Switch services to module based Terraform template from levant
This ends up with a better experience in dealing with tfstate for some services. Not sure why.
This commit is contained in:
parent
49c8a73ac9
commit
a30749f357
@ -211,17 +211,7 @@
|
|||||||
"line_number": 159,
|
"line_number": 159,
|
||||||
"is_secret": false
|
"is_secret": false
|
||||||
}
|
}
|
||||||
],
|
|
||||||
"services/main.tf": [
|
|
||||||
{
|
|
||||||
"type": "Secret Keyword",
|
|
||||||
"filename": "services/main.tf",
|
|
||||||
"hashed_secret": "f84864c6bffa2e0843a4ab2abdca91df7995c462",
|
|
||||||
"is_verified": false,
|
|
||||||
"line_number": 168,
|
|
||||||
"is_secret": false
|
|
||||||
}
|
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"generated_at": "2022-11-10T21:36:17Z"
|
"generated_at": "2022-11-11T21:26:53Z"
|
||||||
}
|
}
|
||||||
|
|||||||
19
services/.terraform.lock.hcl
generated
19
services/.terraform.lock.hcl
generated
@ -20,25 +20,6 @@ provider "registry.terraform.io/hashicorp/consul" {
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|
||||||
provider "registry.terraform.io/hashicorp/external" {
|
|
||||||
version = "2.2.3"
|
|
||||||
hashes = [
|
|
||||||
"h1:uvOYRWcVIqOZSl8YjjaB18yZFz1AWIt2CnK7O45rckg=",
|
|
||||||
"zh:184ecd339d764de845db0e5b8a9c87893dcd0c9d822167f73658f89d80ec31c9",
|
|
||||||
"zh:2661eaca31d17d6bbb18a8f673bbfe3fe1b9b7326e60d0ceb302017003274e3c",
|
|
||||||
"zh:2c0a180f6d1fc2ba6e03f7dfc5f73b617e45408681f75bca75aa82f3796df0e4",
|
|
||||||
"zh:4b92ae44c6baef4c4952c47be00541055cb5280dd3bc8031dba5a1b2ee982387",
|
|
||||||
"zh:5641694d5daf3893d7ea90be03b6fa575211a08814ffe70998d5adb8b59cdc0a",
|
|
||||||
"zh:5bd55a2be8a1c20d732ac9c604b839e1cadc8c49006315dffa4d709b6874df32",
|
|
||||||
"zh:6e0ef5d11e1597202424b7d69b9da7b881494c9b13a3d4026fc47012dc651c79",
|
|
||||||
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
|
|
||||||
"zh:9e19f89fa25004d3b926a8d15ea630b4bde62f1fa4ed5e11a3d27aabddb77353",
|
|
||||||
"zh:b763efdd69fd097616b4a4c89cf333b4cee9699ac6432d73d2756f8335d1213f",
|
|
||||||
"zh:e3b561efdee510b2b445f76a52a902c52bee8e13095e7f4bed7c80f10f8d294a",
|
|
||||||
"zh:fe660bb8781ee043a093b9a20e53069974475dcaa5791a1f45fd03c61a26478a",
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
||||||
provider "registry.terraform.io/hashicorp/nomad" {
|
provider "registry.terraform.io/hashicorp/nomad" {
|
||||||
version = "1.4.19"
|
version = "1.4.19"
|
||||||
hashes = [
|
hashes = [
|
||||||
|
|||||||
185
services/main.tf
185
services/main.tf
@ -108,40 +108,146 @@ resource "consul_config_entry" "nzbget_intents" {
|
|||||||
# }
|
# }
|
||||||
# }
|
# }
|
||||||
|
|
||||||
module "photoprism" {
|
# resource "nomad_job" "photoprism" {
|
||||||
source = "IamTheFij/levant/nomad"
|
# jobspec = templatefile("services_tf.nomad", {
|
||||||
version = "0.1.0"
|
# vars = {
|
||||||
|
# name = "photoprism"
|
||||||
|
# image = "photoprism/photoprism:latest"
|
||||||
|
# ingress = true
|
||||||
|
# service_port = 2342
|
||||||
|
# sticky_disk = true
|
||||||
|
# healthcheck = "/library/login"
|
||||||
|
# env = {
|
||||||
|
# PHOTOPRISM_SITE_CAPTION = "AI-Powered Photos App"
|
||||||
|
# PHOTOPRISM_SITE_DESCRIPTION = "Fijolek home photos"
|
||||||
|
# PHOTOPRISM_SITE_TITLE = "PhotoPrism"
|
||||||
|
# PHOTOPRISM_SITE_URL = "https://photoprism.thefij.rocks:2342/" # server URL in the format "http(s)://domain.name(:port)/(path)"
|
||||||
|
# PHOTOPRISM_SPONSOR = "true"
|
||||||
|
# # Paths
|
||||||
|
# PHOTOPRISM_ORIGINALS_PATH = "/photoprism-media/Library"
|
||||||
|
# PHOTOPRISM_IMPORT_PATH = "/photoprism-media/Import"
|
||||||
|
# PHOTOPRISM_STORAGE_PATH = "$${NOMAD_TASK_DIR}/storage" # Storage PATH for generated files like cache and index
|
||||||
|
# # Unix permissions
|
||||||
|
# PHOTOPRISM_UID = 500
|
||||||
|
# PHOTOPRISM_GID = 100
|
||||||
|
# PHOTOPRISM_UMASK = 0000
|
||||||
|
# }
|
||||||
|
# mysql = true
|
||||||
|
# vault = true
|
||||||
|
# resources = {
|
||||||
|
# cpu = 100
|
||||||
|
# memory = 500
|
||||||
|
# memory_max = 1000
|
||||||
|
# }
|
||||||
|
# host_volumes = [
|
||||||
|
# {
|
||||||
|
# name = "photoprism-media"
|
||||||
|
# dest = "/photoprism-media"
|
||||||
|
# read_only = false
|
||||||
|
# },
|
||||||
|
# ]
|
||||||
|
# mysql_bootstrap = {
|
||||||
|
# vault_key = "kv/data/photoprism"
|
||||||
|
# }
|
||||||
|
# templates = [
|
||||||
|
# {
|
||||||
|
# data = <<EOF
|
||||||
|
# {{ with secret "kv/data/photoprism" -}}
|
||||||
|
# PHOTOPRISM_ADMIN_USER={{ .Data.data.admin_user }}
|
||||||
|
# PHOTOPRISM_ADMIN_PASSWORD={{ .Data.data.admin_password }}
|
||||||
|
# PHOTOPRISM_DATABASE_DRIVER=mysql
|
||||||
|
# PHOTOPRISM_DATABASE_NAME={{ .Data.data.db_name }}
|
||||||
|
# PHOTOPRISM_DATABASE_USER={{ .Data.data.db_user }}
|
||||||
|
# PHOTOPRISM_DATABASE_PASSWORD={{ .Data.data.db_pass }}
|
||||||
|
# PHOTOPRISM_DATABASE_SERVER="{{ env "NOMAD_UPSTREAM_ADDR_mysql_server" }}"
|
||||||
|
# {{ end -}}
|
||||||
|
# EOF
|
||||||
|
# dest_prefix = "$${NOMAD_SECRETS_DIR}/"
|
||||||
|
# dest = "env"
|
||||||
|
# env = true
|
||||||
|
# mount = false
|
||||||
|
# },
|
||||||
|
# ]
|
||||||
|
# }
|
||||||
|
# })
|
||||||
|
# }
|
||||||
|
|
||||||
|
# module "photoprism" {
|
||||||
|
# source = "IamTheFij/levant/nomad"
|
||||||
|
# version = "0.1.0"
|
||||||
|
#
|
||||||
|
# template_path = "service.nomad"
|
||||||
|
# variables = {
|
||||||
|
# name = "photoprism"
|
||||||
|
# image = "photoprism/photoprism:latest"
|
||||||
|
# ingress = true
|
||||||
|
# service_port = 2342
|
||||||
|
# sticky_disk = true
|
||||||
|
# healthcheck = "/library/login"
|
||||||
|
# env = jsonencode({
|
||||||
|
# PHOTOPRISM_SITE_CAPTION = "AI-Powered Photos App"
|
||||||
|
# PHOTOPRISM_SITE_DESCRIPTION = "Fijolek home photos"
|
||||||
|
# PHOTOPRISM_SITE_TITLE = "PhotoPrism"
|
||||||
|
# PHOTOPRISM_SITE_URL = "https://photoprism.thefij.rocks:2342/" # server URL in the format "http(s)://domain.name(:port)/(path)"
|
||||||
|
# PHOTOPRISM_SPONSOR = "true"
|
||||||
|
# # Paths
|
||||||
|
# PHOTOPRISM_ORIGINALS_PATH = "/photoprism-media/Library"
|
||||||
|
# PHOTOPRISM_IMPORT_PATH = "/photoprism-media/Import"
|
||||||
|
# PHOTOPRISM_STORAGE_PATH = "$${NOMAD_TASK_DIR}/storage" # Storage PATH for generated files like cache and index
|
||||||
|
# # Unix permissions
|
||||||
|
# PHOTOPRISM_UID = 500
|
||||||
|
# PHOTOPRISM_GID = 100
|
||||||
|
# PHOTOPRISM_UMASK = 0000
|
||||||
|
# })
|
||||||
|
# mysql = true
|
||||||
|
# vault = true
|
||||||
|
# host_volumes = jsonencode([
|
||||||
|
# {
|
||||||
|
# name = "photoprism-media"
|
||||||
|
# dest = "/photoprism-media"
|
||||||
|
# read_only = false
|
||||||
|
# },
|
||||||
|
# ])
|
||||||
|
# mysql_bootstrap = jsonencode({
|
||||||
|
# vault_key = "kv/data/photoprism"
|
||||||
|
# })
|
||||||
|
# templates = jsonencode([
|
||||||
|
# {
|
||||||
|
# data = <<EOF
|
||||||
|
# {{ with secret "kv/data/photoprism" -}}
|
||||||
|
# PHOTOPRISM_ADMIN_USER={{ .Data.data.admin_user }}
|
||||||
|
# PHOTOPRISM_ADMIN_PASSWORD={{ .Data.data.admin_password }}
|
||||||
|
# PHOTOPRISM_DATABASE_DRIVER=mysql
|
||||||
|
# PHOTOPRISM_DATABASE_NAME={{ .Data.data.db_name }}
|
||||||
|
# PHOTOPRISM_DATABASE_USER={{ .Data.data.db_user }}
|
||||||
|
# PHOTOPRISM_DATABASE_PASSWORD={{ .Data.data.db_pass }}
|
||||||
|
# PHOTOPRISM_DATABASE_SERVER="{{ env "NOMAD_UPSTREAM_ADDR_mysql_server" }}"
|
||||||
|
# {{ end -}}
|
||||||
|
# EOF
|
||||||
|
# dest_prefix = "$${NOMAD_SECRETS_DIR}/"
|
||||||
|
# dest = "env"
|
||||||
|
# env = true
|
||||||
|
# mount = false
|
||||||
|
# },
|
||||||
|
# ])
|
||||||
|
# }
|
||||||
|
# }
|
||||||
|
|
||||||
|
|
||||||
|
module "photoprism_module" {
|
||||||
|
source = "./service"
|
||||||
|
|
||||||
template_path = "service.nomad"
|
|
||||||
variables = {
|
|
||||||
name = "photoprism"
|
name = "photoprism"
|
||||||
image = "photoprism/photoprism:latest"
|
image = "photoprism/photoprism:latest"
|
||||||
ingress = true
|
ingress = true
|
||||||
service_port = 2342
|
service_port = 2342
|
||||||
sticky_disk = true
|
sticky_disk = true
|
||||||
healthcheck = "/library/login"
|
healthcheck_path = "/library/login"
|
||||||
env = jsonencode({
|
env = {
|
||||||
PHOTOPRISM_DETECT_NSFW = "false" # automatically flags photos as private that MAY be offensive (requires TensorFlow)
|
|
||||||
PHOTOPRISM_DISABLE_CHOWN = "false" # disables updating storage permissions via chmod and chown on startup
|
|
||||||
PHOTOPRISM_DISABLE_CLASSIFICATION = "false" # disables image classification (requires TensorFlow)
|
|
||||||
PHOTOPRISM_DISABLE_FACES = "false" # disables face detection and recognition (requires TensorFlow)
|
|
||||||
PHOTOPRISM_DISABLE_RAW = "false" # disables indexing and conversion of RAW files
|
|
||||||
PHOTOPRISM_DISABLE_SETTINGS = "false" # disables settings UI and API
|
|
||||||
PHOTOPRISM_DISABLE_TENSORFLOW = "false" # disables all features depending on TensorFlow
|
|
||||||
PHOTOPRISM_DISABLE_WEBDAV = "false" # disables built-in WebDAV server
|
|
||||||
PHOTOPRISM_EXPERIMENTAL = "false" # enables experimental features
|
|
||||||
PHOTOPRISM_HTTP_COMPRESSION = "gzip" # improves transfer speed and bandwidth utilization (none or gzip)
|
|
||||||
PHOTOPRISM_JPEG_QUALITY = 85 # a higher value increases the quality and file size of JPEG images and thumbnails (25-100)
|
|
||||||
PHOTOPRISM_LOG_LEVEL = "info" # log level: trace, debug, info, warning, error, fatal, or panic
|
|
||||||
PHOTOPRISM_ORIGINALS_LIMIT = 5000 # file size limit for originals in MB (increase for high-res video)
|
|
||||||
PHOTOPRISM_RAW_PRESETS = "false" # enables applying user presets when converting RAW files (reduces performance)
|
|
||||||
PHOTOPRISM_READONLY = "false" # do not modify originals directory (reduced functionality)
|
|
||||||
PHOTOPRISM_SITE_AUTHOR = "" # meta site author
|
|
||||||
PHOTOPRISM_SITE_CAPTION = "AI-Powered Photos App"
|
PHOTOPRISM_SITE_CAPTION = "AI-Powered Photos App"
|
||||||
PHOTOPRISM_SITE_DESCRIPTION = "" # meta site description
|
PHOTOPRISM_SITE_DESCRIPTION = "Fijolek home photos"
|
||||||
PHOTOPRISM_SITE_TITLE = "PhotoPrism"
|
PHOTOPRISM_SITE_TITLE = "PhotoPrism"
|
||||||
PHOTOPRISM_SITE_URL = "http://localhost:2342/" # server URL in the format "http(s)://domain.name(:port)/(path)"
|
PHOTOPRISM_SITE_URL = "https://photoprism.thefij.rocks:2342/" # server URL in the format "http(s)://domain.name(:port)/(path)"
|
||||||
PHOTOPRISM_UPLOAD_NSFW = "true" # allows uploads that MAY be offensive (no effect without TensorFlow)
|
|
||||||
PHOTOPRISM_SPONSOR = "true"
|
PHOTOPRISM_SPONSOR = "true"
|
||||||
# Paths
|
# Paths
|
||||||
PHOTOPRISM_ORIGINALS_PATH = "/photoprism-media/Library"
|
PHOTOPRISM_ORIGINALS_PATH = "/photoprism-media/Library"
|
||||||
@ -151,23 +257,25 @@ module "photoprism" {
|
|||||||
PHOTOPRISM_UID = 500
|
PHOTOPRISM_UID = 500
|
||||||
PHOTOPRISM_GID = 100
|
PHOTOPRISM_GID = 100
|
||||||
PHOTOPRISM_UMASK = 0000
|
PHOTOPRISM_UMASK = 0000
|
||||||
})
|
}
|
||||||
mysql = true
|
resources = {
|
||||||
vault = true
|
cpu = 100
|
||||||
host_volumes = jsonencode([
|
memory = 500
|
||||||
|
memory_max = 1000
|
||||||
|
}
|
||||||
|
use_mysql = true
|
||||||
|
use_vault = true
|
||||||
|
host_volumes = [
|
||||||
{
|
{
|
||||||
name = "photoprism-media"
|
name = "photoprism-media"
|
||||||
dest = "/photoprism-media"
|
dest = "/photoprism-media"
|
||||||
read_only = false
|
read_only = false
|
||||||
},
|
},
|
||||||
])
|
]
|
||||||
mysql_bootstrap = jsonencode({
|
mysql_bootstrap = {
|
||||||
vault_key = "kv/data/photoprism"
|
vault_key = "kv/data/photoprism"
|
||||||
db_name_key = "db_name"
|
}
|
||||||
db_user_key = "db_user"
|
templates = [
|
||||||
db_pass_key = "db_pass"
|
|
||||||
})
|
|
||||||
templates = jsonencode([
|
|
||||||
{
|
{
|
||||||
data = <<EOF
|
data = <<EOF
|
||||||
{{ with secret "kv/data/photoprism" -}}
|
{{ with secret "kv/data/photoprism" -}}
|
||||||
@ -185,6 +293,5 @@ PHOTOPRISM_DATABASE_SERVER="{{ env "NOMAD_UPSTREAM_ADDR_mysql_server" }}"
|
|||||||
env = true
|
env = true
|
||||||
mount = false
|
mount = false
|
||||||
},
|
},
|
||||||
])
|
]
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|||||||
21
services/service/.terraform.lock.hcl
generated
Normal file
21
services/service/.terraform.lock.hcl
generated
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
# This file is maintained automatically by "terraform init".
|
||||||
|
# Manual edits may be lost in future updates.
|
||||||
|
|
||||||
|
provider "registry.terraform.io/hashicorp/nomad" {
|
||||||
|
version = "1.4.19"
|
||||||
|
hashes = [
|
||||||
|
"h1:EdBny2gaLr/IE+l+6csyCKeIGFMYZ/4tHKpcbS7ArgE=",
|
||||||
|
"zh:2f3ceeb3318a6304026035b0ac9ee3e52df04913bb9ee78827e58c5398b41254",
|
||||||
|
"zh:3fbe76c7d957d20dfe3c8c0528b33084651f22a95be9e0452b658e0922916e2a",
|
||||||
|
"zh:595671a05828cfe6c42ef73aac894ac39f81a52cc662a76f37eb74ebe04ddf75",
|
||||||
|
"zh:5d76e8788d2af3e60daf8076babf763ec887480bbb9734baccccd8fcddf4f03e",
|
||||||
|
"zh:676985afeaca6e67b22d60d43fd0ed7055763029ffebc3026089fe2fd3b4a288",
|
||||||
|
"zh:69152ce6164ac999a640cff962ece45208270e1ac37c10dac484eeea5cf47275",
|
||||||
|
"zh:6da0b15c05b81f947ec8e139bd81eeeb05c0d36eb5a967b985d0625c60998b40",
|
||||||
|
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
|
||||||
|
"zh:822c0a3bbada5e38099a379db8b2e339526843699627c3be3664cc3b3752bab7",
|
||||||
|
"zh:af23af2f98a84695b25c8eba7028a81ad4aad63c44aefb79e01bbe2dc82e7f78",
|
||||||
|
"zh:e36cac9960b7506d92925b667254322520966b9c3feb3ca6102e57a1fb9b1761",
|
||||||
|
"zh:ffd1e096c1cc35de879c740a91918e9f06b627818a3cb4b1d87b829b54a6985f",
|
||||||
|
]
|
||||||
|
}
|
||||||
28
services/service/main.tf
Normal file
28
services/service/main.tf
Normal file
@ -0,0 +1,28 @@
|
|||||||
|
resource "nomad_job" "service" {
|
||||||
|
jobspec = templatefile("${path.module}/service_template.nomad", {
|
||||||
|
name = var.name
|
||||||
|
image = var.image
|
||||||
|
args = var.args
|
||||||
|
env = var.env
|
||||||
|
|
||||||
|
service_port = var.service_port
|
||||||
|
sticky_disk = var.sticky_disk
|
||||||
|
resources = var.resources
|
||||||
|
|
||||||
|
ingress = var.ingress
|
||||||
|
ingress_rule = var.ingress_rule
|
||||||
|
ingress_middlewares = var.ingress_middlewares
|
||||||
|
healthcheck_path = var.healthcheck_path
|
||||||
|
|
||||||
|
templates = var.templates
|
||||||
|
host_volumes = var.host_volumes
|
||||||
|
|
||||||
|
upstreams = var.upstreams
|
||||||
|
use_mysql = var.use_mysql
|
||||||
|
use_redis = var.use_redis
|
||||||
|
use_ldap = var.use_ldap
|
||||||
|
use_vault = var.use_vault
|
||||||
|
|
||||||
|
mysql_bootstrap = var.mysql_bootstrap
|
||||||
|
})
|
||||||
|
}
|
||||||
239
services/service/service_template.nomad
Normal file
239
services/service/service_template.nomad
Normal file
@ -0,0 +1,239 @@
|
|||||||
|
job "${name}" {
|
||||||
|
region = "global"
|
||||||
|
datacenters = ["dc1"]
|
||||||
|
|
||||||
|
type = "service"
|
||||||
|
|
||||||
|
group "${name}" {
|
||||||
|
network {
|
||||||
|
mode = "bridge"
|
||||||
|
%{ if service_port != null ~}
|
||||||
|
port "main" {
|
||||||
|
%{ if ingress ~}
|
||||||
|
host_network = "loopback"
|
||||||
|
%{ endif ~}
|
||||||
|
to = ${service_port}
|
||||||
|
}
|
||||||
|
%{ endif ~}
|
||||||
|
}
|
||||||
|
|
||||||
|
%{ if sticky_disk ~}
|
||||||
|
ephemeral_disk {
|
||||||
|
migrate = true
|
||||||
|
sticky = true
|
||||||
|
}
|
||||||
|
|
||||||
|
%{ endif ~}
|
||||||
|
%{ for host_volume in host_volumes ~}
|
||||||
|
volume "${host_volume.name}" {
|
||||||
|
type = "host"
|
||||||
|
read_only = ${host_volume.read_only}
|
||||||
|
source = "${host_volume.name}"
|
||||||
|
}
|
||||||
|
|
||||||
|
%{ endfor ~}
|
||||||
|
%{ if service_port != null ~}
|
||||||
|
service {
|
||||||
|
name = "${replace(name, "_", "-")}"
|
||||||
|
port = "main"
|
||||||
|
|
||||||
|
%{ if anytrue([ingress, use_mysql, use_redis, use_ldap, length(upstreams) > 0]) }
|
||||||
|
connect {
|
||||||
|
sidecar_service {
|
||||||
|
proxy {
|
||||||
|
local_service_port = ${service_port}
|
||||||
|
%{ if use_mysql }
|
||||||
|
upstreams {
|
||||||
|
destination_name = "mysql-server"
|
||||||
|
local_bind_port = 4040
|
||||||
|
}
|
||||||
|
%{ endif ~}
|
||||||
|
%{ if use_redis }
|
||||||
|
upstreams {
|
||||||
|
destination_name = "redis"
|
||||||
|
local_bind_port = 6379
|
||||||
|
}
|
||||||
|
%{ endif ~}
|
||||||
|
%{ if use_ldap }
|
||||||
|
upstreams {
|
||||||
|
destination_name = "lldap"
|
||||||
|
local_bind_port = 3890
|
||||||
|
}
|
||||||
|
%{ endif ~}
|
||||||
|
%{ for upstream in upstreams ~}
|
||||||
|
upstreams {
|
||||||
|
destination_name = "${upstream.destination_name}"
|
||||||
|
local_bind_port = ${upstream.local_bind_port}
|
||||||
|
}
|
||||||
|
%{ endfor }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
sidecar_task {
|
||||||
|
resources {
|
||||||
|
cpu = 50
|
||||||
|
memory = 20
|
||||||
|
memory_max = 50
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
%{ endif ~}
|
||||||
|
%{ if healthcheck_path != null ~}
|
||||||
|
check {
|
||||||
|
type = "http"
|
||||||
|
path = "${healthcheck_path}"
|
||||||
|
port = "main"
|
||||||
|
interval = "10s"
|
||||||
|
timeout = "10s"
|
||||||
|
}
|
||||||
|
|
||||||
|
%{ endif ~}
|
||||||
|
tags = [
|
||||||
|
%{ if ingress ~}
|
||||||
|
"traefik.enable=true",
|
||||||
|
"traefik.http.routers.${name}.entryPoints=websecure",
|
||||||
|
%{ if try(ingress_rule, null) != null ~}
|
||||||
|
"traefik.http.routers.${name}.rule=${ingress_rule}",
|
||||||
|
%{ endif ~}
|
||||||
|
%{ for middleware in ingress_middlewares ~}
|
||||||
|
"traefik.http.routers.${name}.middlewares=${middleware}",
|
||||||
|
%{ endfor ~}
|
||||||
|
%{ endif ~}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
%{ endif ~}
|
||||||
|
task "${name}" {
|
||||||
|
driver = "docker"
|
||||||
|
|
||||||
|
config {
|
||||||
|
image = "${image}"
|
||||||
|
%{ if service_port != null ~}
|
||||||
|
ports = ["main"]
|
||||||
|
%{ endif ~}
|
||||||
|
%{ if length(try(args, [])) > 0 ~}
|
||||||
|
args = ${jsonencode(args)}
|
||||||
|
%{ endif ~}
|
||||||
|
%{ for template in templates ~}
|
||||||
|
%{ if template.mount && !template.env ~}
|
||||||
|
|
||||||
|
mount {
|
||||||
|
type = "bind"
|
||||||
|
target = "${template.dest}"
|
||||||
|
source = "${template.dest_prefix}/${template.dest}"
|
||||||
|
}
|
||||||
|
%{ endif ~}
|
||||||
|
%{ endfor ~}
|
||||||
|
}
|
||||||
|
%{ if use_vault ~}
|
||||||
|
|
||||||
|
vault {
|
||||||
|
policies = [
|
||||||
|
"access-tables",
|
||||||
|
"nomad-task",
|
||||||
|
]
|
||||||
|
}
|
||||||
|
%{ endif ~}
|
||||||
|
%{ if length(env) > 0 ~}
|
||||||
|
|
||||||
|
env = {
|
||||||
|
%{ for k, v in env ~}
|
||||||
|
"${k}" = "${v}"
|
||||||
|
%{ endfor }
|
||||||
|
}
|
||||||
|
%{ endif ~}
|
||||||
|
%{ for volume in host_volumes ~}
|
||||||
|
|
||||||
|
volume_mount {
|
||||||
|
volume = "${volume.name}"
|
||||||
|
destination = "${volume.dest}"
|
||||||
|
read_only = ${volume.read_only}
|
||||||
|
}
|
||||||
|
%{ endfor ~}
|
||||||
|
%{ for template in templates ~}
|
||||||
|
|
||||||
|
template {
|
||||||
|
data = <<EOF
|
||||||
|
${template.data}
|
||||||
|
EOF
|
||||||
|
destination = "${coalesce(template.dest_prefix, "$${NOMAD_TASK_DIR}")}/${template.dest}"
|
||||||
|
%{ if template.left_delimiter != null }left_delimiter = "${template.left_delimiter}"%{ endif }
|
||||||
|
%{ if template.right_delimiter != null }right_delimiter = "${template.right_delimiter}"%{ endif }
|
||||||
|
%{ if template.change_mode != null }change_mode = "${template.change_mode}"%{ endif }
|
||||||
|
%{ if template.change_signal != null }change_signal = "${template.change_signal}"%{ endif }
|
||||||
|
%{ if template.env != null }env = ${template.env}%{ endif }
|
||||||
|
}
|
||||||
|
%{ endfor ~}
|
||||||
|
%{ if resources != null }
|
||||||
|
|
||||||
|
resources {
|
||||||
|
cpu = ${resources.cpu}
|
||||||
|
memory = ${resources.memory}
|
||||||
|
%{ if resources.memory_max != null }memory_max = ${resources.memory_max}%{ endif }
|
||||||
|
}
|
||||||
|
%{~ endif }
|
||||||
|
}
|
||||||
|
%{ if mysql_bootstrap != null }
|
||||||
|
task "${name}-bootstrap" {
|
||||||
|
driver = "docker"
|
||||||
|
|
||||||
|
lifecycle {
|
||||||
|
hook = "prestart"
|
||||||
|
sidecar = false
|
||||||
|
}
|
||||||
|
|
||||||
|
config {
|
||||||
|
image = "mariadb:10"
|
||||||
|
args = [
|
||||||
|
"/bin/bash",
|
||||||
|
"-c",
|
||||||
|
"/usr/bin/mysql --defaults-extra-file=$${NOMAD_SECRETS_DIR}/my.cnf < $${NOMAD_SECRETS_DIR}/bootstrap.sql",
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
vault {
|
||||||
|
policies = [
|
||||||
|
"access-tables",
|
||||||
|
"nomad-task",
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
template {
|
||||||
|
data = <<EOF
|
||||||
|
[client]
|
||||||
|
host={{ env "NOMAD_UPSTREAM_IP_mysql_server" }}
|
||||||
|
port={{ env "NOMAD_UPSTREAM_PORT_mysql_server" }}
|
||||||
|
user=root
|
||||||
|
{{ with secret "kv/data/mysql" -}}
|
||||||
|
password={{ .Data.data.root_password }}
|
||||||
|
{{ end -}}
|
||||||
|
EOF
|
||||||
|
destination = "$${NOMAD_SECRETS_DIR}/my.cnf"
|
||||||
|
}
|
||||||
|
|
||||||
|
template {
|
||||||
|
data = <<EOF
|
||||||
|
{{ with secret "${mysql_bootstrap.vault_key}" -}}
|
||||||
|
CREATE DATABASE IF NOT EXISTS `{{ .Data.data.${mysql_bootstrap.db_name_key} }}`
|
||||||
|
CHARACTER SET = 'utf8mb4'
|
||||||
|
COLLATE = 'utf8mb4_unicode_ci';
|
||||||
|
CREATE USER IF NOT EXISTS '{{ .Data.data.${mysql_bootstrap.db_user_key} }}'@'%'
|
||||||
|
IDENTIFIED BY '{{ .Data.data.${mysql_bootstrap.db_pass_key} }}';
|
||||||
|
GRANT ALL ON `{{ .Data.data.${mysql_bootstrap.db_name_key} }}`.*
|
||||||
|
TO '{{ .Data.data.${mysql_bootstrap.db_user_key} }}'@'%';
|
||||||
|
{{ else -}}
|
||||||
|
SELECT 'NOOP';
|
||||||
|
{{ end -}}
|
||||||
|
EOF
|
||||||
|
destination = "$${NOMAD_SECRETS_DIR}/bootstrap.sql"
|
||||||
|
}
|
||||||
|
|
||||||
|
resources {
|
||||||
|
cpu = 50
|
||||||
|
memory = 50
|
||||||
|
}
|
||||||
|
}
|
||||||
|
%{ endif }
|
||||||
|
}
|
||||||
|
}
|
||||||
133
services/service/vars.tf
Normal file
133
services/service/vars.tf
Normal file
@ -0,0 +1,133 @@
|
|||||||
|
variable "name" {
|
||||||
|
type = string
|
||||||
|
description = "Name of the service"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "image" {
|
||||||
|
type = string
|
||||||
|
description = "Image that should be run"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "service_port" {
|
||||||
|
type = number
|
||||||
|
default = null
|
||||||
|
description = "Port used by the service for ingress"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "ingress" {
|
||||||
|
type = bool
|
||||||
|
default = false
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "sticky_disk" {
|
||||||
|
type = bool
|
||||||
|
default = false
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "args" {
|
||||||
|
type = list(string)
|
||||||
|
default = []
|
||||||
|
description = "Arguments passed to the Docker container"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "resources" {
|
||||||
|
type = object({
|
||||||
|
cpu = number
|
||||||
|
memory = number
|
||||||
|
memory_max = optional(number)
|
||||||
|
})
|
||||||
|
|
||||||
|
default = {
|
||||||
|
cpu = 50
|
||||||
|
memory = 100
|
||||||
|
memory_max = null
|
||||||
|
}
|
||||||
|
|
||||||
|
description = "Resources to be assigned to the main task"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "env" {
|
||||||
|
type = map(string)
|
||||||
|
default = {}
|
||||||
|
description = "Env variables for the main task"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "ingress_rule" {
|
||||||
|
type = string
|
||||||
|
default = null
|
||||||
|
description = "Routing rule for ingress"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "ingress_middlewares" {
|
||||||
|
type = list(string)
|
||||||
|
default = []
|
||||||
|
description = "Traefik middlewares that should be used"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "templates" {
|
||||||
|
type = list(object({
|
||||||
|
data = string
|
||||||
|
dest = string
|
||||||
|
dest_prefix = optional(string, "$${NOMAD_TASK_DIR}")
|
||||||
|
change_mode = optional(string)
|
||||||
|
change_signal = optional(string)
|
||||||
|
left_delimiter = optional(string)
|
||||||
|
right_delimiter = optional(string)
|
||||||
|
mount = optional(bool)
|
||||||
|
env = optional(bool)
|
||||||
|
}))
|
||||||
|
default = []
|
||||||
|
description = "Templates to be used"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "host_volumes" {
|
||||||
|
type = list(object({
|
||||||
|
name = string
|
||||||
|
dest = string
|
||||||
|
read_only = optional(bool)
|
||||||
|
}))
|
||||||
|
default = []
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "healthcheck_path" {
|
||||||
|
type = string
|
||||||
|
default = "/"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "upstreams" {
|
||||||
|
type = list(object({
|
||||||
|
destination_name = string
|
||||||
|
local_bind_port = number
|
||||||
|
}))
|
||||||
|
default = []
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "use_mysql" {
|
||||||
|
type = bool
|
||||||
|
default = false
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "use_redis" {
|
||||||
|
type = bool
|
||||||
|
default = false
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "use_vault" {
|
||||||
|
type = bool
|
||||||
|
default = false
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "use_ldap" {
|
||||||
|
type = bool
|
||||||
|
default = false
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "mysql_bootstrap" {
|
||||||
|
type = object({
|
||||||
|
vault_key = string
|
||||||
|
db_name_key = optional(string, "db_name")
|
||||||
|
db_user_key = optional(string, "db_user")
|
||||||
|
db_pass_key = optional(string, "db_pass")
|
||||||
|
})
|
||||||
|
default = null
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue
Block a user