alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

- Added windows llama proxy

Browse Source 
- Added terraform-mcp
- Added S3 storage to gitea
- Changed context size for windows LLMs
- Changed number of cores for VMs, added P2000 support
This commit is contained in:
Alexandre Pires
2026-06-29 14:31:28 +02:00
parent 80c154df03
commit 4825ad1495
29 changed files with 399 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/apps/dev-01/apps.tf
+16
View File
@@ -43,6 +43,14 @@ module "nextcloud" {
issuer = local.internal_issuer
}
module "llama_windows_proxy" {
source = "../../modules/utils/wol_proxy"
upstream = local.llm_proxy_1
proxy_port = 11435
namespace = "llamacpp"
}
# module "comfyui_proxy" {
# source = "../../modules/utils/wol_proxy"
@@ -122,3 +130,11 @@ module "vaultwarden" {
# signup_enabled = true
# signup_verify = false
}
module "terraform-mcp" {
source = "../../modules/apps/terraform-mcp"
fqdn = local.terraform_mcp_fqdn
tag = "1.0.0"
persistent_folder = local.persistent_folder
}
terraform/apps/dev-01/config.tf
+16
View File
@@ -126,6 +126,11 @@ locals {
name = "vaultwarden"
type = "CNAME"
content = "dev-01.${local.lab_domain}."
},
{
name = "terraform-mcp"
type = "CNAME"
content = "dev-01.${local.lab_domain}."
}
]
}
@@ -179,6 +184,14 @@ locals {
scheme = "http"
}
llm_proxy_1 = {
enabled = true
mac = "52:54:00:CD:DD:2E"
ip = "10.19.4.207"
port = 11434
scheme = "http"
}
# comfyui_proxy = {
# mac = "04:7c:16:d6:63:66"
# ip = "10.19.4.106"
@@ -267,6 +280,9 @@ locals {
vaultwarden_smtp_from_name = "Vaultwarden"
vaultwarden_smtp_username = var.scaleway_project_id
vaultwarden_smtp_password = local.mail_app_api_secret_key
# terraform-mcp
terraform_mcp_fqdn = "terraform-mcp.${local.lab_domain}"
}
data "terraform_remote_state" "scaleway" {
terraform/apps/dev-01/sectool.json
Symlink
+1
View File
@@ -0,0 +1 @@
../../../sectool.json
terraform/apps/prod-01/apps.tf
+1 -21
View File
@@ -89,6 +89,7 @@ module "gitea" {
smtp_passwd = local.mail_app_api_secret_key
secret_key = var.gitea_secret_key
internal_token = var.gitea_internal_token
s3_storage = join("\n", [for k, v in local.gitea_s3_storage : "${k}=${v}"])
disable_registration = true
}
}
@@ -157,24 +158,3 @@ module "auth_exporter" {
source = "../../modules/utils/auth-exporter"
persistent_folder = "${local.persistent_folder}/monitoring"
}
module "vaultwarden" {
source = "../../modules/apps/vaultwarden"
persistent_folder = local.vaultwarden_folder
fqdn = local.vaultwarden_fqdn
issuer = local.vaultwarden_issuer
tag = local.vaultwarden_version
admin_token = var.vaultwarden_admin_token
smtp_host = local.vaultwarden_smtp_host
smtp_port = local.vaultwarden_smtp_port
smtp_security = local.vaultwarden_smtp_security
smtp_from = local.vaultwarden_smtp_from
smtp_from_name = local.vaultwarden_smtp_from_name
smtp_username = local.vaultwarden_smtp_username
smtp_password = var.vaultwarden_smtp_password
smtp_timeout = local.vaultwarden_smtp_timeout
smtp_auth_mechanism = local.vaultwarden_smtp_auth_mechanism
smtp_helo_name = local.vaultwarden_smtp_helo_name
smtp_embed_images = local.vaultwarden_smtp_embed_images
}
