diff --git a/.github/workflows/actions-validate.yml b/.github/workflows/actions-validate.yml.disabled similarity index 100% rename from .github/workflows/actions-validate.yml rename to .github/workflows/actions-validate.yml.disabled diff --git a/.github/workflows/ansible-validate-on-pr.yml b/.github/workflows/ansible-validate-on-pr.yml.disabled similarity index 100% rename from .github/workflows/ansible-validate-on-pr.yml rename to .github/workflows/ansible-validate-on-pr.yml.disabled diff --git a/.github/workflows/ansible-validate-playbook-on-pr.yml b/.github/workflows/ansible-validate-playbook-on-pr.yml.disabled similarity index 100% rename from .github/workflows/ansible-validate-playbook-on-pr.yml rename to .github/workflows/ansible-validate-playbook-on-pr.yml.disabled diff --git a/.github/workflows/deploy-websites.yaml b/.github/workflows/deploy-websites.yaml.disabled similarity index 100% rename from .github/workflows/deploy-websites.yaml rename to .github/workflows/deploy-websites.yaml.disabled diff --git a/.github/workflows/terraform-k8sapps-apply.yml b/.github/workflows/terraform-apps-contabo-apply.yml.disabled similarity index 95% rename from .github/workflows/terraform-k8sapps-apply.yml rename to .github/workflows/terraform-apps-contabo-apply.yml.disabled index ec91101..a8fa169 100644 --- a/.github/workflows/terraform-k8sapps-apply.yml +++ b/.github/workflows/terraform-apps-contabo-apply.yml.disabled @@ -5,7 +5,7 @@ on: branches: - main paths: - - "terraform/k8sapps/**" + - "terraform/apps/contabo/**" jobs: iac-apply: runs-on: ubuntu-latest @@ -35,6 +35,7 @@ jobs: - name: Setup Kubernetes Environment uses: ./.github/actions/setup-k8s-env with: + host: prod-01.alexpires.me project-id: ${{ secrets.BW_PROJECT_ID }} organization-id: ${{ secrets.BW_ORGANIZATION_ID }} access-token: ${{ secrets.BW_ACCESS_TOKEN }} diff --git a/.github/workflows/terraform-k8sapps-validate.yml b/.github/workflows/terraform-apps-contabo-validate.yml.disabled similarity index 100% rename from .github/workflows/terraform-k8sapps-validate.yml rename to .github/workflows/terraform-apps-contabo-validate.yml.disabled diff --git a/.github/workflows/terraform-aws-iac-apply.yml b/.github/workflows/terraform-iac-aws-apply.yml.disabled similarity index 100% rename from .github/workflows/terraform-aws-iac-apply.yml rename to .github/workflows/terraform-iac-aws-apply.yml.disabled diff --git a/.github/workflows/terraform-aws-iac-validate-on-pr.yml b/.github/workflows/terraform-iac-aws-validate-on-pr.yml.disabled similarity index 100% rename from .github/workflows/terraform-aws-iac-validate-on-pr.yml rename to .github/workflows/terraform-iac-aws-validate-on-pr.yml.disabled diff --git a/.github/workflows/terraform-cloudns-iac-apply.yml b/.github/workflows/terraform-iac-cloudns-apply.yml.disabled similarity index 100% rename from .github/workflows/terraform-cloudns-iac-apply.yml rename to .github/workflows/terraform-iac-cloudns-apply.yml.disabled diff --git a/.github/workflows/terraform-cloudns-iac-validate-on-pr.yml b/.github/workflows/terraform-iac-cloudns-validate-on-pr.yml.disabled similarity index 100% rename from .github/workflows/terraform-cloudns-iac-validate-on-pr.yml rename to .github/workflows/terraform-iac-cloudns-validate-on-pr.yml.disabled diff --git a/.github/workflows/terraform-contabo-iac-apply.yml b/.github/workflows/terraform-iac-contabo-apply.yml.disabled similarity index 100% rename from .github/workflows/terraform-contabo-iac-apply.yml rename to .github/workflows/terraform-iac-contabo-apply.yml.disabled diff --git a/.github/workflows/terraform-contabo-iac-validate-on-pr.yml b/.github/workflows/terraform-iac-contabo-validate-on-pr.yml.disabled similarity index 100% rename from .github/workflows/terraform-contabo-iac-validate-on-pr.yml rename to .github/workflows/terraform-iac-contabo-validate-on-pr.yml.disabled diff --git a/.github/workflows/terraform-scaleway-iac-apply.yml b/.github/workflows/terraform-iac-scaleway-apply.yml.disabled similarity index 100% rename from .github/workflows/terraform-scaleway-iac-apply.yml rename to .github/workflows/terraform-iac-scaleway-apply.yml.disabled diff --git a/.github/workflows/terraform-scaleway-iac-validate-on-pr.yml b/.github/workflows/terraform-iac-scaleway-validate-on-pr.yml.disabled similarity index 100% rename from .github/workflows/terraform-scaleway-iac-validate-on-pr.yml rename to .github/workflows/terraform-iac-scaleway-validate-on-pr.yml.disabled diff --git a/ansible/files/dockerfiles/Dockerfile.mcp.gitea b/ansible/files/dockerfiles/Dockerfile.mcp.gitea deleted file mode 100644 index 5834d58..0000000 --- a/ansible/files/dockerfiles/Dockerfile.mcp.gitea +++ /dev/null @@ -1,26 +0,0 @@ -FROM python:3.11-slim -ARG MCP_VERSION=0.2.0 -ARG UID=1000 -ARG GID=1000 -RUN groupadd --system --gid ${GID} worker && \ - adduser --system --gid ${GID} --uid ${UID} --home /home/worker worker -ENV PATH=/home/worker/.local/bin:$PATH -WORKDIR /home/worker -# Super user custom actions -RUN apt-get update && apt-get install -y --no-install-recommends \ - curl \ - tar \ - && rm -rf /var/lib/apt/lists/* -RUN curl -L https://gitea.com/gitea/gitea-mcp/releases/download/v${MCP_VERSION}/gitea-mcp_Linux_x86_64.tar.gz \ - | tar -xz -C /usr/local/bin \ - && chmod +x /usr/local/bin/gitea-mcp -# End of super user custom actions -USER worker -RUN pip install mcpo uv -EXPOSE 8000 -# Worker custom actions -ENV GITEA_HOST="https://gitea.com" -ENV GITEA_INSECURE="false" -ENV GITEA_ACCESS_TOKEN="" -CMD ["uvx", "mcpo", "--host", "0.0.0.0", "--port", "8000", "--", "gitea-mcp"] -# End of worker custom actions \ No newline at end of file diff --git a/ansible/host_vars/dev-01.alexpires.dev.yml b/ansible/host_vars/dev-01.alexpires.dev.yml index 74e3012..f063bb5 100644 --- a/ansible/host_vars/dev-01.alexpires.dev.yml +++ b/ansible/host_vars/dev-01.alexpires.dev.yml @@ -32,8 +32,7 @@ sshd_max_auth_tries: 10 ufw_enable: true fw_allowed_ports: - { rule: "allow", port: "22", proto: "tcp" } - - { rule: "allow", port: "8000", proto: "tcp" } - - { rule: "allow", port: "8080", proto: "tcp" } + - { rule: "allow", port: "443", proto: "tcp" } ufw_outgoing_traffic: - 22 # SSH @@ -42,8 +41,13 @@ ufw_outgoing_traffic: - 123 # NTP - 443 # HTTPS - 853 # DNS over TLS - - 11434 # Ollama + - 10250 # Kubelet - 8880 # Kokoro-FastAPI + - 11434 # Ollama + - 16443 # Kubernetes API + - 4443 + - 9443 + - 995 # POP3S ufw_default_forward_policy: "ACCEPT" @@ -77,6 +81,18 @@ unattended_reboot_time: "04:30" duo_users: ["*", "!provision"] duo_api_hostname: api-7cda1654.duosecurity.com +# Kubernetes specific settings +microk8s_allowed_hosts: + - 10.19.4.0/24 + - 10.5.5.5 +microk8s_alt_names: "{{ hostname }}" + +# Let's encrypt issuer +microk8s_lets_encrypt_issuer: false +microk8s_encryption_secret: "{{ lookup('env', 'MICROK8S_ENCRYPTION_SECRET') }}" +microk8s_users: + - username: operator + enabled: true + # podman services settings -open_webui_home: "/srv/open-webui" -mcp_home: "/srv/mcp" +persistent_data: "/srv" diff --git a/ansible/playbook_podman_open_webui.yml b/ansible/playbook_podman_open_webui.yml index 71cb2a6..a2296bb 100644 --- a/ansible/playbook_podman_open_webui.yml +++ b/ansible/playbook_podman_open_webui.yml @@ -1,22 +1,24 @@ - name: Setup open-webui hosts: openwebui - vars: - podman_user: "{{ open_webui_user | default('openwebui') }}" - podman_group: "{{ open_webui_group | default('openwebui') }}" - podman_user_home: "{{ open_webui_home | default('/home/open-webui') }}" - podman_user_folders: - - data - pods: - - name: open-webui - repo: - image: ghcr.io/open-webui/open-webui - tag: main - ports: - - "0.0.0.0:{{ open_webui_port | default(8080) }}:8080/tcp" - volumes: - - "{{ open_webui_home }}/data:/app/backend/data:Z" tasks: - - name: Setup Pods - ansible.builtin.include_tasks: - file: tasks/podman.yml + - name: Set required facts + ansible.builtin.set_fact: + open_webui_home: "{{ persistent_data | default('/var/lib') }}/open_webui" + open_webui_user_id: 0 + open_webui_group_id: 0 + tags: always + + - name: Create required open_webui data folder + become: true + ansible.builtin.file: + state: directory + path: "{{ item }}" + mode: "0750" + owner: "{{ open_webui_user_id }}" + group: "{{ open_webui_group_id }}" + with_items: + - "{{ open_webui_home }}" + tags: + - tasks + - tasks::folders diff --git a/ansible/roles/microk8s/defaults/main.yml b/ansible/roles/microk8s/defaults/main.yml index 1b1571e..2a4dbfd 100644 --- a/ansible/roles/microk8s/defaults/main.yml +++ b/ansible/roles/microk8s/defaults/main.yml @@ -11,6 +11,7 @@ microk8s_metallb_version: 0.14.9 # certificate manager microk8s_issuer_email: webmaster@localhost.localdomain microk8s_certmgr_version: 1.14.5 +microk8s_lets_encrypt_issuer: true # microk8s specific microk8s_channel: "{{ microk8s_k8s_version }}/stable" @@ -39,4 +40,4 @@ microk8s_iac_user: "provision" microk8s_encryption_secret: "a13labs" microk8s_encryption_cfg: "/etc/microk8s_encryption.yaml" -microk8s_encryption_kms_socket: +microk8s_encryption_kms_socket: "" diff --git a/ansible/roles/microk8s/tasks/certmanager.yml b/ansible/roles/microk8s/tasks/certmanager.yml index 84f75ec..1a3fbbf 100644 --- a/ansible/roles/microk8s/tasks/certmanager.yml +++ b/ansible/roles/microk8s/tasks/certmanager.yml @@ -16,6 +16,7 @@ wait: true - name: CertManager | Register LetsEncrypt (prod) + when: microk8s_lets_encrypt_issuer is true environment: PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}" vars: @@ -46,6 +47,7 @@ class: public - name: CertManager | Register LetsEncrypt (staging) + when: microk8s_lets_encrypt_issuer is true environment: PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}" vars: diff --git a/ansible/roles/microk8s/templates/encryption-provider-config.yml.j2 b/ansible/roles/microk8s/templates/encryption-provider-config.yml.j2 index b96d5fc..7b91061 100644 --- a/ansible/roles/microk8s/templates/encryption-provider-config.yml.j2 +++ b/ansible/roles/microk8s/templates/encryption-provider-config.yml.j2 @@ -6,7 +6,7 @@ resources: - secrets - configmaps providers: -{% if microk8s_encryption_kms_socket is defined %} +{% if microk8s_encryption_kms_socket != "" %} - kms: apiVersion: v2 name: aws-encryption-provider diff --git a/inventory/hosts b/inventory/hosts index 6ff3ea5..aa38574 100644 --- a/inventory/hosts +++ b/inventory/hosts @@ -40,6 +40,7 @@ prod-01.alexpires.me [microk8s] prod-01.alexpires.me +dev-01.alexpires.dev [iac] prod-01.alexpires.me diff --git a/terraform/apps/dev-01/apps.tf b/terraform/apps/dev-01/apps.tf new file mode 100644 index 0000000..18264b6 --- /dev/null +++ b/terraform/apps/dev-01/apps.tf @@ -0,0 +1,6 @@ +module "open-webui" { + source = "../../modules/apps/open-webui" + + persistent_folder = local.persistent_folder + fqdn = local.open_webui_fqdn +} diff --git a/terraform/apps/dev-01/backend.tf b/terraform/apps/dev-01/backend.tf new file mode 100644 index 0000000..60f941a --- /dev/null +++ b/terraform/apps/dev-01/backend.tf @@ -0,0 +1,7 @@ +terraform { + backend "s3" { + bucket = "a13labs.infra.eu" + key = "apps.dev-01.core.infra.tfstate" + region = "eu-west-1" + } +} diff --git a/terraform/apps/dev-01/config.tf b/terraform/apps/dev-01/config.tf new file mode 100644 index 0000000..d2f9ba9 --- /dev/null +++ b/terraform/apps/dev-01/config.tf @@ -0,0 +1,9 @@ +locals { + + # storage + persistent_folder = "/srv" + + primary_domain = "alexpires.me" + open_webui_fqdn = "ai.