viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[ci skip] right-size all pod resources based on VPA + live metrics audit

Browse source 
Full cluster resource audit: cross-referenced Goldilocks VPA recommendations,
live kubectl top metrics, and Terraform definitions for 100+ containers.

Critical fixes:
- dashy: CPU throttled at 98% (490m/500m) → 2 CPU limit
- stirling-pdf: CPU throttled at 99.7% (299m/300m) → 2 CPU limit
- traefik auth-proxy/bot-block-proxy: mem limit 32Mi → 128Mi

Added explicit resources to ~40 containers that had none:
- audiobookshelf, changedetection, cyberchef, dawarich, diun, echo,
  excalidraw, freshrss, hackmd, isponsorblocktv, linkwarden, n8n,
  navidrome, ntfy, owntracks, privatebin, send, shadowsocks, tandoor,
  tor-proxy, wealthfolio, networking-toolbox, rybbit, mailserver,
  cloudflared, pgadmin, phpmyadmin, crowdsec-web, xray, wireguard,
  k8s-portal, tuya-bridge, ollama-ui, whisper, piper, immich-server,
  immich-postgresql, osrm-foot

GPU containers: added CPU/mem alongside GPU limits:
- ollama: removed CPU/mem limits (models vary in size), keep GPU only
- frigate: req 500m/2Gi, lim 4/8Gi + GPU
- immich-ml: req 100m/1Gi, lim 2/4Gi + GPU

Right-sized ~25 over-provisioned containers:
- kms-web-page: 500m/512Mi → 50m/64Mi (was using 0m/10Mi)
- onlyoffice: CPU 8 → 2 (VPA upper 45m)
- realestate-crawler-api: CPU 2000m → 250m
- blog/travel-blog/webhook-handler: 500m → 100m
- coturn/health/plotting-book: reduced to match actual usage

Conservative methodology: limits = max(VPA upper * 2, live usage * 2)
This commit is contained in:
Viktor Barzin 2026-03-01 19:18:50 +00:00
parent ccf0b2232f
commit 9e4fb23b10
66 changed files with 590 additions and 128 deletions
Download patch file Download diff file Expand all files Collapse all files

8
stacks/atuin/main.tf
View file

@ -80,12 +80,12 @@ resource "kubernetes_deployment" "atuin" {
resources {
requests = {
memory = "64Mi"
cpu = "50m"
memory = "16Mi"
cpu = "10m"
}
limits = {
memory = "256Mi"
cpu = "500m"
memory = "128Mi"
cpu = "100m"
}
}

10
stacks/audiobookshelf/main.tf
View file

@ -70,6 +70,16 @@ resource "kubernetes_deployment" "audiobookshelf" {
name = "metadata"
mount_path = "/metadata"
}
resources {
requests = {
cpu = "15m"
memory = "64Mi"
}
limits = {
cpu = "250m"
memory = "512Mi"
}
}
}
volume {
name = "audiobooks"

8
stacks/blog/main.tf
View file

@ -45,12 +45,12 @@ resource "kubernetes_deployment" "blog" {
name = "blog"
resources {
limits = {
cpu = "0.5"
memory = "512Mi"
cpu = "100m"
memory = "256Mi"
}
requests = {
cpu = "250m"
memory = "50Mi"
cpu = "10m"
memory = "32Mi"
}
}
port {

4
stacks/calibre/main.tf
View file

@ -158,11 +158,11 @@ resource "kubernetes_deployment" "calibre-web-automated" {
}
resources {
requests = {
cpu = "50m"
cpu = "25m"
memory = "256Mi"
}
limits = {
cpu = "1"
cpu = "500m"
memory = "1Gi"
}
}

20
stacks/changedetection/main.tf
View file

@ -58,6 +58,16 @@ resource "kubernetes_deployment" "changedetection" {
add = ["SYS_ADMIN"]
}
}
resources {
requests = {
cpu = "25m"
memory = "128Mi"
}
limits = {
cpu = "500m"
memory = "512Mi"
}
}
}
container {
@ -88,6 +98,16 @@ resource "kubernetes_deployment" "changedetection" {
container_port = 5000
protocol = "TCP"
}
resources {
requests = {
cpu = "15m"
memory = "64Mi"
}
limits = {
cpu = "250m"
memory = "256Mi"
}
}
}
# security_context {
# fs_group = "1500"

