Mop/terraform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add base terraform config

Browse Source
This commit is contained in:
Julien Aldon
2026-09-08 12:23:37 +02:00
parent a56911b896
commit 98793acc62
30 changed files with 255 additions and 886 deletions
Download Patch File Download Diff File Expand all files Collapse all files

234
gateway/lib/scripts/services.yml Normal file
View File

@@ -0,0 +1,234 @@
http:
routers:
http-catchall:
rule: "HostRegexp(`{host:.+}`)"
entryPoints:
- web
middlewares:
- redirect-to-https
service: noop
amap:
rule: "Host(`amap.aldon.fr`)"
entryPoints:
- websecure
service: amap
tls:
certResolver: letsencrypt
middlewares:
- redirect-errors
bookshelf:
rule: "Host(`bookshelf.aldon.fr`)"
entryPoints:
- websecure
service: bookshelf
tls:
certResolver: letsencrypt
middlewares:
- redirect-errors
fefan:
rule: "Host(`fefan.fr`)"
entryPoints:
- websecure
service: fefan
tls:
certResolver: letsencrypt
middlewares:
- redirect-errors
content-fefan:
rule: "Host(`content.fefan.fr`)"
entryPoints:
- websecure
service: content-fefan
tls:
certResolver: letsencrypt
middlewares:
- redirect-errors
gitea:
rule: "Host(`gitea.aldon.fr`)"
entryPoints:
- websecure
service: gitea
tls:
certResolver: letsencrypt
middlewares:
- redirect-errors
listmonk:
rule: "Host(`listmonk.fefan.fr`)"
entryPoints:
- websecure
service: listmonk
tls:
certResolver: letsencrypt
middlewares:
- redirect-errors
aldon-http:
rule: "Host(`aldon.fr`)"
entryPoints:
- web
middlewares:
- redirect-to-aldon
service: noop
aldon:
rule: "Host(`aldon.fr`)"
entryPoints:
- websecure
service: noop
tls:
certResolver: letsencrypt
middlewares:
- redirect-to-aldon
- redirect-errors
nextcloud:
rule: "Host(`nextcloud.aldon.fr`)"
entryPoints:
- websecure
service: nextcloud
tls:
certResolver: letsencrypt
middlewares:
- redirect-errors
rocket:
rule: "Host(`discussion.fefan.fr`)"
entryPoints:
- websecure
service: rocket
tls:
certResolver: letsencrypt
middlewares:
- redirect-errors
mathieu:
rule: "Host(`mathieu.wiki`)"
entryPoints:
- websecure
service: noop
tls:
certResolver: letsencrypt
middlewares:
- redirect-to-mathieu
- redirect-errors
mathieu-http:
rule: "Host(`mathieu.wiki`)"
entryPoints:
- web
middlewares:
- redirect-to-mathieu
service: noop
wiki:
rule: "Host(`benoit.mathieu.wiki`)"
entryPoints:
- websecure
service: wiki
tls:
certResolver: letsencrypt
middlewares:
- redirect-errors
vaultwarden:
rule: "Host(`vaultwarden.aldon.fr`)"
entryPoints:
- websecure
service: vaultwarden
tls:
certResolver: letsencrypt
middlewares:
- redirect-errors
keycloak:
rule: "Host(`keycloak.aldon.fr`)"
entryPoints:
- websecure
service: keycloak
tls:
certResolver: letsencrypt
middlewares:
- redirect-errors
services:
amap:
loadBalancer:
passHostHeader: true
servers:
- url: "http://192.168.1.96:80"
bookshelf:
loadBalancer:
passHostHeader: true
servers:
- url: "http://192.168.1.91:80"
fefan:
loadBalancer:
passHostHeader: true
servers:
- url: "http://192.168.1.92:3000"
content-fefan:
loadBalancer:
passHostHeader: true
servers:
- url: "http://192.168.1.92:1337"
gitea:
loadBalancer:
passHostHeader: true
servers:
- url: "http://192.168.1.90:3000"
listmonk:
loadBalancer:
passHostHeader: true
servers:
- url: "http://192.168.1.93:9000"
noop:
loadBalancer:
servers:
- url: "http://127.0.0.1"
nextcloud:
loadBalancer:
passHostHeader: true
servers:
- url: "http://192.168.1.30:11000"
rocket:
loadBalancer:
passHostHeader: true
servers:
- url: "http://192.168.1.15:3000"
wiki:
loadBalancer:
passHostHeader: true
servers:
- url: "http://192.168.1.38:8080"
vaultwarden:
loadBalancer:
passHostHeader: true
servers:
- url: "http://192.168.1.36:80"
keycloak:
loadBalancer:
passHostHeader: true
servers:
- url: "http://192.168.1.34:8080"
error-handler-service:
loadBalancer:
passHostHeader: true
servers:
- url: "http://127.0.0.1:8090"
middlewares:
redirect-to-mathieu:
redirectRegex:
regex: "^https?://mathieu.wiki/(.*)"
replacement: "https://benoit.mathieu.wiki/$1"
permanent: true
redirect-to-aldon:
redirectRegex:
regex: "^https?://aldon.fr/(.*)"
replacement: "https://julien.aldon.fr/$1"
permanent: true
redirect-to-https:
redirectScheme:
scheme: https
redirect-errors:
errors:
status:
- "500"
- "501"
- "503"
- "502"
service: error-handler-service
query: "/502.html"

