Minor fixes

- DNS implementation
- Fixed missing mount in encrypted volumes
- Improved chronograph.sh

ansible/roles/encryption/tasks/volume.yml

@@ -150,3 +150,11 @@
   loop:
     - "{{ key_fetch_service }}"
     - "{{ mount_service }}"
+
+- name: Mount the volume
+  become: true
+  ansible.posix.mount:
+    path: "{{ mount_point }}"
+    src: /dev/mapper/{{ device_name }}
+    fstype: "{{ fstype }}"
+    state: present

repository.vault

@@ -1 +1 @@
-EDbdeVTJjlQ34MEG9o3PwJtUdLoEgeBNTvfx6CK43YcuogW8t/KV9qMynok6udx/Awu0pYE2eVdASRRQmTKbaiN+O5Z8HjDoBOyWmNO+zW/pSTePMJdV/vfr9amgUVSe5cAhkVoLwcMb5mh43iDyyb92dwnOKL0BNq3M95IHzTLUUS/JWrMDGn+r3rWGew2pdp0i7XiODEii66RkXjBqkKzTJU6zSiwlyM9HTw213SKXYgDw+5HWwYK4xnIdXz8kYw1ALjkHwVU0GlWKUN8hyb6v/OWxUdkbaxZ+I1LFmnLekAbW7gvg0VmVST16rLPxji52NHjw7HXi+1Ss0iRN9HKOnmbJSh2BK4rPUsgeXoH9yzjfHbzsvHdKkKXkjJ32f+w+LJt/Z48Hz/jNpwLmW5NvUNfpJ2CaJtVAt7uCrFHNbP7XJZyfGm3u6gvyqsZQERsOl8utElnK7lImMr7HWO5daK98NORahk6Ve/s76mBf4MSsy/jaeYL6VDKWnYVr0Vj+liWEGNCNKTuXUSIFl32SfMIYm6z2R+UeNAgEIzA8vnqxgUsz3lBB+Q9SHvg8COuBi5v9KdAwuPEBIYB38nxVdx6+TbpSR+X5FCFyj8EsOULeA6uwJH5ngebjwxNePtHxTQv6mTCeavblbhT4PQkIuhgp4Phn1t9qleOkzqu/5iwUnkVkKIqa4hyebgPQXufghvpPcsk9aAZQeHxORvCm4IxRkJA3BtpsrWwqKGtssiunoKfkcXhK7AqEZAx6ayB5+g58jYm4N85Sth9Kdnkz68XbP2+WQbuCdLGD1dmnuCUUtyj6kYpjWn4N6l98Fuo0OO76pXijF59ihv0atcDi8D3FLNXIZJ22pY3IJYnTrPootdvDg+8Cavcb6l1MlBLO5gNt/Ry4MGsNRYjCOry4jz43bi0QmOzBhJqVhJvbIRMYlD0BJ5vwTa/ztHInJ40VXHprjzSJsMnYTo25BCj4IWeRCAGCVi2KIOjNdiBOPVmRENjB16DniuMqc4J5+3aqgB5Azda6Ll4k/p+lOpbWpyWs4a8blLAJam3NJrhYCJ+ByU9/uydWTgWoI9+sFHZlu7Asc25mOrEFTGCZNLyMAtUGVClvFiM8wEZ7SuStiwjwopm4OQw+Un/y+N71tKCalPmnj5jXa56Uhl8BuoWghVpxMGkiCxgnylVeefQ7BWW89G7R24Z1yfRPooaPOQ2pomh+LdFVCqygApcB44gb2Uw3GX5r7GC1JTI6UkuhEoBh5OCv9riHfeI+clB3sS7jwd6Rop9x