|
||||
key = env.value.value_from.secret_key_ref.key
|
||||
# optional = true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
# resources {
|
||||
# limits = {
|
||||
# cpu = each.value.requirements.limits-cpu
|
||||
# memory = each.value.requirements.limits-memory
|
||||
# }
|
||||
# requests = {
|
||||
# cpu = each.value.requirements.requests-cpu
|
||||
# memory = each.value.requirements.requests-memory
|
||||
# }
|
||||
# }
|
||||
|
||||
# dynamic "liveness_probe" {
|
||||
# for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
|
||||
# content {
|
||||
# dynamic "tcp_socket" {
|
||||
# for_each = each.value.liveness_tcp_socket != null ? [""] : []
|
||||
# content {
|
||||
# port = each.value.liveness_tcp_socket
|
||||
# }
|
||||
# }
|
||||
|
||||
|
||||
# dynamic "http_get" {
|
||||
# for_each = each.value.liveness_http_get != null ? [""] : []
|
||||
# content {
|
||||
# port = each.value.liveness_http_get
|
||||
# path = coalesce(each.value.liveness_http_get_path, "/")
|
||||
# }
|
||||
# }
|
||||
|
||||
# initial_delay_seconds = 3
|
||||
# period_seconds = 3
|
||||
# }
|
||||
# }
|
||||
}
|
||||
|
||||
|
||||
volume {
|
||||
name = "${each.key}-redis-volume"
|
||||
host_path {
|
||||
path = try(each.value.redis.host_path, join("/", [var.storage_path.main_storage, coalesce(each.value.namespace, each.value.connected_namespace, each.key), join("-", [each.key, "redis"])]))
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,198 +0,0 @@
|
||||
|
||||
data "bitwarden-secrets_secret" "configmap_import" {
|
||||
for_each = {
|
||||
for pair in flatten([
|
||||
for k, v in var.kubernetes : [
|
||||
for id in v.config_map_import : {
|
||||
map_key = k
|
||||
secret_id = id
|
||||
}
|
||||
] if v.config_map_import != null && v.enabled == true
|
||||
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
|
||||
}
|
||||
id = each.value
|
||||
}
|
||||
|
||||
resource "kubernetes_config_map_v1" "configmap_import" {
|
||||
for_each = { for key, value in data.bitwarden-secrets_secret.configmap_import : key => value }
|
||||
metadata {
|
||||
name = each.value.note
|
||||
namespace = split("__", each.value.key)[0]
|
||||
}
|
||||
data = yamldecode(each.value.value)
|
||||
}
|
||||
|
||||
|
||||
data "bitwarden-secrets_secret" "secret_import" {
|
||||
for_each = {
|
||||
for pair in flatten([
|
||||
for k, v in var.kubernetes : [
|
||||
for id in v.secret_import : {
|
||||
map_key = k
|
||||
secret_id = id
|
||||
}
|
||||
] if v.secret_import != null && v.enabled == true
|
||||
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
|
||||
}
|
||||
id = each.value
|
||||
}
|
||||
|
||||
resource "kubernetes_secret_v1" "secret_import" {
|
||||
for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : key => value }
|
||||
metadata {
|
||||
name = each.value.note
|
||||
namespace = split("__", each.value.key)[0]
|
||||
}
|
||||
data = yamldecode(each.value.value)
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_secret_v1" "automatic-database-secret" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-db-terraform"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
}
|
||||
|
||||
data = {
|
||||
DB_DATABASE_NAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
DB_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
POSTGRES_DB = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
MYSQL_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
PGDATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
DB_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
||||
PGHOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
||||
POSTGRES_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
||||
DB_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
MYSQL_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
POSTGRES_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
PGPASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
DB_USERNAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
POSTGRES_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
MYSQL_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
PGUSER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
DATABASE_URL = "postgresql://${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}@${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key].value}/${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
resource "kubernetes_secret_v1" "automatic-database-mapped-secret" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-db-mapped-terraform"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
}
|
||||
|
||||
data = {
|
||||
"${try(each.value.database.map_name, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
"${try(each.value.database.map_host, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
||||
"${try(each.value.database.map_password, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
"${try(each.value.database.map_username, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__username"
|
||||
value = try(each.value.database.username, each.key)
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
value, key
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_password" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__password"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
length = 32
|
||||
special = true
|
||||
min_special = 5
|
||||
avoid_ambiguous = true
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
value, key
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__host"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.database.host, "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
value, key
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__port"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.database.port, 5432)
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
value, key
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__name"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.database.name, each.key)
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
value, key
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
# 1. Move the loop logic to a local variable first
|
||||
locals {
|
||||
database_secrets_to_import = {
|
||||
