3a2d9a9bc5
Emo isn't using the instance and the daily bank-sync CronJob has been failing because the budget has zero accounts (deleted from the UI), triggering BankSyncStale. Adds an `enabled` toggle that gates the core Deployment + Service + Ingress + http-api + CronJob behind a single plan-time bool while preserving the PVC, so we can flip back to true later to restore the instance as-was. Also fixes a latent bug where the http-api Service was always created even when `enable_http_api=false`. Apply: 7 resources destroyed (emo deploy/svc/ingress/cf dns/http-api deploy+svc/cronjob), 0 changes for viktor/anca (moved blocks migrated their state cleanly to the new [0] addresses). Pushgateway job bank-sync-emo cleared manually; orphaned external-monitor synced out by external-monitor-sync.
141 lines
4.6 KiB
HCL
141 lines
4.6 KiB
HCL
variable "tls_secret_name" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
variable "nfs_server" { type = string }
|
|
|
|
resource "kubernetes_manifest" "external_secret" {
|
|
manifest = {
|
|
apiVersion = "external-secrets.io/v1beta1"
|
|
kind = "ExternalSecret"
|
|
metadata = {
|
|
name = "actualbudget-secrets"
|
|
namespace = "actualbudget"
|
|
}
|
|
spec = {
|
|
refreshInterval = "15m"
|
|
secretStoreRef = {
|
|
name = "vault-kv"
|
|
kind = "ClusterSecretStore"
|
|
}
|
|
target = {
|
|
name = "actualbudget-secrets"
|
|
}
|
|
dataFrom = [{
|
|
extract = {
|
|
key = "actualbudget"
|
|
}
|
|
}]
|
|
}
|
|
}
|
|
depends_on = [kubernetes_namespace.actualbudget]
|
|
}
|
|
|
|
data "kubernetes_secret" "eso_secrets" {
|
|
metadata {
|
|
name = "actualbudget-secrets"
|
|
namespace = kubernetes_namespace.actualbudget.metadata[0].name
|
|
}
|
|
depends_on = [kubernetes_manifest.external_secret]
|
|
}
|
|
|
|
locals {
|
|
credentials = jsondecode(data.kubernetes_secret.eso_secrets.data["credentials"])
|
|
}
|
|
|
|
|
|
# To create a new deployment:
|
|
/**
|
|
1. Create a subdirectory for {name} under /srv/nfs on the Proxmox host (192.168.1.127)
|
|
2. Add {name} as proxied cloudflare route (tfvars)
|
|
3. Add module here
|
|
*/
|
|
|
|
resource "kubernetes_namespace" "actualbudget" {
|
|
metadata {
|
|
name = "actualbudget"
|
|
labels = {
|
|
"istio-injection" : "disabled"
|
|
tier = local.tiers.edge
|
|
}
|
|
}
|
|
lifecycle {
|
|
# KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
|
|
ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
|
|
}
|
|
}
|
|
|
|
module "tls_secret" {
|
|
source = "../../modules/kubernetes/setup_tls_secret"
|
|
namespace = kubernetes_namespace.actualbudget.metadata[0].name
|
|
tls_secret_name = var.tls_secret_name
|
|
}
|
|
|
|
|
|
# https://budget-viktor.viktorbarzin.me/
|
|
module "viktor" {
|
|
source = "./factory"
|
|
name = "viktor"
|
|
tag = "26.4.0"
|
|
tls_secret_name = var.tls_secret_name
|
|
nfs_server = var.nfs_server
|
|
depends_on = [kubernetes_namespace.actualbudget]
|
|
tier = local.tiers.edge
|
|
enable_http_api = true
|
|
enable_bank_sync = true
|
|
storage_size = "4Gi"
|
|
budget_encryption_password = lookup(local.credentials["viktor"], "password", null)
|
|
sync_id = lookup(local.credentials["viktor"], "sync_id", null)
|
|
homepage_annotations = {
|
|
"gethomepage.dev/enabled" = "true"
|
|
"gethomepage.dev/name" = "Budget Viktor"
|
|
"gethomepage.dev/description" = "Personal budget"
|
|
"gethomepage.dev/icon" = "actual-budget.png"
|
|
"gethomepage.dev/group" = "Finance & Personal"
|
|
"gethomepage.dev/pod-selector" = ""
|
|
}
|
|
}
|
|
|
|
# https://budget-anca.viktorbarzin.me/
|
|
module "anca" {
|
|
source = "./factory"
|
|
name = "anca"
|
|
tag = "26.4.0"
|
|
tls_secret_name = var.tls_secret_name
|
|
nfs_server = var.nfs_server
|
|
depends_on = [kubernetes_namespace.actualbudget]
|
|
tier = local.tiers.edge
|
|
enable_http_api = true
|
|
enable_bank_sync = true
|
|
budget_encryption_password = lookup(local.credentials["anca"], "password", null)
|
|
sync_id = lookup(local.credentials["anca"], "sync_id", null)
|
|
homepage_annotations = {
|
|
"gethomepage.dev/enabled" = "true"
|
|
"gethomepage.dev/name" = "Budget Anca"
|
|
"gethomepage.dev/description" = "Personal budget"
|
|
"gethomepage.dev/icon" = "actual-budget.png"
|
|
"gethomepage.dev/group" = "Finance & Personal"
|
|
"gethomepage.dev/pod-selector" = ""
|
|
}
|
|
}
|
|
|
|
# https://budget-emo.viktorbarzin.me/
|
|
# Disabled 2026-05-13: Emo isn't using this instance. PVC is preserved so
|
|
# we can flip enabled back to true to bring the instance back as-was.
|
|
# The empty accounts list (vs. anca/viktor) was causing the daily bank-sync
|
|
# CronJob to fail and trigger BankSyncStale.
|
|
module "emo" {
|
|
source = "./factory"
|
|
name = "emo"
|
|
tag = "26.4.0"
|
|
tls_secret_name = var.tls_secret_name
|
|
nfs_server = var.nfs_server
|
|
depends_on = [kubernetes_namespace.actualbudget]
|
|
tier = local.tiers.edge
|
|
enabled = false
|
|
enable_http_api = false
|
|
enable_bank_sync = false
|
|
budget_encryption_password = lookup(local.credentials["emo"], "password", null)
|
|
sync_id = lookup(local.credentials["emo"], "sync_id", null)
|
|
homepage_annotations = {}
|
|
}
|