Add custom error pages and Nginx configuration for proxy module

- Introduced custom HTML error pages for various HTTP status codes (400, 401, 403, 404, 408, 429, 500, 502, 503, 504) in the proxy module. - Created a .gitignore file to exclude non-HTML files in the error resources directory. - Updated Nginx configuration to serve custom error pages for upstream errors. - Added new Nginx configuration templates for handling HTTP and stream protocols. - Implemented Wireguard configuration templates and associated variables for secure connections. - Established Kubernetes resources for Stunnel and Wireguard, including deployment, service accounts, and config maps. - Defined variables for the Stunnel and Wireguard modules to facilitate configuration. - Created a new Wol Proxy module with Kubernetes resources for deployment and service management.
2025-10-02 00:19:01 +02:00
parent 4d00986273
commit e6a3f3affd
62 changed files with 1517 additions and 99 deletions
@@ -0,0 +1,74 @@
+locals {
+  wireguard_version = "1.0.20210914-r4-ls54"
+  wireguard_config = try(templatefile("${path.module}/resources/wireguard/wireguard.conf.tpl", {
+    wireguard_private_key    = var.wireguard_config.private_key
+    wireguard_public_key     = var.wireguard_config.public_key
+    wireguard_pre_shared_key = var.wireguard_config.pre_shared_key
+    wireguard_address        = var.wireguard_config.address
+    wireguard_dns            = var.wireguard_config.dns
+    wireguard_allowed_ips    = join(", ", var.wireguard_config.allowed_ips)
+    wireguard_endpoint       = "${var.wireguard_config.endpoint}:${var.wireguard_config.endpoint_port}"
+  }), "null")
+  wireguard_config_checksum = nonsensitive(sha256(local.wireguard_config))
+
+  default_headers = {
+    "Host" : "$host",
+    "X-Real-IP" : "$remote_addr",
+    "X-Forwarded-For" : "$proxy_add_x_forwarded_for",
+    "X-Forwarded-Proto" : "$scheme",
+    "X-Forwarded-Host" : "$host",
+    "X-Forwarded-Port" : "$server_port",
+  }
+  nginx_config          = file("${path.module}/resources/nginx/nginx.conf")
+  nginx_config_checksum = sha256(local.nginx_config)
+
+  services_config = {
+    for k, v in var.services : "${k}.conf" => coalesce(v.config, templatefile("${path.module}/resources/nginx/conf.d/default.conf.tpl", {
+      errors             = local.error_codes
+      http_port          = v.http_port
+      https_port         = v.https_port
+      upstream           = v.upstream
+      resolver           = v.resolver
+      ingress            = v.ingress
+      service_http_port  = v.service_http_port
+      service_https_port = v.service_https_port
+      tls                = v.tls
+      fqdn               = length(v.fqdn) > 0 ? join(" ", v.fqdn) : k
+      auth               = length([for l in v.locations : true if l.private]) > 0
+      locations = [for l in v.locations : {
+        path     = l.path
+        headers  = merge(l.headers, coalesce(v.default_headers, local.default_headers))
+        private  = l.private
+        upstream = l.upstream
+        resolver = l.resolver
+        rewrite  = l.rewrite
+      }]
+      custom_snippet = v.custom_snippet
+    }))
+  }
+  services_config_checksum = sha256(jsonencode(local.services_config))
+
+  streams_config = {
+    for k, v in var.streams : "${k}.conf" => templatefile("${path.module}/resources/nginx/streams.d/stream.conf.tpl", {
+      name           = k
+      port           = v.port
+      upstream       = v.upstream
+      custom_snippet = v.custom_snippet
+      upstream_port  = coalesce(v.upstream_port, v.port)
+      resolver       = v.resolver
+      protocol       = upper(v.protocol)
+    })
+  }
+  streams_config_checksum = sha256(jsonencode(local.streams_config))
+
+  auth_script          = file("${path.module}/resources/auth/auth_server.py")
+  auth_script_checksum = sha256(local.auth_script)
+
+  error_codes = [for f in fileset("${path.module}/resources/errors", "*.html") : split(".", f)[0]]
+  errors_pages = {
+    for f in local.error_codes :
+    "${f}.html" => file("${path.module}/resources/errors/${f}.html")
+  }
+  errors_pages_checksum = sha256(jsonencode(local.errors_pages))
+}
+