alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Add custom error pages and Nginx configuration for proxy module

Browse Source 
- Introduced custom HTML error pages for various HTTP status codes (400, 401, 403, 404, 408, 429, 500, 502, 503, 504) in the proxy module.
- Created a .gitignore file to exclude non-HTML files in the error resources directory.
- Updated Nginx configuration to serve custom error pages for upstream errors.
- Added new Nginx configuration templates for handling HTTP and stream protocols.
- Implemented Wireguard configuration templates and associated variables for secure connections.
- Established Kubernetes resources for Stunnel and Wireguard, including deployment, service accounts, and config maps.
- Defined variables for the Stunnel and Wireguard modules to facilitate configuration.
- Created a new Wol Proxy module with Kubernetes resources for deployment and service management.
This commit is contained in:
Alexandre Pires
2025-10-02 00:19:01 +02:00
parent 4d00986273
commit e6a3f3affd
62 changed files with 1517 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/apps/dev-01/apps.tf
+18 -4
View File
@@ -21,10 +21,10 @@ module "dns" {
zones = local.zones
}
module "reverse_proxy" {
source = "../../modules/apps/nginx-reverse-proxy"
module "proxy" {
source = "../../modules/utils/proxy"
services = local.reverse_proxy_services
services = local.proxy_services
streams = local.streams
}
@@ -42,9 +42,23 @@ module "nextcloud" {
}
module "comfyui_proxy" {
source = "../../modules/apps/wol_proxy"
source = "../../modules/utils/wol_proxy"
upstream = local.comfyui_proxy
proxy_port = local.comfyui_proxy.port
namespace = "comfyui"
}
module "prometheus" {
source = "../../modules/utils/prometheus"
persistent_folder = "${local.persistent_folder}/monitoring"
config = file("${path.module}/resources/prometheus.yml")
}
module "grafana" {
source = "../../modules/apps/grafana"
persistent_folder = "${local.persistent_folder}/monitoring"
fqdn = local.grafana_fqdn
}
terraform/apps/dev-01/config.tf
+36 -9
View File
@@ -72,16 +72,31 @@ locals {
type = "CNAME"
content = "dev-01.${local.lab_domain}."
},
{
name = "grafana"
type = "CNAME"
content = "dev-01.${local.lab_domain}."
},
{
name = "prometheus"
type = "CNAME"
content = "dev-01.${local.lab_domain}."
},
{
name = "game-01"
type = "A"
content = "10.19.4.245"
},
{
name = "prod-01"
type = "A"
content = "10.5.5.2"
},
]
}
]
reverse_proxy_services = {
proxy_services = {
"comfyui" = {
http_port = 8080
https_port = 8443
@@ -102,14 +117,15 @@ locals {
streams = {
"dns" = {
port = 53
upstream = "dns.dns.svc.cluster.local"
protocol = "udp"
port = 53
host_port = 53
upstream = "dns.dns.svc.cluster.local"
protocol = "udp"
}
}
ollama_proxy = {
enabled = true
enabled = true
mac = "04:7c:16:d6:63:66"
ip = "10.19.4.106"
port = "11434"
@@ -117,10 +133,10 @@ locals {
}
comfyui_proxy = {
mac = "04:7c:16:d6:63:66"
ip = "10.19.4.106"
port = "8188"
scheme = "http"
mac = "04:7c:16:d6:63:66"
ip = "10.19.4.106"
port = "8188"
scheme = "http"
}
scaleway_smtp_host = "smtp.tem.scw.cloud"
@@ -150,6 +166,17 @@ locals {
backup_app_api_secret_key = data.terraform_remote_state.scaleway.outputs.backup_app_api_secret_key
backup_app_api_access_key = data.terraform_remote_state.scaleway.outputs.backup_app_api_access_key
mail_app_api_secret_key = data.terraform_remote_state.scaleway.outputs.mail_app_api_secret_key
grafana_fqdn = "grafana.${local.lab_domain}"
remote_targets = {
"prometheus" = {
listen_port = 9090
target_host = "10.5.5.5"
target_port = 9090
protocol = "TCP"
}
}
}
data "terraform_remote_state" "scaleway" {
terraform/apps/dev-01/resources/prometheus.yml
+38
View File
@@ -0,0 +1,38 @@
global:
scrape_interval: 5s
evaluation_interval: 5s
rule_files:
- /etc/prometheus/prometheus.rules
scrape_configs:
- job_name: kubernetes-nodes-cadvisor
scrape_interval: 10s
scrape_timeout: 10s
scheme: https # remove if you want to scrape metrics on insecure port
tls_config:
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
insecure_skip_verify: true
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
kubernetes_sd_configs:
- role: node
relabel_configs:
- action: labelmap
regex: __meta_kubernetes_node_label_(.+)
