migrate all secrets from SOPS to Vault KV
- Add vault provider to root terragrunt.hcl (generated providers.tf) - Delete stacks/vault/vault_provider.tf (now in generated providers.tf) - Add 124 variable declarations + 43 vault_kv_secret_v2 resources to vault/main.tf to populate Vault KV at secret/<stack-name> - Migrate 43 consuming stacks to read secrets from Vault KV via data "vault_kv_secret_v2" instead of SOPS var-file - Add dependency "vault" to all migrated stacks' terragrunt.hcl - Complex types (maps/lists) stored as JSON strings, decoded with jsondecode() in locals blocks Bootstrap secrets (vault_root_token, vault_authentik_client_id, vault_authentik_client_secret) remain in SOPS permanently. Apply order: vault stack first (populates KV), then all others.
This commit is contained in:
Viktor Barzin
parent
39b7dac1a9
commit
a8d944eb9b
126 changed files with 1635 additions and 817 deletions
|
|
@ -2,12 +2,17 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "actualbudget_credentials" {
|
||||
type = map(any)
|
||||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "actualbudget"
|
||||
}
|
||||
|
||||
locals {
|
||||
credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["credentials"])
|
||||
}
|
||||
|
||||
|
||||
# To create a new deployment:
|
||||
/**
|
||||
|
|
@ -42,8 +47,8 @@ module "viktor" {
|
|||
nfs_server = var.nfs_server
|
||||
depends_on = [kubernetes_namespace.actualbudget]
|
||||
tier = local.tiers.edge
|
||||
budget_encryption_password = lookup(var.actualbudget_credentials["viktor"], "password", null)
|
||||
sync_id = lookup(var.actualbudget_credentials["viktor"], "sync_id", null)
|
||||
budget_encryption_password = lookup(local.credentials["viktor"], "password", null)
|
||||
sync_id = lookup(local.credentials["viktor"], "sync_id", null)
|
||||
homepage_annotations = {
|
||||
"gethomepage.dev/enabled" = "true"
|
||||
"gethomepage.dev/name" = "Budget Viktor"
|
||||
|
|
@ -63,8 +68,8 @@ module "anca" {
|
|||
nfs_server = var.nfs_server
|
||||
depends_on = [kubernetes_namespace.actualbudget]
|
||||
tier = local.tiers.edge
|
||||
budget_encryption_password = lookup(var.actualbudget_credentials["anca"], "password", null)
|
||||
sync_id = lookup(var.actualbudget_credentials["anca"], "sync_id", null)
|
||||
budget_encryption_password = lookup(local.credentials["anca"], "password", null)
|
||||
sync_id = lookup(local.credentials["anca"], "sync_id", null)
|
||||
homepage_annotations = {
|
||||
"gethomepage.dev/enabled" = "true"
|
||||
"gethomepage.dev/name" = "Budget Anca"
|
||||
|
|
@ -84,8 +89,8 @@ module "emo" {
|
|||
nfs_server = var.nfs_server
|
||||
depends_on = [kubernetes_namespace.actualbudget]
|
||||
tier = local.tiers.edge
|
||||
budget_encryption_password = lookup(var.actualbudget_credentials["emo"], "password", null)
|
||||
sync_id = lookup(var.actualbudget_credentials["emo"], "sync_id", null)
|
||||
budget_encryption_password = lookup(local.credentials["emo"], "password", null)
|
||||
sync_id = lookup(local.credentials["emo"], "sync_id", null)
|
||||
homepage_annotations = {
|
||||
"gethomepage.dev/enabled" = "true"
|
||||
"gethomepage.dev/name" = "Budget Emo"
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,12 +2,16 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "affine_postgresql_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "mailserver_accounts" { type = map(any) }
|
||||
variable "nfs_server" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "affine"
|
||||
}
|
||||
|
||||
locals {
|
||||
mailserver_accounts = jsondecode(data.vault_kv_secret_v2.secrets.data["mailserver_accounts"])
|
||||
}
|
||||
variable "redis_host" { type = string }
|
||||
variable "postgresql_host" { type = string }
|
||||
variable "mail_host" { type = string }
|
||||
|
|
@ -32,7 +36,7 @@ locals {
|
|||
common_env = [
|
||||
{
|
||||
name = "DATABASE_URL"
|
||||
value = "postgresql://affine:${var.affine_postgresql_password}@${var.postgresql_host}:5432/affine"
|
||||
value = "postgresql://affine:${data.vault_kv_secret_v2.secrets.data["db_password"]}@${var.postgresql_host}:5432/affine"
|
||||
},
|
||||
{
|
||||
name = "REDIS_SERVER_HOST"
|
||||
|
|
@ -70,7 +74,7 @@ locals {
|
|||
},
|
||||
{
|
||||
name = "MAILER_PASSWORD"
|
||||
value = var.mailserver_accounts["info@viktorbarzin.me"]
|
||||
value = local.mailserver_accounts["info@viktorbarzin.me"]
|
||||
},
|
||||
{
|
||||
name = "MAILER_SENDER"
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,9 +3,13 @@ variable "tls_secret_name" {
|
|||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
variable "homepage_credentials" {
|
||||
type = map(any)
|
||||
sensitive = true
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "audiobookshelf"
|
||||
}
|
||||
|
||||
locals {
|
||||
homepage_credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["homepage_credentials"])
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -205,6 +209,6 @@ module "ingress" {
|
|||
"gethomepage.dev/pod-selector" = ""
|
||||
"gethomepage.dev/widget.type" = "audiobookshelf"
|
||||
"gethomepage.dev/widget.url" = "http://audiobookshelf.audiobookshelf.svc.cluster.local"
|
||||
"gethomepage.dev/widget.key" = var.homepage_credentials["audiobookshelf"]["token"]
|
||||
"gethomepage.dev/widget.key" = local.homepage_credentials["audiobookshelf"]["token"]
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -2,12 +2,17 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "homepage_credentials" {
|
||||
type = map(any)
|
||||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "calibre"
|
||||
}
|
||||
|
||||
locals {
|
||||
homepage_credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["homepage_credentials"])
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_namespace" "calibre" {
|
||||
metadata {
|
||||
|
|
@ -194,6 +199,24 @@ resource "kubernetes_deployment" "calibre-web-automated" {
|
|||
port {
|
||||
container_port = 8083
|
||||
}
|
||||
# Startup probe: allow up to 10 min for calibre binary install on first boot
|
||||
startup_probe {
|
||||
http_get {
|
||||
path = "/"
|
||||
port = 8083
|
||||
}
|
||||
initial_delay_seconds = 30
|
||||
period_seconds = 10
|
||||
failure_threshold = 54
|
||||
}
|
||||
liveness_probe {
|
||||
http_get {
|
||||
path = "/"
|
||||
port = 8083
|
||||
}
|
||||
period_seconds = 30
|
||||
failure_threshold = 3
|
||||
}
|
||||
resources {
|
||||
requests = {
|
||||
cpu = "50m"
|
||||
|
|
@ -274,8 +297,8 @@ module "ingress" {
|
|||
"gethomepage.dev/name" = "Calibre"
|
||||
"gethomepage.dev/widget.type" = "calibreweb"
|
||||
"gethomepage.dev/widget.url" = "http://calibre.calibre.svc.cluster.local"
|
||||
"gethomepage.dev/widget.username" = var.homepage_credentials["calibre-web"]["username"]
|
||||
"gethomepage.dev/widget.password" = var.homepage_credentials["calibre-web"]["password"]
|
||||
"gethomepage.dev/widget.username" = local.homepage_credentials["calibre-web"]["username"]
|
||||
"gethomepage.dev/widget.password" = local.homepage_credentials["calibre-web"]["password"]
|
||||
"gethomepage.dev/pod-selector" = ""
|
||||
# gethomepage.dev/weight: 10 # optional
|
||||
# gethomepage.dev/instance: "public" # optional
|
||||
|
|
|
|||
|
|
@ -1,8 +1,22 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
terraform {
|
||||
required_providers {
|
||||
vault = {
|
||||
source = "hashicorp/vault"
|
||||
version = "~> 4.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
}
|
||||
|
||||
variable "vault_root_token" {
|
||||
type = string
|
||||
sensitive = true
|
||||
default = ""
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
|
|
@ -14,3 +28,9 @@ provider "helm" {
|
|||
config_path = var.kube_config_path
|
||||
}
|
||||
}
|
||||
|
||||
provider "vault" {
|
||||
address = "https://vault.viktorbarzin.me"
|
||||
token = var.vault_root_token
|
||||
skip_child_token = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,9 +3,13 @@ variable "tls_secret_name" {
|
|||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
variable "homepage_credentials" {
|
||||
type = map(any)
|
||||
sensitive = true
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "changedetection"
|
||||
}
|
||||
|
||||
locals {
|
||||
homepage_credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["homepage_credentials"])
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -171,6 +175,6 @@ module "ingress" {
|
|||
"gethomepage.dev/pod-selector" = ""
|
||||
"gethomepage.dev/widget.type" = "changedetectionio"
|
||||
"gethomepage.dev/widget.url" = "http://changedetection.changedetection.svc.cluster.local"
|
||||
"gethomepage.dev/widget.key" = var.homepage_credentials["changedetection"]["api_key"]
|
||||
"gethomepage.dev/widget.key" = local.homepage_credentials["changedetection"]["api_key"]
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -3,17 +3,14 @@ variable "tls_secret_name" {
|
|||
sensitive = true
|
||||
}
|
||||
variable "postgresql_host" { type = string }
|
||||
variable "dbaas_postgresql_root_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "claude_memory_db_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "claude_memory_api_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "claude-memory"