3vw/AoP1k37Ps6us5TivmbAp2MRBXUAncExGx9yG281xGoIZjTeauua92/+/+P0iMnk+ptLPoGBTzqGTJjJDQrhJaHIY7AcH3PajL4s7VWFhY1iG/cyE4YfS8YjeYOQgRh9vIvumQx76j+uCqot5/4YPu7FOPIh8ZIVdpfDc2HZWhiW6g9PhmbGLJ+2QSLpOmh7aiPWCA+arZmIPDagxzMCgH2xu/ahQIKsZCu0gZUXvktFRdCGvZdjc766ilHEZprr2ChFQKCeCgTbdaacouMEaNl23dvtgmvyjvq20/EzWvm4NjLqvURY+6hY2fcsEJDQgYII5NSoPyx3835sr1suG87Gr9FBO8IkDQYUp+Z6+yZakDIYHq60LRau/Kz+WLpTxzKrzh/blp+5kGIB93rfGcJI2DHZmxw+wu9DGm/cRofP/yTCBuP1vEk5YjWrcslvNVeJrh19y6sT8EiSmlRuTc1ak35XYUxAvuY9We7N1Gs6NXxiwwAYyn1XhCzoxM5IjgC7mZa/nS/M+CL/ekZNxlnq7Kmdbps5lKOHhIe7vjZp9HEzGh49ZJzpU5vmJOSuEyiuTQUN780nQXkymCTgmxSb3vFZRuYAKEx/cdaBwwfrE3b2N9MLoQhAsnywBaY7hKshFHluzJknoLnaQHxpG7ceTu+mhACvTOV3sECmckmdo+TXLMtg9QAiy5qX5vkEr3+88eSOvsg6oB6IMNCW/EjsJzkX1Z44of94BoiiQm7jrFaGy682XuEZIUQ4fonKFmA34tmIBxoj3eClDtKAzw6QeOgge2jX6Guvrni5UNi68RKSZKQsvHCw1qCwvIXR83vo6yZ0JeqZvFjbfICdZkybxDnnUAKslxDWIleKEo5s1sl181NhVI75AiJA81yashGeSooiVQGttM6TTDrBl/a5crwy7CkVIER26imfHOZnqFx+LMfcE+efHxnyRm1lcwqmFSF0epqoi8sUATu35pMWh8VRGJhB2Hozp3Of2+2rgR4JZbGh+XlgRtLU1Vc3LQypQKsoFVSDKF3XHAGt76fIBhMFNdcdVf4sMvzsH/4TIg4gDlqXQoxheoVdD2ZJ6sfV1QrXgfNT8zWXmGGs+mZkSsoCyBpVaQJM+MVJZFuAVLRcwEyKYlef+m8ENs94JrbBBv0IhaAhqwQ/173pQugOL0+aKQKp2sFrwIHrYdmDnFRxbPhsJln062VWR7C1fiozRncZ2+MRHehwjybebU8kAJN+IVlNm+pvVt6k89flG3tZgiF6ULpTS5BbVM+ZFy5uW1tHlW33ekg/kmhuu8O5blaxKr2jpexePfnlw0YIMgpTfewVabRIQZO1ktOu28hEtVFYVkGfRn7SIv/bbpsOAgerEqhOcor0XbcJ9HDJs80W5surERyZHIM9BAPd7UEYmOjmFUbLmulxEUNRNrQNwZf3yIL6BxQZYuvmHXRW/J99w763ncvJNSltUK3mopmwP0hT9YUJiuQ+6WM8dCfiND6SeRFU9CTOHFDrIC3na7u8Y0aFnHR36R5WDpSMremdlSadjdau5vbOocpZzfTOd5TkF5deBGLEFPS1ipd/iLVnOC39wiBtq
