Refactor database path variables in Ansible and Terraform playbooks; add local database folder variable

ansible/host_vars/prod-01.alexpires.me.yml

@@ -145,3 +145,4 @@ duo_api_hostname: api-7cda1654.duosecurity.com
 
 # Apps
 persistent_data: "/mnt/microk8s_persistent"
+database_path: "/var/lib"

ansible/playbook_gitea.yml

@@ -8,7 +8,7 @@
     - name: Set required facts
       ansible.builtin.set_fact:
         gitea_home: "{{ persistent_data | default('/var/lib') }}/gitea"
-        gitea_mysql_home: "{{ persistent_data | default('/var/lib') }}/mysql.gitea"
+        gitea_mysql_home: "{{ database_path | default('/var/lib') }}/mysql.gitea"
         gitea_user_id: 1000
         gitea_group_id: 1000
         mysql_user_id: 999

ansible/playbook_local.yml

@@ -0,0 +1,10 @@
+---
+- name: CIS Hardening
+  hosts: localnetwork
+  gather_facts: true
+
+  roles:
+    - role: "cis"
+      tags:
+        - roles
+        - roles::cis

ansible/playbook_nextcloud.yml

@@ -8,7 +8,7 @@
     - name: Set required facts
       ansible.builtin.set_fact:
         nextcloud_home: "{{ persistent_data | default('/var/lib') }}/nextcloud"
-        nextcloud_mysql_home: "{{ persistent_data | default('/var/lib') }}/mysql.nextcloud"
+        nextcloud_mysql_home: "{{ database_path | default('/var/lib') }}/mysql.nextcloud"
         nextcloud_user_id: 33
         nextcloud_group_id: 33
         mysql_user_id: 999

ansible/playbook_wordpress.yml

@@ -8,7 +8,7 @@
     - name: Set required facts
       ansible.builtin.set_fact:
         wordpress_home: "{{ persistent_data | default('/var/lib') }}/wordpress"
-        wordpress_mysql_home: "{{ persistent_data | default('/var/lib') }}/mysql.wordpress"
+        wordpress_mysql_home: "{{ database_path | default('/var/lib') }}/mysql.wordpress"
         wordpress_user_id: 33
         wordpress_group_id: 26
         mysql_user_id: 999

terraform/k8sapps/config.tf

@@ -52,6 +52,7 @@ locals {
 
   # storage
   persistent_folder = "/mnt/microk8s_persistent"
+  database_folder   = "/var/lib"
 }
 
 data "scaleway_account_project" "default" {

terraform/k8sapps/gitea.tf

@@ -37,8 +37,9 @@ locals {
     }
   }
 
-  gitea_path       = "${local.persistent_folder}/gitea"
+  gitea_path        = "${local.persistent_folder}/gitea"
-  gitea_mysql_path = "${local.persistent_folder}/mysql.gitea"
+  gitea_db_path     = "${local.database_folder}/mysql.gitea"
+  gitea_backup_path = "${local.persistent_folder}/backup.gitea"
 }
 
 #
@@ -79,16 +80,17 @@ resource "kubernetes_secret" "gitea_mail_credentials" {
 module "gitea_database" {
   source = "./modules/k8s_mariadb"
 
-  namespace         = kubernetes_namespace.gitea.metadata[0].name
+  namespace = kubernetes_namespace.gitea.metadata[0].name
-  app_name          = "gitea"
+  app_name  = "gitea"
-  app_backup_folder = "gitea.backups"
 
   app_password  = var.gitea_mysql_password
   root_password = var.mysql_root_password
 
-  retention_days    = local.local_backup_retention_days
+  retention_days = local.local_backup_retention_days
-  cron_schedule     = local.gitea_sql_backup_cron_schedule
+  cron_schedule  = local.gitea_sql_backup_cron_schedule
-  host_storage_path = local.gitea_mysql_path
+
+  database_folder = local.gitea_db_path
+  backup_folder   = local.gitea_backup_path
 }
 
 #
@@ -97,10 +99,8 @@ module "gitea_database" {
 module "gitea_backup" {
   source = "./modules/scw_backup_job"
 
-  namespace         = kubernetes_namespace.gitea.metadata[0].name
+  namespace = kubernetes_namespace.gitea.metadata[0].name
-  app_name          = "gitea"
+  app_name  = "gitea"
-  app_files_folder  = "gitea"
-  app_backup_folder = "mysql.gitea/gitea.backups"
 
   scaleway_organization_id = var.scaleway_organization_id
   scaleway_project_id      = var.scaleway_organization_id
@@ -108,9 +108,11 @@ module "gitea_backup" {
   secret_key               = scaleway_iam_api_key.backup_app_api.secret_key
   bucket_name              = scaleway_object_bucket.backup.name
 
-  retention_days    = local.local_backup_retention_days
+  retention_days = local.local_backup_retention_days
-  cron_schedule     = local.gitea_files_backup_cron_schedule
+  cron_schedule  = local.gitea_files_backup_cron_schedule
-  host_storage_path = local.persistent_folder
+
+  source_folder = local.gitea_path
+  target_folder = local.gitea_backup_path
 }
 
