453 lines
14 KiB
Terraform
453 lines
14 KiB
Terraform
|
locals {
|
||
|
|
caddy_frontend_network_name = "caddy-frontend"
|
||
|
|
caddy_container_name = "caddy"
|
||
|
|
caddy_version = "2.9.1-alpine"
|
||
|
|
caddy_config_dir = "/var/opt/caddy"
|
||
|
|
|
||
|
|
castopod_frontend_network_name = "castopod-frontend"
|
||
|
|
castopod_backend_network_name = "castopod-backend"
|
||
|
|
castopod_media_volume_name = "castopod-media"
|
||
|
|
castopod_container_name = "castopod"
|
||
|
|
|
||
|
|
castopod_db_name = "castopod"
|
||
|
|
castopod_db_user = "castopod"
|
||
|
|
castopod_base_url = var.base_url
|
||
|
|
|
||
|
|
valkey_container_name = "valkey"
|
||
|
|
valkey_cache_volume_name = "castopod-cache"
|
||
|
|
|
||
|
|
mariadb_container_name = "mariadb"
|
||
|
|
mariadb_data_volume_name = "castopod-db"
|
||
|
|
mariadb_version = "11.5"
|
||
|
|
|
||
|
|
secrets_part_name = "secrets"
|
||
|
|
secrets_path = "/var/opt/secrets"
|
||
|
|
secrets_path_escaped = "var-opt-secrets"
|
||
|
|
|
||
|
|
data_device_path = "/dev/vdb"
|
||
|
|
|
||
|
|
data_disk = {
|
||
|
|
device = local.data_device_path
|
||
|
|
wipeTable = true
|
||
|
|
partitions = [
|
||
|
|
{
|
||
|
|
label = local.secrets_part_name
|
||
|
|
number = 1
|
||
|
|
sizeMiB = 1024
|
||
|
|
wipePartitionEntry = true
|
||
|
|
shouldExist = true
|
||
|
|
resize = true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
label = local.castopod_media_volume_name
|
||
|
|
number = 2
|
||
|
|
sizeMiB = 20 * 1024
|
||
|
|
wipePartitionEntry = true
|
||
|
|
shouldExist = true
|
||
|
|
resize = true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
label = local.mariadb_data_volume_name
|
||
|
|
number = 3
|
||
|
|
sizeMiB = 5 * 1024
|
||
|
|
wipePartitionEntry = true
|
||
|
|
shouldExist = true
|
||
|
|
resize = true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
label = local.valkey_cache_volume_name
|
||
|
|
number = 4
|
||
|
|
sizeMiB = 1024
|
||
|
|
wipePartitionEntry = true
|
||
|
|
shouldExist = true
|
||
|
|
resize = true
|
||
|
|
},
|
||
|
|
]
|
||
|
|
}
|
||
|
|
|
||
|
|
caddy_config_directory = {
|
||
|
|
path = local.caddy_config_dir
|
||
|
|
user = {id = 0}
|
||
|
|
group = {id = 0}
|
||
|
|
mode = 448 # 0700
|
||
|
|
}
|
||
|
|
|
||
|
|
caddy_config_file = {
|
||
|
|
path = "${local.caddy_config_dir}/Caddyfile"
|
||
|
|
user = {id = 0}
|
||
|
|
group = {id = 0}
|
||
|
|
mode = 420 # 0644
|
||
|
|
contents = {
|
||
|
|
source = format(
|
||
|
|
"data:text/plain;base64,%s",
|
||
|
|
base64encode(
|
||
|
|
templatefile(
|
||
|
|
"${path.module}/files/Caddyfile.tftpl",
|
||
|
|
{
|
||
|
|
castopod_domain = var.castopod_domain
|
||
|
|
castopod_container_name = local.castopod_container_name
|
||
|
|
}
|
||
|
|
)
|
||
|
|
)
|
||
|
|
)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
caddy_frontend_network_file = {
|
||
|
|
path = "/etc/containers/systemd/caddy-frontend.network"
|
||
|
|
user = {id = 0}
|
||
|
|
group = {id = 0}
|
||
|
|
mode = 420 # 0644
|
||
|
|
contents = {
|
||
|
|
source = format(
|
||
|
|
"data:text/plain;base64,%s",
|
||
|
|
base64encode(
|
||
|
|
templatefile(
|
||
|
|
"${path.module}/files/caddy-frontend.network.tftpl",
|
||
|
|
{
|
||
|
|
caddy_frontend_network_name = local.caddy_frontend_network_name
|
||
|
|
}
|
||
|
|
)
|
||
|
|
)
|
||
|
|
)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
caddy_container_file = {
|
||
|
|