+iOK7hvCAo83O/Yf1nSCHSzoweqVAvpv2pO8Azrk1iCb1afHMMItTj6Pi+xEHBgLYXDWvt8qxnqT+5mYmvFkmhpKHuwk4VjUQogO1YmIjy7c2W/hmboOOmmeMa8gjAaGuSRhwRFZq1Ug+lU/cc6YMzCYqvX8iULeZsYBQMj15NL8qYYWMcO/vWgytVxOtpKZi3tQ44qOOW5Uovay//fyudR5k3cge3V5rQplhfX4D9sLN70nRGIK74yh3LviMCaAI/V+5JmAiZZSnfuWIpOYVP61JiankMkz7NLjmrPXkBUTEd7Dm3vbX6eHTDsZxUMIGxH81vQxCeffvGA4eOOV/EEbQjz5D/DeRBZyvDO24YhG2Ougsl8NEcM+u94kIT9uss94OBBNcRUTmmgAmv7P20fkVvUJspZ7JbvjL4T2FyzalMP5REndqbxzLNEpjt8V0TE5IkPo7w3kpLy5qzQTCHPHYcSSMo2a9PfIsQjFthx4EyqALI/QVQCImzUruk/hkyttJrxzsh6AZ4V2U4DvWygjIAvATlAQkgMmlGhyLqSMrNKd206/gYMbhQfjZx/XxByX4evY6B70ypUTADxDKvtTRflMlss2ykC2ib/s6Gry55YWgZXb4xvpXaw125R2UFhbmM5u0V96rAqZgqpX1JiNbpfPCwfDfcvXhWT2j2+TZZ6JToUQq0UNNGh8FPKIcfFCaSAfszP5zHqb7obs74p4erlNj98A/bhIsePa+OH6HkArEAIlZuEAjJBTWSW2E0KVWLe0Iy9tfhQKVAaavW6Pos9jjyJ0G+yyjB8hqPkvBMClqyJCX6HMndZ+MxSasqpPrCZqK8IBUd1Rd/3qeAs7fxDl7GHRDX9CfbYY7+yf40mbS2mgRUtP0/dkOKVoQpEArZPvfBPRW865lDV00HG+I1cGhT6kTRQcTIVzrQG43IoB9qQ6rGgDdg5gxMVymZX6e3cD8FOs6p2p3mVpuDvtCJ6FLqamtEYYH9Ev/XCjOHAji+yVL296ikpaU3ecfRIoQkpoHZWMJ5kxIk2l5P/n0Wf6+J9Wffo7Te0+VW33sTJzCKdUCKis/50QLLMIfCbOI+HqQeQGtKqekamhibjSAWioCiY797WX7amHcmd3HdHpWuprgkkP7l6QFaU7m5uJFVCRG8XNiHMv9NyoyetJwukjZZkrZpoZzJNU3Z7uxSKzbFEhkzbVgPRTzIB2mlr4kTOePsgff6lVrCOwxXDtW/+6mtxDhsJQFiDgWsfe8GtUV2LmXqD0RrYJ3NsZV8ofinio8UQppjUQMRXE3zGP+PgcErlCQA9T0jWb3ZdYuXnT5uCD/OQpb5zAFCEks3RwRIgQhgdva1iZ6l47YbZm22BEsmdmEneQ3uh5N8FRHfq2E/0ZQWQ/RxhlXIzLqOKKwLOUHZhqTzAZZRxnbwiz9yIng1Nk/OFfYzGVePnhMrnJqqRjknA8uhKWmf8MNOM0DsEF7Fb96q48UaGGv607jqJeE++59sC21BXkbewp+VNgyFW9PooMwxd0yCfTw+pLsDGTuM1uSXJ98OiqWgYqbZEbuE8xn2m8pcDMooHNM+OX822moh0TTKFufQehWRnLmdjeSaHtnvVqT42hKQ3SKeFmnnDRCsl55uwAnFBCz/QGhqEj6pJ+b0q02VWFhM5C/vA28AuSHZmnmZpqDC/tjjoX8H/vFuNL2984aNZ2pWECiAAMbvaSVN//NB8pOrppKnlE64++HJ2F1GtAPTYB1cQ8UjOp1o42oQ9BbgtIrS5WkLIHNv5Vg68nzhmPqLSDr2siOSeTMqJkJoCBZcv3nO+1RXeUJPJkoVO34lpi38nF4J0cUvjROzSsQW5eq6taNmrkk8yvd5bGhf52ITavgPW5CvgxtmosotG2PJUaUpO22