Add custom error pages and Nginx configuration for proxy module

- Introduced custom HTML error pages for various HTTP status codes (400, 401, 403, 404, 408, 429, 500, 502, 503, 504) in the proxy module. - Created a .gitignore file to exclude non-HTML files in the error resources directory. - Updated Nginx configuration to serve custom error pages for upstream errors. - Added new Nginx configuration templates for handling HTTP and stream protocols. - Implemented Wireguard configuration templates and associated variables for secure connections. - Established Kubernetes resources for Stunnel and Wireguard, including deployment, service accounts, and config maps. - Defined variables for the Stunnel and Wireguard modules to facilitate configuration. - Created a new Wol Proxy module with Kubernetes resources for deployment and service management.
2025-10-02 00:19:01 +02:00
parent 4d00986273
commit e6a3f3affd
62 changed files with 1517 additions and 99 deletions
@@ -0,0 +1,216 @@
+resource "kubernetes_service_account" "prometheus" {
+  metadata {
+    name      = "prometheus"
+    namespace = kubernetes_namespace.monitoring.metadata[0].name
+  }
+}
+
+resource "kubernetes_cluster_role" "prometheus" {
+  metadata {
+    name = "prometheus"
+  }
+
+  rule {
+    api_groups = [""]
+    resources  = ["nodes", "nodes/proxy", "services", "endpoints", "pods"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  rule {
+    api_groups = ["extensions"]
+    resources  = ["ingresses"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  rule {
+    api_groups = ["networking.k8s.io"]
+    resources  = ["ingresses"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  rule {
+    non_resource_urls = ["/metrics"]
+    verbs             = ["get"]
+  }
+}
+
+resource "kubernetes_cluster_role_binding" "prometheus" {
+  metadata {
+    name = "prometheus"
+  }
+
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "ClusterRole"
+    name      = kubernetes_cluster_role.prometheus.metadata[0].name
+  }
+
+  subject {
+    kind      = "ServiceAccount"
+    name      = kubernetes_service_account.prometheus.metadata[0].name
+    namespace = kubernetes_namespace.monitoring.metadata[0].name
+  }
+}
+
+resource "kubernetes_config_map" "prometheus" {
+  metadata {
+    name      = "prometheus-server-conf"
+    namespace = kubernetes_namespace.monitoring.metadata[0].name
+    labels = {
+      name = "prometheus-server-conf"
+    }
+  }
+
+  data = {
+    "prometheus.rules" = local.prometheus_rules
+    "prometheus.yml"   = local.prometheus_config
+  }
+}
+
+resource "kubernetes_deployment" "prometheus" {
+  metadata {
+    name      = "prometheus"
+    namespace = kubernetes_namespace.monitoring.metadata[0].name
+    labels = {
+      app = "prometheus"
+    }
+  }
+
+  spec {
+    replicas = 1
+    strategy {
+      type = "Recreate"
+    }
+
+    selector {
+      match_labels = {
+        app = "prometheus"
+      }
+    }
+
+    template {
+
+      metadata {
+        labels = {
+          app = "prometheus"
+        }
+        annotations = {
+          "checksum/config" = local.prometheus_config_checksum
+          "checksum/rules"  = local.prometheus_rules_checksum
+        }
+      }
+
+      spec {
+        service_account_name = kubernetes_service_account.prometheus.metadata[0].name
+        container {
+          name  = "prometheus"
+          image = "prom/prometheus:${local.app_version}"
+          args = [
+            "--config.file=/etc/prometheus/prometheus.yml",
+            "--storage.tsdb.path=/prometheus/",
+            "--storage.tsdb.retention.time=${var.retention_time}",
+          ]
+
+          port {
+            name           = "http-prometheus"
+            container_port = 9090
+          }
+
+          security_context {
+            run_as_user                = 1000
+            run_as_group               = 1000
+            run_as_non_root            = true
+            allow_privilege_escalation = false
+          }
+
+          volume_mount {
+            name       = "prometheus-config-volume"
+            mount_path = "/etc/prometheus/"
+          }
+          volume_mount {
+            name       = "prometheus-storage-volume"
+            mount_path = "/prometheus"
+          }
+        }
+
+        volume {
+          name = "prometheus-config-volume"
+          config_map {
+            name = kubernetes_config_map.prometheus.metadata[0].name
+          }
+        }
+
+        volume {
+          name = "prometheus-storage-volume"
+          host_path {
+            path = local.data_folder
+            type = "DirectoryOrCreate"
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_service" "prometheus" {
+  metadata {
+    name      = "prometheus"
+    namespace = kubernetes_namespace.monitoring.metadata[0].name
+    annotations = {
+      "prometheus.io/scrape" = "true"
+      "prometheus.io/port"   = "9090"
+    }
+  }
+
+  spec {
+    selector = {
+      app = "prometheus"
+    }
+
+    type = "ClusterIP"
+
+    port {
+      port        = 9090
+      protocol    = "TCP"
+      target_port = "http-prometheus"
+    }
+  }
+}
+
+# resource "kubernetes_ingress_v1" "prometheus" {
+#   metadata {
+#     name      = "prometheus-ui"
+#     namespace = kubernetes_namespace.monitoring.metadata[0].name
+#     annotations = {
+#       "kubernetes.io/ingress.class" = var.ingress_class
+#     }
+#   }
+
+#   spec {
+#     rule {
+#       host = var.fqdn
+#       http {
+#         path {
+#           path      = "/"
+#           path_type = "Prefix"
+#           backend {
+#             service {
+#               name = kubernetes_service.prometheus.metadata[0].name
+#               port {
+#                 number = 8080
+#               }
+#             }
+#           }
+#         }
+#       }
+#     }
+
+#     dynamic "tls" {
+#       for_each = local.tls_crt_data != "" && local.tls_key_data != "" ? [1] : []
+#       content {
+#         hosts       = [var.fqdn]
+#         secret_name = local.tls_secret_name
+#       }
+#     }
+#   }
+# }