fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip]
6d224861 came from a --no-checkout worktree whose empty index made the
commit drop every file except two. This restores 05b50d2b's full tree and
correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su
entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the
live infra was never applied from the broken commit.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>This commit is contained in:
Viktor Barzin
parent
6d224861c4
commit
fd0f4a0365
1166 changed files with 358546 additions and 0 deletions
484
stacks/terminal/main.tf
Normal file
484
stacks/terminal/main.tf
Normal file
|
|
@ -0,0 +1,484 @@
|
|||
variable "tls_secret_name" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace" "terminal" {
|
||||
metadata {
|
||||
name = "terminal"
|
||||
labels = {
|
||||
"istio-injection" : "disabled"
|
||||
tier = local.tiers.aux
|
||||
"keel.sh/enrolled" = "true"
|
||||
}
|
||||
}
|
||||
lifecycle {
|
||||
# KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
|
||||
ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
|
||||
}
|
||||
}
|
||||
|
||||
module "tls_secret" {
|
||||
source = "../../modules/kubernetes/setup_tls_secret"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
tls_secret_name = var.tls_secret_name
|
||||
}
|
||||
|
||||
# Service + Endpoints to reverse-proxy to ttyd at 10.0.10.10:7681
|
||||
resource "kubernetes_service" "terminal" {
|
||||
metadata {
|
||||
name = "terminal"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
labels = {
|
||||
app = "terminal"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
port {
|
||||
name = "http"
|
||||
port = 80
|
||||
target_port = 7681
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_endpoints" "terminal" {
|
||||
metadata {
|
||||
name = "terminal"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
}
|
||||
|
||||
subset {
|
||||
address {
|
||||
ip = "10.0.10.10"
|
||||
}
|
||||
port {
|
||||
name = "http"
|
||||
port = 7681
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
module "ingress" {
|
||||
source = "../../modules/kubernetes/ingress_factory"
|
||||
dns_type = "proxied"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
name = "terminal"
|
||||
tls_secret_name = var.tls_secret_name
|
||||
auth = "required"
|
||||
extra_annotations = {
|
||||
"gethomepage.dev/enabled" = "true"
|
||||
"gethomepage.dev/name" = "Terminal"
|
||||
"gethomepage.dev/description" = "Web terminal (ttyd)"
|
||||
"gethomepage.dev/icon" = "mdi-console"
|
||||
"gethomepage.dev/group" = "Infrastructure"
|
||||
"gethomepage.dev/pod-selector" = ""
|
||||
}
|
||||
}
|
||||
|
||||
# Read-only terminal session at terminal-ro.viktorbarzin.me
|
||||
resource "kubernetes_service" "terminal_ro" {
|
||||
metadata {
|
||||
name = "terminal-ro"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
labels = {
|
||||
app = "terminal-ro"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
port {
|
||||
name = "http"
|
||||
port = 80
|
||||
target_port = 7682
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_endpoints" "terminal_ro" {
|
||||
metadata {
|
||||
name = "terminal-ro"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
}
|
||||
|
||||
subset {
|
||||
address {
|
||||
ip = "10.0.10.10"
|
||||
}
|
||||
port {
|
||||
name = "http"
|
||||
port = 7682
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Clipboard image upload service (same-origin path routing)
|
||||
resource "kubernetes_service" "clipboard_upload" {
|
||||
metadata {
|
||||
name = "clipboard-upload"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
labels = {
|
||||
app = "clipboard-upload"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
port {
|
||||
name = "http"
|
||||
port = 80
|
||||
target_port = 7683
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_endpoints" "clipboard_upload" {
|
||||
metadata {
|
||||
name = "clipboard-upload"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
}
|
||||
|
||||
subset {
|
||||
address {
|
||||
ip = "10.0.10.10"
|
||||
}
|
||||
port {
|
||||
name = "http"
|
||||
port = 7683
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# IngressRoute for /clipboard/* on terminal.viktorbarzin.me → clipboard-upload service
|
||||
resource "kubernetes_manifest" "clipboard_ingressroute" {
|
||||
manifest = {
|
||||
apiVersion = "traefik.io/v1alpha1"
|
||||
kind = "IngressRoute"
|
||||
metadata = {
|
||||
name = "clipboard-upload"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
}
|
||||
spec = {
|
||||
entryPoints = ["websecure"]
|
||||
routes = [{
|
||||
match = "Host(`terminal.viktorbarzin.me`) && PathPrefix(`/clipboard/`)"
|
||||
kind = "Rule"
|
||||
middlewares = [
|
