Refactor m3uproxy configuration to include GeoIP updates

terraform/k8sapps/m3uproxy.tf

@@ -2,6 +2,7 @@ locals {
   m3uproxy_path       = "/var/lib/m3uproxy"
   m3uproxy_cache_path = "${local.m3uproxy_path}/cache"
   squid_app_path      = "${local.m3uproxy_path}/squid"
+  geoip_path          = "${local.m3uproxy_path}/geoip"
   wireguard_address   = "192.168.5.3/32"
   wireguard_dns       = "192.168.5.1"
   wireguard_allowed_ips = [
@@ -45,6 +46,19 @@ resource "kubernetes_secret" "m3uproxy_admin_credentials" {
   type = "Opaque"
 }
 
+resource "kubernetes_secret" "geoip_maxmind_credentials" {
+  metadata {
+    name      = "geoip-maxmind-credentials"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+  }
+  data = {
+    account_id  = var.maxmind_account_id
+    license_key = var.maxmind_license_key
+  }
+  type = "Opaque"
+
+}
+
 
 resource "kubernetes_service_account" "m3uproxy_service_account" {
 
@@ -207,6 +221,11 @@ resource "kubernetes_deployment" "proxy_pt" {
             mount_path = "/var/spol/squid"
           }
 
+          security_context {
+            run_as_user  = 1000
+            run_as_group = 1000
+          }
+
         }
 
         volume {
@@ -366,7 +385,7 @@ resource "kubernetes_deployment" "m3uproxy" {
         volume {
           name = "geoip-db"
           host_path {
-            path = "/var/lib/GeoIP"
+            path = local.geoip_path
           }
         }
 
@@ -375,6 +394,92 @@ resource "kubernetes_deployment" "m3uproxy" {
   }
 }
 
+resource "kubernetes_cron_job" "geoip_update" {
+
+  metadata {
+    name      = "geoip-update"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+  }
+
+  spec {
+    schedule = local.geoip_cron_schedule
+    job_template {
+      metadata {
+        name = "geoip-update"
+      }
+      spec {
+        template {
+          metadata {
+            labels = {
+              app = "geoip-update"
+            }
+          }
+          spec {
+            container {
+              name  = "geoip-update"
+              image = "${local.geoip_image}:${local.geoip_version}"
+
+              env {
+                name = "GEOIPUPDATE_ACCOUNT_ID"
+                value_from {
+                  secret_key_ref {
+                    name = kubernetes_secret.geoip_maxmind_credentials.metadata[0].name
+                    key  = "account_id"
+                  }
+                }
+              }
+
+              env {
+                name = "GEOIPUPDATE_LICENSE_KEY"
+                value_from {
+                  secret_key_ref {
+                    name = kubernetes_secret.geoip_maxmind_credentials.metadata[0].name
+                    key  = "license_key"
+                  }
+                }
+              }
+
+              env {
+                name  = "GEOIPUPDATE_EDITION_IDS"
+                value = join(" ", local.geoip_editions)
+              }
+
+              resources {
+                requests = {
+                  memory = "64Mi"
+                }
+              }
+
+              volume_mount {
+                name       = "geoip-db"
+                mount_path = "/usr/share/GeoIP"
+              }
+
+
+              security_context {
+                run_as_user  = 1000
+                run_as_group = 1000
+              }
+            }
+
+            service_account_name = kubernetes_service_account.m3uproxy_service_account.metadata[0].name
+
+            restart_policy = "OnFailure"
+
+            volume {
+              name = "geoip-db"
+              host_path {
+                path = local.geoip_path
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+
 resource "kubernetes_service" "m3uproxy" {
   metadata {
     name      = "http"