Major changes

terraform/modules/apps/m3uproxy/main.tf

@@ -102,6 +102,7 @@ resource "kubernetes_deployment" "m3uproxy" {
             container_port = 8080
             name           = "http"
           }
+
           readiness_probe {
             http_get {
               path = "/health"
@@ -111,6 +112,7 @@ resource "kubernetes_deployment" "m3uproxy" {
             period_seconds        = 10
             failure_threshold     = 10
           }
+
           env {
             name = "USERNAME"
             value_from {
@@ -120,6 +122,7 @@ resource "kubernetes_deployment" "m3uproxy" {
               }
             }
           }
+
           env {
             name = "PASSWORD"
             value_from {
@@ -129,11 +132,13 @@ resource "kubernetes_deployment" "m3uproxy" {
               }
             }
           }
+
           security_context {
             allow_privilege_escalation = false
             run_as_user                = 1000
             run_as_group               = 1000
           }
+
           volume_mount {
             name       = "m3uproxy-config"
             mount_path = "/app/conf/m3uproxy.json"

terraform/modules/apps/nginx-reverse-proxy/main.tf

@@ -322,6 +322,9 @@ resource "kubernetes_deployment" "reverse_proxy" {
             }
             initial_delay_seconds = 5
             period_seconds        = 10
+            failure_threshold     = 10
+            timeout_seconds       = 5
+            success_threshold     = 1
           }
 
           security_context {

terraform/modules/apps/open-webui/config.tf

@@ -0,0 +1,8 @@
+locals {
+  persistent_folder = var.persistent_folder
+  app_path          = "${local.persistent_folder}/open-webui"
+
+  app_version = var.tag
+  app_fqdn    = var.fqdn
+}
+

terraform/modules/apps/open-webui/main.tf

@@ -0,0 +1,167 @@
+resource "kubernetes_namespace" "openwebui" {
+  metadata {
+    name = "openwebui"
+  }
+}
+
+resource "kubernetes_service_account" "openwebui" {
+
+  metadata {
+    name      = "openwebui-sa"
+    namespace = kubernetes_namespace.openwebui.metadata[0].name
+  }
+
+  automount_service_account_token = false
+}
+
+resource "kubernetes_manifest" "internal_cert" {
+
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+    metadata = {
+      name      = "internal-cert"
+      namespace = kubernetes_namespace.openwebui.metadata[0].name
+    }
+    spec = {
+      secretName = "internal-cert"
+      issuerRef = {
+        name = var.issuer
+        kind = "ClusterIssuer"
+      }
+      commonName = var.fqdn
+      dnsNames   = [var.fqdn]
+    }
+  }
+}
+
+resource "kubernetes_deployment" "openwebui" {
+  metadata {
+    name      = "openwebui"
+    namespace = kubernetes_namespace.openwebui.metadata[0].name
+    labels = {
+      openwebui = "openwebui"
+    }
+  }
+
+  spec {
+    replicas = 1
+
+    selector {
+      match_labels = {
+        openwebui = "openwebui"
+      }
+    }
+
+    strategy {
+      type = "Recreate"
+    }
+
+    template {
+      metadata {
+        labels = {
+          openwebui = "openwebui"
+        }
+      }
+
+      spec {
+        service_account_name            = kubernetes_service_account.openwebui.metadata[0].name
+        automount_service_account_token = false
+
+        container {
+          name  = "openwebui-container"
+          image = "ghcr.io/open-webui/open-webui:${local.app_version}"
+
+          security_context {
+            allow_privilege_escalation = false
+          }
+
+          port {
+            name           = "http"
+            container_port = 8080
+          }
+
+          readiness_probe {
+            tcp_socket {
+              port = 8080
+            }
+            initial_delay_seconds = 5
+            period_seconds        = 10
+            failure_threshold     = 10
+          }
+
+          volume_mount {
+            name       = "openwebui-data"
+            mount_path = "/app/backend/data"
+          }
+        }
+
+        volume {
+          name = "openwebui-data"
+          host_path {
+            path = local.app_path
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_service" "openwebui" {
+  metadata {
+    name      = "http"
+    namespace = kubernetes_namespace.openwebui.metadata[0].name
+  }
+
+  spec {
+    selector = {
+      openwebui = "openwebui"
+    }
+
+    port {
+      name        = "http"
+      port        = 8080
+      target_port = 8080
+    }
+
+    cluster_ip = "None"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      metadata[0].annotations
+    ]
+  }
+}
+
+resource "kubernetes_ingress_v1" "openwebui" {
+  metadata {
+    name      = "ingress"
+    namespace = kubernetes_namespace.openwebui.metadata[0].name
+
+    annotations = {
+      "nginx.ingress.kubernetes.io/ssl-redirect" = "true"
+    }
+  }
+  spec {
+    tls {
+      hosts       = [local.app_fqdn]
+      secret_name = "internal-cert"
+    }
+    rule {
+      host = local.app_fqdn
+      http {
+        path {
+          backend {
+            service {
+              name = "http"
+              port {
+                number = 8080
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