for key, value in var.kubernetes : key => value
|
||||
if value.database != null && value.enabled == true && try(value.import_database_secret, "") != ""
|
||||
}
|
||||
}
|
||||
|
||||
# 2. Reference the local map in your import block using each.key and each.value
|
||||
import {
|
||||
for_each = local.database_secrets_to_import
|
||||
|
||||
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key]
|
||||
id = each.value.import_database_secret.host
|
||||
}
|
||||
|
||||
import {
|
||||
for_each = local.database_secrets_to_import
|
||||
|
||||
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key]
|
||||
id = each.value.import_database_secret.name
|
||||
}
|
||||
import {
|
||||
for_each = local.database_secrets_to_import
|
||||
|
||||
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key]
|
||||
id = each.value.import_database_secret.password
|
||||
}
|
||||
import {
|
||||
for_each = local.database_secrets_to_import
|
||||
|
||||
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key]
|
||||
id = each.value.import_database_secret.port
|
||||
}
|
||||
import {
|
||||
for_each = local.database_secrets_to_import
|
||||
|
||||
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key]
|
||||
id = each.value.import_database_secret.username
|
||||
}
|
||||
@@ -1,358 +0,0 @@
|
||||
kubernetes = {
|
||||
|
||||
gluetun = {
|
||||
#enabled = false
|
||||
dns_nameservers = "1.1.1.1"
|
||||
replicas = 01
|
||||
image = "qmcgaw/gluetun:latest"
|
||||
exposed = false
|
||||
service_port = [8888]
|
||||
secret_import = ["5527ba11-07e3-415b-8d1f-b3ee0154eb56", "b0d22160-d81a-4702-a3dd-b40e0168d617", "643dbe99-ace0-4ef5-8a2e-b44f014dccb0"]
|
||||
security_context = true
|
||||
|
||||
environment = {
|
||||
WIREGUARD_PRIVATE_KEY = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "gluetun-secret-nl-free-280"
|
||||
key = "WIREGUARD_PRIVATE_KEY"
|
||||
}
|
||||
}
|
||||
}
|
||||
HTTPPROXY = {
|
||||
value = "on"
|
||||
}
|
||||
HTTPPROXY_LOG = {
|
||||
value = "on"
|
||||
}
|
||||
HTTPPROXY_LISTENING_ADDRESS = {
|
||||
value = "0.0.0.0:8888"
|
||||
}
|
||||
VPN_SERVICE_PROVIDER = {
|
||||
value = "protonvpn"
|
||||
}
|
||||
VPN_TYPE = {
|
||||
value = "wireguard"
|
||||
}
|
||||
SERVER_COUNTRIES = {
|
||||
value = "Netherlands"
|
||||
}
|
||||
HEALTH_TARGET_ADDRESS = {
|
||||
value = "0.0.0.0:8888"
|
||||
}
|
||||
|
||||
FREE_ONLY = {
|
||||
value = "on"
|
||||
}
|
||||
|
||||
FIREWALL_INPUT_PORTS = {
|
||||
value = "8081,7878,9696,9091,51413,8080,6881,8989,8191,8888,8000"
|
||||
}
|
||||
PUBLICIP_API = {
|
||||
value = "ip2location"
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
django = {
|
||||
#enabled = false
|
||||
namespace = "django"
|
||||
domain_name = ["django", "admin", "redirect", "streaming", "stash", "simpsons", "kubernetes", "cloudmanager", "podcast"]
|
||||
image = "gitea.tryton.geeraert.eu/pi-ux-ce/django-python:latest"
|
||||
service_port = [8000]
|
||||
database = {
|
||||
image = "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0"
|
||||
username = "django_username"
|
||||
mountPath = "/var/lib/postgresql/data"
|
||||
}
|
||||
secret_ref = ["django-bitwarden-credentials"]
|
||||
secret_import = ["9fc5a725-75f5-4bab-b595-b474017146c3"]
|
||||
requirements = {
|
||||
limits-cpu = "800m"
|
||||
limits-memory = "800Mi"
|
||||
requests-cpu = "10m"
|
||||
requests-memory = "300Mi"
|
||||
}
|
||||
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/django/kubeconfig.secret.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/django/django-db.secret.yaml"]
|
||||
|
||||
environment = {
|
||||
ALLOWED_HOSTS = {
|
||||
value = "django.geeraert.eu,admin.geeraert.eu,redirect.geeraert.eu,streaming.geeraert.eu,stash.geeraert.eu,simpsons.geeraert.eu,kubernetes.geeraert.eu,cloudmanager.geeraert.eu,podcast.geeraert.eu"
|
||||
}
|
||||
DEBUG = {
|
||||
value = "False"
|
||||
}
|
||||
ENVIRONMENT = {
|
||||
value = "PRODUCTION"
|
||||
}
|
||||
|
||||
DB_PASSWORD = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "django-db-credentials"
|
||||
key = "DB_PASSWORD"
|
||||
}
|
||||
}
|
||||
}
|
||||
POSTGRES_DB = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "django-db-credentials"
|
||||
key = "DB_DATABASE_NAME"
|
||||
}
|
||||
}
|
||||
}
|
||||
POSTGRES_USER = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "django-db-credentials"
|
||||
key = "DB_USERNAME"
|
||||
}
|
||||
}
|
||||
}
|
||||
POSTGRES_PASSWORD = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "django-db-credentials"
|
||||
key = "DB_PASSWORD"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
DB_HOSTNAME = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "django-db-credentials"
|
||||
key = "DB_HOST"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
pvc = {
|
||||
kubeconfig-secret = {
|
||||
secret = true
|
||||
name = "kubeconfig"
|
||||
mount_path = "/kubeconfig"
|
||||
}
|
||||
|
||||
stash-django-pvc = {
|
||||
host_path = "/ssd/stash/data-pvc/"
|
||||
name = "stash-django-pvc"
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/stash"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
django-testing = {
|
||||
#enabled = false
|
||||
image = "gitea.tryton.geeraert.eu/pi-ux-ce/django-testing:latest"
|
||||
service_port = [8000]
|
||||
domain_name = ["django-testing", "admin-testing", "redirect-testing", "streaming-testing", "stash-testing", "simpsons-testing", "kubernetes-testing", "cloudmanager-testing", "podcast-testing"]
|
||||
database = {}
|
||||
requirements = {
|
||||
limits-cpu = "800m"
|
||||
limits-memory = "800Mi"
|
||||
requests-cpu = "10m"
|
||||
requests-memory = "300Mi"
|
||||
}
|
||||
extra_manifest = ["../external_manifests/django/kubeconfig-testing.secret.yaml"]
|
||||
secret_ref = ["django-bitwarden-credentials"]
|
||||
secret_import = ["68dce7aa-8e5f-4483-9083-b474016e34fc"]
|
||||
environment = {
|
||||
ALLOWED_HOSTS = {
|
||||
value = "django-testing.geeraert.eu,admin-testing.geeraert.eu,redirect-testing.geeraert.eu,streaming-testing.geeraert.eu,stash-testing.geeraert.eu,simpsons-testing.geeraert.eu,kubernetes-testing.geeraert.eu,cloudmanager-testing.geeraert.eu,podcast-testing.geeraert.eu"
|
||||
}
|
||||
CELERY_BROKER_URL = {
|
||||
value = "redis://django-testing-redis-svc:6379"