path = "/etc/containers/systemd/caddy.container"
|
||
|
|
user = {id = 0}
|
||
|
|
group = {id = 0}
|
||
|
|
mode = 420 # 0644
|
||
|
|
contents = {
|
||
|
|
source = format(
|
||
|
|
"data:text/plain;base64,%s",
|
||
|
|
base64encode(
|
||
|
|
templatefile(
|
||
|
|
"${path.module}/files/caddy.container.tftpl",
|
||
|
|
{
|
||
|
|
caddy_container_name = local.caddy_container_name
|
||
|
|
caddy_version = local.caddy_version
|
||
|
|
caddy_config_dir = local.caddy_config_dir
|
||
|
|
caddy_frontend_network_name = local.caddy_frontend_network_name
|
||
|
|
castopod_frontend_network_name = local.castopod_frontend_network_name
|
||
|
|
castopod_upstream_port = var.castopod_upstream_port
|
||
|
|
castopod_media_volume_name = local.castopod_media_volume_name
|
||
|
|
}
|
||
|
|
)
|
||
|
|
)
|
||
|
|
)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
castopod_secrets_filesystem = {
|
||
|
|
device = "${local.data_device_path}1"
|
||
|
|
format = "ext4"
|
||
|
|
label = local.secrets_part_name
|
||
|
|
}
|
||
|
|
|
||
|
|
castopod_secrets_directory = {
|
||
|
|
path = local.secrets_path
|
||
|
|
user = {id = 0}
|
||
|
|
group = {id = 0}
|
||
|
|
mode = 448 # 0700
|
||
|
|
}
|
||
|
|
|
||
|
|
castopod_secrets_mount_unit = {
|
||
|
|
name = "${local.secrets_path_escaped}.mount"
|
||
|
|
enabled = true
|
||
|
|
contents = templatefile(
|
||
|
|
"${path.module}/files/secrets.mount.tftpl",
|
||
|
|
{
|
||
|
|
secrets_part_name = local.secrets_part_name
|
||
|
|
secrets_path = local.secrets_path
|
||
|
|
}
|
||
|
|
)
|
||
|
|
}
|
||
|
|
|
||
|
|
castopod_generate_secrets_script_file = {
|
||
|
|
path = "/var/opt/generate_secrets.sh"
|
||
|
|
user = {id = 0}
|
||
|
|
group = {id = 0}
|
||
|
|
mode = 448 # 0700
|
||
|
|
contents = {
|
||
|
|
source = format(
|
||
|
|
"data:text/plain;base64,%s",
|
||
|
|
base64encode(
|
||
|
|
templatefile(
|
||
|
|
"${path.module}/files/generate_secrets.sh.tftpl",
|
||
|
|
{
|
||
|
|
secrets_path = local.secrets_path
|
||
|
|
}
|
||
|
|
)
|
||
|
|
)
|
||
|
|
)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
castopod_generate_secrets_service_unit = {
|
||
|
|
name = "generate_secrets.service"
|
||
|
|
enabled = true
|
||
|
|
contents = templatefile(
|
||
|
|
"${path.module}/files/generate_secrets.service.tftpl",
|
||
|
|
{
|
||
|
|
secrets_path = local.secrets_path
|
||
|
|
secrets_path_escaped = local.secrets_path_escaped
|
||
|
|
}
|
||
|
|
)
|
||
|
|
}
|
||
|
|
|
||
|
|
castopod_frontend_network_file = {
|
||
|
|
path = "/etc/containers/systemd/${local.castopod_frontend_network_name}.network"
|
||
|
|
user = {id = 0}
|
||
|
|
group = {id = 0}
|
||
|
|
mode = 420 # 0644
|
||
|
|
contents = {
|
||
|
|
source = format(
|
||
|
|
"data:text/plain;base64,%s",
|
||
|
|
base64encode(
|
||
|
|
templatefile(
|
||
|
|
"${path.module}/files/castopod-frontend.network.tftpl",
|
||
|
|
{
|
||
|
|
castopod_frontend_network_name = local.castopod_frontend_network_name
|
||
|
|
}
|
||
|
|
)
|
||
|
|
)
|
||
|
|
)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
castopod_backend_network_file = {
|
||
|
|
path = "/etc/containers/systemd/${local.castopod_backend_network_name}.network"
|
||
|
|
user = {id = 0}
|
||
|
|
group = {id = 0}
|
||
|
|
mode = 420 # 0644
|
||
|
|
contents = {
|
||
|
|
source = format(
|
||
|
|
"data:text/plain;base64,%s",
|
||
|
|
base64encode(
|
||
|
|
templatefile(
|
||
|
|
"${path.module}/files/castopod-backend.network.tftpl",