8
stacks/city-guesser/main.tf
View file

@ -45,12 +45,12 @@ resource "kubernetes_deployment" "city-guesser" {
name = "city-guesser"
resources {
limits = {
cpu = "0.5"
memory = "512Mi"
cpu = "100m"
memory = "256Mi"
}
requests = {
cpu = "250m"
memory = "50Mi"
cpu = "10m"
memory = "32Mi"
}
}
port {

8
stacks/coturn/main.tf
View file

@ -128,12 +128,12 @@ resource "kubernetes_deployment" "coturn" {
resources {
requests = {
cpu = "100m"
memory = "128Mi"
cpu = "10m"
memory = "32Mi"
}
limits = {
cpu = "1"
memory = "512Mi"
cpu = "100m"
memory = "128Mi"
}
}
}

10
stacks/cyberchef/main.tf
View file

@ -52,6 +52,16 @@ resource "kubernetes_deployment" "cyberchef" {
port {
container_port = 8000
}
resources {
requests = {
cpu = "10m"
memory = "32Mi"
}
limits = {
cpu = "100m"
memory = "128Mi"
}
}
}
}
}

8
stacks/dashy/main.tf
View file

@ -67,12 +67,12 @@ resource "kubernetes_deployment" "dashy" {
resources {
requests = {
cpu = "15m"
memory = "64Mi"
cpu = "50m"
memory = "512Mi"
}
limits = {
cpu = "500m"
memory = "512Mi"
cpu = "2"
memory = "4Gi"
}
}
port {

10
stacks/dawarich/main.tf
View file

@ -140,6 +140,16 @@ resource "kubernetes_deployment" "dawarich" {
# name = "watched"
# mount_path = "/var/app/tmp/imports/watched"
# }
resources {
requests = {
cpu = "15m"
memory = "256Mi"
}
limits = {
cpu = "250m"
memory = "1Gi"
}
}
}
# container {
# image = "freikin/dawarich:${var.image_version}"

10
stacks/diun/main.tf
View file

@ -163,6 +163,16 @@ resource "kubernetes_deployment" "diun" {
name = "data"
mount_path = "/data"
}
resources {
requests = {
cpu = "10m"
memory = "32Mi"
}
limits = {
cpu = "100m"
memory = "128Mi"
}
}
}
volume {
name = "data"

10
stacks/echo/main.tf
View file

@ -49,6 +49,16 @@ resource "kubernetes_deployment" "echo" {
port {
container_port = 8443
}
resources {
requests = {
cpu = "10m"
memory = "32Mi"
}
limits = {
cpu = "100m"
memory = "128Mi"
}
}
}
}
}

10
stacks/excalidraw/main.tf
View file

@ -65,6 +65,16 @@ resource "kubernetes_deployment" "excalidraw" {
name = "data"
mount_path = "/data"
}
resources {
requests = {
cpu = "10m"
memory = "16Mi"
}
limits = {
cpu = "100m"
memory = "64Mi"
}
}
}
volume {
name = "data"

4
stacks/f1-stream/main.tf
View file

@ -41,11 +41,11 @@ resource "kubernetes_deployment" "f1-stream" {
name = "f1-stream"
resources {
limits = {
cpu = "500m"
cpu = "250m"
memory = "256Mi"
}
requests = {
cpu = "50m"
cpu = "25m"
memory = "64Mi"
}
}

2
stacks/forgejo/main.tf
View file

@ -65,7 +65,7 @@ resource "kubernetes_deployment" "forgejo" {
memory = "64Mi"
}
limits = {
cpu = "500m"
cpu = "250m"
memory = "512Mi"
}
}

8
stacks/freedify/factory/main.tf
View file

@ -30,19 +30,19 @@ variable "gemini_api_key" {
}
variable "cpu_limit" {
type = string
default = "500m"
default = "250m"
}
variable "memory_limit" {
type = string
default = "512Mi"
default = "256Mi"
}
variable "cpu_request" {
type = string
default = "100m"
default = "15m"
}
variable "memory_request" {
type = string
default = "256Mi"
default = "64Mi"
}

10
stacks/freshrss/main.tf
View file

@ -75,6 +75,16 @@ resource "kubernetes_deployment" "freshrss" {
container_port = 80
protocol = "TCP"
}
resources {
requests = {
cpu = "15m"
memory = "64Mi"
}
limits = {
cpu = "250m"
memory = "256Mi"
}
}
}
volume {
name = "data"

6
stacks/frigate/main.tf
View file

@ -65,7 +65,13 @@ resource "kubernetes_deployment" "frigate" {
name = "frigate"
resources {
requests = {
cpu = "500m"
memory = "2Gi"
}
limits = {
cpu = "4"
memory = "8Gi"
"nvidia.com/gpu" = "1"
}
}

