alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Refactor Gitea and SSH configurations, update backup scripts, and enhance Nginx settings

Browse Source 
- Updated SSH configuration for Gitea to disable banner and TTY, and modified the AuthorizedKeysCommand.
- Simplified gitea-shell script to directly call the k8s_gitea_shell command with required parameters.
- Removed unused gitea-auth script from playbook_gitea.yml.
- Updated systools_version in playbook_systools.yml to 0.4.5.
- Enhanced ssh_locker_helper to copy redirect URL to clipboard based on OS.
- Added a new script test_imaps for IMAP testing.
- Updated Terraform configurations for various applications, including:
  - Added a backup script for MariaDB with retention policy.
  - Changed Gitea version to 1.24-rootless and adjusted SSH settings.
  - Updated Nginx configurations to log errors and access to stderr/stdout.
  - Refactored services to use ClusterIP type and adjusted security contexts for deployments.
  - Added temporary storage for applications using empty_dir.
  - Enhanced backup.sh scripts for better error handling and logging.
This commit is contained in:
Alexandre Pires
2025-09-20 21:34:33 +02:00
parent ff4197e757
commit aee57a8b89
35 changed files with 284 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/modules/apps/nginx-reverse-proxy/main.tf
+42 -10
View File
@@ -45,6 +45,8 @@ resource "kubernetes_service" "reverse-proxy" {
selector = {
app = "reverse-proxy"
}
type = "ClusterIP"
cluster_ip = "None"
}
}
@@ -234,7 +236,7 @@ resource "kubernetes_deployment" "reverse_proxy" {
}
spec {
dynamic "container" {
for_each = local.wireguard_config != "null" ? [1] : []
for_each = nonsensitive(local.wireguard_config) != "null" ? [1] : []
content {
name = "wireguard"
@@ -263,6 +265,7 @@ resource "kubernetes_deployment" "reverse_proxy" {
capabilities {
add = ["NET_ADMIN"]
}
read_only_root_filesystem = true
}
env {
@@ -291,11 +294,16 @@ resource "kubernetes_deployment" "reverse_proxy" {
mount_path = "/lib/modules"
read_only = true
}
volume_mount {
name = "wireguard-run"
mount_path = "/run"
}
}
}
dynamic "container" {
for_each = var.auth_token != "" ? [1] : []
for_each = nonsensitive(var.auth_token) != "" ? [1] : []
content {
name = "auth-sidecar"
image = "python:3.11-slim"
@@ -322,6 +330,14 @@ resource "kubernetes_deployment" "reverse_proxy" {
container_port = 5000
name = "auth"
}
security_context {
read_only_root_filesystem = true
run_as_group = 1000
run_as_user = 1000
allow_privilege_escalation = false
run_as_non_root = true
}
}
}
@@ -338,6 +354,7 @@ resource "kubernetes_deployment" "reverse_proxy" {
security_context {
allow_privilege_escalation = false
read_only_root_filesystem = true
}
readiness_probe {
@@ -386,32 +403,31 @@ resource "kubernetes_deployment" "reverse_proxy" {
protocol = upper(port.value.protocol)
}
}
volume_mount {
name = "nginx"
mount_path = "/etc/nginx/nginx.conf"
sub_path = "nginx.conf"
read_only = true
}
volume_mount {
name = "services"
mount_path = "/etc/nginx/conf.d/"
read_only = true
}
volume_mount {
name = "streams"
mount_path = "/etc/nginx/streams.d/"
read_only = true
}
volume_mount {
name = "nginx-errors"
mount_path = "/usr/share/nginx/html/errors"
read_only = true
}
volume_mount {
name = "nginx-tmp"
mount_path = "/tmp"
}
dynamic "volume_mount" {
for_each = length([for v in var.services : v.tls if v.tls == true]) > 0 ? [1] : []
content {
@@ -423,17 +439,17 @@ resource "kubernetes_deployment" "reverse_proxy" {
}
dynamic "volume" {
for_each = local.wireguard_config != "null" ? [1] : []
for_each = nonsensitive(local.wireguard_config) != "null" ? [1] : []
content {
name = "wireguard-config"
config_map {
name = kubernetes_config_map.wireguard_config[0].metadata[0].name
name = nonsensitive(kubernetes_config_map.wireguard_config[0].metadata[0].name)
}
}
}
dynamic "volume" {
for_each = local.wireguard_config != "null" ? [1] : []
for_each = nonsensitive(local.wireguard_config) != "null" ? [1] : []
content {
name = "lib-modules"
host_path {
@@ -442,6 +458,16 @@ resource "kubernetes_deployment" "reverse_proxy" {
}
}
dynamic "volume" {
for_each = nonsensitive(local.wireguard_config) != "null" ? [1] : []
content {
name = "wireguard-run"
empty_dir {
medium = "Memory"
}
}
}
volume {
name = "auth-script"
config_map {
@@ -477,6 +503,12 @@ resource "kubernetes_deployment" "reverse_proxy" {
}
}
volume {
name = "nginx-tmp"
empty_dir {
}
}
dynamic "volume" {
for_each = length([for v in var.services : v.tls if v.tls == true]) > 0 ? [1] : []
content {
terraform/modules/apps/nginx-reverse-proxy/resources/nginx/nginx.conf
+5 -4
View File
@@ -1,6 +1,6 @@
worker_processes auto;
error_log /var/log/nginx/error.log notice;
error_log /dev/stderr warn;
pid /tmp/nginx.pid;
events {
@@ -25,7 +25,7 @@ http {
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
access_log /dev/stdout main;
sendfile on;
@@ -43,5 +43,6 @@ http {
include /etc/nginx/conf.d/*.conf;
}
include /etc/nginx/streams.d/*.conf;
stream {
include /etc/nginx/streams.d/*.conf;
}
terraform/modules/apps/nginx-reverse-proxy/resources/nginx/streams.d/stream.conf.tpl
+7 -9
View File
@@ -1,15 +1,13 @@
stream {
upstream ${name} {
upstream ${name} {
%{ if resolver != "" ~}
resolver ${resolver};
resolver ${resolver};
%{ endif ~}
server ${upstream}:${upstream_port};
}
server {
listen %{ if protocol == "UDP" ~}${port} udp;%{ else ~}${port};%{ endif }
server ${upstream}:${upstream_port};
}
server {
listen %{ if protocol == "UDP" ~}${port} udp;%{ else ~}${port};%{ endif }
%{ if custom_snippet != "" ~}
${custom_snippet}
%{ endif ~}
proxy_pass ${name};
}
proxy_pass ${name};
}