50
main.tf
View File

@@ -29,7 +29,7 @@ locals {
}
resource "local_file" "traefik_config" {
filename = "${path.module}/services.yml"
filename = "${path.module}/gateway/lib/scripts/services.yml"
content = templatefile("${path.module}/templates/traefik.services.tpl", {
services = local.traefik_services
@@ -46,7 +46,7 @@ resource "null_resource" "deploy_traefik_config" {
}
provisioner "file" {
source = "${path.module}/services.yml"
source = "${path.module}/gateway/lib/scripts/services.yml"
destination = "/home/gateway/services.yaml"
connection {
@@ -203,52 +203,6 @@ module "amap" {
proxmox_host_ip = var.proxmox_host_ip
}
# module "n8n" {
# source = "./modules/apps/n8n"
# providers = {}
# vm_ip_address = "192.168.1.94"
# depends_on = []
# name = "n8n"
# hostname = "n8n"
# domain = "mathieu.wiki"
# vm_id = 215
# node_name = "mop"
# template_id = 103
# cores = 1
# memory = 1024
# balloon = 512
# disk_size = 16
# ssh_public_key = var.ssh_public_key
# proxmox_host_ip = var.proxmox_host_ip
# }
# module "windmill" {
# source = "./modules/apps/windmill"
# providers = {}
# vm_ip_address = "192.168.1.94"
# depends_on = []
# name = "windmill"
# hostname = "windmill"
# domain = "aldon.fr"
# vm_id = 215
# node_name = "mop"
# template_id = 103
# cores = 1
# memory = 2048
# balloon = 1024
# disk_size = 16
# ssh_public_key = var.ssh_public_key
# proxmox_host_ip = var.proxmox_host_ip
# }
# module "keycloak" {
# source = "./modules/apps/keycloak"
# providers = {}

2
modules/apps/amap/main.tf
View File

@@ -26,7 +26,7 @@ module "vm" {
restore-backup-script = indent(6, file("${path.module}/lib/scripts/restore-backup.sh"))
restore-backup-service = indent(6, file("${path.module}/../common/services/docker/restore-backup.service"))
create-backup-script = indent(6, file("${path.module}/lib/scripts/create-backup.sh"))
create-backup-service = indent(6, file("${path.module}}/../common/services/docker/create-backup.service"))
create-backup-service = indent(6, file("${path.module}/../common/services/docker/create-backup.service"))
create-backup-timer = indent(6, file("${path.module}/../common/services/create-backup.timer"))
act_runner-service = indent(6, file("${path.module}/../common/services/act_runner.service"))

2
modules/apps/bookshelf/main.tf
View File

@@ -26,7 +26,7 @@ module "vm" {
restore-backup-script = indent(6, file("${path.module}/lib/scripts/restore-backup.sh"))
restore-backup-service = indent(6, file("${path.module}/../common/services/docker/restore-backup.service"))
create-backup-script = indent(6, file("${path.module}/lib/scripts/create-backup.sh"))
create-backup-service = indent(6, file("${path.module}}/../common/services/docker/create-backup.service"))
create-backup-service = indent(6, file("${path.module}/../common/services/docker/create-backup.service"))
create-backup-timer = indent(6, file("${path.module}/../common/services/create-backup.timer"))
act_runner-service = indent(6, file("${path.module}/../common/services/act_runner.service"))

2
modules/apps/fefan/main.tf
View File

@@ -26,7 +26,7 @@ module "vm" {
restore-backup-script = indent(6, file("${path.module}/lib/scripts/restore-backup.sh"))
restore-backup-service = indent(6, file("${path.module}/../common/services/docker/restore-backup.service"))
create-backup-script = indent(6, file("${path.module}/lib/scripts/create-backup.sh"))
create-backup-service = indent(6, file("${path.module}}/../common/services/docker/create-backup.service"))
create-backup-service = indent(6, file("${path.module}/../common/services/docker/create-backup.service"))
create-backup-timer = indent(6, file("${path.module}/../common/services/create-backup.timer"))
act_runner-service = indent(6, file("${path.module}/../common/services/act_runner.service"))

7
modules/apps/gateway/lib/scripts/install-crowdsec.sh
View File

@@ -3,11 +3,18 @@ set -e
sudo apt update
sudo apt install -y curl gnupg lsb-release
curl -s https://install.crowdsec.net | sudo bash
sudo apt install crowdsec-firewall-bouncer-nftables
sudo apt install crowdsec
sudo cscli collections install crowdsecurity/linux --force
sudo cscli collections install crowdsecurity/traefik
sudo cscli collections install crowdsecurity/http-cve
sudo cscli collections install crowdsecurity/base-http-scenarios
sudo cscli collections install crowdsecurity/whitelist-good-actors
sudo cscli collections install crowdsecurity/sshd
sudo cscli parsers install crowdsecurity/geoip-enrich
sudo cscli parsers install crowdsecurity/sshd-logs
sudo systemctl enable crowdsec
sudo systemctl restart crowdsec