|
||||
}
|
||||
|
||||
DEBUG = {
|
||||
value = "true"
|
||||
}
|
||||
DB_PORT = {
|
||||
value = 5432
|
||||
}
|
||||
CUSTOM_DB_DATABASE = {
|
||||
value = "cloudmanager" }
|
||||
}
|
||||
pvc = {
|
||||
kubeconfig = {
|
||||
secret = true
|
||||
mount_path = "/kubeconfig"
|
||||
}
|
||||
}
|
||||
|
||||
import_database_secret = {
|
||||
host = "097f10de-63ee-405c-b46a-b41001781e07"
|
||||
name = "20530a85-e446-4d79-8985-b41001781e07"
|
||||
password = "a3385f49-ba92-4478-b6f1-b4e100ff01fb"
|
||||
port = "e15e00eb-db1e-47ea-ab0e-b41001781e09"
|
||||
username = "3c67d310-7113-45b7-8f3f-b41001781e08"
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
fail2ban = {
|
||||
enabled = false
|
||||
#image = "lscr.io/linuxserver/fail2ban:latest"
|
||||
image = "gitea.tryton.geeraert.eu/pi-ux-ce/fail2ban:latest"
|
||||
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.RoleBinding.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.Role.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.ServiceAccount.yaml"]
|
||||
service_account_name = "kubectl-service-account"
|
||||
config_map_import = ["9d8ef71a-de74-478b-aa86-b3ee0160dc43", "50814edb-d190-41cb-8950-b3ee01622dcf", "fb11452e-fec1-489f-9144-b3ee0162ccda"]
|
||||
environment = {
|
||||
PUID = {
|
||||
value = "1000"
|
||||
}
|
||||
PGID = {
|
||||
value = "1000"
|
||||
}
|
||||
TZ = {
|
||||
value = "Etc/UTC"
|
||||
}
|
||||
|
||||
VERBOSITY = {
|
||||
value = "-vv" }
|
||||
}
|
||||
|
||||
security_context = true
|
||||
pvc = {
|
||||
fail2ban-config = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/config"
|
||||
name = "fail2ban-config"
|
||||
}
|
||||
fail2ban-log = {
|
||||
pvc = true
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/var/log"
|
||||
name = "fail2ban-log"
|
||||
}
|
||||
nginx-fail2ban-logs = {
|
||||
host_path = "/data/kubernetes/reverse-proxy/reverse-proxy-log/"
|
||||
name = "nginx-fail2ban-logs"
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/remotelogs/nginx/"
|
||||
}
|
||||
fail2ban-nginx-http-auth-jail = {
|
||||
config_map = true
|
||||
name = "fail2ban-nginx-http-auth-jail"
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/config/fail2ban/jail.d/"
|
||||
}
|
||||
fail2ban-nginx-unauthorized-filter = {
|
||||
config_map = true
|
||||
name = "fail2ban-nginx-unauthorized-filter"
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/config/fail2ban/filter.d/"
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
netdatat = {
|
||||
image = "debian"
|
||||
enabled = false
|
||||
service_port = [19999]
|
||||
domain_name = ["netdata"]
|
||||
command = ["sleep", "3600"]
|
||||
security_context = true
|
||||
|
||||
environment = {
|
||||
NETDATA_CLAIM_TOKEN = {
|
||||
value = "wN6wJV1M5jvLbcpQTT78s0WRWiCkxz-s4l9tzeIqwA86upIkVSTk6TbaPbA5L6h_5HH9LoemluBqSPAGzi8DnJ2LBp4e8JGRVuWwOv8EWcKfrV0winCPce4xXtuD780KUW5CR6k"
|
||||
}
|
||||
NETDATA_CLAIM_URL = {
|
||||
value = "https://app.netdata.cloud"
|
||||
}
|
||||
NETDATA_CLAIM_ROOMS = {
|
||||
value = "28654d7b-4767-4b8e-bddc-8d134624bb3b"
|
||||
}
|
||||
}
|
||||
|
||||
pvc = {
|
||||
netdata-config = {
|
||||
name = "netdata-config"
|
||||
pvc = true
|
||||
pvc_size = "1Gi"
|
||||
mount_path = "/etc/netdata"
|
||||
}
|
||||
netdata-lib = {
|
||||
name = "netdata-lib"
|
||||
pvc = true
|
||||
pvc_size = "1Gi"
|
||||
mount_path = "/var/lib/netdata"
|
||||
}
|
||||
netdata-cache = {
|
||||
name = "netdata-cache"
|
||||
pvc = true
|
||||
pvc_size = "1Gi"
|
||||
mount_path = "/var/cache/netdata"
|
||||
}
|
||||
netdata-host-root = {
|
||||
host_path = "/"
|
||||
name = "netdata-host-root"
|
||||
mount_path = "/host/root"
|
||||
}
|
||||
netdata-host-passwd = {
|
||||
host_path = "/etc/passwd"
|
||||
name = "netdata-host-passwd"
|
||||
mount_path = "/host/etc/passwd"
|
||||
}
|
||||
netdata-host-group = {
|
||||
host_path = "/etc/group"
|
||||
name = "netdata-host-group"
|
||||
mount_path = "/host/etc/group"
|
||||
}
|
||||
netdata-host-localtime = {
|
||||
host_path = "/etc/localtime"
|
||||
name = "netdata-host-localtime"
|
||||
mount_path = "/etc/localtime"
|
||||
}
|
||||
netdata-host-proc = {
|
||||
host_path = "/proc"
|
||||
name = "netdata-host-proc"
|
||||
mount_path = "/host/proc"
|
||||
}
|
||||
netdata-host-sys = {
|
||||
host_path = "/sys"
|
||||
name = "netdata-host-sys"
|
||||
mount_path = "/host/sys"
|
||||
}
|
||||
netdata-host-os-release = {
|
||||
host_path = "/etc/os-release"
|
||||
name = "netdata-host-os-release"
|
||||
mount_path = "/host/etc/os-release"
|
||||
}
|
||||
netdata-host-var-log = {
|
||||
host_path = "/var/log"
|
||||
name = "netdata-host-var-log"
|
||||
mount_path = "/host/var/log"
|
||||
}
|
||||
netdata-docker-sock = {
|
||||
host_path = "/var/run/docker.sock"
|
||||
name = "netdata-docker-sock"
|
||||
mount_path = "/var/run/docker.sock"
|
||||
}
|
||||
netdata-host-dbus = {
|
||||
host_path = "/run/dbus"
|
||||
name = "netdata-host-dbus"
|
||||
mount_path = "/run/dbus"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
@@ -0,0 +1,772 @@
|
||||
terraform {
|
||||
required_version = "> 0.8.0"
|
||||
required_providers {
|
||||
bitwarden = {
|
||||
source = "maxlaverse/bitwarden"
|
||||
version = ">= 0.13.6"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
config_path = "~/.kube/config"
|
||||
}
|
||||
|
||||
provider "bitwarden" {
|
||||
email = "pierre@geeraert.eu"
|
||||
master_password = ""
|
||||
server = "https://bitwarden.tryton.geeraert.eu"
|
||||
experimental {
|
||||
embedded_client = true
|
||||
}
|
||||
}
|
||||
#https://stackoverflow.com/questions/66670949/how-to-tell-terraform-to-skip-the-secret-manager-resource-if-it-exists
|
||||
#for the secret not overwritten (not tested)
|
||||
data "bitwarden_item_login" "example" {
|
||||
search = "bookstack.zeus.geeraert.eu"
|
||||
}
|
||||
|
||||
data "bitwarden_item_secure_note" "vpn_preshared_key" {
|
||||
search = "terraform testing"
|
||||
}
|
||||
output "pgpin" {
|
||||
value = nonsensitive(coalesce(data.bitwarden_item_secure_note.vpn_preshared_key.field.1.hidden,1234))
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
resource "random_password" "password" {
|
||||
length = 16
|
||||
special = true
|
||||
override_special = "!#$%&*()-_=+[]{}<>:?"
