From 98793acc62bd8476fd364bd4f5fa8a86aafdd087 Mon Sep 17 00:00:00 2001 From: JulienAldon Date: Tue, 8 Sep 2026 12:23:37 +0200 Subject: [PATCH] Add base terraform config --- gateway/lib/scripts/services.yml | 234 ++++++++++++++++++ main.tf | 50 +--- modules/apps/amap/main.tf | 2 +- modules/apps/bookshelf/main.tf | 2 +- modules/apps/fefan/main.tf | 2 +- .../gateway/lib/scripts/install-crowdsec.sh | 7 + .../gateway/lib/scripts/install-traefik.sh | 5 + modules/apps/gateway/main.tf | 4 +- modules/apps/girasol/main.tf | 2 +- modules/apps/n8n/.env.example | 0 modules/apps/n8n/cloud-init/service.yaml | 91 ------- modules/apps/n8n/lib/scripts/create-backup.sh | 10 - modules/apps/n8n/lib/scripts/init-data.sh | 8 - modules/apps/n8n/lib/scripts/install-n8n.sh | 11 - .../apps/n8n/lib/scripts/restore-backup.sh | 10 - .../apps/n8n/lib/services/docker-compose.yaml | 54 ---- modules/apps/n8n/main.tf | 39 --- modules/apps/n8n/output.tf | 9 - modules/apps/n8n/variables.tf | 71 ------ modules/apps/windmill/.env.example | 15 -- modules/apps/windmill/cloud-init/service.yaml | 89 ------- .../windmill/lib/scripts/create-backup.sh | 15 -- .../windmill/lib/scripts/install-windmill.sh | 11 - .../windmill/lib/scripts/restore-backup.sh | 20 -- modules/apps/windmill/lib/services/Caddyfile | 35 --- .../windmill/lib/services/docker-compose.yaml | 222 ----------------- modules/apps/windmill/main.tf | 41 --- modules/apps/windmill/output.tf | 9 - modules/apps/windmill/variables.tf | 71 ------ terraform.tfvars.example | 2 +- 30 files changed, 255 insertions(+), 886 deletions(-) create mode 100644 gateway/lib/scripts/services.yml delete mode 100644 modules/apps/n8n/.env.example delete mode 100644 modules/apps/n8n/cloud-init/service.yaml delete mode 100644 modules/apps/n8n/lib/scripts/create-backup.sh delete mode 100644 modules/apps/n8n/lib/scripts/init-data.sh delete mode 100644 modules/apps/n8n/lib/scripts/install-n8n.sh delete mode 100644 modules/apps/n8n/lib/scripts/restore-backup.sh delete mode 100644 modules/apps/n8n/lib/services/docker-compose.yaml delete mode 100644 modules/apps/n8n/main.tf delete mode 100644 modules/apps/n8n/output.tf delete mode 100644 modules/apps/n8n/variables.tf delete mode 100644 modules/apps/windmill/.env.example delete mode 100644 modules/apps/windmill/cloud-init/service.yaml delete mode 100644 modules/apps/windmill/lib/scripts/create-backup.sh delete mode 100644 modules/apps/windmill/lib/scripts/install-windmill.sh delete mode 100644 modules/apps/windmill/lib/scripts/restore-backup.sh delete mode 100644 modules/apps/windmill/lib/services/Caddyfile delete mode 100644 modules/apps/windmill/lib/services/docker-compose.yaml delete mode 100644 modules/apps/windmill/main.tf delete mode 100644 modules/apps/windmill/output.tf delete mode 100644 modules/apps/windmill/variables.tf diff --git a/gateway/lib/scripts/services.yml b/gateway/lib/scripts/services.yml new file mode 100644 index 0000000..6593dd6 --- /dev/null +++ b/gateway/lib/scripts/services.yml @@ -0,0 +1,234 @@ +http: + routers: + http-catchall: + rule: "HostRegexp(`{host:.+}`)" + entryPoints: + - web + middlewares: + - redirect-to-https + service: noop + + amap: + rule: "Host(`amap.aldon.fr`)" + entryPoints: + - websecure + service: amap + tls: + certResolver: letsencrypt + middlewares: + - redirect-errors + bookshelf: + rule: "Host(`bookshelf.aldon.fr`)" + entryPoints: + - websecure + service: bookshelf + tls: + certResolver: letsencrypt + middlewares: + - redirect-errors + fefan: + rule: "Host(`fefan.fr`)" + entryPoints: + - websecure + service: fefan + tls: + certResolver: letsencrypt + middlewares: + - redirect-errors + content-fefan: + rule: "Host(`content.fefan.fr`)" + entryPoints: + - websecure + service: content-fefan + tls: + certResolver: letsencrypt + middlewares: + - redirect-errors + gitea: + rule: "Host(`gitea.aldon.fr`)" + entryPoints: + - websecure + service: gitea + tls: + certResolver: letsencrypt + middlewares: + - redirect-errors + listmonk: + rule: "Host(`listmonk.fefan.fr`)" + entryPoints: + - websecure + service: listmonk + tls: + certResolver: letsencrypt + middlewares: + - redirect-errors + aldon-http: + rule: "Host(`aldon.fr`)" + entryPoints: + - web + middlewares: + - redirect-to-aldon + service: noop + aldon: + rule: "Host(`aldon.fr`)" + entryPoints: + - websecure + service: noop + tls: + certResolver: letsencrypt + middlewares: + - redirect-to-aldon + - redirect-errors + nextcloud: + rule: "Host(`nextcloud.aldon.fr`)" + entryPoints: + - websecure + service: nextcloud + tls: + certResolver: letsencrypt + middlewares: + - redirect-errors + rocket: + rule: "Host(`discussion.fefan.fr`)" + entryPoints: + - websecure + service: rocket + tls: + certResolver: letsencrypt + middlewares: + - redirect-errors + mathieu: + rule: "Host(`mathieu.wiki`)" + entryPoints: + - websecure + service: noop + tls: + certResolver: letsencrypt + middlewares: + - redirect-to-mathieu + - redirect-errors + mathieu-http: + rule: "Host(`mathieu.wiki`)" + entryPoints: + - web + middlewares: + - redirect-to-mathieu + service: noop + wiki: + rule: "Host(`benoit.mathieu.wiki`)" + entryPoints: + - websecure + service: wiki + tls: + certResolver: letsencrypt + middlewares: + - redirect-errors + vaultwarden: + rule: "Host(`vaultwarden.aldon.fr`)" + entryPoints: + - websecure + service: vaultwarden + tls: + certResolver: letsencrypt + middlewares: + - redirect-errors + keycloak: + rule: "Host(`keycloak.aldon.fr`)" + entryPoints: + - websecure + service: keycloak + tls: + certResolver: letsencrypt + middlewares: + - redirect-errors + services: + amap: + loadBalancer: + passHostHeader: true + servers: + - url: "http://192.168.1.96:80" + bookshelf: + loadBalancer: + passHostHeader: true + servers: + - url: "http://192.168.1.91:80" + fefan: + loadBalancer: + passHostHeader: true + servers: + - url: "http://192.168.1.92:3000" + content-fefan: + loadBalancer: + passHostHeader: true + servers: + - url: "http://192.168.1.92:1337" + gitea: + loadBalancer: + passHostHeader: true + servers: + - url: "http://192.168.1.90:3000" + listmonk: + loadBalancer: + passHostHeader: true + servers: + - url: "http://192.168.1.93:9000" + noop: + loadBalancer: + servers: + - url: "http://127.0.0.1" + nextcloud: + loadBalancer: + passHostHeader: true + servers: + - url: "http://192.168.1.30:11000" + rocket: + loadBalancer: + passHostHeader: true + servers: + - url: "http://192.168.1.15:3000" + wiki: + loadBalancer: + passHostHeader: true + servers: + - url: "http://192.168.1.38:8080" + + vaultwarden: + loadBalancer: + passHostHeader: true + servers: + - url: "http://192.168.1.36:80" + + keycloak: + loadBalancer: + passHostHeader: true + servers: + - url: "http://192.168.1.34:8080" + + error-handler-service: + loadBalancer: + passHostHeader: true + servers: + - url: "http://127.0.0.1:8090" + middlewares: + redirect-to-mathieu: + redirectRegex: + regex: "^https?://mathieu.wiki/(.*)" + replacement: "https://benoit.mathieu.wiki/$1" + permanent: true + redirect-to-aldon: + redirectRegex: + regex: "^https?://aldon.fr/(.*)" + replacement: "https://julien.aldon.fr/$1" + permanent: true + redirect-to-https: + redirectScheme: + scheme: https + redirect-errors: + errors: + status: + - "500" + - "501" + - "503" + - "502" + service: error-handler-service + query: "/502.html" diff --git a/main.tf b/main.tf index e833db4..bc176f8 100644 --- a/main.tf +++ b/main.tf @@ -29,7 +29,7 @@ locals { } resource "local_file" "traefik_config" { - filename = "${path.module}/services.yml" + filename = "${path.module}/gateway/lib/scripts/services.yml" content = templatefile("${path.module}/templates/traefik.services.tpl", { services = local.traefik_services @@ -46,7 +46,7 @@ resource "null_resource" "deploy_traefik_config" { } provisioner "file" { - source = "${path.module}/services.yml" + source = "${path.module}/gateway/lib/scripts/services.yml" destination = "/home/gateway/services.yaml" connection { @@ -203,52 +203,6 @@ module "amap" { proxmox_host_ip = var.proxmox_host_ip } -# module "n8n" { -# source = "./modules/apps/n8n" -# providers = {} -# vm_ip_address = "192.168.1.94" -# depends_on = [] - -# name = "n8n" -# hostname = "n8n" -# domain = "mathieu.wiki" -# vm_id = 215 -# node_name = "mop" - -# template_id = 103 - -# cores = 1 -# memory = 1024 -# balloon = 512 -# disk_size = 16 - -# ssh_public_key = var.ssh_public_key -# proxmox_host_ip = var.proxmox_host_ip -# } - -# module "windmill" { -# source = "./modules/apps/windmill" -# providers = {} -# vm_ip_address = "192.168.1.94" -# depends_on = [] - -# name = "windmill" -# hostname = "windmill" -# domain = "aldon.fr" -# vm_id = 215 -# node_name = "mop" - -# template_id = 103 - -# cores = 1 -# memory = 2048 -# balloon = 1024 -# disk_size = 16 - -# ssh_public_key = var.ssh_public_key -# proxmox_host_ip = var.proxmox_host_ip -# } - # module "keycloak" { # source = "./modules/apps/keycloak" # providers = {} diff --git a/modules/apps/amap/main.tf b/modules/apps/amap/main.tf index 96f6bbe..65a1b8c 100644 --- a/modules/apps/amap/main.tf +++ b/modules/apps/amap/main.tf @@ -26,7 +26,7 @@ module "vm" { restore-backup-script = indent(6, file("${path.module}/lib/scripts/restore-backup.sh")) restore-backup-service = indent(6, file("${path.module}/../common/services/docker/restore-backup.service")) create-backup-script = indent(6, file("${path.module}/lib/scripts/create-backup.sh")) - create-backup-service = indent(6, file("${path.module}}/../common/services/docker/create-backup.service")) + create-backup-service = indent(6, file("${path.module}/../common/services/docker/create-backup.service")) create-backup-timer = indent(6, file("${path.module}/../common/services/create-backup.timer")) act_runner-service = indent(6, file("${path.module}/../common/services/act_runner.service")) diff --git a/modules/apps/bookshelf/main.tf b/modules/apps/bookshelf/main.tf index 96f6bbe..65a1b8c 100644 --- a/modules/apps/bookshelf/main.tf +++ b/modules/apps/bookshelf/main.tf @@ -26,7 +26,7 @@ module "vm" { restore-backup-script = indent(6, file("${path.module}/lib/scripts/restore-backup.sh")) restore-backup-service = indent(6, file("${path.module}/../common/services/docker/restore-backup.service")) create-backup-script = indent(6, file("${path.module}/lib/scripts/create-backup.sh")) - create-backup-service = indent(6, file("${path.module}}/../common/services/docker/create-backup.service")) + create-backup-service = indent(6, file("${path.module}/../common/services/docker/create-backup.service")) create-backup-timer = indent(6, file("${path.module}/../common/services/create-backup.timer")) act_runner-service = indent(6, file("${path.module}/../common/services/act_runner.service")) diff --git a/modules/apps/fefan/main.tf b/modules/apps/fefan/main.tf index f81582b..12f8c99 100644 --- a/modules/apps/fefan/main.tf +++ b/modules/apps/fefan/main.tf @@ -26,7 +26,7 @@ module "vm" { restore-backup-script = indent(6, file("${path.module}/lib/scripts/restore-backup.sh")) restore-backup-service = indent(6, file("${path.module}/../common/services/docker/restore-backup.service")) create-backup-script = indent(6, file("${path.module}/lib/scripts/create-backup.sh")) - create-backup-service = indent(6, file("${path.module}}/../common/services/docker/create-backup.service")) + create-backup-service = indent(6, file("${path.module}/../common/services/docker/create-backup.service")) create-backup-timer = indent(6, file("${path.module}/../common/services/create-backup.timer")) act_runner-service = indent(6, file("${path.module}/../common/services/act_runner.service")) diff --git a/modules/apps/gateway/lib/scripts/install-crowdsec.sh b/modules/apps/gateway/lib/scripts/install-crowdsec.sh index 81b4ff0..cb81a24 100644 --- a/modules/apps/gateway/lib/scripts/install-crowdsec.sh +++ b/modules/apps/gateway/lib/scripts/install-crowdsec.sh @@ -3,11 +3,18 @@ set -e sudo apt update sudo apt install -y curl gnupg lsb-release +curl -s https://install.crowdsec.net | sudo bash +sudo apt install crowdsec-firewall-bouncer-nftables sudo apt install crowdsec + +sudo cscli collections install crowdsecurity/linux --force sudo cscli collections install crowdsecurity/traefik sudo cscli collections install crowdsecurity/http-cve sudo cscli collections install crowdsecurity/base-http-scenarios +sudo cscli collections install crowdsecurity/whitelist-good-actors +sudo cscli collections install crowdsecurity/sshd sudo cscli parsers install crowdsecurity/geoip-enrich +sudo cscli parsers install crowdsecurity/sshd-logs sudo systemctl enable crowdsec sudo systemctl restart crowdsec diff --git a/modules/apps/gateway/lib/scripts/install-traefik.sh b/modules/apps/gateway/lib/scripts/install-traefik.sh index 3747d05..be410f5 100644 --- a/modules/apps/gateway/lib/scripts/install-traefik.sh +++ b/modules/apps/gateway/lib/scripts/install-traefik.sh @@ -40,6 +40,11 @@ cat > "$TRAEFIK_CONF" < $SERVICE_BACKUPS_DIR/$SERVICE_BACKUPS_PREFIX-$TIMESTAMP.$SERVICE_BACKUPS_EXTENSION - -ls -1dt $SERVICE_BACKUPS_DIR/$SERVICE_BACKUPS_PREFIX-*.$SERVICE_BACKUPS_EXTENSION | tail -n +5 | xargs -r rm -f diff --git a/modules/apps/n8n/lib/scripts/init-data.sh b/modules/apps/n8n/lib/scripts/init-data.sh deleted file mode 100644 index df82df9..0000000 --- a/modules/apps/n8n/lib/scripts/init-data.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/bash -set -e - -psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" <<-EOSQL - CREATE USER $POSTGRES_NON_ROOT_USER WITH PASSWORD '$POSTGRES_NON_ROOT_PASSWORD'; - CREATE DATABASE $POSTGRES_DB; - GRANT ALL PRIVILEGES ON DATABASE $POSTGRES_DB TO $POSTGRES_NON_ROOT_USER; -EOSQL \ No newline at end of file diff --git a/modules/apps/n8n/lib/scripts/install-n8n.sh b/modules/apps/n8n/lib/scripts/install-n8n.sh deleted file mode 100644 index 1607b45..0000000 --- a/modules/apps/n8n/lib/scripts/install-n8n.sh +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/bash - -#https://docs.n8n.io/hosting/installation/docker/#using-with-postgresql - -set -euo pipefail - -source /opt/environment/.env - -cd $SERVICE_WORKDIR -cp /opt/environment/.env $SERVICE_WORKDIR/.env -docker-compose up -d \ No newline at end of file diff --git a/modules/apps/n8n/lib/scripts/restore-backup.sh b/modules/apps/n8n/lib/scripts/restore-backup.sh deleted file mode 100644 index 876717b..0000000 --- a/modules/apps/n8n/lib/scripts/restore-backup.sh +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash -set -euo pipefail - -source /opt/environment/.env - -LATEST_BACKUP=$(ls -1 $SERVICE_BACKUPS_DIR/$SERVICE_BACKUPS_PREFIX-*.