Major changes

terraform/apps/dev-01/apps.tf

@@ -0,0 +1,6 @@
+module "open-webui" {
+  source = "../../modules/apps/open-webui"
+
+  persistent_folder = local.persistent_folder
+  fqdn              = local.open_webui_fqdn
+}

terraform/apps/dev-01/backend.tf

@@ -0,0 +1,7 @@
+terraform {
+  backend "s3" {
+    bucket = "a13labs.infra.eu"
+    key    = "apps.dev-01.core.infra.tfstate"
+    region = "eu-west-1"
+  }
+}

terraform/apps/dev-01/config.tf

@@ -0,0 +1,9 @@
+locals {
+
+  # storage
+  persistent_folder = "/srv"
+
+  primary_domain  = "alexpires.me"
+  open_webui_fqdn = "ai.${local.primary_domain}"
+  internal_issuer = "internal-ca"
+}

terraform/apps/dev-01/issuer.tf

@@ -0,0 +1,56 @@
+resource "tls_private_key" "tls" {
+  algorithm = "ED25519"
+}
+
+resource "tls_self_signed_cert" "tls" {
+  private_key_pem = tls_private_key.tls.private_key_pem
+
+  subject {
+    common_name  = "kube-ca"
+    organization = "Alexandre Pires, Portugal"
+  }
+
+  validity_period_hours = 87600
+  is_ca_certificate     = true
+
+  allowed_uses = [
+    "cert_signing",
+    "key_encipherment",
+    "digital_signature",
+    "crl_signing"
+  ]
+}
+
+resource "kubernetes_secret" "root_ca" {
+  metadata {
+    name      = "root-ca"
+    namespace = "cert-manager"
+  }
+  data = {
+    "tls.crt" = tls_self_signed_cert.tls.cert_pem
+    "tls.key" = tls_private_key.tls.private_key_pem
+  }
+
+  type = "kubernetes.io/tls"
+}
+
+resource "kubernetes_manifest" "cluster_issuer" {
+
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "ClusterIssuer"
+    metadata = {
+      name = local.internal_issuer
+      annotations = {
+        "cert-manager.io/issuer-group" = "cert-manager.io"
+        "cert-manager.io/issuer-kind"  = "Issuer"
+        "cert-manager.io/issuer-name"  = local.internal_issuer
+      }
+    }
+    spec = {
+      ca = {
+        secretName = "root-ca"
+      }
+    }
+  }
+}

terraform/apps/dev-01/operator.tf

@@ -47,8 +47,6 @@ resource "kubernetes_cluster_role" "operator_maintenance_role" {
     verbs      = ["get", "list", "watch", "create", "delete", "patch", "update"]
   }
 
-
-
   # Allow reading Pod logs
   rule {
     api_groups = [""]

terraform/apps/dev-01/provider.tf

@@ -0,0 +1,20 @@
+terraform {
+  required_version = "~>1.8"
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "2.36.0"
+    }
+    tls = {
+      source  = "hashicorp/tls"
+      version = "4.0.5"
+    }
+  }
+}
+
+provider "kubernetes" {
+  config_path    = "~/.kube/config"
+  config_context = "microk8s-dev-01"
+  insecure       = true
+}
+

terraform/apps/dev-01/secrets.tf

@@ -0,0 +1 @@
+

terraform/apps/dev-01/variables.tf

@@ -0,0 +1 @@
+

terraform/apps/prod-01/apps.tf

@@ -1,11 +1,11 @@
 module "websites" {
-  source            = "../modules/apps/nginx"
+  source            = "../../modules/apps/nginx"
   persistent_folder = local.persistent_folder
   websites          = local.websites
 }
 
 module "rustdesk" {
-  source = "../modules/apps/rustdesk"
+  source = "../../modules/apps/rustdesk"
 
   persistent_folder = local.persistent_folder
   fqdn              = local.rustdesk_fqdn
@@ -14,7 +14,7 @@ module "rustdesk" {
 }
 
 module "m3uproxy" {
-  source = "../modules/apps/m3uproxy"
+  source = "../../modules/apps/m3uproxy"
 
   persistent_folder = local.persistent_folder
   tag               = local.m3uproxy_version
@@ -36,7 +36,7 @@ module "m3uproxy" {
 }
 
 module "mail" {
-  source = "../modules/apps/mail"
+  source = "../../modules/apps/mail"
 