||||
{
|
||||
name = "authentik-forward-auth"
|
||||
namespace = "traefik"
|
||||
},
|
||||
{
|
||||
name = "clipboard-strip-prefix"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
}
|
||||
]
|
||||
services = [{
|
||||
name = "clipboard-upload"
|
||||
port = 80
|
||||
}]
|
||||
}]
|
||||
tls = {
|
||||
secretName = var.tls_secret_name
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_manifest" "clipboard_strip_prefix" {
|
||||
manifest = {
|
||||
apiVersion = "traefik.io/v1alpha1"
|
||||
kind = "Middleware"
|
||||
metadata = {
|
||||
name = "clipboard-strip-prefix"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
}
|
||||
spec = {
|
||||
stripPrefix = {
|
||||
prefixes = ["/clipboard"]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
module "ingress_ro" {
|
||||
source = "../../modules/kubernetes/ingress_factory"
|
||||
dns_type = "proxied"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
name = "terminal-ro"
|
||||
tls_secret_name = var.tls_secret_name
|
||||
auth = "required"
|
||||
extra_annotations = {
|
||||
"gethomepage.dev/enabled" = "true"
|
||||
"gethomepage.dev/name" = "Terminal (Read-Only)"
|
||||
"gethomepage.dev/description" = "Read-only web terminal (ttyd)"
|
||||
"gethomepage.dev/icon" = "mdi-console"
|
||||
"gethomepage.dev/group" = "Infrastructure"
|
||||
"gethomepage.dev/pod-selector" = ""
|
||||
}
|
||||
}
|
||||
|
||||
# === Multi-session lobby on terminal.viktorbarzin.me ===
|
||||
#
|
||||
# Application code (frontend, tmux-api, clipboard-upload, DevVM
|
||||
# systemd units / scripts / config) lives in a separate Forgejo repo:
|
||||
# https://forgejo.viktorbarzin.me/viktor/terminal-lobby
|
||||
#
|
||||
# That repo's ./scripts/deploy.sh ships everything to wizard@10.0.10.10
|
||||
# and restarts ttyd / ttyd-ro / tmux-api / clipboard-upload. This stack
|
||||
# only owns the Kubernetes side: Services, Endpoints pointing at
|
||||
# 10.0.10.10:{7681,7682,7683,7684}, the IngressRoutes, and the Traefik
|
||||
# middlewares that gate everything behind Authentik forward-auth.
|
||||
#
|
||||
# Service map (DevVM):
|
||||
# ttyd :7681 → serves lobby + xterm WS
|
||||
# ttyd-ro :7682 → read-only mirror at terminal-ro.viktorbarzin.me
|
||||
# clipboard-upload :7683 → POST /upload, returns saved path
|
||||
# tmux-api :7684 → GET /sessions, DELETE /sessions/<n>,
|
||||
# POST /sessions/<n>/rename, GET /whoami
|
||||
|
||||
# Service+Endpoints → tmux-api on the DevVM (port 7684).
|
||||
resource "kubernetes_service" "tmux_api" {
|
||||
metadata {
|
||||
name = "tmux-api"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
labels = {
|
||||
app = "tmux-api"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
port {
|
||||
name = "http"
|
||||
port = 80
|
||||
target_port = 7684
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_endpoints" "tmux_api" {
|
||||
metadata {
|
||||
name = "tmux-api"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
}
|
||||
|
||||
subset {
|
||||
address {
|
||||
ip = "10.0.10.10"
|
||||
}
|
||||
port {
|
||||
name = "http"
|
||||
port = 7684
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# IngressRoute: /api/sessions/* on terminal.viktorbarzin.me → tmux-api
|
||||
# service. Path-prefix specificity beats the catch-all `module.ingress`
|
||||
# (terminal.viktorbarzin.me → ttyd) above, so the lobby HTML reaches
|
||||
# tmux-api directly while everything else flows to ttyd.
|
||||
resource "kubernetes_manifest" "tmux_api_ingressroute" {
|
||||
manifest = {
|
||||
apiVersion = "traefik.io/v1alpha1"
|
||||
kind = "IngressRoute"
|
||||
metadata = {
|
||||
name = "tmux-api"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
}
|
||||
spec = {
|
||||
entryPoints = ["websecure"]
|
||||
routes = [{
|
||||
match = "Host(`terminal.viktorbarzin.me`) && PathPrefix(`/api/sessions/`)"
|
||||
kind = "Rule"
|
||||
middlewares = [
|
||||
{
|
||||
name = "authentik-forward-auth"
|
||||
namespace = "traefik"
|
||||
},
|
||||
{
|
||||
name = "tmux-api-strip-prefix"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
}
|
||||
]
|
||||
services = [{
|
||||
name = "tmux-api"
|
||||
port = 80
|
||||
}]
|
||||
}]
|
||||
tls = {
|
||||
secretName = var.tls_secret_name
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_manifest" "tmux_api_strip_prefix" {
|
||||
manifest = {
|
||||
apiVersion = "traefik.io/v1alpha1"
|
||||
kind = "Middleware"
|
||||
metadata = {
|
||||
name = "tmux-api-strip-prefix"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
}
|
||||
spec = {
|
||||
stripPrefix = {
|
||||
prefixes = ["/api/sessions"]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# Webterminal probe (added 2026-05-17 after a Traefik replica came up with a
