Add(module): add girasol module

Add(module): add amap module Add(module): add common lib and services Add(module): add base structure for keycloak Add(module): add base structure for rocket Add(module): add n8n and windmill modules Add(docker): add install docker script in common module Add(template): add root for aldon.fr and mathieu.wiki in traefik.service template
2026-04-21 16:52:41 +02:00
parent 905cc8b43d
commit a56911b896
65 changed files with 1893 additions and 23 deletions
--- a/modules/apps/keycloak/.env.example
+++ b/modules/apps/keycloak/.env.example
@@ -0,0 +1,22 @@
+JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64
+KC_PROXY_HEADERS=forwarded
+KC_HTTP_ENABLED=true
+KC_DB=postgres
+KC_DB_USERNAME=keycloak
+KC_DB_PASSWORD=<secret>
+KC_HOSTNAME=https://keycloak.aldon.fr
+
+#Running behind reverse proxy that handles TLS
+KC_PROXY=edge
+
+#Create admin account on first run
+KEYCLOAK_ADMIN=admin
+KEYCLOAK_ADMIN_PASSWORD=<secret>
+
+KEYCLOAK_DIRECTORY=/home/keycloak/keycloak
+KEYCLOAK_VERSION=26.2.4
+
+# Backup specifics
+SERVICE_BACKUPS_DIR=/backups/keycloak
+SERVICE_BACKUPS_PREFIX=keycloak-dump
+SERVICE_BACKUPS_EXTENSION=sql
--- a/modules/apps/keycloak/cloud-init/service.yaml
+++ b/modules/apps/keycloak/cloud-init/service.yaml
@@ -0,0 +1,71 @@
+#cloud-config
+hostname: ${hostname}
+local-hostname: ${hostname}
+fqdn: ${hostname}.${domain}
+manage_etc_hosts: true
+
+users:
+  - default
+  - name: ${hostname}
+    groups: sudo
+    shell: /bin/bash
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    ssh_authorized_keys:
+      - ${ssh_key}
+
+disable_root: true
+
+package_update: true
+package_upgrade: false
+
+packages:
+  - git
+  - nfs-common
+  - curl
+  - unzip
+  - openjdk-21-jdk-headless
+  - postgresql 
+  - postgresql-contrib
+
+mounts:
+  - [ "192.168.1.12:/main/backups", "/backups", "nfs", "defaults,_netdev,x-systemd.requires=network-online.target", "0", "0" ]
+
+write_files:
+  - path: /opt/environment/.env
+    permissions: "0644"
+    content: |
+      ${env-file-content}
+  - path: /usr/local/bin/restore-backup.sh
+    permissions: "0755"
+    content: |
+      ${restore-backup-script}
+  - path: /etc/systemd/system/restore-backup.service
+    permissions: "0644"
+    content: |
+      ${restore-backup-service}
+  - path: /usr/local/bin/backup.sh
+    permissions: "0755"
+    content: | 
+      ${create-backup-script}
+  - path: /etc/systemd/system/create-backup.timer
+    permissions: "0644"
+    content: |
+      ${create-backup-timer}
+  - path: /etc/systemd/system/create-backup.service
+    permissions: "0644"
+    content: |
+      ${create-backup-service}
+  - path: /etc/systemd/system/keycloak.service
+    permissions: "0644"
+    content: |
+      ${keycloak-service}
+
+runcmd:
+  # Backup setup
+  - mkdir -p /backups
+  - mount -t nfs ${proxmox_host_ip}:/main/backups /backups
+  - systemctl enable --now create-backup.timer
+
+
+final_message: |
+  Base system ready for ${hostname}
--- a/modules/apps/keycloak/lib/scripts/create-backup.sh
+++ b/modules/apps/keycloak/lib/scripts/create-backup.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+set -euo pipefail
+
+source /opt/environment/.env
+
+TIMESTAMP=$(date +'%Y-%m-%d_%H%M%S')
+
+# Backup realms
+
+sh $KEYCLOAK_DIRECTORY/kc.sh export --file $SERVICE_BACKUPS_DIR/$SERVICE_BACKUPS_PREFIX-$TIMESTAMP.json
