[ci skip] Move Terraform modules into stack directories

Move all 88 service modules (66 individual + 22 platform) from
modules/kubernetes/<service>/ into their corresponding stack directories:

- Service stacks: stacks/<service>/module/
- Platform stack: stacks/platform/modules/<service>/

This collocates module source code with its Terragrunt definition.
Only shared utility modules remain in modules/kubernetes/:
ingress_factory, setup_tls_secret, dockerhub_secret, oauth-proxy.

All cross-references to shared modules updated to use correct
relative paths. Verified with terragrunt run --all -- plan:
0 adds, 0 destroys across all 68 stacks.
This commit is contained in:
Viktor Barzin 2026-02-22 14:38:14 +00:00
parent 73cb696f12
commit e225e81ebf
No known key found for this signature in database
GPG key ID: 0EB088298288D958
614 changed files with 12075 additions and 352 deletions

59
stacks/servarr/.terraform.lock.hcl generated Normal file
View file

@ -0,0 +1,59 @@
# This file is maintained automatically by "terraform init".
# Manual edits may be lost in future updates.
provider "registry.terraform.io/hashicorp/helm" {
version = "3.1.1"
hashes = [
"h1:47CqNwkxctJtL/N/JuEj+8QMg8mRNI/NWeKO5/ydfZU=",
"zh:1a6d5ce931708aec29d1f3d9e360c2a0c35ba5a54d03eeaff0ce3ca597cd0275",
"zh:3411919ba2a5941801e677f0fea08bdd0ae22ba3c9ce3309f55554699e06524a",
"zh:81b36138b8f2320dc7f877b50f9e38f4bc614affe68de885d322629dd0d16a29",
"zh:95a2a0a497a6082ee06f95b38bd0f0d6924a65722892a856cfd914c0d117f104",
"zh:9d3e78c2d1bb46508b972210ad706dd8c8b106f8b206ecf096cd211c54f46990",
"zh:a79139abf687387a6efdbbb04289a0a8e7eaca2bd91cdc0ce68ea4f3286c2c34",
"zh:aaa8784be125fbd50c48d84d6e171d3fb6ef84a221dbc5165c067ce05faab4c8",
"zh:afecd301f469975c9d8f350cc482fe656e082b6ab0f677d1a816c3c615837cc1",
"zh:c54c22b18d48ff9053d899d178d9ffef7d9d19785d9bf310a07d648b7aac075b",
"zh:db2eefd55aea48e73384a555c72bac3f7d428e24147bedb64e1a039398e5b903",
"zh:ee61666a233533fd2be971091cecc01650561f1585783c381b6f6e8a390198a4",
"zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
]
}
provider "registry.terraform.io/hashicorp/kubernetes" {
version = "3.0.1"
hashes = [
"h1:P0c8knzZnouTNFIRij8IS7+pqd0OKaFDYX0j4GRsiqo=",
"zh:02d55b0b2238fd17ffa12d5464593864e80f402b90b31f6e1bd02249b9727281",
"zh:20b93a51bfeed82682b3c12f09bac3031f5bdb4977c47c97a042e4df4fb2f9ba",
"zh:6e14486ecfaee38c09ccf33d4fdaf791409f90795c1b66e026c226fad8bc03c7",
"zh:8d0656ff422df94575668e32c310980193fccb1c28117e5c78dd2d4050a760a6",
"zh:9795119b30ec0c1baa99a79abace56ac850b6e6fbce60e7f6067792f6eb4b5f4",
"zh:b388c87acc40f6bd9620f4e23f01f3c7b41d9b88a68d5255dec0a72f0bdec249",
"zh:b59abd0a980649c2f97f172392f080eaeb18e486b603f83bf95f5d93aeccc090",
"zh:ba6e3060fddf4a022087d8f09e38aa0001c705f21170c2ded3d1c26c12f70d97",
"zh:c12626d044b1d5501cf95ca78cbe507c13ad1dd9f12d4736df66eb8e5f336eb8",
"zh:c55203240d50f4cdeb3df1e1760630d677679f5b1a6ffd9eba23662a4ad05119",
"zh:ea206a5a32d6e0d6e32f1849ad703da9a28355d9c516282a8458b5cf1502b2a1",
"zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
]
}
provider "registry.terraform.io/hashicorp/random" {
version = "3.8.1"
hashes = [
"h1:u8AKlWVDTH5r9YLSeswoVEjiY72Rt4/ch7U+61ZDkiQ=",
"zh:08dd03b918c7b55713026037c5400c48af5b9f468f483463321bd18e17b907b4",
"zh:0eee654a5542dc1d41920bbf2419032d6f0d5625b03bd81339e5b33394a3e0ae",
"zh:229665ddf060aa0ed315597908483eee5b818a17d09b6417a0f52fd9405c4f57",
"zh:2469d2e48f28076254a2a3fc327f184914566d9e40c5780b8d96ebf7205f8bc0",
"zh:37d7eb334d9561f335e748280f5535a384a88675af9a9eac439d4cfd663bcb66",
"zh:741101426a2f2c52dee37122f0f4a2f2d6af6d852cb1db634480a86398fa3511",
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
"zh:a902473f08ef8df62cfe6116bd6c157070a93f66622384300de235a533e9d4a9",
"zh:b85c511a23e57a2147355932b3b6dce2a11e856b941165793a0c3d7578d94d05",
"zh:c5172226d18eaac95b1daac80172287b69d4ce32750c82ad77fa0768be4ea4b8",
"zh:dab4434dba34aad569b0bc243c2d3f3ff86dd7740def373f2a49816bd2ff819b",
"zh:f49fd62aa8c5525a5c17abd51e27ca5e213881d58882fd42fec4a545b53c9699",
]
}

