Mop/terraform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add gateway automatic template and fefan vm

Browse Source
This commit is contained in:
Julien Aldon
2026-01-19 17:05:38 +01:00
parent d98c7b8bdb
commit f851ead7cd
56 changed files with 1243 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
modules/apps/bookshelf/.env.example
View File

@@ -1,7 +1,7 @@
ACT_RUNNER_VERSION=0.2.13
ACT_RUNNER_LOCATION=/usr/local/bin
ACT_RUNNER_USER=act_runner
ENV_FILE_LOCATION=/opt/bookshelf/secrets/bookshelf.env
ENV_FILE_LOCATION=/opt/bookshelf/bookshelf.env
GITEA_INSTANCE_URL=https://gitea.aldon.fr
GITEA_RUNNER_REGISTRATION_TOKEN=<gitea-repository-runner-token>
GITEA_BOOKSHELF_APPLICATION_TOKEN=<gitea-auth-token>

15
modules/apps/bookshelf/cloud-init/service.yaml
View File

@@ -26,16 +26,15 @@ packages:
- curl
- jq
mounts:
- [ "192.168.1.12:/main/backups", "/backups", "nfs", "defaults,_netdev,x-systemd.requires=network-online.target", "0", "0" ]
write_files:
- path: /etc/fstab
permissions: "0644"
content: |
${proxmox_host_ip}:/main/backups /backups nfs defaults,_netdev,x-systemd.requires=network-online.target 0 0
- path: /opt/bookshelf/env.sh
permissions: "0644"
content: |
${environment-setup-script}
- path: /opt/bookshelf/secrets/bookshelf.env
- path: /opt/bookshelf/bookshelf.env
permissions: "0644"
content: |
${env-file-content}
@@ -51,11 +50,11 @@ write_files:
permissions: "0755"
content: |
${create-backup-script}
- path: /etc/systemd/system/weekly-backup.timer
- path: /etc/systemd/system/create-backup.timer
permissions: "0644"
content: |
${create-backup-timer}
- path: /etc/systemd/system/weekly-backup.service
- path: /etc/systemd/system/create-backup.service
permissions: "0644"
content: |
${create-backup-service}
@@ -76,7 +75,7 @@ runcmd:
# Backup setup
- mkdir -p /backups
- mount -t nfs ${proxmox_host_ip}:/main/backups /backups
- systemctl enable --now weekly-backup.timer
- systemctl enable --now create-backup.timer
# Docker setup
- systemctl enable docker
- systemctl start docker

4
modules/apps/bookshelf/lib/scripts/create-backup.sh
View File

@@ -3,6 +3,6 @@
source /opt/bookshelf/env.sh
TIMESTAMP=$(date +'%Y-%m-%d_%H%M%S')
docker exec bookshelf-database-1 mariadb-dump --all-database -u root -p"$MARIADB_ROOT_PASSWORD" > $BOOKSHELF_BACKUPS_DIR/bookshelf-dump-$TIMESTAMP.sql
docker exec bookshelf-database-1 mariadb-dump --all-databases -u root -p"$MARIADB_ROOT_PASSWORD" > $BOOKSHELF_BACKUPS_DIR/bookshelf-dump-$TIMESTAMP.sql
ls -1dt $BOOKSHELF_BACKUPS_DIR/$BOOKSHELF_BACKUP_PREFIX-*.zip | tail -n +5 | xargs -r rm -f
ls -1dt $BOOKSHELF_BACKUPS_DIR/$BOOKSHELF_BACKUP_PREFIX-*.sql | tail -n +5 | xargs -r rm -f

2
modules/apps/bookshelf/lib/scripts/env.sh
View File

@@ -1,4 +1,4 @@
#!/bin/bash
set -a
[ -f /opt/bookshelf/secrets/bookshelf.env ] && source /opt/bookshelf/secrets/bookshelf.env
[ -f /opt/bookshelf/bookshelf.env ] && source /opt/bookshelf/bookshelf.env
set +a

11
modules/apps/bookshelf/lib/scripts/install-bookshelf.sh
View File

@@ -31,6 +31,17 @@ done
if [ "$CONCLUSION" = "success" ]; then
echo "Launching command..."
while [ "$(docker inspect -f '{{.State.Running}}' bookshelf-database-1 2>/dev/null)" != "true" ]; do
echo "Waiting database container status"
sleep 5
done
until docker exec bookshelf-database-1 sh -c "mariadb -u root -p$MARIADB_ROOT_PASSWORD -e 'SELECT 1;' >/dev/null 2>&1"; do
echo "Waitin mariadb to accept connections"
sleep 5
done
echo "Restoring backup"
systemctl start restore-backup.service
else
echo "Workflow failed or was cancelled, aborting."

