viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

migrate vaultwarden storage from NFS to iSCSI

Browse source 
SQLite on NFS causes DB corruption due to unreliable POSIX fcntl locking.
iSCSI provides a block device with a local filesystem where locking works
correctly. Same approach used for Redis, MySQL, PostgreSQL, etc.
This commit is contained in:
Viktor Barzin 2026-03-14 22:45:56 +00:00
parent 7e72a10848
commit 92cc3f01c1
2 changed files with 15 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

1
stacks/platform/main.tf
View file

@ -225,7 +225,6 @@ module "monitoring" {
module "vaultwarden" { module "vaultwarden" {
source = "./modules/vaultwarden" source = "./modules/vaultwarden"
tls_secret_name = var.tls_secret_name tls_secret_name = var.tls_secret_name
nfs_server = var.nfs_server
mail_host = var.mail_host mail_host = var.mail_host
smtp_password = data.vault_kv_secret_v2.secrets.data["vaultwarden_smtp_password"] smtp_password = data.vault_kv_secret_v2.secrets.data["vaultwarden_smtp_password"]
tier = local.tiers.edge tier = local.tiers.edge

23
stacks/platform/modules/vaultwarden/main.tf
View file

@ -1,7 +1,6 @@
variable "tls_secret_name" {} variable "tls_secret_name" {}
variable "tier" { type = string } variable "tier" { type = string }
variable "smtp_password" {} variable "smtp_password" {}
variable "nfs_server" { type = string }
variable "mail_host" { type = string } variable "mail_host" { type = string }
resource "kubernetes_namespace" "vaultwarden" { resource "kubernetes_namespace" "vaultwarden" {
@ -20,12 +19,20 @@ module "tls_secret" {
tls_secret_name = var.tls_secret_name tls_secret_name = var.tls_secret_name
} }
module "nfs_data" { resource "kubernetes_persistent_volume_claim" "vaultwarden_data" {
source = "../../../../modules/kubernetes/nfs_volume" metadata {
name = "vaultwarden-data" name = "vaultwarden-data-iscsi"
namespace = kubernetes_namespace.vaultwarden.metadata[0].name namespace = kubernetes_namespace.vaultwarden.metadata[0].name
nfs_server = var.nfs_server }
nfs_path = "/mnt/main/vaultwarden" spec {
access_modes = ["ReadWriteOnce"]
storage_class_name = "iscsi-truenas"
resources {
requests = {
storage = "1Gi"
}
}
}
} }
resource "kubernetes_deployment" "vaultwarden" { resource "kubernetes_deployment" "vaultwarden" {
@ -136,7 +143,7 @@ resource "kubernetes_deployment" "vaultwarden" {
volume { volume {
name = "data" name = "data"
persistent_volume_claim { persistent_volume_claim {
claim_name = module.nfs_data.claim_name claim_name = kubernetes_persistent_volume_claim.vaultwarden_data.metadata[0].name
} }
} }
dns_config { dns_config {