View file

@ -0,0 +1,6 @@
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
terraform {
backend "local" {
path = "/Users/viktorbarzin/code/infra/state/stacks/servarr/terraform.tfstate"
}
}

View file

@ -12,7 +12,7 @@ locals {
}
module "servarr" {
source = "../../modules/kubernetes/servarr"
source = "./module"
tls_secret_name = var.tls_secret_name
tier = local.tiers.aux
aiostreams_database_connection_string = var.aiostreams_database_connection_string

View file

@ -0,0 +1,103 @@
variable "tls_secret_name" {}
variable "tier" { type = string }
variable "aiostreams_database_connection_string" { type = string }
resource "kubernetes_namespace" "aiostreams" {
metadata {
name = "aiostreams"
labels = {
"istio-injection" : "disabled"
}
}
}
resource "random_id" "secret_key" {
byte_length = 32 # 32 bytes × 2 hex chars = 64 hex characters
}
resource "kubernetes_deployment" "aiostreams" {
metadata {
name = "aiostreams"
namespace = kubernetes_namespace.aiostreams.metadata[0].name
labels = {
app = "aiostreams"
tier = var.tier
}
}
spec {
replicas = 1
selector {
match_labels = {
app = "aiostreams"
}
}
template {
metadata {
labels = {
app = "aiostreams"
}
}
spec {
container {
image = "viren070/aiostreams:nightly"
name = "aiostreams"
port {
container_port = 3000
}
env {
name = "BASE_URL"
value = "https://aiostreams.viktorbarzin.me"
}
env {
name = "SECRET_KEY"
value = random_id.secret_key.hex
}
env {
name = "DATABASE_URI"
value = var.aiostreams_database_connection_string
}
volume_mount {
name = "data"
mount_path = "/app/data"
}
}
volume {
name = "data"
nfs {
server = "10.0.10.15"
path = "/mnt/main/servarr/aiostreams"
}
}
}
}
}
}
resource "kubernetes_service" "aiostreams" {
metadata {
name = "aiostreams"
namespace = kubernetes_namespace.aiostreams.metadata[0].name
labels = {
"app" = "aiostreams"
}
}
spec {
selector = {
app = "aiostreams"
}
port {
name = "http"
port = 80
target_port = 3000
}
}
}
module "ingress" {
source = "../../../../modules/kubernetes/ingress_factory"
namespace = kubernetes_namespace.aiostreams.metadata[0].name
name = "aiostreams"
tls_secret_name = var.tls_secret_name
# protected = true
}