   persistent_folder = local.persistent_folder
 
@@ -57,7 +57,7 @@ module "mail" {
 }
 
 module "gitea" {
-  source = "../modules/apps/gitea"
+  source = "../../modules/apps/gitea"
 
   persistent_folder = local.persistent_folder
   database_folder   = local.database_folder
@@ -94,7 +94,7 @@ module "gitea" {
 }
 
 module "sftpgo" {
-  source = "../modules/apps/sftpgo"
+  source = "../../modules/apps/sftpgo"
 
   persistent_folder = local.persistent_folder
   backup_folder     = local.sftpgo_backup_path
@@ -116,7 +116,7 @@ module "sftpgo" {
 }
 
 module "trivy" {
-  source = "../modules/utils/trivy"
+  source = "../../modules/utils/trivy"
 
   persistent_folder = local.persistent_folder
   cron_schedule     = local.trivy_cronjob_schedule
@@ -130,7 +130,7 @@ module "trivy" {
 }
 
 module "ssh_locker_web" {
-  source = "../modules/apps/ssh_locker_web"
+  source = "../../modules/apps/ssh_locker_web"
 
   duo_client_id     = var.server_api_duo_client_id
   duo_client_secret = var.server_api_duo_client_secret
@@ -141,7 +141,7 @@ module "ssh_locker_web" {
 }
 
 module "reverse_proxy" {
-  source = "../modules/apps/nginx-reverse-proxy"
+  source = "../../modules/apps/nginx-reverse-proxy"
 
   services         = local.reverse_proxy_services
   wireguard_config = local.reverse_proxy_wireguard_config

terraform/apps/prod-01/backups.tf

@@ -1,6 +1,6 @@
 module "mail_backup" {
 
-  source = "../modules/utils/scw_rclone"
+  source = "../../modules/utils/scw_rclone"
 
   namespace = module.mail.namespace
   app_name  = module.mail.app_name
@@ -19,7 +19,7 @@ module "mail_backup" {
 }
 
 module "gitea_backup" {
-  source = "../modules/utils/scw_rclone"
+  source = "../../modules/utils/scw_rclone"
 
   namespace = module.gitea.namespace
   app_name  = module.gitea.app_name
@@ -39,7 +39,7 @@ module "gitea_backup" {
 
 module "sftpgo_backup" {
 
-  source = "../modules/utils/scw_rclone"
+  source = "../../modules/utils/scw_rclone"
 
   namespace = module.sftpgo.namespace
   app_name  = module.sftpgo.app_name

terraform/apps/prod-01/config.tf

@@ -98,21 +98,23 @@ locals {
       https_port = 8443
       tls        = true
       fqdn       = ["ai.alexpires.me"]
-      upstream   = "http://10.19.4.136:8080"
+      upstream   = "https://10.19.4.136"
       locations = [
         {
           path = "/ws/socket.io/"
           headers = {
-            "Upgrade"    = "$http_upgrade"
-            "Connection" = "upgrade"
+            "Host"            = "$host"
+            "X-Forwarded-For" = "$remote_addr"
+            "Upgrade"         = "$http_upgrade"
+            "Connection"      = "upgrade"
           }
         },
-        {
-          private  = true
-          path     = "/tools/gitea"
-          upstream = "http://10.19.4.136:8000"
-          rewrite  = "^/tools/gitea/(.*)$ /$1 break"
-        },
+        # {
+        #   private  = true
+        #   path     = "/tools/gitea"
+        #   upstream = "http://10.19.4.136:8000"
+        #   rewrite  = "^/tools/gitea/(.*)$ /$1 break"
+        # },
         {
           private  = true
           path     = "/providers/ollama"
@@ -121,6 +123,10 @@ locals {
         },
         {
           path = "/"
+          headers = {
+            "Host"            = "$host"
+            "X-Forwarded-For" = "$remote_addr"
+          }
         },
       ]
     },

