From b0162abb889a49d9eb2f753ecbce3491163ed779 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Sun, 1 Jun 2025 17:14:33 +0200 Subject: [PATCH] Addes support for reverse proxy to home server --- terraform/cloudns-iac/config.tf | 5 + terraform/k8sapps/apps.tf | 7 + terraform/k8sapps/config.tf | 38 ++ terraform/k8sapps/provider.tf | 2 +- terraform/k8sapps/secrets.tf | 12 + terraform/k8sapps/sectool.env | 5 +- terraform/k8sapps/variables.tf | 6 + terraform/modules/apps/gitea/provider.tf | 2 +- terraform/modules/apps/m3uproxy/provider.tf | 2 +- terraform/modules/apps/mail/provider.tf | 2 +- .../apps/nginx-reverse-proxy/config.tf | 41 ++ .../modules/apps/nginx-reverse-proxy/main.tf | 377 ++++++++++++++++++ .../apps/nginx-reverse-proxy/provider.tf | 13 + .../resources/nginx/conf.d/default.conf.tpl | 22 + .../resources/nginx/nginx.conf | 36 ++ .../resources/wireguard/wireguard.conf.tpl | 10 + .../apps/nginx-reverse-proxy/variables.tf | 45 +++ terraform/modules/apps/nginx/config.tf | 1 - terraform/modules/apps/nginx/main.tf | 12 +- terraform/modules/apps/nginx/provider.tf | 2 +- terraform/modules/apps/rustdesk/provider.tf | 2 +- terraform/modules/apps/sftpgo/provider.tf | 2 +- .../modules/apps/ssh_locker_web/provider.tf | 2 +- terraform/modules/db/mariadb/provider.tf | 2 +- .../modules/utils/scw_rclone/provider.tf | 2 +- 25 files changed, 632 insertions(+), 18 deletions(-) create mode 100644 terraform/modules/apps/nginx-reverse-proxy/config.tf create mode 100644 terraform/modules/apps/nginx-reverse-proxy/main.tf create mode 100644 terraform/modules/apps/nginx-reverse-proxy/provider.tf create mode 100644 terraform/modules/apps/nginx-reverse-proxy/resources/nginx/conf.d/default.conf.tpl create mode 100644 terraform/modules/apps/nginx-reverse-proxy/resources/nginx/nginx.conf create mode 100644 terraform/modules/apps/nginx-reverse-proxy/resources/wireguard/wireguard.conf.tpl create mode 100644 terraform/modules/apps/nginx-reverse-proxy/variables.tf diff --git a/terraform/cloudns-iac/config.tf b/terraform/cloudns-iac/config.tf index d0b953f..0c43282 100644 --- a/terraform/cloudns-iac/config.tf +++ b/terraform/cloudns-iac/config.tf @@ -175,6 +175,11 @@ locals { type = "CNAME" value = "${local.vps_1.name}.alexpires.me" }, + { + name = "ai" + type = "CNAME" + value = "${local.vps_1.name}.alexpires.me" + }, ] } diff --git a/terraform/k8sapps/apps.tf b/terraform/k8sapps/apps.tf index 0e82578..031e596 100644 --- a/terraform/k8sapps/apps.tf +++ b/terraform/k8sapps/apps.tf @@ -139,3 +139,10 @@ module "ssh_locker_web" { redirect_uri = "https://alexpires.me/api/ssh_locker/duo-callback" socket_path = "/var/run/ssh_locker/provision.sock" } + +module "reverse_proxy" { + source = "../modules/apps/nginx-reverse-proxy" + + services = local.reverse_proxy_services + wireguard_config = local.reverse_proxy_wireguard_config +} diff --git a/terraform/k8sapps/config.tf b/terraform/k8sapps/config.tf index 794b49e..6698ba2 100644 --- a/terraform/k8sapps/config.tf +++ b/terraform/k8sapps/config.tf @@ -77,6 +77,44 @@ locals { } ] + #reverse proxy settings + reverse_proxy_wireguard_config = { + private_key = var.wireguard_1_private_key + public_key = var.wireguard_1_public_key + pre_shared_key = var.wireguard_1_pre_shared_key + endpoint = "aristotle.alexpires.me" + endpoint_port = 51820 + address = "10.5.5.2/32" + dns = "10.19.4.1" + allowed_ips = [ + "10.19.4.106/32", + ] + } + + reverse_proxy_services = { + "open-webui" = { + http_port = 8080 + https_port = 8443 + tls = true + fqdn = ["ai.alexpires.me"] + upstream = "http://10.19.4.106:8080" + locations = [ + { + path = "/ws/socket.io/" + headers = { + "Upgrade" = "$http_upgrade" + "Connection" = "upgrade" + } + }, + { + path = "/" + }, + ] + } + } + + + # VPS configuration instance_ips = [ "${local.vps_1.ip}/32", ] diff --git a/terraform/k8sapps/provider.tf b/terraform/k8sapps/provider.tf index e544d39..f25be10 100644 --- a/terraform/k8sapps/provider.tf +++ b/terraform/k8sapps/provider.tf @@ -19,7 +19,7 @@ terraform { } kubernetes = { source = "hashicorp/kubernetes" - version = "~>2.18" + version = "2.36.0" } scaleway = { source = "scaleway/scaleway" diff --git a/terraform/k8sapps/secrets.tf b/terraform/k8sapps/secrets.tf index 269a0e4..f4c2b8d 100644 --- a/terraform/k8sapps/secrets.tf +++ b/terraform/k8sapps/secrets.tf @@ -122,3 +122,15 @@ variable "server_api_access_token" { type = string sensitive = true } + +variable "wireguard_1_private_key" { + description = "The private key for Wireguard" + type = string + sensitive = true +} + +variable "wireguard_1_pre_shared_key" { + description = "The pre-shared key for Wireguard" + type = string + sensitive = true +} diff --git a/terraform/k8sapps/sectool.env b/terraform/k8sapps/sectool.env index b3fe89c..669a0ba 100644 --- a/terraform/k8sapps/sectool.env +++ b/terraform/k8sapps/sectool.env @@ -30,4 +30,7 @@ TF_VAR_gitea_internal_token=$GITEA_INTERNAL_TOKEN TF_VAR_gitea_jwt_secret=$GITEA_JWT_SECRET TF_VAR_server_api_duo_client_id=$SERVER_API_DUO_CLIENT_ID TF_VAR_server_api_duo_client_secret=$SERVER_API_DUO_CLIENT_SECRET -TF_VAR_server_api_access_token=$SERVER_API_ACCESS_TOKEN \ No newline at end of file +TF_VAR_server_api_access_token=$SERVER_API_ACCESS_TOKEN +TF_VAR_wireguard_1_private_key=$WIREGUARD_1_PRIVATE_KEY +TF_VAR_wireguard_1_public_key=$WIREGUARD_1_PUBLIC_KEY +TF_VAR_wireguard_1_pre_shared_key=$WIREGUARD_1_PRE_SHARED_KEY diff --git a/terraform/k8sapps/variables.tf b/terraform/k8sapps/variables.tf index 234df9d..3c1f094 100644 --- a/terraform/k8sapps/variables.tf +++ b/terraform/k8sapps/variables.tf @@ -37,3 +37,9 @@ variable "mail_crypt_public_key" { description = "Mailcrypt public key" type = string } + +variable "wireguard_1_public_key" { + description = "The public key for Wireguard" + type = string +} + diff --git a/terraform/modules/apps/gitea/provider.tf b/terraform/modules/apps/gitea/provider.tf index 8b9fe2f..0f05a03 100644 --- a/terraform/modules/apps/gitea/provider.tf +++ b/terraform/modules/apps/gitea/provider.tf @@ -3,7 +3,7 @@ terraform { required_providers { kubernetes = { source = "hashicorp/kubernetes" - version = "~>2.18" + version = "2.36.0" } scaleway = { source = "scaleway/scaleway" diff --git a/terraform/modules/apps/m3uproxy/provider.tf b/terraform/modules/apps/m3uproxy/provider.tf index 3c8e1a0..2eaa508 100644 --- a/terraform/modules/apps/m3uproxy/provider.tf +++ b/terraform/modules/apps/m3uproxy/provider.tf @@ -3,7 +3,7 @@ terraform { required_providers { kubernetes = { source = "hashicorp/kubernetes" - version = "~>2.18" + version = "2.36.0" } } } diff --git a/terraform/modules/apps/mail/provider.tf b/terraform/modules/apps/mail/provider.tf index 8b9fe2f..0f05a03 100644 --- a/terraform/modules/apps/mail/provider.tf +++ b/terraform/modules/apps/mail/provider.tf @@ -3,7 +3,7 @@ terraform { required_providers { kubernetes = { source = "hashicorp/kubernetes" - version = "~>2.18" + version = "2.36.0" } scaleway = { source = "scaleway/scaleway" diff --git a/terraform/modules/apps/nginx-reverse-proxy/config.tf b/terraform/modules/apps/nginx-reverse-proxy/config.tf new file mode 100644 index 0000000..69f4577 --- /dev/null +++ b/terraform/modules/apps/nginx-reverse-proxy/config.tf @@ -0,0 +1,41 @@ +locals { + wireguard_version = "1.0.20210914-r4-ls54" + wireguard_config = try(templatefile("${path.module}/resources/wireguard/wireguard.conf.tpl", { + wireguard_private_key = var.wireguard_config.private_key + wireguard_public_key = var.wireguard_config.public_key + wireguard_pre_shared_key = var.wireguard_config.pre_shared_key + wireguard_address = var.wireguard_config.address + wireguard_dns = var.wireguard_config.dns + wireguard_allowed_ips = join(", ", var.wireguard_config.allowed_ips) + wireguard_endpoint = "${var.wireguard_config.endpoint}:${var.wireguard_config.endpoint_port}" + }), "null") + wireguard_config_checksum = nonsensitive(sha256(local.wireguard_config)) + + default_headers = { + "Host" : "$host", + "X-Real-IP" : "$remote_addr", + "X-Forwarded-For" : "$proxy_add_x_forwarded_for", + "X-Forwarded-Proto" : "$scheme", + "X-Forwarded-Host" : "$host", + "X-Forwarded-Port" : "$server_port", + } + nginx_config = file("${path.module}/resources/nginx/nginx.conf") + nginx_config_checksum = sha256(local.nginx_config) + + services_config = { + for k, v in var.services : "${k}.conf" => coalesce(v.config, templatefile("${path.module}/resources/nginx/conf.d/default.conf.tpl", { + http_port = v.http_port + https_port = v.https_port + upstream = v.upstream + tls = v.tls + fqdn = join(" ", v.fqdn) + locations = [for l in v.locations : { + path = l.path + headers = merge(l.headers, coalesce(v.default_headers, local.default_headers)) + }] + custom_snippet = v.custom_snippet + })) + } + services_config_checksum = sha256(jsonencode(local.services_config)) +} + diff --git a/terraform/modules/apps/nginx-reverse-proxy/main.tf b/terraform/modules/apps/nginx-reverse-proxy/main.tf new file mode 100644 index 0000000..288a634 --- /dev/null +++ b/terraform/modules/apps/nginx-reverse-proxy/main.tf @@ -0,0 +1,377 @@ +resource "kubernetes_namespace" "reverse_proxy" { + metadata { + annotations = { + name = "reverse-proxy" + } + + labels = { + name = "reverse-proxy" + } + + name = "reverse-proxy" + } +} + +resource "kubernetes_service_account" "reverse-proxy_service_account" { + + metadata { + name = "reverse-proxy-app-sa" + namespace = kubernetes_namespace.reverse_proxy.metadata[0].name + } + + automount_service_account_token = false +} + +resource "kubernetes_service" "reverse-proxy" { + for_each = var.services + metadata { + name = format("reverse-proxy-%s", replace(each.key, ".", "-")) + namespace = kubernetes_namespace.reverse_proxy.metadata[0].name + } + spec { + port { + name = "http" + port = 80 + target_port = substr(format("http-%s", replace(each.key, ".", "-")), 0, 15) + } + dynamic "port" { + for_each = each.value.tls ? [1] : [] + content { + name = "https" + port = 443 + target_port = substr(format("https-%s", replace(each.key, ".", "-")), 0, 15) + } + } + selector = { + app = "reverse-proxy" + } + cluster_ip = "None" + } +} + +resource "kubernetes_manifest" "internal_cert" { + + manifest = { + apiVersion = "cert-manager.io/v1" + kind = "Certificate" + metadata = { + name = "internal-cert" + namespace = kubernetes_namespace.reverse_proxy.metadata[0].name + } + spec = { + secretName = "internal-cert" + issuerRef = { + name = var.issuer_name + kind = "ClusterIssuer" + } + commonName = "reverse-proxy.internal" + dnsNames = flatten([for _, v in var.services : v.fqdn if v.tls == true]) + } + } +} + +resource "kubernetes_config_map" "wireguard_config" { + count = local.wireguard_config != "null" ? 