View file

@ -0,0 +1,74 @@
variable "tls_secret_name" {}
variable "tier" { type = string }
resource "kubernetes_deployment" "flaresolverr" {
metadata {
name = "flaresolverr"
namespace = "servarr"
labels = {
app = "flaresolverr"
tier = var.tier
}
annotations = {
"reloader.stakater.com/search" = "true"
}
}
spec {
replicas = 1
selector {
match_labels = {
app = "flaresolverr"
}
}
template {
metadata {
labels = {
app = "flaresolverr"
}
}
spec {
container {
image = "ghcr.io/flaresolverr/flaresolverr:latest"
name = "flaresolverr"
port {
container_port = 8191
}
}
}
}
}
}
resource "kubernetes_service" "flaresolverr" {
metadata {
name = "flaresolverr"
namespace = "servarr"
labels = {
app = "flaresolverr"
}
}
spec {
selector = {
app = "flaresolverr"
}
port {
name = "http"
target_port = 8191
port = 80
}
}
}
module "ingress" {
source = "../../../../modules/kubernetes/ingress_factory"
namespace = "servarr"
name = "flaresolverr"
tls_secret_name = var.tls_secret_name
protected = true
# extra_annotations = {
# "nginx.ingress.kubernetes.io/proxy-body-size" : "1G" // allow uploading .torrent files
# }
}

View file

@ -0,0 +1,163 @@
variable "tls_secret_name" {}
variable "tier" { type = string }
resource "kubernetes_deployment" "lidarr" {
metadata {
name = "lidarr"
namespace = "servarr"
labels = {
app = "lidarr"
tier = var.tier
}
annotations = {
"reloader.stakater.com/search" = "true"
}
}
spec {
replicas = 1
selector {
match_labels = {
app = "lidarr"
}
}
template {
metadata {
labels = {
app = "lidarr"
}
}
spec {
container {
image = "lscr.io/linuxserver/lidarr:latest"
# image = "youegraillot/lidarr-on-steroids"
name = "lidarr"
port {
name = "lidarr"
container_port = 8686
}
port {
name = "deemix"
container_port = 6595
}
env {
name = "PUID"
value = 1000
}
env {
name = "PGID"
value = 1000
}
env {
name = "TZ"
value = "Etc/UTC"
}
volume_mount {
name = "data"
mount_path = "/config"
}
volume_mount {
name = "downloads"
mount_path = "/downloads"
}
volume_mount {
name = "data"
mount_path = "/music"
sub_path = "music"
}
volume_mount {
name = "deemix-config"
mount_path = "/config_deemix"
sub_path = "deemix"
}
}
volume {
name = "data"
nfs {
path = "/mnt/main/servarr/lidarr"
server = "10.0.10.15"
}
}
volume {
name = "downloads"
nfs {
path = "/mnt/main/servarr/downloads"
server = "10.0.10.15"
}
}
volume {
name = "deemix-config"
nfs {
path = "/mnt/main/servarr/lidarr"
server = "10.0.10.15"
}
}
}
}
}
}
resource "kubernetes_service" "lidarr" {
metadata {
name = "lidarr"
namespace = "servarr"
labels = {
app = "lidarr"
}
}
spec {
selector = {
app = "lidarr"
}
port {
name = "http"
port = 80
target_port = 8686
}
}
}
resource "kubernetes_service" "deemix" {
metadata {
name = "deemix"
namespace = "servarr"
labels = {
app = "deemix"
}
}
spec {
selector = {
app = "lidarr"
}
port {
name = "deemix"
port = 80
target_port = 6595
}
}
}
module "ingress" {
source = "../../../../modules/kubernetes/ingress_factory"
namespace = "servarr"
name = "lidarr"
tls_secret_name = var.tls_secret_name
protected = true
# extra_annotations = {
# "nginx.ingress.kubernetes.io/proxy-body-size" : "1G" // allow uploading .torrent files
# }
}
module "ingress-deemix" {
source = "../../../../modules/kubernetes/ingress_factory"
namespace = "servarr"
name = "deemix"
tls_secret_name = var.tls_secret_name
protected = true
}

