621 lines
No EOL
16 KiB
HCL
621 lines
No EOL
16 KiB
HCL
locals {
|
|
data_device_path = "/dev/vdb"
|
|
luks_device_name = "dm-crypt0"
|
|
|
|
caddy_container_name = "caddy"
|
|
nextcloud_container_name = "nextcloud"
|
|
postgres_container_name = "psql"
|
|
valkey_container_name = "valkey"
|
|
|
|
caddyfile_dir_path = "/opt/caddy"
|
|
caddyfile_file_path = "${local.caddyfile_dir_path}/Caddyfile"
|
|
postgres_password_secret_name = "postgres-passwd"
|
|
php_fpm_config_dir_path = "/opt/php"
|
|
php_fpm_config_file_path = "${local.php_fpm_config_dir_path}/www.conf"
|
|
|
|
caddy_data_volume_name = "caddy-data"
|
|
nextcloud_data_volume_name = "nextcloud-data"
|
|
postgres_data_volume_name = "postgres-data"
|
|
valkey_data_volume_name = "valkey-data"
|
|
|
|
caddy_image_name = "docker.io/caddy"
|
|
caddy_image_tag = "2.9.1-alpine"
|
|
|
|
nextcloud_image_name = "docker.io/nextcloud"
|
|
nextcloud_image_tag = "stable-fpm-alpine"
|
|
|
|
postgres_image_name = "docker.io/postgres"
|
|
postgres_image_tag = "12.22"
|
|
|
|
valkey_image_name = "docker.io/valkey/valkey"
|
|
valkey_image_tag = "8.0-alpine3.21"
|
|
|
|
postgres_env_file_path = "/etc/postgres.env"
|
|
|
|
data_disk = {
|
|
device = local.data_device_path
|
|
wipeTable = true
|
|
partitions = [
|
|
{
|
|
label = local.caddy_data_volume_name
|
|
number = 1
|
|
sizeMiB = 500
|
|
wipePartitionEntry = true
|
|
shouldExist = true
|
|
resize = true
|
|
},
|
|
{
|
|
label = local.nextcloud_data_volume_name
|
|
number = 2
|
|
sizeMiB = 100 * 1024
|
|
wipePartitionEntry = true
|
|
shouldExist = true
|
|
resize = true
|
|
},
|
|
{
|
|
label = local.postgres_data_volume_name
|
|
number = 3
|
|
sizeMiB = 10 * 1024
|
|
wipePartitionEntry = true
|
|
shouldExist = true
|
|
resize = true
|
|
},
|
|
{
|
|
label = local.valkey_data_volume_name
|
|
number = 4
|
|
sizeMiB = 1024
|
|
wipePartitionEntry = true
|
|
shouldExist = true
|
|
resize = true
|
|
},
|
|
]
|
|
}
|
|
|
|
caddy_data_luks = merge(
|
|
{
|
|
name = "encrypted-${local.caddy_data_volume_name}"
|
|
device = "${local.data_device_path}1"
|
|
label = "encrypted-${local.caddy_data_volume_name}"
|
|
wipeVolume = false
|
|
},
|
|
var.luks_passphrase == "" ? {} : {
|
|
keyFile = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
var.luks_passphrase
|
|
)
|
|
},
|
|
},
|
|
var.luks_use_tpm2 ? {
|
|
clevis = {
|
|
tpm2 = true
|
|
}
|
|
} : {}
|
|
)
|
|
|
|
nextcloud_data_luks = merge(
|
|
{
|
|
name = "encrypted-${local.nextcloud_data_volume_name}"
|
|
device = "${local.data_device_path}2"
|
|
label = "encrypted-${local.nextcloud_data_volume_name}"
|
|
wipeVolume = false
|
|
},
|
|
var.luks_passphrase == "" ? {} : {
|
|
keyFile = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
var.luks_passphrase
|
|
)
|
|
}
|
|
},
|
|
var.luks_use_tpm2 ? {
|
|
clevis = {
|
|
tpm2 = true
|
|
}
|
|
} : {}
|
|
)
|
|
|
|
postgres_data_luks = merge(
|
|
{
|
|
name = "encrypted-${local.postgres_data_volume_name}"
|
|
device = "${local.data_device_path}3"
|
|
label = "encrypted-${local.postgres_data_volume_name}"
|
|
wipeVolume = false
|
|
},
|
|
var.luks_passphrase == "" ? {} : {
|
|
keyFile = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
var.luks_passphrase
|
|
)
|
|
}
|
|
},
|
|
var.luks_use_tpm2 ? {
|
|
clevis = {
|
|
tpm2 = true
|
|
}
|
|
} : {}
|
|
)
|
|
|
|
valkey_data_luks = merge(
|
|
{
|
|
name = "encrypted-${local.valkey_data_volume_name}"
|
|
device = "${local.data_device_path}4"
|
|
label = "encrypted-${local.valkey_data_volume_name}"
|
|
wipeVolume = false
|
|
},
|
|
var.luks_passphrase == "" ? {} : {
|
|