terraform/apps/prod-01/operator.tf

@@ -0,0 +1,129 @@
+resource "kubernetes_service_account" "operator_service_account" {
+  metadata {
+    name      = "operator"
+    namespace = "default"
+  }
+}
+
+resource "kubernetes_cluster_role" "operator_maintenance_role" {
+  metadata {
+    name = "operator-maintenance-role"
+  }
+
+  # Allow managing Pods (create, delete, exec, restart)
+  rule {
+    api_groups = [""]
+    resources  = ["pods"]
+    verbs      = ["get", "list", "watch", "create", "delete", "patch", "update", "exec"]
+  }
+
+  rule {
+    api_groups = [""]
+    resources  = ["replicationcontrollers"]
+    verbs      = ["get", "list"]
+  }
+
+  rule {
+    api_groups = ["autoscaling"]
+    resources  = ["horizontalpodautoscalers"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  rule {
+    api_groups = ["apps"]
+    resources  = ["deployments", "replicasets", "statefulsets", "daemonsets"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  rule {
+    api_groups = ["batch"]
+    resources  = ["cronjobs"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  rule {
+    api_groups = ["batch"]
+    resources  = ["jobs"]
+    verbs      = ["get", "list", "watch", "create", "delete", "patch", "update"]
+  }
+
+  # Allow reading Pod logs
+  rule {
+    api_groups = [""]
+    resources  = ["pods/log"]
+    verbs      = ["get", "list"]
+  }
+
+  # Allow managing Pod eviction for draining nodes, etc.
+  rule {
+    api_groups = ["policy"]
+    resources  = ["pods/eviction"]
+    verbs      = ["create"]
+  }
+
+  # Allow reading Namespaces (usually required for multi-namespace tools)
+  rule {
+    api_groups = [""]
+    resources  = ["namespaces"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  # Allow reading and managing PodDisruptionBudgets (useful for draining nodes)
+  rule {
+    api_groups = ["policy"]
+    resources  = ["poddisruptionbudgets"]
+    verbs      = ["get", "list", "watch", "patch", "update"]
+  }
+
+  # Allow managing Nodes (e.g., for cordoning, draining)
+  rule {
+    api_groups = [""]
+    resources  = ["nodes"]
+    verbs      = ["get", "list", "patch", "update"]
+  }
+
+  # Allow reading PersistentVolumeClaims (PVCs) but not PersistentVolumes
+  rule {
+    api_groups = [""]
+    resources  = ["persistentvolumeclaims"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  # Allow listing and getting services and endpoints (but not updating)
+  rule {
+    api_groups = [""]
+    resources  = ["services", "endpoints"]
+    verbs      = ["get", "list", "watch"]
+  }
+}
+
+resource "kubernetes_cluster_role_binding" "operator_maintenance_binding" {
+  metadata {
+    name = "operator-maintenance-binding"
+  }
+
+  role_ref {
+    kind      = "ClusterRole"
+    name      = kubernetes_cluster_role.operator_maintenance_role.metadata[0].name
+    api_group = "rbac.authorization.k8s.io"
+  }
+
+  subject {
+    kind      = "ServiceAccount"
+    namespace = "default"
+    name      = kubernetes_service_account.operator_service_account.metadata[0].name
+  }
+}
+
+resource "kubernetes_secret" "operator_access_token" {
+  metadata {
+    annotations = {
+      "kubernetes.io/service-account.name" = kubernetes_service_account.operator_service_account.metadata[0].name
+    }
+    name      = "operator-token"
+    namespace = "default"
+  }
+
+  type                           = "kubernetes.io/service-account-token"
+  wait_for_service_account_token = true
+}

terraform/apps/prod-01/provider.tf

@@ -30,7 +30,7 @@ terraform {
 
 provider "kubernetes" {
   config_path    = "~/.kube/config"
-  config_context = "microk8s"
+  config_context = "microk8s-prod-01"
   insecure       = true
 }
 

terraform/iac/aws/sectool.env

@@ -0,0 +1,2 @@
+AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY
+AWS_SECRET_ACCESS_KEY=$AWS_SECRET_KEY

terraform/modules/apps/m3uproxy/main.tf

@@ -102,6 +102,7 @@ resource "kubernetes_deployment" "m3uproxy" {
             container_port = 8080
             name           = "http"
           }
+
           readiness_probe {
             http_get {
               path = "/health"
@@ -111,6 +112,7 @@ resource "kubernetes_deployment" "m3uproxy" {
             period_seconds        = 10
             failure_threshold     = 10
           }
+
           env {
             name = "USERNAME"
             value_from {
@@ -120,6 +122,7 @@ resource "kubernetes_deployment" "m3uproxy" {
               }
             }
           }
+
           env {
             name = "PASSWORD"
             value_from {
@@ -129,11 +132,13 @@ resource "kubernetes_deployment" "m3uproxy" {
               }
             }
           }
+
           security_context {
             allow_privilege_escalation = false
             run_as_user                = 1000
             run_as_group               = 1000
           }
+
           volume_mount {
             name       = "m3uproxy-config"
             mount_path = "/app/conf/m3uproxy.json"