View file

@ -0,0 +1,90 @@
variable "tls_secret_name" {}
variable "tier" { type = string }
resource "kubernetes_deployment" "listenarr" {
metadata {
name = "listenarr"
namespace = "servarr"
labels = {
app = "listenarr"
tier = var.tier
}
annotations = {
"reloader.stakater.com/search" = "true"
}
}
spec {
replicas = 1
selector {
match_labels = {
app = "listenarr"
}
}
template {
metadata {
labels = {
app = "listenarr"
}
}
spec {
container {
image = "ghcr.io/therobbiedavis/listenarr:canary"
name = "listenarr"
port {
container_port = 5000
}
volume_mount {
name = "data"
mount_path = "/app/config"
}
}
volume {
name = "data"
nfs {
path = "/mnt/main/servarr/listenarr"
server = "10.0.10.15"
}
}
volume {
name = "downloads"
nfs {
path = "/mnt/main/servarr/downloads"
server = "10.0.10.15"
}
}
}
}
}
}
resource "kubernetes_service" "listenarr" {
metadata {
name = "listenarr"
namespace = "servarr"
labels = {
app = "listenarr"
}
}
spec {
selector = {
app = "listenarr"
}
port {
name = "http"
port = 80
target_port = 5000
}
}
}
module "ingress" {
source = "../../../../modules/kubernetes/ingress_factory"
namespace = "servarr"
name = "listenarr"
tls_secret_name = var.tls_secret_name
protected = true
}

View file

@ -0,0 +1,68 @@
variable "tls_secret_name" {}
variable "tier" { type = string }
variable "aiostreams_database_connection_string" { type = string }
resource "kubernetes_namespace" "servarr" {
metadata {
name = "servarr"
labels = {
tier = var.tier
}
}
}
module "tls_secret" {
source = "../../../modules/kubernetes/setup_tls_secret"
namespace = kubernetes_namespace.servarr.metadata[0].name
tls_secret_name = var.tls_secret_name
}
# module "readarr" {
# source = "./readarr"
# tls_secret_name = var.tls_secret_name
# tier = var.tier
# }
module "prowlarr" {
source = "./prowlarr"
tls_secret_name = var.tls_secret_name
tier = var.tier
}
module "qbittorrent" {
source = "./qbittorrent"
tls_secret_name = var.tls_secret_name
tier = var.tier
}
module "flaresolverr" {
source = "./flaresolverr"
tls_secret_name = var.tls_secret_name
tier = var.tier
}
# module "lidarr" {
# source = "./lidarr"
# tls_secret_name = var.tls_secret_name
# tier = var.tier
# }
# module "soulseek" {
# source = "./soulseek"
# tls_secret_name = var.tls_secret_name
# tier = var.tier
# }
module "listenarr" {
source = "./listenarr"
tls_secret_name = var.tls_secret_name
tier = var.tier
}
module "aiostreams" {
source = "./aiostreams"
tls_secret_name = var.tls_secret_name
aiostreams_database_connection_string = var.aiostreams_database_connection_string
tier = var.tier
}

