iamthefij/homelab-nomad
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use stunnel for mysql

Browse Source 
Doesn't remove wesher or normal mysql service
This commit is contained in:
IamTheFij 2023-05-09 13:20:36 -07:00
parent a5efe0c21b
commit f11fad30a5
16 changed files with 278 additions and 180 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
core/.terraform.lock.hcl generated
View File

@ -1,44 +1,6 @@
# This file is maintained automatically by "terraform init". # This file is maintained automatically by "terraform init".
# Manual edits may be lost in future updates. # Manual edits may be lost in future updates.
provider "registry.terraform.io/hashicorp/consul" {
version = "2.16.2"
hashes = [
"h1:epldE7sZPBTQHnWEA4WlNJIOVT1UEX+/02SMg5nniaE=",
"zh:0a2e11ca2ba650954951a087a1daec95eee2f3000456b295409a9880c4a10b1a",
"zh:34f6bda06a0d1c213fa8d87d4313687681e67bc8c40c4cbaa7dbe59ce24a4f7e",
"zh:5b85cf93db11ee890f720c317a38158927071feb634855786a0c0cd65825a43c",
"zh:75ef915f3d087e6045751a66fbb7066a852a0944ec8c97200d1134dd84df7ffc",
"zh:8a4a95697bd91ad51a581c12fe50ac61a114afba27895d027f77ac4154a7ea15",
"zh:973d538c8d72793861a1ac9718249a9493f417a2b5096846367560054fd843b9",
"zh:9feb2bdc06fdc2d8370cc9aad9a0c69e7e5ae38aac43f315c3f57507c57be030",
"zh:c5709672d0afecbbe298bf519741ebcb9d04f02a73b5ee0c186dfa241aa5a524",
"zh:c65c60570de6da7190e1e7762577655a463caeb59bc5d38e33034821ed0cbcb9",
"zh:c958d6282650fc472aade61d5df4300936033f43cfb898293ef86aceccdfdf1d",
"zh:cdd3632c81e1d11d3becd193aaa061688840f39147950c45c4301d042743ae6a",
"zh:f3d3efac504c9484a025beb919d22b290aa6dbff256f6e86c1f8ce7817e077e5",
]
}
provider "registry.terraform.io/hashicorp/external" {
version = "2.2.2"
hashes = [
"h1:e7RpnZ2PbJEEPnfsg7V0FNwbfSk0/Z3FdrLsXINBmDY=",
"zh:0b84ab0af2e28606e9c0c1289343949339221c3ab126616b831ddb5aaef5f5ca",
"zh:10cf5c9b9524ca2e4302bf02368dc6aac29fb50aeaa6f7758cce9aa36ae87a28",
"zh:56a016ee871c8501acb3f2ee3b51592ad7c3871a1757b098838349b17762ba6b",
"zh:719d6ef39c50e4cffc67aa67d74d195adaf42afcf62beab132dafdb500347d39",
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
"zh:7fbfc4d37435ac2f717b0316f872f558f608596b389b895fcb549f118462d327",
"zh:8ac71408204db606ce63fe8f9aeaf1ddc7751d57d586ec421e62d440c402e955",
"zh:a4cacdb06f114454b6ed0033add28006afa3f65a0ea7a43befe45fc82e6809fb",
"zh:bb5ce3132b52ae32b6cc005bc9f7627b95259b9ffe556de4dad60d47d47f21f0",
"zh:bb60d2976f125ffd232a7ccb4b3f81e7109578b23c9c6179f13a11d125dca82a",
"zh:f9540ecd2e056d6e71b9ea5f5a5cf8f63dd5c25394b9db831083a9d4ea99b372",
"zh:ffd998b55b8a64d4335a090b6956b4bf8855b290f7554dd38db3302de9c41809",
]
}
provider "registry.terraform.io/hashicorp/nomad" { provider "registry.terraform.io/hashicorp/nomad" {
version = "1.4.19" version = "1.4.19"
hashes = [ hashes = [