5
modules/apps/gateway/lib/scripts/install-traefik.sh
View File

@@ -40,6 +40,11 @@ cat > "$TRAEFIK_CONF" <<EOF
entryPoints:
web:
address: ":80"
http:
redirections:
entrypoint:
to: websecure
scheme: https
websecure:
address: ":443"
providers:

4
modules/apps/gateway/main.tf
View File

@@ -30,8 +30,8 @@ module "vm" {
restore-backup-script = indent(6, file("${path.module}/lib/scripts/restore-backup.sh"))
restore-backup-service = indent(6, file("${path.module}/../common/services/docker/restore-backup.service"))
create-backup-script = indent(6, file("${path.module}/lib/scripts/create-backup.sh"))
create-backup-service = indent(6, file("${path.module}}/../common/services/docker/create-backup.service"))
create-backup-timer = indent(6, file("${path.module}}/../common/services/create-backup.timer"))
create-backup-service = indent(6, file("${path.module}/../common/services/docker/create-backup.service"))
create-backup-timer = indent(6, file("${path.module}/../common/services/create-backup.timer"))
nginx-error-configuration = indent(6, file("${path.module}/lib/scripts/default"))
nginx-error-502 = indent(6, file("${path.module}/lib/scripts/502.html"))
env-file-content = indent(6, file("${path.module}/.env"))

2
modules/apps/girasol/main.tf
View File

@@ -26,7 +26,7 @@ module "vm" {
restore-backup-script = indent(6, file("${path.module}/lib/scripts/restore-backup.sh"))
restore-backup-service = indent(6, file("${path.module}/../common/services/docker/restore-backup.service"))
create-backup-script = indent(6, file("${path.module}/lib/scripts/create-backup.sh"))
create-backup-service = indent(6, file("${path.module}}/../common/services/docker/create-backup.service"))
create-backup-service = indent(6, file("${path.module}/../common/services/docker/create-backup.service"))
create-backup-timer = indent(6, file("${path.module}/../common/services/create-backup.timer"))
act_runner-service = indent(6, file("${path.module}/../common/services/act_runner.service"))

0
modules/apps/n8n/.env.example
View File

91
modules/apps/n8n/cloud-init/service.yaml
View File

@@ -1,91 +0,0 @@
#cloud-config
hostname: ${hostname}
local-hostname: ${hostname}
fqdn: ${hostname}.${domain}
manage_etc_hosts: true
groups:
- git
users:
- default
- name: ${hostname}
groups: sudo,git
shell: /bin/bash
sudo: ALL=(ALL) NOPASSWD:ALL
ssh_authorized_keys:
- ${ssh_key}
disable_root: true
package_update: true
package_upgrade: false
packages:
- git
- nfs-common
- curl
- ca-certificates
- gnupg
- unzip
- postgresql
- postgresql-client
mounts:
- [ "192.168.1.12:/main/backups", "/backups", "nfs", "defaults,_netdev,x-systemd.requires=network-online.target", "0", "0" ]
write_files:
- path: /opt/environment/.env
permissions: "0644"
content: |
${env-file-content}
- path: /usr/local/bin/restore-backup.sh
permissions: "0755"
content: |
${restore-backup-script}
- path: /etc/systemd/system/restore-backup.service
permissions: "0644"
content: |
${restore-backup-service}
- path: /usr/local/bin/backup.sh
permissions: "0755"
content: |
${create-backup-script}
- path: /etc/systemd/system/create-backup.timer
permissions: "0644"
content: |
${create-backup-timer}
- path: /etc/systemd/system/create-backup.service
permissions: "0644"
content: |
${create-backup-service}
- path: /opt/n8n/install-n8n.sh
permissions: "0755"
content: |
${install-n8n-script}
- path: /opt/n8n/install-docker.sh
permissions: "0755"
content: |
${install-docker-script}
- path: /home/n8n/docker-compose.yaml
permissions: "0755"
content: |
${n8n-docker-compose}
- path: /home/n8n/init-data.sh
permissions: "0755"
content: |
${n8n-init-data}
runcmd:
# Docker install
- /opt/n8n/install-docker.sh
# Backup setup
- mkdir -p /backups
- mount -t nfs ${proxmox_host_ip}:/main/backups /backups
- systemctl enable --now create-backup.timer
# Install n8n
- /opt/n8n/install-n8n.sh
final_message: |
Base system ready for ${hostname}