View file

@ -0,0 +1,110 @@
variable "tls_secret_name" {}
variable "tier" { type = string }
resource "kubernetes_deployment" "prowlarr" {
metadata {
name = "prowlarr"
namespace = "servarr"
labels = {
app = "prowlarr"
tier = var.tier
}
annotations = {
"reloader.stakater.com/search" = "true"
}
}
spec {
replicas = 1
selector {
match_labels = {
app = "prowlarr"
}
}
template {
metadata {
labels = {
app = "prowlarr"
}
}
spec {
container {
image = "lscr.io/linuxserver/prowlarr:latest"
name = "prowlarr"
port {
container_port = 9696
}
env {
name = "PUID"
value = 1000
}
env {
name = "PGID"
value = 1000
}
env {
name = "TZ"
value = "Etc/UTC"
}
volume_mount {
name = "data"
mount_path = "/config"
}
volume_mount {
name = "data"
mount_path = "/books"
}
volume_mount {
name = "downloads"
mount_path = "/downloads"
}
}
volume {
name = "data"
nfs {
path = "/mnt/main/servarr/prowlarr"
server = "10.0.10.15"
}
}
volume {
name = "downloads"
nfs {
path = "/mnt/main/servarr/downloads"
server = "10.0.10.15"
}
}
}
}
}
}
resource "kubernetes_service" "prowlarr" {
metadata {
name = "prowlarr"
namespace = "servarr"
labels = {
app = "prowlarr"
}
}
spec {
selector = {
app = "prowlarr"
}
port {
name = "http"
port = 80
target_port = 9696
}
}
}
module "ingress" {
source = "../../../../modules/kubernetes/ingress_factory"
namespace = "servarr"
name = "prowlarr"
tls_secret_name = var.tls_secret_name
protected = true
}

View file

@ -0,0 +1,143 @@
variable "tls_secret_name" {}
variable "tier" { type = string }
resource "kubernetes_deployment" "qbittorrent" {
metadata {
name = "qbittorrent"
namespace = "servarr"
labels = {
app = "qbittorrent"
tier = var.tier
}
annotations = {
"reloader.stakater.com/search" = "true"
}
}
spec {
replicas = 1
selector {
match_labels = {
app = "qbittorrent"
}
}
template {
metadata {
labels = {
app = "qbittorrent"
}
}
spec {
container {
image = "lscr.io/linuxserver/qbittorrent:latest"
name = "qbittorrent"
port {
container_port = 8787
}
env {
name = "PUID"
value = 1000
}
env {
name = "PGID"
value = 1000
}
env {
name = "WEBUI_PORT"
value = 8080
}
env {
name = "TORRENTING_PORT"
value = 6881
}
volume_mount {
name = "data"
mount_path = "/config"
}
volume_mount {
name = "downloads"
mount_path = "/downloads"
}
}
volume {
name = "data"
nfs {
path = "/mnt/main/servarr/qbittorrent"
server = "10.0.10.15"
}
}
volume {
name = "downloads"
nfs {
path = "/mnt/main/servarr/downloads"
server = "10.0.10.15"
}
}
}
}
}
}
resource "kubernetes_service" "qbittorrent" {
metadata {
name = "qbittorrent"
namespace = "servarr"
labels = {
app = "qbittorrent"
}
}
spec {
selector = {
app = "qbittorrent"
}
port {
name = "http"
port = 80
target_port = 8080
}
}
}
resource "kubernetes_service" "qbittorrent-torrenting" {
metadata {
name = "qbittorrent-torrenting"
namespace = "servarr"
labels = {
app = "qbittorrent-torrenting"
}
annotations = {
"metallb.universe.tf/allow-shared-ip" = "shared"
}
}
spec {
type = "LoadBalancer"
external_traffic_policy = "Cluster"
selector = {
app = "qbittorrent"
}
port {
name = "torrenting"
port = 6881
target_port = 6881
}
port {
name = "torrenting-udp"
port = 6881
protocol = "UDP"
target_port = 6881
}
}
}
module "ingress" {
source = "../../../../modules/kubernetes/ingress_factory"
namespace = "servarr"
name = "qbittorrent"
tls_secret_name = var.tls_secret_name
protected = true
}