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "claude-memory" {
|
||||
|
|
@ -48,11 +45,11 @@ resource "kubernetes_job" "db_init" {
|
|||
"sh", "-c",
|
||||
<<-EOT
|
||||
set -e
|
||||
PGPASSWORD='${var.dbaas_postgresql_root_password}' psql -h ${var.postgresql_host} -U root -tc "SELECT 1 FROM pg_roles WHERE rolname='claude_memory'" | grep -q 1 || \
|
||||
PGPASSWORD='${var.dbaas_postgresql_root_password}' psql -h ${var.postgresql_host} -U root -c "CREATE ROLE claude_memory WITH LOGIN PASSWORD '${var.claude_memory_db_password}'"
|
||||
PGPASSWORD='${var.dbaas_postgresql_root_password}' psql -h ${var.postgresql_host} -U root -tc "SELECT 1 FROM pg_database WHERE datname='claude_memory'" | grep -q 1 || \
|
||||
PGPASSWORD='${var.dbaas_postgresql_root_password}' psql -h ${var.postgresql_host} -U root -c "CREATE DATABASE claude_memory OWNER claude_memory"
|
||||
PGPASSWORD='${var.dbaas_postgresql_root_password}' psql -h ${var.postgresql_host} -U root -c "GRANT ALL PRIVILEGES ON DATABASE claude_memory TO claude_memory"
|
||||
PGPASSWORD='${data.vault_kv_secret_v2.secrets.data["dbaas_root_password"]}' psql -h ${var.postgresql_host} -U root -tc "SELECT 1 FROM pg_roles WHERE rolname='claude_memory'" | grep -q 1 || \
|
||||
PGPASSWORD='${data.vault_kv_secret_v2.secrets.data["dbaas_root_password"]}' psql -h ${var.postgresql_host} -U root -c "CREATE ROLE claude_memory WITH LOGIN PASSWORD '${var.claude_memory_db_password}'"
|
||||
PGPASSWORD='${data.vault_kv_secret_v2.secrets.data["dbaas_root_password"]}' psql -h ${var.postgresql_host} -U root -tc "SELECT 1 FROM pg_database WHERE datname='claude_memory'" | grep -q 1 || \
|
||||
PGPASSWORD='${data.vault_kv_secret_v2.secrets.data["dbaas_root_password"]}' psql -h ${var.postgresql_host} -U root -c "CREATE DATABASE claude_memory OWNER claude_memory"
|
||||
PGPASSWORD='${data.vault_kv_secret_v2.secrets.data["dbaas_root_password"]}' psql -h ${var.postgresql_host} -U root -c "GRANT ALL PRIVILEGES ON DATABASE claude_memory TO claude_memory"
|
||||
echo "Database init complete"
|
||||
EOT
|
||||
]
|
||||
|
|
@ -79,7 +76,7 @@ resource "kubernetes_deployment" "claude-memory" {
|
|||
}
|
||||
}
|
||||
spec {
|
||||
replicas = 1
|
||||
replicas = 2
|
||||
selector {
|
||||
match_labels = {
|
||||
app = "claude-memory"
|
||||
|
|
@ -92,6 +89,18 @@ resource "kubernetes_deployment" "claude-memory" {
|
|||
}
|
||||
}
|
||||
spec {
|
||||
affinity {
|
||||
pod_anti_affinity {
|
||||
required_during_scheduling_ignored_during_execution {
|
||||
label_selector {
|
||||
match_labels = {
|
||||
app = "claude-memory"
|
||||
}
|
||||
}
|
||||
topology_key = "kubernetes.io/hostname"
|
||||
}
|
||||
}
|
||||
}
|
||||
container {
|
||||
name = "claude-memory"
|
||||
image = "viktorbarzin/claude-memory-mcp:latest"
|
||||
|
|
@ -106,9 +115,17 @@ resource "kubernetes_deployment" "claude-memory" {
|
|||
}
|
||||
env {
|
||||
name = "API_KEY"
|
||||
value = var.claude_memory_api_key
|
||||
value = data.vault_kv_secret_v2.secrets.data["api_key"]
|
||||
}
|
||||
|
||||
startup_probe {
|
||||
http_get {
|
||||
path = "/health"
|
||||
port = 8000
|
||||
}
|
||||
failure_threshold = 30
|
||||
period_seconds = 2
|
||||
}
|
||||
liveness_probe {
|
||||
http_get {
|
||||
path = "/health"
|
||||
|
|
@ -146,6 +163,21 @@ resource "kubernetes_deployment" "claude-memory" {
|
|||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_pod_disruption_budget_v1" "claude-memory" {
|
||||
metadata {
|
||||
name = "claude-memory"
|
||||
namespace = kubernetes_namespace.claude-memory.metadata[0].name
|
||||
}
|
||||
spec {
|
||||
min_available = "1"
|
||||
selector {
|
||||
match_labels = {
|
||||
app = "claude-memory"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_service" "claude-memory" {
|
||||
metadata {
|
||||
name = "claude-memory"
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,12 +2,12 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "coturn_turn_secret" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "public_ip" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "coturn"
|
||||
}
|
||||
|
||||
locals {
|
||||
turn_realm = "viktorbarzin.me"
|
||||
|
|
@ -45,7 +45,7 @@ resource "kubernetes_config_map" "coturn_config" {
|
|||
fingerprint
|
||||
lt-cred-mech
|
||||
use-auth-secret
|
||||
static-auth-secret=${var.coturn_turn_secret}
|
||||
static-auth-secret=${data.vault_kv_secret_v2.secrets.data["turn_secret"]}
|
||||
realm=${local.turn_realm}
|
||||
server-name=turn.${local.turn_realm}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -2,15 +2,6 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "dawarich_database_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "geoapify_api_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
||||
variable "image_version" {
|
||||
type = string
|
||||
|
|
@ -20,6 +11,11 @@ variable "nfs_server" { type = string }
|
|||
variable "redis_host" { type = string }
|
||||
variable "postgresql_host" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "dawarich"
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "dawarich" {
|
||||
metadata {
|
||||
name = "dawarich"
|
||||
|
|
@ -97,7 +93,7 @@ resource "kubernetes_deployment" "dawarich" {
|
|||
}
|
||||
env {
|
||||
name = "DATABASE_PASSWORD"
|
||||
value = var.dawarich_database_password
|
||||
value = data.vault_kv_secret_v2.secrets.data["db_password"]
|
||||
}
|
||||
env {
|
||||
name = "DATABASE_NAME"
|
||||
|
|
@ -178,7 +174,7 @@ resource "kubernetes_deployment" "dawarich" {
|
|||
# }
|
||||
# env {
|
||||
# name = "DATABASE_PASSWORD"
|
||||
# value = var.dawarich_database_password
|
||||
# value = data.vault_kv_secret_v2.secrets.data["db_password"]
|
||||
# }
|
||||
# env {
|
||||
# name = "DATABASE_NAME"
|
||||
|
|
@ -219,7 +215,7 @@ resource "kubernetes_deployment" "dawarich" {
|
|||
# # }
|
||||
# env {
|
||||
# name = "GEOAPIFY_API_KEY"
|
||||
# value = var.geoapify_api_key
|
||||
# value = data.vault_kv_secret_v2.secrets.data["geoapify_api_key"]
|
||||
# }
|
||||
# env {
|
||||
# name = "SELF_HOSTED"
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -2,13 +2,12 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "diun_nfty_token" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "diun_slack_url" { type = string }
|
||||
variable "nfs_server" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "diun"
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "diun" {
|
||||
metadata {
|
||||
|
|
@ -154,11 +153,11 @@ resource "kubernetes_deployment" "diun" {
|
|||
# }
|
||||
# env {
|
||||
# name = "DIUN_NOTIF_NTFY_TOKEN"
|
||||
# value = var.diun_nfty_token
|
||||
# value = data.vault_kv_secret_v2.secrets.data["nfty_token"]
|
||||
# }
|
||||
env {
|
||||
name = "DIUN_NOTIF_SLACK_WEBHOOKURL"
|
||||
value = var.diun_slack_url
|
||||
value = data.vault_kv_secret_v2.secrets.data["slack_url"]
|
||||
}
|
||||
env {
|
||||
name = "LOG_LEVEL"
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -3,13 +3,13 @@ variable "tls_secret_name" {
|
|||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
variable "discord_user_token" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "discord_f1_guild_id" { type = string }
|
||||
variable "discord_f1_channel_ids" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "f1-stream"
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "f1-stream" {
|
||||
metadata {
|
||||
|
|
@ -70,7 +70,7 @@ resource "kubernetes_deployment" "f1-stream" {
|
|||
}
|
||||
env {
|
||||
name = "DISCORD_TOKEN"
|
||||
value = var.discord_user_token
|
||||
value = data.vault_kv_secret_v2.secrets.data["discord_user_token"]
|
||||
}
|
||||
env {
|
||||
name = "DISCORD_CHANNELS"
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,12 +3,11 @@ variable "tls_secret_name" {
|
|||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
variable "forgejo_authentik_client_id" { type = string }
|
||||
variable "forgejo_authentik_client_secret" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "forgejo"
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "forgejo" {
|
||||
metadata {
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,9 +2,13 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "freedify_credentials" {
|
||||
type = map(any)
|
||||
sensitive = true
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "freedify"
|
||||
}
|
||||
|
||||
locals {
|
||||
credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["credentials"])
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -40,11 +44,11 @@ module "viktor" {
|
|||
depends_on = [kubernetes_namespace.freedify]
|
||||
tier = local.tiers.aux
|
||||
protected = true
|
||||
listenbrainz_token = lookup(var.freedify_credentials["viktor"], "listenbrainz_token", null)
|
||||
genius_token = lookup(var.freedify_credentials["viktor"], "genius_token", null)
|
||||
dab_session = lookup(var.freedify_credentials["viktor"], "dab_session", null)
|
||||
dab_visitor_id = lookup(var.freedify_credentials["viktor"], "dab_visitor_id", null)
|
||||
gemini_api_key = lookup(var.freedify_credentials["viktor"], "gemini_api_key", null)
|
||||
listenbrainz_token = lookup(local.credentials["viktor"], "listenbrainz_token", null)
|
||||
genius_token = lookup(local.credentials["viktor"], "genius_token", null)