|
||||
}
|
||||
|
||||
resource "bitwarden_item_secure_note" "terraform_upload_testing" {
|
||||
name = "terraform upload testing"
|
||||
# notes = <<EOT
|
||||
#[global]
|
||||
#secret = "<something sensitive>"
|
||||
#EOT
|
||||
organization_id = "a6361589-badd-4bde-9cb4-af8901161c0d"
|
||||
collection_ids = ["3fa902cd-8244-46bc-a4ea-af8901262d94"]
|
||||
|
||||
field {
|
||||
name = "category"
|
||||
hidden = random_password.password.result
|
||||
}
|
||||
}
|
||||
|
||||
variable "kubernetes" {
|
||||
type = map(object({
|
||||
name = optional(string)
|
||||
image = string
|
||||
pvc = optional(map(object({
|
||||
name = string
|
||||
pvc = optional(bool, false)
|
||||
config_map = optional(bool, false)
|
||||
host_path = optional(string)
|
||||
pvc_size = optional(string)
|
||||
storage_class_name = optional(string, "nfs-storage-intelligent")
|
||||
mount_path = string
|
||||
})))
|
||||
environment = optional(map(object({
|
||||
name = optional(string)
|
||||
value = optional(string)
|
||||
value_from = optional(object({
|
||||
secret_key_ref = object({
|
||||
name = string
|
||||
key = optional(string, null)
|
||||
})
|
||||
}))
|
||||
})))
|
||||
replicas = optional(number, 1)
|
||||
namespace = optional(string)
|
||||
connected_namespace = optional(string, "")
|
||||
# namespace = optional(string,coalesce(connected_namespace,""))
|
||||
#block_namespace_creation = optional(bool, false)
|
||||
service_port = optional(list(number))
|
||||
service_type = optional(string, "ClusterIP")
|
||||
service_name = optional(string)
|
||||
liveness_tcp_socket = optional(number)
|
||||
liveness_http_get = optional(string)
|
||||
liveness_http_get_path = optional(string)
|
||||
database = optional(map(string))
|
||||
redis = optional(map(string))
|
||||
enabled = optional(bool, true)
|
||||
secret_ref = optional(list(string))
|
||||
config_map_ref = optional(list(string))
|
||||
extra_manifest = optional(list(string))
|
||||
requirements = optional(map(string))
|
||||
# requirements = optional(map(string), {
|
||||
# limits-cpu = "800m"
|
||||
# limits-memory = "500Mi"
|
||||
# requests-cpu = "200m"
|
||||
# requests-memory = "200Mi"
|
||||
# })
|
||||
dns_nameservers = optional(string)
|
||||
environment_variables = optional(map(string), { name = "value" })
|
||||
security_context = optional(bool, false)
|
||||
}))
|
||||
|
||||
}
|
||||
|
||||
locals {
|
||||
pvc_details = flatten([
|
||||
for key, value in var.kubernetes : [
|
||||
for index, pvc in value.pvc : {
|
||||
index = index
|
||||
pvc = pvc.pvc
|
||||
name = pvc.name
|
||||
pvc_size = pvc.pvc_size
|
||||
mount_path = pvc.mount_path
|
||||
storage_class_name = pvc.storage_class_name
|
||||
namespace = coalesce(value.namespace, value.connected_namespace, key)
|
||||
}] if value.enabled == true && value.pvc != null
|
||||
])
|
||||
}
|
||||
|
||||
locals {
|
||||
env_details = flatten([
|
||||
for key, value in var.kubernetes : [
|
||||
for index, env in value.environment_variables : {
|
||||
index = index
|
||||
name = env
|
||||
}] if value.enabled == true && value.environment_variables != null
|
||||
])
|
||||
}
|
||||
|
||||
|
||||
data "kubernetes_all_namespaces" "allns" {}
|
||||
|
||||
resource "kubernetes_namespace" "automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true && value.connected_namespace == "" }
|
||||
metadata {
|
||||
annotations = {
|
||||
name = coalesce(each.value.namespace, each.key)
|
||||
}
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
name = coalesce(each.value.namespace, each.key)
|
||||
}
|
||||
depends_on = [data.kubernetes_all_namespaces.allns]
|
||||
}
|
||||
|
||||
locals {
|
||||
kubernetes_manifests = flatten([
|
||||
for k, obj in var.kubernetes : [
|
||||
for index, manifest in(obj.extra_manifest != null ? obj.extra_manifest : []) :
|
||||
{
|
||||
key = "${k}_${index}"
|
||||
name = obj.name
|
||||
manifest = manifest
|
||||
enabled = obj.enabled
|
||||
}
|
||||
if obj.enabled == true
|
||||
]
|
||||
])
|
||||
}
|
||||
|
||||
resource "kubernetes_manifest" "manifest" {
|
||||
for_each = { for item in local.kubernetes_manifests : item.key => item }
|
||||
|
||||
manifest = yamldecode(file(each.value.manifest))
|
||||
provider = kubernetes
|
||||
}
|
||||
|
||||
|
||||
|
||||
resource "kubernetes_persistent_volume_claim" "automatic-pvc" {
|
||||
for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.key)
|
||||
name = "${each.value.name}-pvc"
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
access_modes = ["ReadWriteMany"]
|
||||
storage_class_name = each.value.storage_class_name
|
||||
resources {
|
||||
requests = {
|
||||
storage = each.value.pvc_size
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
resource "kubernetes_persistent_volume_claim" "automatic-pvc-database" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${each.key}-db-pvc"
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
access_modes = ["ReadWriteMany"]
|
||||
storage_class_name = "nfs-storage-intelligent"
|
||||
resources {
|
||||
requests = {
|
||||
storage = "1Gi"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_persistent_volume_claim" "automatic-pvc-redis" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${each.key}-redis-pvc"
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
access_modes = ["ReadWriteMany"]
|
||||
storage_class_name = "nfs-storage-intelligent"
|
||||
resources {
|
||||
requests = {
|
||||
storage = "1Gi"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_service" "automatic_service" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-svc"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
annotations = each.value.service_type == "LoadBalancer" ? {
|
||||
"metallb.universe.tf/ip-allocated-from-pool" = "first-pool"
|
||||
} : {}
|
||||
|
||||
|
||||
|
||||
}
|
||||
spec {
|
||||
selector = {
|
||||
app = each.key
|
||||
}
|
||||
dynamic "port" {
|
||||
for_each = each.value.service_port != null ? each.value.service_port : []
|
||||
content {
|
||||
port = port.value
|
||||
target_port = port.value
|
||||
name = replace("${each.key}${port.value}", "/(.{0,15})(.*)/", "$1")
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
# port {
|
||||
# port = each.value.service_port
|
||||
# target_port = each.value.service_port
|
||||
# }
|
||||
type = each.value.service_type
|
||||
|
||||
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
resource "kubernetes_service" "automatic_service_database" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-db-svc"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
selector = {
|
||||
app = "${each.key}-db"
|
||||
}
|
||||
port {
|
||||
port = try(each.value.database.port, 5432)
|
||||
target_port = try(each.value.database.port, 5432)
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
resource "kubernetes_service" "automatic_service_redis" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-redis-svc"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
selector = {
|
||||
app = "${each.key}-redis"
|
||||
}
|
||||
port {
|
||||
port = 6379
|
||||
target_port = 6379
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
resource "kubernetes_deployment_v1" "automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = coalesce(each.value.name, each.key)
|
||||
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = each.value.replicas
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = each.key