terraform/modules/apps/nginx-reverse-proxy/main.tf

@@ -322,6 +322,9 @@ resource "kubernetes_deployment" "reverse_proxy" {
             }
             initial_delay_seconds = 5
             period_seconds        = 10
+            failure_threshold     = 10
+            timeout_seconds       = 5
+            success_threshold     = 1
           }
 
           security_context {

terraform/modules/apps/open-webui/config.tf

@@ -0,0 +1,8 @@
+locals {
+  persistent_folder = var.persistent_folder
+  app_path          = "${local.persistent_folder}/open-webui"
+
+  app_version = var.tag
+  app_fqdn    = var.fqdn
+}
+

terraform/modules/apps/open-webui/main.tf

@@ -0,0 +1,167 @@
+resource "kubernetes_namespace" "openwebui" {
+  metadata {
+    name = "openwebui"
+  }
+}
+
+resource "kubernetes_service_account" "openwebui" {
+
+  metadata {
+    name      = "openwebui-sa"
+    namespace = kubernetes_namespace.openwebui.metadata[0].name
+  }
+
+  automount_service_account_token = false
+}
+
+resource "kubernetes_manifest" "internal_cert" {
+
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+    metadata = {
+      name      = "internal-cert"
+      namespace = kubernetes_namespace.openwebui.metadata[0].name
+    }
+    spec = {
+      secretName = "internal-cert"
+      issuerRef = {
+        name = var.issuer
+        kind = "ClusterIssuer"
+      }
+      commonName = var.fqdn
+      dnsNames   = [var.fqdn]
+    }
+  }
+}
+
+resource "kubernetes_deployment" "openwebui" {
+  metadata {
+    name      = "openwebui"
+    namespace = kubernetes_namespace.openwebui.metadata[0].name
+    labels = {
+      openwebui = "openwebui"
+    }
+  }
+
+  spec {
+    replicas = 1
+
+    selector {
+      match_labels = {
+        openwebui = "openwebui"
+      }
+    }
+
+    strategy {
+      type = "Recreate"
+    }
+
+    template {
+      metadata {
+        labels = {
+          openwebui = "openwebui"
+        }
+      }
+
+      spec {
+        service_account_name            = kubernetes_service_account.openwebui.metadata[0].name
+        automount_service_account_token = false
+
+        container {
+          name  = "openwebui-container"
+          image = "ghcr.io/open-webui/open-webui:${local.app_version}"
+
+          security_context {
+            allow_privilege_escalation = false
+          }
+
+          port {
+            name           = "http"
+            container_port = 8080
+          }
+
+          readiness_probe {
+            tcp_socket {
+              port = 8080
+            }
+            initial_delay_seconds = 5
+            period_seconds        = 10
+            failure_threshold     = 10
+          }
+
+          volume_mount {
+            name       = "openwebui-data"
+            mount_path = "/app/backend/data"
+          }
+        }
+
+        volume {
+          name = "openwebui-data"
+          host_path {
+            path = local.app_path
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_service" "openwebui" {
+  metadata {
+    name      = "http"
+    namespace = kubernetes_namespace.openwebui.metadata[0].name
+  }
+
+  spec {
+    selector = {
+      openwebui = "openwebui"
+    }
+
+    port {
+      name        = "http"
+      port        = 8080
+      target_port = 8080
+    }
+
+    cluster_ip = "None"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      metadata[0].annotations
+    ]
+  }
+}
+
+resource "kubernetes_ingress_v1" "openwebui" {
+  metadata {
+    name      = "ingress"
+    namespace = kubernetes_namespace.openwebui.metadata[0].name
+
+    annotations = {
+      "nginx.ingress.kubernetes.io/ssl-redirect" = "true"
+    }
+  }
+  spec {
+    tls {
+      hosts       = [local.app_fqdn]
+      secret_name = "internal-cert"
+    }
+    rule {
+      host = local.app_fqdn
+      http {
+        path {
+          backend {
+            service {
+              name = "http"
+              port {
+                number = 8080
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

terraform/modules/apps/open-webui/provider.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = "~>1.8"
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "2.36.0"
+    }
+  }
+}