|
||||
dab_session = lookup(local.credentials["viktor"], "dab_session", null)
|
||||
dab_visitor_id = lookup(local.credentials["viktor"], "dab_visitor_id", null)
|
||||
gemini_api_key = lookup(local.credentials["viktor"], "gemini_api_key", null)
|
||||
extra_annotations = {
|
||||
"gethomepage.dev/enabled" = "true"
|
||||
"gethomepage.dev/name" = "Freedify (Viktor)"
|
||||
|
|
@ -64,8 +68,8 @@ module "emo" {
|
|||
depends_on = [kubernetes_namespace.freedify]
|
||||
tier = local.tiers.aux
|
||||
protected = true
|
||||
genius_token = lookup(var.freedify_credentials["emo"], "genius_token", null)
|
||||
gemini_api_key = lookup(var.freedify_credentials["emo"], "gemini_api_key", null)
|
||||
genius_token = lookup(local.credentials["emo"], "genius_token", null)
|
||||
gemini_api_key = lookup(local.credentials["emo"], "gemini_api_key", null)
|
||||
extra_annotations = {
|
||||
"gethomepage.dev/enabled" = "true"
|
||||
"gethomepage.dev/name" = "Freedify (Emo)"
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,9 +3,13 @@ variable "tls_secret_name" {
|
|||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
variable "homepage_credentials" {
|
||||
type = map(any)
|
||||
sensitive = true
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "freshrss"
|
||||
}
|
||||
|
||||
locals {
|
||||
homepage_credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["homepage_credentials"])
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -159,7 +163,7 @@ module "ingress" {
|
|||
"gethomepage.dev/pod-selector" = ""
|
||||
"gethomepage.dev/widget.type" = "freshrss"
|
||||
"gethomepage.dev/widget.url" = "http://freshrss.freshrss.svc.cluster.local"
|
||||
"gethomepage.dev/widget.username" = var.homepage_credentials["freshrss"]["username"]
|
||||
"gethomepage.dev/widget.password" = var.homepage_credentials["freshrss"]["password"]
|
||||
"gethomepage.dev/widget.username" = local.homepage_credentials["freshrss"]["username"]
|
||||
"gethomepage.dev/widget.password" = local.homepage_credentials["freshrss"]["password"]
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -2,8 +2,16 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "mailserver_accounts" { type = map(any) }
|
||||
variable "nfs_server" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "grampsweb"
|
||||
}
|
||||
|
||||
locals {
|
||||
mailserver_accounts = jsondecode(data.vault_kv_secret_v2.secrets.data["mailserver_accounts"])
|
||||
}
|
||||
variable "redis_host" { type = string }
|
||||
variable "ollama_host" { type = string }
|
||||
variable "mail_host" { type = string }
|
||||
|
|
@ -81,7 +89,7 @@ locals {
|
|||
},
|
||||
{
|
||||
name = "GRAMPSWEB_EMAIL_HOST_PASSWORD"
|
||||
value = var.mailserver_accounts["info@viktorbarzin.me"]
|
||||
value = local.mailserver_accounts["info@viktorbarzin.me"]
|
||||
},
|
||||
{
|
||||
name = "GRAMPSWEB_EMAIL_USE_SSL"
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,13 +1,13 @@
|
|||
variable "hackmd_db_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "tls_secret_name" {
|
||||
type = string
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
variable "mysql_host" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "hackmd"
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "hackmd" {
|
||||
metadata {
|
||||
|
|
@ -103,7 +103,7 @@ resource "kubernetes_deployment" "hackmd" {
|
|||
env {
|
||||
name = "CMD_DB_URL"
|
||||
# value = format("%s%s%s", "postgres://codimd:", var.hackmd_db_password, "@localhost/codimd")
|
||||
value = format("%s%s%s", "mysql://codimd:", var.hackmd_db_password, "@${var.mysql_host}/codimd")
|
||||
value = format("%s%s%s", "mysql://codimd:", data.vault_kv_secret_v2.secrets.data["db_password"], "@${var.mysql_host}/codimd")
|
||||
}
|
||||
env {
|
||||
name = "CMD_USECDN"
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,17 +2,13 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "health_postgresql_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "health_secret_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
variable "postgresql_host" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "health"
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "health" {
|
||||
metadata {
|
||||
|
|
@ -70,11 +66,11 @@ resource "kubernetes_deployment" "health" {
|
|||
|
||||
env {
|
||||
name = "DATABASE_URL"
|
||||
value = "postgresql+asyncpg://health:${var.health_postgresql_password}@${var.postgresql_host}:5432/health"
|
||||
value = "postgresql+asyncpg://health:${data.vault_kv_secret_v2.secrets.data["db_password"]}@${var.postgresql_host}:5432/health"
|
||||
}
|
||||
env {
|
||||
name = "SECRET_KEY"
|
||||
value = var.health_secret_key
|
||||
value = data.vault_kv_secret_v2.secrets.data["secret_key"]
|
||||
}
|
||||
env {
|
||||
name = "UPLOAD_DIR"
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -23,7 +23,7 @@ resource "kubernetes_config_map" "mailserver_config" {
|
|||
ShowProgressBar: false
|
||||
Accounts:
|
||||
- ImmichServerUrl: http://immich.viktorbarzin.me
|
||||
ApiKey: ${var.immich_frame_api_key}
|
||||
ApiKey: ${data.vault_kv_secret_v2.secrets.data["frame_api_key"]}
|
||||
Albums:
|
||||
- 1aa98849-bbd5-452b-aac0-310b210a8597 # china
|
||||
EOF
|
||||
|
|
|
|||
|
|
@ -2,17 +2,13 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "immich_postgresql_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "immich"
|
||||
}
|
||||
variable "immich_frame_api_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "homepage_credentials" {
|
||||
type = map(any)
|
||||
sensitive = true
|
||||
|
||||
locals {
|
||||
homepage_credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["homepage_credentials"])
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -168,7 +164,7 @@ resource "kubernetes_deployment" "immich_server" {
|
|||
}
|
||||
env {
|
||||
name = "DB_PASSWORD"
|
||||
value = var.immich_postgresql_password
|
||||
value = data.vault_kv_secret_v2.secrets.data["db_password"]
|
||||
}
|
||||
env {
|
||||
name = "IMMICH_MACHINE_LEARNING_URL"
|
||||
|
|
@ -357,7 +353,7 @@ resource "kubernetes_deployment" "immich-postgres" {
|
|||
}
|
||||
env {
|
||||
name = "POSTGRES_PASSWORD"
|
||||
value = var.immich_postgresql_password
|
||||
value = data.vault_kv_secret_v2.secrets.data["db_password"]
|
||||
}
|
||||
env {
|
||||
name = "POSTGRES_USER"
|
||||
|
|
@ -428,7 +424,7 @@ resource "kubernetes_service" "immich-postgresql" {
|
|||
# version = "0.9.3"
|
||||
# timeout = 6000
|
||||
|
||||
# values = [templatefile("${path.module}/chart_values.tpl", { postgresql_password = var.immich_postgresql_password, version = var.immich_version })]
|
||||
# values = [templatefile("${path.module}/chart_values.tpl", { postgresql_password = data.vault_kv_secret_v2.secrets.data["db_password"], version = var.immich_version })]
|
||||
# }
|
||||
|
||||
# The helm one cannot be customized to use affinity settings to use the gpu node
|
||||
|
|
@ -595,7 +591,7 @@ module "ingress-immich" {
|
|||
"gethomepage.dev/widget.url" = "http://immich-server.immich.svc.cluster.local:2283"
|
||||
"gethomepage.dev/widget.version" = "2"
|
||||
"gethomepage.dev/pod-selector" = ""
|
||||
"gethomepage.dev/widget.key" = var.homepage_credentials["immich"]["token"]
|
||||
"gethomepage.dev/widget.key" = local.homepage_credentials["immich"]["token"]
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -625,7 +621,7 @@ resource "kubernetes_cron_job_v1" "postgresql-backup" {
|
|||
image = "postgres:16.4-bullseye"
|
||||
command = ["/bin/sh", "-c", <<-EOT
|
||||
export now=$(date +"%Y_%m_%d_%H_%M")
|
||||
PGPASSWORD=${var.immich_postgresql_password} pg_dumpall -h immich-postgresql -U immich > /backup/dump_$now.sql
|
||||
PGPASSWORD=${data.vault_kv_secret_v2.secrets.data["db_password"]} pg_dumpall -h immich-postgresql -U immich > /backup/dump_$now.sql
|
||||
|
||||
# Rotate - delete last log file
|
||||
cd /backup
|
||||
|
|
@ -710,7 +706,7 @@ resource "kubernetes_cron_job_v1" "postgresql-backup" {
|
|||
# }
|
||||
# env {
|
||||
# name = "DB_PASSWORD"
|
||||
# value = var.immich_postgresql_password
|
||||
# value = data.vault_kv_secret_v2.secrets.data["db_password"]
|
||||
# }
|
||||
# env {
|
||||
# name = "DB_HOST"
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -9,18 +9,18 @@ terraform {
|
|||
}
|
||||
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
variable "proxmox_pm_api_url" { type = string }
|
||||
variable "proxmox_pm_api_token_id" {
|
||||
type = string
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "proxmox_pm_api_token_secret" {
|
||||
type = string
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -2,19 +2,15 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "linkwarden_postgresql_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "linkwarden_authentik_client_id" { type = string }
|
||||
variable "linkwarden_authentik_client_secret" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "postgresql_host" { type = string }
|
||||
variable "homepage_credentials" {
|
||||
type = map(any)
|
||||
sensitive = true
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "linkwarden"
|
||||
}
|
||||
|
||||
locals {
|
||||