+
+
+# Backup database
+pg_dump -U keycloak -F c -b -v -f $SERVICE_BACKUPS_DIR/$SERVICE_BACKUPS_PREFIX-$TIMESTAMP.$SERVICE_BACKUPS_EXTENSION
+
+
+ls -1dt $SERVICE_BACKUPS_DIR/$SERVICE_BACKUPS_PREFIX-*.$SERVICE_BACKUPS_EXTENSION | tail -n +5 | xargs -r rm -f
+ls -1dt $SERVICE_BACKUPS_DIR/$SERVICE_BACKUPS_PREFIX-*.json | tail -n +5 | xargs -r rm -f
--- a/modules/apps/keycloak/lib/scripts/install-keycloak.sh
+++ b/modules/apps/keycloak/lib/scripts/install-keycloak.sh
@@ -0,0 +1,34 @@
+#//bin/bash
+
+# KEYCLOAK_DIRECTORY=/home/keycloak/keycloak
+# KEYCLOAK_VERSION: 26.2.4
+# KC_DB_PASSWORD
+# SERVICE_BACKUPS_DIR
+# SERVICE_BACKUPS_PREFIX
+# SERVICE_BACKUPS_EXTENSION
+
+if [ ! -f $KEYCLOAK_DIRECTORY ]; then
+    wget -O /tmp/keycloak.zip https://github.com/keycloak/keycloak/releases/download/$KEYCLOAK_VERSION/keycloak-$KEYCLOAK_VERSION.zip
+    unzip -o /tmp/keycloak /tmp/keycloak.zip -d /tmp
+    mv /tmp/keycloak $KEYCLOAK_DIRECTORY
+    chmod o+x $KEYCLOAK_DIRECTORY/bin
+fi
+
+groupadd keycloak
+
+sudo -u postgres psql <<EOF
+CREATE DATABASE keycloak with encoding 'UTF8' TEMPLATE template0;
+CREATE USER keycloak WITH ENCRYPTED PASSWORD '$KC_DB_PASSWORD';
+GRANT ALL PRIVILEGES ON DATABASE keycloak TO keycloak;
+EOF
+
+
+if ls -1 "$SERVICE_BACKUPS_DIR"/$SERVICE_BACKUPS_PREFIX-*.$SERVICE_BACKUPS_EXTENSION >/dev/null 2>&1; then
+    echo "---- Backup found, restoring Gitea ----"
+    /usr/local/bin/restore-backup.sh
+else
+    echo "---- No backup found in $SERVICE_BACKUPS_DIR, skipping restore ----"
+fi
+
+sudo systemctl enable keycloak
+sudo systemctl start keycloak
--- a/modules/apps/keycloak/lib/scripts/restore-backup.sh
+++ b/modules/apps/keycloak/lib/scripts/restore-backup.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+source /opt/environment/.env
+
+LATEST_BACKUP_DB=$(ls -1 $SERVICE_BACKUPS_DIR/$SERVICE_BACKUPS_PREFIX-*.$SERVICE_BACKUPS_EXTENSION 2>/dev/null | sort | tail -n1)
+LATEST_BACKUP_REALMS=$(ls -1 $SERVICE_BACKUPS_DIR/$SERVICE_BACKUPS_PREFIX-*.json 2>/dev/null | sort | tail -n1)
+
+if [ -n "$LATEST_BACKUP_DB" ] && [ -f "$LATEST_BACKUP_DB" ]; then
+    psql -U keycloak $KC_DB < $LATEST_BACKUP_DB
+fi
+
+if [ -n "$LATEST_BACKUP_REALMS" ] && [ -f "$LATEST_BACKUP_REALMS" ]; then
+    sh $KEYCLOAK_DIRECTORY/kc.sh import --file $SERVICE_BACKUPS_DIR/$SERVICE_BACKUPS_PREFIX-$TIMESTAMP.json
+fi
--- a/modules/apps/keycloak/lib/services/create-backup.service
+++ b/modules/apps/keycloak/lib/services/create-backup.service
@@ -0,0 +1,9 @@
+[Unit]
+Description=Backup Service
+Wants=network.target
+After=network.target
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/bin/backup.sh
--- a/modules/apps/keycloak/lib/services/keycloak.service
+++ b/modules/apps/keycloak/lib/services/keycloak.service
@@ -0,0 +1,17 @@
+[Unit]
+Description=Keycloak Authorization Server
+Requires=network.target
+After=syslog.target network.target
+
+[Service]
+Type=idle
+User=keycloak
+Group=keycloak
+ExecStart=/home/keycloak/keycloak/bin/kc.sh start
+ExecStop=/home/keycloak/keycloak/bin/kc.sh stop
+Restart=always
+RestartSec=15
+EnvironmentFile=/opt/environment/.env
+
+[Install]
+WantedBy=multi-user.target
--- a/modules/apps/keycloak/lib/services/restore-backup.service
+++ b/modules/apps/keycloak/lib/services/restore-backup.service
@@ -0,0 +1,9 @@
+[Unit]
+Description=Restore latest backup
+After=network.target postgresql.service
+Requires=postgresql.service
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/bin/restore-backup.sh
--- a/modules/apps/keycloak/main.tf
+++ b/modules/apps/keycloak/main.tf
@@ -0,0 +1,35 @@
+module "vm" {
+  source      = "../../vm"
+  name        = var.name
+  hostname    = var.hostname
+  domain      = var.domain
+  vm_id       = var.vm_id
+  node_name   = var.node_name
+  vm_ip_address = var.vm_ip_address
+
+  template_id = var.template_id
+
+  cores       = var.cores
+  memory      = var.memory
+  disk_size   = var.disk_size
+
+  ssh_public_key  = var.ssh_public_key
+  proxmox_host_ip = var.proxmox_host_ip
+
+  cloudinit_config = templatefile(
+      "${path.module}/cloud-init/service.yaml",
+      {
+        hostname        = var.hostname
+        domain          = var.domain
+        ssh_key         = var.ssh_public_key
+        proxmox_host_ip = var.proxmox_host_ip
+        restore-backup-script = indent(6, file("${path.module}/lib/scripts/restore-backup.sh"))
+        restore-backup-service = indent(6, file("${path.module}/lib/services/restore-backup.service"))
+        create-backup-script = indent(6, file("${path.module}/lib/scripts/create-backup.sh"))
+        create-backup-service = indent(6, file("${path.module}/lib/services/create-backup.service"))
+        create-backup-timer = indent(6, file("${path.module}/../common/services/create-backup.timer"))
+
+        env-file-content = indent(6, file("${path.module}/.env"))
+      }
+    )
+}
--- a/modules/apps/keycloak/output.tf
+++ b/modules/apps/keycloak/output.tf
@@ -0,0 +1,9 @@
+output "traefik_service" {
+    value = [{
+        domain = var.domain
+        name = var.name
+        host = "${var.hostname}"
+        ip = var.vm_ip_address
+        port = 8080
+    }]
+}
--- a/modules/apps/keycloak/variables.tf
+++ b/modules/apps/keycloak/variables.tf
@@ -0,0 +1,71 @@
+variable "name" {
+  description = "Virtual Machine name"
+  type = string
+}
+
+variable "vm_id" {
+  description = "Virtual Machine id"
+  type = number
+}
+
+variable "node_name" {
+  description = "Proxmox node name"
+  type    = string
+  default = "mop"
+}
+
+variable "cores" {
+  description = "Number of CPU cores for this virtual machine"
+  type    = number
+  default = 2
+}
+
+variable "memory" {
+  description = "Memory RAM for this virtual machine" 
+  type    = number
+  default = 2048
+}
+
+variable "balloon" {
+  description = "Minimum vm memory, using ballooning devide to reach Proxmox node memory target."
+  type = number
+  default = 1024
+}
+
+variable "template_id" {
+  description = "Virtual machine template ID"
+  type = number
+}
+
+variable "ssh_public_key" {
+  description = "Public SSH key for cloud-init user"
+  type        = string
+}
+
+variable "hostname" {
+  description = "Virtual Machine hostname (<service-name>)"
+  type        = string
+  default     = "test"
+}
+
+variable "domain" {
+  description = "Virtual Machine domain (example.fr)"
+  type        = string
+  default     = ""
+}
+
+variable "disk_size" {
+  description = "Disk size for the virtual machine"
+  type    = number
+  default = 10
+}
+
+variable "proxmox_host_ip" {
+  description = "Proxmox host base ip"
+  type = string
+}
+
+variable "vm_ip_address" {
+  description = "Virtual machine ip"
+  type = string
+}