|
||
|
|
{
|
||
|
|
castopod_backend_network_name = local.castopod_backend_network_name
|
||
|
|
}
|
||
|
|
)
|
||
|
|
)
|
||
|
|
)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
castopod_media_volume_filesystem = {
|
||
|
|
device = "${local.data_device_path}2"
|
||
|
|
format = "ext4"
|
||
|
|
label = local.castopod_media_volume_name
|
||
|
|
options = [
|
||
|
|
"-E", "root_owner=33:33",
|
||
|
|
]
|
||
|
|
}
|
||
|
|
|
||
|
|
castopod_media_volume_file = {
|
||
|
|
path = "/etc/containers/systemd/${local.castopod_media_volume_name}.volume"
|
||
|
|
user = {id = 0}
|
||
|
|
group = {id = 0}
|
||
|
|
mode = 420 # 0644
|
||
|
|
contents = {
|
||
|
|
source = format(
|
||
|
|
"data:text/plain;base64,%s",
|
||
|
|
base64encode(
|
||
|
|
templatefile(
|
||
|
|
"${path.module}/files/castopod-media.volume.tftpl",
|
||
|
|
{
|
||
|
|
castopod_media_volume_name = local.castopod_media_volume_name
|
||
|
|
}
|
||
|
|
)
|
||
|
|
)
|
||
|
|
)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
mariadb_data_volume_filesystem = {
|
||
|
|
device = "${local.data_device_path}3"
|
||
|
|
format = "ext4"
|
||
|
|
label = local.mariadb_data_volume_name
|
||
|
|
options = [
|
||
|
|
"-E", "root_owner=999:999",
|
||
|
|
]
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
mariadb_data_volume_file = {
|
||
|
|
path = "/etc/containers/systemd/${local.mariadb_data_volume_name}.volume"
|
||
|
|
user = {id = 0}
|
||
|
|
group = {id = 0}
|
||
|
|
mode = 420 # 0644
|
||
|
|
contents = {
|
||
|
|
source = format(
|
||
|
|
"data:text/plain;base64,%s",
|
||
|
|
base64encode(
|
||
|
|
templatefile(
|
||
|
|
"${path.module}/files/mariadb-data.volume.tftpl",
|
||
|
|
{
|
||
|
|
mariadb_data_volume_name = local.mariadb_data_volume_name
|
||
|
|
}
|
||
|
|
)
|
||
|
|
)
|
||
|
|
)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
mariadb_container_file = {
|
||
|
|
path = "/etc/containers/systemd/${local.mariadb_container_name}.container"
|
||
|
|
user = {id = 0}
|
||
|
|
group = {id = 0}
|
||
|
|
mode = 420 # 0644
|
||
|
|
contents = {
|
||
|
|
source = format(
|
||
|
|
"data:text/plain;base64,%s",
|
||
|
|
base64encode(
|
||
|
|
templatefile(
|
||
|
|
"${path.module}/files/mariadb.container.tftpl",
|
||
|
|
{
|
||
|
|
mariadb_container_name = local.mariadb_container_name
|
||
|
|
mariadb_version = local.mariadb_version
|
||
|
|
mariadb_data_volume_name = local.mariadb_data_volume_name
|
||
|
|
castopod_backend_network_name = local.castopod_backend_network_name
|
||
|
|
castopod_db_name = local.castopod_db_name
|
||
|
|
castopod_db_user = local.castopod_db_user
|
||
|
|
secrets_path = local.secrets_path
|
||
|
|
}
|
||
|
|
)
|
||
|
|
)
|
||
|
|
)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
valkey_cache_volume_filesystem = {
|
||
|
|
device = "${local.data_device_path}4"
|
||
|
|
format = "ext4"
|
||
|
|
label = local.valkey_cache_volume_name
|
||
|
|
options = [
|
||
|
|
"-E", "root_owner=999:999",
|
||
|
|
]
|
||
|
|
}
|
||
|
|
|
||
|
|
valkey_cache_volume_file = {
|
||
|
|
path = "/etc/containers/systemd/${local.valkey_cache_volume_name}.volume"
|
||
|
|
user = {id = 0}
|
||
|
|
group = {id = 0}
|
||
|
|
mode = 420 # 0644
|
||
|
|
contents = {
|
||
|
|
source = format(
|
||
|
|
"data:text/plain;base64,%s",
|
||
|
|
base64encode(
|
||
|
|
templatefile(
|
||
|
|
"${path.module}/files/valkey.volume.tftpl",
|
||
|
|
{
|
||
|
|
valkey_cache_volume_name = local.valkey_cache_volume_name