homepage_credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["homepage_credentials"])
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -78,7 +74,7 @@ resource "kubernetes_deployment" "linkwarden" {
|
|||
}
|
||||
env {
|
||||
name = "DATABASE_URL"
|
||||
value = "postgresql://linkwarden:${var.linkwarden_postgresql_password}@${var.postgresql_host}:5432/linkwarden"
|
||||
value = "postgresql://linkwarden:${data.vault_kv_secret_v2.secrets.data["db_password"]}@${var.postgresql_host}:5432/linkwarden"
|
||||
}
|
||||
env {
|
||||
name = "NEXT_PUBLIC_AUTHENTIK_ENABLED"
|
||||
|
|
@ -98,11 +94,11 @@ resource "kubernetes_deployment" "linkwarden" {
|
|||
}
|
||||
env {
|
||||
name = "AUTHENTIK_CLIENT_ID"
|
||||
value = var.linkwarden_authentik_client_id
|
||||
value = data.vault_kv_secret_v2.secrets.data["authentik_client_id"]
|
||||
}
|
||||
env {
|
||||
name = "AUTHENTIK_CLIENT_SECRET"
|
||||
value = var.linkwarden_authentik_client_secret
|
||||
value = data.vault_kv_secret_v2.secrets.data["authentik_client_secret"]
|
||||
}
|
||||
resources {
|
||||
requests = {
|
||||
|
|
@ -153,6 +149,6 @@ module "ingress" {
|
|||
"gethomepage.dev/pod-selector" = ""
|
||||
"gethomepage.dev/widget.type" = "linkwarden"
|
||||
"gethomepage.dev/widget.url" = "http://linkwarden.linkwarden.svc.cluster.local"
|
||||
"gethomepage.dev/widget.key" = var.homepage_credentials["linkwarden"]["api_key"]
|
||||
"gethomepage.dev/widget.key" = local.homepage_credentials["linkwarden"]["api_key"]
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,13 +2,13 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "n8n_postgresql_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
variable "postgresql_host" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "n8n"
|
||||
}
|
||||
|
||||
module "tls_secret" {
|
||||
source = "../../modules/kubernetes/setup_tls_secret"
|
||||
|
|
@ -125,7 +125,7 @@ resource "kubernetes_deployment" "n8n" {
|
|||
}
|
||||
env {
|
||||
name = "DB_POSTGRESDB_PASSWORD"
|
||||
value = var.n8n_postgresql_password
|
||||
value = data.vault_kv_secret_v2.secrets.data["db_password"]
|
||||
}
|
||||
env {
|
||||
name = "GENERIC_TIMEZONE"
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,9 +3,13 @@ variable "tls_secret_name" {
|
|||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
variable "homepage_credentials" {
|
||||
type = map(any)
|
||||
sensitive = true
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "navidrome"
|
||||
}
|
||||
|
||||
locals {
|
||||
homepage_credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["homepage_credentials"])
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -164,8 +168,8 @@ module "ingress" {
|
|||
"gethomepage.dev/pod-selector" = ""
|
||||
"gethomepage.dev/widget.type" = "navidrome"
|
||||
"gethomepage.dev/widget.url" = "http://navidrome.navidrome.svc.cluster.local"
|
||||
"gethomepage.dev/widget.user" = var.homepage_credentials["navidrome"]["user"]
|
||||
"gethomepage.dev/widget.token" = var.homepage_credentials["navidrome"]["token"]
|
||||
"gethomepage.dev/widget.salt" = var.homepage_credentials["navidrome"]["salt"]
|
||||
"gethomepage.dev/widget.user" = local.homepage_credentials["navidrome"]["user"]
|
||||
"gethomepage.dev/widget.token" = local.homepage_credentials["navidrome"]["token"]
|
||||
"gethomepage.dev/widget.salt" = local.homepage_credentials["navidrome"]["salt"]
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,18 +2,14 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "netbox_db_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "netbox_superuser_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
variable "redis_host" { type = string }
|
||||
variable "postgresql_host" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "netbox"
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "netbox" {
|
||||
metadata {
|
||||
|
|
@ -81,7 +77,7 @@ resource "kubernetes_deployment" "netbox" {
|
|||
}
|
||||
env {
|
||||
name = "DB_PASSWORD"
|
||||
value = var.netbox_db_password
|
||||
value = data.vault_kv_secret_v2.secrets.data["db_password"]
|
||||
}
|
||||
env {
|
||||
name = "DB_HOST"
|
||||
|
|
@ -117,7 +113,7 @@ resource "kubernetes_deployment" "netbox" {
|
|||
}
|
||||
env {
|
||||
name = "SUPERUSER_PASSWORD"
|
||||
value = var.netbox_superuser_password
|
||||
value = data.vault_kv_secret_v2.secrets.data["superuser_password"]
|
||||
}
|
||||
env {
|
||||
name = "REMOTE_AUTH_ENABLED"
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,16 +2,17 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "nextcloud_db_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
variable "redis_host" { type = string }
|
||||
variable "mysql_host" { type = string }
|
||||
variable "homepage_credentials" {
|
||||
type = map(any)
|
||||
sensitive = true
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "nextcloud"
|
||||
}
|
||||
|
||||
locals {
|
||||
homepage_credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["homepage_credentials"])
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -79,7 +80,7 @@ resource "helm_release" "nextcloud" {
|
|||
atomic = true
|
||||
version = "8.8.1"
|
||||
|
||||
values = [templatefile("${path.module}/chart_values.yaml", { tls_secret_name = var.tls_secret_name, db_password = var.nextcloud_db_password, redis_host = var.redis_host, mysql_host = var.mysql_host })]
|
||||
values = [templatefile("${path.module}/chart_values.yaml", { tls_secret_name = var.tls_secret_name, db_password = data.vault_kv_secret_v2.secrets.data["db_password"], redis_host = var.redis_host, mysql_host = var.mysql_host })]
|
||||
timeout = 6000
|
||||
}
|
||||
|
||||
|
|
@ -182,7 +183,7 @@ resource "kubernetes_deployment" "whiteboard" {
|
|||
}
|
||||
env {
|
||||
name = "JWT_SECRET_KEY"
|
||||
value = var.nextcloud_db_password # anything secret is fine
|
||||
value = data.vault_kv_secret_v2.secrets.data["db_password"] # anything secret is fine
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -227,8 +228,8 @@ module "ingress" {
|
|||
"gethomepage.dev/pod-selector" = ""
|
||||
"gethomepage.dev/widget.type" = "nextcloud"
|
||||
"gethomepage.dev/widget.url" = "https://nextcloud.viktorbarzin.me"
|
||||
"gethomepage.dev/widget.username" = var.homepage_credentials["nextcloud"]["username"]
|
||||
"gethomepage.dev/widget.password" = var.homepage_credentials["nextcloud"]["password"]
|
||||
"gethomepage.dev/widget.username" = local.homepage_credentials["nextcloud"]["username"]
|
||||
"gethomepage.dev/widget.password" = local.homepage_credentials["nextcloud"]["password"]
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,13 +2,18 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "ollama_api_credentials" {
|
||||
type = map(string)
|
||||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
variable "ollama_host" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "ollama"
|
||||
}
|
||||
|
||||
locals {
|
||||
api_credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["api_credentials"])
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_namespace" "ollama" {
|
||||
metadata {
|
||||
|
|
@ -167,11 +172,11 @@ module "ollama-ingress" {
|
|||
|
||||
# Ollama API ingress for external access (basicAuth protected)
|
||||
locals {
|
||||
ollama_api_htpasswd = join("\n", [for name, pass in var.ollama_api_credentials : "${name}:${bcrypt(pass, 10)}"])
|
||||
ollama_api_htpasswd = join("\n", [for name, pass in local.api_credentials : "${name}:${bcrypt(pass, 10)}"])
|
||||
}
|
||||
|
||||
resource "kubernetes_secret" "ollama_api_basic_auth" {
|
||||
count = length(var.ollama_api_credentials) > 0 ? 1 : 0
|
||||
count = length(local.api_credentials) > 0 ? 1 : 0
|
||||
metadata {
|
||||
name = "ollama-api-basic-auth-secret"
|
||||
namespace = kubernetes_namespace.ollama.metadata[0].name
|
||||
|
|
@ -188,7 +193,7 @@ resource "kubernetes_secret" "ollama_api_basic_auth" {
|
|||
}
|
||||
|
||||
resource "kubernetes_manifest" "ollama_api_basic_auth_middleware" {
|
||||
count = length(var.ollama_api_credentials) > 0 ? 1 : 0
|
||||
count = length(local.api_credentials) > 0 ? 1 : 0
|
||||
manifest = {
|
||||
apiVersion = "traefik.io/v1alpha1"
|
||||
kind = "Middleware"
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,18 +2,14 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "onlyoffice_db_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "onlyoffice_jwt_token" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
variable "redis_host" { type = string }
|
||||
variable "mysql_host" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "onlyoffice"
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "onlyoffice" {
|
||||
metadata {
|
||||
|
|
@ -140,7 +136,7 @@ resource "kubernetes_deployment" "onlyoffice-document-server" {
|
|||
}
|
||||
env {
|
||||
name = "DB_PWD"
|
||||
value = var.onlyoffice_db_password
|
||||
value = data.vault_kv_secret_v2.secrets.data["db_password"]
|
||||
}
|
||||
env {
|
||||
name = "REDIS_SERVER_HOST"
|
||||
|
|
@ -152,7 +148,7 @@ resource "kubernetes_deployment" "onlyoffice-document-server" {
|
|||
}
|
||||
env {
|
||||
name = "JWT_SECRET"
|
||||
value = var.onlyoffice_jwt_token
|
||||
value = data.vault_kv_secret_v2.secrets.data["jwt_token"]
