fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip]
6d224861 came from a --no-checkout worktree whose empty index made the
commit drop every file except two. This restores 05b50d2b's full tree and
correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su
entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the
live infra was never applied from the broken commit.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>This commit is contained in:
Viktor Barzin
parent
6d224861c4
commit
fd0f4a0365
1166 changed files with 358546 additions and 0 deletions
17
stacks/reverse-proxy/main.tf
Normal file
17
stacks/reverse-proxy/main.tf
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
variable "tls_secret_name" { type = string }
|
||||
|
||||
data "vault_kv_secret_v2" "secrets" {
|
||||
mount = "secret"
|
||||
name = "platform"
|
||||
}
|
||||
|
||||
locals {
|
||||
homepage_credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["homepage_credentials"])
|
||||
}
|
||||
|
||||
module "reverse-proxy" {
|
||||
source = "./modules/reverse_proxy"
|
||||
tls_secret_name = var.tls_secret_name
|
||||
pfsense_homepage_token = local.homepage_credentials["reverse_proxy"]["pfsense_token"]
|
||||
haos_homepage_token = try(local.homepage_credentials["home_assistant"]["token"], "")
|
||||
}
|
||||
309
stacks/reverse-proxy/modules/reverse_proxy/factory/main.tf
Normal file
309
stacks/reverse-proxy/modules/reverse_proxy/factory/main.tf
Normal file
|
|
@ -0,0 +1,309 @@
|
|||
terraform {
|
||||
required_providers {
|
||||
cloudflare = {
|
||||
source = "cloudflare/cloudflare"
|
||||
version = "~> 4"
|
||||
}
|
||||
kubernetes = {
|
||||
source = "hashicorp/kubernetes"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
variable "name" {}
|
||||
variable "namespace" {
|
||||
default = "reverse-proxy"
|
||||
}
|
||||
variable "external_name" {
|
||||
type = string
|
||||
default = null
|
||||
description = "DNS name for ExternalName Service. Mutually exclusive with backend_ip."
|
||||
}
|
||||
variable "backend_ip" {
|
||||
type = string
|
||||
default = null
|
||||
description = "IP address backend. When set, creates a selector-less Service + EndpointSlice pointing at this IP. Mutually exclusive with external_name — use for hosts that aren't in Technitium (e.g. upstream gateways)."
|
||||
}
|
||||
variable "port" {
|
||||
default = "80"
|
||||
}
|
||||
variable "tls_secret_name" {}
|
||||
variable "backend_protocol" {
|
||||
default = "HTTP"
|
||||
}
|
||||
variable "protected" {
|
||||
type = bool
|
||||
default = true
|
||||
}
|
||||
variable "ingress_path" {
|
||||
type = list(string)
|
||||
default = ["/"]
|
||||
}
|
||||
variable "max_body_size" {
|
||||
type = string
|
||||
default = "50m"
|
||||
}
|
||||
variable "extra_annotations" {
|
||||
default = {}
|
||||
}
|
||||
variable "custom_content_security_policy" {
|
||||
default = null
|
||||
type = string
|
||||
}
|
||||
variable "strip_auth_headers" {
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
variable "extra_middlewares" {
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
variable "skip_global_rate_limit" {
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
variable "dns_type" {
|
||||
type = string
|
||||
default = "none"
|
||||
description = "Cloudflare DNS: 'proxied' (CNAME to tunnel), 'non-proxied' (A/AAAA to public IP), or 'none'"
|
||||
validation {
|
||||
condition = contains(["proxied", "non-proxied", "none"], var.dns_type)
|
||||
error_message = "dns_type must be 'proxied', 'non-proxied', or 'none'."
|
||||
}
|
||||
}
|
||||
|
||||
# Uptime Kuma external monitor: when true, annotate the ingress so the
|
||||
# external-monitor-sync CronJob creates a `[External] <name>` monitor pointing
|
||||
# at https://<host>. Null means "follow dns_type" — enabled when proxied.
|
||||
variable "external_monitor" {
|
||||
type = bool
|
||||
default = null
|
||||
description = "Enable Uptime Kuma external monitor. null = auto (enabled when dns_type == 'proxied')."