${local.primary_domain}" + internal_issuer = "internal-ca" +} diff --git a/terraform/apps/dev-01/issuer.tf b/terraform/apps/dev-01/issuer.tf new file mode 100644 index 0000000..16a79f8 --- /dev/null +++ b/terraform/apps/dev-01/issuer.tf @@ -0,0 +1,56 @@ +resource "tls_private_key" "tls" { + algorithm = "ED25519" +} + +resource "tls_self_signed_cert" "tls" { + private_key_pem = tls_private_key.tls.private_key_pem + + subject { + common_name = "kube-ca" + organization = "Alexandre Pires, Portugal" + } + + validity_period_hours = 87600 + is_ca_certificate = true + + allowed_uses = [ + "cert_signing", + "key_encipherment", + "digital_signature", + "crl_signing" + ] +} + +resource "kubernetes_secret" "root_ca" { + metadata { + name = "root-ca" + namespace = "cert-manager" + } + data = { + "tls.crt" = tls_self_signed_cert.tls.cert_pem + "tls.key" = tls_private_key.tls.private_key_pem + } + + type = "kubernetes.io/tls" +} + +resource "kubernetes_manifest" "cluster_issuer" { + + manifest = { + apiVersion = "cert-manager.io/v1" + kind = "ClusterIssuer" + metadata = { + name = local.internal_issuer + annotations = { + "cert-manager.io/issuer-group" = "cert-manager.io" + "cert-manager.io/issuer-kind" = "Issuer" + "cert-manager.io/issuer-name" = local.internal_issuer + } + } + spec = { + ca = { + secretName = "root-ca" + } + } + } +} diff --git a/terraform/k8sapps/operator.tf b/terraform/apps/dev-01/operator.tf similarity index 99% rename from terraform/k8sapps/operator.tf rename to terraform/apps/dev-01/operator.tf index 6cb3bec..e367756 100644 --- a/terraform/k8sapps/operator.tf +++ b/terraform/apps/dev-01/operator.tf @@ -47,8 +47,6 @@ resource "kubernetes_cluster_role" "operator_maintenance_role" { verbs = ["get", "list", "watch", "create", "delete", "patch", "update"] } - - # Allow reading Pod logs rule { api_groups = [""] diff --git a/terraform/apps/dev-01/provider.tf b/terraform/apps/dev-01/provider.tf new file mode 100644 index 0000000..a9a1a17 --- /dev/null +++ b/terraform/apps/dev-01/provider.tf @@ -0,0 +1,20 @@ +terraform { + required_version = "~>1.8" + required_providers { + kubernetes = { + source = "hashicorp/kubernetes" + version = "2.36.0" + } + tls = { + source = "hashicorp/tls" + version = "4.0.5" + } + } +} + +provider "kubernetes" { + config_path = "~/.kube/config" + config_context = "microk8s-dev-01" + insecure = true +} + diff --git a/terraform/apps/dev-01/secrets.tf b/terraform/apps/dev-01/secrets.tf new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/terraform/apps/dev-01/secrets.tf @@ -0,0 +1 @@ + diff --git a/terraform/aws-iac/sectool.env b/terraform/apps/dev-01/sectool.env similarity index 100% rename from terraform/aws-iac/sectool.env rename to terraform/apps/dev-01/sectool.env diff --git a/terraform/apps/dev-01/variables.tf b/terraform/apps/dev-01/variables.tf new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/terraform/apps/dev-01/variables.tf @@ -0,0 +1 @@ + diff --git a/terraform/k8sapps/apps.tf b/terraform/apps/prod-01/apps.tf similarity index 91% rename from terraform/k8sapps/apps.tf rename to terraform/apps/prod-01/apps.tf index 34c4b15..6da7328 100644 --- a/terraform/k8sapps/apps.tf +++ b/terraform/apps/prod-01/apps.tf @@ -1,11 +1,11 @@ module "websites" { - source = "../modules/apps/nginx" + source = "../../modules/apps/nginx" persistent_folder = local.persistent_folder websites = local.websites } module "rustdesk" { - source = "../modules/apps/rustdesk" + source = "../../modules/apps/rustdesk" persistent_folder = local.persistent_folder fqdn = local.rustdesk_fqdn @@ -14,7 +14,7 @@ module "rustdesk" { } module "m3uproxy" { - source = "../modules/apps/m3uproxy" + source = "../../modules/apps/m3uproxy" persistent_folder = local.persistent_folder tag = local.m3uproxy_version @@ -36,7 +36,7 @@ module "m3uproxy" { } module "mail" { - source = "../modules/apps/mail" + source = "../../modules/apps/mail" persistent_folder = local.persistent_folder @@ -57,7 +57,7 @@ module "mail" { } module "gitea" { - source = "../modules/apps/gitea" + source = "../../modules/apps/gitea" persistent_folder = local.persistent_folder database_folder = local.database_folder @@ -94,7 +94,7 @@ module "gitea" { } module "sftpgo" { - source = "../modules/apps/sftpgo" + source = "../../modules/apps/sftpgo" persistent_folder = local.persistent_folder backup_folder = local.sftpgo_backup_path @@ -116,7 +116,7 @@ module "sftpgo" { } module "trivy" { - source = "../modules/utils/trivy" + source = "../../modules/utils/trivy" persistent_folder = local.persistent_folder cron_schedule = local.trivy_cronjob_schedule @@ -130,7 +130,7 @@ module "trivy" { } module "ssh_locker_web" { - source = "../modules/apps/ssh_locker_web" + source = "../../modules/apps/ssh_locker_web" duo_client_id = var.server_api_duo_client_id duo_client_secret = var.server_api_duo_client_secret @@ -141,7 +141,7 @@ module "ssh_locker_web" { } module "reverse_proxy" { - source = "../modules/apps/nginx-reverse-proxy" + source = "../../modules/apps/nginx-reverse-proxy" services = local.reverse_proxy_services wireguard_config = local.reverse_proxy_wireguard_config diff --git a/terraform/k8sapps/backend.tf b/terraform/apps/prod-01/backend.tf similarity index 100% rename from terraform/k8sapps/backend.tf rename to terraform/apps/prod-01/backend.tf diff --git a/terraform/k8sapps/backups.tf b/terraform/apps/prod-01/backups.tf similarity index 93% rename from terraform/k8sapps/backups.tf rename to terraform/apps/prod-01/backups.tf index f70567c..8bdd6e5 100644 --- a/terraform/k8sapps/backups.tf +++ b/terraform/apps/prod-01/backups.tf @@ -1,6 +1,6 @@ module "mail_backup" { - source = "../modules/utils/scw_rclone" + source = "../../modules/utils/scw_rclone" namespace = module.mail.namespace app_name = module.mail.app_name @@ -19,7 +19,7 @@ module "mail_backup" { } module "gitea_backup" { - source = "../modules/utils/scw_rclone" + source = "../../modules/utils/scw_rclone" namespace = module.gitea.namespace app_name = module.gitea.app_name @@ -39,7 +39,7 @@ module "gitea_backup" { module "sftpgo_backup" { - source = "../modules/utils/scw_rclone" + source = "../../modules/utils/scw_rclone" namespace = module.sftpgo.namespace app_name = module.sftpgo.app_name diff --git a/terraform/k8sapps/buckets.tf b/terraform/apps/prod-01/buckets.tf similarity index 100% rename from terraform/k8sapps/buckets.tf rename to terraform/apps/prod-01/buckets.tf diff --git a/terraform/k8sapps/config.tf b/terraform/apps/prod-01/config.tf similarity index 87% rename from terraform/k8sapps/config.tf rename to terraform/apps/prod-01/config.tf index f2fd799..b3606bf 100644 --- a/terraform/k8sapps/config.tf +++ b/terraform/apps/prod-01/config.tf @@ -98,21 +98,23 @@ locals { https_port = 8443 tls = true fqdn = ["ai.alexpires.me"] - upstream = "http://10.19.4.136:8080" + upstream = "https://10.19.4.136" locations = [ { path = "/ws/socket.io/" headers = { - "Upgrade" = "$http_upgrade" - "Connection" = "upgrade" + "Host" = "$host" + "X-Forwarded-For" = "$remote_addr" + "Upgrade" = "$http_upgrade" + "Connection" = "upgrade" } }, - { - private = true - path = "/tools/gitea" - upstream = "http://10.19.4.136:8000" - rewrite = "^/tools/gitea/(.*)$ /$1 break" - }, + # { + # private = true + # path = "/tools/gitea" + # upstream = "http://10.19.4.136:8000" + # rewrite = "^/tools/gitea/(.*)$ /$1 break" + # }, { private = true path = "/providers/ollama" @@ -121,6 +123,10 @@ locals { }, { path = "/" + headers = { + "Host" = "$host" + "X-Forwarded-For" = "$remote_addr" + } }, ] }, diff --git a/terraform/k8sapps/disabled/chronograf.tf.bak b/terraform/apps/prod-01/disabled/chronograf.tf.bak similarity index 100% rename from terraform/k8sapps/disabled/chronograf.tf.bak rename to terraform/apps/prod-01/disabled/chronograf.tf.bak diff --git a/terraform/k8sapps/disabled/collabora.tf.disabled b/terraform/apps/prod-01/disabled/collabora.tf.disabled similarity index 100% rename from terraform/k8sapps/disabled/collabora.tf.disabled rename to terraform/apps/prod-01/disabled/collabora.tf.disabled diff --git a/terraform/k8sapps/disabled/fluent_bit.tf.bak b/terraform/apps/prod-01/disabled/fluent_bit.tf.bak similarity index 100% rename from terraform/k8sapps/disabled/fluent_bit.tf.bak rename to terraform/apps/prod-01/disabled/fluent_bit.tf.bak diff --git a/terraform/k8sapps/disabled/influxdb.tf.bak b/terraform/apps/prod-01/disabled/influxdb.tf.bak similarity index 100% rename from terraform/k8sapps/disabled/influxdb.tf.bak rename to terraform/apps/prod-01/disabled/influxdb.tf.bak diff --git a/terraform/k8sapps/disabled/kapacitor.tf.bak b/terraform/apps/prod-01/disabled/kapacitor.tf.bak similarity index 100% rename from terraform/k8sapps/disabled/kapacitor.tf.bak rename to terraform/apps/prod-01/disabled/kapacitor.tf.bak diff --git a/terraform/k8sapps/disabled/monitoring.tf.bak b/terraform/apps/prod-01/disabled/monitoring.tf.bak similarity index 100% rename from terraform/k8sapps/disabled/monitoring.tf.bak rename to terraform/apps/prod-01/disabled/monitoring.tf.bak diff --git a/terraform/k8sapps/disabled/nextcloud.tf.bak b/terraform/apps/prod-01/disabled/nextcloud.tf.bak similarity index 100% rename from terraform/k8sapps/disabled/nextcloud.tf.bak rename to terraform/apps/prod-01/disabled/nextcloud.tf.bak diff --git a/terraform/k8sapps/disabled/resources/alexpires.me.conf b/terraform/apps/prod-01/disabled/resources/alexpires.me.conf similarity index 100% rename from terraform/k8sapps/disabled/resources/alexpires.me.conf rename to terraform/apps/prod-01/disabled/resources/alexpires.me.conf diff --git a/terraform/k8sapps/disabled/resources/apache2/99-compression.conf b/terraform/apps/prod-01/disabled/resources/apache2/99-compression.conf similarity index 100% rename from terraform/k8sapps/disabled/resources/apache2/99-compression.conf rename to terraform/apps/prod-01/disabled/resources/apache2/99-compression.conf diff --git a/terraform/k8sapps/disabled/resources/apache2/99-nextcloudworkers.conf b/terraform/apps/prod-01/disabled/resources/apache2/99-nextcloudworkers.conf similarity index 100% rename from terraform/k8sapps/disabled/resources/apache2/99-nextcloudworkers.conf rename to terraform/apps/prod-01/disabled/resources/apache2/99-nextcloudworkers.conf diff --git a/terraform/k8sapps/disabled/resources/chronograf/dashboards/1_host_compute_performance.dashboard b/terraform/apps/prod-01/disabled/resources/chronograf/dashboards/1_host_compute_performance.dashboard similarity index 100% rename from terraform/k8sapps/disabled/resources/chronograf/dashboards/1_host_compute_performance.dashboard rename to terraform/apps/prod-01/disabled/resources/chronograf/dashboards/1_host_compute_performance.dashboard diff --git a/terraform/k8sapps/disabled/resources/chronograf/dashboards/2_disk_capacity.dashboard b/terraform/apps/prod-01/disabled/resources/chronograf/dashboards/2_disk_capacity.dashboard similarity index 100% rename from terraform/k8sapps/disabled/resources/chronograf/dashboards/2_disk_capacity.dashboard rename to terraform/apps/prod-01/disabled/resources/chronograf/dashboards/2_disk_capacity.dashboard diff --git a/terraform/k8sapps/disabled/resources/chronograf/dashboards/3_system_metrics.dashboard.disabled b/terraform/apps/prod-01/disabled/resources/chronograf/dashboards/3_system_metrics.dashboard.disabled similarity index 100% rename from terraform/k8sapps/disabled/resources/chronograf/dashboards/3_system_metrics.dashboard.disabled rename to terraform/apps/prod-01/disabled/resources/chronograf/dashboards/3_system_metrics.dashboard.disabled diff --git a/terraform/k8sapps/disabled/resources/chronograf/dashboards/4_net_interface_metric_explorer.dashboard b/terraform/apps/prod-01/disabled/resources/chronograf/dashboards/4_net_interface_metric_explorer.dashboard similarity index 100% rename from terraform/k8sapps/disabled/resources/chronograf/dashboards/4_net_interface_metric_explorer.dashboard rename to terraform/apps/prod-01/disabled/resources/chronograf/dashboards/4_net_interface_metric_explorer.dashboard diff --git