2023-12-17 12:22:29 +00:00
|
|
|
variable "tls_secret_name" {}
|
2026-01-10 16:28:12 +00:00
|
|
|
variable "tier" { type = string }
|
[ci skip] Infrastructure hardening: security, monitoring, reliability, maintainability
Phase 1 - Critical Security:
- Netbox: move hardcoded DB/superuser passwords to variables
- MeshCentral: disable public registration, add Authentik auth
- Traefik: disable insecure API dashboard (api.insecure=false)
- Traefik: configure forwarded headers with Cloudflare trusted IPs
Phase 2 - Security Hardening:
- Add security headers middleware (HSTS, X-Frame-Options, nosniff, etc.)
- Add Kyverno pod security policies in audit mode (privileged, host
namespaces, SYS_ADMIN, trusted registries)
- Tighten rate limiting (avg=10, burst=50)
- Add Authentik protection to grampsweb
Phase 3 - Monitoring & Alerting:
- Add critical service alerts (PostgreSQL, MySQL, Redis, Headscale,
Authentik, Loki)
- Increase Loki retention from 7 to 30 days (720h)
- Add predictive PV filling alert (predict_linear)
- Re-enable Hackmd and Privatebin down alerts
Phase 4 - Reliability:
- Add resource requests/limits to Redis, DBaaS, Technitium, Headscale,
Vaultwarden, Uptime Kuma
- Increase Alloy DaemonSet memory to 512Mi/1Gi
Phase 6 - Maintainability:
- Extract duplicated tiers locals to terragrunt.hcl generate block
(removed from 67 stacks)
- Replace hardcoded NFS IP 10.0.10.15 with var.nfs_server (114
instances across 63 files)
- Replace hardcoded Redis/PostgreSQL/MySQL/Ollama/mail host references
with variables across ~35 stacks
- Migrate xray raw ingress resources to ingress_factory modules
2026-02-23 22:05:28 +00:00
|
|
|
variable "nfs_server" { type = string }
|
2023-12-17 12:22:29 +00:00
|
|
|
|
|
|
|
|
resource "kubernetes_namespace" "uptime-kuma" {
|
|
|
|
|
metadata {
|
|
|
|
|
name = "uptime-kuma"
|
2026-02-21 23:38:05 +00:00
|
|
|
labels = {
|
|
|
|
|
tier = var.tier
|
|
|
|
|
}
|
2024-01-21 03:33:57 +00:00
|
|
|
# labels = {
|
|
|
|
|
# "istio-injection" : "enabled"
|
|
|
|
|
# }
|
2023-12-17 12:22:29 +00:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2025-12-29 10:23:42 +00:00
|
|
|
module "tls_secret" {
|
2026-02-22 14:38:14 +00:00
|
|
|
source = "../../../../modules/kubernetes/setup_tls_secret"
|
2025-12-29 10:23:42 +00:00
|
|
|
namespace = kubernetes_namespace.uptime-kuma.metadata[0].name
|
|
|
|
|
tls_secret_name = var.tls_secret_name
|
|
|
|
|
}
|
|
|
|
|
|
[ci skip] complete NFS CSI migration: complex stacks + platform modules
Migrate remaining multi-volume stacks and all platform modules from
inline NFS volumes to CSI-backed PV/PVC with nfs-truenas StorageClass
(soft,timeo=30,retrans=3 mount options).