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,48 +2,17 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "openclaw_ssh_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "openclaw_skill_secrets" {
|
||||
type = map(string)
|
||||
sensitive = true
|
||||
}
|
||||
variable "llama_api_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "brave_api_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "openrouter_api_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "nvidia_api_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "anthropic_api_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "openclaw_telegram_bot_token" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "forgejo_api_token" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "claude_memory_api_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "openclaw"
|
||||
}
|
||||
|
||||
locals {
|
||||
skill_secrets = jsondecode(data.vault_kv_secret_v2.secrets.data["skill_secrets"])
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_namespace" "openclaw" {
|
||||
metadata {
|
||||
|
|
@ -89,7 +58,7 @@ resource "kubernetes_secret" "ssh_key" {
|
|||
namespace = kubernetes_namespace.openclaw.metadata[0].name
|
||||
}
|
||||
data = {
|
||||
"id_rsa" = var.openclaw_ssh_key
|
||||
"id_rsa" = data.vault_kv_secret_v2.secrets.data["ssh_key"]
|
||||
}
|
||||
type = "generic"
|
||||
}
|
||||
|
|
@ -166,7 +135,7 @@ resource "kubernetes_config_map" "openclaw_config" {
|
|||
search = {
|
||||
enabled = true
|
||||
provider = "brave"
|
||||
apiKey = var.brave_api_key
|
||||
apiKey = data.vault_kv_secret_v2.secrets.data["brave_api_key"]
|
||||
maxResults = 5
|
||||
}
|
||||
fetch = {
|
||||
|
|
@ -192,7 +161,7 @@ resource "kubernetes_config_map" "openclaw_config" {
|
|||
channels = {
|
||||
telegram = {
|
||||
enabled = true
|
||||
botToken = var.openclaw_telegram_bot_token
|
||||
botToken = data.vault_kv_secret_v2.secrets.data["telegram_bot_token"]
|
||||
dmPolicy = "allowlist"
|
||||
allowFrom = ["tg:8281953845"]
|
||||
groupPolicy = "allowlist"
|
||||
|
|
@ -213,7 +182,7 @@ resource "kubernetes_config_map" "openclaw_config" {
|
|||
anthropic = {
|
||||
baseUrl = "https://api.anthropic.com/v1"
|
||||
api = "anthropic-messages"
|
||||
apiKey = var.anthropic_api_key
|
||||
apiKey = data.vault_kv_secret_v2.secrets.data["anthropic_api_key"]
|
||||
models = [
|
||||
{ id = "claude-sonnet-4-20250514", name = "Claude Sonnet 4", reasoning = true, input = ["text", "image"], contextWindow = 200000, maxTokens = 16384, cost = { input = 0.003, output = 0.015, cacheRead = 0.0003, cacheWrite = 0.00375 } },
|
||||
{ id = "claude-opus-4-20250514", name = "Claude Opus 4", reasoning = true, input = ["text", "image"], contextWindow = 200000, maxTokens = 16384, cost = { input = 0.015, output = 0.075, cacheRead = 0.0015, cacheWrite = 0.01875 } },
|
||||
|
|
@ -223,7 +192,7 @@ resource "kubernetes_config_map" "openclaw_config" {
|
|||
nim = {
|
||||
baseUrl = "https://integrate.api.nvidia.com/v1"
|
||||
api = "openai-completions"
|
||||
apiKey = var.nvidia_api_key
|
||||
apiKey = data.vault_kv_secret_v2.secrets.data["nvidia_api_key"]
|
||||
models = [
|
||||
{ id = "deepseek-ai/deepseek-v3.2", name = "DeepSeek V3.2", reasoning = false, input = ["text"], contextWindow = 164000, maxTokens = 16384, cost = { input = 0, output = 0, cacheRead = 0, cacheWrite = 0 } },
|
||||
{ id = "qwen/qwen3.5-397b-a17b", name = "Qwen 3.5", reasoning = true, input = ["text"], contextWindow = 262000, maxTokens = 16384, cost = { input = 0, output = 0, cacheRead = 0, cacheWrite = 0 } },
|
||||
|
|
@ -236,7 +205,7 @@ resource "kubernetes_config_map" "openclaw_config" {
|
|||
openrouter = {
|
||||
baseUrl = "https://openrouter.ai/api/v1"
|
||||
api = "openai-completions"
|
||||
apiKey = var.openrouter_api_key
|
||||
apiKey = data.vault_kv_secret_v2.secrets.data["openrouter_api_key"]
|
||||
models = [
|
||||
{ id = "stepfun/step-3.5-flash:free", name = "Step 3.5 Flash", reasoning = true, input = ["text"], contextWindow = 256000, maxTokens = 16384, cost = { input = 0, output = 0, cacheRead = 0, cacheWrite = 0 } },
|
||||
{ id = "arcee-ai/trinity-large-preview:free", name = "Trinity Large", reasoning = false, input = ["text"], contextWindow = 131000, maxTokens = 16384, cost = { input = 0, output = 0, cacheRead = 0, cacheWrite = 0 } },
|
||||
|
|
@ -244,7 +213,7 @@ resource "kubernetes_config_map" "openclaw_config" {
|
|||
}
|
||||
llama-as-openai = {
|
||||
baseUrl = "https://api.llama.com/compat/v1"
|
||||
apiKey = var.llama_api_key
|
||||
apiKey = data.vault_kv_secret_v2.secrets.data["llama_api_key"]
|
||||
api = "openai-completions"
|
||||
models = [
|
||||
{ id = "Llama-4-Maverick-17B-128E-Instruct-FP8", name = "Llama 4 Maverick", reasoning = false, input = ["text"], contextWindow = 200000, maxTokens = 16384, cost = { input = 0, output = 0, cacheRead = 0, cacheWrite = 0 } },
|
||||
|
|
@ -574,7 +543,7 @@ resource "kubernetes_deployment" "openclaw" {
|
|||
}
|
||||
env {
|
||||
name = "HOME_ASSISTANT_TOKEN"
|
||||
value = var.openclaw_skill_secrets["home_assistant_token"]
|
||||
value = local.skill_secrets["home_assistant_token"]
|
||||
}
|
||||
env {
|
||||
name = "HOME_ASSISTANT_SOFIA_URL"
|
||||
|
|
@ -582,17 +551,17 @@ resource "kubernetes_deployment" "openclaw" {
|
|||
}
|
||||
env {
|
||||
name = "HOME_ASSISTANT_SOFIA_TOKEN"
|
||||
value = var.openclaw_skill_secrets["home_assistant_sofia_token"]
|
||||
value = local.skill_secrets["home_assistant_sofia_token"]
|
||||
}
|
||||
# Skill secrets - Uptime Kuma
|
||||
env {
|
||||
name = "UPTIME_KUMA_PASSWORD"
|
||||
value = var.openclaw_skill_secrets["uptime_kuma_password"]
|
||||
value = local.skill_secrets["uptime_kuma_password"]
|
||||
}
|
||||
# Skill secrets - Slack
|
||||
env {
|
||||
name = "SLACK_WEBHOOK_URL"
|
||||
value = var.openclaw_skill_secrets["slack_webhook"]
|
||||
value = local.skill_secrets["slack_webhook"]
|
||||
}
|
||||
# Memory API
|
||||
env {
|
||||
|
|
@ -601,7 +570,7 @@ resource "kubernetes_deployment" "openclaw" {
|
|||
}
|
||||
env {
|
||||
name = "MEMORY_API_KEY"
|
||||
value = var.claude_memory_api_key
|
||||
value = data.vault_kv_secret_v2.secrets.data["claude_memory_api_key"]
|
||||
}
|
||||
# Python packages path for skills
|
||||
env {
|
||||
|
|
@ -659,11 +628,11 @@ resource "kubernetes_deployment" "openclaw" {
|
|||
}
|
||||
env {
|
||||
name = "NVIDIA_API_KEY"
|
||||
value = var.nvidia_api_key
|
||||
value = data.vault_kv_secret_v2.secrets.data["nvidia_api_key"]
|
||||
}
|
||||
env {
|
||||
name = "OPENROUTER_API_KEY"
|
||||
value = var.openrouter_api_key
|
||||
value = data.vault_kv_secret_v2.secrets.data["openrouter_api_key"]
|
||||
}
|
||||
volume_mount {
|
||||
name = "tools"
|
||||
|
|
@ -1122,11 +1091,11 @@ resource "kubernetes_cron_job_v1" "task_processor" {
|
|||
|
||||
env {
|
||||
name = "FORGEJO_TOKEN"
|
||||
value = var.forgejo_api_token
|
||||
value = data.vault_kv_secret_v2.secrets.data["forgejo_api_token"]
|
||||
}
|
||||
env {
|
||||
name = "OPENCLAW_TOKEN"
|
||||
value = var.nvidia_api_key
|
||||
value = data.vault_kv_secret_v2.secrets.data["nvidia_api_key"]
|
||||
}
|
||||
|
||||
resources {
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,12 +2,17 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "owntracks_credentials" {
|
||||
type = map(string)
|
||||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "owntracks"
|
||||
}
|
||||
|
||||
locals {
|
||||
credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["credentials"])
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_namespace" "owntracks" {
|
||||
metadata {
|
||||
|
|
@ -27,7 +32,7 @@ module "tls_secret" {
|
|||
|
||||
locals {
|
||||
username = "owntracks"
|
||||
htpasswd = join("\n", [for name, pass in var.owntracks_credentials : "${name}:${bcrypt(pass, 10)}"])
|
||||
htpasswd = join("\n", [for name, pass in local.credentials : "${name}:${bcrypt(pass, 10)}"])
|
||||
}
|
||||
|
||||
resource "kubernetes_secret" "basic_auth" {
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,18 +2,19 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "paperless_db_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "homepage_credentials" {
|
||||
type = map(any)
|
||||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
variable "redis_host" { type = string }
|
||||
variable "mysql_host" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "paperless-ngx"
|
||||
}
|
||||
|
||||
locals {
|
||||
homepage_credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["homepage_credentials"])
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_namespace" "paperless-ngx" {
|
||||
metadata {
|
||||
|
|
@ -104,7 +105,7 @@ resource "kubernetes_deployment" "paperless-ngx" {
|
|||
}
|
||||
env {
|
||||
name = "PAPERLESS_DBPASS"
|
||||
value = var.paperless_db_password
|
||||
value = data.vault_kv_secret_v2.secrets.data["db_password"]
|
||||
}
|
||||
env {
|
||||
name = "PAPERLESS_CSRF_TRUSTED_ORIGINS"
|
||||
|
|
@ -191,8 +192,8 @@ module "ingress" {
|
|||
"gethomepage.dev/widget.type" = "paperlessngx"
|
||||
"gethomepage.dev/widget.url" = "http://paperless-ngx.paperless-ngx.svc.cluster.local"
|
||||
# "gethomepage.dev/widget.token" = var.homepage_token
|