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
container {
|
||||
image = each.value.image
|
||||
name = coalesce(each.value.name, each.key)
|
||||
dynamic "port" {
|
||||
for_each = each.value.service_port != null ? each.value.service_port : []
|
||||
content {
|
||||
container_port = port.value
|
||||
# name = "${each.key}-${port.value}"
|
||||
name = replace("${each.key}${port.value}", "/(.{0,15})(.*)/", "$1")
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
dynamic "volume_mount" {
|
||||
for_each = each.value.pvc != null ? each.value.pvc : {}
|
||||
content {
|
||||
mount_path = volume_mount.value.mount_path
|
||||
name = "${volume_mount.value.name}-pvc"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.secret_ref != null ? each.value.secret_ref : []
|
||||
content {
|
||||
dynamic "secret_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.config_map_ref != null ? each.value.config_map_ref : []
|
||||
content {
|
||||
dynamic "config_map_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
dynamic "env" {
|
||||
for_each = each.value.environment != null ? each.value.environment : {}
|
||||
content {
|
||||
name = env.key
|
||||
value = env.value.value != null ? env.value.value : null
|
||||
dynamic "value_from" {
|
||||
for_each = env.value.value_from != null ? env.value.value_from : {}
|
||||
content {
|
||||
dynamic "secret_key_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env.value.value_from.secret_key_ref.name
|
||||
key = env.value.value_from.secret_key_ref.key
|
||||
# optional = true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
dynamic "resources" {
|
||||
for_each = each.value.requirements != null ? [1] : []
|
||||
content {
|
||||
limits = {
|
||||
cpu = each.value.requirements.limits-cpu
|
||||
memory = each.value.requirements.limits-memory
|
||||
}
|
||||
requests = {
|
||||
cpu = each.value.requirements.requests-cpu
|
||||
memory = each.value.requirements.requests-memory
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
# resources {
|
||||
# limits = {
|
||||
# cpu = each.value.requirements.limits-cpu
|
||||
# memory = each.value.requirements.limits-memory
|
||||
# }
|
||||
# requests = {
|
||||
# cpu = each.value.requirements.requests-cpu
|
||||
# memory = each.value.requirements.requests-memory
|
||||
# }
|
||||
# }
|
||||
|
||||
dynamic "security_context" {
|
||||
for_each = each.value.security_context == true ? [1] : []
|
||||
content {
|
||||
privileged = true
|
||||
#capabilities = {
|
||||
# add : ["NET_ADMIN", "NET_RAW"]
|
||||
#}
|
||||
}
|
||||
}
|
||||
dynamic "liveness_probe" {
|
||||
for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
|
||||
content {
|
||||
dynamic "tcp_socket" {
|
||||
for_each = each.value.liveness_tcp_socket != null ? [""] : []
|
||||
content {
|
||||
port = each.value.liveness_tcp_socket
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "http_get" {
|
||||
for_each = each.value.liveness_http_get != null ? [""] : []
|
||||
content {
|
||||
port = each.value.liveness_http_get
|
||||
path = coalesce(each.value.liveness_http_get_path, "/")
|
||||
}
|
||||
}
|
||||
|
||||
initial_delay_seconds = 3
|
||||
period_seconds = 3
|
||||
}
|
||||
}
|
||||
}
|
||||
dynamic "dns_config" {
|
||||
for_each = each.value.dns_nameservers != null ? [1] : []
|
||||
content {
|
||||
nameservers = [each.value.dns_nameservers]
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
dynamic "volume" {
|
||||
for_each = each.value.pvc != null ? each.value.pvc : {}
|
||||
content {
|
||||
name = "${volume.value.name}-pvc"
|
||||
|
||||
dynamic "persistent_volume_claim" {
|
||||
for_each = volume.value.pvc ? [1] : []
|
||||
content {
|
||||
claim_name = "${volume.value.name}-pvc"
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "config_map" {
|
||||
for_each = volume.value.config_map ? [1] : []
|
||||
content {
|
||||
name = volume.value.name
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "host_path" {
|
||||
for_each = volume.value.host_path != null ? [1] : []
|
||||
content {
|
||||
path = volume.value.host_path
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
resource "kubernetes_deployment_v1" "database-automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
|
||||
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${coalesce(each.value.namespace, each.key)}-db"
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
database = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = each.value.replicas
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = "${each.key}-db"
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = "${each.key}-db"
|
||||
deployment_method = "Terraform"
|
||||
database = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
container {
|
||||
image = try(each.value.database.image, "docker.io/library/postgres:latest")
|
||||
name = "${coalesce(each.value.name, each.key)}-db"
|
||||
port {
|
||||
|
||||
container_port = 5432
|
||||
name = "database-port"
|
||||
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/data")
|
||||
name = "${each.key}-db-pvc"
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
dynamic "env" {
|
||||
for_each = each.value.environment != null ? each.value.environment : {}
|
||||
content {
|
||||
name = env.key
|
||||
value = env.value.value != null ? env.value.value : null
|
||||
dynamic "value_from" {
|
||||
for_each = env.value.value_from != null ? env.value.value_from : {}
|
||||
content {
|
||||
dynamic "secret_key_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env.value.value_from.secret_key_ref.name
|
||||
key = env.value.value_from.secret_key_ref.key
|
||||
# optional = true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
# resources {
|
||||
# limits = {
|
||||
# cpu = each.value.requirements.limits-cpu
|
||||
# memory = each.value.requirements.limits-memory
|
||||
# }
|
||||
# requests = {
|
||||
# cpu = each.value.requirements.requests-cpu
|
||||
# memory = each.value.requirements.requests-memory
|
||||
# }
|
||||
# }
|
||||
|
||||
# dynamic "liveness_probe" {
|
||||
# for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
|
||||
# content {
|
||||
# dynamic "tcp_socket" {
|
||||
# for_each = each.value.liveness_tcp_socket != null ? [""] : []
|
||||
# content {
|
||||
# port = each.value.liveness_tcp_socket
|
||||
# }
|
||||
# }
|
||||
|
||||
|
||||
# dynamic "http_get" {
|
||||
# for_each = each.value.liveness_http_get != null ? [""] : []
|
||||
# content {
|
||||
# port = each.value.liveness_http_get
|
||||
# path = coalesce(each.value.liveness_http_get_path, "/")
|
||||
# }
|
||||
# }
|
||||
|
||||
# initial_delay_seconds = 3
|
||||
# period_seconds = 3
|
||||
# }
|
||||
# }
|
||||
}
|
||||
|
||||
|
||||
volume {
|
||||
name = "${each.key}-db-pvc"
|
||||
persistent_volume_claim {
|
||||
claim_name = "${each.key}-db-pvc"
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_deployment_v1" "redis-automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
|
||||
|
||||
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${coalesce(each.value.namespace, each.key)}-redis"
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
redis = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = each.value.replicas
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = "${each.key}-redis"
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = "${each.key}-redis"
|
||||
deployment_method = "Terraform"
|
||||
