alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(mail): enhance mail configuration with getmail and dovecot settings

Browse Source 
- Added getmail configuration generation using template files.
- Introduced postfix and dovecot configuration checksums for deployment.
- Created new dovecot configuration file and sieve script for email handling.
- Updated main.tf to utilize local variables for configuration management.
- Removed redundant external password hasher from main.tf.

feat(nginx): improve nginx configuration management

- Centralized nginx configuration into a local variable with checksum.
- Created separate config maps for default website configurations.
- Updated deployment to utilize new configuration structure.

feat(sftpgo): add SFTPGo application deployment

- Introduced SFTPGo with Kubernetes resources including namespace, config maps, and secrets.
- Configured SFTPGo with SMTP settings and AWS credentials.
- Implemented health checks and volume mounts for persistent storage.

refactor(seafile): remove Seafile module

- Deleted Seafile module and associated resources as part of cleanup.
This commit is contained in:
Alexandre Pires
2025-05-05 00:47:36 +02:00
parent 6adbd50c6d
commit e6e85b00f7
60 changed files with 1107 additions and 604 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/modules/apps/m3uproxy/config.tf
+24 -6
View File
@@ -1,18 +1,19 @@
locals {
persistent_folder = var.persistent_folder
m3uproxy_version = var.tag
m3uproxy_fqdn = var.fqdn
wireguard_version = "1.0.20210914-r4-ls54"
squid_version = "6.1-23.10_edge"
persistent_folder = var.persistent_folder
m3uproxy_version = var.tag
m3uproxy_fqdn = var.fqdn
wireguard_version = "1.0.20210914-r4-ls54"
squid_version = "6.1-23.10_edge"
geoip_image = "maxmindinc/geoipupdate"
geoip_version = "latest"
geoip_cron_schedule = var.geoip_cron_schedule
geoip_editions = var.geoip_editions
geoip_path = "${local.m3uproxy_path}/geoip"
m3uproxy_path = "${local.persistent_folder}/m3uproxy"
m3uproxy_cache_path = "${local.m3uproxy_path}/cache"
squid_app_path = "${local.m3uproxy_path}/squid"
geoip_path = "${local.m3uproxy_path}/geoip"
wireguard_address = "192.168.5.3/32"
wireguard_dns = "192.168.5.1"
wireguard_allowed_ips = [
@@ -26,5 +27,22 @@ locals {
m3uproxy_config = templatefile("${path.module}/resources/m3uproxy/m3uproxy.json", {
m3uproxy_secret = var.secret
})
m3uproxy_config_checksum = nonsensitive(sha256(local.m3uproxy_config))
m3uproxy_playlist = file("${path.module}/resources/m3uproxy/playlist.json")
m3uproxy_playlist_checksum = sha256(local.m3uproxy_playlist)
wireguard_config = templatefile("${path.module}/resources/wireguard/wireguard.conf.tpl", {
wireguard_private_key = var.wireguard_private_key
wireguard_public_key = var.wireguard_public_key
wireguard_address = local.wireguard_address
wireguard_dns = local.wireguard_dns
wireguard_allowed_ips = join(", ", local.wireguard_allowed_ips)
wireguard_endpoint = "${local.wireguard_endpoint}:${local.wireguard_endpoint_port}"
})
wireguard_config_checksum = nonsensitive(sha256(local.wireguard_config))
squid_config = file("${path.module}/resources/squid/squid.conf")
squid_config_checksum = sha256(local.squid_config)
}
terraform/modules/apps/m3uproxy/geoip.tf
+97
View File
@@ -0,0 +1,97 @@
resource "kubernetes_secret" "geoip_maxmind_credentials" {
metadata {
name = "geoip-maxmind-credentials"
namespace = kubernetes_namespace.m3uproxy.metadata[0].name
}
data = {
account_id = var.maxmind_account_id
license_key = var.maxmind_license_key
}
type = "Opaque"
}
resource "kubernetes_cron_job_v1" "geoip_update" {
metadata {
name = "geoip-update"
namespace = kubernetes_namespace.m3uproxy.metadata[0].name
}
spec {
schedule = local.geoip_cron_schedule
job_template {
metadata {
name = "geoip-update"
}
spec {
template {
metadata {
labels = {
app = "geoip-update"
}
}
spec {
container {
name = "geoip-update"
image = "${local.geoip_image}:${local.geoip_version}"
env {
name = "GEOIPUPDATE_ACCOUNT_ID"
value_from {
secret_key_ref {
name = kubernetes_secret.geoip_maxmind_credentials.metadata[0].name
key = "account_id"
}
}
}
env {
name = "GEOIPUPDATE_LICENSE_KEY"
value_from {
secret_key_ref {
name = kubernetes_secret.geoip_maxmind_credentials.metadata[0].name
key = "license_key"
}
}
}
env {
name = "GEOIPUPDATE_EDITION_IDS"
value = join(" ", local.geoip_editions)
}
resources {
requests = {
memory = "64Mi"
}
}
volume_mount {
name = "geoip-db"
mount_path = "/usr/share/GeoIP"
}
security_context {
run_as_user = 1000
run_as_group = 1000
}
}
service_account_name = kubernetes_service_account.m3uproxy_service_account.metadata[0].name
restart_policy = "OnFailure"
volume {
name = "geoip-db"
host_path {
path = local.geoip_path
}
}
}
}
}
}
}
}
terraform/modules/apps/m3uproxy/main.tf
+6 -329
View File
@@ -22,20 +22,6 @@ resource "kubernetes_secret" "m3uproxy_admin_credentials" {
type = "Opaque"
}
resource "kubernetes_secret" "geoip_maxmind_credentials" {
metadata {
name = "geoip-maxmind-credentials"
namespace = kubernetes_namespace.m3uproxy.metadata[0].name
}
data = {
account_id = var.maxmind_account_id
license_key = var.maxmind_license_key
}
type = "Opaque"
}
resource "kubernetes_service_account" "m3uproxy_service_account" {
metadata {
@@ -46,36 +32,6 @@ resource "kubernetes_service_account" "m3uproxy_service_account" {
automount_service_account_token = false
}
resource "kubernetes_config_map" "wireguard_config" {
metadata {
name = "wireguard-config"
namespace = kubernetes_namespace.m3uproxy.metadata[0].name
}
data = {
"wireguard.conf" = templatefile("${path.module}/resources/wireguard/wireguard.conf.tpl", {
wireguard_private_key = var.wireguard_private_key
wireguard_public_key = var.wireguard_public_key
wireguard_address = local.wireguard_address
wireguard_dns = local.wireguard_dns
wireguard_allowed_ips = join(", ", local.wireguard_allowed_ips)
wireguard_endpoint = "${local.wireguard_endpoint}:${local.wireguard_endpoint_port}"
})
}
}
resource "kubernetes_config_map" "squid_config" {
metadata {
name = "squid-config"
namespace = kubernetes_namespace.m3uproxy.metadata[0].name
}
data = {
"squid.conf" = file("${path.module}/resources/squid/squid.conf")
}
}
resource "kubernetes_config_map" "m3uproxy_config" {
metadata {
name = "m3uproxy-config"
@@ -84,190 +40,10 @@ resource "kubernetes_config_map" "m3uproxy_config" {
data = {
"m3uproxy.json" = local.m3uproxy_config
"playlist.json" = file("${path.module}/resources/m3uproxy/playlist.json")
"playlist.json" = local.m3uproxy_playlist
}
}
resource "kubernetes_deployment" "proxy_pt" {
metadata {
name = "proxy-pt"
namespace = kubernetes_namespace.m3uproxy.metadata[0].name
annotations = {
"security.alpha.kubernetes.io/unsafe-sysctls" = "net.ipv4.conf.all.src_valid_mark=1"
}
}
spec {
replicas = 1
selector {
match_labels = {
app = "proxy-pt"
}
}
strategy {
type = "Recreate"
}
template {
metadata {
labels = {
app = "proxy-pt"
}
}
spec {
