Addes support for reverse proxy to home server

terraform/k8sapps/apps.tf

@@ -139,3 +139,10 @@ module "ssh_locker_web" {
   redirect_uri      = "https://alexpires.me/api/ssh_locker/duo-callback"
   socket_path       = "/var/run/ssh_locker/provision.sock"
 }
+
+module "reverse_proxy" {
+  source = "../modules/apps/nginx-reverse-proxy"
+
+  services         = local.reverse_proxy_services
+  wireguard_config = local.reverse_proxy_wireguard_config
+}

terraform/k8sapps/config.tf

@@ -77,6 +77,44 @@ locals {
     }
   ]
 
+  #reverse proxy settings
+  reverse_proxy_wireguard_config = {
+    private_key    = var.wireguard_1_private_key
+    public_key     = var.wireguard_1_public_key
+    pre_shared_key = var.wireguard_1_pre_shared_key
+    endpoint       = "aristotle.alexpires.me"
+    endpoint_port  = 51820
+    address        = "10.5.5.2/32"
+    dns            = "10.19.4.1"
+    allowed_ips = [
+      "10.19.4.106/32",
+    ]
+  }
+
+  reverse_proxy_services = {
+    "open-webui" = {
+      http_port  = 8080
+      https_port = 8443
+      tls        = true
+      fqdn       = ["ai.alexpires.me"]
+      upstream   = "http://10.19.4.106:8080"
+      locations = [
+        {
+          path = "/ws/socket.io/"
+          headers = {
+            "Upgrade"    = "$http_upgrade"
+            "Connection" = "upgrade"
+          }
+        },
+        {
+          path = "/"
+        },
+      ]
+    }
+  }
+
+
+  # VPS configuration
   instance_ips = [
     "${local.vps_1.ip}/32",
   ]

terraform/k8sapps/provider.tf

@@ -19,7 +19,7 @@ terraform {
     }
     kubernetes = {
       source  = "hashicorp/kubernetes"
-      version = "~>2.18"
+      version = "2.36.0"
     }
     scaleway = {
       source  = "scaleway/scaleway"

terraform/k8sapps/secrets.tf

@@ -122,3 +122,15 @@ variable "server_api_access_token" {
   type        = string
   sensitive   = true
 }
+
+variable "wireguard_1_private_key" {
+  description = "The private key for Wireguard"
+  type        = string
+  sensitive   = true
+}
+
+variable "wireguard_1_pre_shared_key" {
+  description = "The pre-shared key for Wireguard"
+  type        = string
+  sensitive   = true
+}

terraform/k8sapps/sectool.env

@@ -30,4 +30,7 @@ TF_VAR_gitea_internal_token=$GITEA_INTERNAL_TOKEN
 TF_VAR_gitea_jwt_secret=$GITEA_JWT_SECRET
 TF_VAR_server_api_duo_client_id=$SERVER_API_DUO_CLIENT_ID
 TF_VAR_server_api_duo_client_secret=$SERVER_API_DUO_CLIENT_SECRET
-TF_VAR_server_api_access_token=$SERVER_API_ACCESS_TOKEN
+TF_VAR_server_api_access_token=$SERVER_API_ACCESS_TOKEN
+TF_VAR_wireguard_1_private_key=$WIREGUARD_1_PRIVATE_KEY
+TF_VAR_wireguard_1_public_key=$WIREGUARD_1_PUBLIC_KEY
+TF_VAR_wireguard_1_pre_shared_key=$WIREGUARD_1_PRE_SHARED_KEY

terraform/k8sapps/variables.tf

@@ -37,3 +37,9 @@ variable "mail_crypt_public_key" {
   description = "Mailcrypt public key"
   type        = string
 }
+
+variable "wireguard_1_public_key" {
+  description = "The public key for Wireguard"
+  type        = string
+}
+