10
modules/apps/n8n/lib/scripts/create-backup.sh
View File

@@ -1,10 +0,0 @@
#!/bin/bash
set -euo pipefail
source /opt/environment/.env
TIMESTAMP=$(date +'%Y-%m-%d_%H%M%S')
sudo -u $USERNAME docker exec -i n8n-postgres-1 pg_dump -F c -U $DB_USER -d $DB_NAME > $SERVICE_BACKUPS_DIR/$SERVICE_BACKUPS_PREFIX-$TIMESTAMP.$SERVICE_BACKUPS_EXTENSION
ls -1dt $SERVICE_BACKUPS_DIR/$SERVICE_BACKUPS_PREFIX-*.$SERVICE_BACKUPS_EXTENSION | tail -n +5 | xargs -r rm -f

8
modules/apps/n8n/lib/scripts/init-data.sh
View File

@@ -1,8 +0,0 @@
#!/bin/bash
set -e
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" <<-EOSQL
CREATE USER $POSTGRES_NON_ROOT_USER WITH PASSWORD '$POSTGRES_NON_ROOT_PASSWORD';
CREATE DATABASE $POSTGRES_DB;
GRANT ALL PRIVILEGES ON DATABASE $POSTGRES_DB TO $POSTGRES_NON_ROOT_USER;
EOSQL

11
modules/apps/n8n/lib/scripts/install-n8n.sh
View File

@@ -1,11 +0,0 @@
#!/bin/bash
#https://docs.n8n.io/hosting/installation/docker/#using-with-postgresql
set -euo pipefail
source /opt/environment/.env
cd $SERVICE_WORKDIR
cp /opt/environment/.env $SERVICE_WORKDIR/.env
docker-compose up -d

10
modules/apps/n8n/lib/scripts/restore-backup.sh
View File

@@ -1,10 +0,0 @@
#!/bin/bash
set -euo pipefail
source /opt/environment/.env
LATEST_BACKUP=$(ls -1 $SERVICE_BACKUPS_DIR/$SERVICE_BACKUPS_PREFIX-*.$SERVICE_BACKUPS_EXTENSION 2>/dev/null | sort | tail -n1)
if [ -n "$LATEST_BACKUP" ] && [ -f "$LATEST_BACKUP" ]; then
sudo -u $USERNAME docker exec -i n8n-postgres-1 pg_restore --clean --if-exists -U "$DB_USER" -v -d "$DB_NAME" < $LATEST_BACKUP
fi

54
modules/apps/n8n/lib/services/docker-compose.yaml
View File

@@ -1,54 +0,0 @@
volumes:
db_storage:
n8n_storage:
services:
postgres:
image: postgres:16
restart: always
environment:
- POSTGRES_USER=${POSTGRES_USER}
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
- POSTGRES_DB=${POSTGRES_DB}
- POSTGRES_NON_ROOT_USER=${POSTGRES_NON_ROOT_USER}
- POSTGRES_NON_ROOT_PASSWORD=${POSTGRES_NON_ROOT_PASSWORD}
volumes:
- db_storage:/var/lib/postgresql/data
- ./init-data.sh:/docker-entrypoint-initdb.d/init-data.sh
healthcheck:
test: ['CMD-SHELL', 'pg_isready -h localhost -U ${POSTGRES_USER} -d ${POSTGRES_DB}']
interval: 5s
timeout: 5s
retries: 10
n8n:
image: docker.n8n.io/n8nio/n8n:${N8N_VERSION}
restart: always
environment:
- DB_TYPE=postgresdb
- DB_POSTGRESDB_HOST=postgres
- DB_POSTGRESDB_PORT=5432
- DB_POSTGRESDB_DATABASE=${POSTGRES_DB}
- DB_POSTGRESDB_USER=${POSTGRES_USER}
- DB_POSTGRESDB_PASSWORD=${POSTGRES_PASSWORD}
- N8N_RUNNERS_MODE=external
- N8N_RUNNERS_AUTH_TOKEN=${RUNNERS_AUTH_TOKEN}
- N8N_RUNNERS_BROKER_LISTEN_ADDRESS=0.0.0.0
ports:
- 5678:5678
links:
- postgres
volumes:
- n8n_storage:/home/node/.n8n
depends_on:
postgres:
condition: service_healthy
n8n-runner:
image: n8nio/runners:${N8N_VERSION}
restart: always
environment:
- N8N_RUNNERS_AUTH_TOKEN=${RUNNERS_AUTH_TOKEN}
- N8N_RUNNERS_TASK_BROKER_URI=http://n8n:5679
depends_on:
- n8n