terraform/modules/apps/open-webui/variables.tf

@@ -0,0 +1,22 @@
+variable "persistent_folder" {
+  description = "The path to the persistent folder"
+  type        = string
+}
+
+variable "fqdn" {
+  description = "The fully qualified domain name for the app server"
+  type        = string
+}
+
+variable "tag" {
+  description = "The version of app to install"
+  type        = string
+  default     = "main"
+}
+
+variable "issuer" {
+  description = "The issuer for the certificate"
+  type        = string
+  default     = "internal-ca"
+}
+

terraform/modules/apps/template/config.tf

@@ -0,0 +1,8 @@
+locals {
+  persistent_folder = var.persistent_folder
+  app_path          = "${local.persistent_folder}/app"
+
+  app_version = var.tag
+  app_fqdn    = var.fqdn
+}
+

terraform/modules/apps/template/main.tf

@@ -0,0 +1,160 @@
+resource "kubernetes_namespace" "app" {
+  metadata {
+    name = "app"
+  }
+}
+
+resource "kubernetes_service_account" "app" {
+
+  metadata {
+    name      = "app-sa"
+    namespace = kubernetes_namespace.app.metadata[0].name
+  }
+
+  automount_service_account_token = false
+}
+
+resource "kubernetes_config_map" "app_config" {
+  metadata {
+    name      = "app-config"
+    namespace = kubernetes_namespace.app.metadata[0].name
+  }
+
+  data = {}
+}
+
+resource "kubernetes_secret" "app_secrets" {
+  metadata {
+    name      = "app-keys"
+    namespace = kubernetes_namespace.app.metadata[0].name
+  }
+
+  data = {}
+}
+
+resource "kubernetes_deployment" "app" {
+  metadata {
+    name      = "app"
+    namespace = kubernetes_namespace.app.metadata[0].name
+    labels = {
+      app = "app"
+    }
+  }
+
+  spec {
+    replicas = 1
+
+    selector {
+      match_labels = {
+        app = "app"
+      }
+    }
+
+    strategy {
+      type = "Recreate"
+    }
+
+    template {
+      metadata {
+        labels = {
+          app = "app"
+        }
+      }
+
+      spec {
+        service_account_name            = kubernetes_service_account.app.metadata[0].name
+        automount_service_account_token = false
+
+        container {
+          name  = "app-container"
+          image = "app/app-server-s6:${local.app_version}"
+
+          env_from {
+            config_map_ref {
+              name = kubernetes_config_map.app_config.metadata[0].name
+            }
+          }
+
+          security_context {
+            allow_privilege_escalation = false
+          }
+
+          port {
+            name           = "app-port-1"
+            container_port = 21115
+            host_port      = 21115
+            protocol       = "TCP"
+          }
+
+
+          volume_mount {
+            name       = "app-data"
+            mount_path = "/data"
+          }
+
+          volume_mount {
+            name       = "app-secrets"
+            mount_path = "/data/secrets"
+            read_only  = true
+          }
+
+          volume_mount {
+            name       = "app-config"
+            mount_path = "/data/config"
+            read_only  = true
+          }
+        }
+
+        volume {
+          name = "app-data"
+          host_path {
+            path = local.app_path
+          }
+        }
+
+        volume {
+          name = "app-secrets"
+          secret {
+            secret_name = kubernetes_secret.app_secrets.metadata[0].name
+          }
+        }
+
+        volume {
+          name = "app-config"
+          config_map {
+            name = kubernetes_config_map.app_config.metadata[0].name
+          }
+        }
+
+      }
+    }
+  }
+}
+
+resource "kubernetes_service" "app" {
+  metadata {
+    name      = "app-ports"
+    namespace = kubernetes_namespace.app.metadata[0].name
+  }
+
+  spec {
+    selector = {
+      app = "app"
+    }
+
+    port {
+      name        = "app-port-1"
+      port        = 21115
+      target_port = 21115
+    }
+
+    cluster_ip = "None"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      metadata[0].annotations
+    ]
+  }
+
+}

terraform/modules/apps/template/provider.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = "~>1.8"
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "2.36.0"
+    }
+  }
+}

terraform/modules/apps/template/variables.tf

@@ -0,0 +1,15 @@
+variable "persistent_folder" {
+  description = "The path to the persistent folder"
+  type        = string
+}
+
+variable "fqdn" {
+  description = "The fully qualified domain name for the app server"
+  type        = string
+}
+
+variable "tag" {
+  description = "The version of app to install"
+  type        = string
+  default     = "latest"
+}