terraform/apps/prod-01/config.tf
+10 -17
View File
@@ -18,8 +18,17 @@ locals {
}
# gitea
gitea_version = "1.25-rootless"
gitea_version = "1.26-rootless"
gitea_fqdn = "code.${local.primary_domain}"
gitea_s3_storage = {
STORAGE_TYPE = "minio"
MINIO_ENDPOINT = "s3.fr-par.scw.cloud"
MINIO_ACCESS_KEY_ID = data.terraform_remote_state.scaleway.outputs.gitea_app_api_access_key
MINIO_SECRET_ACCESS_KEY = data.terraform_remote_state.scaleway.outputs.gitea_app_api_secret_key
MINIO_BUCKET = data.terraform_remote_state.scaleway.outputs.gitea_bucket_name
MINIO_LOCATION = "fr-par"
MINIO_USE_SSL = true
}
# sftpgo
sftpgo_version = "2.6.x"
@@ -210,22 +219,6 @@ locals {
# telegram_chat_id = "-950480346" # alexpires.me group
telegram_message = file("${path.module}/resources/telegram.tpl")
# vaultwarden
vaultwarden_folder = "${local.persistent_folder}/vaultwarden"
vaultwarden_fqdn = "vaultwarden.${local.primary_domain}"
vaultwarden_issuer = "internal-ca"
vaultwarden_version = "1.36.0"
vaultwarden_smtp_host = ""
vaultwarden_smtp_port = 587
vaultwarden_smtp_security = "starttls"
vaultwarden_smtp_from = ""
vaultwarden_smtp_from_name = "Vaultwarden"
vaultwarden_smtp_username = ""
vaultwarden_smtp_timeout = 15
vaultwarden_smtp_auth_mechanism = ""
vaultwarden_smtp_helo_name = ""
vaultwarden_smtp_embed_images = true
# get secrets from remote state
backup_bucket_name = data.terraform_remote_state.scaleway.outputs.backup_bucket_name
backup_app_api_secret_key = data.terraform_remote_state.scaleway.outputs.backup_app_api_secret_key
terraform/apps/prod-01/secrets.tf
-13
View File
@@ -134,16 +134,3 @@ variable "telegram_bot_token" {
type = string
sensitive = true
}
variable "vaultwarden_admin_token" {
description = "The admin token for VaultWarden"
type = string
sensitive = true
}
variable "vaultwarden_smtp_password" {
description = "SMTP password for VaultWarden email"
type = string
sensitive = true
default = ""
}
terraform/apps/prod-01/sectool.env
-2
View File
@@ -33,5 +33,3 @@ TF_VAR_wireguard_1_public_key=$WIREGUARD_1_PUBLIC_KEY
TF_VAR_wireguard_1_pre_shared_key=$WIREGUARD_1_PRE_SHARED_KEY
TF_VAR_nginx_token_bearer=$NGINX_TOKEN_BEARER
TF_VAR_telegram_bot_token=$TELEGRAM_BOT_TOKEN
TF_VAR_vaultwarden_admin_token=$VAULTWARDEN_ADMIN_TOKEN
TF_VAR_vaultwarden_smtp_password=$VAULTWARDEN_SMTP_PASSWORD
terraform/apps/prod-01/sectool.json
Symlink
+1
View File
@@ -0,0 +1 @@
../../../sectool.json
terraform/iac/scaleway/buckets.tf
+47
View File
@@ -165,3 +165,50 @@ resource "scaleway_object_bucket_policy" "sftpgo" {
})
}
resource "scaleway_object_bucket" "gitea" {
name = "a13labs-gitea-packages-${random_string.bucket_suffix.result}"
project_id = var.scaleway_project_id
region = "fr-par"
}
resource "scaleway_object_bucket_policy" "gitea" {
bucket = scaleway_object_bucket.gitea.name
policy = jsonencode({
Version = "2023-04-17",
Id = "AllowAccess",
Statement = [
{
Effect = "Allow"
Action = [
"s3:*",
]
Principal = {
SCW = "user_id:${var.scaleway_user_id}"
}
Resource = [
scaleway_object_bucket.gitea.name,
"${scaleway_object_bucket.gitea.name}/*",
]
},
{
Effect = "Allow"
Action = [
"s3:*",
]
Principal = {