redis = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
container {
|
||||
image = try(each.value.redis.image, "docker.io/library/redis:7")
|
||||
name = "${coalesce(each.value.name, each.key)}-redis"
|
||||
port {
|
||||
|
||||
container_port = 6379
|
||||
name = "redis-port"
|
||||
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
mount_path = "/data"
|
||||
name = "${each.key}-redis-pvc"
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
dynamic "env" {
|
||||
for_each = each.value.environment != null ? each.value.environment : {}
|
||||
content {
|
||||
name = env.key
|
||||
value = env.value.value != null ? env.value.value : null
|
||||
dynamic "value_from" {
|
||||
for_each = env.value.value_from != null ? env.value.value_from : {}
|
||||
content {
|
||||
dynamic "secret_key_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env.value.value_from.secret_key_ref.name
|
||||
key = env.value.value_from.secret_key_ref.key
|
||||
# optional = true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
# resources {
|
||||
# limits = {
|
||||
# cpu = each.value.requirements.limits-cpu
|
||||
# memory = each.value.requirements.limits-memory
|
||||
# }
|
||||
# requests = {
|
||||
# cpu = each.value.requirements.requests-cpu
|
||||
# memory = each.value.requirements.requests-memory
|
||||
# }
|
||||
# }
|
||||
|
||||
# dynamic "liveness_probe" {
|
||||
# for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
|
||||
# content {
|
||||
# dynamic "tcp_socket" {
|
||||
# for_each = each.value.liveness_tcp_socket != null ? [""] : []
|
||||
# content {
|
||||
# port = each.value.liveness_tcp_socket
|
||||
# }
|
||||
# }
|
||||
|
||||
|
||||
# dynamic "http_get" {
|
||||
# for_each = each.value.liveness_http_get != null ? [""] : []
|
||||
# content {
|
||||
# port = each.value.liveness_http_get
|
||||
# path = coalesce(each.value.liveness_http_get_path, "/")
|
||||
# }
|
||||
# }
|
||||
|
||||
# initial_delay_seconds = 3
|
||||
# period_seconds = 3
|
||||
# }
|
||||
# }
|
||||
}
|
||||
|
||||
|
||||
volume {
|
||||
name = "${each.key}-redis-pvc"
|
||||
persistent_volume_claim {
|
||||
claim_name = "${each.key}-redis-pvc"
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+185
@@ -0,0 +1,185 @@
|
||||
terraform {
|
||||
required_version = "> 0.8.0"
|
||||
}
|
||||
|
||||
|
||||
provider "kubernetes" {
|
||||
config_path = "~/.kube/config"
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_namespace" "screeps" {
|
||||
metadata {
|
||||
annotations = {
|
||||
name = "screeps"
|
||||
}
|
||||
name = "screeps"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_persistent_volume_claim" "screeps-pvc" {
|
||||
metadata {
|
||||
namespace = "screeps"
|
||||
name = "screeps-pvc"
|
||||
}
|
||||
spec {
|
||||
access_modes = ["ReadWriteMany"]
|
||||
storage_class_name = "nfs-storage-intelligent"
|
||||
resources {
|
||||
requests = {
|
||||
storage = "1Gi"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_deployment_v1" "screeps" {
|
||||
metadata {
|
||||
namespace = "screeps"
|
||||
name = "screeps"
|
||||
labels = {
|
||||
app = "screepsserver"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = 1
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = "screepsserver"
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = "screepsserver"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
container {
|
||||
image = "screepers/screeps-launcher"
|
||||
name = "screeps-launcher"
|
||||
port {
|
||||
container_port = 21025
|
||||
name = "screeps-port"
|
||||
}
|
||||
volume_mount {
|
||||
mount_path = "/screeps"
|
||||
name = "screeps-volume"
|
||||
}
|
||||
|
||||
resources {
|
||||
limits = {
|
||||
cpu = "2"
|
||||
memory = "2Gi"
|
||||
}
|
||||
requests = {
|
||||
cpu = "250m"
|
||||
memory = "500Mi"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
}
|
||||
volume {
|
||||
name = "screeps-volume"
|
||||
persistent_volume_claim {
|
||||
claim_name = "screeps-pvc"
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_service" "screeps_service" {
|
||||
metadata {
|
||||
name = "screeps"
|
||||
namespace = "screeps"
|
||||
}
|
||||
spec {
|
||||
selector = {
|
||||
app = "screepsserver"
|
||||
}
|
||||
port {
|
||||
port = 21025
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
variable "kubernetes" {
|
||||
type = map(object({
|
||||
service = string
|
||||
#testingbool= bool
|
||||
pvc_name = optional(string)
|
||||
namespace = optional(string)
|
||||
service_port = optional(number)
|
||||
LoadBalancerbool = optional(string)
|
||||
enabled = optional(bool, true)
|
||||
proxy_cache = optional(bool, false)
|
||||
extra-value = optional(string, "")
|
||||
http2_bool = optional(bool, false)
|
||||
proxy_pass_https = optional(bool, false)
|
||||
authentication_required = optional(bool, false)
|
||||
}))
|
||||
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
|
||||
metadata {
|
||||
annotations = {
|
||||
name = coalesce(each.value.namespace, each.key)
|
||||
}
|
||||
name = coalesce(each.value.namespace, each.key)
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_persistent_volume_claim" "automatic-pvc" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.pvc_name != null }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.key)
|
||||
name = coalesce(each.value.namespace, each.key)
|
||||
}
|
||||
spec {
|
||||
access_modes = ["ReadWriteMany"]
|
||||
storage_class_name = "nfs-storage-intelligent"
|
||||
resources {
|
||||
requests = {
|
||||
storage = "1Gi"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_service" "automatic_service" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.service_port != null }
|
||||
metadata {
|
||||
name = coalesce(each.value.namespace, each.key)
|
||||
namespace = coalesce(each.value.namespace, each.key)
|
||||
}
|
||||
spec {
|
||||
selector = {
|
||||
app = "screepsserver"
|
||||
}
|
||||
port {
|
||||
port = each.value.service_port
|
||||
}
|
||||
|
||||
if(each.value.LoadBalancerbool == "enabled" ? [type = "LoadBalancer"] :[]
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
@@ -1,119 +0,0 @@
|
||||
variable "kubernetes_input" {
|
||||
type = map(object({
|
||||
name = optional(string)
|
||||
docker = optional(bool)
|
||||
namespace = optional(string)
|
||||
connected_namespace = optional(string, "")
|
||||
service_port = optional(list(number))
|
||||
service_type = optional(string, "ClusterIP")
|
||||
domain_name = optional(list(string))
|
||||
legacy_domain = optional(bool, false)
|
||||
exposed = optional(bool, true)
|
||||
enabled = optional(bool, true)
|
||||
}))
|
||||
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_ingress_v1" "automatic_ingress" {
|
||||
# Keep your top-level filter for filtering active services
|
||||
for_each = { for key, value in var.kubernetes_input : key => value if value.service_port != null && value.enabled == true && value.docker != true && value.exposed == true }
|
||||
|
||||
metadata {
|
||||
name = "${each.key}-ingress"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
|
||||
annotations = {
|
||||
"cert-manager.io/cluster-issuer" = "letsencrypt-prod"
|
||||
"traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
ingress_class_name = "traefik"
|
||||
|
||||
# --- DYNAMIC TLS BLOCK ---
|
||||
# Generates a separate TLS block + secret per domain entry
|
||||
dynamic "tls" {
|
||||
for_each = toset(coalesce(each.value.domain_name, [each.key]))
|
||||