10
stacks/hackmd/main.tf
View file

@ -106,6 +106,16 @@ resource "kubernetes_deployment" "hackmd" {
container_port = 3000
protocol = "TCP"
}
resources {
requests = {
cpu = "15m"
memory = "64Mi"
}
limits = {
cpu = "250m"
memory = "512Mi"
}
}
}
security_context {
fs_group = "1500"

8
stacks/health/main.tf
View file

@ -83,12 +83,12 @@ resource "kubernetes_deployment" "health" {
resources {
requests = {
memory = "256Mi"
cpu = "100m"
memory = "64Mi"
cpu = "15m"
}
limits = {
memory = "1Gi"
cpu = "1"
memory = "256Mi"
cpu = "250m"
}
}
}

28
stacks/immich/main.tf
View file

@ -164,6 +164,16 @@ resource "kubernetes_deployment" "immich_server" {
name = "upload"
mount_path = "/usr/src/app/upload/upload"
}
resources {
requests = {
cpu = "100m"
memory = "256Mi"
}
limits = {
cpu = "2"
memory = "2Gi"
}
}
}
# volume {
@ -293,6 +303,16 @@ resource "kubernetes_deployment" "immich-postgres" {
name = "postgresql-persistent-storage"
mount_path = "/var/lib/postgresql/data"
}
resources {
requests = {
cpu = "50m"
memory = "256Mi"
}
limits = {
cpu = "1"
memory = "1Gi"
}
}
}
volume {
name = "postgresql-persistent-storage"
@ -425,8 +445,14 @@ resource "kubernetes_deployment" "immich-machine-learning" {
mount_path = "/cache"
}
resources {
requests = {
cpu = "100m"
memory = "1Gi"
}
limits = {
"nvidia.com/gpu" = "1" # Used for inference
cpu = "2"
memory = "4Gi"
"nvidia.com/gpu" = "1"
}
}
}

10
stacks/isponsorblocktv/main.tf
View file

@ -43,6 +43,16 @@ resource "kubernetes_deployment" "isponsorblocktv-vermont" {
name = "data"
mount_path = "/app/data"
}
resources {
requests = {
cpu = "10m"
memory = "32Mi"
}
limits = {
cpu = "150m"
memory = "256Mi"
}
}
}
volume {
name = "data"

16
stacks/kms/main.tf
View file

@ -58,12 +58,12 @@ resource "kubernetes_deployment" "kms-web-page" {
image_pull_policy = "IfNotPresent"
resources {
limits = {
cpu = "0.5"
memory = "512Mi"
cpu = "50m"
memory = "64Mi"
}
requests = {
cpu = "0.5"
memory = "512Mi"
cpu = "10m"
memory = "16Mi"
}
}
port {
@ -147,12 +147,12 @@ resource "kubernetes_deployment" "windows_kms" {
name = "windows-kms"
resources {
limits = {
cpu = "1"
memory = "512Mi"
cpu = "100m"
memory = "128Mi"
}
requests = {
cpu = "1"
memory = "50Mi"
cpu = "10m"
memory = "32Mi"
}
}
port {

10
stacks/linkwarden/main.tf
View file

@ -91,6 +91,16 @@ resource "kubernetes_deployment" "linkwarden" {
name = "AUTHENTIK_CLIENT_SECRET"
value = var.linkwarden_authentik_client_secret
}
resources {
requests = {
cpu = "25m"
memory = "256Mi"
}
limits = {
cpu = "500m"
memory = "1536Mi"
}
}
}
}
}

4
stacks/meshcentral/main.tf
View file

@ -95,8 +95,8 @@ resource "kubernetes_deployment" "meshcentral" {
memory = "64Mi"
}
limits = {
cpu = "500m"
memory = "384Mi"
cpu = "250m"
memory = "512Mi"
}
}
volume_mount {

10
stacks/n8n/main.tf
View file

@ -102,6 +102,16 @@ resource "kubernetes_deployment" "n8n" {
container_port = 5678
protocol = "TCP"
}
resources {
requests = {
cpu = "25m"
memory = "256Mi"
}
limits = {
cpu = "500m"
memory = "1Gi"
}
}
}
volume {
name = "data"

10
stacks/navidrome/main.tf
View file

@ -66,6 +66,16 @@ resource "kubernetes_deployment" "navidrome" {
container_port = 4533
protocol = "TCP"
}
resources {
requests = {
cpu = "15m"
memory = "64Mi"
}
limits = {
cpu = "250m"
memory = "384Mi"
}
}
}
volume {
name = "data"