SCW = "application_id:${scaleway_iam_application.gitea_app.id}"
}
Resource = [
scaleway_object_bucket.gitea.name,
"${scaleway_object_bucket.gitea.name}/*",
],
Condition = {
IpAddress = {
"aws:SourceIp" = local.instance_ips
}
},
},
]
})
}
terraform/iac/scaleway/iam.tf
+26
View File
@@ -56,6 +56,27 @@ resource "scaleway_iam_policy" "object_read_write_sftpgo" {
}
}
resource "scaleway_iam_application" "gitea_app" {
name = "gitea_app"
}
resource "scaleway_iam_policy" "object_read_write_gitea" {
name = "Gitea app policy"
description = "Gives gitea job access to object storage in project"
application_id = scaleway_iam_application.gitea_app.id
rule {
project_ids = [data.scaleway_account_project.default.id]
permission_set_names = [
"ObjectStorageObjectsWrite",
"ObjectStorageObjectsRead",
"ObjectStorageBucketsRead",
"ObjectStorageBucketsWrite",
"ObjectStorageObjectsDelete"
]
}
}
resource "scaleway_iam_api_key" "backup_app_api" {
application_id = scaleway_iam_application.backup_app.id
description = "k8s backup app API key"
@@ -70,3 +91,8 @@ resource "scaleway_iam_api_key" "sftpgo_app_api" {
application_id = scaleway_iam_application.sftpgo_app.id
description = "sftpgo access API key"
}
resource "scaleway_iam_api_key" "gitea_app_api" {
application_id = scaleway_iam_application.gitea_app.id
description = "gitea access API key"
}
terraform/iac/scaleway/outputs.tf
+17
View File
@@ -32,3 +32,20 @@ output "sftpgo_app_api_secret_key" {
value = scaleway_iam_api_key.sftpgo_app_api.secret_key
sensitive = true
}
output "gitea_app_api_access_key" {
description = "The access key for the Gitea app API."
value = scaleway_iam_api_key.gitea_app_api.access_key
sensitive = true
}
output "gitea_app_api_secret_key" {
description = "The secret key for the Gitea app API."
value = scaleway_iam_api_key.gitea_app_api.secret_key
sensitive = true
}
output "gitea_bucket_name" {
description = "The name of the Gitea bucket."
value = scaleway_object_bucket.gitea.name
}
terraform/iac/scaleway/sectool.json
Symlink
+1
View File
@@ -0,0 +1 @@
../../../sectool.json
terraform/modules/apps/gitea/config.tf
+1
View File
@@ -35,6 +35,7 @@ locals {
SMTP_HOST = var.app_config.smtp_host
SMTP_PORT = var.app_config.smtp_port
SSH_SERVER_KEY_EXCHANGES = "mlkem768x25519-sha256"
S3_STORAGE = var.app_config.s3_storage
})
config_checksum = sha256(local.config)
}
terraform/modules/apps/gitea/resources/app.ini.tpl
+8
View File
@@ -37,8 +37,11 @@ OFFLINE_MODE = false
SHELL = /bin/sh
SSH_SERVER_KEY_EXCHANGES=${SSH_SERVER_KEY_EXCHANGES}
%{ if S3_STORAGE != "" ~}
%{ else ~}
[lfs]
PATH = /data/git/lfs
%{ endif }
[database]
PATH = /data/gitea/gitea.db
@@ -97,3 +100,8 @@ SMTP_PORT = ${SMTP_PORT}
[openid]
ENABLE_OPENID_SIGNIN = true
ENABLE_OPENID_SIGNUP = false
%{ if S3_STORAGE != "" ~}
[storage]
${S3_STORAGE}
%{ endif }
terraform/modules/apps/gitea/variables.tf
+1
View File
@@ -84,5 +84,6 @@ variable "app_config" {
db_user = optional(string, "gitea")
smtp_protocol = optional(string, "SMTPS")
smtp_port = optional(string, "587")
s3_storage = optional(string, "")
})
}
terraform/modules/apps/nextcloud/config.tf
+1 -1
View File