$SERVICE_BACKUPS_EXTENSION 2>/dev/null | sort | tail -n1) - -if [ -n "$LATEST_BACKUP" ] && [ -f "$LATEST_BACKUP" ]; then - sudo -u $USERNAME docker exec -i n8n-postgres-1 pg_restore --clean --if-exists -U "$DB_USER" -v -d "$DB_NAME" < $LATEST_BACKUP -fi \ No newline at end of file diff --git a/modules/apps/n8n/lib/services/docker-compose.yaml b/modules/apps/n8n/lib/services/docker-compose.yaml deleted file mode 100644 index 39c654c..0000000 --- a/modules/apps/n8n/lib/services/docker-compose.yaml +++ /dev/null @@ -1,54 +0,0 @@ -volumes: - db_storage: - n8n_storage: - -services: - postgres: - image: postgres:16 - restart: always - environment: - - POSTGRES_USER=${POSTGRES_USER} - - POSTGRES_PASSWORD=${POSTGRES_PASSWORD} - - POSTGRES_DB=${POSTGRES_DB} - - POSTGRES_NON_ROOT_USER=${POSTGRES_NON_ROOT_USER} - - POSTGRES_NON_ROOT_PASSWORD=${POSTGRES_NON_ROOT_PASSWORD} - volumes: - - db_storage:/var/lib/postgresql/data - - ./init-data.sh:/docker-entrypoint-initdb.d/init-data.sh - healthcheck: - test: ['CMD-SHELL', 'pg_isready -h localhost -U ${POSTGRES_USER} -d ${POSTGRES_DB}'] - interval: 5s - timeout: 5s - retries: 10 - - n8n: - image: docker.n8n.io/n8nio/n8n:${N8N_VERSION} - restart: always - environment: - - DB_TYPE=postgresdb - - DB_POSTGRESDB_HOST=postgres - - DB_POSTGRESDB_PORT=5432 - - DB_POSTGRESDB_DATABASE=${POSTGRES_DB} - - DB_POSTGRESDB_USER=${POSTGRES_USER} - - DB_POSTGRESDB_PASSWORD=${POSTGRES_PASSWORD} - - N8N_RUNNERS_MODE=external - - N8N_RUNNERS_AUTH_TOKEN=${RUNNERS_AUTH_TOKEN} - - N8N_RUNNERS_BROKER_LISTEN_ADDRESS=0.0.0.0 - ports: - - 5678:5678 - links: - - postgres - volumes: - - n8n_storage:/home/node/.n8n - depends_on: - postgres: - condition: service_healthy - - n8n-runner: - image: n8nio/runners:${N8N_VERSION} - restart: always - environment: - - N8N_RUNNERS_AUTH_TOKEN=${RUNNERS_AUTH_TOKEN} - - N8N_RUNNERS_TASK_BROKER_URI=http://n8n:5679 - depends_on: - - n8n diff --git a/modules/apps/n8n/main.tf b/modules/apps/n8n/main.tf deleted file mode 100644 index 422bfa9..0000000 --- a/modules/apps/n8n/main.tf +++ /dev/null @@ -1,39 +0,0 @@ -module "vm" { - source = "../../vm" - name = var.name - hostname = var.hostname - domain = var.domain - vm_id = var.vm_id - node_name = var.node_name - vm_ip_address = var.vm_ip_address - - template_id = var.template_id - - cores = var.cores - memory = var.memory - disk_size = var.disk_size - - ssh_public_key = var.ssh_public_key - proxmox_host_ip = var.proxmox_host_ip - - cloudinit_config = templatefile( - "${path.module}/cloud-init/service.yaml", - { - hostname = var.hostname - domain = var.domain - ssh_key = var.ssh_public_key - proxmox_host_ip = var.proxmox_host_ip - restore-backup-script = indent(6, file("${path.module}/lib/scripts/restore-backup.sh")) - restore-backup-service = indent(6, file("${path.module}/../common/services/docker/restore-backup.service")) - create-backup-script = indent(6, file("${path.module}/lib/scripts/create-backup.sh")) - create-backup-timer = indent(6, file("${path.module}/../common/services/create-backup.timer")) - create-backup-service = indent(6, file("${path.module}/../common/services/docker/create-backup.service")) - - install-n8n-script = indent(6, file("${path.module}/lib/scripts/install-n8n.sh")) - install-docker-script = indent(6, file("${path.module}/../common/scripts/install-docker.sh")) - n8n-docker-compose = indent(6, file("${path.module}/lib/services/docker-compose.yaml")) - n8n-init-data = indent(6, file("${path.module}/lib/scripts/init-data.sh")) - env-file-content = indent(6, file("${path.module}/.env")) - } - ) -} \ No newline at end of file diff --git a/modules/apps/n8n/output.tf b/modules/apps/n8n/output.tf deleted file mode 100644 index c318a13..0000000 --- a/modules/apps/n8n/output.tf +++ /dev/null @@ -1,9 +0,0 @@ -output "traefik_service" { - value = [{ - domain = var.domain - name = var.name - host = "${var.hostname}" - ip = var.vm_ip_address - port = 5678 - }] -} \ No newline at end of file diff --git a/modules/apps/n8n/variables.tf b/modules/apps/n8n/variables.tf deleted file mode 100644 index 3610517..0000000 --- a/modules/apps/n8n/variables.tf +++ /dev/null @@ -1,71 +0,0 @@ -variable "name" { - description = "Virtual Machine name" - type = string -} - -variable "vm_id" { - description = "Virtual Machine id" - type = number -} - -variable "node_name" { - description = "Proxmox node name" - type = string - default = "mop" -} - -variable "cores" { - description = "Number of CPU cores for this virtual machine" - type = number - default = 2 -} - -variable "memory" { - description = "Memory RAM for this virtual machine" - type = number - default = 2048 -} - -variable "balloon" { - description = "Minimum vm memory, using ballooning devide to reach Proxmox node memory target." - type = number - default = 1024 -} - -variable "template_id" { - description = "Virtual machine template ID" - type = number -} - -variable "ssh_public_key" { - description = "Public SSH key for cloud-init user" - type = string -} - -variable "hostname" { - description = "Virtual Machine hostname ()" - type = string - default = "test" -} - -variable "domain" { - description = "Virtual Machine domain (example.fr)" - type = string - default = "" -} - -variable "disk_size" { - description = "Disk size for the virtual machine" - type = number - default = 10 -} - -variable "proxmox_host_ip" { - description = "Proxmox host base ip" - type = string -} - -variable "vm_ip_address" { - description = "Virtual machine ip" - type = string -} \ No newline at end of file diff --git a/modules/apps/windmill/.env.example b/modules/apps/windmill/.env.example deleted file mode 100644 index 9af3469..0000000 --- a/modules/apps/windmill/.env.example +++ /dev/null @@ -1,15 +0,0 @@ -# Environment files -ENV_FILE_LOCATION=/opt/environment/.env - -# Application specifics -DATABASE_URL=postgres://postgres:changeme@db/windmill?sslmode=disable -DB_USER=postgres -DB_NAME=windmill -DB_PASS= -WM_IMAGE=ghcr.io/windmill-labs/windmill:main -SERVICE_WORKDIR=/home/windmill - -# Backup specifics -SERVICE_BACKUPS_DIR=/backups/windmill -SERVICE_BACKUPS_PREFIX=windmill-dump -SERVICE_BACKUPS_EXTENSION=dump \ No newline at end of file diff --git a/modules/apps/windmill/cloud-init/service.yaml b/modules/apps/windmill/cloud-init/service.yaml deleted file mode 100644 index c6274f8..0000000 --- a/modules/apps/windmill/cloud-init/service.yaml +++ /dev/null @@ -1,89 +0,0 @@ -#cloud-config -hostname: ${hostname} -local-hostname: ${hostname} -fqdn: ${hostname}.${domain} -manage_etc_hosts: true - -groups: - - git - -users: - - default - - name: ${hostname} - groups: sudo,git - shell: /bin/bash - sudo: ALL=(ALL) NOPASSWD:ALL - ssh_authorized_keys: - - ${ssh_key} - -disable_root: true - -package_update: true -package_upgrade: false - -packages: - - git - - nfs-common - - curl - - unzip - - postgresql - - postgresql-client - -mounts: - - [ "192.168.1.12:/main/backups", "/backups", "nfs", "defaults,_netdev,x-systemd.requires=network-online.target", "0", "0" ] - -write_files: - - path: /opt/environment/.env - permissions: "0644" - content: | - ${env-file-content} - - path: /opt/${hostname}/install-docker.sh - permissions: "0755" - content: | - ${install-docker-script} - - path: /usr/local/bin/restore-backup.sh - permissions: "0755" - content: | - ${restore-backup-script} - - path: /etc/systemd/system/restore-backup.service - permissions: "0644" - content: | - ${restore-backup-service} - - path: /usr/local/bin/backup.sh - permissions: "0755" - content: | - ${create-backup-script} - - path: /etc/systemd/system/create-backup.timer - permissions: "0644" - content: | - ${create-backup-timer} - - path: /etc/systemd/system/create-backup.service - permissions: "0644" - content: | - ${create-backup-service} - - path: /opt/windmill/install-windmill.sh - permissions: "0755" - content: | - ${install-windmill-script} - - path: /home/windmill/docker-compose.yaml - permissions: "0755" - content: | - ${windmill-docker-compose} - - path: /home/windmill/Caddyfile - permissions: "0755" - content: | - ${windmill-caddyfile} - - -runcmd: - # Backup setup - - mkdir -p /backups - - mount -t nfs ${proxmox_host_ip}:/main/backups /backups - - systemctl enable --now create-backup.timer - # Docker setup - - /opt/${hostname}/install-docker.sh - # windmill setup - - /opt/windmill/install-windmill.sh - -final_message: | - Base system ready for ${hostname} \ No newline at end of file diff --git a/modules/apps/windmill/lib/scripts/create-backup.sh b/modules/apps/windmill/lib/scripts/create-backup.sh deleted file mode 100644 index edc07ec..0000000 --- a/modules/apps/windmill/lib/scripts/create-backup.sh +++ /dev/null @@ -1,15 +0,0 @@ -#!