content {
|
||||
hosts = [join(".", [tls.value, "geeraert.eu"])]
|
||||
secret_name = "${each.key}-${tls.value}-tls-secret"
|
||||
}
|
||||
}
|
||||
|
||||
# --- DYNAMIC RULE BLOCK ---
|
||||
# Loops through the domain list and creates an HTTP path routing rule for each
|
||||
dynamic "rule" {
|
||||
for_each = toset(coalesce(each.value.domain_name, [each.key]))
|
||||
content {
|
||||
host = join(".", [rule.value, "geeraert.eu"])
|
||||
http {
|
||||
path {
|
||||
path = "/"
|
||||
backend {
|
||||
service {
|
||||
name = "${each.key}-svc"
|
||||
port {
|
||||
number = each.value.service_port[0]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_ingress_v1" "automatic_ingress_legacy" {
|
||||
for_each = { for key, value in var.kubernetes_input : key => value if value.service_port != null && value.enabled == true && value.docker != true && value.exposed == true && value.legacy_domain == true }
|
||||
|
||||
metadata {
|
||||
name = "${each.key}-legacy-ingress"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
|
||||
annotations = {
|
||||
"cert-manager.io/cluster-issuer" = "letsencrypt-prod"
|
||||
"traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
ingress_class_name = "traefik"
|
||||
|
||||
# --- DYNAMIC TLS BLOCK ---
|
||||
# Generates a separate TLS block + secret per domain entry
|
||||
dynamic "tls" {
|
||||
for_each = toset(coalesce(each.value.domain_name, [each.key]))
|
||||
content {
|
||||
hosts = [join(".", [tls.value, "tryton.geeraert.eu"])]
|
||||
secret_name = "${each.key}-${tls.value}-tls-secret"
|
||||
}
|
||||
}
|
||||
|
||||
# --- DYNAMIC RULE BLOCK ---
|
||||
# Loops through the domain list and creates an HTTP path routing rule for each
|
||||
dynamic "rule" {
|
||||
for_each = toset(coalesce(each.value.domain_name, [each.key]))
|
||||
content {
|
||||
host = join(".", [rule.value, "tryton.geeraert.eu"])
|
||||
http {
|
||||
path {
|
||||
path = "/"
|
||||
backend {
|
||||
service {
|
||||
name = "${each.key}-svc"
|
||||
port {
|
||||
number = each.value.service_port[0]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
@@ -1,97 +0,0 @@
|
||||
variable "kubernetes_input" {
|
||||
type = map(object({
|
||||
docker = optional(bool)
|
||||
namespace = optional(string)
|
||||
connected_namespace = optional(string, "")
|
||||
service_port = optional(list(number))
|
||||
service_type = optional(string, "ClusterIP")
|
||||
database = optional(map(string))
|
||||
redis = optional(map(string))
|
||||
enabled = optional(bool, true)
|
||||
|
||||
}))
|
||||
|
||||
}
|
||||
|
||||
resource "kubernetes_service_v1" "automatic_service" {
|
||||
for_each = { for key, value in var.kubernetes_input : key => value if value.service_port != null && value.enabled == true && value.docker != true }
|
||||
metadata {
|
||||
name = "${each.key}-svc"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
annotations = each.value.service_type == "LoadBalancer" ? {
|
||||
"metallb.universe.tf/ip-allocated-from-pool" = "first-pool"
|
||||
} : {}
|
||||
|
||||
|
||||
|
||||
}
|
||||
spec {
|
||||
selector = {
|
||||
app = each.key
|
||||
}
|
||||
dynamic "port" {
|
||||
for_each = each.value.service_port != null ? each.value.service_port : []
|
||||
content {
|
||||
port = port.value
|
||||
target_port = port.value
|
||||
name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
|
||||
node_port = each.value.service_type == "NodePort" ? port.value : 0
|
||||
}
|
||||
}
|
||||
|
||||
type = each.value.service_type
|
||||
|
||||
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
resource "kubernetes_service_v1" "automatic_service_database" {
|
||||
for_each = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) && value.docker != true }
|
||||
metadata {
|
||||
name = "${each.key}-db-svc"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
#username = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_password[each.key].key}"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
selector = {
|
||||
app = "${each.key}-db"
|
||||
}
|
||||
port {
|
||||
port = try(each.value.database.port, 5432)
|
||||
target_port = try(each.value.database.port, 5432)
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
resource "kubernetes_service_v1" "automatic_service_redis" {
|
||||
for_each = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true && value.docker != true }
|
||||
metadata {
|
||||
name = "${each.key}-redis-svc"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
selector = {
|
||||
app = "${each.key}-redis"
|
||||
}
|
||||
port {
|
||||
port = 6379
|
||||
target_port = 6379
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: screeps
|
||||
---
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: screeps-storage
|
||||
namespace: screeps
|
||||
spec:
|
||||
storageClassName: nfs-storage-intelligent
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 20Gi
|
||||
|
||||
+6271
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -1,7 +1,7 @@
|
||||
kubernetes = {
|
||||
bookstack = {
|
||||
#namespace = "bookstack"
|
||||
#enabled = false
|
||||
namespace = "bookstack"
|
||||
# enabled = false
|
||||
replicas = 01
|
||||
extra_manifest = ["/opt/kubernetes/Bookstack_kube/Bookstack.configmap.yaml", "/opt/kubernetes/Bookstack_kube/Bookstack.secret.yaml"]
|
||||
#image = "linuxserver/bookstack:24.10.3"
|
||||
@@ -194,7 +194,7 @@ kubernetes = {
|
||||
}
|
||||
|
||||
gluetun = {
|
||||
# enabled = false
|
||||
#enabled = false
|
||||
dns_nameservers = "10.2.0.1"
|
||||
replicas = 01
|
||||
image = "qmcgaw/gluetun:latest"
|
||||
@@ -898,9 +898,7 @@ kubernetes = {
|
||||
# dns_nameservers = "10.2.0.1"
|
||||
service_port = [9696]
|
||||
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/servarr/servarr-db.secret.yaml"]
|
||||
database = {
|
||||
"image" = "docker.io/library/postgres:17.5"
|
||||
}
|
||||
database = {}
|
||||
|
||||
environment = {
|
||||
PUID = {
|
||||
@@ -1044,40 +1042,7 @@ kubernetes = {
|
||||
}
|
||||
|
||||
}
|
||||
recommendarr = {
|
||||
enabled = false
|
||||
image = "tannermiddleton/recommendarr:latest"
|
||||
connected_namespace = "servarr"
|
||||
#replicas = 0
|
||||
service_port = [3000]
|
||||
|
||||
environment = {
|
||||
PUID = {
|
||||
value = "1000"
|
||||
}
|
||||
PGID = {
|
||||
value = "1000"
|
||||
}
|
||||
TZ = {
|
||||
value = "Etc/UTC"
|
||||
}
|
||||
}
|
||||
# requirements = {
|
||||
# limits-cpu = "1000m"
|
||||
# limits-memory = "1Gi"
|
||||
# requests-cpu = "500m"
|
||||
# requests-memory = "400Mi"
|
||||
# }
|
||||
pvc = {
|
||||
recommendarr-config = {
|
||||
name = "recommendarr-config"
|
||||
pvc_size = "10Mi"
|
||||
pvc = true
|
||||
mount_path = "/app/server/data"
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
qbittorrent = {
|
||||
#enabled = false
|
||||
image = "lscr.io/linuxserver/qbittorrent:latest"
|
||||
@@ -1129,9 +1094,10 @@ kubernetes = {
|
||||
image = "alexfozor/flaresolverr:pr-1300-experimental"
|
||||
|
||||
connected_namespace = "servarr"
|
||||
#enabled = false
|
||||
image = "ghcr.io/flaresolverr/flaresolverr:latest"
|
||||
service_port = [8191]
|
||||
enabled = false
|
||||
image = "ghcr.io/flaresolverr/flaresolverr:latest"
|
||||
connected_namespace = "tservarr"
|
||||
service_port = [8191]
|
||||
|
||||
environment = {
|
||||
PUID = {
|
||||
@@ -1159,7 +1125,7 @@ kubernetes = {
|
||||
poste = {
|
||||
enabled = false
|
||||
image = "analogic/poste.io:latest"
|
||||
