Add custom error pages and Nginx configuration for proxy module
- Introduced custom HTML error pages for various HTTP status codes (400, 401, 403, 404, 408, 429, 500, 502, 503, 504) in the proxy module. - Created a .gitignore file to exclude non-HTML files in the error resources directory. - Updated Nginx configuration to serve custom error pages for upstream errors. - Added new Nginx configuration templates for handling HTTP and stream protocols. - Implemented Wireguard configuration templates and associated variables for secure connections. - Established Kubernetes resources for Stunnel and Wireguard, including deployment, service accounts, and config maps. - Defined variables for the Stunnel and Wireguard modules to facilitate configuration. - Created a new Wol Proxy module with Kubernetes resources for deployment and service management.
This commit is contained in:
@@ -0,0 +1,20 @@
|
||||
locals {
|
||||
wireguard_version = var.wireguard_version
|
||||
wireguard_config = try(templatefile("${path.module}/resources/wireguard.conf.tpl", {
|
||||
wireguard_private_key = var.wireguard_config.private_key
|
||||
wireguard_public_key = var.wireguard_config.public_key
|
||||
wireguard_pre_shared_key = var.wireguard_config.pre_shared_key
|
||||
wireguard_address = var.wireguard_config.address
|
||||
wireguard_dns = var.wireguard_config.dns
|
||||
wireguard_allowed_ips = join(", ", var.wireguard_config.allowed_ips)
|
||||
wireguard_endpoint = "${var.wireguard_config.endpoint}:${var.wireguard_config.endpoint_port}"
|
||||
}), "null")
|
||||
wireguard_config_checksum = nonsensitive(sha256(local.wireguard_config))
|
||||
|
||||
stunnel_version = var.stunnel_version
|
||||
stunnel_config = templatefile("${path.module}/resources/stunnel.conf.tpl", {
|
||||
local_targets = var.local_targets
|
||||
remote_targets = var.remote_targets
|
||||
})
|
||||
stunnel_config_checksum = sha256(local.stunnel_config)
|
||||
}
|
||||
@@ -0,0 +1,289 @@
|
||||
resource "kubernetes_namespace" "stunnel" {
|
||||
metadata {
|
||||
name = "stunnel"
|
||||
annotations = {
|
||||
name = "stunnel"
|
||||
}
|
||||
labels = {
|
||||
name = "stunnel"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_service_account" "stunnel_service_account" {
|
||||
|
||||
metadata {
|
||||
name = "stunnel-app-sa"
|
||||
namespace = kubernetes_namespace.stunnel.metadata[0].name
|
||||
}
|
||||
|
||||
automount_service_account_token = false
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_config_map" "wireguard_config" {
|
||||
count = local.wireguard_config != "null" ? 1 : 0
|
||||
metadata {
|
||||
name = "wireguard-config"
|
||||
namespace = kubernetes_namespace.stunnel.metadata[0].name
|
||||
}
|
||||
|
||||
data = {
|
||||
"wireguard.conf" = local.wireguard_config
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_config_map" "stunnel_config" {
|
||||
metadata {
|
||||
name = "stunnel-config"
|
||||
namespace = kubernetes_namespace.stunnel.metadata[0].name
|
||||
}
|
||||
|
||||
data = {
|
||||
"stunnel.conf" = local.stunnel_config
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_deployment" "stunnel" {
|
||||
|
||||
metadata {
|
||||
name = "stunnel"
|
||||
namespace = kubernetes_namespace.stunnel.metadata[0].name
|
||||
|
||||
annotations = {
|
||||
"security.alpha.kubernetes.io/unsafe-sysctls" = "net.ipv4.conf.all.src_valid_mark=1"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = 1
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = "stunnel"
|
||||
}
|
||||
}
|
||||
|
||||
strategy {
|
||||
type = "Recreate"
|
||||
}
|
||||
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = "stunnel"
|
||||
}
|
||||
annotations = {
|
||||
"checksum/stunnel" = local.stunnel_config_checksum
|
||||
"checksum/wireguard" = local.wireguard_config_checksum
|
||||
}
|
||||
}
|
||||