6
stacks/netbox/main.tf
View file

@ -134,11 +134,11 @@ resource "kubernetes_deployment" "netbox" {
resources {
requests = {
cpu = "25m"
memory = "64Mi"
memory = "256Mi"
}
limits = {
cpu = "1"
memory = "512Mi"
cpu = "500m"
memory = "1Gi"
}
}
port {

10
stacks/networking-toolbox/main.tf
View file

@ -46,6 +46,16 @@ resource "kubernetes_deployment" "networking-toolbox" {
port {
container_port = 3000
}
resources {
requests = {
cpu = "10m"
memory = "32Mi"
}
limits = {
cpu = "100m"
memory = "128Mi"
}
}
}
}
}

2
stacks/nextcloud/main.tf
View file

@ -16,7 +16,7 @@ resource "kubernetes_namespace" "nextcloud" {
name = "nextcloud"
labels = {
"istio-injection" : "disabled"
tier = local.tiers.edge
tier = local.tiers.edge
"resource-governance/custom-limitrange" = "true"
"resource-governance/custom-quota" = "true"
}

10
stacks/ntfy/main.tf
View file

@ -87,6 +87,16 @@ resource "kubernetes_deployment" "ntfy" {
name = "data"
mount_path = "/var/lib/ntfy/"
}
resources {
requests = {
cpu = "10m"
memory = "32Mi"
}
limits = {
cpu = "100m"
memory = "128Mi"
}
}
}
volume {
name = "data"

22
stacks/ollama/main.tf
View file

@ -93,9 +93,9 @@ resource "kubernetes_deployment" "ollama" {
"gpu" = "true"
}
toleration {
key = "nvidia.com/gpu"
value = "true"
effect = "NoSchedule"
key = "nvidia.com/gpu"
value = "true"
effect = "NoSchedule"
}
container {
image = "ollama/ollama:latest"
@ -122,12 +122,10 @@ resource "kubernetes_deployment" "ollama" {
}
resources {
requests = {
cpu = "500m"
memory = "4Gi"
cpu = "100m"
memory = "256Mi"
}
limits = {
cpu = "4"
memory = "12Gi"
"nvidia.com/gpu" = "1"
}
}
@ -271,6 +269,16 @@ resource "kubernetes_deployment" "ollama-ui" {
name = "data"
mount_path = "/app/backend/data"
}
resources {
requests = {
cpu = "25m"
memory = "256Mi"
}
limits = {
cpu = "500m"
memory = "1536Mi"
}
}
}
volume {
name = "data"

10
stacks/onlyoffice/main.tf
View file

@ -11,9 +11,9 @@ resource "kubernetes_namespace" "onlyoffice" {
name = "onlyoffice"
labels = {
"istio-injection" : "disabled"
tier = local.tiers.edge
"resource-governance/custom-limitrange" = "true"
"resource-governance/custom-quota" = "true"
tier = local.tiers.edge
"resource-governance/custom-limitrange" = "true"
"resource-governance/custom-quota" = "true"
}
}
}
@ -92,11 +92,11 @@ resource "kubernetes_deployment" "onlyoffice-document-server" {
image = "onlyoffice/documentserver:8.2.3"
resources {
requests = {
cpu = "250m"
cpu = "100m"
memory = "512Mi"
}
limits = {
cpu = "8"
cpu = "2"
memory = "4Gi"
}
}

2
stacks/openclaw/main.tf
View file

@ -517,7 +517,7 @@ resource "kubernetes_deployment" "openclaw" {
resources {
limits = {
cpu = "500m"
memory = "256Mi"
memory = "512Mi"
}
requests = {
cpu = "25m"

14
stacks/osm_routing/main.tf
View file

@ -52,6 +52,16 @@ resource "kubernetes_deployment" "osrm-foot" {
name = "osrm-data"
mount_path = "/data"
}
resources {
requests = {
cpu = "15m"
memory = "256Mi"
}
limits = {
cpu = "100m"
memory = "1Gi"
}
}
}
volume {
name = "osrm-data"
@ -127,10 +137,10 @@ resource "kubernetes_deployment" "osrm-bicycle" {
resources {
requests = {
cpu = "15m"
memory = "512Mi"
memory = "256Mi"
}
limits = {
cpu = "250m"
cpu = "100m"
memory = "1Gi"
}
}

