diff --git a/terraform/k8sapps/collabora.tf b/terraform/k8sapps/collabora.tf deleted file mode 100644 index fadbf6b..0000000 --- a/terraform/k8sapps/collabora.tf +++ /dev/null @@ -1,213 +0,0 @@ -# -# Namespace -# -resource "kubernetes_namespace" "collabora" { - metadata { - annotations = { - name = "collabora" - } - - labels = { - name = "collabora" - } - - name = "collabora" - } -} - -resource "kubernetes_secret" "collabora_admin_credentials" { - metadata { - name = "collabora-admin-credentials" - namespace = kubernetes_namespace.collabora.metadata[0].name - } - data = { - username = "admin" - password = var.collabora_admin_password - } - type = "Opaque" -} - -resource "kubernetes_config_map" "collabora" { - - metadata { - name = "collabora-config" - namespace = kubernetes_namespace.collabora.metadata[0].name - } - data = { - "extra_params" = "-o:ssl.enable=true" - "aliasgroup1" = "https://${local.nextcloud_fqdn}" - } -} - -resource "kubernetes_service_account" "collabora_service_account" { - - metadata { - name = "collabora-app-sa" - namespace = kubernetes_namespace.collabora.metadata[0].name - } - - automount_service_account_token = false -} - - -resource "kubernetes_service" "collabora_office" { - metadata { - name = "http" - namespace = kubernetes_namespace.collabora.metadata[0].name - } - spec { - port { - port = 80 - target_port = "http" - } - selector = { - app = "collabora" - } - cluster_ip = "None" - } -} - -resource "kubernetes_ingress_v1" "collabora_ingress" { - depends_on = [ - kubernetes_stateful_set.collabora_office - ] - metadata { - name = "collabora-ingress" - namespace = kubernetes_namespace.collabora.metadata[0].name - - annotations = { - "kubernetes.io/ingress.class" = "public" - "cert-manager.io/cluster-issuer" = "letsencrypt-prod" - "kubernetes.io/tls-acme" = "true" - "nginx.ingress.kubernetes.io/backend-protocol" = "HTTPS" - } - } - spec { - tls { - hosts = [local.collabora_fqdn] - secret_name = "collabora-tls" - } - rule { - host = local.collabora_fqdn - http { - path { - backend { - service { - name = "http" - port { - number = 80 - } - } - } - } - } - } - } -} - - -resource "kubernetes_stateful_set" "collabora_office" { - - metadata { - name = "collabora" - namespace = kubernetes_namespace.collabora.metadata[0].name - } - - spec { - service_name = "collabora" - selector { - match_labels = { - app = "collabora" - } - } - template { - metadata { - annotations = { - "cluster-autoscaler.kubernetes.io/safe-to-evict" = "true" - } - labels = { - app = "collabora" - } - } - spec { - termination_grace_period_seconds = 60 - service_account_name = kubernetes_service_account.collabora_service_account.metadata[0].name - container { - name = "collabora" - image = "collabora/code:${local.collabora_version}" - image_pull_policy = "IfNotPresent" - port { - name = "http" - container_port = 9980 - protocol = "TCP" - } - startup_probe { - tcp_socket { - # path = "/" - port = 9980 - # scheme = "HTTP" - } - failure_threshold = 30 - period_seconds = 3 - } - liveness_probe { - tcp_socket { - # path = "/" - port = 9980 - # scheme = "HTTP" - } - initial_delay_seconds = 0 - period_seconds = 30 - timeout_seconds = 30 - success_threshold = 1 - failure_threshold = 4 - } - readiness_probe { - tcp_socket { - # path = "/" - port = 9980 - # scheme = "HTTP" - } - initial_delay_seconds = 0 - period_seconds = 30 - timeout_seconds = 30 - success_threshold = 1 - failure_threshold = 2 - } - env_from { - config_map_ref { - name = kubernetes_config_map.collabora.metadata[0].name - } - } - env { - name = "username" - value_from { - secret_key_ref { - name = kubernetes_secret.collabora_admin_credentials.metadata[0].name - key = "username" - } - } - } - env { - name = "password" - value_from { - secret_key_ref { - name = kubernetes_secret.collabora_admin_credentials.metadata[0].name - key = "password" - } - } - } - volume_mount { - name = "tmp" - mount_path = "/tmp" - } - } - volume { - name = "tmp" - empty_dir { - } - } - } - } - } -} diff --git a/terraform/k8sapps/nextcloud.tf.disabled b/terraform/k8sapps/nextcloud.tf.disabled deleted file mode 100644 index e071b1f..0000000 --- a/terraform/k8sapps/nextcloud.tf.disabled +++ /dev/null @@ -1,492 +0,0 @@ -locals { - nextcloud_env_vars = { - # Database configuration - MYSQL_DATABASE = "nextcloud" - MYSQL_HOST = module.nextcloud_database.host - - # Email configuration - SMTP_HOST = local.scaleway_smtp_host - SMTP_SECURE = "ssl" - SMTP_PORT = 465 - MAIL_FROM_ADDRESS = "cloud" - MAIL_DOMAIN = "alexpires.me" - SMTP_AUTHTYPE = "PLAIN" - - # Redis configuration - REDIS_HOST = "redis" - - # Object as primary storage - OBJECTSTORE_S3_HOST = "s3.${scaleway_object_bucket.nextcloud.region}.scw.cloud" - OBJECTSTORE_S3_BUCKET = scaleway_object_bucket.nextcloud.name - OBJECTSTORE_S3_PORT = 443 - OBJECTSTORE_S3_SSL = true - OBJECTSTORE_S3_REGION = scaleway_object_bucket.nextcloud.region - OBJECTSTORE_S3_AUTOCREATE = false - - # General - NEXTCLOUD_TRUSTED_DOMAINS = local.nextcloud_fqdn - TRUSTED_PROXIES = join(" ", ["10.1.0.0/16"]) - OVERWRITEHOST = local.nextcloud_fqdn - OVERWRITEPROTOCOL = "https" - OVERWRITECLIURL = "https://${local.nextcloud_fqdn}" - } - - nextcloud_secrets = { - - OBJECTSTORE_S3_KEY = { - key = "access_key" - name = kubernetes_secret.nextcloud_object_store_credentials.metadata[0].name - } - - OBJECTSTORE_S3_SECRET = { - key = "secret_key" - name = kubernetes_secret.nextcloud_object_store_credentials.metadata[0].name - } - - SMTP_NAME = { - key = "username" - name = kubernetes_secret.nextcloud_mail_credentials.metadata[0].name - } - - SMTP_PASSWORD = { - key = "password" - name = kubernetes_secret.nextcloud_mail_credentials.metadata[0].name - } - - MYSQL_USER = { - key = "username" - name = module.nextcloud_database.app_crendentials_name - } - - MYSQL_PASSWORD = { - key = "password" - name = module.nextcloud_database.app_crendentials_name - } - - NEXTCLOUD_ADMIN_USER = { - key = "username" - name = kubernetes_secret.nextcloud_admin_credentials.metadata[0].name - } - - NEXTCLOUD_ADMIN_PASSWORD = { - key = "password" - name = kubernetes_secret.nextcloud_admin_credentials.metadata[0].name - } - } - - nextcloud_path = "/var/lib/nextcloud" - nextcloud_mysql_path = "/var/lib/mysql.nextcloud" - -} - -# -# Namespace -# -resource "kubernetes_namespace" "nextcloud" { - metadata { - annotations = { - name = "nextcloud" - } - - labels = { - name = "nextcloud" - } - - name = "nextcloud" - } -} - -# -# Nextcloud required credentials -# -resource "kubernetes_secret" "nextcloud_mail_credentials" { - metadata { - name = "nextcloud-mail-credentials" - namespace = kubernetes_namespace.nextcloud.metadata[0].name - } - data = { - username = var.scaleway_project_id - password = scaleway_iam_api_key.mail_app_api.secret_key - } - type = "Opaque" -} - -resource "kubernetes_secret" "nextcloud_object_store_credentials" { - metadata { - name = "nextcloud-object-store-credentials" - namespace = kubernetes_namespace.nextcloud.metadata[0].name - } - data = { - access_key = scaleway_iam_api_key.nextcloud_app_api.access_key - secret_key = scaleway_iam_api_key.nextcloud_app_api.secret_key - } - type = "Opaque" -} - -resource "kubernetes_secret" "nextcloud_admin_credentials" { - metadata { - name = "nextcloud-admin-credentials" - namespace = kubernetes_namespace.nextcloud.metadata[0].name - } - data = { - username = "admin" - password = var.nextcloud_admin_password - } - type = "Opaque" -} - -# -# Setup MariaDB database -# -module "nextcloud_database" { - source = "./modules/k8s_mariadb" - - namespace = kubernetes_namespace.nextcloud.metadata[0].name - app_name = "nextcloud" - app_backup_folder = "nextcloud.backups" - - app_password = var.nextcloud_mysql_password - root_password = var.mysql_root_password - - retention_days = local.local_backup_retention_days - cron_schedule = local.nextcloud_sql_backup_cron_schedule - host_storage_path = local.nextcloud_mysql_path -} - -# -# Setup rsync backup job to scaleway bucket -# -module "nextcloud_backup" { - - source = "./modules/scw_backup_job" - - namespace = kubernetes_namespace.nextcloud.metadata[0].name - app_name = "nextcloud" - app_files_folder = "nextcloud" - app_backup_folder = "mysql.nextcloud/nextcloud.backups" - - scaleway_organization_id = var.scaleway_organization_id - scaleway_project_id = var.scaleway_organization_id - access_key = scaleway_iam_api_key.backup_app_api.access_key - secret_key = scaleway_iam_api_key.backup_app_api.secret_key - bucket_name = scaleway_object_bucket.backup.name - - retention_days = local.local_backup_retention_days - cron_schedule = local.nextcloud_files_backup_cron_schedule -} - -# -# Nextcloud service, ingress, deployment and file backup job -# -# -resource "kubernetes_service_account" "nextcloud_service_account" { - - metadata { - name = "nextcloud-app-sa" - namespace = kubernetes_namespace.nextcloud.metadata[0].name - } - - automount_service_account_token = false -} - -resource "kubernetes_service" "nextcloud_redis" { - metadata { - name = "redis" - namespace = kubernetes_namespace.nextcloud.metadata[0].name - } - spec { - port { - port = 6379 - name = "redis" - } - selector = { - app = "redis" - } - cluster_ip = "None" - } -} - -resource "kubernetes_service" "nextcloud_apache" { - metadata { - name = "http" - namespace = kubernetes_namespace.nextcloud.metadata[0].name - } - spec { - port { - port = 80 - target_port = "http" - } - selector = { - app = "nextcloud" - } - cluster_ip = "None" - } -} - -resource "kubernetes_ingress_v1" "nextcloud_ingress" { - depends_on = [ - kubernetes_deployment.nextcloud_apache - ] - metadata { - name = "nextcloud-ingress" - namespace = kubernetes_namespace.nextcloud.metadata[0].name - - annotations = { - "kubernetes.io/ingress.class" = "public" - "cert-manager.io/cluster-issuer" = "letsencrypt-prod" - "kubernetes.io/tls-acme" = "true" - "nginx.ingress.kubernetes.io/ssl-redirect" = "true" - "nginx.ingress.kubernetes.io/proxy-body-size" = "4G" - "nginx.ingress.kubernetes.io/proxy-request-buffering" = "on" - "nginx.ingress.kubernetes.io/proxy-buffer-size" = "32k" - "nginx.ingress.kubernetes.io/proxy-buffers-number" = "16" - "nginx.ingress.kubernetes.io/server-snippet" = file("${path.module}/resources/nextcloud-server-snippet.conf") - } - } - spec { - tls { - hosts = [local.nextcloud_fqdn] - secret_name = "nextcloud-tls" - } - rule { - host = local.nextcloud_fqdn - http { - path { - backend { - service { - name = "http" - port { - number = 80 - } - } - } - } - } - } - } -} - -resource "kubernetes_deployment" "nextcloud_redis" { - metadata { - name = "redis" - namespace = kubernetes_namespace.nextcloud.metadata[0].name - } - spec { - selector { - match_labels = { - app = "redis" - } - } - strategy { - type = "RollingUpdate" - } - template { - metadata { - labels = { - app = "redis" - } - } - spec { - container { - name = "redis" - image = "redis:latest" - - resources { - requests = { - memory = "20Mi" - } - limits = { - memory = "50Mi" - } - } - - readiness_probe { - tcp_socket { - port = "redis" - } - initial_delay_seconds = 10 - period_seconds = 15 - success_threshold = 1 - failure_threshold = 3 - } - - liveness_probe { - tcp_socket { - port = "redis" - } - initial_delay_seconds = 10 - period_seconds = 15 - success_threshold = 1 - failure_threshold = 3 - } - - port { - container_port = 6379 - name = "redis" - protocol = "TCP" - } - } - } - } - } -} - -resource "kubernetes_deployment" "nextcloud_apache" { - - depends_on = [ - module.nextcloud_database, - kubernetes_deployment.nextcloud_redis - ] - - metadata { - name = "nextcloud-app" - namespace = kubernetes_namespace.nextcloud.metadata[0].name - } - spec { - selector { - match_labels = { - app = "nextcloud" - } - } - strategy { - type = "Recreate" - } - template { - metadata { - labels = { - app = "nextcloud" - } - } - spec { - service_account_name = kubernetes_service_account.nextcloud_service_account.metadata[0].name - - container { - name = "nextcloud" - image = "nextcloud:${local.nextcloud_version}" - image_pull_policy = "Always" - - resources { - requests = { - memory = "200Mi" - } - } - - readiness_probe { - http_get { - port = "http" - path = "/status.php" - } - initial_delay_seconds = 30 - period_seconds = 10 - success_threshold = 1 - failure_threshold = 3 - } - - liveness_probe { - tcp_socket { - port = "http" - } - initial_delay_seconds = 5 - period_seconds = 10 - success_threshold = 1 - failure_threshold = 3 - } - - dynamic "env" { - for_each = local.nextcloud_env_vars - content { - name = env.key - value = env.value - } - } - - dynamic "env" { - for_each = local.nextcloud_secrets - content { - name = env.key - value_from { - secret_key_ref { - key = env.value.key - name = env.value.name - } - } - } - } - - port { - container_port = 80 - name = "http" - } - - volume_mount { - mount_path = "/var/www/html" - name = "persistent-storage" - } - } - volume { - name = "persistent-storage" - host_path { - path = local.nextcloud_path - } - } - } - } - } - lifecycle { - replace_triggered_by = [ - kubernetes_deployment.nextcloud_redis - ] - } -} - -resource "kubernetes_cron_job_v1" "nextcloud_cron_apache" { - depends_on = [ - kubernetes_deployment.nextcloud_apache - ] - metadata { - namespace = kubernetes_namespace.nextcloud.metadata[0].name - name = "cronjob-trigger" - } - spec { - schedule = "*/15 * * * *" - concurrency_policy = "Forbid" - failed_jobs_history_limit = 2 - successful_jobs_history_limit = 2 - job_template { - metadata { - labels = { - app = "cronjob-trigger" - } - } - spec { - backoff_limit = 1 - parallelism = 1 - completions = 1 - active_deadline_seconds = 300 - template { - metadata { - labels = { - app = "cronjob-trigger" - } - } - spec { - container { - name = "nextcloud" - image = "nextcloud:${local.nextcloud_version}" - - command = ["curl"] - args = ["--fail", "-L", "http://http/cron.php"] - } - restart_policy = "Never" - termination_grace_period_seconds = 30 - } - } - } - } - } - lifecycle { - replace_triggered_by = [ - kubernetes_deployment.nextcloud_apache - ] - } -}