spec {
|
||||
|
||||
dynamic "container" {
|
||||
for_each = nonsensitive(local.wireguard_config) != "null" ? [1] : []
|
||||
content {
|
||||
|
||||
name = "wireguard"
|
||||
image = "linuxserver/wireguard:${local.wireguard_version}"
|
||||
|
||||
resources {
|
||||
requests = {
|
||||
memory = "64Mi"
|
||||
}
|
||||
}
|
||||
|
||||
liveness_probe {
|
||||
exec {
|
||||
command = [
|
||||
"/bin/sh",
|
||||
"-c",
|
||||
"wg show | grep -q transfer"
|
||||
]
|
||||
}
|
||||
initial_delay_seconds = 90
|
||||
period_seconds = 90
|
||||
}
|
||||
|
||||
security_context {
|
||||
privileged = true
|
||||
capabilities {
|
||||
add = ["NET_ADMIN"]
|
||||
}
|
||||
read_only_root_filesystem = true
|
||||
}
|
||||
|
||||
env {
|
||||
name = "PUID"
|
||||
value = "1000"
|
||||
}
|
||||
|
||||
env {
|
||||
name = "PGID"
|
||||
value = "1000"
|
||||
}
|
||||
|
||||
env {
|
||||
name = "TZ"
|
||||
value = "Europe/Berlin"
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
name = "wireguard-config"
|
||||
mount_path = "/config/wg_confs"
|
||||
read_only = true
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
name = "lib-modules"
|
||||
mount_path = "/lib/modules"
|
||||
read_only = true
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
name = "wireguard-run"
|
||||
mount_path = "/run"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
container {
|
||||
name = "stunnel"
|
||||
image = "chainguard/stunnel:${local.stunnel_version}"
|
||||
args = ["/etc/conf/stunnel.conf"]
|
||||
volume_mount {
|
||||
name = "stunnel-config"
|
||||
mount_path = "/etc/conf"
|
||||
read_only = true
|
||||
}
|
||||
volume_mount {
|
||||
name = "stunnel-certs"
|
||||
mount_path = "/etc/ssl/certs/private"
|
||||
read_only = true
|
||||
}
|
||||
dynamic "port" {
|
||||
for_each = var.remote_targets
|
||||
content {
|
||||
container_port = port.value.listen_port
|
||||
name = substr(replace(port.key, ".", "-"), 0, 15)
|
||||
protocol = coalesce(upper(port.value.protocol), "TCP")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "volume" {
|
||||
for_each = nonsensitive(local.wireguard_config) != "null" ? [1] : []
|
||||
content {
|
||||
name = "wireguard-config"
|
||||
config_map {
|
||||
name = nonsensitive(kubernetes_config_map.wireguard_config[0].metadata[0].name)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "volume" {
|
||||
for_each = nonsensitive(local.wireguard_config) != "null" ? [1] : []
|
||||
content {
|
||||
name = "lib-modules"
|
||||
host_path {
|
||||
path = "/lib/modules"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "volume" {
|
||||
for_each = nonsensitive(local.wireguard_config) != "null" ? [1] : []
|
||||
content {
|
||||
name = "wireguard-run"
|
||||
empty_dir {
|
||||
medium = "Memory"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
volume {
|
||||
name = "stunnel-config"
|
||||
config_map {
|
||||
name = kubernetes_config_map.stunnel_config.metadata[0].name
|
||||
}
|
||||
}
|
||||
|
||||
volume {
|
||||
name = "stunnel-certs"
|
||||
secret {
|
||||
secret_name = "remote-targets-cert"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]]
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_manifest" "remote_targets_cert" {
|
||||
|
||||
manifest = {
|
||||
apiVersion = "cert-manager.io/v1"
|
||||
kind = "Certificate"
|
||||
metadata = {
|
||||
name = "remote-targets-cert"
|
||||
namespace = kubernetes_namespace.stunnel.metadata[0].name
|
||||
}
|
||||
spec = {
|
||||
secretName = "remote-targets-cert"
|
||||
issuerRef = {
|
||||
name = var.issuer_name
|
||||
kind = "ClusterIssuer"
|
||||
}
|
||||
commonName = "stunnel.remote_targets.internal"
|
||||
dnsNames = flatten([
|
||||
for k, v in var.remote_targets : "${k}.stunnel.svc.cluster.local"
|
||||
])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_manifest" "local_targets_cert" {