||||
"gethomepage.dev/widget.username" = var.homepage_credentials["paperless-ngx"]["username"]
|
||||
"gethomepage.dev/widget.password" = var.homepage_credentials["paperless-ngx"]["password"]
|
||||
"gethomepage.dev/widget.username" = local.homepage_credentials["paperless-ngx"]["username"]
|
||||
"gethomepage.dev/widget.password" = local.homepage_credentials["paperless-ngx"]["password"]
|
||||
"gethomepage.dev/widget.fields" = "[\"total\"]"
|
||||
"gethomepage.dev/pod-selector" = ""
|
||||
# gethomepage.dev/weight: 10 # optional
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@
|
|||
# Variable Declarations
|
||||
# =============================================================================
|
||||
|
||||
# --- Core ---
|
||||
# --- Core (non-secret, from config.tfvars) ---
|
||||
variable "tls_secret_name" {
|
||||
type = string
|
||||
}
|
||||
|
|
@ -35,91 +35,15 @@ variable "prod" {
|
|||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
# --- dbaas ---
|
||||
variable "dbaas_root_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "dbaas_postgresql_root_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "dbaas_pgadmin_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
# --- traefik ---
|
||||
variable "ingress_crowdsec_api_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "auth_fallback_htpasswd" {
|
||||
type = string
|
||||
sensitive = true
|
||||
default = ""
|
||||
}
|
||||
|
||||
# --- technitium ---
|
||||
variable "technitium_db_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "homepage_credentials" {
|
||||
type = map(any)
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
# --- headscale ---
|
||||
variable "headscale_config" { type = string }
|
||||
variable "headscale_acl" { type = string }
|
||||
variable "k8s_ca_cert" {
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
# --- authentik / rbac / k8s-portal ---
|
||||
variable "authentik_secret_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "authentik_postgres_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "k8s_users" {
|
||||
type = map(any)
|
||||
default = {}
|
||||
}
|
||||
variable "ssh_private_key" {
|
||||
type = string
|
||||
default = ""
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
# --- crowdsec ---
|
||||
variable "crowdsec_enroll_key" { type = string }
|
||||
variable "crowdsec_db_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "crowdsec_dash_api_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "crowdsec_dash_machine_id" { type = string }
|
||||
variable "crowdsec_dash_machine_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "alertmanager_slack_api_url" { type = string }
|
||||
|
||||
# --- cloudflared ---
|
||||
variable "cloudflare_api_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "cloudflare_email" { type = string }
|
||||
variable "cloudflare_account_id" { type = string }
|
||||
variable "cloudflare_zone_id" { type = string }
|
||||
|
|
@ -127,91 +51,23 @@ variable "cloudflare_tunnel_id" { type = string }
|
|||
variable "public_ip" { type = string }
|
||||
variable "cloudflare_proxied_names" {}
|
||||
variable "cloudflare_non_proxied_names" {}
|
||||
variable "cloudflare_tunnel_token" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
# --- monitoring ---
|
||||
variable "alertmanager_account_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "monitoring_idrac_username" { type = string }
|
||||
variable "monitoring_idrac_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "tiny_tuya_service_secret" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "haos_api_token" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "pve_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "grafana_db_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "grafana_admin_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
|
||||
# --- Vault KV secrets ---
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "platform"
|
||||
}
|
||||
|
||||
# --- vaultwarden ---
|
||||
variable "vaultwarden_smtp_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
# --- wireguard ---
|
||||
variable "wireguard_wg_0_conf" { type = string }
|
||||
variable "wireguard_wg_0_key" { type = string }
|
||||
variable "wireguard_firewall_sh" { type = string }
|
||||
|
||||
# --- xray ---
|
||||
variable "xray_reality_clients" { type = list(map(string)) }
|
||||
variable "xray_reality_private_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "xray_reality_short_ids" { type = list(string) }
|
||||
|
||||
# --- mailserver ---
|
||||
variable "mailserver_accounts" {}
|
||||
variable "mailserver_aliases" {}
|
||||
variable "mailserver_opendkim_key" {}
|
||||
variable "mailserver_sasl_passwd" {}
|
||||
variable "mailserver_roundcubemail_db_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
# --- infra-maintenance ---
|
||||
variable "webhook_handler_git_user" { type = string }
|
||||
variable "webhook_handler_git_token" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "technitium_username" { type = string }
|
||||
variable "technitium_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
# --- iscsi-csi ---
|
||||
variable "truenas_api_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "truenas_ssh_private_key" {
|
||||
type = string
|
||||
sensitive = true
|
||||
locals {
|
||||
homepage_credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["homepage_credentials"])
|
||||
k8s_users = jsondecode(data.vault_kv_secret_v2.secrets.data["k8s_users"])
|
||||
xray_reality_clients = jsondecode(data.vault_kv_secret_v2.secrets.data["xray_reality_clients"])
|
||||
xray_reality_short_ids = jsondecode(data.vault_kv_secret_v2.secrets.data["xray_reality_short_ids"])
|
||||
mailserver_accounts = jsondecode(data.vault_kv_secret_v2.secrets.data["mailserver_accounts"])
|
||||
mailserver_aliases = jsondecode(data.vault_kv_secret_v2.secrets.data["mailserver_aliases"])
|
||||
mailserver_opendkim_key = jsondecode(data.vault_kv_secret_v2.secrets.data["mailserver_opendkim_key"])
|
||||
mailserver_sasl_passwd = jsondecode(data.vault_kv_secret_v2.secrets.data["mailserver_sasl_passwd"])
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
|
|
@ -234,9 +90,9 @@ module "dbaas" {
|
|||
prod = var.prod
|
||||
tls_secret_name = var.tls_secret_name
|
||||
nfs_server = var.nfs_server
|
||||
dbaas_root_password = var.dbaas_root_password
|
||||
postgresql_root_password = var.dbaas_postgresql_root_password
|
||||
pgadmin_password = var.dbaas_pgadmin_password
|
||||
dbaas_root_password = data.vault_kv_secret_v2.secrets.data["dbaas_root_password"]
|
||||
postgresql_root_password = data.vault_kv_secret_v2.secrets.data["dbaas_postgresql_root_password"]
|
||||
pgadmin_password = data.vault_kv_secret_v2.secrets.data["dbaas_pgadmin_password"]
|
||||
kube_config_path = var.kube_config_path
|
||||
tier = local.tiers.cluster
|
||||
}
|
||||
|
|
@ -257,10 +113,10 @@ module "redis" {
|
|||
module "traefik" {
|
||||
source = "./modules/traefik"
|
||||
tier = local.tiers.core
|
||||
crowdsec_api_key = var.ingress_crowdsec_api_key
|
||||
crowdsec_api_key = data.vault_kv_secret_v2.secrets.data["ingress_crowdsec_api_key"]
|
||||
redis_host = var.redis_host
|
||||
tls_secret_name = var.tls_secret_name
|
||||
auth_fallback_htpasswd = var.auth_fallback_htpasswd
|
||||
auth_fallback_htpasswd = data.vault_kv_secret_v2.secrets.data["auth_fallback_htpasswd"]
|
||||
}
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
|
|
@ -271,10 +127,10 @@ module "technitium" {
|
|||
tls_secret_name = var.tls_secret_name
|
||||
nfs_server = var.nfs_server
|
||||
mysql_host = var.mysql_host
|
||||
homepage_token = var.homepage_credentials["technitium"]["token"]
|
||||
technitium_db_password = var.technitium_db_password
|
||||
technitium_username = var.technitium_username
|
||||
technitium_password = var.technitium_password
|
||||
homepage_token = local.homepage_credentials["technitium"]["token"]
|
||||
technitium_db_password = data.vault_kv_secret_v2.secrets.data["technitium_db_password"]
|
||||
technitium_username = data.vault_kv_secret_v2.secrets.data["technitium_username"]
|
||||
technitium_password = data.vault_kv_secret_v2.secrets.data["technitium_password"]
|
||||
tier = local.tiers.core
|
||||
}
|
||||
|
||||
|
|
@ -285,9 +141,9 @@ module "headscale" {
|
|||
source = "./modules/headscale"
|
||||
tls_secret_name = var.tls_secret_name
|
||||
nfs_server = var.nfs_server
|
||||
headscale_config = var.headscale_config
|
||||
headscale_acl = var.headscale_acl
|
||||
homepage_token = try(var.homepage_credentials["headscale"]["api_key"], "")
|
||||
headscale_config = data.vault_kv_secret_v2.secrets.data["headscale_config"]
|
||||
headscale_acl = data.vault_kv_secret_v2.secrets.data["headscale_acl"]
|
||||
homepage_token = try(local.homepage_credentials["headscale"]["api_key"], "")
|
||||
tier = local.tiers.core
|
||||
}
|
||||
|
||||
|
|
@ -298,10 +154,10 @@ module "authentik" {
|
|||
source = "./modules/authentik"
|
||||
tier = local.tiers.cluster
|
||||
tls_secret_name = var.tls_secret_name
|
||||
secret_key = var.authentik_secret_key
|
||||
postgres_password = var.authentik_postgres_password
|
||||
