Compare commits
1 Commits
main
...
test-clust
Author | SHA1 | Date |
---|---|---|
IamTheFij | 25fcdd2292 |
|
@ -132,7 +132,7 @@
|
|||
"filename": "core/authelia.yml",
|
||||
"hashed_secret": "a32b08d97b1615dc27f58b6b17f67624c04e2c4f",
|
||||
"is_verified": false,
|
||||
"line_number": 189,
|
||||
"line_number": 185,
|
||||
"is_secret": false
|
||||
}
|
||||
],
|
||||
|
@ -187,5 +187,5 @@
|
|||
}
|
||||
]
|
||||
},
|
||||
"generated_at": "2024-02-20T18:04:29Z"
|
||||
"generated_at": "2023-08-24T20:00:24Z"
|
||||
}
|
||||
|
|
|
@ -2,39 +2,39 @@
|
|||
# Manual edits may be lost in future updates.
|
||||
|
||||
provider "registry.terraform.io/hashicorp/nomad" {
|
||||
version = "2.2.0"
|
||||
version = "2.0.0"
|
||||
hashes = [
|
||||
"h1:BAjqzVkuXxHtRKG+l9unaZJPk2kWZpSTCEcQPRcl2so=",
|
||||
"zh:052f909d25121e93dc799290216292fca67943ccde12ba515068b838a6ff8c66",
|
||||
"zh:20e29aeb9989f7a1e04bb4093817c7acc4e1e737bb21a3066f3ea46f2001feff",
|
||||
"zh:2326d101ef427599b72cce30c0e0c1d18ae783f1a897c20f2319fbf54bab0a61",
|
||||
"zh:3420cbe4fd19cdc96d715d0ae8e79c272608023a76033bbf582c30637f6d570f",
|
||||
"zh:41ec570f87f578f1c57655e2e4fbdb9932d94cf92dc9cd11828cccedf36dd4a4",
|
||||
"zh:5f90dcc58e3356ffead82ea211ecb4a2d7094d3c2fbd14ff85527c3652a595a2",
|
||||
"zh:64aaa48609d2db868fcfd347490df0e12c6c3fcb8e4f12908c5d52b1a0adf73f",
|
||||
"h1:lIHIxA6ZmfyTGL3J9YIddhxlfit4ipSS09BLxkwo6L0=",
|
||||
"zh:09b897d64db293f9a904a4a0849b11ec1e3fff5c638f734d82ae36d8dc044b72",
|
||||
"zh:435cc106799290f64078ec24b6c59cb32b33784d609088638ed32c6d12121199",
|
||||
"zh:7073444bd064e8c4ec115ca7d9d7f030cc56795c0a83c27f6668bba519e6849a",
|
||||
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
|
||||
"zh:86b4923e10e6ba407d1d2aab83740b702058e8b01460af4f5f0e4008f40e492c",
|
||||
"zh:ae89dcba33097af33a306344d20e4e25181f15dcc1a860b42db5b7199a97c6a6",
|
||||
"zh:ce56d68cdfba60891765e94f9c0bf69eddb985d44d97db9f91874bea027f08e2",
|
||||
"zh:e993bcde5dbddaedf3331e3014ffab904f98ab0f5e8b5d6082b7ca5083e0a2f1",
|
||||
"zh:79d238c35d650d2d83a439716182da63f3b2767e72e4cbd0b69cb13d9b1aebfc",
|
||||
"zh:7ef5f49344278fe0bbc5447424e6aa5425ff1821d010d944a444d7fa2c751acf",
|
||||
"zh:92179091638c8ba03feef371c4361a790190f9955caea1fa59de2055c701a251",
|
||||
"zh:a8a34398851761368eb8e7c171f24e55efa6e9fdbb5c455f6dec34dc17f631bc",
|
||||