|
||||
}
|
||||
|
||||
variable "external_monitor_name" {
|
||||
type = string
|
||||
default = null
|
||||
description = "Override the monitor label. Defaults to the ingress hostname label."
|
||||
}
|
||||
variable "cloudflare_zone_id" {
|
||||
type = string
|
||||
default = "fd2c5dd4efe8fe38958944e74d0ced6d"
|
||||
}
|
||||
variable "cloudflare_tunnel_id" {
|
||||
type = string
|
||||
default = "75182cd7-bb91-4310-b961-5d8967da8b41"
|
||||
}
|
||||
variable "public_ip" {
|
||||
type = string
|
||||
default = "176.12.22.76"
|
||||
}
|
||||
variable "public_ipv6" {
|
||||
type = string
|
||||
default = "2001:470:6e:43d::2"
|
||||
}
|
||||
|
||||
|
||||
locals {
|
||||
use_backend_ip = var.backend_ip != null
|
||||
port_name = var.backend_protocol == "HTTPS" ? "https-${var.name}" : "${var.name}-web"
|
||||
}
|
||||
|
||||
# ExternalName flavor — used when the backend is addressable by DNS.
|
||||
resource "kubernetes_service" "proxied-service" {
|
||||
count = local.use_backend_ip ? 0 : 1
|
||||
metadata {
|
||||
name = var.name
|
||||
namespace = var.namespace
|
||||
labels = {
|
||||
"app" = var.name
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
type = "ExternalName"
|
||||
external_name = var.external_name
|
||||
|
||||
port {
|
||||
name = local.port_name
|
||||
port = var.port
|
||||
protocol = "TCP"
|
||||
target_port = var.port
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# IP-backend flavor — selector-less Service + manually-managed EndpointSlice.
|
||||
# Used for upstreams that have no DNS entry in Technitium (e.g. 192.168.1.1).
|
||||
resource "kubernetes_service" "ip-backend-service" {
|
||||
count = local.use_backend_ip ? 1 : 0
|
||||
metadata {
|
||||
name = var.name
|
||||
namespace = var.namespace
|
||||
labels = {
|
||||
"app" = var.name
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
type = "ClusterIP"
|
||||
port {
|
||||
name = local.port_name
|
||||
port = var.port
|
||||
protocol = "TCP"
|
||||
target_port = var.port
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_manifest" "ip_backend_endpointslice" {
|
||||
count = local.use_backend_ip ? 1 : 0
|
||||
manifest = {
|
||||
apiVersion = "discovery.k8s.io/v1"
|
||||
kind = "EndpointSlice"
|
||||
metadata = {
|
||||
name = var.name
|
||||
namespace = var.namespace
|
||||
labels = {
|
||||
"kubernetes.io/service-name" = var.name
|
||||
"app" = var.name
|
||||
}
|
||||
}
|
||||
addressType = "IPv4"
|
||||
ports = [{
|
||||
name = local.port_name
|
||||
port = tonumber(var.port)
|
||||
protocol = "TCP"
|
||||
}]
|
||||
endpoints = [{
|
||||
addresses = [var.backend_ip]
|
||||
conditions = {
|
||||
ready = true
|
||||
}
|
||||
}]
|
||||
}
|
||||
depends_on = [kubernetes_service.ip-backend-service]
|
||||
}
|
||||
|
||||
locals {
|
||||
# External monitor defaults: on when proxied, off otherwise. Explicit bool overrides.
|
||||
effective_external_monitor = var.external_monitor != null ? var.external_monitor : (var.dns_type == "proxied")
|
||||
|
||||
# Emit the annotation when effective is true (positive signal), or when the
|
||||
# caller explicitly set external_monitor=false (opt-out). When the caller
|
||||
# leaves it null AND dns_type != "proxied", emit nothing — the sync script's
|
||||
# default opt-in (any *.viktorbarzin.me ingress) keeps monitoring services
|
||||
# that are publicly reachable via routes we don't manage here.
|
||||
external_monitor_annotations = local.effective_external_monitor ? merge(
|
||||
{ "uptime.viktorbarzin.me/external-monitor" = "true" },
|
||||
var.external_monitor_name != null ? { "uptime.viktorbarzin.me/external-monitor-name" = var.external_monitor_name } : {},
|
||||
) : (var.external_monitor == false ?