View file

@ -0,0 +1,128 @@
variable "tls_secret_name" {}
variable "tier" { type = string }
resource "kubernetes_namespace" "readarr" {
metadata {
name = "readarr"
# labels = {
# "istio-injection" : "enabled"
# }
}
}
module "tls_secret" {
source = "../../../../modules/kubernetes/setup_tls_secret"
namespace = "readarr"
tls_secret_name = var.tls_secret_name
}
resource "kubernetes_deployment" "readarr" {
metadata {
name = "readarr"
namespace = "readarr"
labels = {
app = "readarr"
tier = var.tier
}
annotations = {
"reloader.stakater.com/search" = "true"
}
}
spec {
replicas = 1
selector {
match_labels = {
app = "readarr"
}
}
template {
metadata {
labels = {
app = "readarr"
}
}
spec {
container {
image = "lscr.io/linuxserver/readarr:develop"
name = "readarr"
port {
container_port = 8787
}
env {
name = "PUID"
value = 1000
}
env {
name = "PGID"
value = 1000
}
env {
name = "TZ"
value = "Etc/UTC"
}
volume_mount {
name = "data"
mount_path = "/config"
}
volume_mount {
name = "data"
mount_path = "/books"
}
volume_mount {
name = "data"
mount_path = "/downloads"
}
volume_mount {
name = "qbittorrent"
mount_path = "/mnt"
read_only = true
}
}
volume {
name = "data"
nfs {
path = "/mnt/main/servarr/readarr"
server = "10.0.10.15"
}
}
volume {
name = "qbittorrent"
nfs {
path = "/mnt/main/servarr/qbittorrent"
server = "10.0.10.15"
}
}
}
}
}
}
resource "kubernetes_service" "readarr" {
metadata {
name = "readarr"
namespace = "readarr"
labels = {
app = "readarr"
}
}
spec {
selector = {
app = "readarr"
}
port {
name = "http"
port = 8787
}
}
}
module "ingress" {
source = "../../../../modules/kubernetes/ingress_factory"
namespace = "readarr"
name = "readarr"
port = 8787
tls_secret_name = var.tls_secret_name
protected = true
}

View file

@ -0,0 +1,105 @@
variable "tls_secret_name" {}
variable "tier" { type = string }
resource "kubernetes_deployment" "soulseek" {
metadata {
name = "soulseek"
namespace = "servarr"
labels = {
app = "soulseek"
tier = var.tier
}
annotations = {
"reloader.stakater.com/search" = "true"
}
}
spec {
replicas = 1
selector {
match_labels = {
app = "soulseek"
}
}
template {
metadata {
labels = {
app = "soulseek"
}
}
spec {
container {
image = "realies/soulseek"
name = "soulseek"
port {
name = "soulseek"
container_port = 6080
}
env {
name = "PUID"
value = 1000
}
env {
name = "PGID"
value = 1000
}
volume_mount {
name = "config"
mount_path = "/data/.SoulseekQt"
sub_path = "soulseek/config"
}
volume_mount {
name = "downloads"
mount_path = "/data/Soulseek Downloads"
sub_path = "soulseek/downloads"
}
}
volume {
name = "config"
nfs {
path = "/mnt/main/servarr/lidarr"
server = "10.0.10.15"
}
}
volume {
name = "downloads"
nfs {
path = "/mnt/main/servarr/lidarr"
server = "10.0.10.15"
}
}
}
}
}
}
resource "kubernetes_service" "soulseek" {
metadata {
name = "soulseek"
namespace = "servarr"
labels = {
app = "soulseek"
}
}
spec {
selector = {
app = "soulseek"
}
port {
name = "http"
port = 80
target_port = 6080
}
}
}
module "ingress" {
source = "../../../../modules/kubernetes/ingress_factory"
namespace = "servarr"
name = "soulseek"
tls_secret_name = var.tls_secret_name
protected = true
}

View file

@ -0,0 +1,15 @@
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
variable "kube_config_path" {
type = string
default = "~/.kube/config"
}
provider "kubernetes" {
config_path = var.kube_config_path
}
provider "helm" {
kubernetes = {
config_path = var.kube_config_path
}
}

1
stacks/servarr/secrets Symbolic link
View file

@ -0,0 +1 @@
../../secrets