18
modules/apps/bookshelf/lib/scripts/install-runner.sh
View File

@@ -2,6 +2,16 @@
source /opt/bookshelf/env.sh
## .env should define
# ACT_RUNNER_USER: act_runner username (act_runner)
# ACT_RUNNER_LOCATION: act_runner binary location (/usr/local/bin)
# ACT_RUNNER_VERSION: act_runner version (0.2.13)
# ENV_FILE_LOCATION: .env file location on vm (/opt/bookshelf/bookshelf.env)
# GITEA_INSTANCE_URL: url of the gitea instance (https://gitea.aldon.fr)
# GITEA_RUNNER_REGISTRATION_TOKEN: registration token for gitea runner (repository scope)
# USERNAME: username of the vm (bookshelf)
# REPOSITORY: repository on which service code is hosted (mop/bookshelf)
if ! id -u $ACT_RUNNER_USER >/dev/null 2>&1; then
adduser \
--system \
@@ -30,9 +40,9 @@ runner:
fetch_interval: 2s
github_mirror: ''
labels:
- "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
- "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
- "ubuntu-20.04:docker://docker.gitea.com/runner-images:ubuntu-20.04"
- 'ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest'
- 'ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04'
- 'ubuntu-20.04:docker://docker.gitea.com/runner-images:ubuntu-20.04'
cache:
enabled: true
dir: ""
@@ -55,5 +65,5 @@ host:
EOF
cd /home/act_runner
sudo -u $ACT_RUNNER_USER act_runner register --no-interactive --instance $GITEA_INSTANCE_URL --token $GITEA_RUNNER_REGISTRATION_TOKEN --name $USERNAME --labels $USERNAME $REPOSITORY
sudo -u $ACT_RUNNER_USER act_runner register --no-interactive --instance $GITEA_INSTANCE_URL --token $GITEA_RUNNER_REGISTRATION_TOKEN --name $USERNAME --labels $USERNAME
chown -R $ACT_RUNNER_USER:docker /home/$ACT_RUNNER_USER

9
modules/apps/bookshelf/lib/services/create-backup.service Normal file
View File

@@ -0,0 +1,9 @@
[Unit]
Description=Backup Service
Wants=network.target
After=network.target docker.service
[Service]
Type=oneshot
User=root
ExecStart=/usr/local/bin/backup.sh

2
modules/apps/gitea/lib/services/weekly-backup.timer → modules/apps/bookshelf/lib/services/create-backup.timer
View File

@@ -1,5 +1,5 @@
[Unit]
Description=Run Gitea backup weekly
Description=Run backup weekly
[Timer]
OnCalendar=Sun *-*-* 01:00:00

6
modules/apps/bookshelf/lib/services/restore-backup.service
View File

@@ -1,11 +1,9 @@
[Unit]
Description=Restore latest Bookshelf backup
Description=Restore latest backup
After=network.target
Requires=docker.service
[Service]
Type=oneshot
User=root
ExecStart=/usr/local/bin/restore-backup.sh
WorkingDirectory=/home/bookshelf
TimeoutStartSec=600
ExecStart=/usr/local/bin/restore-backup.sh

10
modules/apps/bookshelf/lib/services/weekly-backup.service
View File

@@ -1,10 +0,0 @@
[Unit]
Description=Weekly Bookshelf Backup
Wants=network.target
After=network.target docker.service
Before=shutdown.target reboot.target halt.target
[Service]
Type=oneshot
User=root
ExecStart=/usr/local/bin/backup.sh

6
modules/apps/bookshelf/main.tf
View File

@@ -5,7 +5,7 @@ module "vm" {
domain = var.domain
vm_id = var.vm_id
node_name = var.node_name
vm_ip_address = "192.168.1.91"
vm_ip_address = var.vm_ip_address
template_id = var.template_id
@@ -26,8 +26,8 @@ module "vm" {
restore-backup-script = indent(6, file("${path.module}/lib/scripts/restore-backup.sh"))
restore-backup-service = indent(6, file("${path.module}/lib/services/restore-backup.service"))
create-backup-script = indent(6, file("${path.module}/lib/scripts/create-backup.sh"))
create-backup-service = indent(6, file("${path.module}/lib/services/weekly-backup.service"))
create-backup-timer = indent(6, file("${path.module}/lib/services/weekly-backup.timer"))
create-backup-service = indent(6, file("${path.module}/lib/services/create-backup.service"))
create-backup-timer = indent(6, file("${path.module}/lib/services/create-backup.timer"))
act_runner-service = indent(6, file("${path.module}/lib/services/act_runner.service"))
act_runner-install-script = indent(6, file("${path.module}/lib/scripts/install-runner.sh"))
bookshelf-install-script = indent(6, file("${path.module}/lib/scripts/install-bookshelf.sh"))

9
modules/apps/bookshelf/output.tf Normal file
View File

@@ -0,0 +1,9 @@
output "traefik_service" {
value = [{
domain = var.domain
name = var.name
host = "${var.hostname}"
ip = var.vm_ip_address
port = 80
}]
}

10
modules/apps/bookshelf/variables.tf
View File

@@ -21,6 +21,12 @@ variable "memory" {
default = 2048
}
variable "balloon" {
description = "Minimum vm memory, using ballooning devide to reach Proxmox node memory target."
type = number
default = 1024
}
variable "template_id" {
type = number
}
@@ -49,4 +55,8 @@ variable "disk_size" {
variable "proxmox_host_ip" {
type = string
}
variable "vm_ip_address" {
type = string
}