/bin/bash - -#SERVICE_BACKUPS_DIR -#SERVICE_BACKUPS_PREFIX -#SERVICE_BACKUPS_EXTENSION - -set -euo pipefail - -source /opt/environment/.env - -TIMESTAMP=$(date +'%Y-%m-%d_%H%M%S') - -# docker exec $DB_SERVICE - -ls -1dt $SERVICE_BACKUPS_DIR/$SERVICE_BACKUPS_PREFIX-*.$SERVICE_BACKUPS_EXTENSION | tail -n +5 | xargs -r rm -f diff --git a/modules/apps/windmill/lib/scripts/install-windmill.sh b/modules/apps/windmill/lib/scripts/install-windmill.sh deleted file mode 100644 index 387f40e..0000000 --- a/modules/apps/windmill/lib/scripts/install-windmill.sh +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/bash - -#https://www.windmill.dev/docs/advanced/self_host - -set -euo pipefail - -source /opt/environment/.env - -cd $SERVICE_WORKDIR -cp /opt/environment/.env $SERVICE_WORKDIR/.env -docker-compose up -d \ No newline at end of file diff --git a/modules/apps/windmill/lib/scripts/restore-backup.sh b/modules/apps/windmill/lib/scripts/restore-backup.sh deleted file mode 100644 index 20cc6b2..0000000 --- a/modules/apps/windmill/lib/scripts/restore-backup.sh +++ /dev/null @@ -1,20 +0,0 @@ -#!/bin/bash - -#USERNAME -#SERVICE_BACKUPS_DIR -#SERVICE_BACKUPS_PREFIX -#SERVICE_BACKUPS_EXTENSION -#DB_USER -#DB_NAME - -set -euo pipefail - -source /opt/environment/.env - -LATEST_BACKUP=$(ls -1 $SERVICE_BACKUPS_DIR/$SERVICE_BACKUPS_PREFIX-*.$SERVICE_BACKUPS_EXTENSION 2>/dev/null | sort | tail -n1) - -if [ -n "$LATEST_BACKUP" ] && [ -f "$LATEST_BACKUP" ]; then - systemctl stop listmonk - sudo -u $USERNAME pg_restore --clean --if-exists -U "$DB_USER" -d "$DB_NAME" $LATEST_BACKUP - systemctl start listmonk -fi \ No newline at end of file diff --git a/modules/apps/windmill/lib/services/Caddyfile b/modules/apps/windmill/lib/services/Caddyfile deleted file mode 100644 index d01ca0d..0000000 --- a/modules/apps/windmill/lib/services/Caddyfile +++ /dev/null @@ -1,35 +0,0 @@ -{ - layer4 { - :25 { - proxy { - to windmill_server:2525 - } - } - } -} - -{$BASE_URL} { - bind {$ADDRESS} - - # LSP - Language Server Protocol for code intelligence (windmill_extra:3001) - reverse_proxy /ws/* http://windmill_extra:3001 - - # Multiplayer - Real-time collaboration, Enterprise Edition (windmill_extra:3002) - # Uncomment and set ENABLE_MULTIPLAYER=true in docker-compose.yml - # reverse_proxy /ws_mp/* http://windmill_extra:3002 - - # Debugger - Interactive debugging via DAP WebSocket (windmill_extra:3003) - # Set ENABLE_DEBUGGER=true in docker-compose.yml to enable - handle_path /ws_debug/* { - reverse_proxy http://windmill_extra:3003 - } - - # Search indexer, Enterprise Edition (windmill_indexer:8002) - # reverse_proxy /api/srch/* http://windmill_indexer:8002 - - # Default: Windmill server - reverse_proxy /* http://windmill_server:8000 - - # TLS with custom certificates - # tls /certs/cert.pem /certs/key.pem -} \ No newline at end of file diff --git a/modules/apps/windmill/lib/services/docker-compose.yaml b/modules/apps/windmill/lib/services/docker-compose.yaml deleted file mode 100644 index 26f939e..0000000 --- a/modules/apps/windmill/lib/services/docker-compose.yaml +++ /dev/null @@ -1,222 +0,0 @@ -version: "3.7" - -x-logging: &default-logging - driver: "json-file" - options: - max-size: "${LOG_MAX_SIZE:-20m}" - max-file: "${LOG_MAX_FILE:-10}" - compress: "true" - -services: - db: - deploy: - # To use an external database, set replicas to 0 and set DATABASE_URL to the external database url in the .env file - replicas: 1 - image: postgres:16 - shm_size: 1g - restart: unless-stopped - volumes: - - db_data:/var/lib/postgresql/data - expose: - - 5432 - environment: - POSTGRES_PASSWORD: ${DB_PASS} - POSTGRES_DB: ${DB_NAME} - healthcheck: - test: ["CMD-SHELL", "pg_isready -U postgres"] - interval: 10s - timeout: 5s - retries: 5 - logging: *default-logging - - windmill_server: - image: ${WM_IMAGE} - pull_policy: always - deploy: - replicas: 1 - restart: unless-stopped - expose: - - 8000 - - 2525 - environment: - - DATABASE_URL=${DATABASE_URL} - - MODE=server - depends_on: - db: - condition: service_healthy - volumes: - - worker_logs:/tmp/windmill/logs - - logging: *default-logging - - windmill_worker: - image: ${WM_IMAGE} - pull_policy: always - deploy: - replicas: 3 - resources: - limits: - cpus: "1" - memory: 2048M - # for GB, use syntax '2Gi' - restart: unless-stopped - # Uncomment to enable PID namespace isolation (recommended for security) - # Requires privileged mode for --mount-proc flag - # See: https://www.windmill.dev/docs/advanced/security_isolation - # privileged: true - environment: - - DATABASE_URL=${DATABASE_URL} - - MODE=worker - - WORKER_GROUP=default - # If running with non-root/non-windmill UID (e.g., user: "1001:1001"), - # add: - HOME=/tmp - # Uncomment to enable PID