@@ -35,7 +35,7 @@ locals {
OVERWRITECLIURL = "https://${var.fqdn}"
# PHP
PHP_MEMORY_LIMIT = "512M"
PHP_MEMORY_LIMIT = "2048M"
}, var.db_credentials_are_secrets ? {} : local.database_credentials)
nextcloud_secrets = merge({
terraform/modules/apps/terraform-mcp/config.tf
+4
View File
@@ -0,0 +1,4 @@
locals {
app_version = var.tag
app_fqdn = var.fqdn
}
terraform/modules/apps/terraform-mcp/ingress.tf
+24
View File
@@ -0,0 +1,24 @@
resource "kubernetes_ingress_v1" "terraform_mcp" {
metadata {
name = "ingress"
namespace = kubernetes_namespace.terraform_mcp.metadata[0].name
}
spec {
rule {
host = var.fqdn
http {
path {
backend {
service {
name = kubernetes_service.terraform_mcp.metadata[0].name
port {
number = 80
}
}
}
}
}
}
}
}
terraform/modules/apps/terraform-mcp/main.tf
+131
View File
@@ -0,0 +1,131 @@
resource "kubernetes_namespace" "terraform_mcp" {
metadata {
name = "terraform-mcp"
}
}
resource "kubernetes_service_account" "terraform_mcp" {
metadata {
name = "terraform-mcp-sa"
namespace = kubernetes_namespace.terraform_mcp.metadata[0].name
}
automount_service_account_token = false
}
resource "kubernetes_deployment" "terraform_mcp" {
metadata {
name = "terraform-mcp"
namespace = kubernetes_namespace.terraform_mcp.metadata[0].name
labels = {
app = "terraform-mcp"
}
}
spec {
replicas = 1
selector {
match_labels = {
app = "terraform-mcp"
}
}
strategy {
type = "Recreate"
}
template {
metadata {
labels = {
app = "terraform-mcp"
}
}
spec {
service_account_name = kubernetes_service_account.terraform_mcp.metadata[0].name
automount_service_account_token = false
container {
name = "terraform-mcp"
image = "hashicorp/terraform-mcp-server:${local.app_version}"
env {
name = "TRANSPORT_MODE"
value = "streamable-http"
}
env {
name = "TRANSPORT_PORT"
value = "8084"
}
env {
name = "TRANSPORT_HOST"
value = "0.0.0.0"
}
security_context {
allow_privilege_escalation = false
privileged = false
capabilities {
drop = ["ALL"]
}
}
port {
name = "http"
container_port = 8084
protocol = "TCP"
}
liveness_probe {
http_get {
path = "/health"
port = "http"
}
initial_delay_seconds = 10
period_seconds = 15
}
readiness_probe {
http_get {
path = "/health"
port = "http"
}
initial_delay_seconds = 5
period_seconds = 10
}
}
}
}
}
}
resource "kubernetes_service" "terraform_mcp" {
metadata {
name = "terraform-mcp-service"
namespace = kubernetes_namespace.terraform_mcp.metadata[0].name
}
spec {
selector = {
app = "terraform-mcp"
}
port {
name = "http"
port = 80
target_port = 8084
}
type = "ClusterIP"
}
lifecycle {
ignore_changes = [
metadata[0].annotations
]
}
}
terraform/modules/apps/terraform-mcp/provider.tf
+9
View File
@@ -0,0 +1,9 @@
terraform {
required_version = "~>1.8"
required_providers {
kubernetes = {
source = "hashicorp/kubernetes"
version = "2.36.0"
}
}
}
terraform/modules/apps/terraform-mcp/variables.tf
+15
View File
@@ -0,0 +1,15 @@
variable "fqdn" {
description = "FQDN for the service"
type = string
}
variable "tag" {
description = "Image tag to deploy"
type = string
default = "1.0.0"
}
variable "persistent_folder" {
description = "Path for persistent data on the host"
type = string
}