a/terraform/k8sapps/disabled/resources/chronograf/dashboards/5_net_interface_performance.dashboard b/terraform/apps/prod-01/disabled/resources/chronograf/dashboards/5_net_interface_performance.dashboard similarity index 100% rename from terraform/k8sapps/disabled/resources/chronograf/dashboards/5_net_interface_performance.dashboard rename to terraform/apps/prod-01/disabled/resources/chronograf/dashboards/5_net_interface_performance.dashboard diff --git a/terraform/k8sapps/disabled/resources/chronograf/default.org b/terraform/apps/prod-01/disabled/resources/chronograf/default.org similarity index 100% rename from terraform/k8sapps/disabled/resources/chronograf/default.org rename to terraform/apps/prod-01/disabled/resources/chronograf/default.org diff --git a/terraform/k8sapps/disabled/resources/chronograf/internal.kap b/terraform/apps/prod-01/disabled/resources/chronograf/internal.kap similarity index 100% rename from terraform/k8sapps/disabled/resources/chronograf/internal.kap rename to terraform/apps/prod-01/disabled/resources/chronograf/internal.kap diff --git a/terraform/k8sapps/disabled/resources/chronograf/internal.src b/terraform/apps/prod-01/disabled/resources/chronograf/internal.src similarity index 100% rename from terraform/k8sapps/disabled/resources/chronograf/internal.src rename to terraform/apps/prod-01/disabled/resources/chronograf/internal.src diff --git a/terraform/k8sapps/disabled/resources/collabora/coolwsd.xml b/terraform/apps/prod-01/disabled/resources/collabora/coolwsd.xml similarity index 100% rename from terraform/k8sapps/disabled/resources/collabora/coolwsd.xml rename to terraform/apps/prod-01/disabled/resources/collabora/coolwsd.xml diff --git a/terraform/k8sapps/disabled/resources/fluent-bit/fluent-bit.conf b/terraform/apps/prod-01/disabled/resources/fluent-bit/fluent-bit.conf similarity index 100% rename from terraform/k8sapps/disabled/resources/fluent-bit/fluent-bit.conf rename to terraform/apps/prod-01/disabled/resources/fluent-bit/fluent-bit.conf diff --git a/terraform/k8sapps/disabled/resources/fluent-bit/parsers.conf b/terraform/apps/prod-01/disabled/resources/fluent-bit/parsers.conf similarity index 100% rename from terraform/k8sapps/disabled/resources/fluent-bit/parsers.conf rename to terraform/apps/prod-01/disabled/resources/fluent-bit/parsers.conf diff --git a/terraform/k8sapps/disabled/resources/influxdb/init.iql b/terraform/apps/prod-01/disabled/resources/influxdb/init.iql similarity index 100% rename from terraform/k8sapps/disabled/resources/influxdb/init.iql rename to terraform/apps/prod-01/disabled/resources/influxdb/init.iql diff --git a/terraform/k8sapps/disabled/resources/nextcloud-server-snippet.conf b/terraform/apps/prod-01/disabled/resources/nextcloud-server-snippet.conf similarity index 100% rename from terraform/k8sapps/disabled/resources/nextcloud-server-snippet.conf rename to terraform/apps/prod-01/disabled/resources/nextcloud-server-snippet.conf diff --git a/terraform/k8sapps/disabled/resources/telegraf/telegraf.conf b/terraform/apps/prod-01/disabled/resources/telegraf/telegraf.conf similarity index 100% rename from terraform/k8sapps/disabled/resources/telegraf/telegraf.conf rename to terraform/apps/prod-01/disabled/resources/telegraf/telegraf.conf diff --git a/terraform/k8sapps/disabled/telegraf.tf.bak b/terraform/apps/prod-01/disabled/telegraf.tf.bak similarity index 100% rename from terraform/k8sapps/disabled/telegraf.tf.bak rename to terraform/apps/prod-01/disabled/telegraf.tf.bak diff --git a/terraform/k8sapps/iam.tf b/terraform/apps/prod-01/iam.tf similarity index 100% rename from terraform/k8sapps/iam.tf rename to terraform/apps/prod-01/iam.tf diff --git a/terraform/k8sapps/issuer.tf b/terraform/apps/prod-01/issuer.tf similarity index 100% rename from terraform/k8sapps/issuer.tf rename to terraform/apps/prod-01/issuer.tf diff --git a/terraform/apps/prod-01/operator.tf b/terraform/apps/prod-01/operator.tf new file mode 100644 index 0000000..e367756 --- /dev/null +++ b/terraform/apps/prod-01/operator.tf @@ -0,0 +1,129 @@ +resource "kubernetes_service_account" "operator_service_account" { + metadata { + name = "operator" + namespace = "default" + } +} + +resource "kubernetes_cluster_role" "operator_maintenance_role" { + metadata { + name = "operator-maintenance-role" + } + + # Allow managing Pods (create, delete, exec, restart) + rule { + api_groups = [""] + resources = ["pods"] + verbs = ["get", "list", "watch", "create", "delete", "patch", "update", "exec"] + } + + rule { + api_groups = [""] + resources = ["replicationcontrollers"] + verbs = ["get", "list"] + } + + rule { + api_groups = ["autoscaling"] + resources = ["horizontalpodautoscalers"] + verbs = ["get", "list", "watch"] + } + + rule { + api_groups = ["apps"] + resources = ["deployments", "replicasets", "statefulsets", "daemonsets"] + verbs = ["get", "list", "watch"] + } + + rule { + api_groups = ["batch"] + resources = ["cronjobs"] + verbs = ["get", "list", "watch"] + } + + rule { + api_groups = ["batch"] + resources = ["jobs"] + verbs = ["get", "list", "watch", "create", "delete", "patch", "update"] + } + + # Allow reading Pod logs + rule { + api_groups = [""] + resources = ["pods/log"] + verbs = ["get", "list"] + } + + # Allow managing Pod eviction for draining nodes, etc. + rule { + api_groups = ["policy"] + resources = ["pods/eviction"] + verbs = ["create"] + } + + # Allow reading Namespaces (usually required for multi-namespace tools) + rule { + api_groups = [""] + resources = ["namespaces"] + verbs = ["get", "list", "watch"] + } + + # Allow reading and managing PodDisruptionBudgets (useful for draining nodes) + rule { + api_groups = ["policy"] + resources = ["poddisruptionbudgets"] + verbs = ["get", "list", "watch", "patch", "update"] + } + + # Allow managing Nodes (e.g., for cordoning, draining) + rule { + api_groups = [""] + resources = ["nodes"] + verbs = ["get", "list", "patch", "update"] + } + + # Allow reading PersistentVolumeClaims (PVCs) but not PersistentVolumes + rule { + api_groups = [""] + resources = ["persistentvolumeclaims"] + verbs = ["get", "list", "watch"] + } + + # Allow listing and getting services and endpoints (but not updating) + rule { + api_groups = [""] + resources = ["services", "endpoints"] + verbs = ["get", "list", "watch"] + } +} + +resource "kubernetes_cluster_role_binding" "operator_maintenance_binding" { + metadata { + name = "operator-maintenance-binding" + } + + role_ref { + kind = "ClusterRole" + name = kubernetes_cluster_role.operator_maintenance_role.metadata[0].name + api_group = "rbac.authorization.k8s.io" + } + + subject { + kind = "ServiceAccount" + namespace = "default" + name = kubernetes_service_account.operator_service_account.metadata[0].name + } +} + +resource "kubernetes_secret" "operator_access_token" { + metadata { + annotations = { + "kubernetes.io/service-account.name" = kubernetes_service_account.operator_service_account.metadata[0].name + } + name = "operator-token" + namespace = "default" + } + + type = "kubernetes.io/service-account-token" + wait_for_service_account_token = true +} diff --git a/terraform/k8sapps/provider.tf b/terraform/apps/prod-01/provider.tf similarity index 95% rename from terraform/k8sapps/provider.tf rename to terraform/apps/prod-01/provider.tf index f25be10..a38af38 100644 --- a/terraform/k8sapps/provider.tf +++ b/terraform/apps/prod-01/provider.tf @@ -30,7 +30,7 @@ terraform { provider "kubernetes" { config_path = "~/.kube/config" - config_context = "microk8s" + config_context = "microk8s-prod-01" insecure = true } diff --git a/terraform/k8sapps/resources/alexpires.me.conf b/terraform/apps/prod-01/resources/alexpires.me.conf similarity index 100% rename from terraform/k8sapps/resources/alexpires.me.conf rename to terraform/apps/prod-01/resources/alexpires.me.conf diff --git a/terraform/k8sapps/secrets.tf b/terraform/apps/prod-01/secrets.tf similarity index 100% rename from terraform/k8sapps/secrets.tf rename to terraform/apps/prod-01/secrets.tf diff --git a/terraform/k8sapps/sectool.env b/terraform/apps/prod-01/sectool.env similarity index 100% rename from terraform/k8sapps/sectool.env rename to terraform/apps/prod-01/sectool.env diff --git a/terraform/k8sapps/variables.tf b/terraform/apps/prod-01/variables.tf similarity index 100% rename from terraform/k8sapps/variables.tf rename to terraform/apps/prod-01/variables.tf diff --git a/terraform/aws-iac/backend.tf b/terraform/iac/aws/backend.tf similarity index 100% rename from terraform/aws-iac/backend.tf rename to terraform/iac/aws/backend.tf diff --git a/terraform/aws-iac/billing.tf b/terraform/iac/aws/billing.tf similarity index 100% rename from terraform/aws-iac/billing.tf rename to terraform/iac/aws/billing.tf diff --git a/terraform/aws-iac/buckets.tf b/terraform/iac/aws/buckets.tf similarity index 100% rename from terraform/aws-iac/buckets.tf rename to terraform/iac/aws/buckets.tf diff --git a/terraform/aws-iac/config.tf b/terraform/iac/aws/config.tf similarity index 100% rename from terraform/aws-iac/config.tf rename to terraform/iac/aws/config.tf diff --git a/terraform/aws-iac/kms.tf b/terraform/iac/aws/kms.tf similarity index 100% rename from terraform/aws-iac/kms.tf rename to terraform/iac/aws/kms.tf diff --git a/terraform/aws-iac/provider.tf b/terraform/iac/aws/provider.tf similarity index 100% rename from terraform/aws-iac/provider.tf rename to terraform/iac/aws/provider.tf diff --git a/terraform/aws-iac/scripts/sns_subscription.sh b/terraform/iac/aws/scripts/sns_subscription.sh similarity index 100% rename from terraform/aws-iac/scripts/sns_subscription.sh rename to terraform/iac/aws/scripts/sns_subscription.sh diff --git a/terraform/iac/aws/sectool.env b/terraform/iac/aws/sectool.env new file mode 100644 index 0000000..865ddf9 --- /dev/null +++ b/terraform/iac/aws/sectool.env @@ -0,0 +1,2 @@ +AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY +AWS_SECRET_ACCESS_KEY=$AWS_SECRET_KEY diff --git a/terraform/aws-iac/variables.tf b/terraform/iac/aws/variables.tf similarity index 100% rename from terraform/aws-iac/variables.tf rename to terraform/iac/aws/variables.tf diff --git a/terraform/cloudns-iac/backend.tf b/terraform/iac/cloudns/backend.tf similarity index 100% rename from terraform/cloudns-iac/backend.tf rename to terraform/iac/cloudns/backend.tf diff --git a/terraform/cloudns-iac/config.tf b/terraform/iac/cloudns/config.tf similarity index 100% rename from terraform/cloudns-iac/config.tf rename to terraform/iac/cloudns/config.tf diff --git a/terraform/cloudns-iac/provider.tf b/terraform/iac/cloudns/provider.tf similarity index 100% rename from terraform/cloudns-iac/provider.tf rename to terraform/iac/cloudns/provider.tf diff --git a/terraform/cloudns-iac/records.tf b/terraform/iac/cloudns/records.tf similarity index 100% rename from terraform/cloudns-iac/records.tf rename to terraform/iac/cloudns/records.tf diff --git a/terraform/cloudns-iac/sectool.env b/terraform/iac/cloudns/sectool.env similarity index 100% rename from terraform/cloudns-iac/sectool.env rename to terraform/iac/cloudns/sectool.env diff --git a/terraform/cloudns-iac/variables.tf b/terraform/iac/cloudns/variables.tf similarity index 100% rename from terraform/cloudns-iac/variables.tf rename to terraform/iac/cloudns/variables.tf diff --git a/terraform/contabo-iac/backend.tf b/terraform/iac/contabo/backend.tf similarity index 100% rename from terraform/contabo-iac/backend.tf rename to terraform/iac/contabo/backend.tf diff --git a/terraform/contabo-iac/contabo.tf b/terraform/iac/contabo/contabo.tf similarity index 100% rename from terraform/contabo-iac/contabo.tf rename to terraform/iac/contabo/contabo.tf diff --git a/terraform/contabo-iac/outputs.tf b/terraform/iac/contabo/outputs.tf similarity index 100% rename from