namespace isolation (requires privileged: true above) - # - ENABLE_UNSHARE_PID=true - depends_on: - db: - condition: service_healthy - # to mount the worker folder to debug, KEEP_JOB_DIR=true and mount /tmp/windmill - volumes: - # mount the docker socket to allow to run docker containers from within the workers - - /var/run/docker.sock:/var/run/docker.sock - - worker_dependency_cache:/tmp/windmill/cache - - worker_logs:/tmp/windmill/logs - - logging: *default-logging - - ## This worker is specialized for "native" jobs. Native jobs run in-process and thus are much more lightweight than other jobs - windmill_worker_native: - # Use ghcr.io/windmill-labs/windmill-ee:main for the ee - image: ${WM_IMAGE} - pull_policy: always - deploy: - replicas: 1 - resources: - limits: - cpus: "1" - memory: 2048M - # for GB, use syntax '2Gi' - restart: unless-stopped - # Uncomment to enable PID namespace isolation (recommended for security) - # Requires privileged mode for --mount-proc flag - # See: https://www.windmill.dev/docs/advanced/security_isolation - # privileged: true - environment: - - DATABASE_URL=${DATABASE_URL} - - MODE=worker - - WORKER_GROUP=native - - NUM_WORKERS=8 - - SLEEP_QUEUE=200 - # Uncomment to enable PID namespace isolation (requires privileged: true above) - # - ENABLE_UNSHARE_PID=true - depends_on: - db: - condition: service_healthy - volumes: - - worker_logs:/tmp/windmill/logs - logging: *default-logging - # This worker is specialized for reports or scraping jobs. It is assigned the "reports" worker group which has an init script that installs chromium and can be targeted by using the "chromium" worker tag. - # windmill_worker_reports: - # image: ${WM_IMAGE} - # pull_policy: always - # deploy: - # replicas: 1 - # resources: - # limits: - # cpus: "1" - # memory: 2048M - # # for GB, use syntax '2Gi' - # restart: unless-stopped - # # Uncomment to enable PID namespace isolation (recommended for security) - # # Requires privileged mode for --mount-proc flag - # # See: https://www.windmill.dev/docs/advanced/security_isolation - # # privileged: true - # environment: - # - DATABASE_URL=${DATABASE_URL} - # - MODE=worker - # - WORKER_GROUP=reports - # # Uncomment to enable PID namespace isolation (requires privileged: true above) - # # - ENABLE_UNSHARE_PID=true - # depends_on: - # db: - # condition: service_healthy - # # to mount the worker folder to debug, KEEP_JOB_DIR=true and mount /tmp/windmill - # volumes: - # # mount the docker socket to allow to run docker containers from within the workers - # - /var/run/docker.sock:/var/run/docker.sock - # - worker_dependency_cache:/tmp/windmill/cache - # - worker_logs:/tmp/windmill/logs - - # The indexer powers full-text job and log search, an EE feature. - windmill_indexer: - image: ${WM_IMAGE} - pull_policy: always - deploy: - replicas: 0 # set to 1 to enable full-text job and log search - restart: unless-stopped - expose: - - 8002 - environment: - - PORT=8002 - - DATABASE_URL=${DATABASE_URL} - - MODE=indexer - depends_on: - db: - condition: service_healthy - volumes: - - windmill_index:/tmp/windmill/search - - worker_logs:/tmp/windmill/logs - logging: *default-logging - - # Combined extra services: LSP, Multiplayer, and Debugger - # Each service can be enabled/disabled via environment variables: - # - ENABLE_LSP=true (default) - Language Server Protocol for code intelligence - # - ENABLE_MULTIPLAYER=false - Real-time collaboration (Enterprise Edition) - # - ENABLE_DEBUGGER=false - Interactive debugging via DAP WebSocket - windmill_extra: - image: ghcr.io/windmill-labs/windmill-extra:latest - pull_policy: always - restart: unless-stopped - expose: - - 3001 # LSP - - 3002 # Multiplayer - - 3003 # Debugger - environment: - - ENABLE_LSP=true - - ENABLE_MULTIPLAYER=false # Set to true to enable multiplayer (Enterprise Edition) - - ENABLE_DEBUGGER=true # Set to true to enable debugger - - DEBUGGER_PORT=3003 # Debugger service port - - ENABLE_NSJAIL=false # Set to true for nsjail sandboxing (requires privileged: true) - - REQUIRE_SIGNED_DEBUG_REQUESTS=false # Set to true to require JWT tokens for debug sessions - - WINDMILL_BASE_URL=http://windmill_server:8000 - volumes: - - lsp_cache:/pyls/.cache - logging: *default-logging - - caddy: - image: ghcr.io/windmill-labs/caddy-l4:latest - restart: unless-stopped - # Configure the mounted Caddyfile and the exposed ports or use another reverse proxy if needed - volumes: - - ./Caddyfile:/etc/caddy/Caddyfile - - caddy_data:/data - # - ./certs:/certs # Provide custom certificate files like cert.pem and key.pem to enable HTTPS - See the corresponding section in the Caddyfile - ports: - # To change