|
||||
# partial routing table — only the IngressRoute CRDs registered; the
|
||||
# kubernetes_ingress for terminal.viktorbarzin.me was missing, so ~70% of
|
||||
# /token requests routed to that replica returned 404 with router="-". The
|
||||
# lobby's WebSocket retry loop kept the user stuck on "Failed to connect.
|
||||
# Retrying..." because Cloudflare → that replica → 404 broke /token and the
|
||||
# /ws upgrade intermittently.
|
||||
#
|
||||
# The probe exercises the full external path (Cloudflare → Traefik → ttyd
|
||||
# Service) every 5 minutes and pushes 4 gauges to Pushgateway:
|
||||
# webterminal_probe_token_status — HTTP status of GET /token (want 302)
|
||||
# webterminal_probe_ws_status — HTTP status of WS upgrade /ws (want 302)
|
||||
# webterminal_probe_ttyd_status — In-cluster ttyd /token (want 200)
|
||||
# webterminal_probe_last_success_timestamp — Unix ts of last fully-OK run
|
||||
#
|
||||
# Alerts live in monitoring/prometheus_chart_values.tpl group "Webterminal".
|
||||
# =============================================================================
|
||||
|
||||
resource "kubernetes_cron_job_v1" "webterminal_probe" {
|
||||
metadata {
|
||||
name = "webterminal-probe"
|
||||
namespace = kubernetes_namespace.terminal.metadata[0].name
|
||||
}
|
||||
spec {
|
||||
concurrency_policy = "Forbid"
|
||||
failed_jobs_history_limit = 3
|
||||
successful_jobs_history_limit = 1
|
||||
schedule = "*/5 * * * *"
|
||||
job_template {
|
||||
metadata {}
|
||||
spec {
|
||||
backoff_limit = 1
|
||||
ttl_seconds_after_finished = 600
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = "webterminal-probe"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
restart_policy = "OnFailure"
|
||||
container {
|
||||
name = "probe"
|
||||
image = "docker.io/library/alpine:3.20"
|
||||
image_pull_policy = "IfNotPresent"
|
||||
resources {
|
||||
requests = {
|
||||
cpu = "10m"
|
||||
memory = "32Mi"
|
||||
}
|
||||
limits = {
|
||||
memory = "96Mi"
|
||||
}
|
||||
}
|
||||
env {
|
||||
name = "TARGET_HOST"
|
||||
value = "terminal.viktorbarzin.me"
|
||||
}
|
||||
env {
|
||||
name = "PUSHGATEWAY"
|
||||
value = "http://prometheus-prometheus-pushgateway.monitoring:9091/metrics/job/webterminal-probe"
|
||||
}
|
||||
command = ["/bin/sh", "-c", <<-EOT
|
||||
set -u
|
||||
apk add --no-cache curl python3 >/dev/null 2>&1
|
||||
|
||||
# Probe 1 — HTTP GET /token (Cloudflare → Traefik → ttyd).
|
||||
# Without an Authentik cookie the response MUST be 302
|
||||
# (forward-auth redirect). 404 means a Traefik router is
|
||||
# missing on the replica that received the request.
|
||||
TOKEN_STATUS=$(curl -sk -o /dev/null -w "%%{http_code}" \
|
||||
--max-time 10 \
|
||||
"https://$${TARGET_HOST}/token?arg=probe" || echo 0)