24
modules/apps/fefan/.env.example Normal file
View File

@@ -0,0 +1,24 @@
ACT_RUNNER_VERSION=0.2.13
ACT_RUNNER_LOCATION=/usr/local/bin
ACT_RUNNER_USER=act_runner
ENV_FILE_LOCATION=/opt/fefan/fefan.env
GITEA_INSTANCE_URL=https://gitea.aldon.fr
GITEA_RUNNER_REGISTRATION_TOKEN=<gitea-repository-runner-token>
GITEA_FEFAN_APPLICATION_TOKEN=<gitea-auth-token>
GITEA_FEFAN_REPOSITORY=Mop/fefan
NEXT_PUBLIC_CONTENT_URI=https://content.fefan.fr/api
NEXT_PUBLIC_IMG_URI=https://content.fefan.fr
NEXT_PUBLIC_ORIGIN=https://fefan.fr
POSTGRES_USER=strapi
POSTGRES_PASSWORD=password
STRAPI_APP_KEYS=
STRAPI_TOKEN_SALT=
STRAPI_ADMIN_JWT_SECRET=
STRAPI_TRANSFER_TOKEN_SALT=
STRAPI_JWT_SECRET=
USERNAME=fefan
FEFAN_BACKUPS_DIR=/backups/fefan
FEFAN_BACKUP_PREFIX=fefan-dump

92
modules/apps/fefan/cloud-init/service.yaml Normal file
View File

@@ -0,0 +1,92 @@
#cloud-config
hostname: ${hostname}
local-hostname: ${hostname}
fqdn: ${hostname}.${domain}
manage_etc_hosts: true
users:
- default
- name: ${hostname}
groups: sudo
shell: /bin/bash
sudo: ALL=(ALL) NOPASSWD:ALL
ssh_authorized_keys:
- ${ssh_key}
disable_root: true
package_update: true
package_upgrade: false
packages:
- git
- nfs-common
- docker.io
- docker-compose
- curl
- jq
mounts:
- [ "192.168.1.12:/main/backups", "/backups", "nfs", "defaults,_netdev,x-systemd.requires=network-online.target", "0", "0" ]
write_files:
- path: /opt/fefan/env.sh
permissions: "0644"
content: |
${environment-setup-script}
- path: /opt/fefan/fefan.env
permissions: "0644"
content: |
${env-file-content}
- path: /usr/local/bin/restore-backup.sh
permissions: "0755"
content: |
${restore-backup-script}
- path: /etc/systemd/system/restore-backup.service
permissions: "0644"
content: |
${restore-backup-service}
- path: /usr/local/bin/backup.sh
permissions: "0755"
content: |
${create-backup-script}
- path: /etc/systemd/system/create-backup.timer
permissions: "0644"
content: |
${create-backup-timer}
- path: /etc/systemd/system/create-backup.service
permissions: "0644"
content: |
${create-backup-service}
- path: /etc/systemd/system/act_runner.service
permissions: "0644"
content: |
${act_runner-service}
- path: /opt/fefan/install-runner.sh
permissions: "0755"
content: |
${act_runner-install-script}
- path: /opt/fefan/install-fefan.sh
permissions: "0755"
content: |
${fefan-install-script}
runcmd:
# Backup setup
- mkdir -p /backups
- mount -t nfs ${proxmox_host_ip}:/main/backups /backups
- systemctl enable --now create-backup.timer
# Docker setup
- systemctl enable docker
- systemctl start docker
- usermod -aG docker ${hostname}
# Act_runner install
- /opt/fefan/install-runner.sh
- systemctl daemon-reload
- systemctl enable act_runner.service
- systemctl start act_runner.service
# Install fefan
- /opt/fefan/install-fefan.sh
final_message: |
Base system ready for ${hostname}

14
modules/apps/fefan/lib/scripts/create-backup.sh Normal file
View File

@@ -0,0 +1,14 @@
#!/bin/bash
source /opt/fefan/env.sh
# FEFAN_BACKUPS_DIR=/backups/fefan
# FEFAN_BACKUP_PREFIX=fefan-dump
TIMESTAMP=$(date +'%Y-%m-%d_%H%M%S')
docker exec fefan-strapi-1 yarn strapi export -f export --no-encrypt
docker cp fefan-strapi-1:/app/export.tar.gz $FEFAN_BACKUPS_DIR/$FEFAN_BACKUP_PREFIX-$TIMESTAMP.tar.gz
docker exec fefan-strapi-1 rm /app/export.tar.gz
ls -1dt $FEFAN_BACKUPS_DIR/$FEFAN_BACKUP_PREFIX-*.tar.gz | tail -n +5 | xargs -r rm -f

4
modules/apps/fefan/lib/scripts/env.sh Normal file
View File

@@ -0,0 +1,4 @@
#!/bin/bash
set -a
[ -f /opt/fefan/fefan.env ] && source /opt/fefan/fefan.env
set +a

44
modules/apps/fefan/lib/scripts/install-fefan.sh Normal file
View File

@@ -0,0 +1,44 @@
#!/bin/bash
source /opt/fefan/env.sh
# trigger manually a CI/CD pipeline
curl -X POST -H "Authorization: token $GITEA_FEFAN_APPLICATION_TOKEN" \
-H "Content-Type: application/json" \
$GITEA_INSTANCE_URL/api/v1/repos/$GITEA_FEFAN_REPOSITORY/actions/workflows/deploy.yaml/dispatches \
-d '{"ref": "main", "inputs": {"ref": "main"}}'
RUN_ID=$(curl -s -H "Authorization: token $GITEA_FEFAN_APPLICATION_TOKEN" \
$GITEA_INSTANCE_URL/api/v1/repos/$GITEA_FEFAN_REPOSITORY/actions/runs \
| jq -r '.workflow_runs | sort_by(.created_at) | .[0].id')
while true; do
STATUS=$(curl -s -H "Authorization: token $GITEA_FEFAN_APPLICATION_TOKEN" \
$GITEA_INSTANCE_URL/api/v1/repos/$GITEA_FEFAN_REPOSITORY/actions/runs/$RUN_ID \
| jq -r '.status')
if [ "$STATUS" = "completed" ]; then
CONCLUSION=$(curl -s -H "Authorization: token $GITEA_FEFAN_APPLICATION_TOKEN" \
$GITEA_INSTANCE_URL/api/v1/repos/$GITEA_FEFAN_REPOSITORY/actions/runs/$RUN_ID \
| jq -r '.conclusion')
echo "Workflow finished with status: $CONCLUSION"
break
fi
echo "Waiting 10 seconds..."
sleep 10
done
if [ "$CONCLUSION" = "success" ]; then
echo "Launching command..."
while [ "$(docker inspect -f '{{.State.Running}}' fefan-db-1 2>/dev/null)" != "true" ]; do
echo "Waiting database container status"
sleep 5
done
systemctl start restore-backup.service
else
echo "Workflow failed or was cancelled, aborting."
exit 1
fi

69
modules/apps/fefan/lib/scripts/install-runner.sh Normal file
View File

@@ -0,0 +1,69 @@
#!/bin/bash
source /opt/fefan/env.sh
## .env should define
# ACT_RUNNER_USER: act_runner username (act_runner)
# ACT_RUNNER_LOCATION: act_runner binary location (/usr/local/bin)
# ACT_RUNNER_VERSION: act_runner version (0.2.13)
# ENV_FILE_LOCATION: .env file location on vm (/opt/fefan/fefan.env)
# GITEA_INSTANCE_URL: url of the gitea instance (https://gitea.aldon.fr)
# GITEA_RUNNER_REGISTRATION_TOKEN: registration token for gitea runner (repository scope)
# USERNAME: username of the vm (fefan)
# REPOSITORY: repository on which service code is hosted (mop/fefan)
if ! id -u $ACT_RUNNER_USER >/dev/null 2>&1; then
adduser \
--system \
--shell /bin/bash \
--gecos 'Action runner user' \
--ingroup docker\
--disabled-password \
--home /home/$ACT_RUNNER_USER \
$ACT_RUNNER_USER
fi
wget -O $ACT_RUNNER_LOCATION/act_runner https://dl.gitea.com/act_runner/$ACT_RUNNER_VERSION/act_runner-$ACT_RUNNER_VERSION-linux-amd64
chmod +x $ACT_RUNNER_LOCATION/act_runner
cat <<EOF > /home/$ACT_RUNNER_USER/config.yaml
log:
level: info
runner:
file: .runner
capacity: 1
timeout: 3h
shutdown_timeout: 0s
insecure: false
fetch_timeout: 5s
env_file: $ENV_FILE_LOCATION
fetch_interval: 2s
github_mirror: ''
labels:
- 'ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest'
- 'ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04'
- 'ubuntu-20.04:docker://docker.gitea.com/runner-images:ubuntu-20.04'
cache:
enabled: true
dir: ""
host: ""
port: 0
external_server: ""
container:
network: ""
privileged: false
options:
workdir_parent:
valid_volumes: []
docker_host: ""
force_pull: true
force_rebuild: false
require_docker: false
docker_timeout: 0s
host:
workdir_parent:
EOF
cd /home/act_runner
sudo -u $ACT_RUNNER_USER act_runner register --no-interactive --instance $GITEA_INSTANCE_URL --token $GITEA_RUNNER_REGISTRATION_TOKEN --name $USERNAME --labels $USERNAME
chown -R $ACT_RUNNER_USER:docker /home/$ACT_RUNNER_USER

14
modules/apps/fefan/lib/scripts/restore-backup.sh Normal file
View File

@@ -0,0 +1,14 @@
#!/bin/bash
source /opt/fefan/env.sh
# FEFAN_BACKUPS_DIR=/backups/fefan
# FEFAN_BACKUP_PREFIX=fefan-dump
LATEST_BACKUP=$(ls -1 $FEFAN_BACKUPS_DIR/$FEFAN_BACKUP_PREFIX-*.tar.gz 2>/dev/null | sort | tail -n1)
if [ -n "$LATEST_BACKUP" ] && [ -f "$LATEST_BACKUP" ]; then
docker cp $LATEST_BACKUP fefan-strapi-1:/app/${LATEST_BACKUP#"$FEFAN_BACKUPS_DIR"/}
docker exec fefan-strapi-1 yarn strapi import -f /app/${LATEST_BACKUP#"$FEFAN_BACKUPS_DIR"/} --force
docker exec fefan-strapi-1 rm /app/${LATEST_BACKUP#"$FEFAN_BACKUPS_DIR"/}
fi

16
modules/apps/fefan/lib/services/act_runner.service Normal file
View File

@@ -0,0 +1,16 @@
[Unit]
Description=Gitea Actions runner
Documentation=https://gitea.com/gitea/act_runner
After=docker.service
[Service]
ExecStart=/usr/local/bin/act_runner daemon --config /home/act_runner/config.yaml
ExecReload=/bin/kill -s HUP $MAINPID
WorkingDirectory=/home/act_runner
TimeoutSec=0
RestartSec=10
Restart=always
User=act_runner
[Install]
WantedBy=multi-user.target

9
modules/apps/fefan/lib/services/create-backup.service Normal file
View File

@@ -0,0 +1,9 @@
[Unit]
Description=Backup Service
Wants=network.target
After=network.target docker.service
[Service]
Type=oneshot
User=root
ExecStart=/usr/local/bin/backup.sh

2
modules/apps/bookshelf/lib/services/weekly-backup.timer → modules/apps/fefan/lib/services/create-backup.timer
View File

@@ -1,5 +1,5 @@
[Unit]
Description=Run Bookshelf backup weekly
Description=Run backup weekly
[Timer]
OnCalendar=Sun *-*-* 01:00:00

9
modules/apps/fefan/lib/services/restore-backup.service Normal file
View File

@@ -0,0 +1,9 @@
[Unit]
Description=Restore latest backup
After=network.target
Requires=docker.service
[Service]
Type=oneshot
User=root
ExecStart=/usr/local/bin/restore-backup.sh

37
modules/apps/fefan/main.tf Normal file
View File

@@ -0,0 +1,37 @@
module "vm" {
source = "../../vm"
name = var.name
hostname = var.hostname
domain = var.domain
vm_id = var.vm_id
node_name = var.node_name
vm_ip_address = var.vm_ip_address
template_id = var.template_id
cores = var.cores
memory = var.memory
disk_size = var.disk_size
ssh_public_key = var.ssh_public_key
proxmox_host_ip = var.proxmox_host_ip
cloudinit_config = templatefile(
"${path.module}/cloud-init/service.yaml",
{
hostname = var.hostname
domain = var.domain
ssh_key = var.ssh_public_key
proxmox_host_ip = var.proxmox_host_ip
environment-setup-script = indent(6, file("${path.module}/lib/scripts/env.sh"))
restore-backup-script = indent(6, file("${path.module}/lib/scripts/restore-backup.sh"))
restore-backup-service = indent(6, file("${path.module}/lib/services/restore-backup.service"))
create-backup-script = indent(6, file("${path.module}/lib/scripts/create-backup.sh"))
create-backup-service = indent(6, file("${path.module}/lib/services/create-backup.service"))
create-backup-timer = indent(6, file("${path.module}/lib/services/create-backup.timer"))
act_runner-service = indent(6, file("${path.module}/lib/services/act_runner.service"))
act_runner-install-script = indent(6, file("${path.module}/lib/scripts/install-runner.sh"))
fefan-install-script = indent(6, file("${path.module}/lib/scripts/install-fefan.sh"))
env-file-content = indent(6, file("${path.module}/.env"))
}
)
}

18
modules/apps/fefan/output.tf Normal file
View File

@@ -0,0 +1,18 @@
output "traefik_service" {
value = [
{
domain = "fefan.fr"
name = "fefan"
host = ""
ip = var.vm_ip_address
port = 3000
},
{
domain = "fefan.fr"
name = "content-fefan"
host = "content"
ip = var.vm_ip_address
port = 1337
}
]
}

62
modules/apps/fefan/variables.tf Normal file
View File

@@ -0,0 +1,62 @@
variable "name" {
type = string
}
variable "vm_id" {
type = number
}
variable "node_name" {
type = string
default = "mop"
}
variable "cores" {
type = number
default = 2
}
variable "memory" {
type = number
default = 2048
}
variable "balloon" {
description = "Minimum vm memory, using ballooning devide to reach Proxmox node memory target."
type = number
default = 1024
}
variable "template_id" {
type = number
}
variable "ssh_public_key" {
type = string
description = "Public SSH key for cloud-init user"
}
variable "hostname" {
description = "VM hostname"
type = string
default = "test"
}
variable "domain" {
description = "VM domain"
type = string
default = ""
}
variable "disk_size" {
type = number
default = 10
}
variable "proxmox_host_ip" {
type = string
}
variable "vm_ip_address" {
type = string
}

8
modules/apps/gateway/.env.example Normal file
View File

@@ -0,0 +1,8 @@
#openssl rand -hex 20
WEBHOOK_SECRET=xxx
TRAEFIK_VERSION=v3.6.7
TRAEFIK_BINARY=/usr/local/bin/traefik
TRAEFIK_USER=traefik
TRAEFIK_CONF=/home/traefik/traefik.yml
GATEWAY_REPOSITORY=/Mop/gateway
GATEWAY_REPOSITORY_LOCATION=/home/traefik/gateway

60
modules/apps/gateway/cloud-init/service.yaml Normal file
View File

@@ -0,0 +1,60 @@
#cloud-config
hostname: ${hostname}
local-hostname: ${hostname}
fqdn: ${hostname}.${domain}
manage_etc_hosts: true
users:
- default
- name: ${hostname}
groups: sudo
shell: /bin/bash
sudo: ALL=(ALL) NOPASSWD:ALL
ssh_authorized_keys:
- ${ssh_key}
disable_root: true
package_update: true
package_upgrade: false
packages:
- git
- nfs-common
- curl
- python3-flask
- gunicorn
write_files:
- path: /opt/gateway/env.sh
permissions: "0644"
content: |
${environment-setup-script}
- path: /opt/gateway/gateway.env
permissions: "0644"
content: |
${env-file-content}
- path: /opt/gateway/install-traefik.sh
permissions: "0755"
content: |
${install-traefik-script}
- path: /usr/local/bin/pull-webhook.py
permissions: "0755"
content: |
${pull-webhook-script}
- path: /etc/systemd/system/pull-webhook.service
permissions: "0755"
content: |
${pull-webhook-service}
- path: /etc/systemd/system/traefik.service
permissions: "0755"
content: |
${traefik-service}
runcmd:
- /opt/gateway/install-traefik.sh
- systemctl enable pull-webhook.service
- systemctl start pull-webhook.service
final_message: |
Base system ready for ${hostname}

4
modules/apps/gateway/lib/scripts/env.sh Normal file
View File

@@ -0,0 +1,4 @@
#!/bin/bash
set -a
[ -f /opt/gateway/gateway.env ] && source /opt/gateway/gateway.env
set +a

63
modules/apps/gateway/lib/scripts/install-traefik.sh Normal file
View File

@@ -0,0 +1,63 @@
#!/bin/bash
# GATEWAY_REPOSITORY_LOCATION (path on vm)
# GATEWAY_REPOSITORY (path on gitea)
# TRAEFIK_USER
# TRAEFIK_BINARY
# TRAEFIK_VERSION
# TRAEFIK_CONF
source /opt/gateway/env.sh
if ! id -u $TRAEFIK_USER >/dev/null 2>&1; then
adduser \
--system \
--shell /bin/bash \
--gecos 'Traefik reverse proxy user' \
--group \
--disabled-password \
--home /home/$TRAEFIK_USER \
$TRAEFIK_USER
fi
if [ ! -f $TRAEFIK_BINARY ]; then
wget -O /tmp/traefik.tar.gz "https://github.com/traefik/traefik/releases/download/$TRAEFIK_VERSION/traefik_${TRAEFIK_VERSION}_linux_amd64.tar.gz"
tar -zxvf /tmp/traefik.tar.gz -C /usr/local/bin traefik
chmod +x $TRAEFIK_BINARY
fi
mkdir -p /etc/traefik/certs
touch /etc/traefik/acme.json
chown $TRAEFIK_USER:$TRAEFIK_USER /etc/traefik/acme.json
chmod 600 /etc/traefik/acme.json
setcap 'cap_net_bind_service=+ep' /usr/local/bin/traefik
git clone https://gitea.aldon.fr/$GATEWAY_REPOSITORY.git $GATEWAY_REPOSITORY_LOCATION
cat > "$TRAEFIK_CONF" <<EOF
entryPoints:
web:
address: ":80"
websecure:
address: ":443"
providers:
file:
directory: $GATEWAY_REPOSITORY_LOCATION
watch: true
api:
dashboard: false
insecure: false
log:
level: INFO
accessLog: {}
certificatesResolvers:
letsencrypt:
acme:
email: julien.aldon@wanadoo.fr
storage: /etc/traefik/acme.json
httpChallenge:
entryPoint: web
EOF
systemctl enable traefik.service
systemctl start traefik.service

23
modules/apps/gateway/lib/scripts/pull-webhook.py Normal file
View File

@@ -0,0 +1,23 @@
from flask import Flask, request, abort
import subprocess
import os
SECRET = os.environ.get("WEBHOOK_SECRET")
REPOSITORY = os.environ.get("GATEWAY_REPOSITORY_LOCATION")
app = Flask(__name__)
@app.route("/reload", methods=["POST"])
def reload():
token = request.headers.get("X-Webhook-Token")
if token != SECRET:
abort(403)
subprocess.run(
["git", "-C", REPOSITORY, "pull"],
check=True
)
return "ok\n"
if __name__ == "__main__":
app.run()

13
modules/apps/gateway/lib/services/pull-webhook.service Normal file
View File

@@ -0,0 +1,13 @@
[Unit]
Description=Traefik config webhook
After=network.target
[Service]
WorkingDirectory=/usr/local/bin
ExecStart=/usr/bin/gunicorn --bind 0.0.0.0:5555 pull-webhook:app
EnvironmentFile=/opt/gateway/gateway.env
Restart=always
User=root
[Install]
WantedBy=multi-user.target

13
modules/apps/gateway/lib/services/traefik.service Normal file
View File

@@ -0,0 +1,13 @@
[Unit]
Description=Traefik reverse proxy
After=network.target
[Service]
User=traefik
Group=traefik
ExecStart=/usr/local/bin/traefik --configFile=/home/traefik/traefik.yml
Restart=always
RestartSec=5s
[Install]
WantedBy=multi-user.target

33
modules/apps/gateway/main.tf Normal file
View File

@@ -0,0 +1,33 @@
module "vm" {
source = "../../vm"
name = var.name
hostname = var.hostname
domain = var.domain
vm_id = var.vm_id
node_name = var.node_name
vm_ip_address = var.vm_ip_address
template_id = var.template_id
cores = var.cores
memory = var.memory
disk_size = var.disk_size
ssh_public_key = var.ssh_public_key
proxmox_host_ip = var.proxmox_host_ip
cloudinit_config = templatefile(
"${path.module}/cloud-init/service.yaml",
{
hostname = var.hostname
domain = var.domain
ssh_key = var.ssh_public_key
proxmox_host_ip = var.proxmox_host_ip
environment-setup-script = indent(6, file("${path.module}/lib/scripts/env.sh"))
env-file-content = indent(6, file("${path.module}/.env"))
pull-webhook-service = indent(6, file("${path.module}/lib/services/pull-webhook.service"))
pull-webhook-script = indent(6, file("${path.module}/lib/scripts/pull-webhook.py"))
traefik-service = indent(6, file("${path.module}/lib/services/traefik.service"))
install-traefik-script = indent(6, file("${path.module}/lib/scripts/install-traefik.sh"))
}
)
}

62
modules/apps/gateway/variables.tf Normal file
View File

@@ -0,0 +1,62 @@
variable "name" {
type = string
}
variable "vm_id" {
type = number
}
variable "node_name" {
type = string
default = "mop"
}
variable "cores" {
type = number
default = 2
}
variable "memory" {
type = number
default = 2048
}
variable "balloon" {
description = "Minimum vm memory, using ballooning devide to reach Proxmox node memory target."
type = number
default = 1024
}
variable "template_id" {
type = number
}
variable "ssh_public_key" {
type = string
description = "Public SSH key for cloud-init user"
}
variable "hostname" {
description = "VM hostname"
type = string
default = "test"
}
variable "domain" {
description = "VM domain"
type = string
default = ""
}
variable "disk_size" {
type = number
default = 10
}
variable "proxmox_host_ip" {
type = string
}
variable "vm_ip_address" {
type = string
}

9
modules/apps/gitea/.env.example Normal file
View File

@@ -0,0 +1,9 @@
GITEA_HOME="/var/lib/gitea"
GITEA_CONF="/var/lib/gitea/app.ini"
GITEA_USER="git"
GITEA_VERSION="1.25.3"
GITEA_BINARY="/usr/local/bin/gitea"
GITEA_SERVICE="/etc/systemd/system/gitea.service"
DB_NAME="giteadb"
DB_USER="gitea"
GITEA_BACKUPS_DIR="/backups/gitea"

13
modules/apps/gitea/cloud-init/service.yaml
View File

@@ -31,11 +31,14 @@ packages:
- postgresql
- postgresql-client
mounts:
- [ "192.168.1.12:/main/backups", "/backups", "nfs", "defaults,_netdev,x-systemd.requires=network-online.target", "0", "0" ]
write_files:
- path: /etc/fstab
- path: /opt/gitea/gitea.env
permissions: "0644"
content: |
${proxmox_host_ip}:/main/backups /backups nfs defaults,_netdev 0 0
${env-file-content}
- path: /opt/gitea/env.sh
permissions: "0644"
content: |
@@ -52,11 +55,11 @@ write_files:
permissions: "0755"
content: |
${create-backup-script}
- path: /etc/systemd/system/weekly-backup.timer
- path: /etc/systemd/system/create-backup.timer
permissions: "0644"
content: |
${create-backup-timer}
- path: /etc/systemd/system/weekly-backup.service
- path: /etc/systemd/system/create-backup.service
permissions: "0644"
content: |
${create-backup-service}
@@ -73,7 +76,7 @@ runcmd:
# Backup setup
- mkdir -p /backups
- mount -t nfs ${proxmox_host_ip}:/main/backups /backups
- systemctl enable --now weekly-backup.timer
- systemctl enable --now create-backup.timer
# Docker setup
- systemctl enable docker
- systemctl start docker

2
modules/apps/gitea/lib/scripts/create-backup.sh
View File

@@ -5,6 +5,6 @@ source /opt/gitea/env.sh
TIMESTAMP=$(date +'%Y-%m-%d_%H%M%S')
sudo -u "$GITEA_USER" gitea dump -c "$GITEA_HOME/app.ini" -f $GITEA_BACKUPS_DIR/gitea-dump-\$TIMESTAMP.zip
sudo -u "$GITEA_USER" gitea dump -c "$GITEA_HOME/app.ini" -f $GITEA_BACKUPS_DIR/gitea-dump-$TIMESTAMP.zip
ls -1dt $GITEA_BACKUPS_DIR/gitea-dump-*.zip | tail -n +5 | xargs -r rm -f

14
modules/apps/gitea/lib/scripts/env.sh
View File

@@ -1,12 +1,4 @@
#!/bin/bash
set -euo pipefail
GITEA_HOME="/var/lib/gitea"
GITEA_CONF="$GITEA_HOME/app.ini"
GITEA_USER="git"
GITEA_VERSION="1.25.3"
GITEA_BINARY="/usr/local/bin/gitea"
GITEA_SERVICE="/etc/systemd/system/gitea.service"
DB_NAME="giteadb"
DB_USER="gitea"
GITEA_BACKUPS_DIR="/backups/gitea"
set -a
[ -f /opt/gitea/gitea.env ] && source /opt/gitea/gitea.env
set +a

11
modules/apps/gitea/lib/scripts/install-gitea.sh
View File

@@ -21,6 +21,12 @@ mkdir -p $GITEA_HOME/{custom,data,log}
chown -R $GITEA_USER:$GITEA_USER $GITEA_HOME
chmod -R 750 $GITEA_HOME
mkdir -p /home/$GITEA_USER/.ssh
touch /home/$GITEA_USER/.ssh/authorized_keys
chown -R $GITEA_USER:$GITEA_USER /home/$GITEA_USER/.ssh
chmod 700 /home/$GITEA_USER/.ssh
chmod 600 /home/$GITEA_USER/.ssh/authorized_keys
if [ ! -f $GITEA_BINARY ]; then
wget -O /tmp/gitea "https://dl.gitea.com/gitea/$GITEA_VERSION/gitea-$GITEA_VERSION-linux-amd64"
chmod +x /tmp/gitea
@@ -67,6 +73,7 @@ INTERNAL_TOKEN = $GITEA_INTERNAL_TOKEN
[server]
DOMAIN = gitea.aldon.fr
SSH_AUTHORIZED_KEYS = /home/git/.ssh/authorized_keys
HTTP_PORT = 3000
ROOT_URL = https://gitea.aldon.fr
DISABLE_SSH = false
@@ -89,5 +96,9 @@ chmod 640 $GITEA_CONF
systemctl daemon-reload
systemctl enable gitea
sudo -u git gitea --config $GITEA_CONF admin regenerate keys
systemctl is-active --quiet gitea || systemctl start gitea
echo "---- Gitea installation completed ----"

9
modules/apps/gitea/lib/services/create-backup.service Normal file
View File

@@ -0,0 +1,9 @@
[Unit]
Description=Backup Service
Wants=network.target
After=network.target gitea.service
[Service]
Type=oneshot
User=root
ExecStart=/usr/local/bin/backup.sh

9
modules/apps/gitea/lib/services/create-backup.timer Normal file
View File

@@ -0,0 +1,9 @@
[Unit]
Description=Run backup weekly
[Timer]
OnCalendar=Sun *-*-* 01:00:00
Persistent=true
[Install]
WantedBy=timers.target

6
modules/apps/gitea/lib/services/restore-backup.service
View File

@@ -1,11 +1,9 @@
[Unit]
Description=Restore latest Gitea backup
Description=Restore latest backup
After=network.target postgresql.service gitea.service
Requires=postgresql.service gitea.service
[Service]
Type=oneshot
User=root
ExecStart=/usr/local/bin/restore-backup.sh
WorkingDirectory=/var/lib/gitea
TimeoutStartSec=600
ExecStart=/usr/local/bin/restore-backup.sh

10
modules/apps/gitea/lib/services/weekly-backup.service
View File

@@ -1,10 +0,0 @@
[Unit]
Description=Weekly Gitea Backup
Wants=network.target
After=network.target gitea.service
Before=shutdown.target reboot.target halt.target
[Service]
Type=oneshot
User=root
ExecStart=/usr/local/bin/backup.sh

8
modules/apps/gitea/main.tf
View File

@@ -5,7 +5,7 @@ module "vm" {
domain = var.domain
vm_id = var.vm_id
node_name = var.node_name
vm_ip_address = "192.168.1.90"
vm_ip_address = var.vm_ip_address
template_id = var.template_id
@@ -26,10 +26,12 @@ module "vm" {
restore-backup-script = indent(6, file("${path.module}/lib/scripts/restore-backup.sh"))
restore-backup-service = indent(6, file("${path.module}/lib/services/restore-backup.service"))
create-backup-script = indent(6, file("${path.module}/lib/scripts/create-backup.sh"))
create-backup-service = indent(6, file("${path.module}/lib/services/weekly-backup.service"))
create-backup-timer = indent(6, file("${path.module}/lib/services/weekly-backup.timer"))
create-backup-service = indent(6, file("${path.module}/lib/services/create-backup.service"))
create-backup-timer = indent(6, file("${path.module}/lib/services/create-backup.timer"))
install-gitea-script = indent(6, file("${path.module}/lib/scripts/install-gitea.sh"))
gitea-service = indent(6, file("${path.module}/lib/services/gitea.service"))
env-file-content = indent(6, file("${path.module}/.env"))
}
)
}

9
modules/apps/gitea/output.tf Normal file
View File

@@ -0,0 +1,9 @@
output "traefik_service" {
value = [{
domain = var.domain
name = var.name
host = "${var.hostname}"
ip = var.vm_ip_address
port = 3000
}]
}

10
modules/apps/gitea/variables.tf
View File

@@ -21,6 +21,12 @@ variable "memory" {
default = 2048
}
variable "balloon" {
description = "Minimum vm memory, using ballooning devide to reach Proxmox node memory target."
type = number
default = 1024
}
variable "template_id" {
type = number
}
@@ -49,4 +55,8 @@ variable "disk_size" {
variable "proxmox_host_ip" {
type = string
}
variable "vm_ip_address" {
type = string
}