viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip]

Browse source 
6d224861 came from a --no-checkout worktree whose empty index made the
commit drop every file except two. This restores 05b50d2b's full tree and
correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su
entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the
live infra was never applied from the broken commit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin 2026-06-09 08:45:33 +00:00
parent 6d224861c4
commit fd0f4a0365
1166 changed files with 358546 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

257
stacks/netbox/main.tf Normal file
View file

@ -0,0 +1,257 @@
variable "tls_secret_name" {
type = string
sensitive = true
}
variable "nfs_server" { type = string }
variable "redis_host" { type = string }
variable "postgresql_host" { type = string }
resource "kubernetes_namespace" "netbox" {
metadata {
name = "netbox"
labels = {
tier = local.tiers.aux
"keel.sh/enrolled" = "true"
}
}
lifecycle {
# KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
}
}
resource "kubernetes_manifest" "external_secret" {
manifest = {
apiVersion = "external-secrets.io/v1beta1"
kind = "ExternalSecret"
metadata = {
name = "netbox-secrets"
namespace = "netbox"
}
spec = {
refreshInterval = "15m"
secretStoreRef = {
name = "vault-kv"
kind = "ClusterSecretStore"
}
target = {
name = "netbox-secrets"
}
dataFrom = [{
extract = {
key = "netbox"
}
}]
}
}
depends_on = [kubernetes_namespace.netbox]
}
module "tls_secret" {
source = "../../modules/kubernetes/setup_tls_secret"
namespace = kubernetes_namespace.netbox.metadata[0].name
tls_secret_name = var.tls_secret_name
}
resource "random_string" "random" {
length = 50
lower = true
}
resource "random_string" "api_token_pepper" {
length = 50
lower = true
}
resource "kubernetes_deployment" "netbox" {
metadata {
name = "netbox"
namespace = kubernetes_namespace.netbox.metadata[0].name
labels = {
app = "netbox"
tier = local.tiers.aux
}
annotations = {
"reloader.stakater.com/search" = "true"
}
}
spec {
# Disabled: reduce cluster memory pressure (2026-03-14 OOM incident)
replicas = 0
strategy {
type = "Recreate"
}
selector {
match_labels = {
app = "netbox"
}
}
template {
metadata {
annotations = {
"diun.enable" = "true"
}
labels = {
app = "netbox"
}
}
spec {
container {
image = "netboxcommunity/netbox:v4.5.0-beta1"
name = "netbox"
env {
name = "DB_USER"
value = "netbox"
}
env {
name = "DB_PASSWORD"
value_from {
secret_key_ref {
name = "netbox-secrets"
key = "db_password"
}
}
}
env {
name = "DB_HOST"
value = var.postgresql_host
}
env {
name = "DB_NAME"
value = "netbox"
}
env {
name = "DB_WAIT_DEBUG"
value = "1"
}
env {
name = "SECRET_KEY"
value = random_string.random.result
}
env {
name = "API_TOKEN_PEPPERS"
value = random_string.api_token_pepper.result
}
env {
name = "REDIS_HOST"
value = var.redis_host
}
env {
name = "ALLOWED_HOST"
value = "netbox.viktorbarzin.me"
}
env {
name = "SUPERUSER_EMAIL"
value = "me@viktorbarzin.me"
}
env {
name = "SUPERUSER_PASSWORD"
value_from {
secret_key_ref {
name = "netbox-secrets"
key = "superuser_password"
}
}
}
env {
name = "REMOTE_AUTH_ENABLED"
value = "True"
}
env {
name = "REMOTE_AUTH_AUTO_CREATE_USER"
value = "True"
}
env {
name = "PUID"
value = 1000
}
env {
name = "PGID"
value = 1000
}
env {
name = "TZ"
value = "Europe/Sofia"
}
resources {
requests = {
cpu = "25m"
memory = "256Mi"
}
limits = {
memory = "256Mi"
}
}
port {
container_port = 8080
}
# volume_mount {
# name = "data"
# mount_path = "/books"
# }
}
# volume {
# name = "data"
# nfs {
# path = "/mnt/main/netbox"
# server = var.nfs_server
# }
# }
}
}
}
lifecycle {
ignore_changes = [
spec[0].template[0].spec[0].dns_config, # KYVERNO_LIFECYCLE_V1
metadata[0].annotations["keel.sh/policy"],
metadata[0].annotations["keel.sh/trigger"],
metadata[0].annotations["keel.sh/pollSchedule"], # KYVERNO_LIFECYCLE_V2
metadata[0].annotations["keel.sh/match-tag"],
spec[0].template[0].spec[0].container[0].image, # KEEL_IGNORE_IMAGE — Keel manages tag updates
metadata[0].annotations["kubernetes.io/change-cause"],
metadata[0].annotations["deployment.kubernetes.io/revision"],
spec[0].template[0].metadata[0].annotations["keel.sh/update-time"], # KEEL_LIFECYCLE_V1
]
}
}
resource "kubernetes_service" "netbox" {
metadata {
name = "netbox"
namespace = kubernetes_namespace.netbox.metadata[0].name
labels = {
"app" = "netbox"
}
}
spec {
selector = {
app = "netbox"
}
port {
name = "http"
target_port = 8080
port = 80
protocol = "TCP"
}
}
}
module "ingress" {
source = "../../modules/kubernetes/ingress_factory"
dns_type = "proxied"
namespace = kubernetes_namespace.netbox.metadata[0].name
name = "netbox"
tls_secret_name = var.tls_secret_name
auth = "required"
extra_annotations = {
"gethomepage.dev/enabled" = "true"
"gethomepage.dev/name" = "Netbox"
"gethomepage.dev/description" = "Network documentation"
"gethomepage.dev/icon" = "netbox.png"
"gethomepage.dev/group" = "Infrastructure"
"gethomepage.dev/pod-selector" = ""
}
}
# CI retrigger 2026-05-16T13:42:57+00:00 — bulk enrollment apply (pipeline #689 killed)
# CI retrigger v2 2026-05-16T13:46:35+00:00