keyFile = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
var.luks_passphrase
|
|
)
|
|
}
|
|
},
|
|
var.luks_use_tpm2 ? {
|
|
clevis = {
|
|
tpm2 = true
|
|
}
|
|
} : {}
|
|
)
|
|
|
|
caddy_data_filesystem = {
|
|
device = "/dev/disk/by-id/dm-name-encrypted-${local.caddy_data_volume_name}"
|
|
format = "ext4"
|
|
label = local.caddy_data_volume_name
|
|
wipeFilesystem = false
|
|
}
|
|
|
|
nextcloud_data_filesystem = {
|
|
device = "/dev/disk/by-id/dm-name-encrypted-${local.nextcloud_data_volume_name}"
|
|
format = "ext4"
|
|
label = local.nextcloud_data_volume_name
|
|
wipeFilesystem = false
|
|
}
|
|
|
|
postgres_data_filesystem = {
|
|
device = "/dev/disk/by-id/dm-name-encrypted-${local.postgres_data_volume_name}"
|
|
format = "ext4"
|
|
label = local.postgres_data_volume_name
|
|
wipeFilesystem = false
|
|
}
|
|
|
|
valkey_data_filesystem = {
|
|
device = "/dev/disk/by-id/dm-name-encrypted-${local.valkey_data_volume_name}"
|
|
format = "ext4"
|
|
label = local.valkey_data_volume_name
|
|
wipeFilesystem = false
|
|
options = [
|
|
"-E", "root_owner=999:999",
|
|
]
|
|
}
|
|
|
|
hostname_file = {
|
|
path = "/etc/hostname"
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 420 # 0644
|
|
contents = {
|
|
source = "data:text/plain,nextcloud"
|
|
}
|
|
}
|
|
|
|
hosts_file = {
|
|
path = "/etc/hosts"
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 420 # 0644
|
|
append = [
|
|
{
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
base64encode(
|
|
"${var.reverse_proxy_ip_address} ${var.nextcloud_domain}"
|
|
)
|
|
)
|
|
}
|
|
]
|
|
}
|
|
|
|
caddy_frontend_network_file = {
|
|
path = "/etc/containers/systemd/caddy-frontend.network"
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 420 # 0644
|
|
contents = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
base64encode(
|
|
file("${path.module}/files/caddy-frontend.network")
|
|
)
|
|
)
|
|
}
|
|
}
|
|
|
|
caddy_backend_network_file = {
|
|
path = "/etc/containers/systemd/caddy-backend.network"
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 420 # 0644
|
|
contents = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
base64encode(
|
|
file("${path.module}/files/caddy-backend.network")
|
|
)
|
|
)
|
|
}
|
|
}
|
|
|
|
nextcloud_backend_network_file = {
|
|
path = "/etc/containers/systemd/nextcloud-backend.network"
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 420 # 0644
|
|
contents = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
base64encode(
|
|
file("${path.module}/files/nextcloud-backend.network")
|
|
)
|
|
)
|
|
}
|
|
}
|
|
|
|
nextcloud_internet_network_file = {
|
|
path = "/etc/containers/systemd/nextcloud-internet.network"
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 420 # 0644
|
|
contents = {
|
|
source = format(
|
|
"data:text/plein;base64,%s",
|
|
base64encode(
|
|
file("${path.module}/files/nextcloud-internet.network")
|
|
)
|
|
)
|
|
}
|
|
}
|
|
|
|
caddy_data_volume_file = {
|
|
path = "/etc/containers/systemd/caddy-data.volume"
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 420 # 0644
|
|
contents = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
base64encode(
|
|
templatefile(
|
|
"${path.module}/files/caddy-data.volume.tftpl",
|
|
{
|
|
caddy_data_volume_name = local.caddy_data_volume_name
|
|
|
|
}
|
|
)
|
|
)
|
|
)
|
|
}
|
|
}
|
|
|
|
nextcloud_data_volume_file = {
|
|
path = "/etc/containers/systemd/nextcloud-data.volume"
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 420 # 0644
|
|
contents = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
base64encode(
|
|
templatefile(
|
|