secret_key = data.vault_kv_secret_v2.secrets.data["authentik_secret_key"]
|
||||
postgres_password = data.vault_kv_secret_v2.secrets.data["authentik_postgres_password"]
|
||||
redis_host = var.redis_host
|
||||
homepage_token = try(var.homepage_credentials["authentik"]["token"], "")
|
||||
homepage_token = try(local.homepage_credentials["authentik"]["token"], "")
|
||||
}
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
|
|
@ -311,7 +167,7 @@ module "rbac" {
|
|||
source = "./modules/rbac"
|
||||
tier = local.tiers.cluster
|
||||
tls_secret_name = var.tls_secret_name
|
||||
k8s_users = var.k8s_users
|
||||
k8s_users = local.k8s_users
|
||||
ssh_private_key = var.ssh_private_key
|
||||
}
|
||||
|
||||
|
|
@ -333,14 +189,14 @@ module "crowdsec" {
|
|||
tier = local.tiers.cluster
|
||||
tls_secret_name = var.tls_secret_name
|
||||
mysql_host = var.mysql_host
|
||||
homepage_username = var.homepage_credentials["crowdsec"]["username"]
|
||||
homepage_password = var.homepage_credentials["crowdsec"]["password"]
|
||||
enroll_key = var.crowdsec_enroll_key
|
||||
db_password = var.crowdsec_db_password
|
||||
crowdsec_dash_api_key = var.crowdsec_dash_api_key
|
||||
crowdsec_dash_machine_id = var.crowdsec_dash_machine_id
|
||||
crowdsec_dash_machine_password = var.crowdsec_dash_machine_password
|
||||
slack_webhook_url = var.alertmanager_slack_api_url
|
||||
homepage_username = local.homepage_credentials["crowdsec"]["username"]
|
||||
homepage_password = local.homepage_credentials["crowdsec"]["password"]
|
||||
enroll_key = data.vault_kv_secret_v2.secrets.data["crowdsec_enroll_key"]
|
||||
db_password = data.vault_kv_secret_v2.secrets.data["crowdsec_db_password"]
|
||||
crowdsec_dash_api_key = data.vault_kv_secret_v2.secrets.data["crowdsec_dash_api_key"]
|
||||
crowdsec_dash_machine_id = data.vault_kv_secret_v2.secrets.data["crowdsec_dash_machine_id"]
|
||||
crowdsec_dash_machine_password = data.vault_kv_secret_v2.secrets.data["crowdsec_dash_machine_password"]
|
||||
slack_webhook_url = data.vault_kv_secret_v2.secrets.data["alertmanager_slack_api_url"]
|
||||
}
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
|
|
@ -351,15 +207,15 @@ module "monitoring" {
|
|||
tls_secret_name = var.tls_secret_name
|
||||
nfs_server = var.nfs_server
|
||||
mysql_host = var.mysql_host
|
||||
alertmanager_account_password = var.alertmanager_account_password
|
||||
alertmanager_account_password = data.vault_kv_secret_v2.secrets.data["alertmanager_account_password"]
|
||||
idrac_username = var.monitoring_idrac_username
|
||||
idrac_password = var.monitoring_idrac_password
|
||||
alertmanager_slack_api_url = var.alertmanager_slack_api_url
|
||||
tiny_tuya_service_secret = var.tiny_tuya_service_secret
|
||||
haos_api_token = var.haos_api_token
|
||||
pve_password = var.pve_password
|
||||
grafana_db_password = var.grafana_db_password
|
||||
grafana_admin_password = var.grafana_admin_password
|
||||
idrac_password = data.vault_kv_secret_v2.secrets.data["monitoring_idrac_password"]
|
||||
alertmanager_slack_api_url = data.vault_kv_secret_v2.secrets.data["alertmanager_slack_api_url"]
|
||||
tiny_tuya_service_secret = data.vault_kv_secret_v2.secrets.data["tiny_tuya_service_secret"]
|
||||
haos_api_token = data.vault_kv_secret_v2.secrets.data["haos_api_token"]
|
||||
pve_password = data.vault_kv_secret_v2.secrets.data["pve_password"]
|
||||
grafana_db_password = data.vault_kv_secret_v2.secrets.data["grafana_db_password"]
|
||||
grafana_admin_password = data.vault_kv_secret_v2.secrets.data["grafana_admin_password"]
|
||||
tier = local.tiers.cluster
|
||||
}
|
||||
|
||||
|
|
@ -371,7 +227,7 @@ module "vaultwarden" {
|
|||
tls_secret_name = var.tls_secret_name
|
||||
nfs_server = var.nfs_server
|
||||
mail_host = var.mail_host
|
||||
smtp_password = var.vaultwarden_smtp_password
|
||||
smtp_password = data.vault_kv_secret_v2.secrets.data["vaultwarden_smtp_password"]
|
||||
tier = local.tiers.edge
|
||||
}
|
||||
|
||||
|
|
@ -381,9 +237,9 @@ module "vaultwarden" {
|
|||
module "reverse-proxy" {
|
||||
source = "./modules/reverse_proxy"
|
||||
tls_secret_name = var.tls_secret_name
|
||||
truenas_homepage_token = var.homepage_credentials["reverse_proxy"]["truenas_token"]
|
||||
pfsense_homepage_token = var.homepage_credentials["reverse_proxy"]["pfsense_token"]
|
||||
haos_homepage_token = try(var.homepage_credentials["home_assistant"]["token"], "")
|
||||
truenas_homepage_token = local.homepage_credentials["reverse_proxy"]["truenas_token"]
|
||||
pfsense_homepage_token = local.homepage_credentials["reverse_proxy"]["pfsense_token"]
|
||||
haos_homepage_token = try(local.homepage_credentials["home_assistant"]["token"], "")
|
||||
}
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
|
|
@ -420,8 +276,8 @@ module "iscsi-csi" {
|
|||
source = "./modules/iscsi-csi"
|
||||
tier = local.tiers.cluster
|
||||
truenas_host = var.nfs_server # Same TrueNAS host
|
||||
truenas_api_key = var.truenas_api_key
|
||||
truenas_ssh_private_key = var.truenas_ssh_private_key
|
||||
truenas_api_key = data.vault_kv_secret_v2.secrets.data["truenas_api_key"]
|
||||
truenas_ssh_private_key = data.vault_kv_secret_v2.secrets.data["truenas_ssh_private_key"]
|
||||
}
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
|
|
@ -472,9 +328,9 @@ module "uptime-kuma" {
|
|||
module "wireguard" {
|
||||
source = "./modules/wireguard"
|
||||
tls_secret_name = var.tls_secret_name
|
||||
wg_0_conf = var.wireguard_wg_0_conf
|
||||
wg_0_key = var.wireguard_wg_0_key
|
||||
firewall_sh = var.wireguard_firewall_sh
|
||||
wg_0_conf = data.vault_kv_secret_v2.secrets.data["wireguard_wg_0_conf"]
|
||||
wg_0_key = data.vault_kv_secret_v2.secrets.data["wireguard_wg_0_key"]
|
||||
firewall_sh = data.vault_kv_secret_v2.secrets.data["wireguard_firewall_sh"]
|
||||
tier = local.tiers.core
|
||||
}
|
||||
|
||||
|
|
@ -486,9 +342,9 @@ module "xray" {
|
|||
tls_secret_name = var.tls_secret_name
|
||||
tier = local.tiers.core
|
||||
|
||||
xray_reality_clients = var.xray_reality_clients
|
||||
xray_reality_private_key = var.xray_reality_private_key
|
||||
xray_reality_short_ids = var.xray_reality_short_ids
|
||||
xray_reality_clients = local.xray_reality_clients
|
||||
xray_reality_private_key = data.vault_kv_secret_v2.secrets.data["xray_reality_private_key"]
|
||||
xray_reality_short_ids = local.xray_reality_short_ids
|
||||
}
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
|
|
@ -499,11 +355,11 @@ module "mailserver" {
|
|||
tls_secret_name = var.tls_secret_name
|
||||
nfs_server = var.nfs_server
|
||||
mysql_host = var.mysql_host
|
||||
mailserver_accounts = var.mailserver_accounts
|
||||
postfix_account_aliases = var.mailserver_aliases
|
||||
opendkim_key = var.mailserver_opendkim_key
|
||||
sasl_passwd = var.mailserver_sasl_passwd
|
||||
roundcube_db_password = var.mailserver_roundcubemail_db_password
|
||||
mailserver_accounts = local.mailserver_accounts
|
||||
postfix_account_aliases = local.mailserver_aliases
|
||||
opendkim_key = local.mailserver_opendkim_key
|
||||
sasl_passwd = local.mailserver_sasl_passwd
|
||||
roundcube_db_password = data.vault_kv_secret_v2.secrets.data["mailserver_roundcubemail_db_password"]
|
||||
tier = local.tiers.edge
|
||||
}
|
||||
|
||||
|
|
@ -515,7 +371,7 @@ module "cloudflared" {
|
|||
tier = local.tiers.core
|
||||
tls_secret_name = var.tls_secret_name
|
||||
|
||||
cloudflare_api_key = var.cloudflare_api_key
|
||||
cloudflare_api_key = data.vault_kv_secret_v2.secrets.data["cloudflare_api_key"]
|
||||
cloudflare_email = var.cloudflare_email
|
||||
cloudflare_account_id = var.cloudflare_account_id
|
||||
cloudflare_zone_id = var.cloudflare_zone_id
|
||||
|
|
@ -523,7 +379,7 @@ module "cloudflared" {
|
|||
public_ip = var.public_ip
|
||||
cloudflare_proxied_names = var.cloudflare_proxied_names
|
||||
cloudflare_non_proxied_names = var.cloudflare_non_proxied_names
|
||||
cloudflare_tunnel_token = var.cloudflare_tunnel_token
|
||||
cloudflare_tunnel_token = data.vault_kv_secret_v2.secrets.data["cloudflare_tunnel_token"]
|
||||
}
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
|
|
@ -532,10 +388,10 @@ module "cloudflared" {
|
|||
module "infra-maintenance" {
|
||||
source = "./modules/infra-maintenance"
|
||||
nfs_server = var.nfs_server
|
||||
git_user = var.webhook_handler_git_user
|
||||
git_token = var.webhook_handler_git_token
|
||||
technitium_username = var.technitium_username
|
||||
technitium_password = var.technitium_password
|
||||
git_user = data.vault_kv_secret_v2.secrets.data["webhook_handler_git_user"]
|
||||
git_token = data.vault_kv_secret_v2.secrets.data["webhook_handler_git_token"]
|
||||
technitium_username = data.vault_kv_secret_v2.secrets.data["technitium_username"]
|
||||
technitium_password = data.vault_kv_secret_v2.secrets.data["technitium_password"]
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
|
|
|
|||
|
|
@ -7,3 +7,8 @@ dependency "infra" {
|
|||
config_path = "../infra"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,10 +2,6 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "plotting_book_session_secret" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "plotting_book_google_client_id" {
|
||||
type = string
|