|
||||
{ "uptime.viktorbarzin.me/external-monitor" = "false" } : {}
|
||||
)
|
||||
}
|
||||
|
||||
resource "kubernetes_ingress_v1" "proxied-ingress" {
|
||||
metadata {
|
||||
name = var.name
|
||||
namespace = var.namespace
|
||||
annotations = merge({
|
||||
"traefik.ingress.kubernetes.io/router.middlewares" = join(",", compact(concat([
|
||||
"traefik-retry@kubernetescrd",
|
||||
var.skip_global_rate_limit ? null : "traefik-rate-limit@kubernetescrd",
|
||||
var.custom_content_security_policy == null ? "traefik-csp-headers@kubernetescrd" : null,
|
||||
"traefik-crowdsec@kubernetescrd",
|
||||
var.protected ? "traefik-authentik-forward-auth@kubernetescrd" : null,
|
||||
var.strip_auth_headers ? "traefik-strip-auth-headers@kubernetescrd" : null,
|
||||
var.custom_content_security_policy != null ? "${var.namespace}-custom-csp-${var.name}@kubernetescrd" : null,
|
||||
], var.extra_middlewares)))
|
||||
"traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
|
||||
"traefik.ingress.kubernetes.io/service.serversscheme" = var.backend_protocol == "HTTPS" ? "https" : null
|
||||
"traefik.ingress.kubernetes.io/service.serverstransport" = var.backend_protocol == "HTTPS" ? "traefik-insecure-skip-verify@kubernetescrd" : null
|
||||
}, var.extra_annotations,
|
||||
var.dns_type != "none" ? { "cloudflare.viktorbarzin.me/dns-type" = var.dns_type } : {},
|
||||
local.external_monitor_annotations,
|
||||
)
|
||||
}
|
||||
|
||||
spec {
|
||||
ingress_class_name = "traefik"
|
||||
tls {
|
||||
hosts = ["${var.name}.viktorbarzin.me"]
|
||||
secret_name = var.tls_secret_name
|
||||
}
|
||||
rule {
|
||||
host = "${var.name}.viktorbarzin.me"
|
||||
http {
|
||||
dynamic "path" {
|
||||
for_each = var.ingress_path
|
||||
|
||||
content {
|
||||
path = path.value
|
||||
backend {
|
||||
service {
|
||||
|
||||
name = var.name
|
||||
port {
|
||||
number = var.port
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Custom CSP headers middleware - created per service when custom_content_security_policy is set
|
||||
resource "kubernetes_manifest" "custom_csp" {
|
||||
count = var.custom_content_security_policy != null ? 1 : 0
|
||||
|
||||
manifest = {
|
||||
apiVersion = "traefik.io/v1alpha1"
|
||||
kind = "Middleware"
|
||||
metadata = {
|
||||
name = "custom-csp-${var.name}"
|
||||
namespace = var.namespace
|
||||
}
|
||||
spec = {
|
||||
headers = {
|
||||
contentSecurityPolicy = var.custom_content_security_policy
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Cloudflare DNS records — created automatically when dns_type is set.
