Merge pull request #8 from a13labs/feature/geoipupdate

Refactor m3uproxy configuration to include GeoIP updates

terraform/k8sapps/config.tf

@@ -16,14 +16,20 @@ locals {
   nextcloud_sql_backup_cron_schedule   = "40 2 * * *"
   nextcloud_files_backup_cron_schedule = "50 2 * * *"
 
-  # collabora
-  collabora_fqdn    = "office.alexpires.me"
-  collabora_version = "24.04.1.4.1"
 
   # tvheadend
   m3uproxy_version  = "latest"
   wireguard_version = "latest"
   m3uproxy_fqdn     = "tv.alexpires.me"
+  geoip_image       = "maxmindinc/geoipupdate"
+  geoip_version     = "latest"
+
+  geoip_cron_schedule = "0 0 * * *"
+  geoip_editions = [
+    "GeoLite2-Country",
+    "GeoLite2-City",
+    "GeoLite2-ASN"
+  ]
 
   # backup
   local_backup_retention_days = 2

terraform/k8sapps/m3uproxy.tf

@@ -2,6 +2,7 @@ locals {
   m3uproxy_path       = "/var/lib/m3uproxy"
   m3uproxy_cache_path = "${local.m3uproxy_path}/cache"
   squid_app_path      = "${local.m3uproxy_path}/squid"
+  geoip_path          = "${local.m3uproxy_path}/geoip"
   wireguard_address   = "192.168.5.3/32"
   wireguard_dns       = "192.168.5.1"
   wireguard_allowed_ips = [
@@ -45,6 +46,19 @@ resource "kubernetes_secret" "m3uproxy_admin_credentials" {
   type = "Opaque"
 }
 
+resource "kubernetes_secret" "geoip_maxmind_credentials" {
+  metadata {
+    name      = "geoip-maxmind-credentials"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+  }
+  data = {
+    account_id  = var.maxmind_account_id
+    license_key = var.maxmind_license_key
+  }
+  type = "Opaque"
+
+}
+
 
 resource "kubernetes_service_account" "m3uproxy_service_account" {
 
@@ -207,6 +221,12 @@ resource "kubernetes_deployment" "proxy_pt" {
             mount_path = "/var/spol/squid"
           }
 
+          security_context {
+            allow_privilege_escalation = false
+            run_as_user                = 1000
+            run_as_group               = 1000
+          }
+
         }
 
         volume {
@@ -327,8 +347,9 @@ resource "kubernetes_deployment" "m3uproxy" {
           }
 
           security_context {
-            run_as_user  = 1000
-            run_as_group = 1000
+            allow_privilege_escalation = false
+            run_as_user                = 1000
+            run_as_group               = 1000
           }
 
           volume_mount {
@@ -366,7 +387,7 @@ resource "kubernetes_deployment" "m3uproxy" {
         volume {
           name = "geoip-db"
           host_path {
-            path = "/var/lib/GeoIP"
+            path = local.geoip_path
           }
         }
 
@@ -375,6 +396,92 @@ resource "kubernetes_deployment" "m3uproxy" {
   }
 }
 
+resource "kubernetes_cron_job" "geoip_update" {
+
+  metadata {
+    name      = "geoip-update"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+  }
+
+  spec {
+    schedule = local.geoip_cron_schedule
+    job_template {
+      metadata {
+        name = "geoip-update"
+      }
+      spec {
+        template {
+          metadata {
+            labels = {
+              app = "geoip-update"
+            }
+          }
+          spec {
+            container {
+              name  = "geoip-update"
+              image = "${local.geoip_image}:${local.geoip_version}"
+
+              env {
+                name = "GEOIPUPDATE_ACCOUNT_ID"
+                value_from {
+                  secret_key_ref {
+                    name = kubernetes_secret.geoip_maxmind_credentials.metadata[0].name
+                    key  = "account_id"
+                  }
+                }
+              }
+
+              env {
+                name = "GEOIPUPDATE_LICENSE_KEY"
+                value_from {
+                  secret_key_ref {
+                    name = kubernetes_secret.geoip_maxmind_credentials.metadata[0].name
+                    key  = "license_key"
+                  }
+                }
+              }
+
+              env {
+                name  = "GEOIPUPDATE_EDITION_IDS"
+                value = join(" ", local.geoip_editions)
+              }
+
+              resources {
+                requests = {
+                  memory = "64Mi"
+                }
+              }
+
+              volume_mount {
+                name       = "geoip-db"
+                mount_path = "/usr/share/GeoIP"
+              }
+
+
+              security_context {
+                run_as_user  = 1000
+                run_as_group = 1000
+              }
+            }
+
+            service_account_name = kubernetes_service_account.m3uproxy_service_account.metadata[0].name
+
+            restart_policy = "OnFailure"
+
+            volume {
+              name = "geoip-db"
+              host_path {
+                path = local.geoip_path
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+
 resource "kubernetes_service" "m3uproxy" {
   metadata {
     name      = "http"

terraform/k8sapps/sectool.env

@@ -14,3 +14,5 @@ TF_VAR_wireguard_private_key=$WIREGUARD_PRIVATE_KEY
 TF_VAR_wireguard_public_key=$WIREGUARD_PUBLIC_KEY
 TF_VAR_m3uproxy_admin_password=$M3UPROXY_ADMIN_PASSWORD
 TF_VAR_m3uproxy_secret=$M3UPROXY_SECRET
+TF_VAR_maxmind_account_id=$MAXMIND_ACCOUNT_ID
+TF_VAR_maxmind_license_key=$MAXMIND_LICENSE_KEY

terraform/k8sapps/variables.tf

@@ -43,11 +43,6 @@ variable "nextcloud_admin_password" {
   type        = string
 }
 
-variable "collabora_admin_password" {
-  description = "Collabora access password"
-  type        = string
-}
-
 variable "wireguard_private_key" {
   description = "Wireguard public key"
   type        = string
@@ -67,3 +62,13 @@ variable "m3uproxy_secret" {
   description = "M3UProxy HMAC secret"
   type        = string
 }
+
+variable "maxmind_account_id" {
+  description = "Maxmind account ID"
+  type        = string
+}
+
+variable "maxmind_license_key" {
+  description = "Maxmind license key"
+  type        = string
+}