# Only for Kubernetes ^1.7.3.
# See: https://github.com/prometheus/prometheus/issues/2916
- target_label: __address__
replacement: kubernetes.default.svc:443
- source_labels: [__meta_kubernetes_node_name]
regex: (.+)
target_label: __metrics_path__
replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor
metric_relabel_configs:
- action: replace
source_labels: [id]
regex: '^/machine\.slice/machine-rkt\\x2d([^\\]+)\\.+/([^/]+)\.service$'
target_label: rkt_container_name
replacement: "${2}-${1}"
- action: replace
source_labels: [id]
regex: '^/system\.slice/(.+)\.service$'
target_label: systemd_service_name
replacement: "${1}"
terraform/apps/prod-01/apps.tf
+15 -4
View File
@@ -54,6 +54,10 @@ module "mail" {
mail_crypt_public_key = var.mail_crypt_public_key
ca_pem = var.root_ca_pem
# For now we need to use host networking because of the fail2ban integration
postfix_use_host_networking = true
dovecot_use_host_networking = true
}
module "gitea" {
@@ -116,11 +120,18 @@ module "ssh_locker_web" {
socket_path = "/var/run/ssh_locker/provision.sock"
}
module "reverse_proxy" {
source = "../../modules/apps/nginx-reverse-proxy"
module "proxy" {
source = "../../modules/utils/proxy"
services = local.reverse_proxy_services
wireguard_config = local.reverse_proxy_wireguard_config
auth_token = var.nginx_token_bearer
services = local.proxy_services
streams = local.streams
wireguard_config = local.wireguard_config
}
module "prometheus" {
source = "../../modules/utils/prometheus"
persistent_folder = "${local.persistent_folder}/monitoring"
config = file("${path.module}/resources/prometheus.yml")
}
terraform/apps/prod-01/config.tf
+36 -23
View File
@@ -79,39 +79,52 @@ locals {
#reverse proxy settings
streams = {
"imap" = {
port = 993
upstream = "imap.mail.svc.cluster.local"
protocol = "tcp"
}
"smtps" = {
port = 465
upstream = "smtps.mail.svc.cluster.local"
protocol = "tcp"
}
# For now disabled, because this messes with fail2ban on the host
# since the ip is lost and replaced with the nginx ingress controller ip
# to fix this we might need to setup logging on the stream and cross reference
# with postfix/dovecot logs and then ban the ip on the host
# "imap" = {
# port = 993
# upstream = "imap.mail.svc.cluster.local"
# protocol = "tcp"
# }
# "smtps" = {
# port = 465
# upstream = "smtps.mail.svc.cluster.local"
# protocol = "tcp"
# }
"21115-tcp" = {
port = 21115
upstream = "tcp.rustdesk.svc.cluster.local"
protocol = "tcp"
port = 21115
host_port = 21115
upstream = "tcp.rustdesk.svc.cluster.local"
protocol = "tcp"
}
"21116-tcp" = {
port = 21116
upstream = "tcp.rustdesk.svc.cluster.local"
protocol = "tcp"
port = 21116
host_port = 21116
upstream = "tcp.rustdesk.svc.cluster.local"
protocol = "tcp"
}
"21116-udp" = {
port = 21116
upstream = "udp.rustdesk.svc.cluster.local"
protocol = "udp"
port = 21116
host_port = 21116
upstream = "udp.rustdesk.svc.cluster.local"
protocol = "udp"
}
"21117-tcp" = {
port = 21117
upstream = "tcp.rustdesk.svc.cluster.local"
port = 21117
host_port = 21117
upstream = "tcp.rustdesk.svc.cluster.local"
protocol = "tcp"
}
"9090-tcp" = {
port = 9090
upstream = "prometheus.prometheus.svc.cluster.local"
protocol = "tcp"
}
}
reverse_proxy_wireguard_config = {
wireguard_config = {
private_key = var.wireguard_1_private_key
public_key = var.wireguard_1_public_key
pre_shared_key = var.wireguard_1_pre_shared_key
@@ -125,7 +138,7 @@ locals {
]
}
reverse_proxy_services = {
proxy_services = {
"open-webui" = {
http_port = 8080
https_port = 8443
terraform/apps/prod-01/resources/prometheus.yml
+40
View File
@@ -0,0 +1,40 @@
global:
scrape_interval: 5s
evaluation_interval: 5s
rule_files:
- /etc/prometheus/prometheus.rules
scrape_configs:
- job_name: kubernetes-nodes-cadvisor
scrape_interval: 10s
scrape_timeout: 10s
scheme: https # remove if you want to scrape metrics on insecure port
tls_config:
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
insecure_skip_verify: true
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
kubernetes_sd_configs:
- role: node
relabel_configs:
- action: labelmap
regex: __meta_kubernetes_node_label_(.+)
# Only for Kubernetes ^1.7.3.
# See: https://github.com/prometheus/prometheus/issues/2916
- target_label: __address__
replacement: kubernetes.default.svc:443
- source_labels: [__meta_kubernetes_node_name]
regex: (.+)
target_label: __metrics_path__
replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor
metric_relabel_configs:
- action: replace
source_labels: [id]
regex: '^/machine\.slice/machine-rkt\\x2d([^\\]+)\\.+/([^/]+)\.service$'
target_label: rkt_container_name
replacement: "${2}-${1}"
- action: replace
source_labels: [id]
regex: '^/system\.slice/(.+)\.service$'
target_label: systemd_service_name
replacement: "${1}"
remote_write:
- url: "http://prometheus.reverse-proxy.svc.cluster.local:9090/api/v1/write"