||||
sensitive = true
|
||||
|
|
@ -15,6 +11,10 @@ variable "plotting_book_google_client_secret" {
|
|||
sensitive = true
|
||||
}
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "plotting-book"
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "plotting-book" {
|
||||
metadata {
|
||||
|
|
@ -92,7 +92,7 @@ resource "kubernetes_deployment" "plotting-book" {
|
|||
image_pull_policy = "Always"
|
||||
env {
|
||||
name = "SESSION_SECRET"
|
||||
value = var.plotting_book_session_secret
|
||||
value = data.vault_kv_secret_v2.secrets.data["session_secret"]
|
||||
}
|
||||
env {
|
||||
name = "GOOGLE_CLIENT_ID"
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,15 +2,19 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "realestate_crawler_db_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "realestate_crawler_notification_settings" { type = map(string) }
|
||||
variable "nfs_server" { type = string }
|
||||
variable "redis_host" { type = string }
|
||||
variable "mysql_host" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "real-estate-crawler"
|
||||
}
|
||||
|
||||
locals {
|
||||
notification_settings = jsondecode(data.vault_kv_secret_v2.secrets.data["notification_settings"])
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_namespace" "realestate-crawler" {
|
||||
metadata {
|
||||
|
|
@ -150,7 +154,7 @@ resource "kubernetes_deployment" "realestate-crawler-api" {
|
|||
}
|
||||
env {
|
||||
name = "DB_CONNECTION_STRING"
|
||||
value = "mysql://wrongmove:${var.realestate_crawler_db_password}@${var.mysql_host}:3306/wrongmove"
|
||||
value = "mysql://wrongmove:${data.vault_kv_secret_v2.secrets.data["db_password"]}@${var.mysql_host}:3306/wrongmove"
|
||||
|
||||
}
|
||||
# env {
|
||||
|
|
@ -188,7 +192,7 @@ resource "kubernetes_deployment" "realestate-crawler-api" {
|
|||
}
|
||||
env {
|
||||
name = "SLACK_WEBHOOK_URL"
|
||||
value = var.realestate_crawler_notification_settings["slack"]
|
||||
value = local.notification_settings["slack"]
|
||||
}
|
||||
env {
|
||||
name = "WEBAUTHN_RP_ID"
|
||||
|
|
@ -339,7 +343,7 @@ resource "kubernetes_deployment" "realestate-crawler-celery" {
|
|||
}
|
||||
env {
|
||||
name = "DB_CONNECTION_STRING"
|
||||
value = "mysql://wrongmove:${var.realestate_crawler_db_password}@${var.mysql_host}:3306/wrongmove"
|
||||
value = "mysql://wrongmove:${data.vault_kv_secret_v2.secrets.data["db_password"]}@${var.mysql_host}:3306/wrongmove"
|
||||
}
|
||||
env {
|
||||
name = "CELERY_BROKER_URL"
|
||||
|
|
@ -351,7 +355,7 @@ resource "kubernetes_deployment" "realestate-crawler-celery" {
|
|||
}
|
||||
env {
|
||||
name = "SLACK_WEBHOOK_URL"
|
||||
value = lookup(var.realestate_crawler_notification_settings, "slack", "")
|
||||
value = lookup(local.notification_settings, "slack", "")
|
||||
}
|
||||
env {
|
||||
name = "OSRM_FOOT_URL"
|
||||
|
|
@ -447,7 +451,7 @@ resource "kubernetes_deployment" "realestate-crawler-celery-beat" {
|
|||
}
|
||||
env {
|
||||
name = "DB_CONNECTION_STRING"
|
||||
value = "mysql://wrongmove:${var.realestate_crawler_db_password}@${var.mysql_host}:3306/wrongmove"
|
||||
value = "mysql://wrongmove:${data.vault_kv_secret_v2.secrets.data["db_password"]}@${var.mysql_host}:3306/wrongmove"
|
||||
}
|
||||
env {
|
||||
name = "CELERY_BROKER_URL"
|
||||
|
|
@ -459,7 +463,7 @@ resource "kubernetes_deployment" "realestate-crawler-celery-beat" {
|
|||
}
|
||||
env {
|
||||
name = "SCRAPE_SCHEDULES"
|
||||
value = lookup(var.realestate_crawler_notification_settings, "scrape_schedules", "")
|
||||
value = lookup(local.notification_settings, "scrape_schedules", "")
|
||||
}
|
||||
volume_mount {
|
||||
name = "data"
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -3,18 +3,18 @@ variable "tls_secret_name" {
|
|||
sensitive = true
|
||||
}
|
||||
variable "resume_database_url" { type = string }
|
||||
variable "resume_auth_secret" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "mailserver_accounts" { type = map(any) }
|
||||
variable "nfs_server" { type = string }
|
||||
variable "mail_host" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "resume"
|
||||
}
|
||||
|
||||
locals {
|
||||
namespace = "resume"
|
||||
app_url = "https://resume.viktorbarzin.me"
|
||||
namespace = "resume"
|
||||
app_url = "https://resume.viktorbarzin.me"
|
||||
mailserver_accounts = jsondecode(data.vault_kv_secret_v2.secrets.data["mailserver_accounts"])
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "resume" {
|
||||
|
|
@ -186,7 +186,7 @@ resource "kubernetes_deployment" "resume" {
|
|||
}
|
||||
env {
|
||||
name = "AUTH_SECRET"
|
||||
value = var.resume_auth_secret
|
||||
value = data.vault_kv_secret_v2.secrets.data["auth_secret"]
|
||||
}
|
||||
|
||||
# Server config
|
||||
|
|
@ -210,7 +210,7 @@ resource "kubernetes_deployment" "resume" {
|
|||
}
|
||||
env {
|
||||
name = "SMTP_PASS"
|
||||
value = var.mailserver_accounts["info@viktorbarzin.me"]
|
||||
value = local.mailserver_accounts["info@viktorbarzin.me"]
|
||||
}
|
||||
env {
|
||||
name = "SMTP_FROM"
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,17 +2,13 @@ variable "tls_secret_name" {
|
|||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "clickhouse_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "clickhouse_postgres_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
variable "nfs_server" { type = string }
|
||||
variable "postgresql_host" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "rybbit"
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "rybbit" {
|
||||
metadata {
|
||||
|
|
@ -82,7 +78,7 @@ resource "kubernetes_deployment" "clickhouse" {
|
|||
}
|
||||
env {
|
||||
name = "CLICKHOUSE_PASSWORD"
|
||||
value = var.clickhouse_password
|
||||
value = data.vault_kv_secret_v2.secrets.data["clickhouse_password"]
|
||||
}
|
||||
port {
|
||||
name = "clickhouse"
|
||||
|
|
@ -180,12 +176,12 @@ resource "kubernetes_cron_job_v1" "clickhouse_truncate_logs" {
|
|||
command = [
|
||||
"sh", "-c",
|
||||
join(" && ", [
|
||||
"curl -s 'http://clickhouse.rybbit.svc.cluster.local:8123/?user=default&password=${var.clickhouse_password}' -d 'TRUNCATE TABLE IF EXISTS system.metric_log'",
|
||||
"curl -s 'http://clickhouse.rybbit.svc.cluster.local:8123/?user=default&password=${var.clickhouse_password}' -d 'TRUNCATE TABLE IF EXISTS system.trace_log'",
|
||||
"curl -s 'http://clickhouse.rybbit.svc.cluster.local:8123/?user=default&password=${var.clickhouse_password}' -d 'TRUNCATE TABLE IF EXISTS system.text_log'",
|
||||
"curl -s 'http://clickhouse.rybbit.svc.cluster.local:8123/?user=default&password=${var.clickhouse_password}' -d 'TRUNCATE TABLE IF EXISTS system.asynchronous_metric_log'",
|
||||
"curl -s 'http://clickhouse.rybbit.svc.cluster.local:8123/?user=default&password=${var.clickhouse_password}' -d 'TRUNCATE TABLE IF EXISTS system.query_log'",
|
||||
"curl -s 'http://clickhouse.rybbit.svc.cluster.local:8123/?user=default&password=${var.clickhouse_password}' -d 'TRUNCATE TABLE IF EXISTS system.part_log'",
|
||||
"curl -s 'http://clickhouse.rybbit.svc.cluster.local:8123/?user=default&password=${data.vault_kv_secret_v2.secrets.data["clickhouse_password"]}' -d 'TRUNCATE TABLE IF EXISTS system.metric_log'",
|
||||
"curl -s 'http://clickhouse.rybbit.svc.cluster.local:8123/?user=default&password=${data.vault_kv_secret_v2.secrets.data["clickhouse_password"]}' -d 'TRUNCATE TABLE IF EXISTS system.trace_log'",
|
||||
"curl -s 'http://clickhouse.rybbit.svc.cluster.local:8123/?user=default&password=${data.vault_kv_secret_v2.secrets.data["clickhouse_password"]}' -d 'TRUNCATE TABLE IF EXISTS system.text_log'",
|
||||
"curl -s 'http://clickhouse.rybbit.svc.cluster.local:8123/?user=default&password=${data.vault_kv_secret_v2.secrets.data["clickhouse_password"]}' -d 'TRUNCATE TABLE IF EXISTS system.asynchronous_metric_log'",
|
||||
"curl -s 'http://clickhouse.rybbit.svc.cluster.local:8123/?user=default&password=${data.vault_kv_secret_v2.secrets.data["clickhouse_password"]}' -d 'TRUNCATE TABLE IF EXISTS system.query_log'",
|
||||
"curl -s 'http://clickhouse.rybbit.svc.cluster.local:8123/?user=default&password=${data.vault_kv_secret_v2.secrets.data["clickhouse_password"]}' -d 'TRUNCATE TABLE IF EXISTS system.part_log'",
|
||||
"echo 'System logs truncated'"
|
||||
])
|
||||
]
|
||||
|
|
@ -242,7 +238,7 @@ resource "kubernetes_deployment" "rybbit" {
|
|||
}
|
||||
env {
|
||||
name = "CLICKHOUSE_PASSWORD"
|
||||
value = var.clickhouse_password
|
||||
value = data.vault_kv_secret_v2.secrets.data["clickhouse_password"]
|
||||
}
|
||||
env {
|
||||
name = "POSTGRES_HOST"
|
||||
|
|
@ -262,7 +258,7 @@ resource "kubernetes_deployment" "rybbit" {
|
|||
}
|
||||
env {
|
||||
name = "POSTGRES_PASSWORD"
|
||||
value = var.clickhouse_postgres_password
|
||||
value = data.vault_kv_secret_v2.secrets.data["postgres_password"]
|
||||
}
|
||||
env {
|
||||
name = "BASE_URL"
|
||||
|
|
|
|||
|
|
@ -6,3 +6,8 @@ dependency "platform" {
|
|||
config_path = "../platform"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
||||
dependency "vault" {
|
||||
config_path = "../vault"
|
||||
skip_outputs = true
|
||||
}
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Add a link
Reference in a new issue