Complex stacks: openclaw (4 vols), immich (8 vols), frigate (2 vols),
nextcloud (2 vols + old PV replaced), rybbit (1 vol)
Remaining stacks: affine, ebook2audiobook, f1-stream, osm_routing,
real-estate-crawler
Platform modules: monitoring (prometheus, loki, alertmanager PVs
converted from native NFS to CSI), redis, dbaas, technitium,
headscale, vaultwarden, uptime-kuma, mailserver, infra-maintenance
2026-03-02 01:24:07 +00:00
|
|
|
module "nfs_data" {
|
|
|
|
|
source = "../../../../modules/kubernetes/nfs_volume"
|
|
|
|
|
name = "uptime-kuma-data"
|
|
|
|
|
namespace = kubernetes_namespace.uptime-kuma.metadata[0].name
|
|
|
|
|
nfs_server = var.nfs_server
|
|
|
|
|
nfs_path = "/mnt/main/uptime-kuma"
|
|
|
|
|
}
|
|
|
|
|
|
2023-12-17 12:22:29 +00:00
|
|
|
resource "kubernetes_deployment" "uptime-kuma" {
|
|
|
|
|
metadata {
|
|
|
|
|
name = "uptime-kuma"
|
2025-12-29 10:23:42 +00:00
|
|
|
namespace = kubernetes_namespace.uptime-kuma.metadata[0].name
|
2023-12-17 12:22:29 +00:00
|
|
|
labels = {
|
2026-01-10 16:28:12 +00:00
|
|
|
app = "uptime-kuma"
|
|
|
|
|
tier = var.tier
|
2023-12-17 12:22:29 +00:00
|
|
|
}
|
|
|
|
|
annotations = {
|
|
|
|
|
"reloader.stakater.com/search" = "true"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
spec {
|
|
|
|
|
replicas = 1
|
2024-01-21 03:33:57 +00:00
|
|
|
strategy {
|
|
|
|
|
type = "Recreate"
|
|
|
|
|
}
|
2023-12-17 12:22:29 +00:00
|
|
|
selector {
|
|
|
|
|
match_labels = {
|
|
|
|
|
app = "uptime-kuma"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
template {
|
|
|
|
|
metadata {
|
2024-08-17 20:23:20 +00:00
|
|
|
annotations = {
|
2024-12-30 14:01:38 +00:00
|
|
|
"diun.enable" = "true"
|
|
|
|
|
"diun.include_tags" = "latest"
|
2024-08-17 20:23:20 +00:00
|
|
|
}
|
2023-12-17 12:22:29 +00:00
|
|
|
labels = {
|
|
|
|
|
app = "uptime-kuma"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
spec {
|
|
|
|
|
container {
|
2025-10-20 20:35:51 +00:00
|
|
|
image = "louislam/uptime-kuma:2"
|
2023-12-17 12:22:29 +00:00
|
|
|
name = "uptime-kuma"
|
|
|
|
|
|
[ci skip] Infrastructure hardening: security, monitoring, reliability, maintainability
Phase 1 - Critical Security:
- Netbox: move hardcoded DB/superuser passwords to variables
- MeshCentral: disable public registration, add Authentik auth
- Traefik: disable insecure API dashboard (api.insecure=false)
- Traefik: configure forwarded headers with Cloudflare trusted IPs
Phase 2 - Security Hardening:
- Add security headers middleware (HSTS, X-Frame-Options, nosniff, etc.)
- Add Kyverno pod security policies in audit mode (privileged, host
namespaces, SYS_ADMIN, trusted registries)
- Tighten rate limiting (avg=10, burst=50)
- Add Authentik protection to grampsweb
Phase 3 - Monitoring & Alerting:
- Add critical service alerts (PostgreSQL, MySQL, Redis, Headscale,
Authentik, Loki)
- Increase Loki retention from 7 to 30 days (720h)
- Add predictive PV filling alert (predict_linear)
- Re-enable Hackmd and Privatebin down alerts
Phase 4 - Reliability:
- Add resource requests/limits to Redis, DBaaS, Technitium, Headscale,
Vaultwarden, Uptime Kuma
- Increase Alloy DaemonSet memory to 512Mi/1Gi
Phase 6 - Maintainability:
- Extract duplicated tiers locals to terragrunt.hcl generate block
(removed from 67 stacks)
- Replace hardcoded NFS IP 10.0.10.15 with var.nfs_server (114
instances across 63 files)
- Replace hardcoded Redis/PostgreSQL/MySQL/Ollama/mail host references
with variables across ~35 stacks
- Migrate xray raw ingress resources to ingress_factory modules
2026-02-23 22:05:28 +00:00
|
|
|
resources {
|
|
|
|
|
requests = {
|
|
|
|
|
cpu = "50m"
|
|
|
|
|
memory = "64Mi"
|
|
|
|
|
}
|
|
|
|
|
limits = {
|
2026-03-12 07:26:08 +00:00
|
|
|
memory = "512Mi"
|
[ci skip] Infrastructure hardening: security, monitoring, reliability, maintainability
Phase 1 - Critical Security:
- Netbox: move hardcoded DB/superuser passwords to variables
- MeshCentral: disable public registration, add Authentik auth
- Traefik: disable insecure API dashboard (api.insecure=false)
- Traefik: configure forwarded headers with Cloudflare trusted IPs
Phase 2 - Security Hardening:
- Add security headers middleware (HSTS, X-Frame-Options, nosniff, etc.)
- Add Kyverno pod security policies in audit mode (privileged, host
namespaces, SYS_ADMIN, trusted registries)
- Tighten rate limiting (avg=10, burst=50)
- Add Authentik protection to grampsweb
Phase 3 - Monitoring & Alerting:
- Add critical service alerts (PostgreSQL, MySQL, Redis, Headscale,
Authentik, Loki)
- Increase Loki retention from 7 to 30 days (720h)
- Add predictive PV filling alert (predict_linear)
- Re-enable Hackmd and Privatebin down alerts
Phase 4 - Reliability:
- Add resource requests/limits to Redis, DBaaS, Technitium, Headscale,
Vaultwarden, Uptime Kuma
- Increase Alloy DaemonSet memory to 512Mi/1Gi
Phase 6 - Maintainability:
- Extract duplicated tiers locals to terragrunt.hcl generate block
(removed from 67 stacks)
- Replace hardcoded NFS IP 10.0.10.15 with var.nfs_server (114
instances across 63 files)
- Replace hardcoded Redis/PostgreSQL/MySQL/Ollama/mail host references
with variables across ~35 stacks
- Migrate xray raw ingress resources to ingress_factory modules
2026-02-23 22:05:28 +00:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2023-12-17 12:22:29 +00:00
|
|
|
port {
|
|
|
|
|
container_port = 3001
|
|
|
|
|
}
|
[ci skip] iSCSI migration, healthcheck fixes, health probes, etcd backup
- Migrate MySQL/PostgreSQL storage from local-path to iscsi-truenas
- Add democratic-csi iSCSI driver module for TrueNAS
- Add open-iscsi to cloud-init VM template
- Fix Shlink health probe path (/api/v3 -> /rest/v3 for Shlink 5.0)
- Fix etcd backup: use etcd 3.5.21-0 (3.6.x is distroless, no /bin/sh)
- Fix cluster healthcheck CronJob: always exit 0 to prevent circular
JobFailed alerts (reporting via Slack, not exit codes)
- Fix Uptime Kuma nested list handling in cluster-health.sh
- Add health probes to: audiobookshelf, immich ML, ntfy, headscale,
uptime-kuma, vaultwarden, rybbit (clickhouse + server + client),
shlink, shlink-web
- Add iSCSI storage documentation to CLAUDE.md
2026-03-06 19:54:21 +00:00
|
|
|
liveness_probe {
|
|
|
|
|
http_get {
|
|
|
|
|
path = "/"
|
|
|
|
|
port = 3001
|
|
|
|
|
}
|
|
|
|
|
initial_delay_seconds = 15
|
|
|
|
|
period_seconds = 30
|
|
|
|
|
timeout_seconds = 5
|
|
|
|
|
failure_threshold = 5
|
|
|
|
|
}
|
|
|
|
|
readiness_probe {
|
|
|
|
|
http_get {
|
|
|
|
|
path = "/"
|
|
|
|
|
port = 3001
|
|
|
|
|
}
|
|
|
|
|
initial_delay_seconds = 5
|
|
|
|
|
period_seconds = 30
|
|
|
|
|
timeout_seconds = 5
|
|
|
|
|
failure_threshold = 3
|
|
|
|
|
}
|
2023-12-17 12:22:29 +00:00
|
|
|
volume_mount {
|
|
|
|
|
name = "data"
|
|
|
|
|
mount_path = "/app/data"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
volume {
|
|
|
|
|
name = "data"
|
[ci skip] complete NFS CSI migration: complex stacks + platform modules
Migrate remaining multi-volume stacks and all platform modules from
inline NFS volumes to CSI-backed PV/PVC with nfs-truenas StorageClass
(soft,timeo=30,retrans=3 mount options).
Complex stacks: openclaw (4 vols), immich (8 vols), frigate (2 vols),
nextcloud (2 vols + old PV replaced), rybbit (1 vol)
Remaining stacks: affine, ebook2audiobook, f1-stream, osm_routing,
real-estate-crawler
Platform modules: monitoring (prometheus, loki, alertmanager PVs
converted from native NFS to CSI), redis, dbaas, technitium,
headscale, vaultwarden, uptime-kuma, mailserver, infra-maintenance
2026-03-02 01:24:07 +00:00
|
|
|
persistent_volume_claim {
|
|
|
|
|
claim_name = module.nfs_data.claim_name
|
2023-12-17 12:22:29 +00:00
|
|
|
}
|
|
|
|
|
}
|
2026-02-23 22:43:05 +00:00
|
|
|
dns_config {
|
|
|
|
|
option {
|
|
|
|
|
name = "ndots"
|
|
|
|
|
value = "2"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-12-17 12:22:29 +00:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
resource "kubernetes_service" "uptime-kuma" {
|
|
|
|
|
metadata {
|
|
|
|
|
name = "uptime-kuma"
|
2025-12-29 10:23:42 +00:00
|
|
|
namespace = kubernetes_namespace.uptime-kuma.metadata[0].name
|
2023-12-17 12:22:29 +00:00
|
|
|
labels = {
|
|
|
|
|
"app" = "uptime-kuma"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
spec {
|
|
|
|
|
selector = {
|
|
|
|
|
app = "uptime-kuma"
|
|
|
|
|
}
|
|
|
|
|
port {
|
|
|
|
|
port = "80"
|
|
|
|
|
target_port = "3001"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
2025-01-14 22:53:04 +00:00
|
|
|
module "ingress" {
|
2026-02-22 14:38:14 +00:00
|
|
|
source = "../../../../modules/kubernetes/ingress_factory"
|
2025-12-29 10:23:42 +00:00
|
|
|
namespace = kubernetes_namespace.uptime-kuma.metadata[0].name
|
2025-01-14 22:53:04 +00:00
|
|
|
name = "uptime"
|
|
|
|
|
tls_secret_name = var.tls_secret_name
|
|
|
|
|
service_name = "uptime-kuma"
|
|
|
|
|
extra_annotations = {
|
2026-02-07 13:25:49 +00:00
|
|
|
"gethomepage.dev/enabled" = "true"
|
|
|
|
|
"gethomepage.dev/description" = "Uptime monitor"
|
2026-03-07 16:41:36 +00:00
|
|
|
"gethomepage.dev/group" = "Core Platform"
|
2025-01-14 22:53:04 +00:00
|
|
|
"gethomepage.dev/icon" : "uptime-kuma.png"
|
|
|
|
|
"gethomepage.dev/name" = "Uptime Kuma"
|
|
|
|
|
"gethomepage.dev/pod-selector" = ""
|
2026-03-07 19:03:06 +00:00
|
|
|
"gethomepage.dev/widget.type" = "uptimekuma"
|
2026-03-07 19:23:57 +00:00
|
|
|
"gethomepage.dev/widget.url" = "http://uptime-kuma.uptime-kuma.svc.cluster.local"
|
2026-03-07 19:03:06 +00:00
|
|
|
"gethomepage.dev/widget.slug" = "infra"
|
2023-12-17 12:22:29 +00:00
|
|
|
}
|
2025-12-18 08:53:16 +00:00
|
|
|
rybbit_site_id = "8fef77b1f7fe"
|
2023-12-17 12:22:29 +00:00
|
|
|
}
|
2025-05-04 11:22:33 +00:00
|
|
|
|
2025-10-20 20:35:51 +00:00
|
|
|
# CronJob for daily SQLite backups # no longer needed as we're using the mysql
|
|
|
|
|
# resource "kubernetes_cron_job_v1" "sqlite-backup" {
|
|
|
|
|
# metadata {
|
|
|
|
|
# name = "backup"
|
2025-12-29 10:23:42 +00:00
|
|
|
# namespace = kubernetes_namespace.uptime-kuma.metadata[0].name
|
2025-10-20 20:35:51 +00:00
|
|
|
# }
|
|
|
|
|
# spec {
|
|
|
|
|
# concurrency_policy = "Replace"
|
|
|
|
|
# failed_jobs_history_limit = 5
|
|
|
|
|
# schedule = "0 0 * * *"
|