|
||||
resource "cloudflare_record" "proxied" {
|
||||
count = var.dns_type == "proxied" ? 1 : 0
|
||||
name = var.name
|
||||
content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
|
||||
proxied = true
|
||||
ttl = 1
|
||||
type = "CNAME"
|
||||
zone_id = var.cloudflare_zone_id
|
||||
allow_overwrite = true
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "non_proxied_a" {
|
||||
count = var.dns_type == "non-proxied" ? 1 : 0
|
||||
name = var.name
|
||||
content = var.public_ip
|
||||
proxied = false
|
||||
ttl = 1
|
||||
type = "A"
|
||||
zone_id = var.cloudflare_zone_id
|
||||
allow_overwrite = true
|
||||
}
|
||||
|
||||
resource "cloudflare_record" "non_proxied_aaaa" {
|
||||
count = var.dns_type == "non-proxied" ? 1 : 0
|
||||
name = var.name
|
||||
content = var.public_ipv6
|
||||
proxied = false
|
||||
ttl = 1
|
||||
type = "AAAA"
|
||||
zone_id = var.cloudflare_zone_id
|
||||
allow_overwrite = true
|
||||
}
|
||||
425
stacks/reverse-proxy/modules/reverse_proxy/main.tf
Normal file
425
stacks/reverse-proxy/modules/reverse_proxy/main.tf
Normal file
|
|
@ -0,0 +1,425 @@
|
|||
# Reverse proxy for things in my infra that are
|
||||
# outside of K8S but would be nice to use the Nginx-ingress
|
||||
|
||||
variable "tls_secret_name" {}
|
||||
variable "pfsense_homepage_token" {}
|
||||
variable "haos_homepage_token" {
|
||||
type = string
|
||||
default = ""
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "reverse-proxy" {
|
||||
metadata {
|
||||
labels = {
|
||||
"keel.sh/enrolled" = "true"
|
||||
}
|
||||
name = "reverse-proxy"
|
||||
}
|
||||
lifecycle {
|
||||
# KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
|
||||
ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
|
||||
}
|
||||
}
|
||||
|
||||
module "tls_secret" {
|
||||
source = "../../../../modules/kubernetes/setup_tls_secret"
|
||||
namespace = "reverse-proxy"
|
||||
tls_secret_name = var.tls_secret_name
|
||||
depends_on = [kubernetes_namespace.reverse-proxy]
|
||||
}
|
||||
|
||||
# https://pfsense.viktorbarzin.me/
|
||||
module "pfsense" {
|
||||
source = "./factory"
|
||||
dns_type = "proxied"
|
||||
name = "pfsense"
|
||||
external_name = "pfsense.viktorbarzin.lan"
|
||||
tls_secret_name = var.tls_secret_name
|
||||
port = 443
|
||||
backend_protocol = "HTTPS"
|
||||
|
||||
extra_annotations = {
|
||||
"gethomepage.dev/enabled" : "true"
|
||||
"gethomepage.dev/description" : "Cluster Firewall"
|
||||
"gethomepage.dev/group" : "Identity & Security"
|
||||
"gethomepage.dev/icon" : "pfsense.png"
|
||||
"gethomepage.dev/name" : "pFsense"
|
||||
"gethomepage.dev/widget.type" : "pfsense"
|
||||
"gethomepage.dev/widget.version" : "2"
|
||||
"gethomepage.dev/widget.url" : "https://10.0.20.1"
|
||||
"gethomepage.dev/widget.username" : "admin"
|
||||
"gethomepage.dev/widget.password" : var.pfsense_homepage_token
|
||||
"gethomepage.dev/widget.fields" = "[\"load\", \"memory\", \"temp\", \"disk\"]"
|
||||
"gethomepage.dev/widget.wan" = "vtnet0"
|
||||
}
|
||||
depends_on = [kubernetes_namespace.reverse-proxy]
|
||||
}
|
||||
|
||||
# https://nas.viktorbarzin.me/
|
||||
module "nas" {
|
||||
source = "./factory"
|
||||
dns_type = "proxied"
|
||||
name = "nas"
|
||||
external_name = "nas.viktorbarzin.lan"
|
||||
port = 5001
|
||||
tls_secret_name = var.tls_secret_name
|
||||
backend_protocol = "HTTPS"
|
||||
max_body_size = "0m"
|
||||
depends_on = [kubernetes_namespace.reverse-proxy]
|
||||
extra_annotations = {
|
||||
"gethomepage.dev/enabled" = "true"
|
||||
"gethomepage.dev/name" = "Synology NAS"
|
||||
"gethomepage.dev/description" = "Network storage"