1 : 0 + metadata { + name = "wireguard-config" + namespace = kubernetes_namespace.reverse_proxy.metadata[0].name + } + + data = { + "wireguard.conf" = local.wireguard_config + } +} + +resource "kubernetes_config_map" "nginx_config" { + metadata { + name = "nginx-config" + namespace = kubernetes_namespace.reverse_proxy.metadata[0].name + } + + data = { + "nginx.conf" = local.nginx_config + } +} + +resource "kubernetes_config_map" "nginx_default_config" { + metadata { + name = "nginx-default-config" + namespace = kubernetes_namespace.reverse_proxy.metadata[0].name + } + + data = local.services_config +} + +resource "kubernetes_ingress_v1" "reverse-proxy_ingress" { + for_each = var.services + metadata { + name = "reverse-proxy-ingress" + namespace = kubernetes_namespace.reverse_proxy.metadata[0].name + + annotations = merge({ + "kubernetes.io/ingress.class" = "public" + "cert-manager.io/cluster-issuer" = "letsencrypt-prod" + }, + each.value.tls ? { + "nginx.org/ssl-services" = format("reverse-proxy-%s", replace(each.key, ".", "-")) + "nginx.org/ssl-redirect" = "true" + "nginx.org/redirect-to-https" = "true" + "nginx.ingress.kubernetes.io/backend-protocol" = "HTTPS" + } : {}) + } + spec { + tls { + hosts = each.value.fqdn + secret_name = format("reverse-proxy-%s-tls", replace(each.key, ".", "-")) + } + dynamic "rule" { + for_each = each.value.fqdn + content { + host = rule.value + http { + path { + backend { + service { + name = format("reverse-proxy-%s", replace(each.key, ".", "-")) + port { + name = each.value.tls ? "https" : "http" + } + } + } + } + } + } + } + } +} + +resource "kubernetes_deployment" "reverse_proxy" { + + metadata { + name = "reverse-proxy" + namespace = kubernetes_namespace.reverse_proxy.metadata[0].name + + annotations = { + "security.alpha.kubernetes.io/unsafe-sysctls" = "net.ipv4.conf.all.src_valid_mark=1" + } + } + + spec { + replicas = 1 + + selector { + match_labels = { + app = "reverse-proxy" + } + } + + strategy { + type = "Recreate" + } + + template { + metadata { + labels = { + app = "reverse-proxy" + } + annotations = { + "checksum/nginx" = local.nginx_config_checksum + "checksum/services" = local.services_config_checksum + "checksum/wireguard" = local.wireguard_config_checksum + } + } + spec { + dynamic "container" { + for_each = local.wireguard_config != "null" ? [1] : [] + content { + + name = "wireguard" + image = "linuxserver/wireguard:${local.wireguard_version}" + + resources { + requests = { + memory = "64Mi" + } + } + + liveness_probe { + exec { + command = [ + "/bin/sh", + "-c", + "wg show | grep -q transfer" + ] + } + initial_delay_seconds = 90 + period_seconds = 90 + } + + security_context { + privileged = true + capabilities { + add = ["NET_ADMIN"] + } + } + + env { + name = "PUID" + value = "1000" + } + + env { + name = "PGID" + value = "1000" + } + + env { + name = "TZ" + value = "Europe/Berlin" + } + + volume_mount { + name = "wireguard-config" + mount_path = "/config/wg_confs" + read_only = true + } + + volume_mount { + name = "lib-modules" + mount_path = "/lib/modules" + read_only = true + } + } + } + + container { + name = "reverse-proxy" + image = "nginx:${var.tag}" + image_pull_policy = "Always" + + resources { + requests = { + memory = "100Mi" + } + } + + readiness_probe { + http_get { + path = "/" + port = 8080 + } + initial_delay_seconds = 5 + period_seconds = 10 + } + + liveness_probe { + http_get { + path = "/" + port = 8080 + } + initial_delay_seconds = 5 + period_seconds = 10 + } + + security_context { + allow_privilege_escalation = false + } + + dynamic "port" { + for_each = { for k, v in var.services : k => v.http_port } + content { + container_port = port.value + name = substr(format("http-%s", replace(port.key, ".", "-")), 0, 15) + } + } + + dynamic "port" { + for_each = { for k, v in var.services : k => v.https_port if v.tls } + content { + container_port = port.value + name = substr(format("https-%s", replace(port.key, ".", "-")), 0, 15) + } + } + + volume_mount { + name = "nginx" + mount_path = "/etc/nginx/nginx.conf" + sub_path = "nginx.conf" + read_only = true + } + + volume_mount { + name = "services" + mount_path = "/etc/nginx/conf.d/" + read_only = true + } + + dynamic "volume_mount" { + for_each = length([for v in var.services : v.tls if v.tls == true]) > 0 ? [1] : [] + content { + name = "tls" + mount_path = "/etc/ssl/certs/private" + read_only = true + } + } + } + + dynamic "volume" { + for_each = local.wireguard_config != "null" ? [1] : [] + content { + name = "wireguard-config" + config_map { + name = kubernetes_config_map.wireguard_config[0].metadata[0].name + } + } + } + + dynamic "volume" { + for_each = local.wireguard_config != "null" ? [1] : [] + content { + name = "lib-modules" + host_path { + path = "/lib/modules" + } + } + } + + volume { + name = "nginx" + config_map { + name = kubernetes_config_map.nginx_config.metadata[0].name + } + } + + volume { + name = "services" + config_map { + name = kubernetes_config_map.nginx_default_config.metadata[0].name + } + } + + dynamic "volume" { + for_each = length([for v in var.services : v.tls if v.tls == true]) > 0 ? [1] : [] + content { + name = "tls" + secret { + secret_name = kubernetes_manifest.internal_cert.manifest["metadata"]["name"] + items { + key = "tls.crt" + path = "tls.crt" + } + items { + key = "tls.key" + path = "tls.key" + } + } + } + } + + } + } + } + + lifecycle { + ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]] + } +} + diff --git a/terraform/modules/apps/nginx-reverse-proxy/provider.tf b/terraform/modules/apps/nginx-reverse-proxy/provider.tf new file mode 100644 index 0000000..0f05a03 --- /dev/null +++ b/terraform/modules/apps/nginx-reverse-proxy/provider.tf @@ -0,0 +1,13 @@ +terraform { + required_version = "~>1.8" + required_providers { + kubernetes = { + source = "hashicorp/kubernetes" + version = "2.36.0" + } + scaleway = { + source = "scaleway/scaleway" + version = "~>2.13" + } + } +} diff --git a/terraform/modules/apps/nginx-reverse-proxy/resources/nginx/conf.d/default.conf.tpl b/terraform/modules/apps/nginx-reverse-proxy/resources/nginx/conf.d/default.conf.tpl new file mode 100644 index 0000000..fdff5a7 --- /dev/null +++ b/terraform/modules/apps/nginx-reverse-proxy/resources/nginx/conf.d/default.conf.tpl @@ -0,0 +1,22 @@ +server { + listen ${http_port}; +%{ if tls ~} + listen ${https_port} ssl; + ssl_certificate /etc/ssl/certs/private/tls.crt; + ssl_certificate_key /etc/ssl/certs/private/tls.key; + ssl_protocols TLSv1.2 TLSv1.3; +%{ endif ~} + server_name ${fqdn}; +%{ if custom_snippet != "" ~} +${custom_snippet} +%{ endif ~} +%{ for l in locations ~} + location ${l.path} { + proxy_pass ${upstream}; + proxy_http_version 1.1; +%{ for k,v in l.headers ~} + proxy_set_header ${k} ${v}; +%{ endfor ~} + } +%{ endfor ~} +} diff --git a/terraform/modules/apps/nginx-reverse-proxy/resources/nginx/nginx.conf b/terraform/modules/apps/nginx-reverse-proxy/resources/nginx/nginx.conf new file mode 100644 index 0000000..185ece8 --- /dev/null +++ b/terraform/modules/apps/nginx-reverse-proxy/resources/nginx/nginx.conf @@ -0,0 +1,36 @@ +worker_processes auto; + +error_log /var/log/nginx/error.log notice; +pid /tmp/nginx.pid; + + +events { + worker_connections 1024; +} + +http { + proxy_temp_path /tmp/proxy_temp; + client_body_temp_path /tmp/client_temp; + fastcgi_temp_path /tmp/fastcgi_temp; + uwsgi_temp_path /tmp/uwsgi_temp; + scgi_temp_path /tmp/scgi_temp; + + client_max_body_size 10M; + proxy_buffering off; + proxy_request_buffering off; + + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + + keepalive_timeout 65; + + include /etc/nginx/conf.d/*.conf; +} \ No newline at end of file diff --git a/terraform/modules/apps/nginx-reverse-proxy/resources/wireguard/wireguard.conf.tpl b/terraform/modules/apps/nginx-reverse-proxy/resources/wireguard/wireguard.conf.tpl new file mode 100644 index 0000000..f3f495c --- /dev/null +++ b/terraform/modules/apps/nginx-reverse-proxy/resources/wireguard/wireguard.conf.tpl @@ -0,0 +1,10 @@ +[Interface] +PrivateKey = ${wireguard_private_key} +Address = ${wireguard_address} + +[Peer] +PublicKey = ${wireguard_public_key} +PresharedKey = ${wireguard_pre_shared_key} +AllowedIPs = ${wireguard_allowed_ips} +Endpoint = ${wireguard_endpoint} +PersistentKeepalive = 25 diff --git a/terraform/modules/apps/nginx-reverse-proxy/variables.tf b/terraform/modules/apps/nginx-reverse-proxy/variables.tf new file mode 100644 index 0000000..69b366e --- /dev/null +++ b/terraform/modules/apps/nginx-reverse-proxy/variables.tf @@ -0,0 +1,45 @@ +variable "tag" { + description = "The version of the nginx server to install" + type = string + default = "stable-alpine" +} + +variable "wireguard_config" { + description = "The Wireguard configuration file" + type = object({ + private_key = string + public_key = string + pre_shared_key = string + endpoint = string + endpoint_port = number + address = string + dns = string + allowed_ips = list(string) + }) + default = null + sensitive = true +} + +variable "issuer_name" { + description = "The name of the issuer to use for TLS certificates, internal certificates" + type = string + default = "internal-ca" +} + +variable "services" { + description = "A list of services to be deployed" + type = map(object({ + fqdn = list(string) + upstream = string + default_headers = optional(map(string), {}), + http_port = optional(number, 80) + https_port = optional(number, 443) + tls = optional(bool, false) + locations = optional(list(object({ + path = string, + headers = optional(map(string), {}), + })), []) + custom_snippet = optional(string, "") + config = optional(string, "") + })) +} diff --git a/terraform/modules/apps/nginx/config.tf b/terraform/modules/apps/nginx/config.tf index 492abef..6191cd6 100644 --- a/terraform/modules/apps/nginx/config.tf +++ b/terraform/modules/apps/nginx/config.tf @@ -1,7 +1,6 @@ locals { persistent_folder = var.persistent_folder websites_path = "${local.persistent_folder}/web" - websites = var.websites nginx_config = file("${path.module}/resources/nginx.conf") nginx_config_checksum = sha256(local.nginx_config) diff --git a/terraform/modules/apps/nginx/main.tf b/terraform/modules/apps/nginx/main.tf index beda68b..ac80fc8 100644 --- a/terraform/modules/apps/nginx/main.tf +++ b/terraform/modules/apps/nginx/main.tf @@ -23,7 +23,7 @@ resource "kubernetes_service_account" "website_service_account" { } resource "kubernetes_service" "website" { - for_each = local.websites + for_each = var.websites metadata { name = format("website-%s", replace(each.key, ".", "-")) namespace = kubernetes_namespace.website.metadata[0].name @@ -35,7 +35,7 @@ resource "kubernetes_service" "website" { target_port = "http" } dynamic "port" { - for_each = each.value.tls ? [443] : [] + for_each = each.value.tls ? [1] : [] content { name = "https" port = 443 @@ -51,7 +51,7 @@ resource "kubernetes_service" "website" { resource "kubernetes_manifest" "internal_cert" { for_each = { - for k, v in local.websites : k => v if v.tls == true + for k, v in var.websites : k => v if v.tls == true } manifest = { apiVersion = "cert-manager.io/v1" @@ -84,7 +84,7 @@ resource "kubernetes_config_map" "nginx_config" { } resource "kubernetes_config_map" "nginx_default_config" { - for_each = local.websites + for_each = var.websites metadata { name = format("website-%s-default", replace(each.key, ".", "-")) namespace = kubernetes_namespace.website.metadata[0].name @@ -100,7 +100,7 @@ resource "kubernetes_config_map" "nginx_default_config" { } resource "kubernetes_ingress_v1" "website_ingress" { - for_each = local.websites + for_each = var.websites metadata { name = "website-ingress" namespace = kubernetes_namespace.website.metadata[0].name @@ -144,7 +144,7 @@ resource "kubernetes_ingress_v1" "website_ingress" { } resource "kubernetes_deployment" "website" { - for_each = local.websites + for_each = var.websites metadata { name = "website-app" diff --git a/terraform/modules/apps/nginx/provider.tf b/terraform/modules/apps/nginx/provider.tf index 8b9fe2f..0f05a03 100644 --- a/terraform/modules/apps/nginx/provider.tf +++ b/terraform/modules/apps/nginx/provider.tf @@ -3,7 +3,7 @@ terraform { required_providers { kubernetes = { source = "hashicorp/kubernetes" - version = "~>2.18" + version = "2.36.0" } scaleway = { source = "scaleway/scaleway" diff --git a/terraform/modules/apps/rustdesk/provider.tf b/terraform/modules/apps/rustdesk/provider.tf index 3c8e1a0..2eaa508 100644 --- a/terraform/modules/apps/rustdesk/provider.tf +++ b/terraform/modules/apps/rustdesk/provider.tf @@ -3,7 +3,7 @@ terraform { required_providers { kubernetes = { source = "hashicorp/kubernetes" - version = "~>2.18" + version = "2.36.0" } } } diff --git a/terraform/modules/apps/sftpgo/provider.tf b/terraform/modules/apps/sftpgo/provider.tf index 17ea632..aff5aac 100644 --- a/terraform/modules/apps/sftpgo/provider.tf +++ b/terraform/modules/apps/sftpgo/provider.tf @@ -3,7 +3,7 @@ terraform { required_providers { kubernetes = { source = "hashicorp/kubernetes" - version = "~>2.18" + version = "2.36.0" } scaleway = { source = "scaleway/scaleway" diff --git a/terraform/modules/apps/ssh_locker_web/provider.tf b/terraform/modules/apps/ssh_locker_web/provider.tf index 3c8e1a0..2eaa508 100644 --- a/terraform/modules/apps/ssh_locker_web/provider.tf +++ b/terraform/modules/apps/ssh_locker_web/provider.tf @@ -3,7 +3,7 @@ terraform { required_providers { kubernetes = { source = "hashicorp/kubernetes" - version = "~>2.18" + version = "2.36.0" } } } diff --git a/terraform/modules/db/mariadb/provider.tf b/terraform/modules/db/mariadb/provider.tf index d1b0a1a..4015b4b 100644 --- a/terraform/modules/db/mariadb/provider.tf +++ b/terraform/modules/db/mariadb/provider.tf @@ -3,7 +3,7 @@ terraform { required_providers { kubernetes = { source = "hashicorp/kubernetes" - version = "~>2.18" + version = "2.36.0" } } } diff --git a/terraform/modules/utils/scw_rclone/provider.tf b/terraform/modules/utils/scw_rclone/provider.tf index d1b0a1a..4015b4b 100644 --- a/terraform/modules/utils/scw_rclone/provider.tf +++ b/terraform/modules/utils/scw_rclone/provider.tf @@ -3,7 +3,7 @@ terraform { required_providers { kubernetes = { source = "hashicorp/kubernetes" - version = "~>2.18" + version = "2.36.0" } } }