"${path.module}/files/nextcloud-data.volume.tftpl",
|
|
{
|
|
nextcloud_data_volume_name = local.nextcloud_data_volume_name
|
|
|
|
}
|
|
)
|
|
)
|
|
)
|
|
}
|
|
}
|
|
|
|
postgres_data_volume_file = {
|
|
path = "/etc/containers/systemd/postgres-data.volume"
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 420 # 0644
|
|
contents = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
base64encode(
|
|
templatefile(
|
|
"${path.module}/files/postgres-data.volume.tftpl",
|
|
{
|
|
postgres_data_volume_name = local.postgres_data_volume_name
|
|
|
|
}
|
|
)
|
|
)
|
|
)
|
|
}
|
|
}
|
|
|
|
valkey_data_volume_file = {
|
|
path = "/etc/containers/systemd/valkey-data.volume"
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 420 # 0644
|
|
contents = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
base64encode(
|
|
templatefile(
|
|
"${path.module}/files/valkey-data.volume.tftpl",
|
|
{
|
|
valkey_data_volume_name = local.valkey_data_volume_name
|
|
|
|
}
|
|
)
|
|
)
|
|
)
|
|
}
|
|
}
|
|
|
|
caddy_container_file = {
|
|
path = "/etc/containers/systemd/caddy.container"
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 420 # 0644
|
|
contents = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
base64encode(
|
|
templatefile(
|
|
"${path.module}/files/caddy.container.tftpl",
|
|
{
|
|
caddy_container_name = local.caddy_container_name
|
|
caddy_image_name = local.caddy_image_name
|
|
caddy_image_tag = local.caddy_image_tag
|
|
caddyfile_file_path = local.caddyfile_file_path
|
|
}
|
|
)
|
|
)
|
|
)
|
|
}
|
|
}
|
|
|
|
nextcloud_container_file = {
|
|
path = "/etc/containers/systemd/nextcloud.container"
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 420 # 0644
|
|
contents = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
base64encode(
|
|
templatefile(
|
|
"${path.module}/files/nextcloud.container.tftpl",
|
|
{
|
|
nextcloud_container_name = local.nextcloud_container_name
|
|
nextcloud_image_name = local.nextcloud_image_name
|
|
nextcloud_image_tag = local.nextcloud_image_tag
|
|
postgres_env_file_path = local.postgres_env_file_path
|
|
postgres_container_name = local.postgres_container_name
|
|
postgres_password_secret_name = local.postgres_password_secret_name
|
|
valkey_container_name = local.valkey_container_name
|
|
nextcloud_trusted_domains = join(" ", var.nextcloud_trusted_domains)
|
|
php_upload_limit = "2048M" # variable ?
|
|
php_fpm_config_file_path = local.php_fpm_config_file_path
|
|
nextcloud_trusted_proxies = "10.0.0.0/8"
|
|
}
|
|
)
|
|
)
|
|
)
|
|
}
|
|
}
|
|
|
|
postgres_container_file = {
|
|
path = "/etc/containers/systemd/postgres.container"
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 420 # 0644
|
|
contents = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
base64encode(
|
|
templatefile(
|
|
"${path.module}/files/postgres.container.tftpl",
|
|
{
|
|
postgres_container_name = local.postgres_container_name
|
|
postgres_image_name = local.postgres_image_name
|
|
postgres_image_tag = local.postgres_image_tag
|
|
postgres_env_file_path = local.postgres_env_file_path
|
|
postgres_password_secret_name = local.postgres_password_secret_name
|
|
}
|
|
)
|
|
)
|
|
)
|
|
}
|
|
}
|
|
|
|
valkey_container_file = {
|
|
path = "/etc/containers/systemd/valkey.container"
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 420 # 0644
|
|
contents = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
base64encode(
|
|
templatefile(
|
|
"${path.module}/files/valkey.container.tftpl",
|
|
{
|
|
valkey_container_name = local.valkey_container_name
|
|
valkey_image_name = local.valkey_image_name
|
|
valkey_image_tag = local.valkey_image_tag
|
|
}
|
|
)
|
|
)
|
|
)
|
|
}
|
|
}
|
|
|
|
caddyfile_dir = {
|
|
path = local.caddyfile_dir_path
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 493 # 0755
|
|
}
|
|
|
|
caddyfile_file = {
|
|
path = local.caddyfile_file_path
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 420 # 0644
|
|
contents = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
base64encode(
|
|
templatefile(
|
|
"${path.module}/files/Caddyfile.tftpl",
|
|
{
|
|
nextcloud_domain = var.nextcloud_domain
|
|
nextcloud_container_name = local.nextcloud_container_name
|
|
}
|
|
)
|
|
)
|
|
)
|
|
}
|
|
}
|
|
|
|
postgres_env_file = {
|
|
path = local.postgres_env_file_path
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 420 # 0644
|
|
contents = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
base64encode(
|
|
templatefile(
|
|
"${path.module}/files/postgres.env.tftpl",
|
|
{
|
|
postgres_user_name = "nextcloud"
|
|
postgres_database_name = "nextcloud"
|
|
}
|
|
)
|
|
)
|
|
)
|
|
}
|
|
}
|
|
|
|
php_config_dir = {
|
|
path = local.php_fpm_config_dir_path
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 493 # 0755
|
|
}
|
|
|
|
php_fpm_config_file = {
|
|
path = "/opt/php/www.conf"
|
|
user = { id = 0 }
|
|
group = { id = 0 }
|
|
mode = 420 # 0644
|
|
contents = {
|
|
source = format(
|
|
"data:text/plain;base64,%s",
|
|
base64encode(
|
|
file("${path.module}/files/php-fpm-www.conf")
|
|
)
|
|
)
|
|
}
|
|
}
|
|
|
|
generate_secrets_systemd_unit = {
|
|
name = "generate-secrets.service"
|
|
enabled = true
|
|
contents = templatefile(
|
|
"${path.module}/files/generate-secrets.service.tftpl",
|
|
{
|
|
postgres_password_secret_name = local.postgres_password_secret_name
|
|
}
|
|
)
|
|
}
|
|
|
|
nextcloud_cronjob_service_unit = {
|
|
name = "nextcloud-cronjob.service"
|
|
contents = templatefile(
|
|
"${path.module}/files/nextcloud-cronjob.service.tftpl",
|
|
{
|
|
nextcloud_container_name = local.nextcloud_container_name
|
|
}
|
|
)
|
|
}
|
|
|
|
nextcloud_cronjob_timer_unit = {
|
|
name = "nextcloud-cronjob.timer"
|
|
enabled = true
|
|
contents = file("${path.module}/files/nextcloud-cronjob.timer")
|
|
}
|
|
|
|
ignition_config = {
|
|
ignition = {
|
|
version = "3.5.0"
|
|
}
|
|
storage = {
|
|
luks = [
|
|
local.caddy_data_luks,
|
|
local.nextcloud_data_luks,
|
|
local.postgres_data_luks,
|
|
local.valkey_data_luks,
|
|
]
|
|
disks = [
|
|
local.data_disk,
|
|
]
|
|
filesystems = [
|
|
local.caddy_data_filesystem,
|
|
local.nextcloud_data_filesystem,
|
|
local.postgres_data_filesystem,
|
|
local.valkey_data_filesystem,
|
|
]
|
|
directories = [
|
|
local.caddyfile_dir,
|
|
local.php_config_dir,
|
|
]
|
|
files = [
|
|
local.hostname_file,
|
|
local.hosts_file,
|
|
local.caddy_frontend_network_file,
|
|
local.caddy_backend_network_file,
|
|
local.nextcloud_backend_network_file,
|
|
local.nextcloud_internet_network_file,
|
|
local.caddy_data_volume_file,
|
|
local.nextcloud_data_volume_file,
|
|
local.postgres_data_volume_file,
|
|
local.valkey_data_volume_file,
|
|
local.caddy_container_file,
|
|
local.nextcloud_container_file,
|
|
local.postgres_container_file,
|
|
local.valkey_container_file,
|
|
local.caddyfile_file,
|
|
local.postgres_env_file,
|
|
local.php_fpm_config_file,
|
|
]
|
|
}
|
|
systemd = {
|
|
units = [
|
|
local.generate_secrets_systemd_unit,
|
|
local.nextcloud_cronjob_service_unit,
|
|
local.nextcloud_cronjob_timer_unit,
|
|
]
|
|
}
|
|
passwd = {
|
|
users = [
|
|
{
|
|
name = "core"
|
|
sshAuthorizedKeys = var.ssh_authorized_keys
|
|
}
|
|
]
|
|
}
|
|
}
|
|
} |