homelab-nomad/core/blocky/blocky.tf

resource "nomad_job" "blocky" {
  jobspec = templatefile("${path.module}/blocky.nomad", {
    use_wesher  = var.use_wesher,
    module_path = path.module,
  })
}

# Generate secrets and policies for access to MySQL
resource "nomad_acl_policy" "blocky_mysql_bootstrap_secrets" {
  name        = "blocky-secrets-mysql"
  description = "Give access to MySQL secrets"
  rules_hcl   = <<EOH
namespace "default" {
  variables {
    path "secrets/mysql" {
      capabilities = ["read"]
    }
  }
}
EOH

  job_acl {
    job_id = "blocky"
    group  = "blocky"
    task   = "mysql-bootstrap"
  }
}

resource "random_password" "blocky_mysql_psk" {
  length           = 32
  override_special = "!@#%&*-_="
}

resource "nomad_variable" "blocky_mysql_psk" {
  path = "secrets/mysql/allowed_psks/blocky"
  items = {
    psk = "blocky:${resource.random_password.blocky_mysql_psk.result}"
  }
}

resource "nomad_acl_policy" "blocky_mysql_psk" {
  name        = "blocky-secrets-mysql-psk"
  description = "Give access to MySQL PSK secrets"
  rules_hcl   = <<EOH
namespace "default" {
  variables {
    path "secrets/mysql/allowed_psks/blocky" {
      capabilities = ["read"]
    }
  }
}
EOH

  job_acl {
    job_id = "blocky"
    group  = "blocky"
    task   = "stunnel"
  }
}

resource "nomad_variable" "blocky_lists_terraform" {
  path = "blocky_lists/terraform"
  items = {
    smarttv_regex = file("${path.module}/list-smarttv-regex.txt")
    wemo          = file("${path.module}/list-wemo.txt")
    sonos         = file("${path.module}/list-sonos.txt")
  }
}

resource "nomad_acl_policy" "blocky_lists" {
  name        = "blocky-lists"
  description = "Give access Blocky lists"
  rules_hcl   = <<EOH
namespace "default" {
  variables {
    path "blocky_lists/*" {
      capabilities = ["read"]
    }
  }
}
EOH

  job_acl {
    job_id = "blocky"
    group  = "blocky"
    task   = "blocky"
  }
}