25
core/blocky/blocky.nomad
View File

@ -105,7 +105,7 @@ job "blocky" {
} }
} }
task "redis-stunnel" { task "stunnel" {
driver = "docker" driver = "docker"
lifecycle { lifecycle {
@ -139,6 +139,14 @@ syslog = no
foreground = yes foreground = yes
delay = yes delay = yes
[mysql_client]
client = yes
accept = 127.0.0.1:3306
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-tls" -}}
connect = {{ .Address }}:{{ .Port }}
{{- end }}
PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/mysql_stunnel_psk.txt
[redis_client] [redis_client]
client = yes client = yes
accept = 127.0.0.1:6379 accept = 127.0.0.1:6379
@ -152,9 +160,14 @@ PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/stunnel_psk.txt
template { template {
data = <<EOF data = <<EOF
{{ with nomadVar "nomad/jobs/blocky" -}} {{- with nomadVar "nomad/jobs/blocky/blocky/stunnel" }}{{ .mysql_stunnel_psk }}{{ end -}}
{{ .redis_stunnel_psk }} EOF
{{- end }} destination = "$${NOMAD_SECRETS_DIR}/mysql_stunnel_psk.txt"
}
template {
data = <<EOF
{{- with nomadVar "nomad/jobs/blocky/blocky/stunnel" -}}{{ .redis_stunnel_psk }}{{ end -}}
EOF EOF
destination = "${NOMAD_SECRETS_DIR}/stunnel_psk.txt" destination = "${NOMAD_SECRETS_DIR}/stunnel_psk.txt"
} }
@ -171,9 +184,11 @@ PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/stunnel_psk.txt
config { config {
image = "mariadb:10" image = "mariadb:10"
args = [ args = [
"/usr/bin/timeout",
"2m",
"/bin/bash", "/bin/bash",
"-c", "-c",
"/usr/bin/mysql --defaults-extra-file=$${NOMAD_SECRETS_DIR}/my.cnf < $${NOMAD_SECRETS_DIR}/bootstrap.sql || echo 'SQL Failed'", "until /usr/bin/mysql --defaults-extra-file=$${NOMAD_SECRETS_DIR}/my.cnf < $${NOMAD_SECRETS_DIR}/bootstrap.sql; do sleep 10; done",
] ]
} }

9
core/blocky/config.yml
View File

@ -107,13 +107,12 @@ redis:
connectionCooldown: 3s connectionCooldown: 3s
{{ end -}} {{ end -}}
{{ $mysql_addr := "" }}
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-server" -}} {{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-tls" -}}
{{ $mysql_addr = print .Address ":" .Port }}
{{- end }}
{{ with nomadVar "nomad/jobs/blocky" -}} {{ with nomadVar "nomad/jobs/blocky" -}}
queryLog: queryLog:
type: mysql type: mysql
target: {{ .db_user }}:{{ .db_pass }}@tcp({{ $mysql_addr }})/{{ .db_name }}?charset=utf8mb4&parseTime=True&loc=Local target: {{ .db_user }}:{{ .db_pass }}@tcp(127.0.0.1:3306)/{{ .db_name }}?charset=utf8mb4&parseTime=True&loc=Local
logRetentionDays: 14 logRetentionDays: 14
{{ end -}} {{ end -}}
{{ end -}}

32
core/main.tf
View File

@ -23,24 +23,22 @@ resource "nomad_job" "nomad-client-stalker" {
} }
module "loki" { module "loki" {
source = "IamTheFij/levant/nomad" source = "../services/service"
version = "0.1.0"
template_path = "service.nomad" name = "loki"
variables = { image = "grafana/loki:2.2.1"
name = "loki" args = ["--config.file=$${NOMAD_TASK_DIR}/loki-config.yml"]
image = "grafana/loki:2.2.1" service_port = 3100
service_port = 3100 ingress = true
ingress = true sticky_disk = true
sticky_disk = true # healthcheck = "/ready"
healthcheck = "/ready" templates = [
templates = jsonencode([ {
{ data = file("${path.module}/loki-config.yml")
data = file("${path.module}/loki-config.yml") dest = "loki-config.yml"
dest = "/etc/loki/local-config.yaml" mount = false
} }
]) ]
}
} }
resource "nomad_job" "syslog-ng" { resource "nomad_job" "syslog-ng" {

