a13labs.infra/terraform/modules/apps/m3uproxy/vpn.tf

resource "kubernetes_config_map" "wireguard_config" {
  metadata {
    name      = "wireguard-config"
    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
  }

  data = {
    "wireguard.conf" = local.wireguard_config
  }
}

resource "kubernetes_config_map" "squid_config" {
  metadata {
    name      = "squid-config"
    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
  }

  data = {
    "squid.conf" = local.squid_config
  }

}

resource "kubernetes_deployment" "proxy_pt" {
  metadata {
    name      = "proxy-pt"
    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
    annotations = {
      "security.alpha.kubernetes.io/unsafe-sysctls" = "net.ipv4.conf.all.src_valid_mark=1"
    }
  }

  spec {
    replicas = 1

    selector {
      match_labels = {
        app = "proxy-pt"
      }
    }

    strategy {
      type = "Recreate"
    }

    template {
      metadata {
        labels = {
          app = "proxy-pt"
        }
        annotations = {
          "checksum/squid"     = local.squid_config_checksum
          "checksum/wireguard" = local.wireguard_config_checksum
        }
      }

      spec {
        container {
          name  = "wireguard"
          image = "linuxserver/wireguard:${local.wireguard_version}"

          resources {
            requests = {
              memory = "64Mi"
            }
          }

          liveness_probe {
            exec {
              command = [
                "/bin/sh",
                "-c",
                "wg show | grep -q transfer"
              ]
            }
            initial_delay_seconds = 90
            period_seconds        = 90
          }

          security_context {
            privileged = true
            capabilities {
              add = ["NET_ADMIN"]
            }
          }

          env {
            name  = "PUID"
            value = "1000"
          }

          env {
            name  = "PGID"
            value = "1000"
          }

          env {
            name  = "TZ"
            value = "Europe/Berlin"
          }

          volume_mount {
            name       = "wireguard-config"
            mount_path = "/config/wg_confs"
            read_only  = true
          }

          volume_mount {
            name       = "lib-modules"
            mount_path = "/lib/modules"
            read_only  = true
          }
        }

        container {
          name  = "squid"
          image = "ubuntu/squid:${local.squid_version}"

          port {
            container_port = 3128
            name           = "proxy"
            protocol       = "TCP"
          }

          readiness_probe {
            tcp_socket {
              port = "proxy"
            }
            initial_delay_seconds = 10
            timeout_seconds       = 4
          }

          liveness_probe {
            tcp_socket {
              port = "proxy"
            }
            initial_delay_seconds = 10
            timeout_seconds       = 4
          }

          resources {
            requests = {
              memory = "256Mi"
            }
          }

          security_context {
            allow_privilege_escalation = false
            run_as_user                = 1000
            run_as_group               = 1000
          }

          volume_mount {
            name       = "squid-config"
            mount_path = "/etc/squid"
            read_only  = true
          }

          volume_mount {
            name       = "squid-data"
            mount_path = "/var/spol/squid"
          }

        }

        volume {
          name = "wireguard-config"
          config_map {
            name = kubernetes_config_map.wireguard_config.metadata[0].name
          }
        }

        volume {
          name = "lib-modules"
          host_path {
            path = "/lib/modules"
          }
        }

        volume {
          name = "squid-config"
          config_map {
            name = kubernetes_config_map.squid_config.metadata[0].name
          }
        }

        volume {
          name = "squid-data"
          host_path {
            path = local.squid_app_path
          }
        }
      }
    }
  }

  lifecycle {
    ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]]
  }
}

resource "kubernetes_service" "proxy_pt" {
  metadata {
    name      = "proxy-pt"
    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
  }

  spec {
    selector = {
      app = "proxy-pt"
    }
    port {
      port = 3128
    }
    cluster_ip = "None"
  }
}