|
||||
"gethomepage.dev/icon" = "synology.png"
|
||||
"gethomepage.dev/group" = "Infrastructure"
|
||||
"gethomepage.dev/pod-selector" = ""
|
||||
}
|
||||
}
|
||||
|
||||
# https://files.viktorbarzin.me/
|
||||
module "nas-files" {
|
||||
source = "./factory"
|
||||
dns_type = "non-proxied"
|
||||
name = "files"
|
||||
external_name = "nas.viktorbarzin.lan"
|
||||
port = 5001
|
||||
tls_secret_name = var.tls_secret_name
|
||||
backend_protocol = "HTTPS"
|
||||
protected = false # allow anyone to download files
|
||||
ingress_path = ["/sharing", "/scripts", "/webman", "/wfmlogindialog.js", "/fsdownload"]
|
||||
max_body_size = "0m"
|
||||
depends_on = [kubernetes_namespace.reverse-proxy]
|
||||
extra_annotations = { "gethomepage.dev/enabled" = "false" }
|
||||
}
|
||||
|
||||
# https://idrac.viktorbarzin.me/
|
||||
module "idrac" {
|
||||
source = "./factory"
|
||||
dns_type = "proxied"
|
||||
name = "idrac"
|
||||
external_name = "idrac.viktorbarzin.lan"
|
||||
port = 443
|
||||
tls_secret_name = var.tls_secret_name
|
||||
backend_protocol = "HTTPS"
|
||||
strip_auth_headers = true
|
||||
extra_annotations = {
|
||||
"gethomepage.dev/enabled" = "true"
|
||||
"gethomepage.dev/name" = "iDRAC"
|
||||
"gethomepage.dev/description" = "Server management"
|
||||
"gethomepage.dev/icon" = "dell.png"
|
||||
"gethomepage.dev/group" = "Infrastructure"
|
||||
"gethomepage.dev/pod-selector" = ""
|
||||
}
|
||||
depends_on = [kubernetes_namespace.reverse-proxy]
|
||||
}
|
||||
|
||||
module "tp-link-gateway" {
|
||||
source = "./factory"
|
||||
dns_type = "proxied"
|
||||
name = "gw"
|
||||
backend_ip = "192.168.1.1"
|
||||
port = 443
|
||||
tls_secret_name = var.tls_secret_name
|
||||
backend_protocol = "HTTPS"
|
||||
depends_on = [kubernetes_namespace.reverse-proxy]
|
||||
protected = true
|
||||
strip_auth_headers = true
|
||||
extra_annotations = { "gethomepage.dev/enabled" = "false" }
|
||||
}
|
||||
|
||||
# https://proxmox.viktorbarzin.me/
|
||||
module "proxmox" {
|
||||
source = "./factory"
|
||||
dns_type = "proxied"
|
||||
name = "proxmox"
|
||||
external_name = "proxmox.viktorbarzin.lan"
|
||||
port = 8006
|
||||
tls_secret_name = var.tls_secret_name
|
||||
backend_protocol = "HTTPS"
|
||||
max_body_size = "0" # unlimited
|
||||
depends_on = [kubernetes_namespace.reverse-proxy]
|
||||
extra_annotations = {
|
||||
"gethomepage.dev/enabled" = "true"
|
||||
"gethomepage.dev/name" = "Proxmox"
|
||||
"gethomepage.dev/description" = "Hypervisor"
|
||||
"gethomepage.dev/icon" = "proxmox.png"
|
||||
"gethomepage.dev/group" = "Infrastructure"
|
||||
"gethomepage.dev/pod-selector" = ""
|
||||
}
|
||||
}
|
||||
|
||||
# https://docker.viktorbarzin.me/ (registry web UI)
|
||||
module "docker-registry-ui" {
|
||||
source = "./factory"
|
||||
dns_type = "proxied"
|
||||
name = "docker"
|
||||
external_name = "docker-registry.viktorbarzin.lan"
|
||||
port = 8080
|
||||
tls_secret_name = var.tls_secret_name
|
||||
depends_on = [kubernetes_namespace.reverse-proxy]
|
||||
extra_annotations = {
|
||||
# Override middleware chain to remove rate-limit; the UI fires many API calls to list repos/tags
|
||||
"traefik.ingress.kubernetes.io/router.middlewares" = "traefik-csp-headers@kubernetescrd,traefik-crowdsec@kubernetescrd,traefik-authentik-forward-auth@kubernetescrd"
|
||||
"gethomepage.dev/enabled" = "true"
|
||||
"gethomepage.dev/name" = "Docker Registry"
|
||||
"gethomepage.dev/description" = "Container registry"
|
||||
"gethomepage.dev/icon" = "docker.png"
|
||||
"gethomepage.dev/group" = "Infrastructure"
|
||||
"gethomepage.dev/pod-selector" = ""
|
||||
}
|
||||
}
|
||||
|
||||
# registry.viktorbarzin.me decommissioned 2026-05-07 (forgejo-registry-consolidation
|
||||
# Phase 4). Forgejo at forgejo.viktorbarzin.me is the only writable private
|
||||
# registry now. Pull-through caches stay on registry VM at 10.0.20.10:5000-5040.
|
||||
|
||||
# https://valchedrym.viktorbarzin.me/
|
||||
module "valchedrym" {
|
||||
source = "./factory"
|
||||
dns_type = "proxied"
|
||||
name = "valchedrym"
|
||||
external_name = "valchedrym.viktorbarzin.lan"
|
||||
tls_secret_name = var.tls_secret_name
|
||||
port = 80
|
||||
backend_protocol = "HTTP"
|
||||
depends_on = [kubernetes_namespace.reverse-proxy]
|
||||
extra_annotations = { "gethomepage.dev/enabled" = "false" }
|
||||
}
|
||||
|
||||
# https://ip150.viktorbarzin.me/
|
||||
# Server has funky behaviour based on headers; works on some browrsers not others...
|
||||
# module "valchedrym-ip150" {
|
||||
# source = "./factory"
|
||||
# name = "ip150"
|
||||
# # external_name = "valchedrym.ddns.net"
|
||||
# external_name = "192.168.0.10"
|
||||
# port = 80
|
||||
# backend_protocol = "HTTP"
|
||||
# use_proxy_protocol = false
|
||||
# tls_secret_name = var.tls_secret_name
|
||||
# protected = false
|
||||
# depends_on = [kubernetes_namespace.reverse-proxy]
|
||||
# }
|
||||
|
||||
# https://mladost3.viktorbarzin.me/
|
||||
module "mladost3" {
|
||||
source = "./factory"
|
||||
name = "mladost3"
|
||||
external_name = "mladost3.ddns.net"
|
||||
port = 8080
|
||||
tls_secret_name = var.tls_secret_name
|
||||
depends_on = [kubernetes_namespace.reverse-proxy]
|
||||
external_monitor = false
|
||||
extra_annotations = { "gethomepage.dev/enabled" = "false" }
|
||||
}
|
||||
|
||||
# # https://server-switch.viktorbarzin.me/
|
||||
# module "server-switch" {
|
||||
# source = "./factory"
|
||||
# name = "server-switch"
|
||||
# external_name = "server-switch.viktorbarzin.lan"
|
||||
# port = 80
|
||||
# tls_secret_name = var.tls_secret_name
|
||||
# depends_on = [kubernetes_namespace.reverse-proxy]
|
||||
# }
|
||||
|
||||
# https://ha-sofia.viktorbarzin.me/
|
||||
resource "kubernetes_manifest" "ha_sofia_rate_limit" {
|
||||
manifest = {
|
||||
apiVersion = "traefik.io/v1alpha1"
|
||||
kind = "Middleware"
|
||||
metadata = {
|
||||
name = "ha-sofia-rate-limit"
|
||||
namespace = "reverse-proxy"
|
||||
}
|
||||
spec = {
|
||||
rateLimit = {
|
||||
average = 100
|
||||
burst = 200
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Per-service retry — bumps default (attempts=2) to 3 so transient DNS/connect
|
||||
# stalls on the ha-sofia.viktorbarzin.lan ExternalName are absorbed before
|
||||
# surfacing a 502. Drives bd code-rd1 Phase 2.2.
|
||||
resource "kubernetes_manifest" "ha_sofia_retry" {
|
||||
manifest = {
|
||||
apiVersion = "traefik.io/v1alpha1"
|
||||
kind = "Middleware"
|
||||
metadata = {
|
||||
name = "ha-sofia-retry"
|
||||
namespace = "reverse-proxy"
|
||||
}
|
||||
spec = {
|
||||
retry = {
|
||||
attempts = 3
|
||||
initialInterval = "100ms"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Per-service ServersTransport — overrides the global 60s dialTimeout
|
||||
# (set for Immich) with 500ms so a stall fails fast and the retry middleware
|
||||
# kicks in instead of blocking the connection for seconds. Drives bd
|
||||
# code-rd1 Phase 2.3.
|
||||
resource "kubernetes_manifest" "ha_sofia_transport" {
|
||||
manifest = {
|
||||
apiVersion = "traefik.io/v1alpha1"
|
||||
kind = "ServersTransport"
|
||||
metadata = {
|
||||
name = "ha-sofia-transport"
|
||||
namespace = "reverse-proxy"
|
||||
}
|
||||
spec = {
|
||||
forwardingTimeouts = {
|
||||
dialTimeout = "500ms"
|
||||
responseHeaderTimeout = "30s"
|
||||
idleConnTimeout = "90s"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
module "ha-sofia" {
|
||||
source = "./factory"
|
||||
dns_type = "non-proxied"
|
||||
name = "ha-sofia"
|
||||
external_name = "ha-sofia.viktorbarzin.lan"
|
||||
port = 8123
|
||||
tls_secret_name = var.tls_secret_name
|
||||
# depends_on on the retry/transport manifests avoids a dangling-reference
|
||||
# window that would 404 ha-sofia traffic (memory 768: 2026-04-17 P0 outage).
|
||||
depends_on = [
|
||||
kubernetes_namespace.reverse-proxy,
|
||||
kubernetes_manifest.ha_sofia_retry,
|
||||
kubernetes_manifest.ha_sofia_transport,
|
||||
]
|
||||
protected = false
|
||||
skip_global_rate_limit = true
|
||||
extra_middlewares = [
|
||||
"reverse-proxy-ha-sofia-rate-limit@kubernetescrd",
|
||||
"reverse-proxy-ha-sofia-retry@kubernetescrd",
|
||||
]
|
||||
extra_annotations = {
|
||||
"gethomepage.dev/enabled" = "true"
|
||||
"gethomepage.dev/name" = "Home Assistant Sofia"
|
||||
"gethomepage.dev/description" = "Smart home hub"
|
||||
"gethomepage.dev/icon" = "home-assistant.png"
|
||||
"gethomepage.dev/group" = "Smart Home"
|
||||
"gethomepage.dev/pod-selector" = ""
|
||||
"traefik.ingress.kubernetes.io/service.serverstransport" = "reverse-proxy-ha-sofia-transport@kubernetescrd"
|
||||
}
|
||||
}
|
||||
|
||||
# https://music-assistant.viktorbarzin.me/
|
||||
module "music-assistant" {
|
||||
source = "./factory"
|
||||
dns_type = "non-proxied"
|
||||
name = "music-assistant"
|
||||
external_name = "ha-sofia.viktorbarzin.lan"
|
||||
port = 8095
|
||||
tls_secret_name = var.tls_secret_name
|
||||
depends_on = [
|
||||
kubernetes_namespace.reverse-proxy,
|
||||
kubernetes_manifest.ha_sofia_retry,
|
||||
kubernetes_manifest.ha_sofia_transport,
|
||||
]
|
||||
protected = false
|
||||
skip_global_rate_limit = true
|
||||
extra_middlewares = [
|
||||
"reverse-proxy-ha-sofia-rate-limit@kubernetescrd",
|
||||
"reverse-proxy-ha-sofia-retry@kubernetescrd",
|
||||
]
|
||||
extra_annotations = {
|
||||
"traefik.ingress.kubernetes.io/service.serverstransport" = "reverse-proxy-ha-sofia-transport@kubernetescrd"
|
||||
}
|
||||
}
|
||||
|
||||
# https://ha-london.viktorbarzin.me/
|
||||
module "ha-london" {
|
||||
source = "./factory"
|
||||
dns_type = "non-proxied"
|
||||
name = "ha-london"
|
||||
external_name = "ha-london.viktorbarzin.lan"
|
||||
port = 8123
|
||||
tls_secret_name = var.tls_secret_name
|
||||
depends_on = [kubernetes_namespace.reverse-proxy]
|
||||
protected = false
|
||||
extra_annotations = {
|
||||
"gethomepage.dev/enabled" = "true"
