feat(mail): enhance mail configuration with getmail and dovecot settings

- Added getmail configuration generation using template files. - Introduced postfix and dovecot configuration checksums for deployment. - Created new dovecot configuration file and sieve script for email handling. - Updated main.tf to utilize local variables for configuration management. - Removed redundant external password hasher from main.tf. feat(nginx): improve nginx configuration management - Centralized nginx configuration into a local variable with checksum. - Created separate config maps for default website configurations. - Updated deployment to utilize new configuration structure. feat(sftpgo): add SFTPGo application deployment - Introduced SFTPGo with Kubernetes resources including namespace, config maps, and secrets. - Configured SFTPGo with SMTP settings and AWS credentials. - Implemented health checks and volume mounts for persistent storage. refactor(seafile): remove Seafile module - Deleted Seafile module and associated resources as part of cleanup.
2025-05-05 00:47:36 +02:00
parent 6adbd50c6d
commit e6e85b00f7
60 changed files with 1107 additions and 604 deletions
@@ -0,0 +1,218 @@
+
+resource "kubernetes_config_map" "wireguard_config" {
+  metadata {
+    name      = "wireguard-config"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+  }
+
+  data = {
+    "wireguard.conf" = local.wireguard_config
+  }
+}
+
+resource "kubernetes_config_map" "squid_config" {
+  metadata {
+    name      = "squid-config"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+  }
+
+  data = {
+    "squid.conf" = local.squid_config
+  }
+
+}
+
+resource "kubernetes_deployment" "proxy_pt" {
+  metadata {
+    name      = "proxy-pt"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+    annotations = {
+      "security.alpha.kubernetes.io/unsafe-sysctls" = "net.ipv4.conf.all.src_valid_mark=1"
+    }
+  }
+
+  spec {
+    replicas = 1
+
+    selector {
+      match_labels = {
+        app = "proxy-pt"
+      }
+    }
+
+    strategy {
+      type = "Recreate"
+    }
+
+    template {
+      metadata {
+        labels = {
+          app = "proxy-pt"
+        }
+        annotations = {
+          "checksum/squid"     = local.squid_config_checksum
+          "checksum/wireguard" = local.wireguard_config_checksum
+        }
+      }
+
+      spec {
+        container {
+          name  = "wireguard"
+          image = "linuxserver/wireguard:${local.wireguard_version}"
+
+          resources {
+            requests = {
+              memory = "64Mi"
+            }
+          }
+
+          liveness_probe {
+            exec {
+              command = [
+                "/bin/sh",
+                "-c",
+                "wg show | grep -q transfer"
+              ]
+            }
+            initial_delay_seconds = 90
+            period_seconds        = 90
+          }
+
+          security_context {
+            privileged = true
+            capabilities {
+              add = ["NET_ADMIN"]
+            }
+          }
+
+          env {
+            name  = "PUID"
+            value = "1000"
+          }
+
+          env {
+            name  = "PGID"
+            value = "1000"
+          }
+
+          env {
+            name  = "TZ"
+            value = "Europe/Berlin"
+          }
+
+          volume_mount {
+            name       = "wireguard-config"
+            mount_path = "/config/wg_confs"
+            read_only  = true
+          }
+
+          volume_mount {
+            name       = "lib-modules"
+            mount_path = "/lib/modules"
+            read_only  = true
+          }
+        }
+
+        container {
+          name  = "squid"
+          image = "ubuntu/squid:${local.squid_version}"
+
+          port {
+            container_port = 3128
+            name           = "proxy"
+            protocol       = "TCP"
+          }
+
+          readiness_probe {
+            tcp_socket {
+              port = "proxy"
+            }
+            initial_delay_seconds = 10
+            timeout_seconds       = 4
+          }
+
+          liveness_probe {
+            tcp_socket {
+              port = "proxy"
+            }
+            initial_delay_seconds = 10
+            timeout_seconds       = 4
+          }
+
+          resources {
+            requests = {
+              memory = "256Mi"
+            }
+          }
+
+          security_context {
+            allow_privilege_escalation = false
+            run_as_user                = 1000
+            run_as_group               = 1000
+          }
+
+          volume_mount {
+            name       = "squid-config"
+            mount_path = "/etc/squid"
+            read_only  = true
+          }
+
+          volume_mount {
+            name       = "squid-data"
+            mount_path = "/var/spol/squid"
+          }
+
+        }
+
+        volume {
+          name = "wireguard-config"
+          config_map {
+            name = kubernetes_config_map.wireguard_config.metadata[0].name
+          }
+        }
+
+        volume {
+          name = "lib-modules"
+          host_path {
+            path = "/lib/modules"
+          }
+        }
+
+        volume {
+          name = "squid-config"
+          config_map {
+            name = kubernetes_config_map.squid_config.metadata[0].name
+          }
+        }
+
+        volume {
+          name = "squid-data"
+          host_path {
+            path = local.squid_app_path
+          }
+        }
+      }
+    }
+  }
+
+  lifecycle {
+    ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]]
+  }
+}
+
+resource "kubernetes_service" "proxy_pt" {
+  metadata {
+    name      = "proxy-pt"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+  }
+
+  spec {
+    selector = {
+      app = "proxy-pt"
+    }
+    port {
+      port = 3128
+    }
+    cluster_ip = "None"
+  }
+}