|
||
|
|
}
|
||
|
|
)
|
||
|
|
)
|
||
|
|
)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
valkey_container_file = {
|
||
|
|
path = "/etc/containers/systemd/${local.valkey_container_name}.container"
|
||
|
|
user = {id = 0}
|
||
|
|
group = {id = 0}
|
||
|
|
mode = 420 # 0644
|
||
|
|
contents = {
|
||
|
|
source = format(
|
||
|
|
"data:text/plain;base64,%s",
|
||
|
|
base64encode(
|
||
|
|
templatefile(
|
||
|
|
"${path.module}/files/valkey.container.tftpl",
|
||
|
|
{
|
||
|
|
valkey_container_name = local.valkey_container_name
|
||
|
|
valkey_version = "8.0-alpine"
|
||
|
|
valkey_cache_volume_name = local.valkey_cache_volume_name
|
||
|
|
castopod_backend_network_name = local.castopod_backend_network_name
|
||
|
|
secrets_path = local.secrets_path
|
||
|
|
}
|
||
|
|
)
|
||
|
|
)
|
||
|
|
)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
castopod_container_file = {
|
||
|
|
path = "/etc/containers/systemd/${local.castopod_container_name}.container"
|
||
|
|
user = {id = 0}
|
||
|
|
group = {id = 0}
|
||
|
|
mode = 420 # 0644
|
||
|
|
contents = {
|
||
|
|
source = format(
|
||
|
|
"data:text/plain;base64,%s",
|
||
|
|
base64encode(
|
||
|
|
templatefile("${path.module}/files/castopod.container.tftpl", {
|
||
|
|
castopod_version = "1.13.2",
|
||
|
|
castopod_container_name = local.castopod_container_name
|
||
|
|
castopod_frontend_network_name = local.castopod_frontend_network_name
|
||
|
|
castopod_backend_network_name = local.castopod_backend_network_name
|
||
|
|
castopod_media_volume_name = local.castopod_media_volume_name
|
||
|
|
castopod_db_name = local.castopod_db_name
|
||
|
|
castopod_db_user = local.castopod_db_user
|
||
|
|
castopod_base_url = var.base_url
|
||
|
|
mariadb_container_name = local.mariadb_container_name
|
||
|
|
valkey_container_name = local.valkey_container_name
|
||
|
|
secrets_path = local.secrets_path
|
||
|
|
})
|
||
|
|
)
|
||
|
|
)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
ignition_config = jsonencode({
|
||
|
|
ignition = {
|
||
|
|
version = "3.4.0"
|
||
|
|
}
|
||
|
|
storage = {
|
||
|
|
disks = [
|
||
|
|
local.data_disk,
|
||
|
|
]
|
||
|
|
filesystems = [
|
||
|
|
local.castopod_secrets_filesystem,
|
||
|
|
local.castopod_media_volume_filesystem,
|
||
|
|
local.mariadb_data_volume_filesystem,
|
||
|
|
local.valkey_cache_volume_filesystem,
|
||
|
|
]
|
||
|
|
files = [
|
||
|
|
local.caddy_config_file,
|
||
|
|
local.caddy_frontend_network_file,
|
||
|
|
local.caddy_container_file,
|
||
|
|
local.castopod_generate_secrets_script_file,
|
||
|
|
local.castopod_frontend_network_file,
|
||
|
|
local.castopod_backend_network_file,
|
||
|
|
local.castopod_media_volume_file,
|
||
|
|
local.mariadb_data_volume_file,
|
||
|
|
local.mariadb_container_file,
|
||
|
|
local.valkey_cache_volume_file,
|
||
|
|
local.valkey_container_file,
|
||
|
|
local.castopod_container_file,
|
||
|
|
]
|
||
|
|
directories = [
|
||
|
|
local.caddy_config_directory,
|
||
|
|
local.castopod_secrets_directory,
|
||
|
|
]
|
||
|
|
}
|
||
|
|
systemd = {
|
||
|
|
units = [
|
||
|
|
local.castopod_secrets_mount_unit,
|
||
|
|
local.castopod_generate_secrets_service_unit,
|
||
|
|
]
|
||
|
|
}
|
||
|
|
passwd = {
|
||
|
|
users = [
|
||
|
|
{
|
||
|
|
name = "core"
|
||
|
|
sshAuthorizedKeys = var.ssh_authorized_keys
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
})
|
||
|
|
}
|