39
modules/apps/n8n/main.tf
View File

@@ -1,39 +0,0 @@
module "vm" {
source = "../../vm"
name = var.name
hostname = var.hostname
domain = var.domain
vm_id = var.vm_id
node_name = var.node_name
vm_ip_address = var.vm_ip_address
template_id = var.template_id
cores = var.cores
memory = var.memory
disk_size = var.disk_size
ssh_public_key = var.ssh_public_key
proxmox_host_ip = var.proxmox_host_ip
cloudinit_config = templatefile(
"${path.module}/cloud-init/service.yaml",
{
hostname = var.hostname
domain = var.domain
ssh_key = var.ssh_public_key
proxmox_host_ip = var.proxmox_host_ip
restore-backup-script = indent(6, file("${path.module}/lib/scripts/restore-backup.sh"))
restore-backup-service = indent(6, file("${path.module}/../common/services/docker/restore-backup.service"))
create-backup-script = indent(6, file("${path.module}/lib/scripts/create-backup.sh"))
create-backup-timer = indent(6, file("${path.module}/../common/services/create-backup.timer"))
create-backup-service = indent(6, file("${path.module}/../common/services/docker/create-backup.service"))
install-n8n-script = indent(6, file("${path.module}/lib/scripts/install-n8n.sh"))
install-docker-script = indent(6, file("${path.module}/../common/scripts/install-docker.sh"))
n8n-docker-compose = indent(6, file("${path.module}/lib/services/docker-compose.yaml"))
n8n-init-data = indent(6, file("${path.module}/lib/scripts/init-data.sh"))
env-file-content = indent(6, file("${path.module}/.env"))
}
)
}

9
modules/apps/n8n/output.tf
View File

@@ -1,9 +0,0 @@
output "traefik_service" {
value = [{
domain = var.domain
name = var.name
host = "${var.hostname}"
ip = var.vm_ip_address
port = 5678
}]
}

71
modules/apps/n8n/variables.tf
View File

@@ -1,71 +0,0 @@
variable "name" {
description = "Virtual Machine name"
type = string
}
variable "vm_id" {
description = "Virtual Machine id"
type = number
}
variable "node_name" {
description = "Proxmox node name"
type = string
default = "mop"
}
variable "cores" {
description = "Number of CPU cores for this virtual machine"
type = number
default = 2
}
variable "memory" {
description = "Memory RAM for this virtual machine"
type = number
default = 2048
}
variable "balloon" {
description = "Minimum vm memory, using ballooning devide to reach Proxmox node memory target."
type = number
default = 1024
}
variable "template_id" {
description = "Virtual machine template ID"
type = number
}
variable "ssh_public_key" {
description = "Public SSH key for cloud-init user"
type = string
}
variable "hostname" {
description = "Virtual Machine hostname (<service-name>)"
type = string
default = "test"
}
variable "domain" {
description = "Virtual Machine domain (example.fr)"
type = string
default = ""
}
variable "disk_size" {
description = "Disk size for the virtual machine"
type = number
default = 10
}
variable "proxmox_host_ip" {
description = "Proxmox host base ip"
type = string
}
variable "vm_ip_address" {
description = "Virtual machine ip"
type = string
}

15
modules/apps/windmill/.env.example
View File

@@ -1,15 +0,0 @@
# Environment files
ENV_FILE_LOCATION=/opt/environment/.env
# Application specifics
DATABASE_URL=postgres://postgres:changeme@db/windmill?sslmode=disable
DB_USER=postgres
DB_NAME=windmill
DB_PASS=
WM_IMAGE=ghcr.io/windmill-labs/windmill:main
SERVICE_WORKDIR=/home/windmill
# Backup specifics
SERVICE_BACKUPS_DIR=/backups/windmill
SERVICE_BACKUPS_PREFIX=windmill-dump
SERVICE_BACKUPS_EXTENSION=dump

89
modules/apps/windmill/cloud-init/service.yaml
View File

@@ -1,89 +0,0 @@
#cloud-config
hostname: ${hostname}
local-hostname: ${hostname}
fqdn: ${hostname}.${domain}
manage_etc_hosts: true
groups:
- git
users:
- default
- name: ${hostname}
groups: sudo,git
shell: /bin/bash
sudo: ALL=(ALL) NOPASSWD:ALL
ssh_authorized_keys:
- ${ssh_key}
disable_root: true
package_update: true
package_upgrade: false
packages:
- git
- nfs-common
- curl
- unzip
- postgresql
- postgresql-client
mounts:
- [ "192.168.1.12:/main/backups", "/backups", "nfs", "defaults,_netdev,x-systemd.requires=network-online.target", "0", "0" ]
write_files:
- path: /opt/environment/.env
permissions: "0644"
content: |
${env-file-content}
- path: /opt/${hostname}/install-docker.sh
permissions: "0755"
content: |
${install-docker-script}
- path: /usr/local/bin/restore-backup.sh
permissions: "0755"
content: |
${restore-backup-script}
- path: /etc/systemd/system/restore-backup.service
permissions: "0644"
content: |
${restore-backup-service}
- path: /usr/local/bin/backup.sh
permissions: "0755"
content: |
${create-backup-script}
- path: /etc/systemd/system/create-backup.timer
permissions: "0644"
content: |
${create-backup-timer}
- path: /etc/systemd/system/create-backup.service
permissions: "0644"
content: |
${create-backup-service}
- path: /opt/windmill/install-windmill.sh
permissions: "0755"
content: |
${install-windmill-script}
- path: /home/windmill/docker-compose.yaml
permissions: "0755"
content: |
${windmill-docker-compose}
- path: /home/windmill/Caddyfile
permissions: "0755"
content: |
${windmill-caddyfile}
runcmd:
# Backup setup
- mkdir -p /backups
- mount -t nfs ${proxmox_host_ip}:/main/backups /backups
- systemctl enable --now create-backup.timer
# Docker setup
- /opt/${hostname}/install-docker.sh
# windmill setup
- /opt/windmill/install-windmill.sh
final_message: |
Base system ready for ${hostname}