terraform/contabo-iac/outputs.tf rename to terraform/iac/contabo/outputs.tf diff --git a/terraform/contabo-iac/provider.tf b/terraform/iac/contabo/provider.tf similarity index 100% rename from terraform/contabo-iac/provider.tf rename to terraform/iac/contabo/provider.tf diff --git a/terraform/contabo-iac/sectool.env b/terraform/iac/contabo/sectool.env similarity index 100% rename from terraform/contabo-iac/sectool.env rename to terraform/iac/contabo/sectool.env diff --git a/terraform/contabo-iac/variables.tf b/terraform/iac/contabo/variables.tf similarity index 100% rename from terraform/contabo-iac/variables.tf rename to terraform/iac/contabo/variables.tf diff --git a/terraform/scaleway-iac/backend.tf b/terraform/iac/scaleway/backend.tf similarity index 100% rename from terraform/scaleway-iac/backend.tf rename to terraform/iac/scaleway/backend.tf diff --git a/terraform/scaleway-iac/buckets.tf b/terraform/iac/scaleway/buckets.tf similarity index 100% rename from terraform/scaleway-iac/buckets.tf rename to terraform/iac/scaleway/buckets.tf diff --git a/terraform/scaleway-iac/config.tf b/terraform/iac/scaleway/config.tf similarity index 100% rename from terraform/scaleway-iac/config.tf rename to terraform/iac/scaleway/config.tf diff --git a/terraform/scaleway-iac/encryption.tf b/terraform/iac/scaleway/encryption.tf similarity index 100% rename from terraform/scaleway-iac/encryption.tf rename to terraform/iac/scaleway/encryption.tf diff --git a/terraform/scaleway-iac/provider.tf b/terraform/iac/scaleway/provider.tf similarity index 100% rename from terraform/scaleway-iac/provider.tf rename to terraform/iac/scaleway/provider.tf diff --git a/terraform/scaleway-iac/registry.tf b/terraform/iac/scaleway/registry.tf similarity index 100% rename from terraform/scaleway-iac/registry.tf rename to terraform/iac/scaleway/registry.tf diff --git a/terraform/scaleway-iac/sectool.env b/terraform/iac/scaleway/sectool.env similarity index 100% rename from terraform/scaleway-iac/sectool.env rename to terraform/iac/scaleway/sectool.env diff --git a/terraform/scaleway-iac/variables.tf b/terraform/iac/scaleway/variables.tf similarity index 100% rename from terraform/scaleway-iac/variables.tf rename to terraform/iac/scaleway/variables.tf diff --git a/terraform/modules/apps/m3uproxy/main.tf b/terraform/modules/apps/m3uproxy/main.tf index 0dab911..a0bde48 100644 --- a/terraform/modules/apps/m3uproxy/main.tf +++ b/terraform/modules/apps/m3uproxy/main.tf @@ -102,6 +102,7 @@ resource "kubernetes_deployment" "m3uproxy" { container_port = 8080 name = "http" } + readiness_probe { http_get { path = "/health" @@ -111,6 +112,7 @@ resource "kubernetes_deployment" "m3uproxy" { period_seconds = 10 failure_threshold = 10 } + env { name = "USERNAME" value_from { @@ -120,6 +122,7 @@ resource "kubernetes_deployment" "m3uproxy" { } } } + env { name = "PASSWORD" value_from { @@ -129,11 +132,13 @@ resource "kubernetes_deployment" "m3uproxy" { } } } + security_context { allow_privilege_escalation = false run_as_user = 1000 run_as_group = 1000 } + volume_mount { name = "m3uproxy-config" mount_path = "/app/conf/m3uproxy.json" diff --git a/terraform/modules/apps/nginx-reverse-proxy/main.tf b/terraform/modules/apps/nginx-reverse-proxy/main.tf index 2073782..08b3eec 100644 --- a/terraform/modules/apps/nginx-reverse-proxy/main.tf +++ b/terraform/modules/apps/nginx-reverse-proxy/main.tf @@ -322,6 +322,9 @@ resource "kubernetes_deployment" "reverse_proxy" { } initial_delay_seconds = 5 period_seconds = 10 + failure_threshold = 10 + timeout_seconds = 5 + success_threshold = 1 } security_context { diff --git a/terraform/modules/apps/open-webui/config.tf b/terraform/modules/apps/open-webui/config.tf new file mode 100644 index 0000000..2e1f547 --- /dev/null +++ b/terraform/modules/apps/open-webui/config.tf @@ -0,0 +1,8 @@ +locals { + persistent_folder = var.persistent_folder + app_path = "${local.persistent_folder}/open-webui" + + app_version = var.tag + app_fqdn = var.fqdn +} + diff --git a/terraform/modules/apps/open-webui/main.tf b/terraform/modules/apps/open-webui/main.tf new file mode 100644 index 0000000..005f5d1 --- /dev/null +++ b/terraform/modules/apps/open-webui/main.tf @@ -0,0 +1,167 @@ +resource "kubernetes_namespace" "openwebui" { + metadata { + name = "openwebui" + } +} + +resource "kubernetes_service_account" "openwebui" { + + metadata { + name = "openwebui-sa" + namespace = kubernetes_namespace.openwebui.metadata[0].name + } + + automount_service_account_token = false +} + +resource "kubernetes_manifest" "internal_cert" { + + manifest = { + apiVersion = "cert-manager.io/v1" + kind = "Certificate" + metadata = { + name = "internal-cert" + namespace = kubernetes_namespace.openwebui.metadata[0].name + } + spec = { + secretName = "internal-cert" + issuerRef = { + name = var.issuer + kind = "ClusterIssuer" + } + commonName = var.fqdn + dnsNames = [var.fqdn] + } + } +} + +resource "kubernetes_deployment" "openwebui" { + metadata { + name = "openwebui" + namespace = kubernetes_namespace.openwebui.metadata[0].name + labels = { + openwebui = "openwebui" + } + } + + spec { + replicas = 1 + + selector { + match_labels = { + openwebui = "openwebui" + } + } + + strategy { + type = "Recreate" + } + + template { + metadata { + labels = { + openwebui = "openwebui" + } + } + + spec { + service_account_name = kubernetes_service_account.openwebui.metadata[0].name + automount_service_account_token = false + + container { + name = "openwebui-container" + image = "ghcr.io/open-webui/open-webui:${local.app_version}" + + security_context { + allow_privilege_escalation = false + } + + port { + name = "http" + container_port = 8080 + } + + readiness_probe { + tcp_socket { + port = 8080 + } + initial_delay_seconds = 5 + period_seconds = 10 + failure_threshold = 10 + } + + volume_mount { + name = "openwebui-data" + mount_path = "/app/backend/data" + } + } + + volume { + name = "openwebui-data" + host_path { + path = local.app_path + } + } + } + } + } +} + +resource "kubernetes_service" "openwebui" { + metadata { + name = "http" + namespace = kubernetes_namespace.openwebui.metadata[0].name + } + + spec { + selector = { + openwebui = "openwebui" + } + + port { + name = "http" + port = 8080 + target_port = 8080 + } + + cluster_ip = "None" + } + + lifecycle { + ignore_changes = [ + metadata[0].annotations + ] + } +} + +resource "kubernetes_ingress_v1" "openwebui" { + metadata { + name = "ingress" + namespace = kubernetes_namespace.openwebui.metadata[0].name + + annotations = { + "nginx.ingress.kubernetes.io/ssl-redirect" = "true" + } + } + spec { + tls { + hosts = [local.app_fqdn] + secret_name = "internal-cert" + } + rule { + host = local.app_fqdn + http { + path { + backend { + service { + name = "http" + port { + number = 8080 + } + } + } + } + } + } + } +} diff --git a/terraform/modules/apps/open-webui/provider.tf b/terraform/modules/apps/open-webui/provider.tf new file mode 100644 index 0000000..2eaa508 --- /dev/null +++ b/terraform/modules/apps/open-webui/provider.tf @@ -0,0 +1,9 @@ +terraform { + required_version = "~>1.8" + required_providers { + kubernetes = { + source = "hashicorp/kubernetes" + version = "2.36.0" + } + } +} diff --git a/terraform/modules/apps/open-webui/variables.tf b/terraform/modules/apps/open-webui/variables.tf new file mode 100644 index 0000000..00189d8 --- /dev/null +++ b/terraform/modules/apps/open-webui/variables.tf @@ -0,0 +1,22 @@ +variable "persistent_folder" { + description = "The path to the persistent folder" + type = string +} + +variable "fqdn" { + description = "The fully qualified domain name for the app server" + type = string +} + +variable "tag" { + description = "The version of app to install" + type = string + default = "main" +} + +variable "issuer" { + description = "The issuer for the certificate" + type = string + default = "internal-ca" +} + diff --git a/terraform/modules/apps/template/config.tf b/terraform/modules/apps/template/config.tf new file mode 100644 index 0000000..9777605 --- /dev/null +++ b/terraform/modules/apps/template/config.tf @@ -0,0 +1,8 @@ +locals { + persistent_folder = var.persistent_folder + app_path = "${local.persistent_folder}/app" + + app_version = var.tag + app_fqdn = var.fqdn +} + diff --git a/terraform/modules/apps/template/main.tf b/terraform/modules/apps/template/main.tf new file mode 100644 index 0000000..7cd54a6 --- /dev/null +++ b/terraform/modules/apps/template/main.tf @@ -0,0 +1,160 @@ +resource "kubernetes_namespace" "app" { + metadata { + name = "app" + } +} + +resource "kubernetes_service_account" "app" { + + metadata { + name = "app-sa" + namespace = kubernetes_namespace.app.metadata[0].name + } + + automount_service_account_token = false +} + +resource "kubernetes_config_map" "app_config" { + metadata { + name = "app-config" + namespace = kubernetes_namespace.app.metadata[0].name + } + + data = {} +} + +resource "kubernetes_secret" "app_secrets" { + metadata { + name = "app-keys" + namespace = kubernetes_namespace.app.metadata[0].name + } + + data = {} +} + +resource "kubernetes_deployment" "app" { + metadata { + name = "app" + namespace = kubernetes_namespace.app.metadata[0].name + labels = { + app = "app" + } + } + + spec { + replicas = 1 + + selector { + match_labels = { + app = "app" + } + } + + strategy { + type = "Recreate" + } + + template { + metadata { + labels = { + app = "app" + } + } + + spec { + service_account_name = kubernetes_service_account.app.metadata[0].name + automount_service_account_token = false + + container { + name = "app-container" + image = "app/app-server-s6:${local.app_version}" + + env_from { + config_map_ref { + name = kubernetes_config_map.app_config.metadata[0].name + } + } + + security_context { + allow_privilege_escalation = false + } + + port { + name = "app-port-1" + container_port = 21115 + host_port = 21115 + protocol = "TCP" + } + + + volume_mount { + name = "app-data" + mount_path = "/data" + } + + volume_mount { + name = "app-secrets" + mount_path = "/data/secrets" + read_only = true + } + + volume_mount { + name = "app-config" + mount_path = "/data/config" + read_only = true + } + } + + volume { + name = "app-data" + host_path { + path = local.app_path + } + } + + volume { + name = "app-secrets" + secret { + secret_name = kubernetes_secret.app_secrets.metadata[0].name + } + } + + volume { + name = "app-config" + config_map { + name = kubernetes_config_map.app_config.metadata[0].name + } + } + + } + } + } +} + +resource "kubernetes_service" "app" { + metadata { + name = "app-ports" + namespace = kubernetes_namespace.app.metadata[0].name + } + + spec { + selector = { + app = "app" + } + + port { + name = "app-port-1" + port = 21115 + target_port = 21115 + } + + cluster_ip = "None" + } + + lifecycle { + ignore_changes = [ + metadata[0].annotations + ] + } + +} diff --git a/terraform/modules/apps/template/provider.tf b/terraform/modules/apps/template/provider.tf new file mode 100644 index 0000000..2eaa508 --- /dev/null +++ b/terraform/modules/apps/template/provider.tf @@ -0,0 +1,9 @@ +terraform { + required_version = "~>1.8" + required_providers { + kubernetes = { + source = "hashicorp/kubernetes" + version = "2.36.0" + } + } +} diff --git a/terraform/modules/apps/template/variables.tf b/terraform/modules/apps/template/variables.tf new file mode 100644 index 0000000..4ee313b --- /dev/null +++ b/terraform/modules/apps/template/variables.tf @@ -0,0 +1,15 @@ +variable "persistent_folder" { + description = "The path to the persistent folder" + type = string +} + +variable "fqdn" { + description = "The fully qualified domain name for the app server" + type = string +} + +variable "tag" { + description = "The version of app to install" + type = string + default = "latest" +}