service_port = [25, 80, 110, 143, 443, 465, 587, 993, 995, 4190]
|
||||
service_port = [25,80,110,143,443,465,587,993,995,4190]
|
||||
|
||||
environment = {
|
||||
PUID = {
|
||||
@@ -1273,302 +1239,4 @@ kubernetes = {
|
||||
|
||||
}
|
||||
|
||||
immicht = {
|
||||
enabled = false
|
||||
#replicas = 0
|
||||
namespace = "immicht"
|
||||
image = "ghcr.io/immich-app/immich-server:v1.134.0"
|
||||
service_port = [2283]
|
||||
database = {
|
||||
#image = "ghcr.io/immich-app/postgres:14-vectorchord0.3.0-pgvectors0.2.0@sha256:fa4f6e0971f454cd95fec5a9aaed2ed93d8f46725cc6bc61e0698e97dba96da1"
|
||||
image = "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0"
|
||||
}
|
||||
|
||||
redis = {
|
||||
image = "docker.io/bitnami/redis:7.2.5-debian-12-r0" }
|
||||
requirements = {
|
||||
limits-cpu = "800m"
|
||||
limits-memory = "800Mi"
|
||||
requests-cpu = "10m"
|
||||
requests-memory = "300Mi"
|
||||
}
|
||||
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/immich/immich-db.secret.yaml"]
|
||||
|
||||
environment = {
|
||||
DB_DATABASE_NAME = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "immich-db-credentials"
|
||||
key = "DB_DATABASE_NAME"
|
||||
}
|
||||
}
|
||||
}
|
||||
DB_USERNAME = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "immich-db-credentials"
|
||||
key = "DB_USERNAME"
|
||||
}
|
||||
}
|
||||
}
|
||||
DB_PASSWORD = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "immich-db-credentials"
|
||||
key = "DB_PASSWORD"
|
||||
}
|
||||
}
|
||||
}
|
||||
POSTGRES_DATABASE = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "immich-db-credentials"
|
||||
key = "DB_DATABASE_NAME"
|
||||
}
|
||||
}
|
||||
}
|
||||
POSTGRES_USER = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "immich-db-credentials"
|
||||
key = "DB_USERNAME"
|
||||
}
|
||||
}
|
||||
}
|
||||
POSTGRES_PASSWORD = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "immich-db-credentials"
|
||||
key = "DB_PASSWORD"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
POSTGRES_POSTGRES_PASSWORD = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "immich-db-credentials"
|
||||
key = "DB_PASSWORD"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
DB_HOSTNAME = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "immich-db-credentials"
|
||||
key = "DB_HOST"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
IMMICH_MACHINE_LEARNING_URL = { value = "http://machinelearning-svc:3003" }
|
||||
REDIS_HOSTNAME = { value = "immicht-redis-svc" }
|
||||
UPLOAD_LOCATION = { value = "/tmp" }
|
||||
POSTGRESQL_ENABLE_LDAP = { value = "no" }
|
||||
POSTGRESQL_ENABLE_TLS = { value = "no" }
|
||||
POSTGRESQL_LOG_HOSTNAME = { value = "false" }
|
||||
POSTGRESQL_LOG_CONNECTIONS = { value = "false" }
|
||||
POSTGRESQL_LOG_DISCONNECTIONS = { value = "false" }
|
||||
POSTGRESQL_PGAUDIT_LOG_CATALOG = { value = "off" }
|
||||
POSTGRESQL_CLIENT_MIN_MESSAGES = { value = "error" }
|
||||
POSTGRESQL_SHARED_PRELOAD_LIBRARIES = { value = "pgaudit" }
|
||||
POSTGRES_INITDB_ARGS = { value = "--data-checksums" }
|
||||
|
||||
BITNAMI_DEBUG = { value = "false" }
|
||||
REDIS_REPLICATION_MODE = { value = "master" }
|
||||
ALLOW_EMPTY_PASSWORD = { value = "yes" }
|
||||
REDIS_TLS_ENABLED = { value = "no" }
|
||||
REDIS_PORT = { value = "6379" }
|
||||
|
||||
}
|
||||
pvc = {
|
||||
immich-data = {
|
||||
pvc = true
|
||||
name = "immich-data"
|
||||
pvc_size = "2Mi"
|
||||
mount_path = "/usr/src/app/upload"
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
machinelearning = {
|
||||
enabled = false
|
||||
#replicas = 0
|
||||
connected_namespace = "immicht"
|
||||
image = "ghcr.io/immich-app/immich-machine-learning:v1.134.0"
|
||||
service_port = [3003]
|
||||
environment = {
|
||||
DB_DATABASE_NAME = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "immich-db-credentials"
|
||||
key = "DB_DATABASE_NAME"
|
||||
}
|
||||
}
|
||||
}
|
||||
DB_USERNAME = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "immich-db-credentials"
|
||||
key = "DB_USERNAME"
|
||||
}
|
||||
}
|
||||
}
|
||||
DB_PASSWORD = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "immich-db-credentials"
|
||||
key = "DB_PASSWORD"
|
||||
}
|
||||
}
|
||||
}
|
||||
DB_HOSTNAME = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "immich-db-credentials"
|
||||
key = "DB_HOST"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
IMMICH_MACHINE_LEARNING_URL = {
|
||||
value = "http://machinelearning-svc:3003"
|
||||
}
|
||||
|
||||
REDIS_HOSTNAME = {
|
||||
value = "immicht-redis-svc"
|
||||
}
|
||||
|
||||
TRANSFORMERS_CACHE = {
|
||||
value = "/cache"
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
django = {
|
||||
#enabled =false
|
||||
namespace = "django"
|
||||
image = "gitea.tryton.geeraert.eu/pi-ux-ce/django-python:latest"
|
||||
service_port = [8000]
|
||||
database = {
|
||||
image = "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0"
|
||||
}
|
||||
|
||||
requirements = {
|
||||
limits-cpu = "800m"
|
||||
limits-memory = "800Mi"
|
||||
requests-cpu = "10m"
|
||||
requests-memory = "300Mi"
|
||||
}
|
||||
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/django/kubeconfig.secret.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/django/django-db.secret.yaml"]
|
||||
|
||||
environment = {
|
||||
|
||||
DB_PASSWORD = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "django-db-credentials"
|
||||
key = "DB_PASSWORD"
|
||||
}
|
||||
}
|
||||
}
|
||||
POSTGRES_DB = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "django-db-credentials"
|
||||
key = "DB_DATABASE_NAME"
|
||||
}
|
||||
}
|
||||
}
|
||||
POSTGRES_USER = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "django-db-credentials"
|
||||
key = "DB_USERNAME"
|
||||
}
|
||||
}
|
||||
}
|
||||
POSTGRES_PASSWORD = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "django-db-credentials"
|
||||
key = "DB_PASSWORD"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
DB_HOSTNAME = {
|
||||
value_from = {
|
||||
secret_key_ref = {
|
||||
name = "django-db-credentials"
|
||||
key = "DB_HOST"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
pvc = {
|
||||
kubeconfig-secret = {
|
||||
secret = true
|
||||
name = "kubeconfig"
|
||||
mount_path = "/kubeconfig"
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
keycloak = {
|
||||
#enabled = false
|
||||
name = "keycloak"
|
||||
image = "quay.io/keycloak/keycloak:25.0.1"
|
||||
service_port = [8080]
|
||||
command = ["/opt/keycloak/bin/kc.sh", "start-dev"]
|
||||
environment = {
|
||||
KEYCLOAK_ADMIN = {
|
||||
value = "admin"
|
||||
}
|
||||
KEYCLOAK_ADMIN_PASSWORD = {
|
||||
value = "admin"
|
||||
}
|
||||
#KC_DB = {
|
||||
# value = "dev-mem"
|
||||
#}
|
||||
KC_HTTP_ENABLED = {
|
||||
value = "true"
|
||||
}
|
||||
KC_PROXY_HEADERS = {
|
||||
value = "xforwarded"
|
||||
}
|
||||
KC_HOSTNAME_STRICT = {
|
||||
value = "false"
|
||||
}
|
||||
|
||||
KC_HOSTNAME = {
|
||||
value = "https://keycloak.tryton.geeraert.eu"
|
||||
}
|
||||
KC_HOSTNAME_ADMIN = {
|
||||
value = "https://keycloak.tryton.geeraert.eu"
|
||||
}
|
||||
}
|
||||
requirements = {
|
||||
limits-cpu = "1000m"
|
||||
limits-memory = "1Gi"
|
||||
requests-cpu = "500m"
|
||||
requests-memory = "400Mi"
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
your-app:
|
||||
image: hashicorp/http-echo
|
||||
command: ["-text=Hello, authenticated world!"]
|
||||
ports:
|
||||
- "3000"
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user