15
modules/apps/windmill/lib/scripts/create-backup.sh
View File

@@ -1,15 +0,0 @@
#!/bin/bash
#SERVICE_BACKUPS_DIR
#SERVICE_BACKUPS_PREFIX
#SERVICE_BACKUPS_EXTENSION
set -euo pipefail
source /opt/environment/.env
TIMESTAMP=$(date +'%Y-%m-%d_%H%M%S')
# docker exec $DB_SERVICE
ls -1dt $SERVICE_BACKUPS_DIR/$SERVICE_BACKUPS_PREFIX-*.$SERVICE_BACKUPS_EXTENSION | tail -n +5 | xargs -r rm -f

11
modules/apps/windmill/lib/scripts/install-windmill.sh
View File

@@ -1,11 +0,0 @@
#!/bin/bash
#https://www.windmill.dev/docs/advanced/self_host
set -euo pipefail
source /opt/environment/.env
cd $SERVICE_WORKDIR
cp /opt/environment/.env $SERVICE_WORKDIR/.env
docker-compose up -d

20
modules/apps/windmill/lib/scripts/restore-backup.sh
View File

@@ -1,20 +0,0 @@
#!/bin/bash
#USERNAME
#SERVICE_BACKUPS_DIR
#SERVICE_BACKUPS_PREFIX
#SERVICE_BACKUPS_EXTENSION
#DB_USER
#DB_NAME
set -euo pipefail
source /opt/environment/.env
LATEST_BACKUP=$(ls -1 $SERVICE_BACKUPS_DIR/$SERVICE_BACKUPS_PREFIX-*.$SERVICE_BACKUPS_EXTENSION 2>/dev/null | sort | tail -n1)
if [ -n "$LATEST_BACKUP" ] && [ -f "$LATEST_BACKUP" ]; then
systemctl stop listmonk
sudo -u $USERNAME pg_restore --clean --if-exists -U "$DB_USER" -d "$DB_NAME" $LATEST_BACKUP
systemctl start listmonk
fi

35
modules/apps/windmill/lib/services/Caddyfile
View File

@@ -1,35 +0,0 @@
{
layer4 {
:25 {
proxy {
to windmill_server:2525
}
}
}
}
{$BASE_URL} {
bind {$ADDRESS}
# LSP - Language Server Protocol for code intelligence (windmill_extra:3001)
reverse_proxy /ws/* http://windmill_extra:3001
# Multiplayer - Real-time collaboration, Enterprise Edition (windmill_extra:3002)
# Uncomment and set ENABLE_MULTIPLAYER=true in docker-compose.yml
# reverse_proxy /ws_mp/* http://windmill_extra:3002
# Debugger - Interactive debugging via DAP WebSocket (windmill_extra:3003)
# Set ENABLE_DEBUGGER=true in docker-compose.yml to enable
handle_path /ws_debug/* {
reverse_proxy http://windmill_extra:3003
}
# Search indexer, Enterprise Edition (windmill_indexer:8002)
# reverse_proxy /api/srch/* http://windmill_indexer:8002
# Default: Windmill server
reverse_proxy /* http://windmill_server:8000
# TLS with custom certificates
# tls /certs/cert.pem /certs/key.pem
}