|
||||
|
||||
manifest = {
|
||||
apiVersion = "cert-manager.io/v1"
|
||||
kind = "Certificate"
|
||||
metadata = {
|
||||
name = "local-targets-cert"
|
||||
namespace = kubernetes_namespace.stunnel.metadata[0].name
|
||||
}
|
||||
spec = {
|
||||
secretName = "local-targets-cert"
|
||||
issuerRef = {
|
||||
name = var.issuer_name
|
||||
kind = "ClusterIssuer"
|
||||
}
|
||||
commonName = "stunnel.local_targets.internal"
|
||||
dnsNames = flatten([
|
||||
for _, v in var.local_targets : v.target_host
|
||||
])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_service" "services" {
|
||||
for_each = var.remote_targets
|
||||
metadata {
|
||||
name = format("%s", replace(each.key, ".", "-"))
|
||||
namespace = kubernetes_namespace.stunnel.metadata[0].name
|
||||
}
|
||||
spec {
|
||||
port {
|
||||
name = substr(format("%s", replace(each.key, ".", "-")), 0, 15)
|
||||
port = each.value.listen_port
|
||||
target_port = substr(format("%s", replace(each.key, ".", "-")), 0, 15)
|
||||
}
|
||||
selector = {
|
||||
app = "stunnel"
|
||||
}
|
||||
type = "ClusterIP"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
terraform {
|
||||
required_version = "~>1.8"
|
||||
required_providers {
|
||||
kubernetes = {
|
||||
source = "hashicorp/kubernetes"
|
||||
version = "2.36.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
foreground = yes
|
||||
|
||||
%{ for target in local_targets ~}
|
||||
[server-${target.listen_port}]
|
||||
accept = 0.0.0.0:${target.listen_port}
|
||||
connect = ${target.target_host}:${target.target_port}
|
||||
cert = /etc/ssl/certs/private/tls.crt
|
||||
key = /etc/ssl/certs/private/tls.key
|
||||
%{ endfor ~}
|
||||
|
||||
%{ for target in remote_targets ~}
|
||||
[client-${target.listen_port}]
|
||||
client = yes
|
||||
accept = 0.0.0.0:${target.listen_port}
|
||||
connect = ${target.target_host}:${target.target_port}
|
||||
%{ endfor ~}
|
||||
@@ -0,0 +1,10 @@
|
||||
[Interface]
|
||||
PrivateKey = ${wireguard_private_key}
|
||||
Address = ${wireguard_address}
|
||||
|
||||
[Peer]
|
||||
PublicKey = ${wireguard_public_key}
|
||||
PresharedKey = ${wireguard_pre_shared_key}
|
||||
AllowedIPs = ${wireguard_allowed_ips}
|
||||
Endpoint = ${wireguard_endpoint}
|
||||
PersistentKeepalive = 25
|
||||
@@ -0,0 +1,55 @@
|
||||
variable "stunnel_version" {
|
||||
description = "Stunnel image version"
|
||||
type = string
|
||||
default = "latest"
|
||||
}
|
||||
|
||||
variable "wireguard_version" {
|
||||
description = "Wireguard image version"
|
||||
type = string
|
||||
default = "1.0.20210914-r4-ls54"
|
||||
}
|
||||
|
||||
variable "issuer_name" {
|
||||
description = "The name of the issuer to use for TLS certificates, internal certificates"
|
||||
type = string
|
||||
default = "internal-ca"
|
||||
}
|
||||
|
||||
variable "local_targets" {
|
||||
description = "Map of local services to expose via stunnel"
|
||||
type = map(object({
|
||||
listen_port = number
|
||||
target_host = string
|
||||
target_port = number
|
||||
protocol = string
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "wireguard_config" {
|
||||
description = "The Wireguard configuration file"
|
||||
type = object({
|
||||
private_key = string
|
||||
public_key = string
|
||||
pre_shared_key = string
|
||||
endpoint = string
|
||||
endpoint_port = number
|
||||
address = string
|
||||
dns = string
|
||||
allowed_ips = list(string)
|
||||
})
|
||||
default = null
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
variable "remote_targets" {
|
||||
description = "Map of remote services to connect to via stunnel"
|
||||
type = map(object({
|
||||
listen_port = number
|
||||
target_host = string
|
||||
target_port = number
|
||||
protocol = string
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
Reference in New Issue
Block a user