68
core/metrics/grafana.nomad
View File

@ -29,6 +29,60 @@ job "grafana" {
] ]
} }
task "stunnel" {
driver = "docker"
lifecycle {
hook = "prestart"
sidecar = true
}
config {
image = "alpine:3.17"
args = ["/bin/sh", "$${NOMAD_TASK_DIR}/start.sh"]
}
resources {
cpu = 100
memory = 100
}
template {
data = <<EOF
set -e
apk add stunnel
exec stunnel {{ env "NOMAD_TASK_DIR" }}/stunnel.conf
EOF
destination = "$${NOMAD_TASK_DIR}/start.sh"
}
template {
data = <<EOF
syslog = no
foreground = yes
delay = yes
[mysql_client]
client = yes
accept = 127.0.0.1:3306
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-tls" -}}
connect = {{ .Address }}:{{ .Port }}
{{- end }}
PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/mysql_stunnel_psk.txt
EOF
destination = "$${NOMAD_TASK_DIR}/stunnel.conf"
}
# TODO: Get psk for backup jobs despite multiple job declarations
# Probably should use variable ACLs to grant each node job to this path
template {
data = <<EOF
{{- with nomadVar "nomad/jobs/grafana/grafana/stunnel" }}{{ .mysql_stunnel_psk }}{{ end -}}
EOF
destination = "$${NOMAD_SECRETS_DIR}/mysql_stunnel_psk.txt"
}
}
task "grafana-bootstrap" { task "grafana-bootstrap" {
driver = "docker" driver = "docker"
@ -40,19 +94,19 @@ job "grafana" {
config { config {
image = "mariadb:10" image = "mariadb:10"
args = [ args = [
"/usr/bin/timeout",
"2m",
"/bin/bash", "/bin/bash",
"-c", "-c",
"/usr/bin/mysql --defaults-extra-file=$${NOMAD_SECRETS_DIR}/my.cnf < $${NOMAD_SECRETS_DIR}/bootstrap.sql", "until /usr/bin/mysql --defaults-extra-file=$${NOMAD_SECRETS_DIR}/my.cnf < $${NOMAD_SECRETS_DIR}/bootstrap.sql; do sleep 10; done",
] ]
} }
template { template {
data = <<EOF data = <<EOF
[client] [client]
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-server" -}} host=127.0.0.1
host={{ .Address }} port=3306
port={{ .Port }}
{{ end -}}
user=root user=root
{{ with nomadVar "nomad/jobs" -}} {{ with nomadVar "nomad/jobs" -}}
password={{ .mysql_root_password }} password={{ .mysql_root_password }}
@ -110,9 +164,7 @@ GRAFANA_ALERT_EMAIL_ADDRESSES={{ .alert_email_addresses }}
{{ if .db_name -}} {{ if .db_name -}}
# Database storage # Database storage
GF_DATABASE_TYPE=mysql GF_DATABASE_TYPE=mysql
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-server" -}} GF_DATABASE_HOST=127.0.0.1:3306
GF_DATABASE_HOST={{ .Address }}:{{ .Port }}
{{- end }}
GF_DATABASE_NAME={{ .db_name }} GF_DATABASE_NAME={{ .db_name }}
GF_DATABASE_USER={{ .db_user }} GF_DATABASE_USER={{ .db_user }}
GF_DATABASE_PASSWORD={{ .db_pass }} GF_DATABASE_PASSWORD={{ .db_pass }}

4
core/metrics/grafana/provisioning/datasources/mysql.yml
View File

@ -3,9 +3,7 @@ apiVersion: 1
datasources: datasources:
- name: Blocky logs - name: Blocky logs
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-server" -}} url: 127.0.0.1:3306
url: {{ .Address }}:{{ .Port }}
{{- end }}
# TODO: Looking for an acl friendly way to expose this since it's a variable in blocky setup # TODO: Looking for an acl friendly way to expose this since it's a variable in blocky setup
database: blocky database: blocky
type: mysql type: mysql

51
databases/adminer.nomad
View File

@ -1,51 +0,0 @@
job "adminer" {
datacenters = ["dc1"]
type = "service"
group "adminer" {
count = 1
# Some affinity to stateful hosts?
network {
mode = "bridge"
port "adminer" {
to = 8080
}
}
service {
name = "adminer"
provider = "nomad"
port = "adminer"
tags = [
"traefik.enable=true",
"traefik.http.routers.adminer.entryPoints=websecure",
]
}
task "adminer" {
driver = "docker"
config {
image = "adminer"
ports = ["adminer"]
}
template {
data = <<EOF
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-server" -}}
ADMINER_DEFAULT_SERVER={{ .Address }}:{{ .Port }}
{{- end }}
EOF
env = true
destination = "env"
}
resources {
cpu = 50
memory = 50
}
}
}
}

8
databases/main.tf
View File

@ -20,14 +20,6 @@ resource "nomad_job" "postgres-server" {
detach = false detach = false
} }
resource "nomad_job" "adminer" {
hcl2 {
enabled = true
}
jobspec = file("${path.module}/adminer.nomad")
}
resource "nomad_job" "redis" { resource "nomad_job" "redis" {
hcl2 { hcl2 {
enabled = true enabled = true

59
databases/mysql.nomad
View File

@ -20,6 +20,10 @@ job "mysql-server" {
to = 3306 to = 3306
host_network = "wesher" host_network = "wesher"
} }
port "tls" {
host_network = "wesher"
}
} }
volume "mysql-data" { volume "mysql-data" {
@ -34,6 +38,12 @@ job "mysql-server" {
port = "db" port = "db"
} }
service {
name = "mysql-tls"
provider = "nomad"
port = "tls"
}
task "mysql-server" { task "mysql-server" {
driver = "docker" driver = "docker"
@ -69,5 +79,54 @@ MYSQL_ROOT_PASSWORD={{ .mysql_root_password }}
memory = 1024 memory = 1024
} }
} }
task "stunnel" {
driver = "docker"
config {
image = "alpine:3.17"
ports = ["tls"]
args = ["/bin/sh", "${NOMAD_TASK_DIR}/start.sh"]
}
resources {
cpu = 100
memory = 100
}
template {
data = <<EOF
set -e
apk add stunnel
exec stunnel ${NOMAD_TASK_DIR}/stunnel.conf
EOF
destination = "${NOMAD_TASK_DIR}/start.sh"
}
template {
data = <<EOF
syslog = no
foreground = yes
delay = yes
[mysql_server]
accept = {{ env "NOMAD_PORT_tls" }}
connect = 127.0.0.1:3306
ciphers = PSK
PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/stunnel_psk.txt
EOF
destination = "${NOMAD_TASK_DIR}/stunnel.conf"
}
template {
data = <<EOF
{{ with nomadVar "nomad/jobs/mysql-server" -}}
{{ .allowed_psks }}
{{- end }}
EOF
destination = "${NOMAD_SECRETS_DIR}/stunnel_psk.txt"
}
}
} }
} }

4
databases/redis.nomad
View File

@ -15,9 +15,7 @@ job "redis" {
network { network {
mode = "bridge" mode = "bridge"
port "tls" { port "tls" {}
host_network = "wesher"
}
} }
service { service {

1
service.nomad
View File

@ -1,3 +1,4 @@
DEPRECATED
# Vars # Vars
# name = string* # name = string*
# image = string* # image = string*

19
services/.terraform.lock.hcl generated
View File

@ -1,25 +1,6 @@
# This file is maintained automatically by "terraform init". # This file is maintained automatically by "terraform init".
# Manual edits may be lost in future updates. # Manual edits may be lost in future updates.
provider "registry.terraform.io/hashicorp/consul" {
version = "2.16.2"
hashes = [
"h1:epldE7sZPBTQHnWEA4WlNJIOVT1UEX+/02SMg5nniaE=",
"zh:0a2e11ca2ba650954951a087a1daec95eee2f3000456b295409a9880c4a10b1a",
"zh:34f6bda06a0d1c213fa8d87d4313687681e67bc8c40c4cbaa7dbe59ce24a4f7e",
"zh:5b85cf93db11ee890f720c317a38158927071feb634855786a0c0cd65825a43c",
"zh:75ef915f3d087e6045751a66fbb7066a852a0944ec8c97200d1134dd84df7ffc",
"zh:8a4a95697bd91ad51a581c12fe50ac61a114afba27895d027f77ac4154a7ea15",
"zh:973d538c8d72793861a1ac9718249a9493f417a2b5096846367560054fd843b9",
"zh:9feb2bdc06fdc2d8370cc9aad9a0c69e7e5ae38aac43f315c3f57507c57be030",
"zh:c5709672d0afecbbe298bf519741ebcb9d04f02a73b5ee0c186dfa241aa5a524",
"zh:c65c60570de6da7190e1e7762577655a463caeb59bc5d38e33034821ed0cbcb9",
"zh:c958d6282650fc472aade61d5df4300936033f43cfb898293ef86aceccdfdf1d",
"zh:cdd3632c81e1d11d3becd193aaa061688840f39147950c45c4301d042743ae6a",
"zh:f3d3efac504c9484a025beb919d22b290aa6dbff256f6e86c1f8ce7817e077e5",
]
}
provider "registry.terraform.io/hashicorp/nomad" { provider "registry.terraform.io/hashicorp/nomad" {
version = "1.4.19" version = "1.4.19"
hashes = [ hashes = [

62
services/backups/backup.nomad
View File

@ -89,16 +89,14 @@ job "backup%{ if batch_node != null }-oneoff-${batch_node}%{ endif }" {
template { template {
data = <<EOF data = <<EOF
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-server" -}} MYSQL_HOST=127.0.0.1
MYSQL_HOST={{ .Address }} MYSQL_PORT=3306
MYSQL_PORT={{ .Port }}
{{- end }}
# TODO: Move this to new mysql root pass path # TODO: Move this to new mysql root pass path
{{ with nomadVar "nomad/jobs" }} {{ with nomadVar "nomad/jobs" }}
MYSQL_USER=root MYSQL_USER=root
MYSQL_PASSWORD={{ .mysql_root_password }} MYSQL_PASSWORD={{ .mysql_root_password }}
{{ end -}} {{ end -}}
{{ with nomadVar "nomad/jobs/backup" -}} {{ with nomadVar (print "nomad/jobs/" (env "NOMAD_JOB_ID")) -}}
BACKUP_PASSPHRASE={{ .backup_passphrase }} BACKUP_PASSPHRASE={{ .backup_passphrase }}
RCLONE_FTP_HOST={{ .nas_ftp_host }} RCLONE_FTP_HOST={{ .nas_ftp_host }}
RCLONE_FTP_USER={{ .nas_ftp_user }} RCLONE_FTP_USER={{ .nas_ftp_user }}
@ -160,5 +158,59 @@ ${file("${module_path}/jobs/nzbget.hcl")}
memory = 256 memory = 256
} }
} }
task "stunnel" {
driver = "docker"
lifecycle {
hook = "prestart"
sidecar = true
}
config {
image = "alpine:3.17"
args = ["/bin/sh", "$${NOMAD_TASK_DIR}/start.sh"]
}
resources {
cpu = 100
memory = 100
}
template {
data = <<EOF
set -e
apk add stunnel
exec stunnel {{ env "NOMAD_TASK_DIR" }}/stunnel.conf
EOF
destination = "$${NOMAD_TASK_DIR}/start.sh"
}
template {
data = <<EOF
syslog = no
foreground = yes
delay = yes
[mysql_client]
client = yes
accept = 127.0.0.1:3306
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-tls" -}}
connect = {{ .Address }}:{{ .Port }}
{{- end }}
PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/mysql_stunnel_psk.txt
EOF
destination = "$${NOMAD_TASK_DIR}/stunnel.conf"
}
# TODO: Get psk for backup jobs despite multiple job declarations
# Probably should use variable ACLs to grant each node job to this path
template {
data = <<EOF
{{- with nomadVar (print "nomad/jobs/" (env "NOMAD_JOB_ID")) }}{{ .mysql_stunnel_psk }}{{ end -}}
EOF
destination = "$${NOMAD_SECRETS_DIR}/mysql_stunnel_psk.txt"
}
}
} }
} }

21
services/main.tf
View File

@ -131,9 +131,7 @@ module "photoprism_module" {
PHOTOPRISM_DATABASE_NAME={{ .db_name }} PHOTOPRISM_DATABASE_NAME={{ .db_name }}
PHOTOPRISM_DATABASE_USER={{ .db_user }} PHOTOPRISM_DATABASE_USER={{ .db_user }}
PHOTOPRISM_DATABASE_PASSWORD={{ .db_pass }} PHOTOPRISM_DATABASE_PASSWORD={{ .db_pass }}
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-server" -}} PHOTOPRISM_DATABASE_SERVER=127.0.0.1:3306
PHOTOPRISM_DATABASE_SERVER="{{ .Address }}:{{ .Port }}"
{{- end }}
{{- end }} {{- end }}
{{ if eq (env "meta.hw_transcode.type") "raspberry" -}} {{ if eq (env "meta.hw_transcode.type") "raspberry" -}}
PHOTOPRISM_FFMPEG_ENCODER=raspberry PHOTOPRISM_FFMPEG_ENCODER=raspberry
@ -184,3 +182,20 @@ module "diun" {
}, },
] ]
} }
module "adminer" {
source = "./service"
name = "adminer"
image = "adminer"
ingress = true
service_port = 8080
use_mysql = true
resources = {
cpu = 50
memory = 50
}
}

2
services/service/main.tf
View File

@ -22,7 +22,7 @@ resource "nomad_job" "service" {
templates = var.templates templates = var.templates
host_volumes = var.host_volumes host_volumes = var.host_volumes
use_mysql = var.use_mysql use_mysql = var.use_mysql || var.mysql_bootstrap != null
use_redis = var.use_redis use_redis = var.use_redis
use_ldap = var.use_ldap use_ldap = var.use_ldap

55
services/service/service_template.nomad
View File

@ -150,7 +150,7 @@ EOF
%{~ endif } %{~ endif }
} }
%{ if mysql_bootstrap != null } %{ if mysql_bootstrap != null ~}
task "${name}-bootstrap" { task "${name}-bootstrap" {
driver = "docker" driver = "docker"
@ -162,19 +162,19 @@ EOF
config { config {
image = "mariadb:10" image = "mariadb:10"
args = [ args = [
"/usr/bin/timeout",
"2m",
"/bin/bash", "/bin/bash",
"-c", "-c",
"/usr/bin/mysql --defaults-extra-file=$${NOMAD_SECRETS_DIR}/my.cnf < $${NOMAD_SECRETS_DIR}/bootstrap.sql", "until /usr/bin/mysql --defaults-extra-file=$${NOMAD_SECRETS_DIR}/my.cnf < $${NOMAD_SECRETS_DIR}/bootstrap.sql; do sleep 10; done",
] ]
} }
template { template {
data = <<EOF data = <<EOF
[client] [client]
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-server" -}} host=127.0.0.1
host={{ .Address }} port=3306
port={{ .Port }}
{{ end -}}
user=root user=root
# TODO: Use via lesser scoped access # TODO: Use via lesser scoped access
{{ with nomadVar "nomad/jobs" -}} {{ with nomadVar "nomad/jobs" -}}
@ -214,10 +214,16 @@ SELECT 'NOOP';
} }
} }
%{ endif } %{ endif }
%{ if use_redis ~}
task "redis-stunnel" { %{ if use_mysql || use_redis ~}
task "stunnel" {
driver = "docker" driver = "docker"
lifecycle {
hook = "prestart"
sidecar = true
}
config { config {
image = "alpine:3.17" image = "alpine:3.17"
args = ["/bin/sh", "$${NOMAD_TASK_DIR}/start.sh"] args = ["/bin/sh", "$${NOMAD_TASK_DIR}/start.sh"]
@ -243,25 +249,46 @@ syslog = no
foreground = yes foreground = yes
delay = yes delay = yes
%{~ if use_mysql }
[mysql_client]
client = yes
accept = 127.0.0.1:3306
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-tls" -}}
connect = {{ .Address }}:{{ .Port }}
{{- end }}
PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/mysql_stunnel_psk.txt
%{~ endif }
%{~ if use_redis }
[redis_client] [redis_client]
client = yes client = yes
accept = 127.0.0.1:6379 accept = 127.0.0.1:6379
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "redis-tls" -}} {{ range nomadService 1 (env "NOMAD_ALLOC_ID") "redis-tls" -}}
connect = {{ .Address }}:{{ .Port }} connect = {{ .Address }}:{{ .Port }}
{{- end }} {{- end }}
PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/stunnel_psk.txt PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/redis_stunnel_psk.txt
%{~ endif }
EOF EOF
destination = "$${NOMAD_TASK_DIR}/stunnel.conf" destination = "$${NOMAD_TASK_DIR}/stunnel.conf"
} }
%{~ if use_mysql }
template { template {
data = <<EOF data = <<EOF
{{ with nomadVar "nomad/jobs/${name}" -}} {{- with nomadVar "nomad/jobs/${name}" }}{{ .mysql_stunnel_psk }}{{ end -}}
{{ .redis_stunnel_psk }} EOF
{{- end }} destination = "$${NOMAD_SECRETS_DIR}/mysql_stunnel_psk.txt"
EOF
destination = "$${NOMAD_SECRETS_DIR}/stunnel_psk.txt"
} }
%{ endif }
%{~ if use_redis }
template {
data = <<EOF
{{- with nomadVar "nomad/jobs/${name}" }}{{ .redis_stunnel_psk }}{{ end -}}
EOF
destination = "$${NOMAD_SECRETS_DIR}/redis_stunnel_psk.txt"
}
%{~ endif }
} }
%{~ endif } %{~ endif }
} }