10
stacks/owntracks/main.tf
View file

@ -94,6 +94,16 @@ resource "kubernetes_deployment" "owntracks" {
name = "data"
mount_path = "/config"
}
resources {
requests = {
cpu = "10m"
memory = "16Mi"
}
limits = {
cpu = "100m"
memory = "64Mi"
}
}
}
volume {
name = "data"

8
stacks/paperless-ngx/main.tf
View file

@ -112,12 +112,12 @@ resource "kubernetes_deployment" "paperless-ngx" {
resources {
requests = {
cpu = "100m"
memory = "256Mi"
cpu = "50m"
memory = "512Mi"
}
limits = {
cpu = "2"
memory = "1Gi"
cpu = "1"
memory = "2Gi"
}
}

10
stacks/platform/modules/cloudflared/main.tf
View file

@ -60,6 +60,16 @@ resource "kubernetes_deployment" "cloudflared" {
port {
container_port = 14333
}
resources {
requests = {
cpu = "15m"
memory = "32Mi"
}
limits = {
cpu = "200m"
memory = "256Mi"
}
}
}
dns_config {
option {

10
stacks/platform/modules/crowdsec/main.tf
View file

@ -159,6 +159,16 @@ resource "kubernetes_deployment" "crowdsec-web" {
container_port = 8000
protocol = "TCP"
}
resources {
requests = {
cpu = "15m"
memory = "32Mi"
}
limits = {
cpu = "250m"
memory = "256Mi"
}
}
}
dns_config {
option {

37
stacks/platform/modules/dbaas/main.tf
View file

@ -221,8 +221,8 @@ resource "kubernetes_service" "mysql" {
spec {
publish_not_ready_addresses = true # bypass InnoDB Cluster readiness gate during partial failures
selector = {
"component" = "mysqld"
"mysql.oracle.com/cluster" = "mysql-cluster"
"component" = "mysqld"
"mysql.oracle.com/cluster" = "mysql-cluster"
"mysql.oracle.com/cluster-role" = "PRIMARY"
}
port {
@ -477,6 +477,16 @@ resource "kubernetes_deployment" "phpmyadmin" {
name = "UPLOAD_LIMIT"
value = "300M"
}
resources {
requests = {
cpu = "15m"
memory = "32Mi"
}
limits = {
cpu = "250m"
memory = "256Mi"
}
}
}
dns_config {
option {
@ -763,12 +773,12 @@ module "ingress" {
# Ensure the CNPG cluster manifest exists (idempotent kubectl apply)
resource "null_resource" "pg_cluster" {
triggers = {
instances = "2"
image = "ghcr.io/cloudnative-pg/postgis:16"
storage_size = "20Gi"
storage_class = "local-path"
memory_limit = "4Gi"
cpu_limit = "2"
instances = "2"
image = "ghcr.io/cloudnative-pg/postgis:16"
storage_size = "20Gi"
storage_class = "local-path"
memory_limit = "4Gi"
cpu_limit = "2"
}
provisioner "local-exec" {
@ -900,6 +910,17 @@ resource "kubernetes_deployment" "pgadmin" {
mount_path = "/var/lib/pgadmin/"
}
resources {
requests = {
cpu = "25m"
memory = "128Mi"
}
limits = {
cpu = "500m"
memory = "512Mi"
}
}
}
volume {
name = "pgadmin"

10
stacks/platform/modules/k8s-portal/main.tf
View file

@ -66,6 +66,16 @@ resource "kubernetes_deployment" "k8s_portal" {
mount_path = "/config"
read_only = true
}
resources {
requests = {
cpu = "10m"
memory = "32Mi"
}
limits = {
cpu = "100m"
memory = "128Mi"
}
}
}
volume {

21
stacks/platform/modules/mailserver/main.tf
View file

@ -351,6 +351,17 @@ resource "kubernetes_deployment" "mailserver" {
}
}
resources {
requests = {
cpu = "25m"
memory = "128Mi"
}
limits = {
cpu = "500m"
memory = "512Mi"
}
}
}
container {
@ -370,6 +381,16 @@ resource "kubernetes_deployment" "mailserver" {
name = "var-run-dovecot"
mount_path = "/var/run/dovecot"
}
resources {
requests = {
cpu = "10m"
memory = "16Mi"
}
limits = {
cpu = "100m"
memory = "64Mi"
}
}
}
volume {