terraform/modules/apps/open-webui/provider.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = "~>1.8"
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "2.36.0"
+    }
+  }
+}

terraform/modules/apps/open-webui/variables.tf

@@ -0,0 +1,22 @@
+variable "persistent_folder" {
+  description = "The path to the persistent folder"
+  type        = string
+}
+
+variable "fqdn" {
+  description = "The fully qualified domain name for the app server"
+  type        = string
+}
+
+variable "tag" {
+  description = "The version of app to install"
+  type        = string
+  default     = "main"
+}
+
+variable "issuer" {
+  description = "The issuer for the certificate"
+  type        = string
+  default     = "internal-ca"
+}
+

terraform/modules/apps/template/config.tf

@@ -0,0 +1,8 @@
+locals {
+  persistent_folder = var.persistent_folder
+  app_path          = "${local.persistent_folder}/app"
+
+  app_version = var.tag
+  app_fqdn    = var.fqdn
+}
+

terraform/modules/apps/template/main.tf

@@ -0,0 +1,160 @@
+resource "kubernetes_namespace" "app" {
+  metadata {
+    name = "app"
+  }
+}
+
+resource "kubernetes_service_account" "app" {
+
+  metadata {
+    name      = "app-sa"
+    namespace = kubernetes_namespace.app.metadata[0].name
+  }
+
+  automount_service_account_token = false
+}
+
+resource "kubernetes_config_map" "app_config" {
+  metadata {
+    name      = "app-config"
+    namespace = kubernetes_namespace.app.metadata[0].name
+  }
+
+  data = {}
+}
+
+resource "kubernetes_secret" "app_secrets" {
+  metadata {
+    name      = "app-keys"
+    namespace = kubernetes_namespace.app.metadata[0].name
+  }
+
+  data = {}
+}
+
+resource "kubernetes_deployment" "app" {
+  metadata {
+    name      = "app"
+    namespace = kubernetes_namespace.app.metadata[0].name
+    labels = {
+      app = "app"
+    }
+  }
+
+  spec {
+    replicas = 1
+
+    selector {
+      match_labels = {
+        app = "app"
+      }
+    }
+
+    strategy {
+      type = "Recreate"
+    }
+
+    template {
+      metadata {
+        labels = {
+          app = "app"
+        }
+      }
+
+      spec {
+        service_account_name            = kubernetes_service_account.app.metadata[0].name
+        automount_service_account_token = false
+
+        container {
+          name  = "app-container"
+          image = "app/app-server-s6:${local.app_version}"
+
+          env_from {
+            config_map_ref {
+              name = kubernetes_config_map.app_config.metadata[0].name
+            }
+          }
+
+          security_context {
+            allow_privilege_escalation = false
+          }
+
+          port {
+            name           = "app-port-1"
+            container_port = 21115
+            host_port      = 21115
+            protocol       = "TCP"
+          }
+
+
+          volume_mount {
+            name       = "app-data"
+            mount_path = "/data"
+          }
+
+          volume_mount {
+            name       = "app-secrets"
+            mount_path = "/data/secrets"
+            read_only  = true
+          }
+
+          volume_mount {
+            name       = "app-config"
+            mount_path = "/data/config"
+            read_only  = true
+          }
+        }
+
+        volume {
+          name = "app-data"
+          host_path {
+            path = local.app_path
+          }
+        }
+
+        volume {
+          name = "app-secrets"
+          secret {
+            secret_name = kubernetes_secret.app_secrets.metadata[0].name
+          }
+        }
+
+        volume {
+          name = "app-config"
+          config_map {
+            name = kubernetes_config_map.app_config.metadata[0].name
+          }
+        }
+
+      }
+    }
+  }
+}
+
+resource "kubernetes_service" "app" {
+  metadata {
+    name      = "app-ports"
+    namespace = kubernetes_namespace.app.metadata[0].name
+  }
+
+  spec {
+    selector = {
+      app = "app"
+    }
+
+    port {
+      name        = "app-port-1"
+      port        = 21115
+      target_port = 21115
+    }
+
+    cluster_ip = "None"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      metadata[0].annotations
+    ]
+  }
+
+}

terraform/modules/apps/template/provider.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = "~>1.8"
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "2.36.0"
+    }
+  }
+}

terraform/modules/apps/template/variables.tf

@@ -0,0 +1,15 @@
+variable "persistent_folder" {
+  description = "The path to the persistent folder"
+  type        = string
+}
+
+variable "fqdn" {
+  description = "The fully qualified domain name for the app server"
+  type        = string
+}
+
+variable "tag" {
+  description = "The version of app to install"
+  type        = string
+  default     = "latest"
+}