viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip]

Browse source 
6d224861 came from a --no-checkout worktree whose empty index made the
commit drop every file except two. This restores 05b50d2b's full tree and
correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su
entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the
live infra was never applied from the broken commit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin 2026-06-09 08:45:33 +00:00
parent 6d224861c4
commit fd0f4a0365
1166 changed files with 358546 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
stacks/wireguard/modules/wireguard/extra/clients.conf Normal file
View file

@ -0,0 +1,4 @@
[Peer]
# friendly_name = anca
PublicKey = fr4DB6FHhxYyzrtnoNbhdT8Fqwvsz7QkhTnZpSQmBCY=
AllowedIPs = 10.3.3.13/32

1
stacks/wireguard/modules/wireguard/extra/last_ip.txt Normal file
View file

@ -0,0 +1 @@
# DO NOT MANUALLY EDIT THIS LINE. Last IP: 10.3.3.15/24

269
stacks/wireguard/modules/wireguard/main.tf Normal file
View file

@ -0,0 +1,269 @@
variable "tls_secret_name" {}
variable "tier" { type = string }
variable "wg_0_conf" {}
variable "firewall_sh" {}
variable "wg_0_key" {}
module "tls_secret" {
source = "../../../../modules/kubernetes/setup_tls_secret"
namespace = kubernetes_namespace.wireguard.metadata[0].name
tls_secret_name = var.tls_secret_name
}
resource "kubernetes_namespace" "wireguard" {
metadata {
name = "wireguard"
labels = {
tier = var.tier
"keel.sh/enrolled" = "true"
}
}
lifecycle {
# KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
}
}
resource "kubernetes_config_map" "wg_0_conf" {
metadata {
name = "wg0-conf"
namespace = kubernetes_namespace.wireguard.metadata[0].name
labels = {
app = "wireguard"
}
annotations = {
"reloader.stakater.com/match" = "true"
}
}
data = {
"setup-firewall.sh" = var.firewall_sh
"wg0.conf" = format("%s%s", var.wg_0_conf, file("${path.module}/extra/clients.conf"))
}
}
resource "kubernetes_secret" "wg_0_key" {
metadata {
name = "wg0-key"
namespace = kubernetes_namespace.wireguard.metadata[0].name
annotations = {
"reloader.stakater.com/match" = "true"
}
}
data = {
"wg0.key" = var.wg_0_key
# If thep rivate key changes the pub key must be updated manually
"wg-ui-config" = format("{\"PrivateKey\": \"%s\",\"PublicKey\": \"%s\",\"Users\": {}}", var.wg_0_key, "3OeDa6Z3Z6vPVxn/WKJujYL7DoDYPPpI5W+2glUYLHU=")
}
type = "generic"
}
resource "kubernetes_deployment" "wireguard" {
metadata {
name = "wireguard"
namespace = kubernetes_namespace.wireguard.metadata[0].name
labels = {
app = "wireguard"
tier = var.tier
}
annotations = {
"reloader.stakater.com/search" = "true"
}
}
spec {
replicas = 1
strategy {
rolling_update {
max_surge = "2"
max_unavailable = "0"
}
}
selector {
match_labels = {
app = "wireguard"
}
}
template {
metadata {
labels = {
app = "wireguard"
}
annotations = {
"prometheus.io/scrape" = "true"
"prometheus.io/port" = "9586"
}
}
spec {
init_container {
name = "sysctl-setup"
image = "busybox"
command = ["/bin/sh", "-c", "echo 1 > /proc/sys/net/ipv4/ip_forward"]
security_context {
privileged = true
}
}
container {
image = "sclevine/wg:latest"
name = "wireguard"
image_pull_policy = "IfNotPresent"
lifecycle {
post_start {
# Switch the container's `iptables` symlink to iptables-nft
# before running wg-quick. The Debian-based sclevine/wg image
# defaults to iptables-legacy, which talks to the kernel's
# xt-tables interface. K8s nodes initialize their nat table
# via nftables (kernel `nf_tables`), so iptables-legacy in the
# container fails the wg0.conf PostUp MASQUERADE with:
# can't initialize iptables table `nat': Table does not
# exist (do you need to insmod?)
# Reproduced inside the live pod's namespaces 2026-05-17. The
# `update-alternatives` call points iptables/ip6tables at the
# `-nft` binaries so the same wg0.conf PostUp/PostDown writes
# to the nftables-backed nat table calico already set up.
exec {
command = ["sh", "-c", "update-alternatives --set iptables /usr/sbin/iptables-nft >/dev/null && update-alternatives --set ip6tables /usr/sbin/ip6tables-nft >/dev/null && exec wg-quick up wg0"]
}
}
pre_stop {
exec {
command = ["wg-quick", "down", "wg0"]
}
}
}
command = ["tail", "-f", "/dev/null"]
port {
container_port = 51820
protocol = "UDP"
}
volume_mount {
name = "wg0-key"
mount_path = "/etc/wireguard/wg0.key"
sub_path = "wg0.key"
}
volume_mount {
name = "wg0-conf"
mount_path = "/etc/wireguard/wg0.conf"
sub_path = "wg0.conf"
}
volume_mount {
name = "wg0-conf"
mount_path = "/etc/wireguard/setup-firewall.sh"
sub_path = "setup-firewall.sh"
}
security_context {
capabilities {
add = ["NET_ADMIN", "SYS_MODULE"]
}
}
resources {
requests = {
cpu = "10m"
memory = "64Mi"
}
limits = {
memory = "64Mi"
}
}
}
container {
name = "prometheus-exporter"
image = "mindflavor/prometheus-wireguard-exporter"
image_pull_policy = "IfNotPresent"
command = ["prometheus_wireguard_exporter", "-a", "true", "-v", "true", "-n", "/etc/wireguard/wg0.conf"]
volume_mount {
name = "wg0-conf"
mount_path = "/etc/wireguard/wg0.conf"
sub_path = "wg0.conf"
}
security_context {
capabilities {
add = ["NET_ADMIN"]
}
}
port {
container_port = 9586
protocol = "TCP"
}
resources {
requests = {
cpu = "10m"
memory = "32Mi"
}
limits = {
memory = "32Mi"
}
}
}
volume {
name = "wg0-key"
secret {
secret_name = "wg0-key"
}
}
volume {
name = "wg0-conf"
config_map {
name = "wg0-conf"
}
}
dns_config {
option {
name = "ndots"
value = "2"
}
}
}
}
}
}
resource "kubernetes_service" "wireguard" {
metadata {
name = "wireguard"
namespace = kubernetes_namespace.wireguard.metadata[0].name
annotations = {
"metallb.io/loadBalancerIPs" = "10.0.20.200"
"metallb.io/allow-shared-ip" = "shared"
}
labels = {
"app" = "wireguard"
}
}
spec {
type = "LoadBalancer"
external_traffic_policy = "Cluster"
selector = {
app = "wireguard"
}
port {
port = "51820"
protocol = "UDP"
}
}
}
resource "kubernetes_service" "wireguard_exporter" {
metadata {
name = "wireguard-exporter"
namespace = kubernetes_namespace.wireguard.metadata[0].name
labels = {
"app" = "wireguard-exporter"
}
}
spec {
selector = {
app = "wireguard"
}
port {
port = "9102"
target_port = "9586"
}
}
}