8
stacks/platform/modules/redis/main.tf
View file

@ -119,10 +119,10 @@ resource "kubernetes_service" "redis" {
}
spec {
selector = {
"app.kubernetes.io/component" = "node"
"app.kubernetes.io/instance" = "redis"
"app.kubernetes.io/name" = "redis"
"statefulset.kubernetes.io/pod-name" = "redis-node-0"
"app.kubernetes.io/component" = "node"
"app.kubernetes.io/instance" = "redis"
"app.kubernetes.io/name" = "redis"
"statefulset.kubernetes.io/pod-name" = "redis-node-0"
}
port {
name = "tcp-redis"

8
stacks/platform/modules/traefik/main.tf
View file

@ -380,11 +380,11 @@ resource "kubernetes_deployment" "bot_block_proxy" {
resources {
requests = {
cpu = "5m"
memory = "16Mi"
memory = "32Mi"
}
limits = {
cpu = "50m"
memory = "32Mi"
memory = "128Mi"
}
}
}
@ -569,11 +569,11 @@ resource "kubernetes_deployment" "auth_proxy" {
resources {
requests = {
cpu = "5m"
memory = "16Mi"
memory = "32Mi"
}
limits = {
cpu = "50m"
memory = "32Mi"
memory = "128Mi"
}
}
}

16
stacks/platform/modules/traefik/middleware.tf
View file

@ -150,14 +150,14 @@ resource "kubernetes_manifest" "middleware_crowdsec" {
spec = {
plugin = {
crowdsec-bouncer = {
crowdsecLapiKey = var.crowdsec_api_key
crowdsecLapiHost = "crowdsec-service.crowdsec.svc.cluster.local:8080"
crowdsecMode = "stream"
updateMaxFailure = -1 # fail-open: serve from cache when LAPI is unreachable
redisCacheEnabled = true
redisCacheHost = var.redis_host
redisCacheUnreachableBlock = false # don't block traffic if Redis is also unreachable
clientTrustedIPs = ["10.0.20.0/24", "10.10.0.0/16"] # node + pod CIDRs bypass CrowdSec
crowdsecLapiKey = var.crowdsec_api_key
crowdsecLapiHost = "crowdsec-service.crowdsec.svc.cluster.local:8080"
crowdsecMode = "stream"
updateMaxFailure = -1 # fail-open: serve from cache when LAPI is unreachable
redisCacheEnabled = true
redisCacheHost = var.redis_host
redisCacheUnreachableBlock = false # don't block traffic if Redis is also unreachable
clientTrustedIPs = ["10.0.20.0/24", "10.10.0.0/16"] # node + pod CIDRs bypass CrowdSec
}
}
}

6
stacks/platform/modules/vaultwarden/main.tf
View file

@ -56,11 +56,11 @@ resource "kubernetes_deployment" "vaultwarden" {
resources {
requests = {
cpu = "50m"
memory = "64Mi"
cpu = "10m"
memory = "32Mi"
}
limits = {
cpu = "200m"
cpu = "100m"
memory = "256Mi"
}
}

20
stacks/platform/modules/wireguard/main.tf
View file

@ -141,6 +141,16 @@ resource "kubernetes_deployment" "wireguard" {
add = ["NET_ADMIN", "SYS_MODULE"]
}
}
resources {
requests = {
cpu = "10m"
memory = "16Mi"
}
limits = {
cpu = "100m"
memory = "128Mi"
}
}
}
container {
@ -162,6 +172,16 @@ resource "kubernetes_deployment" "wireguard" {
container_port = 9586
protocol = "TCP"
}
resources {
requests = {
cpu = "10m"
memory = "16Mi"
}
limits = {
cpu = "50m"
memory = "64Mi"
}
}
}
volume {
name = "wg0-key"

10
stacks/platform/modules/xray/main.tf
View file

@ -114,6 +114,16 @@ resource "kubernetes_deployment" "xray" {
mount_path = "/etc/xray/config.json"
sub_path = "config.json"
}
resources {
requests = {
cpu = "10m"
memory = "32Mi"
}
limits = {
cpu = "100m"
memory = "128Mi"
}
}
}
volume {

8
stacks/plotting-book/main.tf
View file

@ -60,12 +60,12 @@ resource "kubernetes_deployment" "plotting-book" {
}
resources {
requests = {
memory = "128Mi"
cpu = "50m"
memory = "32Mi"
cpu = "10m"
}
limits = {
memory = "512Mi"
cpu = "500m"
memory = "256Mi"
cpu = "100m"
}
}
}

