viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

extract remaining 19 modules from platform, complete stack split [ci skip]

Browse source 
Phase 3: all 27 platform modules now run as independent stacks.
Platform reduced to empty shell (outputs only) for backward compat
with 72 app stacks that declare dependency "platform".
Fixed technitium cross-module dashboard reference by copying file.
Woodpecker pipeline applies all 27+1 stacks in parallel via loop.
All applied with zero destroys.
This commit is contained in:
Viktor Barzin 2026-03-17 21:42:16 +00:00 • committed by Viktor Barzin
parent f7c3a338a5
commit 263d97bea2
134 changed files with 7930 additions and 270 deletions
Download patch file Download diff file Expand all files Collapse all files

239
stacks/xray/modules/xray/main.tf Normal file
View file

@ -0,0 +1,239 @@
variable "tls_secret_name" {}
variable "tier" { type = string }
variable "xray_reality_clients" { type = list(map(string)) }
variable "xray_reality_private_key" {
type = string
sensitive = true
}
variable "xray_reality_short_ids" { type = list(string) }
# Github repo - https://github.com/teddysun/across/blob/master/docker/xray/README.md
# Clients:
# iOS - OneXRay - https://github.com/OneXray/OneXray
# MacOS - V2BOX
module "tls_secret" {
source = "../../../../modules/kubernetes/setup_tls_secret"
namespace = kubernetes_namespace.xray.metadata[0].name
tls_secret_name = var.tls_secret_name
}
resource "kubernetes_namespace" "xray" {
metadata {
name = "xray"
labels = {
tier = var.tier
}
}
}
resource "kubernetes_config_map" "xray_config" {
metadata {
name = "xray-config"
namespace = kubernetes_namespace.xray.metadata[0].name
labels = {
app = "xray"
}
annotations = {
"reloader.stakater.com/match" = "true"
}
}
data = {
"config.json" = templatefile("${path.module}/xray_config.json.tpl", {
clients = jsonencode(var.xray_reality_clients)
reality_private_key = var.xray_reality_private_key
reality_short_ids = jsonencode(var.xray_reality_short_ids)
})
}
}
resource "kubernetes_deployment" "xray" {
metadata {
name = "xray"
namespace = kubernetes_namespace.xray.metadata[0].name
labels = {
app = "xray"
tier = var.tier
}
annotations = {
"reloader.stakater.com/search" = "true"
}
}
spec {
replicas = 1
strategy {
rolling_update {
max_surge = "2"
max_unavailable = "0"
}
}
selector {
match_labels = {
app = "xray"
}
}
template {
metadata {
labels = {
app = "xray"
}
}
spec {
container {
image = "teddysun/xray"
name = "xray"
image_pull_policy = "IfNotPresent"
port {
container_port = 6443 // vless
protocol = "TCP"
}
port {
container_port = 7443 // reality
protocol = "TCP"
}
port {
container_port = 8443 // websocket
protocol = "TCP"
}
port {
container_port = 9443 // gRPC
protocol = "TCP"
}
volume_mount {
name = "tls"
mount_path = "/etc/xray/tls.crt"
sub_path = "tls.crt"
}
volume_mount {
name = "tls"
mount_path = "/etc/xray/tls.key"
sub_path = "tls.key"
}
volume_mount {
name = "config"
mount_path = "/etc/xray/config.json"
sub_path = "config.json"
}
resources {
requests = {
cpu = "10m"
memory = "64Mi"
}
limits = {
memory = "64Mi"
}
}
}
volume {
name = "tls"
secret {
secret_name = var.tls_secret_name
}
}
volume {
name = "config"
config_map {
name = "xray-config"
}
}
dns_config {
option {
name = "ndots"
value = "2"
}
}
}
}
}
}
resource "kubernetes_service" "xray" {
metadata {
name = "xray"
namespace = kubernetes_namespace.xray.metadata[0].name
labels = {
"app" = "xray"
}
}
spec {
selector = {
app = "xray"
}
port {
name = "vless"
port = 6443
protocol = "TCP"
}
port {
name = "websocket"
port = 8443
protocol = "TCP"
}
port {
name = "grpc"
port = 9443
protocol = "TCP"
}
}
}
resource "kubernetes_service" "xray-reality" {
metadata {
name = "xray-reality"
namespace = kubernetes_namespace.xray.metadata[0].name
labels = {
"app" = "xray"
}
}
spec {
type = "LoadBalancer"
selector = {
app = "xray"
}
port {
name = "reality"
port = 7443
protocol = "TCP"
}
}
}
module "ingress_ws" {
source = "../../../../modules/kubernetes/ingress_factory"
namespace = kubernetes_namespace.xray.metadata[0].name
name = "xray-ws"
service_name = "xray"
host = "xray-ws"
port = 8443
tls_secret_name = var.tls_secret_name
}
module "ingress_grpc" {
source = "../../../../modules/kubernetes/ingress_factory"
namespace = kubernetes_namespace.xray.metadata[0].name
name = "xray-grpc"
service_name = "xray"
host = "xray-grpc"
port = 9443
tls_secret_name = var.tls_secret_name
ingress_path = ["/grpc-vpn"]
extra_annotations = {
"traefik.ingress.kubernetes.io/service.serversscheme" = "h2c"
}
}
module "ingress_vless" {
source = "../../../../modules/kubernetes/ingress_factory"
namespace = kubernetes_namespace.xray.metadata[0].name
name = "xray-vless"
service_name = "xray"
host = "xray-vless"
port = 6443
tls_secret_name = var.tls_secret_name
}

80
stacks/xray/modules/xray/xray_config.json.tpl Normal file
View file

@ -0,0 +1,80 @@
{
"log": {
"loglevel": "none"
},
"inbounds": [
{
"port": 7443,
"protocol": "vless",
"settings": {
"clients": ${clients},
"decryption": "none"
},
"streamSettings": {
"network": "tcp",
"security": "reality",
"realitySettings": {
"show": false,
"dest": "www.cloudflare.com:443",
"xver": 0,
"serverNames": [
"www.cloudflare.com"
],
"privateKey": "${reality_private_key}",
"shortIds": ${reality_short_ids}
}
}
},
{
"port": 8443,
"protocol": "vless",
"settings": {
"clients": ${clients},
"decryption": "none"
},
"streamSettings": {
"network": "ws",
"security": "none",
"tlsSettings": {
"certificates": [
{
"certificateFile": "/etc/xray/tls.crt",
"keyFile": "/etc/xray/tls.key"
}
]
},
"wsSettings": {
"path": "/ws"
}
}
},
{
"port": 9443,
"protocol": "vless",
"settings": {
"clients": ${clients},
"decryption": "none"
},
"streamSettings": {
"network": "xhttp",
"security": "none",
"tlsSettings": {
"certificates": [
{
"certificateFile": "/etc/xray/tls.crt",
"keyFile": "/etc/xray/tls.key"
}
]
},
"xhttpSettings": {
"path": "/grpc-vpn"
}
}
}
],
"outbounds": [
{
"protocol": "freedom"
}
]
}