 # 
@@ -226,7 +228,7 @@ resource "kubernetes_deployment" "gitea" {
               port = "http"
             }
             initial_delay_seconds = 200
-            period_seconds        = 10
+            period_seconds        = 300
             success_threshold     = 1
             failure_threshold     = 5
           }
@@ -236,7 +238,7 @@ resource "kubernetes_deployment" "gitea" {
               port = "http"
             }
             initial_delay_seconds = 5
-            period_seconds        = 60
+            period_seconds        = 10
             success_threshold     = 1
             failure_threshold     = 3
           }

terraform/k8sapps/modules/k8s_mariadb/main.tf

@@ -85,7 +85,7 @@ resource "kubernetes_deployment" "deployment" {
               command = ["sh", "-c", "mysqladmin status -uroot -p$MARIADB_ROOT_PASSWORD"]
             }
             initial_delay_seconds = 30
-            period_seconds        = 10
+            period_seconds        = 300
             timeout_seconds       = 1
             failure_threshold     = 15
           }
@@ -151,13 +151,13 @@ resource "kubernetes_deployment" "deployment" {
         volume {
           name = "persistent-storage"
           host_path {
-            path = "${var.host_storage_path}/${var.app_name}.data"
+            path = "${var.database_folder}/${var.app_name}.data"
           }
         }
         volume {
           name = "initdb-storage"
           host_path {
-            path = "${var.host_storage_path}/${var.app_name}.initdb.d"
+            path = "${var.database_folder}/${var.app_name}.initdb.d"
           }
         }
       }
@@ -231,7 +231,7 @@ resource "kubernetes_cron_job_v1" "backup_data_cron" {
             volume {
               name = "backups-storage"
               host_path {
-                path = "${var.host_storage_path}/${var.app_backup_folder}"
+                path = var.backup_folder
               }
             }
             restart_policy                   = "Never"

terraform/k8sapps/modules/k8s_mariadb/variables.tf

@@ -22,7 +22,7 @@ variable "app_password" {
   type        = string
 }
 
-variable "host_storage_path" {
+variable "database_folder" {
   description = "host storage path"
   type        = string
 }
@@ -45,7 +45,7 @@ variable "current_version" {
   type        = string
 }
 
-variable "app_backup_folder" {
+variable "backup_folder" {
   description = "Backup source location"
   type        = string
 }

terraform/k8sapps/modules/scw_backup_job/main.tf

@@ -142,13 +142,13 @@ resource "kubernetes_cron_job_v1" "backup_job" {
             volume {
               name = "backup-storage"
               host_path {
-                path = "${var.host_storage_path}/${var.app_backup_folder}"
+                path = var.target_folder
               }
             }
             volume {
               name = "persistent-storage"
               host_path {
-                path = "${var.host_storage_path}/${var.app_files_folder}"
+                path = var.source_folder
               }
             }
             volume {

terraform/k8sapps/modules/scw_backup_job/variables.tf

@@ -37,11 +37,6 @@ variable "cron_schedule" {
   type        = string
 }
 
-variable "host_storage_path" {
-  description = "Host path"
-  type        = string
-}
-
 variable "access_key" {
   description = "Access key"
   sensitive   = true
@@ -59,12 +54,12 @@ variable "app_name" {
   type        = string
 }
 
-variable "app_files_folder" {
+variable "source_folder" {
   description = "Name of host folder"
   type        = string
 }
 
-variable "app_backup_folder" {
+variable "target_folder" {
   description = "Backup source location"
   type        = string
 }

terraform/k8sapps/wordpress.tf

@@ -1,6 +1,7 @@
 locals {
-  wordpress_path       = "${local.persistent_folder}/wordpress"
+  wordpress_path        = "${local.persistent_folder}/wordpress"
-  wordpress_mysql_path = "${local.persistent_folder}/mysql.wordpress"
+  wordpress_db_path     = "${local.database_folder}/mysql.wordpress"
+  wordpress_backup_path = "${local.persistent_folder}/backup.wordpress"
 }
 
 resource "kubernetes_namespace" "wordpress" {
@@ -24,16 +25,17 @@ resource "kubernetes_namespace" "wordpress" {
 module "wordpress_database" {
   source = "./modules/k8s_mariadb"
 
-  namespace         = kubernetes_namespace.wordpress.metadata[0].name
+  namespace = kubernetes_namespace.wordpress.metadata[0].name
-  app_name          = "wordpress"
+  app_name  = "wordpress"
-  app_backup_folder = "wordpress.backups"
 
   app_password  = var.wordpress_mysql_password
   root_password = var.mysql_root_password
 
-  retention_days    = local.local_backup_retention_days
+  retention_days = local.local_backup_retention_days
-  cron_schedule     = local.wordpress_sql_backup_cron_schedule
+  cron_schedule  = local.wordpress_sql_backup_cron_schedule
-  host_storage_path = local.wordpress_mysql_path
+
+  database_folder = local.wordpress_db_path
+  backup_folder   = local.wordpress_backup_path
 }
 
 
@@ -43,10 +45,8 @@ module "wordpress_database" {
 module "wordpress_backup" {
   source = "./modules/scw_backup_job"
 
-  namespace         = kubernetes_namespace.wordpress.metadata[0].name
+  namespace = kubernetes_namespace.wordpress.metadata[0].name
-  app_name          = "wordpress"
+  app_name  = "wordpress"
-  app_files_folder  = "wordpress"
-  app_backup_folder = "mysql.wordpress/wordpress.backups"
 
   scaleway_organization_id = var.scaleway_organization_id
   scaleway_project_id      = var.scaleway_organization_id
@@ -54,9 +54,11 @@ module "wordpress_backup" {
   secret_key               = scaleway_iam_api_key.backup_app_api.secret_key
   bucket_name              = scaleway_object_bucket.backup.name
 
-  retention_days    = local.local_backup_retention_days
+  retention_days = local.local_backup_retention_days
-  cron_schedule     = local.wordpress_files_backup_cron_schedule
+  cron_schedule  = local.wordpress_files_backup_cron_schedule
-  host_storage_path = local.persistent_folder
+
+  source_folder = local.wordpress_path
+  target_folder = local.wordpress_backup_path
 }
 
 #