E9pXsENX/hJ8x/Igb+8nR7R0OZ0FHKURkCR256c3rNEG+rIdSzOzXj9hp7d/FO5ObiybC22olamjI6OnUOast8hxAxmqIz/A05IowgI2s1pyvEOylru+KievCQZ/0P8FG6avzsg7hus3yHGcYWVxhKXwymhFLzzkhVFKkM1SPumaMFWLtZltF+eWeD2uoectRL8XuvMpUFnqLXCE2skWUKNYYmRvPzHahZleyXTvqPFvSG6jSTQ6nRGAPAjH1PVGQ4Z3xttX3+UPvhGM7feuxx95ohkSraLU57l0DzWejyPFjjGJBeEPYP2kBCEi4TqIm43Yiwg4l2hCVqiPpwfpRkGO2wzIehjiqzQNPUaeDcTOBxyKUzJdaFw/6aDvo4XjE0a1ndKi4pBFB7RrWA2P15/uuHifz9f6Hoo/AleqgEzS7cFzgnCtr+hhaYYASSOXEHm6y4O763vUOgHFvYZevalFBynzLGWNG97+c9xIm343hRq0LJG5K10UphJwbPIqd0ml3tGjQXU7vkRKxTNVLqUDSHD1IxLrNGdbcoFR02ryudNdzy+VwlkukqUR1pSkibVby2Ag4Y9vyIztL/NM7XLNDqgr4ODJXHaiAEwZQsTJpIELDQabha3VyO6NnwrkTlZw7+kz57pExr0xbpGs0pbIiVHIj2zW9jEY98LihLvHzJjbshygEYzJwUVsUutZkTZPz3QaN9ZjdvbKMMTvaErzlt1TXryXF6y0+lgJTo/YoribY4khLRvn3/FZ3MfBJRhGRs33Nnw4rkIrj67SVue016XMUkdkI2a6jLWWQIeV1fNGoWRUYwukzyOB18HP5aW+6k0oUntXrQ1X6PKXAdXhGWAFPqzHVxdRtFEs67QCWenHphdraTrAcKvB0XzX34/eGpefTa8tD8ttrCLgZswICkqYjC/EF9VHzF9k1kVpsG6oDPO5YLN/q50xUmBrC+bGBm69h4hgOe7zvO8SGJYvXXESpWnvr19XncKS1a76y6rr6z0IIquuHTiJ/AZsvTrNqh16gQ5mRMD86dPkwDuMqmvjzKBCF8o0OMgXcT8DxeSQ0VptxczvMTqnRQCe6bFe4xrmtXTre9Zyglb6rtNlacO/DQRexbm1Zp3rcin4s0zXPN7lhhgiFb8SfNOvo+G4uPGbVPskYEmXvvTVDq0Ks01E3Ke+kOew37g6CSkMJw1q4E5DfX87Z7VbuIJOHMKZYofRGYKLedCChaG9fqnvqHXdsgD1Hzt3BpUve0RQr0e2DE7HbeCXb0HaZwZOa90ifpdUqT8wMeOXmuzqvnm7PB+mQHWD0b33O7ZRBpUP3ovtPzZXB2k9ejZgelji8QEwkV3nsadVaR0B4HmCLncsO5MUu/kSZVsTdZSY5WWk+dhWogeixc2hBbK1xVGHX7hNaxqfy8rU+WKRGpn/1Y98DUGLc06Q5OS12O93N0G7beT1dGgzHgJd6Lu+XLU3x5LZCKjBuGguqS7r7ihfPx1nMhO8+QAp0JPgDQlGQnGT0fo4nGfVvMcxiFUS1yNhEYx+2snfNEOINFFeIKvEyspCEWeG3odVU1Sy96o9AfLZkzTg9qI9WjswUWQE2QM0Wz2i8HguHXid0fWrdyhDyc6ikxbHxDweT9M0SkXKG1S6xgeSReML0bMvwstKhNNXMY6GP3nePtzWZmSTTQcWc1qZl7qEY4Xexrftf0BMhdeWtODkb/NwzjuKVGW7A+xahsmvcOEQ1yURH28TP5o=

scripts/chronograf.sh

@@ -1,3 +1,21 @@
 #!/bin/bash
+REDIRECT_OUTPUT=true
+
+while getopts "q" opt; do
+    case $opt in
+        q)
+            REDIRECT_OUTPUT=false
+            ;;
+        *)
+            ;;
+    esac
+done
+
+if $REDIRECT_OUTPUT; then
+    REDIRECT="1>/dev/null 2>&1"
+else
+    REDIRECT=""
+fi
+
 POD_NAME=$(kubectl get pods -n monitoring -l app=chronograf -o jsonpath="{.items[0].metadata.name}")
-kubectl port-forward --address 127.0.0.1 --request-timeout=0 -n monitoring $POD_NAME 8888:8888 1>/dev/null 2>&1 &
+kubectl port-forward --address 127.0.0.1 --request-timeout=0 -n monitoring $POD_NAME 8888:8888 $REDIRECT

terraform/iac/alexpires.me.tf

@@ -0,0 +1,114 @@
+resource "cloudns_dns_record" "microk8s" {
+  name  = data.contabo_instance.microk8s.name
+  zone  = local.alexpires_me_zone
+  type  = "A"
+  value = data.contabo_instance.microk8s.ip_config[0].v4[0].ip
+  ttl   = "3600"
+}
+
+resource "cloudns_dns_record" "code" {
+  name  = "code"
+  zone  = local.alexpires_me_zone
+  type  = "CNAME"
+  value = "${cloudns_dns_record.microk8s.name}.${local.alexpires_me_zone}"
+  ttl   = "3600"
+}
+
+resource "cloudns_dns_record" "cloud" {
+  name  = "cloud"
+  zone  = local.alexpires_me_zone
+  type  = "CNAME"
+  value = "${cloudns_dns_record.microk8s.name}.${local.alexpires_me_zone}"
+  ttl   = "3600"
+}
+
+resource "cloudns_dns_record" "tv" {
+  name  = "tv"
+  zone  = local.alexpires_me_zone
+  type  = "CNAME"
+  value = "${cloudns_dns_record.microk8s.name}.${local.alexpires_me_zone}"
+  ttl   = "3600"
+}
+
+resource "cloudns_dns_record" "blog" {
+  name  = "blog"
+  zone  = local.alexpires_me_zone
+  type  = "CNAME"
+  value = "${cloudns_dns_record.microk8s.name}.${local.alexpires_me_zone}"
+  ttl   = "3600"
+}
+
+resource "cloudns_dns_record" "www" {
+  name  = "www"
+  zone  = local.alexpires_me_zone
+  type  = "CNAME"
+  value = "${cloudns_dns_record.microk8s.name}.${local.alexpires_me_zone}"
+  ttl   = "3600"
+}
+
+resource "cloudns_dns_record" "root" {
+  name  = ""
+  zone  = local.alexpires_me_zone
+  type  = "A"
+  value = data.contabo_instance.microk8s.ip_config[0].v4[0].ip
+  ttl   = "3600"
+}
+
+resource "cloudns_dns_record" "spf" {
+  name  = ""
+  zone  = local.alexpires_me_zone
+  type  = "TXT"
+  value = "v=spf1 include:_spf.tem.scaleway.com -all"
+  ttl   = "3600"
+}
+
+resource "cloudns_dns_record" "dkim" {
+  name  = "${var.scaleway_dkim_key}._domainkey"
+  zone  = local.alexpires_me_zone
+  type  = "TXT"
+  value = "vv=DKIM1; h=sha256; k=rsa; p=${var.scaleway_dkim_value}"
+  ttl   = "3600"
+}
+
+resource "cloudns_dns_record" "dmarc" {
+  name  = "_dmarc"
+  zone  = local.alexpires_me_zone
+  type  = "TXT"
+  value = "v=DMARC1; p=none; rua=mailto:admin@${local.alexpires_me_zone}"
+  ttl   = "3600"
+}
+
+import {
+  id = "${local.alexpires_me_zone}/178650182"
+  to = cloudns_dns_record.code
+}
+
+import {
+  id = "${local.alexpires_me_zone}/281519967"
+  to = cloudns_dns_record.cloud
+}
+
+import {
+  id = "${local.alexpires_me_zone}/521232645"
+  to = cloudns_dns_record.tv
+}
+
+import {
+  id = "${local.alexpires_me_zone}/178650153"
+  to = cloudns_dns_record.blog
+}
+
+import {
+  id = "${local.alexpires_me_zone}/281520528"
+  to = cloudns_dns_record.spf
+}
+
+import {
+  id = "${local.alexpires_me_zone}/281520539"
+  to = cloudns_dns_record.dkim
+}
+
+import {
+  id = "${local.alexpires_me_zone}/281718535"
+  to = cloudns_dns_record.dmarc
+}

terraform/iac/config.tf

@@ -3,4 +3,5 @@ locals {
     "${data.contabo_instance.microk8s.ip_config[0].v4[0].ip}/32",
   ]
   instance_mac_addr = replace(data.contabo_instance.microk8s.mac_address, ":", "_")
+  alexpires_me_zone = "alexpires.me"
 }

terraform/iac/provider.tf

@@ -30,9 +30,17 @@ terraform {
       source  = "contabo/contabo"
       version = "~>0.1"
     }
+    cloudns = {
+      source  = "ClouDNS/cloudns"
+      version = "~1.0"
+    }
   }
 }
 
+provider "cloudns" {
+  auth_id  = var.cloudns_auth_id
+  password = var.cloudns_password
+}
 
 provider "scaleway" {
   zone            = "fr-par-2"

terraform/iac/sectool.env

@@ -5,9 +5,13 @@ TF_VAR_scaleway_secret_key=$SCALEWAY_SECRET_KEY
 TF_VAR_scaleway_project_id=$SCALEWAY_PROJECT_ID
 TF_VAR_scaleway_organization_id=$SCALEWAY_ORGANIZATION_ID
 TF_VAR_scaleway_user_id=$SCALEWAY_USER_ID
+TF_VAR_scaleway_dkim_key=$SCALEWAY_DKIM_KEY
+TF_VAR_scaleway_dkim_value=$SCALEWAY_DKIM_VALUE
 TF_VAR_contabo_client_id=$CONTABO_CLIENT_ID
 TF_VAR_contabo_client_secret=$CONTABO_CLIENT_SECRET
 TF_VAR_contabo_api_password=$CONTABO_API_PASSWORD
 TF_VAR_contabo_api_user=$CONTABO_USER_NAME
 TF_VAR_bucket_suffix=$BUCKET_SUFFIX
 TF_VAR_encryption_key=$ENCRYPT_KEY
+TF_VAR_cloudns_auth_id=$CLOUDNS_AUTH_ID
+TF_VAR_cloudns_password=$CLOUDNS_PASSWORD

terraform/iac/variables.tf

@@ -69,3 +69,27 @@ variable "system_id" {
   type        = string
   sensitive   = true
 }
+
+variable "cloudns_auth_id" {
+  description = "Cloudns Auth ID"
+  type        = string
+  sensitive   = true
+}
+
+variable "cloudns_password" {
+  description = "Cloudns Password"
+  type        = string
+  sensitive   = true
+}
+
+variable "scaleway_dkim_key" {
+  description = "Scaleway DKIM key"
+  type        = string
+  sensitive   = true
+}
+
+variable "scaleway_dkim_value" {
+  description = "Scaleway DKIM value"
+  type        = string
+  sensitive   = true
+}

terraform/k8sapps/config.tf

@@ -2,7 +2,7 @@ locals {
 
   # apps
   wordpress_version                    = "6.5.2"
-  wordpress_fqdn                       = "blog.alexpires.me"
+  wordpress_fqdns                      = ["blog.alexpires.me", "www.alexpires.me", "alexpires.me"]
   wordpress_sql_backup_cron_schedule   = "0 2 * * *"
   wordpress_files_backup_cron_schedule = "10 2 * * *"
 

terraform/k8sapps/wordpress.tf

@@ -101,11 +101,13 @@ resource "kubernetes_ingress_v1" "wordpress_ingress" {
   }
   spec {
     tls {
-      hosts       = [local.wordpress_fqdn]
+      hosts       = local.wordpress_fqdns
       secret_name = "wordpress-le-tls"
     }
-    rule {
+    dynamic "rule" {
-      host = local.wordpress_fqdn
+      for_each = local.wordpress_fqdns
+      content {
+        host = rule.value
         http {
           path {
             backend {
@@ -120,6 +122,7 @@ resource "kubernetes_ingress_v1" "wordpress_ingress" {
         }
       }
     }
+  }
 }
 
 resource "kubernetes_deployment" "wordpress" {