222
modules/apps/windmill/lib/services/docker-compose.yaml
View File

@@ -1,222 +0,0 @@
version: "3.7"
x-logging: &default-logging
driver: "json-file"
options:
max-size: "${LOG_MAX_SIZE:-20m}"
max-file: "${LOG_MAX_FILE:-10}"
compress: "true"
services:
db:
deploy:
# To use an external database, set replicas to 0 and set DATABASE_URL to the external database url in the .env file
replicas: 1
image: postgres:16
shm_size: 1g
restart: unless-stopped
volumes:
- db_data:/var/lib/postgresql/data
expose:
- 5432
environment:
POSTGRES_PASSWORD: ${DB_PASS}
POSTGRES_DB: ${DB_NAME}
healthcheck:
test: ["CMD-SHELL", "pg_isready -U postgres"]
interval: 10s
timeout: 5s
retries: 5
logging: *default-logging
windmill_server:
image: ${WM_IMAGE}
pull_policy: always
deploy:
replicas: 1
restart: unless-stopped
expose:
- 8000
- 2525
environment:
- DATABASE_URL=${DATABASE_URL}
- MODE=server
depends_on:
db:
condition: service_healthy
volumes:
- worker_logs:/tmp/windmill/logs
logging: *default-logging
windmill_worker:
image: ${WM_IMAGE}
pull_policy: always
deploy:
replicas: 3
resources:
limits:
cpus: "1"
memory: 2048M
# for GB, use syntax '2Gi'
restart: unless-stopped
# Uncomment to enable PID namespace isolation (recommended for security)
# Requires privileged mode for --mount-proc flag
# See: https://www.windmill.dev/docs/advanced/security_isolation
# privileged: true
environment:
- DATABASE_URL=${DATABASE_URL}
- MODE=worker
- WORKER_GROUP=default
# If running with non-root/non-windmill UID (e.g., user: "1001:1001"),
# add: - HOME=/tmp
# Uncomment to enable PID namespace isolation (requires privileged: true above)
# - ENABLE_UNSHARE_PID=true
depends_on:
db:
condition: service_healthy
# to mount the worker folder to debug, KEEP_JOB_DIR=true and mount /tmp/windmill
volumes:
# mount the docker socket to allow to run docker containers from within the workers
- /var/run/docker.sock:/var/run/docker.sock
- worker_dependency_cache:/tmp/windmill/cache
- worker_logs:/tmp/windmill/logs
logging: *default-logging
## This worker is specialized for "native" jobs. Native jobs run in-process and thus are much more lightweight than other jobs
windmill_worker_native:
# Use ghcr.io/windmill-labs/windmill-ee:main for the ee
image: ${WM_IMAGE}
pull_policy: always
deploy:
replicas: 1
resources:
limits:
cpus: "1"
memory: 2048M
# for GB, use syntax '2Gi'
restart: unless-stopped
# Uncomment to enable PID namespace isolation (recommended for security)
# Requires privileged mode for --mount-proc flag
# See: https://www.windmill.dev/docs/advanced/security_isolation
# privileged: true
environment:
- DATABASE_URL=${DATABASE_URL}
- MODE=worker
- WORKER_GROUP=native
- NUM_WORKERS=8
- SLEEP_QUEUE=200
# Uncomment to enable PID namespace isolation (requires privileged: true above)
# - ENABLE_UNSHARE_PID=true
depends_on:
db:
condition: service_healthy
volumes:
- worker_logs:/tmp/windmill/logs
logging: *default-logging
# This worker is specialized for reports or scraping jobs. It is assigned the "reports" worker group which has an init script that installs chromium and can be targeted by using the "chromium" worker tag.
# windmill_worker_reports:
# image: ${WM_IMAGE}
# pull_policy: always
# deploy:
# replicas: 1
# resources:
# limits:
# cpus: "1"
# memory: 2048M
# # for GB, use syntax '2Gi'
# restart: unless-stopped
# # Uncomment to enable PID namespace isolation (recommended for security)
# # Requires privileged mode for --mount-proc flag
# # See: https://www.windmill.dev/docs/advanced/security_isolation
# # privileged: true
# environment:
# - DATABASE_URL=${DATABASE_URL}
# - MODE=worker
# - WORKER_GROUP=reports
# # Uncomment to enable PID namespace isolation (requires privileged: true above)
# # - ENABLE_UNSHARE_PID=true
# depends_on:
# db:
# condition: service_healthy
# # to mount the worker folder to debug, KEEP_JOB_DIR=true and mount /tmp/windmill
# volumes:
# # mount the docker socket to allow to run docker containers from within the workers
# - /var/run/docker.sock:/var/run/docker.sock
# - worker_dependency_cache:/tmp/windmill/cache
# - worker_logs:/tmp/windmill/logs
# The indexer powers full-text job and log search, an EE feature.
windmill_indexer:
image: ${WM_IMAGE}
pull_policy: always
deploy:
replicas: 0 # set to 1 to enable full-text job and log search
restart: unless-stopped
expose:
- 8002
environment:
- PORT=8002
- DATABASE_URL=${DATABASE_URL}
- MODE=indexer
depends_on:
db:
condition: service_healthy
volumes:
- windmill_index:/tmp/windmill/search
- worker_logs:/tmp/windmill/logs
logging: *default-logging
# Combined extra services: LSP, Multiplayer, and Debugger
# Each service can be enabled/disabled via environment variables:
# - ENABLE_LSP=true (default) - Language Server Protocol for code intelligence
# - ENABLE_MULTIPLAYER=false - Real-time collaboration (Enterprise Edition)
# - ENABLE_DEBUGGER=false - Interactive debugging via DAP WebSocket
windmill_extra:
image: ghcr.io/windmill-labs/windmill-extra:latest
pull_policy: always
restart: unless-stopped
expose:
- 3001 # LSP
- 3002 # Multiplayer
- 3003 # Debugger
environment:
- ENABLE_LSP=true
- ENABLE_MULTIPLAYER=false # Set to true to enable multiplayer (Enterprise Edition)
- ENABLE_DEBUGGER=true # Set to true to enable debugger
- DEBUGGER_PORT=3003 # Debugger service port
- ENABLE_NSJAIL=false # Set to true for nsjail sandboxing (requires privileged: true)
- REQUIRE_SIGNED_DEBUG_REQUESTS=false # Set to true to require JWT tokens for debug sessions
- WINDMILL_BASE_URL=http://windmill_server:8000
volumes:
- lsp_cache:/pyls/.cache
logging: *default-logging
caddy:
image: ghcr.io/windmill-labs/caddy-l4:latest
restart: unless-stopped
# Configure the mounted Caddyfile and the exposed ports or use another reverse proxy if needed
volumes:
- ./Caddyfile:/etc/caddy/Caddyfile
- caddy_data:/data
# - ./certs:/certs # Provide custom certificate files like cert.pem and key.pem to enable HTTPS - See the corresponding section in the Caddyfile
ports:
# To change the exposed port, simply change 80:80 to <desired_port>:80. No other changes needed
- 80:80
- 25:25
# - 443:443 # Uncomment to enable HTTPS handling by Caddy
environment:
- BASE_URL=":80"
# - BASE_URL=":443" # uncomment and comment line above to enable HTTPS via custom certificate and key files
# - BASE_URL=mydomain.com # Uncomment and comment line above to enable HTTPS handling by Caddy
logging: *default-logging
volumes:
db_data: null
worker_dependency_cache: null
worker_logs: null
worker_memory: null
windmill_index: null
lsp_cache: null
caddy_data: null

41
modules/apps/windmill/main.tf
View File

@@ -1,41 +0,0 @@
module "vm" {
source = "../../vm"
name = var.name
hostname = var.hostname
domain = var.domain
vm_id = var.vm_id
node_name = var.node_name
vm_ip_address = var.vm_ip_address
template_id = var.template_id
cores = var.cores
memory = var.memory
disk_size = var.disk_size
ssh_public_key = var.ssh_public_key
proxmox_host_ip = var.proxmox_host_ip
cloudinit_config = templatefile(
"${path.module}/cloud-init/service.yaml",
{
hostname = var.hostname
domain = var.domain
ssh_key = var.ssh_public_key
proxmox_host_ip = var.proxmox_host_ip
restore-backup-script = indent(6, file("${path.module}/lib/scripts/restore-backup.sh"))
restore-backup-service = indent(6, file("${path.module}/../common/services/docker/restore-backup.service"))
create-backup-script = indent(6, file("${path.module}/lib/scripts/create-backup.sh"))
create-backup-timer = indent(6, file("${path.module}/../common/services/create-backup.timer"))
create-backup-service = indent(6, file("${path.module}/../common/services/docker/create-backup.service"))
install-windmill-script = indent(6, file("${path.module}/lib/scripts/install-windmill.sh"))
windmill-docker-compose = indent(6, file("${path.module}/lib/services/docker-compose.yaml"))
windmill-caddyfile = indent(6, file("${path.module}/lib/services/Caddyfile"))
install-docker-script = indent(6, file("${path.module}/../common/scripts/install-docker.sh"))
env-file-content = indent(6, file("${path.module}/.env"))
}
)
}

9
modules/apps/windmill/output.tf
View File

@@ -1,9 +0,0 @@
output "traefik_service" {
value = [{
domain = var.domain
name = var.name
host = "${var.hostname}"
ip = var.vm_ip_address
port = 80
}]
}

71
modules/apps/windmill/variables.tf
View File

@@ -1,71 +0,0 @@
variable "name" {
description = "Virtual Machine name"
type = string
}
variable "vm_id" {
description = "Virtual Machine id"
type = number
}
variable "node_name" {
description = "Proxmox node name"
type = string
default = "mop"
}
variable "cores" {
description = "Number of CPU cores for this virtual machine"
type = number
default = 2
}
variable "memory" {
description = "Memory RAM for this virtual machine"
type = number
default = 2048
}
variable "balloon" {
description = "Minimum vm memory, using ballooning devide to reach Proxmox node memory target."
type = number
default = 1024
}
variable "template_id" {
description = "Virtual machine template ID"
type = number
}
variable "ssh_public_key" {
description = "Public SSH key for cloud-init user"
type = string
}
variable "hostname" {
description = "Virtual Machine hostname (<service-name>)"
type = string
default = "test"
}
variable "domain" {
description = "Virtual Machine domain (example.fr)"
type = string
default = ""
}
variable "disk_size" {
description = "Disk size for the virtual machine"
type = number
default = 10
}
variable "proxmox_host_ip" {
description = "Proxmox host base ip"
type = string
}
variable "vm_ip_address" {
description = "Virtual machine ip"
type = string
}

2
terraform.tfvars.example
View File

@@ -1,4 +1,4 @@
ssh_public_key = "<ssh-public-key>"
proxmox_api_token = "<proxmox-api-token>"
proxmox_endpoint = "http://mop:8006"
proxmox_endpoint = "https://192.168.1.12:8006"
proxmox_host_ip = "192.168.1.121"