|
||||
"gethomepage.dev/name" = "Home Assistant London"
|
||||
"gethomepage.dev/description" = "Smart home hub"
|
||||
"gethomepage.dev/icon" = "home-assistant.png"
|
||||
"gethomepage.dev/group" = "Smart Home"
|
||||
"gethomepage.dev/pod-selector" = ""
|
||||
}
|
||||
}
|
||||
|
||||
# https://london.viktorbarzin.me/
|
||||
module "london" {
|
||||
source = "./factory"
|
||||
dns_type = "proxied"
|
||||
name = "london"
|
||||
external_name = "openwrt-london.viktorbarzin.lan"
|
||||
port = 443
|
||||
tls_secret_name = var.tls_secret_name
|
||||
backend_protocol = "HTTPS"
|
||||
protected = true
|
||||
depends_on = [kubernetes_namespace.reverse-proxy]
|
||||
extra_annotations = {
|
||||
"gethomepage.dev/enabled" : "false"
|
||||
"gethomepage.dev/description" : "OpenWRT London"
|
||||
# gethomepage.dev/group: Media
|
||||
"gethomepage.dev/icon" : "openwrt.png"
|
||||
"gethomepage.dev/name" : "OpenWRT London"
|
||||
"gethomepage.dev/widget.type" : "openwrt"
|
||||
"gethomepage.dev/widget.url" : "https://100.64.0.14"
|
||||
# "gethomepage.dev/widget.token" = var.homepage_token
|
||||
"gethomepage.dev/widget.username" : "homepage"
|
||||
"gethomepage.dev/widget.password" : "" # add later as Flint2's openwrt is a little odd
|
||||
"gethomepage.dev/pod-selector" : ""
|
||||
}
|
||||
}
|
||||
module "pi-lights" {
|
||||
source = "./factory"
|
||||
dns_type = "proxied"
|
||||
name = "pi"
|
||||
external_name = "ha-london.viktorbarzin.lan"
|
||||
port = 5000
|
||||
tls_secret_name = var.tls_secret_name
|
||||
protected = true
|
||||
depends_on = [kubernetes_namespace.reverse-proxy]
|
||||
extra_annotations = { "gethomepage.dev/enabled" = "false" }
|
||||
}
|
||||
|
||||
# module "ups" { # .NET app doesn't work well behind host
|
||||
# source = "./factory"
|
||||
# name = "ups"
|
||||
# external_name = "ups.viktorbarzin.lan"
|
||||
# backend_protocol = "HTTPS"
|
||||
# port = 443
|
||||
# tls_secret_name = var.tls_secret_name
|
||||
# # protected = true
|
||||
# protected = false
|
||||
# depends_on = [kubernetes_namespace.reverse-proxy]
|
||||
# extra_annotations = {
|
||||
# "nginx.ingress.kubernetes.io/upstream-vhost" : "",
|
||||
# # "nginx.ingress.kubernetes.io/proxy-set-header" : "Host: <>",
|
||||
# }
|
||||
# }
|
||||
|
||||
module "mbp14" {
|
||||
source = "./factory"
|
||||
dns_type = "proxied"
|
||||
name = "mbp14"
|
||||
external_name = "mbp14.viktorbarzin.lan"
|
||||
port = 4020
|
||||
tls_secret_name = var.tls_secret_name
|
||||
protected = true
|
||||
depends_on = [kubernetes_namespace.reverse-proxy]
|
||||
extra_annotations = { "gethomepage.dev/enabled" = "false" }
|
||||
}
|
||||
1
stacks/reverse-proxy/secrets
Symbolic link
1
stacks/reverse-proxy/secrets
Symbolic link
|
|
@ -0,0 +1 @@
|
|||
../../secrets
|
||||
8
stacks/reverse-proxy/terragrunt.hcl
Normal file
8
stacks/reverse-proxy/terragrunt.hcl
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
include "root" {
|
||||
path = find_in_parent_folders()
|
||||
}
|
||||
|
||||
dependency "infra" {
|
||||
config_path = "../infra"
|
||||
skip_outputs = true
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue