add gateway automatic template and fefan vm

modules/apps/gateway/.env.example

@@ -0,0 +1,8 @@
+#openssl rand -hex 20
+WEBHOOK_SECRET=xxx
+TRAEFIK_VERSION=v3.6.7
+TRAEFIK_BINARY=/usr/local/bin/traefik
+TRAEFIK_USER=traefik
+TRAEFIK_CONF=/home/traefik/traefik.yml
+GATEWAY_REPOSITORY=/Mop/gateway
+GATEWAY_REPOSITORY_LOCATION=/home/traefik/gateway

modules/apps/gateway/cloud-init/service.yaml

@@ -0,0 +1,60 @@
+#cloud-config
+hostname: ${hostname}
+local-hostname: ${hostname}
+fqdn: ${hostname}.${domain}
+manage_etc_hosts: true
+
+users:
+  - default
+  - name: ${hostname}
+    groups: sudo
+    shell: /bin/bash
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    ssh_authorized_keys:
+      - ${ssh_key}
+
+disable_root: true
+
+package_update: true
+package_upgrade: false
+
+packages:
+  - git
+  - nfs-common
+  - curl
+  - python3-flask
+  - gunicorn
+
+write_files:
+  - path: /opt/gateway/env.sh
+    permissions: "0644"
+    content: |
+      ${environment-setup-script}
+  - path: /opt/gateway/gateway.env
+    permissions: "0644"
+    content: |
+      ${env-file-content}
+  - path: /opt/gateway/install-traefik.sh
+    permissions: "0755"
+    content: |
+      ${install-traefik-script}
+  - path: /usr/local/bin/pull-webhook.py
+    permissions: "0755"
+    content: |
+      ${pull-webhook-script}
+  - path: /etc/systemd/system/pull-webhook.service
+    permissions: "0755"
+    content: |
+      ${pull-webhook-service}
+  - path: /etc/systemd/system/traefik.service
+    permissions: "0755"
+    content: |
+      ${traefik-service}
+
+runcmd:
+  - /opt/gateway/install-traefik.sh
+  - systemctl enable pull-webhook.service
+  - systemctl start pull-webhook.service
+
+final_message: |
+  Base system ready for ${hostname}

modules/apps/gateway/lib/scripts/env.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+set -a
+[ -f /opt/gateway/gateway.env ] && source /opt/gateway/gateway.env
+set +a

modules/apps/gateway/lib/scripts/install-traefik.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+
+# GATEWAY_REPOSITORY_LOCATION (path on vm)
+# GATEWAY_REPOSITORY (path on gitea)
+# TRAEFIK_USER
+# TRAEFIK_BINARY
+# TRAEFIK_VERSION
+# TRAEFIK_CONF
+
+source /opt/gateway/env.sh
+
+if ! id -u $TRAEFIK_USER >/dev/null 2>&1; then
+    adduser \
+        --system \
+        --shell /bin/bash \
+        --gecos 'Traefik reverse proxy user' \
+        --group \
+        --disabled-password \
+        --home /home/$TRAEFIK_USER \
+        $TRAEFIK_USER
+fi
+
+if [ ! -f $TRAEFIK_BINARY ]; then
+    wget -O /tmp/traefik.tar.gz "https://github.com/traefik/traefik/releases/download/$TRAEFIK_VERSION/traefik_${TRAEFIK_VERSION}_linux_amd64.tar.gz"
+    tar -zxvf /tmp/traefik.tar.gz -C /usr/local/bin traefik
+    chmod +x $TRAEFIK_BINARY
+fi
+
+mkdir -p /etc/traefik/certs
+touch /etc/traefik/acme.json
+chown $TRAEFIK_USER:$TRAEFIK_USER /etc/traefik/acme.json
+chmod 600 /etc/traefik/acme.json
+setcap 'cap_net_bind_service=+ep' /usr/local/bin/traefik
+
+git clone https://gitea.aldon.fr/$GATEWAY_REPOSITORY.git $GATEWAY_REPOSITORY_LOCATION
+
+cat > "$TRAEFIK_CONF" <<EOF
+entryPoints:
+  web:
+    address: ":80"
+  websecure:
+    address: ":443"
+providers:
+  file:
+    directory: $GATEWAY_REPOSITORY_LOCATION
+    watch: true
+api:
+  dashboard: false
+  insecure: false
+log:
+  level: INFO
+accessLog: {}
+certificatesResolvers:
+  letsencrypt:
+    acme:
+      email: julien.aldon@wanadoo.fr
+      storage: /etc/traefik/acme.json
+      httpChallenge:
+        entryPoint: web
+EOF
+
+systemctl enable traefik.service
+systemctl start traefik.service

modules/apps/gateway/lib/scripts/pull-webhook.py

@@ -0,0 +1,23 @@
+from flask import Flask, request, abort
+import subprocess
+import os
+
+SECRET = os.environ.get("WEBHOOK_SECRET")
+REPOSITORY = os.environ.get("GATEWAY_REPOSITORY_LOCATION")
+
+app = Flask(__name__)
+
+@app.route("/reload", methods=["POST"])
+def reload():
+    token = request.headers.get("X-Webhook-Token")
+    if token != SECRET:
+        abort(403)
+
+    subprocess.run(
+        ["git", "-C", REPOSITORY, "pull"],
+        check=True
+    )
+    return "ok\n"
+
+if __name__ == "__main__":
+    app.run()

modules/apps/gateway/lib/services/pull-webhook.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Traefik config webhook
+After=network.target
+
+[Service]
+WorkingDirectory=/usr/local/bin
+ExecStart=/usr/bin/gunicorn --bind 0.0.0.0:5555 pull-webhook:app
+EnvironmentFile=/opt/gateway/gateway.env
+Restart=always
+User=root
+
+[Install]
+WantedBy=multi-user.target

modules/apps/gateway/lib/services/traefik.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Traefik reverse proxy
+After=network.target
+
+[Service]
+User=traefik
+Group=traefik
+ExecStart=/usr/local/bin/traefik --configFile=/home/traefik/traefik.yml
+Restart=always
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target

modules/apps/gateway/main.tf

@@ -0,0 +1,33 @@
+module "vm" {
+  source      = "../../vm"
+  name        = var.name
+  hostname    = var.hostname
+  domain      = var.domain
+  vm_id       = var.vm_id
+  node_name   = var.node_name
+  vm_ip_address = var.vm_ip_address
+
+  template_id = var.template_id
+
+  cores       = var.cores
+  memory      = var.memory
+  disk_size   = var.disk_size
+
+  ssh_public_key  = var.ssh_public_key
+  proxmox_host_ip = var.proxmox_host_ip
+  cloudinit_config = templatefile(
+      "${path.module}/cloud-init/service.yaml",
+      {
+        hostname        = var.hostname
+        domain          = var.domain
+        ssh_key         = var.ssh_public_key
+        proxmox_host_ip = var.proxmox_host_ip
+        environment-setup-script = indent(6, file("${path.module}/lib/scripts/env.sh"))
+        env-file-content = indent(6, file("${path.module}/.env"))
+        pull-webhook-service = indent(6, file("${path.module}/lib/services/pull-webhook.service"))
+        pull-webhook-script = indent(6, file("${path.module}/lib/scripts/pull-webhook.py"))
+        traefik-service = indent(6, file("${path.module}/lib/services/traefik.service"))
+        install-traefik-script = indent(6, file("${path.module}/lib/scripts/install-traefik.sh"))
+      }
+    )
+}

modules/apps/gateway/variables.tf

@@ -0,0 +1,62 @@
+variable "name" {
+  type = string
+}
+
+variable "vm_id" {
+  type = number
+}
+
+variable "node_name" {
+  type    = string
+  default = "mop"
+}
+
+variable "cores" {
+  type    = number
+  default = 2
+}
+
+variable "memory" {
+  type    = number
+  default = 2048
+}
+
+variable "balloon" {
+  description = "Minimum vm memory, using ballooning devide to reach Proxmox node memory target."
+  type = number
+  default = 1024
+}
+
+variable "template_id" {
+  type = number
+}
+
+variable "ssh_public_key" {
+  type        = string
+  description = "Public SSH key for cloud-init user"
+}
+
+variable "hostname" {
+  description = "VM hostname"
+  type        = string
+  default     = "test"
+}
+
+variable "domain" {
+  description = "VM domain"
+  type        = string
+  default     = ""
+}
+
+variable "disk_size" {
+  type    = number
+  default = 10
+}
+
+variable "proxmox_host_ip" {
+  type = string
+}
+
+variable "vm_ip_address" {
+  type = string
+}