|
|
|
|
# # schedule = "* * * * *"
|
|
|
|
|
# starting_deadline_seconds = 10
|
|
|
|
|
# successful_jobs_history_limit = 3
|
|
|
|
|
# job_template {
|
|
|
|
|
# metadata {}
|
|
|
|
|
# spec {
|
|
|
|
|
# active_deadline_seconds = 600 # should finish in 10 minutes
|
|
|
|
|
# backoff_limit = 3
|
|
|
|
|
# ttl_seconds_after_finished = 10
|
|
|
|
|
# template {
|
|
|
|
|
# metadata {}
|
|
|
|
|
# spec {
|
|
|
|
|
# container {
|
|
|
|
|
# name = "backup"
|
|
|
|
|
# image = "alpine/sqlite:latest"
|
|
|
|
|
# command = ["/bin/sh", "-c", <<-EOT
|
|
|
|
|
# set -e
|
|
|
|
|
# export now=$(date +"%Y_%m_%d_%H_%M")
|
|
|
|
|
# echo "Backing up SQLite database to /app/data/backup/backup_$now.sqlite"
|
|
|
|
|
# sqlite3 /app/data/kuma.db ".backup /app/data/backup/backup_$now.sqlite"
|
|
|
|
|
# echo "Backup completed. Deleting old backups..."
|
2025-05-04 11:22:33 +00:00
|
|
|
|
2025-10-20 20:35:51 +00:00
|
|
|
# # Rotate - delete last log file
|
|
|
|
|
# cd /app/data/backup
|
|
|
|
|
# find . -name "*.sqlite" -type f -mtime +7 -delete # 7 day retention of backups
|
|
|
|
|
# echo "Old backups deleted."
|
|
|
|
|
# EOT
|
|
|
|
|
# ]
|
|
|
|
|
# volume_mount {
|
|
|
|
|
# name = "data"
|
|
|
|
|
# mount_path = "/app/data"
|
|
|
|
|
# }
|
|
|
|
|
# }
|
|
|
|
|
# volume {
|
|
|
|
|
# name = "data"
|
|
|
|
|
# nfs {
|
[ci skip] Infrastructure hardening: security, monitoring, reliability, maintainability
Phase 1 - Critical Security:
- Netbox: move hardcoded DB/superuser passwords to variables
- MeshCentral: disable public registration, add Authentik auth
- Traefik: disable insecure API dashboard (api.insecure=false)
- Traefik: configure forwarded headers with Cloudflare trusted IPs
Phase 2 - Security Hardening:
- Add security headers middleware (HSTS, X-Frame-Options, nosniff, etc.)
- Add Kyverno pod security policies in audit mode (privileged, host
namespaces, SYS_ADMIN, trusted registries)
- Tighten rate limiting (avg=10, burst=50)
- Add Authentik protection to grampsweb
Phase 3 - Monitoring & Alerting:
- Add critical service alerts (PostgreSQL, MySQL, Redis, Headscale,
Authentik, Loki)
- Increase Loki retention from 7 to 30 days (720h)
- Add predictive PV filling alert (predict_linear)
- Re-enable Hackmd and Privatebin down alerts
Phase 4 - Reliability:
- Add resource requests/limits to Redis, DBaaS, Technitium, Headscale,
Vaultwarden, Uptime Kuma
- Increase Alloy DaemonSet memory to 512Mi/1Gi
Phase 6 - Maintainability:
- Extract duplicated tiers locals to terragrunt.hcl generate block
(removed from 67 stacks)
- Replace hardcoded NFS IP 10.0.10.15 with var.nfs_server (114
instances across 63 files)
- Replace hardcoded Redis/PostgreSQL/MySQL/Ollama/mail host references
with variables across ~35 stacks
- Migrate xray raw ingress resources to ingress_factory modules
2026-02-23 22:05:28 +00:00
|
|
|
# server = var.nfs_server
|
2025-10-20 20:35:51 +00:00
|
|
|
# path = "/mnt/main/uptime-kuma"
|
|
|
|
|
# }
|
|
|
|
|
# }
|
|
|
|
|
# }
|
|
|
|
|
# }
|
|
|
|
|
# }
|
|
|
|
|
# }
|
|
|
|
|
# }
|
|
|
|
|
# }
|