10
stacks/privatebin/main.tf
View file

@ -56,6 +56,16 @@ resource "kubernetes_deployment" "privatebin" {
mount_path = "/srv/data"
sub_path = "data"
}
resources {
requests = {
cpu = "10m"
memory = "32Mi"
}
limits = {
cpu = "150m"
memory = "256Mi"
}
}
}
volume {

10
stacks/real-estate-crawler/main.tf
View file

@ -192,12 +192,12 @@ resource "kubernetes_deployment" "realestate-crawler-api" {
}
resources {
requests = {
cpu = "50m"
memory = "128Mi"
cpu = "15m"
memory = "64Mi"
}
limits = {
cpu = "2000m"
memory = "1Gi"
cpu = "250m"
memory = "512Mi"
}
}
volume_mount {
@ -408,7 +408,7 @@ resource "kubernetes_deployment" "realestate-crawler-celery-beat" {
memory = "64Mi"
}
limits = {
cpu = "200m"
cpu = "100m"
memory = "256Mi"
}
}

12
stacks/resume/main.tf
View file

@ -74,11 +74,11 @@ resource "kubernetes_deployment" "printer" {
resources {
requests = {
memory = "128Mi"
cpu = "50m"
cpu = "25m"
}
limits = {
memory = "512Mi"
cpu = "1"
memory = "1536Mi"
cpu = "500m"
}
}
@ -221,12 +221,12 @@ resource "kubernetes_deployment" "resume" {
resources {
requests = {
memory = "128Mi"
cpu = "25m"
memory = "64Mi"
cpu = "15m"
}
limits = {
memory = "384Mi"
cpu = "500m"
cpu = "250m"
}
}

58
stacks/rybbit/main.tf
View file

@ -30,6 +30,28 @@ locals {
}
resource "kubernetes_config_map" "clickhouse_config" {
metadata {
name = "clickhouse-config"
namespace = kubernetes_namespace.rybbit.metadata[0].name
}
data = {
"docker_related_config.xml" = <<-XML
<clickhouse>
<listen_host>::</listen_host>
<listen_host>0.0.0.0</listen_host>
<listen_try>1</listen_try>
</clickhouse>
XML
"disable-system-logs.xml" = <<-XML
<clickhouse>
<background_pool_size>4</background_pool_size>
<background_schedule_pool_size>16</background_schedule_pool_size>
</clickhouse>
XML
}
}
resource "kubernetes_deployment" "clickhouse" {
metadata {
name = "clickhouse"
@ -60,10 +82,6 @@ resource "kubernetes_deployment" "clickhouse" {
name = "CLICKHOUSE_DB"
value = local.clickhouse_db
}
# env {
# name = "CLICKHOUSE_USER"
# value = "clickhouse"
# }
env {
name = "CLICKHOUSE_PASSWORD"
value = var.clickhouse_password
@ -77,6 +95,12 @@ resource "kubernetes_deployment" "clickhouse" {
name = "data"
mount_path = "/var/lib/clickhouse"
}
volume_mount {
name = "config"
mount_path = "/etc/clickhouse-server/config.d/zzz-custom.xml"
sub_path = "disable-system-logs.xml"
read_only = true
}
resources {
requests = {
cpu = "100m"
@ -95,6 +119,12 @@ resource "kubernetes_deployment" "clickhouse" {
server = var.nfs_server
}
}
volume {
name = "config"
config_map {
name = kubernetes_config_map.clickhouse_config.metadata[0].name
}
}
}
}
}
@ -208,6 +238,16 @@ resource "kubernetes_deployment" "rybbit" {
port {
container_port = 3001
}
resources {
requests = {
cpu = "25m"
memory = "128Mi"
}
limits = {
cpu = "250m"
memory = "512Mi"
}
}
}
}
}
@ -274,6 +314,16 @@ resource "kubernetes_deployment" "rybbit-client" {
protocol = "TCP"
container_port = 3002
}
resources {
requests = {
cpu = "10m"
memory = "64Mi"
}
limits = {
cpu = "150m"
memory = "256Mi"
}
}
}
}
}

10
stacks/send/main.tf
View file

@ -80,6 +80,16 @@ resource "kubernetes_deployment" "send" {
name = "data"
mount_path = "/uploads"
}
resources {
requests = {
cpu = "10m"
memory = "32Mi"
}
limits = {
cpu = "150m"
memory = "256Mi"
}
}
}
volume {
name = "data"

4
stacks/servarr/aiostreams/main.tf
View file

@ -63,12 +63,12 @@ resource "kubernetes_deployment" "aiostreams" {
}
resources {
requests = {
cpu = "50m"
cpu = "25m"
memory = "256Mi"
}
limits = {
cpu = "500m"
memory = "768Mi"
memory = "1Gi"
}
}
}