container {
name = "wireguard"
image = "linuxserver/wireguard:${local.wireguard_version}"
resources {
requests = {
memory = "64Mi"
}
}
liveness_probe {
exec {
command = [
"/bin/sh",
"-c",
"wg show | grep -q transfer"
]
}
initial_delay_seconds = 90
period_seconds = 90
}
security_context {
privileged = true
capabilities {
add = ["NET_ADMIN"]
}
}
env {
name = "PUID"
value = "1000"
}
env {
name = "PGID"
value = "1000"
}
env {
name = "TZ"
value = "Europe/Berlin"
}
volume_mount {
name = "wireguard-config"
mount_path = "/config/wg_confs"
read_only = true
}
volume_mount {
name = "lib-modules"
mount_path = "/lib/modules"
read_only = true
}
}
container {
name = "squid"
image = "ubuntu/squid:${local.squid_version}"
port {
container_port = 3128
name = "proxy"
protocol = "TCP"
}
readiness_probe {
tcp_socket {
port = "proxy"
}
initial_delay_seconds = 10
timeout_seconds = 4
}
liveness_probe {
tcp_socket {
port = "proxy"
}
initial_delay_seconds = 10
timeout_seconds = 4
}
resources {
requests = {
memory = "256Mi"
}
}
security_context {
allow_privilege_escalation = false
run_as_user = 1000
run_as_group = 1000
}
volume_mount {
name = "squid-config"
mount_path = "/etc/squid"
read_only = true
}
volume_mount {
name = "squid-data"
mount_path = "/var/spol/squid"
}
}
volume {
name = "wireguard-config"
config_map {
name = kubernetes_config_map.wireguard_config.metadata[0].name
}
}
volume {
name = "lib-modules"
host_path {
path = "/lib/modules"
}
}
volume {
name = "squid-config"
config_map {
name = kubernetes_config_map.squid_config.metadata[0].name
}
}
volume {
name = "squid-data"
host_path {
path = local.squid_app_path
}
}
}
}
}
lifecycle {
ignore_changes = [spec[0].template[0].metadata[0].annotations]
replace_triggered_by = [
kubernetes_config_map.wireguard_config,
kubernetes_config_map.squid_config
]
}
}
# Create the Deployment
resource "kubernetes_deployment" "m3uproxy" {
metadata {
name = "m3uproxy"
@@ -292,6 +68,10 @@ resource "kubernetes_deployment" "m3uproxy" {
labels = {
app = "m3uproxy"
}
annotations = {
"checksum/m3uproxy" = local.m3uproxy_config_checksum
"checksum/playlist" = local.m3uproxy_playlist_checksum
}
}
spec {
@@ -393,96 +173,10 @@ resource "kubernetes_deployment" "m3uproxy" {
}
}
lifecycle {
ignore_changes = [spec[0].template[0].metadata[0].annotations]
ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]]
}
}
resource "kubernetes_cron_job_v1" "geoip_update" {
metadata {
name = "geoip-update"
namespace = kubernetes_namespace.m3uproxy.metadata[0].name
}
spec {
schedule = local.geoip_cron_schedule
job_template {
metadata {
name = "geoip-update"
}
spec {
template {
metadata {
labels = {
app = "geoip-update"
}
}
spec {
container {
name = "geoip-update"
image = "${local.geoip_image}:${local.geoip_version}"
env {
name = "GEOIPUPDATE_ACCOUNT_ID"
value_from {
secret_key_ref {
name = kubernetes_secret.geoip_maxmind_credentials.metadata[0].name
key = "account_id"
}
}
}
env {
name = "GEOIPUPDATE_LICENSE_KEY"
value_from {
secret_key_ref {
name = kubernetes_secret.geoip_maxmind_credentials.metadata[0].name
key = "license_key"
}
}
}
env {
name = "GEOIPUPDATE_EDITION_IDS"
value = join(" ", local.geoip_editions)
}
resources {
requests = {
memory = "64Mi"
}
}
volume_mount {
name = "geoip-db"
mount_path = "/usr/share/GeoIP"
}
security_context {
run_as_user = 1000
run_as_group = 1000
}
}
service_account_name = kubernetes_service_account.m3uproxy_service_account.metadata[0].name
restart_policy = "OnFailure"