|
||||
|
||||
# Probe 2 — WebSocket upgrade to /ws. Same expectation: 302.
|
||||
# 404 here is what produced "Failed to connect" in the lobby
|
||||
# iframe. Use Python for a true Upgrade request — curl's
|
||||
# synthetic upgrade headers don't always trigger the WS path
|
||||
# through every Cloudflare POP.
|
||||
WS_STATUS=$(python3 - <<'PYEOF' 2>/dev/null || echo 0
|
||||
import ssl, socket, base64, os
|
||||
try:
|
||||
ctx = ssl.create_default_context()
|
||||
ctx.check_hostname = False
|
||||
ctx.verify_mode = ssl.CERT_NONE
|
||||
ctx.set_alpn_protocols(["http/1.1"])
|
||||
sock = socket.create_connection((os.environ["TARGET_HOST"], 443), timeout=10)
|
||||
ssock = ctx.wrap_socket(sock, server_hostname=os.environ["TARGET_HOST"])
|
||||
key = base64.b64encode(os.urandom(16)).decode()
|
||||
req = (
|
||||
"GET /ws?arg=probe HTTP/1.1\r\n"
|
||||
f"Host: {os.environ['TARGET_HOST']}\r\n"
|
||||
"Upgrade: websocket\r\n"
|
||||
"Connection: Upgrade\r\n"
|
||||
f"Sec-WebSocket-Key: {key}\r\n"
|
||||
"Sec-WebSocket-Version: 13\r\n"
|
||||
"Sec-WebSocket-Protocol: tty\r\n"
|
||||
f"Origin: https://{os.environ['TARGET_HOST']}\r\n"
|
||||
"\r\n"
|
||||
)
|
||||
ssock.sendall(req.encode())
|
||||
ssock.settimeout(5)
|
||||
data = ssock.recv(2048)
|
||||
ssock.close()
|
||||
first = data.split(b"\r\n")[0].decode("ascii", "ignore")
|
||||
parts = first.split()
|
||||
print(parts[1] if len(parts) >= 2 and parts[1].isdigit() else 0)
|
||||
except Exception:
|
||||
print(0)
|
||||
PYEOF
|
||||
)
|
||||
|
||||
# Probe 3 — ttyd Service ClusterIP. Bypasses Cloudflare /
|
||||
# Traefik / Authentik so we can tell whether the failure mode
|
||||
# is "ttyd down" vs "edge proxy misrouting".
|
||||
TTYD_STATUS=$(curl -s -o /dev/null -w "%%{http_code}" \
|
||||
--max-time 5 -H "X-authentik-username: probe" \
|
||||
"http://terminal.terminal.svc.cluster.local/token" || echo 0)
|
||||
|
||||
OK=0
|
||||
if [ "$$TOKEN_STATUS" = "302" ] && [ "$$WS_STATUS" = "302" ] && [ "$$TTYD_STATUS" = "200" ]; then
|
||||
OK=1
|
||||
fi
|
||||
NOW=$(date +%s)
|
||||
|
||||
cat <<METRICS | curl -sf --max-time 10 --data-binary @- "$$PUSHGATEWAY" >/dev/null 2>&1 || true
|
||||
# HELP webterminal_probe_token_status HTTP status from GET /token via Cloudflare.
|
||||
# TYPE webterminal_probe_token_status gauge
|
||||
webterminal_probe_token_status $${TOKEN_STATUS:-0}
|
||||
# HELP webterminal_probe_ws_status HTTP status from WebSocket upgrade /ws via Cloudflare.
|
||||
# TYPE webterminal_probe_ws_status gauge
|
||||
webterminal_probe_ws_status $${WS_STATUS:-0}
|
||||
# HELP webterminal_probe_ttyd_status HTTP status from in-cluster ttyd /token.
|
||||
# TYPE webterminal_probe_ttyd_status gauge
|
||||
webterminal_probe_ttyd_status $${TTYD_STATUS:-0}
|
||||
# HELP webterminal_probe_last_success_timestamp Unix ts of last fully-OK probe.
|
||||
# TYPE webterminal_probe_last_success_timestamp gauge
|
||||
webterminal_probe_last_success_timestamp $$([ "$$OK" = "1" ] && echo "$$NOW" || echo 0)
|
||||
METRICS
|
||||
|
||||
echo "probe: token=$${TOKEN_STATUS} ws=$${WS_STATUS} ttyd=$${TTYD_STATUS} ok=$${OK}"
|
||||
EOT
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# CI retrigger 2026-05-16T13:42:57+00:00 — bulk enrollment apply (pipeline #689 killed)
|
||||
# CI retrigger v2 2026-05-16T13:46:35+00:00
|
||||
37
stacks/terminal/providers.tf
Normal file
37
stacks/terminal/providers.tf
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
||||
terraform {
|
||||
required_providers {
|
||||
vault = {
|
||||
source = "hashicorp/vault"
|
||||
version = "~> 4.0"
|
||||
}
|
||||
cloudflare = {
|
||||
source = "cloudflare/cloudflare"
|
||||
version = "~> 4"
|
||||
}
|
||||
authentik = {
|
||||
source = "goauthentik/authentik"
|
||||
version = "~> 2024.10"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
variable "kube_config_path" {
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
config_path = var.kube_config_path
|
||||
}
|
||||
|
||||
provider "helm" {
|
||||
kubernetes = {
|
||||
config_path = var.kube_config_path
|
||||
}
|
||||
}
|
||||
|
||||
provider "vault" {
|
||||
address = "https://vault.viktorbarzin.me"
|
||||
skip_child_token = true
|
||||
}
|
||||
1
stacks/terminal/secrets
Symbolic link
1
stacks/terminal/secrets
Symbolic link
|
|
@ -0,0 +1 @@
|
|||
../../secrets
|
||||
3
stacks/terminal/terragrunt.hcl
Normal file
3
stacks/terminal/terragrunt.hcl
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
include "root" {
|
||||
path = find_in_parent_folders()
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue