diff --git a/terraform/k8sapps/apps.tf b/terraform/k8sapps/apps.tf index fca8ef7..aaccfca 100644 --- a/terraform/k8sapps/apps.tf +++ b/terraform/k8sapps/apps.tf @@ -64,19 +64,31 @@ module "gitea" { backup_retention_days = local.local_backup_retention_days backup_cron_schedule = local.gitea_sql_backup_cron_schedule - db_password = var.gitea_mysql_password db_root_password = var.mysql_root_password - tag = local.gitea_version - fqdn = local.gitea_fqdn - app_name = "A13Labs git repository" + tag = local.gitea_version + fqdn = local.gitea_fqdn - smtp_host = local.scaleway_smtp_host - smtp_port = local.scaleway_smtp_port - smtp_username = var.scaleway_project_id - smtp_password = scaleway_iam_api_key.mail_app_api.secret_key - - from_email = "gitea@${local.primary_domain}" + app_config = { + app_name = "A13Labs git repository" + domain = local.gitea_fqdn + lfs_jwt_secret = var.gitea_lfs_jwt_secret + db_passwd = var.gitea_mysql_password + jwt_secret = var.gitea_jwt_secret + mail_from = "gitea@${local.primary_domain}" + no_reply_address = "no-reply@${local.primary_domain}" + smtp_user = var.scaleway_project_id + db_password = var.gitea_mysql_password + smtp_host = local.scaleway_smtp_host + smtp_port = local.scaleway_smtp_port + smtp_user = var.scaleway_project_id + smtp_passwd = scaleway_iam_api_key.mail_app_api.secret_key + secret_key = var.gitea_secret_key + internal_token = var.gitea_internal_token + disable_ssh = false + ssh_port = 22 + disable_registration = true + } } module "sftpgo" { diff --git a/terraform/k8sapps/secrets.tf b/terraform/k8sapps/secrets.tf index 65517de..7fecddf 100644 --- a/terraform/k8sapps/secrets.tf +++ b/terraform/k8sapps/secrets.tf @@ -82,3 +82,27 @@ variable "root_ca_key" { type = string sensitive = true } + +variable "gitea_lfs_jwt_secret" { + description = "Gitea LFS JWT secret" + type = string + sensitive = true +} + +variable "gitea_secret_key" { + description = "Gitea secret key" + type = string + sensitive = true +} + +variable "gitea_internal_token" { + description = "Gitea internal token" + type = string + sensitive = true +} + +variable "gitea_jwt_secret" { + description = "Gitea JWT secret" + type = string + sensitive = true +} diff --git a/terraform/k8sapps/sectool.env b/terraform/k8sapps/sectool.env index dab5461..3123310 100644 --- a/terraform/k8sapps/sectool.env +++ b/terraform/k8sapps/sectool.env @@ -24,3 +24,7 @@ TF_VAR_mail_crypt_public_key=$DOVECOT_CRYPT_PUB_KEY_FILE TF_VAR_sftpgo_admin_password=$SFTPGO_ADMIN_PASSWORD TF_VAR_root_ca_pem=$K8S_ROOT_CA_PEM TF_VAR_root_ca_key=$K8S_ROOT_CA_KEY +TF_VAR_gitea_lfs_jwt_secret=$GITEA_LFS_JWT_SECRET +TF_VAR_gitea_secret_key=$GITEA_SECRET_KEY +TF_VAR_gitea_internal_token=$GITEA_INTERNAL_TOKEN +TF_VAR_gitea_jwt_secret=$GITEA_JWT_SECRET diff --git a/terraform/modules/apps/gitea/config.tf b/terraform/modules/apps/gitea/config.tf index 103c782..f6be7e7 100644 --- a/terraform/modules/apps/gitea/config.tf +++ b/terraform/modules/apps/gitea/config.tf @@ -1,43 +1,39 @@ locals { - gitea_env_vars = { - APP_NAME = var.app_name - HTTP_PORT = "3000" - RUN_MODE = "prod" - LFS_START_SERVER = "true" - SSH_DOMAIN = var.fqdn - DISABLE_REGISTRATION = true - INSTALL_LOCK = "true" - DB_TYPE = "mysql" - DB_NAME = "gitea" - DB_HOST = module.gitea_database.host - SSH_LISTEN_PORT = 22 - GITEA__mailer__ENABLED = true - GITEA__mailer__FROM = var.from_email - GITEA__mailer__SMTP_ADDR = var.smtp_host - GITEA__mailer__SMTP_PORT = var.smtp_port - GITEA__mailer__PROTOCOL = "smtps" - } - - gitea_secrets = { - DB_USER = { - key = "username" - name = module.gitea_database.app_crendentials_name - } - DB_PASSWD = { - key = "password" - name = module.gitea_database.app_crendentials_name - } - GITEA__mailer__USER = { - key = "username" - name = kubernetes_secret.gitea_mail_credentials.metadata[0].name - } - GITEA__mailer__PASSWD = { - key = "password" - name = kubernetes_secret.gitea_mail_credentials.metadata[0].name - } - } - gitea_path = "${var.persistent_folder}/gitea" gitea_db_path = "${var.database_folder}/mysql.gitea" + + config = templatefile("${path.module}/resources/app.ini.tpl", { + APP_NAME = var.app_config.app_name + RUN_MODE = var.app_config.run_mode + DOMAIN = var.app_config.domain + HTTP_PORT = var.app_config.http_port + TLS_ENABLED = var.tls_enabled + DISABLE_SSH = var.app_config.disable_ssh + SSH_PORT = var.app_config.ssh_port + LFS_JWT_SECRET = var.app_config.lfs_jwt_secret + DB_HOST = var.app_config.db_host + DB_PORT = var.app_config.db_port + DB_NAME = var.app_config.db_name + DB_USER = var.app_config.db_user + DB_PASSWD = var.app_config.db_passwd + DB_SSL_MODE = var.tls_enabled ? "skip-verify" : "false" + SECRET_KEY = var.app_config.secret_key + INTERNAL_TOKEN = var.app_config.internal_token + DISABLE_REGISTRATION = var.app_config.disable_registration + REQUIRE_SIGNIN_VIEW = var.app_config.require_signin_view + REGISTER_EMAIL_CONFIRM = var.app_config.register_email_confirm + ENABLE_NOTIFY_MAIL = var.app_config.enable_notify_mail + ALLOW_ONLY_EXTERNAL_REGISTRATION = var.app_config.allow_only_external_registration + ENABLE_CAPTCHA = var.app_config.enable_captcha + NO_REPLY_ADDRESS = var.app_config.no_reply_address + JWT_SECRET = var.app_config.jwt_secret + MAIL_FROM = var.app_config.mail_from + SMTP_USER = var.app_config.smtp_user + SMTP_PASSWD = var.app_config.smtp_passwd + SMTP_PROTOCOL = var.app_config.smtp_protocol + SMTP_HOST = var.app_config.smtp_host + SMTP_PORT = var.app_config.smtp_port + }) + config_checksum = sha256(local.config) } diff --git a/terraform/modules/apps/gitea/database.tf b/terraform/modules/apps/gitea/database.tf index 59ac4d9..194d97d 100644 --- a/terraform/modules/apps/gitea/database.tf +++ b/terraform/modules/apps/gitea/database.tf @@ -2,9 +2,9 @@ module "gitea_database" { source = "../../db/mariadb" namespace = kubernetes_namespace.gitea.metadata[0].name - app_name = "gitea" + app_name = var.app_config.db_name - app_password = var.db_password + app_password = var.app_config.db_passwd root_password = var.db_root_password retention_days = var.backup_retention_days @@ -12,4 +12,7 @@ module "gitea_database" { database_folder = local.gitea_db_path backup_folder = var.backup_folder + + tls_enabled = var.tls_enabled + issuer = var.issuer } diff --git a/terraform/modules/apps/gitea/ingress.tf b/terraform/modules/apps/gitea/ingress.tf new file mode 100644 index 0000000..20dbefb --- /dev/null +++ b/terraform/modules/apps/gitea/ingress.tf @@ -0,0 +1,63 @@ + +resource "kubernetes_service" "gitea_http" { + metadata { + name = "http" + namespace = kubernetes_namespace.gitea.metadata[0].name + } + spec { + port { + port = var.tls_enabled ? 443 : 80 + target_port = "http" + } + selector = { + app = "gitea" + } + cluster_ip = "None" + } +} + +resource "kubernetes_ingress_v1" "gitea_ingress" { + metadata { + name = "gitea-ingress" + namespace = kubernetes_namespace.gitea.metadata[0].name + + annotations = merge({ + "kubernetes.io/ingress.class" = "public" + "cert-manager.io/cluster-issuer" = "letsencrypt-prod" + "nginx.ingress.kubernetes.io/ssl-redirect" = "true" + "nginx.ingress.kubernetes.io/proxy-body-size" = "8m" + "nginx.ingress.kubernetes.io/proxy-request-buffering" = "on" + "nginx.ingress.kubernetes.io/proxy-buffer-size" = "32k" + "nginx.ingress.kubernetes.io/proxy-buffers-number" = "16" + }, + var.tls_enabled ? { + "nginx.org/ssl-services" = "http" + "nginx.org/ssl-redirect" = "true" + "nginx.org/redirect-to-https" = "true" + "nginx.ingress.kubernetes.io/backend-protocol" = "HTTPS" + } : {} + ) + + } + spec { + tls { + hosts = [var.fqdn] + secret_name = "gitea-tls" + } + rule { + host = var.fqdn + http { + path { + backend { + service { + name = "http" + port { + number = var.tls_enabled ? 443 : 80 + } + } + } + } + } + } + } +} diff --git a/terraform/modules/apps/gitea/main.tf b/terraform/modules/apps/gitea/main.tf index 0a0c1bd..724340e 100644 --- a/terraform/modules/apps/gitea/main.tf +++ b/terraform/modules/apps/gitea/main.tf @@ -12,18 +12,38 @@ resource "kubernetes_namespace" "gitea" { } } -resource "kubernetes_secret" "gitea_mail_credentials" { +resource "kubernetes_manifest" "internal_cert" { + count = var.tls_enabled ? 1 : 0 + manifest = { + apiVersion = "cert-manager.io/v1" + kind = "Certificate" + metadata = { + name = "internal-cert" + namespace = kubernetes_namespace.gitea.metadata[0].name + } + spec = { + secretName = "internal-cert" + issuerRef = { + name = var.issuer + kind = "ClusterIssuer" + } + commonName = var.fqdn + dnsNames = [var.fqdn] + } + } +} + +resource "kubernetes_config_map" "gitea_config" { metadata { - name = "gitea-mail-credentials" + name = "gitea-config" namespace = kubernetes_namespace.gitea.metadata[0].name } data = { - username = var.smtp_username - password = var.smtp_password + "app.ini" = local.config } - type = "Opaque" } + resource "kubernetes_service_account" "gitea_service_account" { metadata { @@ -34,61 +54,6 @@ resource "kubernetes_service_account" "gitea_service_account" { automount_service_account_token = false } -resource "kubernetes_service" "gitea_http" { - metadata { - name = "http" - namespace = kubernetes_namespace.gitea.metadata[0].name - } - spec { - port { - port = 80 - target_port = "http" - } - selector = { - app = "gitea" - } - cluster_ip = "None" - } -} - -resource "kubernetes_ingress_v1" "gitea_ingress" { - metadata { - name = "gitea-ingress" - namespace = kubernetes_namespace.gitea.metadata[0].name - - annotations = { - "kubernetes.io/ingress.class" = "public" - "cert-manager.io/cluster-issuer" = "letsencrypt-prod" - "nginx.ingress.kubernetes.io/ssl-redirect" = "true" - "nginx.ingress.kubernetes.io/proxy-body-size" = "8m" - "nginx.ingress.kubernetes.io/proxy-request-buffering" = "on" - "nginx.ingress.kubernetes.io/proxy-buffer-size" = "32k" - "nginx.ingress.kubernetes.io/proxy-buffers-number" = "16" - } - } - spec { - tls { - hosts = [var.fqdn] - secret_name = "gitea-tls" - } - rule { - host = var.fqdn - http { - path { - backend { - service { - name = "http" - port { - number = 80 - } - } - } - } - } - } - } -} - resource "kubernetes_deployment" "gitea" { depends_on = [module.gitea_database] @@ -111,6 +76,9 @@ resource "kubernetes_deployment" "gitea" { labels = { app = "gitea" } + annotations = { + "checksum/config" = local.config_checksum + } } spec { service_account_name = kubernetes_service_account.gitea_service_account.metadata[0].name @@ -149,30 +117,10 @@ resource "kubernetes_deployment" "gitea" { failure_threshold = 3 } - dynamic "env" { - for_each = local.gitea_env_vars - content { - name = env.key - value = env.value - } - } security_context { allow_privilege_escalation = false } - dynamic "env" { - for_each = local.gitea_secrets - content { - name = env.key - value_from { - secret_key_ref { - key = env.value.key - name = env.value.name - } - } - } - } - port { container_port = 3000 name = "http" @@ -186,6 +134,19 @@ resource "kubernetes_deployment" "gitea" { mount_path = "/data" name = "persistent-storage" } + volume_mount { + mount_path = "/data/gitea/conf/app.ini" + name = "gitea-config" + sub_path = "app.ini" + } + dynamic "volume_mount" { + for_each = var.tls_enabled ? [1] : [] + content { + mount_path = "/etc/ssl/certs/private" + name = "internal-cert" + read_only = true + } + } } volume { name = "persistent-storage" @@ -193,54 +154,35 @@ resource "kubernetes_deployment" "gitea" { path = local.gitea_path } } + volume { + name = "gitea-config" + config_map { + name = kubernetes_config_map.gitea_config.metadata[0].name + } + } + dynamic "volume" { + for_each = var.tls_enabled ? [1] : [] + content { + name = "internal-cert" + secret { + secret_name = kubernetes_manifest.internal_cert[0].manifest["metadata"]["name"] + items { + key = "tls.crt" + path = "tls.crt" + } + items { + key = "tls.key" + path = "tls.key" + } + } + } + } } } } -} -resource "kubernetes_role" "gitea_ssh_access" { - metadata { - name = "gitea-ssh-access" - namespace = kubernetes_namespace.gitea.metadata[0].name - } - rule { - api_groups = [""] - resources = ["pods", "pods/log"] - verbs = ["get", "list"] - } - rule { - api_groups = [""] - resources = ["pods/exec"] - verbs = ["create"] + lifecycle { + ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]] } } -resource "kubernetes_role_binding" "gitea_ssh_access" { - metadata { - name = "gitea-ssh-access" - namespace = kubernetes_namespace.gitea.metadata[0].name - } - role_ref { - api_group = "rbac.authorization.k8s.io" - kind = "Role" - name = kubernetes_role.gitea_ssh_access.metadata[0].name - } - subject { - kind = "ServiceAccount" - name = kubernetes_service_account.gitea_service_account.metadata[0].name - namespace = kubernetes_namespace.gitea.metadata[0].name - } -} - -resource "kubernetes_secret" "gitea_access_token" { - metadata { - annotations = { - "kubernetes.io/service-account.name" = kubernetes_service_account.gitea_service_account.metadata[0].name - } - name = "git-token" - namespace = kubernetes_namespace.gitea.metadata[0].name - } - - type = "kubernetes.io/service-account-token" - wait_for_service_account_token = true -} diff --git a/terraform/modules/apps/gitea/rbac.tf b/terraform/modules/apps/gitea/rbac.tf new file mode 100644 index 0000000..d6499e8 --- /dev/null +++ b/terraform/modules/apps/gitea/rbac.tf @@ -0,0 +1,46 @@ +resource "kubernetes_role" "gitea_ssh_access" { + metadata { + name = "gitea-ssh-access" + namespace = kubernetes_namespace.gitea.metadata[0].name + } + rule { + api_groups = [""] + resources = ["pods", "pods/log"] + verbs = ["get", "list"] + } + rule { + api_groups = [""] + resources = ["pods/exec"] + verbs = ["create"] + } +} + +resource "kubernetes_role_binding" "gitea_ssh_access" { + metadata { + name = "gitea-ssh-access" + namespace = kubernetes_namespace.gitea.metadata[0].name + } + role_ref { + api_group = "rbac.authorization.k8s.io" + kind = "Role" + name = kubernetes_role.gitea_ssh_access.metadata[0].name + } + subject { + kind = "ServiceAccount" + name = kubernetes_service_account.gitea_service_account.metadata[0].name + namespace = kubernetes_namespace.gitea.metadata[0].name + } +} + +resource "kubernetes_secret" "gitea_access_token" { + metadata { + annotations = { + "kubernetes.io/service-account.name" = kubernetes_service_account.gitea_service_account.metadata[0].name + } + name = "git-token" + namespace = kubernetes_namespace.gitea.metadata[0].name + } + + type = "kubernetes.io/service-account-token" + wait_for_service_account_token = true +} diff --git a/terraform/modules/apps/gitea/resources/app.ini.tpl b/terraform/modules/apps/gitea/resources/app.ini.tpl new file mode 100644 index 0000000..d1ccdf2 --- /dev/null +++ b/terraform/modules/apps/gitea/resources/app.ini.tpl @@ -0,0 +1,92 @@ +APP_NAME = ${APP_NAME} +RUN_MODE = ${RUN_MODE} +WORK_PATH = /data/gitea + +[repository] +ROOT = /data/git/repositories + +[repository.local] +LOCAL_COPY_PATH = /data/gitea/tmp/local-repo + +[repository.upload] +TEMP_PATH = /data/gitea/uploads + +[server] +APP_DATA_PATH = /data/gitea +SSH_DOMAIN = ${DOMAIN} +HTTP_PORT = ${HTTP_PORT} +%{ if TLS_ENABLED ~} +PROTOCOL = https +ROOT_URL = https://${DOMAIN} +CERT_FILE = /etc/ssl/certs/private/tls.crt +KEY_FILE = /etc/ssl/certs/private/tls.key +%{ else ~} +PROTOCOL = http +ROOT_URL = http://${DOMAIN} +%{ endif ~} +DISABLE_SSH = ${DISABLE_SSH} +SSH_PORT = ${SSH_PORT} +SSH_LISTEN_PORT = ${SSH_PORT} +LFS_START_SERVER = true +LFS_CONTENT_PATH = /data/git/lfs +LFS_JWT_SECRET = ${LFS_JWT_SECRET} +DOMAIN = ${DOMAIN} +OFFLINE_MODE = false + +[database] +PATH = /data/gitea/gitea.db +DB_TYPE = mysql +HOST = ${DB_HOST}:${DB_PORT} +NAME = ${DB_NAME} +USER = ${DB_USER} +PASSWD = ${DB_PASSWD} +SSL_MODE = ${DB_SSL_MODE} + +[indexer] +ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve + +[session] +PROVIDER_CONFIG = /data/gitea/sessions + +[picture] +AVATAR_UPLOAD_PATH = /data/gitea/avatars +REPOSITORY_AVATAR_UPLOAD_PATH = /data/gitea/repo-avatars + +[attachment] +PATH = /data/gitea/attachments + +[log] +ROOT_PATH = /data/gitea/log + +[security] +INSTALL_LOCK = true +SECRET_KEY = ${SECRET_KEY} +INTERNAL_TOKEN = ${INTERNAL_TOKEN} + +[service] +DISABLE_REGISTRATION = ${DISABLE_REGISTRATION} +REQUIRE_SIGNIN_VIEW = ${REQUIRE_SIGNIN_VIEW} +REGISTER_EMAIL_CONFIRM = ${REGISTER_EMAIL_CONFIRM} +ENABLE_NOTIFY_MAIL = ${ENABLE_NOTIFY_MAIL} +ALLOW_ONLY_EXTERNAL_REGISTRATION = ${ALLOW_ONLY_EXTERNAL_REGISTRATION} +ENABLE_CAPTCHA = ${ENABLE_CAPTCHA} +DEFAULT_KEEP_EMAIL_PRIVATE = true +DEFAULT_ALLOW_CREATE_ORGANIZATION = true +DEFAULT_ENABLE_TIMETRACKING = true +NO_REPLY_ADDRESS = ${NO_REPLY_ADDRESS} + +[oauth2] +JWT_SECRET = ${JWT_SECRET} + +[mailer] +ENABLED = true +FROM = ${MAIL_FROM} +USER = ${SMTP_USER} +PASSWD = ${SMTP_PASSWD} +PROTOCOL = ${SMTP_PROTOCOL} +SMTP_ADDR = ${SMTP_HOST} +SMTP_PORT = ${SMTP_PORT} + +[openid] +ENABLE_OPENID_SIGNIN = true +ENABLE_OPENID_SIGNUP = false diff --git a/terraform/modules/apps/gitea/variables.tf b/terraform/modules/apps/gitea/variables.tf index 99ef261..f4e497d 100644 --- a/terraform/modules/apps/gitea/variables.tf +++ b/terraform/modules/apps/gitea/variables.tf @@ -23,12 +23,6 @@ variable "backup_cron_schedule" { type = string } -variable "db_password" { - description = "The password for the Gitea MySQL database" - type = string - sensitive = true -} - variable "db_root_password" { description = "The root password for the MySQL database" type = string @@ -46,34 +40,49 @@ variable "fqdn" { type = string } -variable "app_name" { - description = "The name of the application" - type = string + +variable "tls_enabled" { + description = "Enable TLS for the SFTPGo server" + type = bool + default = true } -variable "smtp_host" { - description = "The SMTP relay host" +variable "issuer" { + description = "The issuer for the certificate" type = string + default = "internal-ca" } -variable "smtp_port" { - description = "The SMTP relay port" - type = number -} - -variable "smtp_username" { - description = "The SMTP relay username" - type = string - sensitive = true -} - -variable "smtp_password" { - description = "The SMTP relay password" - type = string - sensitive = true -} - -variable "from_email" { - description = "The email address to use as the sender" - type = string +variable "app_config" { + description = "The configuration for the SFTPGo server" + type = object({ + app_name = string + domain = string + lfs_jwt_secret = string + db_passwd = string + jwt_secret = string + mail_from = string + no_reply_address = string + smtp_user = string + smtp_passwd = string + smtp_host = string + secret_key = string + internal_token = string + disable_registration = optional(bool, true) + require_signin_view = optional(bool, false) + register_email_confirm = optional(bool, false) + enable_notify_mail = optional(bool, true) + allow_only_external_registration = optional(bool, false) + enable_captcha = optional(bool, true) + run_mode = optional(string, "prod") + http_port = optional(string, "3000") + disable_ssh = optional(bool, false) + ssh_port = optional(number, 22) + db_host = optional(string, "mariadb") + db_port = optional(string, "3306") + db_name = optional(string, "gitea") + db_user = optional(string, "gitea") + smtp_protocol = optional(string, "SMTPS") + smtp_port = optional(string, "587") + }) } diff --git a/terraform/modules/db/mariadb/main.tf b/terraform/modules/db/mariadb/main.tf index 467d414..a8e09cc 100644 --- a/terraform/modules/db/mariadb/main.tf +++ b/terraform/modules/db/mariadb/main.tf @@ -10,6 +10,37 @@ resource "kubernetes_secret" "root_password" { type = "Opaque" } +resource "kubernetes_manifest" "internal_cert" { + count = var.tls_enabled ? 1 : 0 + manifest = { + apiVersion = "cert-manager.io/v1" + kind = "Certificate" + metadata = { + name = "mariadb-cert" + namespace = var.namespace + } + spec = { + secretName = "mariadb-cert" + issuerRef = { + name = var.issuer + kind = "ClusterIssuer" + } + commonName = "${var.app_name}-db-cert" + } + } +} + +resource "kubernetes_config_map" "ssl_config" { + count = var.tls_enabled ? 1 : 0 + metadata { + name = "${var.app_name}-mariadb-config" + namespace = var.namespace + } + data = { + "tls.cnf" = file("${path.module}/resources/tls.cnf") + } +} + resource "kubernetes_service_account" "service_account" { metadata { @@ -94,7 +125,7 @@ resource "kubernetes_deployment" "deployment" { exec { command = ["sh", "-c", "mysqladmin status -uroot -p$MARIADB_ROOT_PASSWORD"] } - initial_delay_seconds = 120 + initial_delay_seconds = 30 period_seconds = 10 timeout_seconds = 1 failure_threshold = 15 @@ -147,6 +178,23 @@ resource "kubernetes_deployment" "deployment" { mount_path = "/docker-entrypoint-initdb.d" name = "initdb-storage" } + dynamic "volume_mount" { + for_each = var.tls_enabled ? [1] : [] + content { + mount_path = "/etc/ssl/certs/private" + name = "mariadb-cert" + read_only = true + } + } + dynamic "volume_mount" { + for_each = var.tls_enabled ? [1] : [] + content { + mount_path = "/etc/mysql/conf.d/tls.cnf" + name = "ssl-config" + sub_path = "tls.cnf" + read_only = true + } + } } volume { name = "persistent-storage" @@ -160,6 +208,32 @@ resource "kubernetes_deployment" "deployment" { path = "${var.database_folder}/${var.app_name}.initdb.d" } } + dynamic "volume" { + for_each = var.tls_enabled ? [1] : [] + content { + name = "mariadb-cert" + secret { + secret_name = kubernetes_manifest.internal_cert[0].manifest["metadata"]["name"] + items { + key = "tls.crt" + path = "tls.crt" + } + items { + key = "tls.key" + path = "tls.key" + } + } + } + } + dynamic "volume" { + for_each = var.tls_enabled ? [1] : [] + content { + name = "ssl-config" + config_map { + name = kubernetes_config_map.ssl_config[0].metadata[0].name + } + } + } } } } diff --git a/terraform/modules/db/mariadb/resources/tls.cnf b/terraform/modules/db/mariadb/resources/tls.cnf new file mode 100644 index 0000000..a519c0d --- /dev/null +++ b/terraform/modules/db/mariadb/resources/tls.cnf @@ -0,0 +1,4 @@ +[mysqld] +ssl-cert = /etc/ssl/certs/private/tls.crt +ssl-key = /etc/ssl/certs/private/tls.key +tls-version = TLSv1.2,TLSv1.3 \ No newline at end of file diff --git a/terraform/modules/db/mariadb/variables.tf b/terraform/modules/db/mariadb/variables.tf index 9ea381e..6d9e518 100644 --- a/terraform/modules/db/mariadb/variables.tf +++ b/terraform/modules/db/mariadb/variables.tf @@ -49,3 +49,15 @@ variable "backup_folder" { description = "Backup source location" type = string } + +variable "tls_enabled" { + description = "Enable SSL for MariaDB" + default = false + type = bool +} + +variable "issuer" { + description = "Issuer for SSL certificate" + default = "internal-ca" + type = string +}