a13labs.infra/terraform/apps/prod-01/config.tf

locals {

  # general
  # storage
  persistent_folder = "/mnt/microk8s_persistent"
  database_folder   = "/var/lib"

  # domains
  primary_domain = "alexpires.me"
  websites = {
    "alexpires.me" = {
      domain_name    = "alexpires.me"
      fqdn           = ["blog.alexpires.me", "www.alexpires.me", "alexpires.me"]
      tls            = true
      issuer         = "internal-ca"
      custom_snippet = file("${path.module}/resources/alexpires.me.conf")
    }
  }

  # gitea
  gitea_version = "1.24-rootless"
  gitea_fqdn    = "code.${local.primary_domain}"

  # sftpgo
  sftpgo_version = "2.6.x"
  sftpgo_fqdn    = "webdav.${local.primary_domain}"

  # m3uproxy
  m3uproxy_version = "latest"
  m3uproxy_fqdn    = "tv.${local.primary_domain}"

  # geoip
  geoip_cron_schedule = "0 0 * * *"
  geoip_editions = [
    "GeoLite2-Country",
    "GeoLite2-City",
    "GeoLite2-ASN"
  ]

  rustdesk_fqdn = "rustdesk.${local.primary_domain}"

  # trivy
  trivy_cronjob_schedule = "0 1 1/15 * *"

  # backup
  local_backup_retention_days       = 2
  mail_backup_path                  = "${local.persistent_folder}/backup.mail"
  gitea_backup_path                 = "${local.persistent_folder}/backup.gitea"
  sftpgo_backup_path                = "${local.persistent_folder}/backup.sftpgo"
  gitea_sql_backup_cron_schedule    = "20 2 * * *"
  gitea_files_backup_cron_schedule  = "30 2 * * *"
  sftpgo_files_backup_cron_schedule = "50 2 * * *"
  mail_files_backup_cron_schedule   = "0 3 * * *"

  # email settings
  fetch_emails_schedule = "*/2 * * * *"
  scaleway_smtp_host    = "smtp.tem.scw.cloud"
  scaleway_smtp_port    = 587
  email_accounts = [
    {
      domain    = "alexpires.me"
      recipient = "c.alexandre.pires"
      receive = {
        type   = "imap"
        server = "mail-pt.securemail.pro"
        port   = 993
      }
      send = {
        server = "smtp-pt.securemail.pro"
        port   = 465
      }
      username  = var.alexpires_me_email_username
      password  = var.alexpires_me_email_password
      mailboxes = ["INBOX", "Sent", "Drafts", "Trash", "Spam"]
    }
  ]

  # proxy settings

  streams = {
    # For now disabled, because this messes with fail2ban on the host
    # since the ip is lost and replaced with the nginx ingress controller ip
    # to fix this we might need to setup logging on the stream and cross reference
    # with postfix/dovecot logs and then ban the ip on the host
    # "imap" = {
    #   port     = 993
    #   upstream = "imap.mail.svc.cluster.local"
    #   protocol = "tcp"
    # }
    # "smtps" = {
    #   port     = 465
    #   upstream = "smtps.mail.svc.cluster.local"
    #   protocol = "tcp"
    # }
    "21115-tcp" = {
      port      = 21115
      host_port = 21115
      upstream  = "tcp.rustdesk.svc.cluster.local"
      protocol  = "tcp"
    }
    "21116-tcp" = {
      port      = 21116
      host_port = 21116
      upstream  = "tcp.rustdesk.svc.cluster.local"
      protocol  = "tcp"
    }
    "21116-udp" = {
      port      = 21116
      host_port = 21116
      upstream  = "udp.rustdesk.svc.cluster.local"
      protocol  = "udp"
    }
    "21117-tcp" = {
      port      = 21117
      host_port = 21117
      upstream  = "tcp.rustdesk.svc.cluster.local"
      protocol  = "tcp"
    }
    "9090-tcp" = {
      port     = 9090
      upstream = "prometheus.prometheus.svc.cluster.local"
      protocol = "tcp"
    }
  }

  wireguard_config = {
    private_key    = var.wireguard_1_private_key
    public_key     = var.wireguard_1_public_key
    pre_shared_key = var.wireguard_1_pre_shared_key
    endpoint       = "aristotle.alexpires.me"
    endpoint_port  = 51820
    address        = "10.5.5.2/32"
    dns            = "10.19.4.1"
    allowed_ips = [
      "10.19.4.106/32",
      "10.19.4.136/32",
    ]
  }

  proxy_services = {
    "open-webui" = {
      http_port  = 8080
      https_port = 8443
      tls        = true
      resolver   = "10.19.4.136"
      fqdn       = ["ai.alexpires.me"]
      upstream   = "https://open-webui.lab.alexpires.me"
      locations = [
        {
          path = "/ws/socket.io/"
          headers = {
            "Upgrade"    = "$http_upgrade"
            "Connection" = "upgrade"
          }
        },
        {
          path = "/"
        },
      ]
    },
    "nextcloud" = {
      http_port  = 8081
      https_port = 8444
      custom_ingress_annotations = {
        "nginx.ingress.kubernetes.io/proxy-body-size"         = "4G"
        "nginx.ingress.kubernetes.io/proxy-request-buffering" = "on"
        "nginx.ingress.kubernetes.io/proxy-buffer-size"       = "32k"
        "nginx.ingress.kubernetes.io/proxy-buffers-number"    = "16"
      }
      tls            = true
      custom_snippet = file("${path.module}/resources/nextcloud.conf")
      resolver       = "10.19.4.136"
      fqdn           = ["cloud.alexpires.me"]
      upstream       = "https://cloud.alexpires.me"
      locations = [
        {
          path = "/"
        },
      ]
    },
    "ollama" = {
      http_port         = 11434
      ingress           = false
      resolver          = "10.19.4.136"
      upstream          = "http://ollama.lab.alexpires.me:11434"
      service_http_port = 11434
      locations = [
        {
          path = "/"
        },
      ]
    }
  }

  # prometheus
  prometheus_config   = file("${path.module}/resources/prometheus.yml")
  prometheus_rules    = file("${path.module}/resources/prometheus-rules.yml")
  alertmanager_config = file("${path.module}/resources/alertmanager.yml")
  alertmanager_email_config = {
    to            = "c.alexandre.pires@alexpires.me"
    from          = "alertmanager@${local.primary_domain}"
    smarthost     = "smtp.tem.scw.cloud:587"
    auth_username = var.scaleway_project_id
    auth_password = local.mail_app_api_secret_key
  }

  telegram_chat_id = "5432313610" # a13labs channel
  telegram_message = file("${path.module}/resources/telegram.tpl")

  # get secrets from remote state
  backup_bucket_name        = data.terraform_remote_state.scaleway.outputs.backup_bucket_name
  backup_app_api_secret_key = data.terraform_remote_state.scaleway.outputs.backup_app_api_secret_key
  backup_app_api_access_key = data.terraform_remote_state.scaleway.outputs.backup_app_api_access_key
  mail_app_api_secret_key   = data.terraform_remote_state.scaleway.outputs.mail_app_api_secret_key
  sftpgo_app_api_access_key = data.terraform_remote_state.scaleway.outputs.sftpgo_app_api_access_key
  sftpgo_app_api_secret_key = data.terraform_remote_state.scaleway.outputs.sftpgo_app_api_secret_key
}

data "terraform_remote_state" "scaleway" {
  backend = "s3"
  config = {
    bucket = "a13labs.infra.eu"
    key    = "scaleway.core.infra.tfstate"
    region = "eu-west-1"
  }
}