From e8710ea1347215861b147075f8b0c027d1abf620 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Sun, 12 Jan 2025 15:15:16 +0100 Subject: [PATCH] Refactor database path variables in Ansible and Terraform playbooks; add local database folder variable --- ansible/host_vars/prod-01.alexpires.me.yml | 1 + ansible/playbook_gitea.yml | 2 +- ansible/playbook_local.yml | 10 ++++++ ansible/playbook_nextcloud.yml | 2 +- ansible/playbook_wordpress.yml | 2 +- terraform/k8sapps/config.tf | 1 + terraform/k8sapps/gitea.tf | 36 ++++++++++--------- terraform/k8sapps/modules/k8s_mariadb/main.tf | 8 ++--- .../k8sapps/modules/k8s_mariadb/variables.tf | 4 +-- .../k8sapps/modules/scw_backup_job/main.tf | 4 +-- .../modules/scw_backup_job/variables.tf | 9 ++--- terraform/k8sapps/wordpress.tf | 32 +++++++++-------- 12 files changed, 61 insertions(+), 50 deletions(-) create mode 100644 ansible/playbook_local.yml diff --git a/ansible/host_vars/prod-01.alexpires.me.yml b/ansible/host_vars/prod-01.alexpires.me.yml index d64f960..f45cde6 100644 --- a/ansible/host_vars/prod-01.alexpires.me.yml +++ b/ansible/host_vars/prod-01.alexpires.me.yml @@ -145,3 +145,4 @@ duo_api_hostname: api-7cda1654.duosecurity.com # Apps persistent_data: "/mnt/microk8s_persistent" +database_path: "/var/lib" diff --git a/ansible/playbook_gitea.yml b/ansible/playbook_gitea.yml index 345f84d..f38a5b5 100644 --- a/ansible/playbook_gitea.yml +++ b/ansible/playbook_gitea.yml @@ -8,7 +8,7 @@ - name: Set required facts ansible.builtin.set_fact: gitea_home: "{{ persistent_data | default('/var/lib') }}/gitea" - gitea_mysql_home: "{{ persistent_data | default('/var/lib') }}/mysql.gitea" + gitea_mysql_home: "{{ database_path | default('/var/lib') }}/mysql.gitea" gitea_user_id: 1000 gitea_group_id: 1000 mysql_user_id: 999 diff --git a/ansible/playbook_local.yml b/ansible/playbook_local.yml new file mode 100644 index 0000000..13c94fa --- /dev/null +++ b/ansible/playbook_local.yml @@ -0,0 +1,10 @@ +--- +- name: CIS Hardening + hosts: localnetwork + gather_facts: true + + roles: + - role: "cis" + tags: + - roles + - roles::cis diff --git a/ansible/playbook_nextcloud.yml b/ansible/playbook_nextcloud.yml index 5c4c15f..5115480 100644 --- a/ansible/playbook_nextcloud.yml +++ b/ansible/playbook_nextcloud.yml @@ -8,7 +8,7 @@ - name: Set required facts ansible.builtin.set_fact: nextcloud_home: "{{ persistent_data | default('/var/lib') }}/nextcloud" - nextcloud_mysql_home: "{{ persistent_data | default('/var/lib') }}/mysql.nextcloud" + nextcloud_mysql_home: "{{ database_path | default('/var/lib') }}/mysql.nextcloud" nextcloud_user_id: 33 nextcloud_group_id: 33 mysql_user_id: 999 diff --git a/ansible/playbook_wordpress.yml b/ansible/playbook_wordpress.yml index ca53573..324652a 100644 --- a/ansible/playbook_wordpress.yml +++ b/ansible/playbook_wordpress.yml @@ -8,7 +8,7 @@ - name: Set required facts ansible.builtin.set_fact: wordpress_home: "{{ persistent_data | default('/var/lib') }}/wordpress" - wordpress_mysql_home: "{{ persistent_data | default('/var/lib') }}/mysql.wordpress" + wordpress_mysql_home: "{{ database_path | default('/var/lib') }}/mysql.wordpress" wordpress_user_id: 33 wordpress_group_id: 26 mysql_user_id: 999 diff --git a/terraform/k8sapps/config.tf b/terraform/k8sapps/config.tf index 3813de2..ba8ccda 100644 --- a/terraform/k8sapps/config.tf +++ b/terraform/k8sapps/config.tf @@ -52,6 +52,7 @@ locals { # storage persistent_folder = "/mnt/microk8s_persistent" + database_folder = "/var/lib" } data "scaleway_account_project" "default" { diff --git a/terraform/k8sapps/gitea.tf b/terraform/k8sapps/gitea.tf index c18d52e..9355351 100644 --- a/terraform/k8sapps/gitea.tf +++ b/terraform/k8sapps/gitea.tf @@ -37,8 +37,9 @@ locals { } } - gitea_path = "${local.persistent_folder}/gitea" - gitea_mysql_path = "${local.persistent_folder}/mysql.gitea" + gitea_path = "${local.persistent_folder}/gitea" + gitea_db_path = "${local.database_folder}/mysql.gitea" + gitea_backup_path = "${local.persistent_folder}/backup.gitea" } # @@ -79,16 +80,17 @@ resource "kubernetes_secret" "gitea_mail_credentials" { module "gitea_database" { source = "./modules/k8s_mariadb" - namespace = kubernetes_namespace.gitea.metadata[0].name - app_name = "gitea" - app_backup_folder = "gitea.backups" + namespace = kubernetes_namespace.gitea.metadata[0].name + app_name = "gitea" app_password = var.gitea_mysql_password root_password = var.mysql_root_password - retention_days = local.local_backup_retention_days - cron_schedule = local.gitea_sql_backup_cron_schedule - host_storage_path = local.gitea_mysql_path + retention_days = local.local_backup_retention_days + cron_schedule = local.gitea_sql_backup_cron_schedule + + database_folder = local.gitea_db_path + backup_folder = local.gitea_backup_path } # @@ -97,10 +99,8 @@ module "gitea_database" { module "gitea_backup" { source = "./modules/scw_backup_job" - namespace = kubernetes_namespace.gitea.metadata[0].name - app_name = "gitea" - app_files_folder = "gitea" - app_backup_folder = "mysql.gitea/gitea.backups" + namespace = kubernetes_namespace.gitea.metadata[0].name + app_name = "gitea" scaleway_organization_id = var.scaleway_organization_id scaleway_project_id = var.scaleway_organization_id @@ -108,9 +108,11 @@ module "gitea_backup" { secret_key = scaleway_iam_api_key.backup_app_api.secret_key bucket_name = scaleway_object_bucket.backup.name - retention_days = local.local_backup_retention_days - cron_schedule = local.gitea_files_backup_cron_schedule - host_storage_path = local.persistent_folder + retention_days = local.local_backup_retention_days + cron_schedule = local.gitea_files_backup_cron_schedule + + source_folder = local.gitea_path + target_folder = local.gitea_backup_path } # @@ -226,7 +228,7 @@ resource "kubernetes_deployment" "gitea" { port = "http" } initial_delay_seconds = 200 - period_seconds = 10 + period_seconds = 300 success_threshold = 1 failure_threshold = 5 } @@ -236,7 +238,7 @@ resource "kubernetes_deployment" "gitea" { port = "http" } initial_delay_seconds = 5 - period_seconds = 60 + period_seconds = 10 success_threshold = 1 failure_threshold = 3 } diff --git a/terraform/k8sapps/modules/k8s_mariadb/main.tf b/terraform/k8sapps/modules/k8s_mariadb/main.tf index e1db82e..467d414 100644 --- a/terraform/k8sapps/modules/k8s_mariadb/main.tf +++ b/terraform/k8sapps/modules/k8s_mariadb/main.tf @@ -85,7 +85,7 @@ resource "kubernetes_deployment" "deployment" { command = ["sh", "-c", "mysqladmin status -uroot -p$MARIADB_ROOT_PASSWORD"] } initial_delay_seconds = 30 - period_seconds = 10 + period_seconds = 300 timeout_seconds = 1 failure_threshold = 15 } @@ -151,13 +151,13 @@ resource "kubernetes_deployment" "deployment" { volume { name = "persistent-storage" host_path { - path = "${var.host_storage_path}/${var.app_name}.data" + path = "${var.database_folder}/${var.app_name}.data" } } volume { name = "initdb-storage" host_path { - path = "${var.host_storage_path}/${var.app_name}.initdb.d" + path = "${var.database_folder}/${var.app_name}.initdb.d" } } } @@ -231,7 +231,7 @@ resource "kubernetes_cron_job_v1" "backup_data_cron" { volume { name = "backups-storage" host_path { - path = "${var.host_storage_path}/${var.app_backup_folder}" + path = var.backup_folder } } restart_policy = "Never" diff --git a/terraform/k8sapps/modules/k8s_mariadb/variables.tf b/terraform/k8sapps/modules/k8s_mariadb/variables.tf index a4907a9..9ea381e 100644 --- a/terraform/k8sapps/modules/k8s_mariadb/variables.tf +++ b/terraform/k8sapps/modules/k8s_mariadb/variables.tf @@ -22,7 +22,7 @@ variable "app_password" { type = string } -variable "host_storage_path" { +variable "database_folder" { description = "host storage path" type = string } @@ -45,7 +45,7 @@ variable "current_version" { type = string } -variable "app_backup_folder" { +variable "backup_folder" { description = "Backup source location" type = string } diff --git a/terraform/k8sapps/modules/scw_backup_job/main.tf b/terraform/k8sapps/modules/scw_backup_job/main.tf index a9937a0..446daac 100644 --- a/terraform/k8sapps/modules/scw_backup_job/main.tf +++ b/terraform/k8sapps/modules/scw_backup_job/main.tf @@ -142,13 +142,13 @@ resource "kubernetes_cron_job_v1" "backup_job" { volume { name = "backup-storage" host_path { - path = "${var.host_storage_path}/${var.app_backup_folder}" + path = var.target_folder } } volume { name = "persistent-storage" host_path { - path = "${var.host_storage_path}/${var.app_files_folder}" + path = var.source_folder } } volume { diff --git a/terraform/k8sapps/modules/scw_backup_job/variables.tf b/terraform/k8sapps/modules/scw_backup_job/variables.tf index 203a988..6954566 100644 --- a/terraform/k8sapps/modules/scw_backup_job/variables.tf +++ b/terraform/k8sapps/modules/scw_backup_job/variables.tf @@ -37,11 +37,6 @@ variable "cron_schedule" { type = string } -variable "host_storage_path" { - description = "Host path" - type = string -} - variable "access_key" { description = "Access key" sensitive = true @@ -59,12 +54,12 @@ variable "app_name" { type = string } -variable "app_files_folder" { +variable "source_folder" { description = "Name of host folder" type = string } -variable "app_backup_folder" { +variable "target_folder" { description = "Backup source location" type = string } diff --git a/terraform/k8sapps/wordpress.tf b/terraform/k8sapps/wordpress.tf index 3377c69..83768f3 100644 --- a/terraform/k8sapps/wordpress.tf +++ b/terraform/k8sapps/wordpress.tf @@ -1,6 +1,7 @@ locals { - wordpress_path = "${local.persistent_folder}/wordpress" - wordpress_mysql_path = "${local.persistent_folder}/mysql.wordpress" + wordpress_path = "${local.persistent_folder}/wordpress" + wordpress_db_path = "${local.database_folder}/mysql.wordpress" + wordpress_backup_path = "${local.persistent_folder}/backup.wordpress" } resource "kubernetes_namespace" "wordpress" { @@ -24,16 +25,17 @@ resource "kubernetes_namespace" "wordpress" { module "wordpress_database" { source = "./modules/k8s_mariadb" - namespace = kubernetes_namespace.wordpress.metadata[0].name - app_name = "wordpress" - app_backup_folder = "wordpress.backups" + namespace = kubernetes_namespace.wordpress.metadata[0].name + app_name = "wordpress" app_password = var.wordpress_mysql_password root_password = var.mysql_root_password - retention_days = local.local_backup_retention_days - cron_schedule = local.wordpress_sql_backup_cron_schedule - host_storage_path = local.wordpress_mysql_path + retention_days = local.local_backup_retention_days + cron_schedule = local.wordpress_sql_backup_cron_schedule + + database_folder = local.wordpress_db_path + backup_folder = local.wordpress_backup_path } @@ -43,10 +45,8 @@ module "wordpress_database" { module "wordpress_backup" { source = "./modules/scw_backup_job" - namespace = kubernetes_namespace.wordpress.metadata[0].name - app_name = "wordpress" - app_files_folder = "wordpress" - app_backup_folder = "mysql.wordpress/wordpress.backups" + namespace = kubernetes_namespace.wordpress.metadata[0].name + app_name = "wordpress" scaleway_organization_id = var.scaleway_organization_id scaleway_project_id = var.scaleway_organization_id @@ -54,9 +54,11 @@ module "wordpress_backup" { secret_key = scaleway_iam_api_key.backup_app_api.secret_key bucket_name = scaleway_object_bucket.backup.name - retention_days = local.local_backup_retention_days - cron_schedule = local.wordpress_files_backup_cron_schedule - host_storage_path = local.persistent_folder + retention_days = local.local_backup_retention_days + cron_schedule = local.wordpress_files_backup_cron_schedule + + source_folder = local.wordpress_path + target_folder = local.wordpress_backup_path } #