10
stacks/shadowsocks/main.tf
View file

@ -64,6 +64,16 @@ resource "kubernetes_deployment" "shadowsocks" {
container_port = 8388
protocol = "UDP"
}
resources {
requests = {
cpu = "10m"
memory = "16Mi"
}
limits = {
cpu = "100m"
memory = "64Mi"
}
}
}
}
}

4
stacks/speedtest/main.tf
View file

@ -104,10 +104,10 @@ resource "kubernetes_deployment" "speedtest" {
resources {
requests = {
cpu = "25m"
memory = "64Mi"
memory = "128Mi"
}
limits = {
cpu = "500m"
cpu = "1"
memory = "512Mi"
}
}

4
stacks/stirling-pdf/main.tf
View file

@ -47,11 +47,11 @@ resource "kubernetes_deployment" "stirling-pdf" {
resources {
requests = {
cpu = "100m"
memory = "256Mi"
memory = "512Mi"
}
limits = {
cpu = "2"
memory = "1Gi"
memory = "2Gi"
}
}

10
stacks/tandoor/main.tf
View file

@ -136,6 +136,16 @@ resource "kubernetes_deployment" "tandoor" {
name = "data"
mount_path = "/opt/recipes/staticfiles"
}
resources {
requests = {
cpu = "25m"
memory = "256Mi"
}
limits = {
cpu = "250m"
memory = "1536Mi"
}
}
}
volume {

10
stacks/tor-proxy/main.tf
View file

@ -73,6 +73,16 @@ resource "kubernetes_deployment" "tor-proxy" {
container_port = 9050
protocol = "TCP"
}
resources {
requests = {
cpu = "10m"
memory = "64Mi"
}
limits = {
cpu = "150m"
memory = "256Mi"
}
}
# volume_mount {
# name = "tor-config"
# mount_path = "/etc/tor/torrc"

2
stacks/trading-bot/main.tf
View file

@ -47,7 +47,7 @@ resource "kubernetes_namespace" "trading-bot" {
metadata {
name = "trading-bot"
labels = {
tier = local.tiers.edge
tier = local.tiers.edge
"resource-governance/custom-quota" = "true"
}
}

8
stacks/travel_blog/main.tf
View file

@ -45,12 +45,12 @@ resource "kubernetes_deployment" "blog" {
name = "travel-blog"
resources {
limits = {
cpu = "0.5"
memory = "512Mi"
cpu = "100m"
memory = "256Mi"
}
requests = {
cpu = "250m"
memory = "50Mi"
cpu = "10m"
memory = "32Mi"
}
}
port {

10
stacks/tuya-bridge/main.tf
View file

@ -66,6 +66,16 @@ resource "kubernetes_deployment" "tuya-bridge" {
name = "SLACK_URL"
value = var.tiny_tuya_slack_url
}
resources {
requests = {
cpu = "10m"
memory = "32Mi"
}
limits = {
cpu = "150m"
memory = "256Mi"
}
}
}
}
}

10
stacks/wealthfolio/main.tf
View file

@ -88,6 +88,16 @@ resource "kubernetes_deployment" "wealthfolio" {
name = "data"
mount_path = "/data"
}
resources {
requests = {
cpu = "10m"
memory = "32Mi"
}
limits = {
cpu = "100m"
memory = "128Mi"
}
}
}
volume {
name = "data"

8
stacks/webhook_handler/main.tf
View file

@ -110,12 +110,12 @@ resource "kubernetes_deployment" "webhook_handler" {
name = "webhook-handler"
resources {
limits = {
cpu = "0.5"
memory = "512Mi"
cpu = "100m"
memory = "256Mi"
}
requests = {
cpu = "250m"
memory = "50Mi"
cpu = "10m"
memory = "32Mi"
}
}
port {

20
stacks/whisper/main.tf
View file

@ -67,6 +67,16 @@ resource "kubernetes_deployment" "whisper" {
name = "data"
mount_path = "/data"
}
resources {
requests = {
cpu = "25m"
memory = "256Mi"
}
limits = {
cpu = "500m"
memory = "1536Mi"
}
}
}
volume {
@ -177,6 +187,16 @@ resource "kubernetes_deployment" "piper" {
name = "data"
mount_path = "/data"
}
resources {
requests = {
cpu = "25m"
memory = "64Mi"
}
limits = {
cpu = "250m"
memory = "512Mi"
}
}
}
volume {