the exposed port, simply change 80:80 to :80. No other changes needed - - 80:80 - - 25:25 - # - 443:443 # Uncomment to enable HTTPS handling by Caddy - environment: - - BASE_URL=":80" - # - BASE_URL=":443" # uncomment and comment line above to enable HTTPS via custom certificate and key files - # - BASE_URL=mydomain.com # Uncomment and comment line above to enable HTTPS handling by Caddy - logging: *default-logging - -volumes: - db_data: null - worker_dependency_cache: null - worker_logs: null - worker_memory: null - windmill_index: null - lsp_cache: null - caddy_data: null \ No newline at end of file diff --git a/modules/apps/windmill/main.tf b/modules/apps/windmill/main.tf deleted file mode 100644 index e1429c3..0000000 --- a/modules/apps/windmill/main.tf +++ /dev/null @@ -1,41 +0,0 @@ -module "vm" { - source = "../../vm" - name = var.name - hostname = var.hostname - domain = var.domain - vm_id = var.vm_id - node_name = var.node_name - vm_ip_address = var.vm_ip_address - - template_id = var.template_id - - cores = var.cores - memory = var.memory - disk_size = var.disk_size - - ssh_public_key = var.ssh_public_key - proxmox_host_ip = var.proxmox_host_ip - - cloudinit_config = templatefile( - "${path.module}/cloud-init/service.yaml", - { - hostname = var.hostname - domain = var.domain - ssh_key = var.ssh_public_key - proxmox_host_ip = var.proxmox_host_ip - restore-backup-script = indent(6, file("${path.module}/lib/scripts/restore-backup.sh")) - restore-backup-service = indent(6, file("${path.module}/../common/services/docker/restore-backup.service")) - create-backup-script = indent(6, file("${path.module}/lib/scripts/create-backup.sh")) - create-backup-timer = indent(6, file("${path.module}/../common/services/create-backup.timer")) - create-backup-service = indent(6, file("${path.module}/../common/services/docker/create-backup.service")) - - install-windmill-script = indent(6, file("${path.module}/lib/scripts/install-windmill.sh")) - - windmill-docker-compose = indent(6, file("${path.module}/lib/services/docker-compose.yaml")) - windmill-caddyfile = indent(6, file("${path.module}/lib/services/Caddyfile")) - install-docker-script = indent(6, file("${path.module}/../common/scripts/install-docker.sh")) - - env-file-content = indent(6, file("${path.module}/.env")) - } - ) -} \ No newline at end of file diff --git a/modules/apps/windmill/output.tf b/modules/apps/windmill/output.tf deleted file mode 100644 index f7ad914..0000000 --- a/modules/apps/windmill/output.tf +++ /dev/null @@ -1,9 +0,0 @@ -output "traefik_service" { - value = [{ - domain = var.domain - name = var.name - host = "${var.hostname}" - ip = var.vm_ip_address - port = 80 - }] -} \ No newline at end of file diff --git a/modules/apps/windmill/variables.tf b/modules/apps/windmill/variables.tf deleted file mode 100644 index c2feb6d..0000000 --- a/modules/apps/windmill/variables.tf +++ /dev/null @@ -1,71 +0,0 @@ -variable "name" { - description = "Virtual Machine name" - type = string -} - -variable "vm_id" { - description = "Virtual Machine id" - type = number -} - -variable "node_name" { - description = "Proxmox node name" - type = string - default = "mop" -} - -variable "cores" { - description = "Number of CPU cores for this virtual machine" - type = number - default = 2 -} - -variable "memory" { - description = "Memory RAM for this virtual machine" - type = number - default = 2048 -} - -variable "balloon" { - description = "Minimum vm memory, using ballooning devide to reach Proxmox node memory target." - type = number - default = 1024 -} - -variable "template_id" { - description = "Virtual machine template ID" - type = number -} - -variable "ssh_public_key" { - description = "Public SSH key for cloud-init user" - type = string -} - -variable "hostname" { - description = "Virtual Machine hostname ()" - type = string - default = "test" -} - -variable "domain" { - description = "Virtual Machine domain (example.fr)" - type = string - default = "" -} - -variable "disk_size" { - description = "Disk size for the virtual machine" - type = number - default = 10 -} - -variable "proxmox_host_ip" { - description = "Proxmox host base ip" - type = string -} - -variable "vm_ip_address" { - description = "Virtual machine ip" - type = string -} \ No newline at end of file diff --git a/terraform.tfvars.example b/terraform.tfvars.example index 0e553c3..513cef9 100644 --- a/terraform.tfvars.example +++ b/terraform.tfvars.example @@ -1,4 +1,4 @@ ssh_public_key = "" proxmox_api_token = "" -proxmox_endpoint = "http://mop:8006" +proxmox_endpoint = "https://192.168.1.12:8006" proxmox_host_ip = "192.168.1.121" \ No newline at end of file