68c8c5b4a0
SEV1 outage: fsid=0 in PVE /etc/exports broke all NFS subdirectory mounts from k8s (NFSv4 pseudo-root path resolution). Combined with lockd failure, both NFSv4 and NFSv3 mount paths broken. Cascaded into DNS primary, Vault (2/3 pods), Alertmanager, 20+ services. Changes: - Primary PVC: NFS (nfs-truenas) → proxmox-lvm-encrypted - Secondary/tertiary PVCs: proxmox-lvm → proxmox-lvm-encrypted - Removed NFS module dependency from technitium stack - Added full post-mortem with prevention plan [ci skip] Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
24 lines
895 B
HCL
24 lines
895 B
HCL
variable "tls_secret_name" { type = string }
|
|
variable "nfs_server" { type = string } # passed by config.tfvars, unused after NFS removal
|
|
variable "mysql_host" { type = string }
|
|
variable "postgresql_host" { type = string }
|
|
|
|
data "vault_kv_secret_v2" "secrets" {
|
|
mount = "secret"
|
|
name = "platform"
|
|
}
|
|
|
|
locals {
|
|
homepage_credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["homepage_credentials"])
|
|
}
|
|
|
|
module "technitium" {
|
|
source = "./modules/technitium"
|
|
tls_secret_name = var.tls_secret_name
|
|
mysql_host = var.mysql_host
|
|
postgresql_host = var.postgresql_host
|
|
homepage_token = local.homepage_credentials["technitium"]["token"]
|
|
technitium_username = data.vault_kv_secret_v2.secrets.data["technitium_username"]
|
|
technitium_password = data.vault_kv_secret_v2.secrets.data["technitium_password"]
|
|
tier = local.tiers.core
|
|
}
|