a13labs.infra/terraform/k8sapps/wordpress.tf

locals {
  wordpress_path        = "${local.persistent_folder}/wordpress"
  wordpress_db_path     = "${local.database_folder}/mysql.wordpress"
  wordpress_backup_path = "${local.persistent_folder}/backup.wordpress"
}

resource "kubernetes_namespace" "wordpress" {
  metadata {
    annotations = {
      name = "wordpress"
    }

    labels = {
      name = "wordpress"
    }

    name = "wordpress"
  }
}


#
# Setup MariaDB database
#
module "wordpress_database" {
  source = "./modules/k8s_mariadb"

  namespace = kubernetes_namespace.wordpress.metadata[0].name
  app_name  = "wordpress"

  app_password  = var.wordpress_mysql_password
  root_password = var.mysql_root_password

  retention_days = local.local_backup_retention_days
  cron_schedule  = local.wordpress_sql_backup_cron_schedule

  database_folder = local.wordpress_db_path
  backup_folder   = local.wordpress_backup_path
}


#
# Setup rsync backup job to scaleway bucket
#
module "wordpress_backup" {
  source = "./modules/scw_backup_job"

  namespace = kubernetes_namespace.wordpress.metadata[0].name
  app_name  = "wordpress"

  scaleway_organization_id = var.scaleway_organization_id
  scaleway_project_id      = var.scaleway_organization_id
  access_key               = scaleway_iam_api_key.backup_app_api.access_key
  secret_key               = scaleway_iam_api_key.backup_app_api.secret_key
  bucket_name              = scaleway_object_bucket.backup.name

  retention_days = local.local_backup_retention_days
  cron_schedule  = local.wordpress_files_backup_cron_schedule

  source_folder = local.wordpress_path
  target_folder = local.wordpress_backup_path
}

# 
# Gitea service, ingress, deployment and file backup job
#
resource "kubernetes_service_account" "wordpress_service_account" {

  metadata {
    name      = "wordpress-app-sa"
    namespace = kubernetes_namespace.wordpress.metadata[0].name
  }

  automount_service_account_token = false
}


resource "kubernetes_service" "wordpress" {
  metadata {
    name      = "http"
    namespace = kubernetes_namespace.wordpress.metadata[0].name
  }
  spec {
    port {
      port        = 80
      target_port = "http"
    }
    selector = {
      app = "wordpress"
    }
    cluster_ip = "None"
  }
}

resource "kubernetes_ingress_v1" "wordpress_ingress" {
  metadata {
    name      = "wordpress-ingress"
    namespace = kubernetes_namespace.wordpress.metadata[0].name

    annotations = {
      "kubernetes.io/ingress.class"    = "public"
      "cert-manager.io/cluster-issuer" = "letsencrypt-prod"
    }
  }
  spec {
    tls {
      hosts       = local.wordpress_fqdns
      secret_name = "wordpress-le-tls"
    }
    dynamic "rule" {
      for_each = local.wordpress_fqdns
      content {
        host = rule.value
        http {
          path {
            backend {
              service {
                name = "http"
                port {
                  number = 80
                }
              }
            }
          }
        }
      }
    }
  }
}

resource "kubernetes_deployment" "wordpress" {

  depends_on = [module.wordpress_database]

  metadata {
    name      = "wordpress-app"
    namespace = kubernetes_namespace.wordpress.metadata[0].name
  }
  spec {
    selector {
      match_labels = {
        app = "wordpress"
      }
    }
    strategy {
      type = "RollingUpdate"
    }
    template {
      metadata {
        labels = {
          app = "wordpress"
        }
      }
      spec {
        service_account_name = kubernetes_service_account.wordpress_service_account.metadata[0].name

        container {
          name              = "wordpress"
          image             = "wordpress:${local.wordpress_version}"
          image_pull_policy = "IfNotPresent"

          resources {
            requests = {
              memory = "100Mi"
            }
            limits = {
              memory = "500Mi"
            }
          }

          # readiness_probe {
          #   http_get {
          #     path = "/?nocache"
          #     port = "http"
          #   }
          #   initial_delay_seconds = 20
          #   period_seconds        = 10
          #   success_threshold     = 1
          #   failure_threshold     = 5
          # }

          # liveness_probe {
          #   tcp_socket {
          #     port = "http"
          #   }
          #   initial_delay_seconds = 30
          #   period_seconds        = 60
          #   success_threshold     = 1
          #   failure_threshold     = 10
          # }
          security_context {
            allow_privilege_escalation = false
          }

          env {
            name  = "WORDPRESS_DB_NAME"
            value = "wordpress"
          }
          env {
            name  = "WORDPRESS_DB_HOST"
            value = "${module.wordpress_database.host}:${module.wordpress_database.port}"
          }
          env {
            name = "WORDPRESS_DB_USER"
            value_from {
              secret_key_ref {
                key  = "username"
                name = module.wordpress_database.app_crendentials_name
              }
            }
          }
          env {
            name = "WORDPRESS_DB_PASSWORD"
            value_from {
              secret_key_ref {
                key  = "password"
                name = module.wordpress_database.app_crendentials_name
              }
            }
          }
          port {
            container_port = 80
            name           = "http"
          }
          volume_mount {
            mount_path = "/var/www/html"
            name       = "persistent-storage"
          }
        }
        volume {
          name = "persistent-storage"
          host_path {
            path = local.wordpress_path
          }
        }
      }
    }
  }
}