volume {
name = "geoip-db"
host_path {
path = local.geoip_path
}
}
}
}
}
}
}
}
resource "kubernetes_service" "m3uproxy" {
metadata {
name = "http"
@@ -501,23 +195,6 @@ resource "kubernetes_service" "m3uproxy" {
}
}
resource "kubernetes_service" "proxy_pt" {
metadata {
name = "proxy-pt"
namespace = kubernetes_namespace.m3uproxy.metadata[0].name
}
spec {
selector = {
app = "proxy-pt"
}
port {
port = 3128
}
cluster_ip = "None"
}
}
resource "kubernetes_ingress_v1" "m3uproxy_ingress_http" {
metadata {
name = "m3uproxy-ingress"
terraform/modules/apps/m3uproxy/vpn.tf
+218
View File
@@ -0,0 +1,218 @@
resource "kubernetes_config_map" "wireguard_config" {
metadata {
name = "wireguard-config"
namespace = kubernetes_namespace.m3uproxy.metadata[0].name
}
data = {
"wireguard.conf" = local.wireguard_config
}
}
resource "kubernetes_config_map" "squid_config" {
metadata {
name = "squid-config"
namespace = kubernetes_namespace.m3uproxy.metadata[0].name
}
data = {
"squid.conf" = local.squid_config
}
}
resource "kubernetes_deployment" "proxy_pt" {
metadata {
name = "proxy-pt"
namespace = kubernetes_namespace.m3uproxy.metadata[0].name
annotations = {
"security.alpha.kubernetes.io/unsafe-sysctls" = "net.ipv4.conf.all.src_valid_mark=1"
}
}
spec {
replicas = 1
selector {
match_labels = {
app = "proxy-pt"
}
}
strategy {
type = "Recreate"
}
template {
metadata {
labels = {
app = "proxy-pt"
}
annotations = {
"checksum/squid" = local.squid_config_checksum
"checksum/wireguard" = local.wireguard_config_checksum
}
}
spec {
container {
name = "wireguard"
image = "linuxserver/wireguard:${local.wireguard_version}"
resources {
requests = {
memory = "64Mi"
}
}
liveness_probe {
exec {
command = [
"/bin/sh",
"-c",
"wg show | grep -q transfer"
]
}
initial_delay_seconds = 90
period_seconds = 90
}
security_context {
privileged = true
capabilities {
add = ["NET_ADMIN"]
}
}
env {
name = "PUID"
value = "1000"
}
env {
name = "PGID"
value = "1000"
}
env {
name = "TZ"
value = "Europe/Berlin"
}
volume_mount {
name = "wireguard-config"
mount_path = "/config/wg_confs"
read_only = true
}
volume_mount {
name = "lib-modules"
mount_path = "/lib/modules"
read_only = true
}
}
container {
name = "squid"
image = "ubuntu/squid:${local.squid_version}"
port {
container_port = 3128
name = "proxy"
protocol = "TCP"
}
readiness_probe {
tcp_socket {
port = "proxy"
}
initial_delay_seconds = 10
timeout_seconds = 4
}
liveness_probe {
tcp_socket {
port = "proxy"
}
initial_delay_seconds = 10
timeout_seconds = 4
}
resources {
requests = {
memory = "256Mi"
}
}
security_context {
allow_privilege_escalation = false
run_as_user = 1000
run_as_group = 1000
}
volume_mount {
name = "squid-config"
mount_path = "/etc/squid"
read_only = true
}
volume_mount {
name = "squid-data"
mount_path = "/var/spol/squid"
}
}
volume {
name = "wireguard-config"
config_map {
name = kubernetes_config_map.wireguard_config.metadata[0].name
}
}
volume {
name = "lib-modules"
host_path {
path = "/lib/modules"
}
}
volume {
name = "squid-config"
config_map {
name = kubernetes_config_map.squid_config.metadata[0].name
}
}
volume {
name = "squid-data"
host_path {
path = local.squid_app_path
}
}
}
}
}
lifecycle {
ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]]
}
}
resource "kubernetes_service" "proxy_pt" {
metadata {
name = "proxy-pt"
namespace = kubernetes_namespace.m3uproxy.metadata[0].name
}
spec {
selector = {
app = "proxy-pt"
}
port {
port = 3128
}
cluster_ip = "None"
}
}