"zh:b38fd5338625ebace5a4a94cea1a28b11bd91995d834e318f47587cfaf6ec599",
|
||||
"zh:b71b273a2aca7ad5f1e07c767b25b5a888881ba9ca93b30044ccc39c2937f03c",
|
||||
"zh:cd14357e520e0f09fb25badfb4f2ee37d7741afdc3ed47c7bcf54c1683772543",
|
||||
"zh:e05e025f4bb95138c3c8a75c636e97cd7cfd2fc1525b0c8bd097db8c5f02df6e",
|
||||
]
|
||||
}
|
||||
|
||||
provider "registry.terraform.io/hashicorp/random" {
|
||||
version = "3.6.0"
|
||||
version = "3.5.1"
|
||||
hashes = [
|
||||
"h1:R5Ucn26riKIEijcsiOMBR3uOAjuOMfI1x7XvH4P6B1w=",
|
||||
"zh:03360ed3ecd31e8c5dac9c95fe0858be50f3e9a0d0c654b5e504109c2159287d",
|
||||
"zh:1c67ac51254ba2a2bb53a25e8ae7e4d076103483f55f39b426ec55e47d1fe211",
|
||||
"zh:24a17bba7f6d679538ff51b3a2f378cedadede97af8a1db7dad4fd8d6d50f829",
|
||||
"zh:30ffb297ffd1633175d6545d37c2217e2cef9545a6e03946e514c59c0859b77d",
|
||||
"zh:454ce4b3dbc73e6775f2f6605d45cee6e16c3872a2e66a2c97993d6e5cbd7055",
|
||||
"h1:VSnd9ZIPyfKHOObuQCaKfnjIHRtR7qTw19Rz8tJxm+k=",
|
||||
"zh:04e3fbd610cb52c1017d282531364b9c53ef72b6bc533acb2a90671957324a64",
|
||||
"zh:119197103301ebaf7efb91df8f0b6e0dd31e6ff943d231af35ee1831c599188d",
|
||||
"zh:4d2b219d09abf3b1bb4df93d399ed156cadd61f44ad3baf5cf2954df2fba0831",
|
||||
"zh:6130bdde527587bbe2dcaa7150363e96dbc5250ea20154176d82bc69df5d4ce3",
|
||||
"zh:6cc326cd4000f724d3086ee05587e7710f032f94fc9af35e96a386a1c6f2214f",
|
||||
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
|
||||
"zh:91df0a9fab329aff2ff4cf26797592eb7a3a90b4a0c04d64ce186654e0cc6e17",
|
||||
"zh:aa57384b85622a9f7bfb5d4512ca88e61f22a9cea9f30febaa4c98c68ff0dc21",
|
||||
"zh:c4a3e329ba786ffb6f2b694e1fd41d413a7010f3a53c20b432325a94fa71e839",
|
||||
"zh:e2699bc9116447f96c53d55f2a00570f982e6f9935038c3810603572693712d0",
|
||||
"zh:e747c0fd5d7684e5bfad8aa0ca441903f15ae7a98a737ff6aca24ba223207e2c",
|
||||
"zh:f1ca75f417ce490368f047b63ec09fd003711ae48487fba90b4aba2ccf71920e",
|
||||
"zh:b6d88e1d28cf2dfa24e9fdcc3efc77adcdc1c3c3b5c7ce503a423efbdd6de57b",
|
||||
"zh:ba74c592622ecbcef9dc2a4d81ed321c4e44cddf7da799faa324da9bf52a22b2",
|
||||
"zh:c7c5cde98fe4ef1143bd1b3ec5dc04baf0d4cc3ca2c5c7d40d17c0e9b2076865",
|
||||
"zh:dac4bad52c940cd0dfc27893507c1e92393846b024c5a9db159a93c534a3da03",
|
||||
"zh:de8febe2a2acd9ac454b844a4106ed295ae9520ef54dc8ed2faf29f12716b602",
|
||||
"zh:eab0d0495e7e711cca367f7d4df6e322e6c562fc52151ec931176115b83ed014",
|
||||
]
|
||||
}
|
||||
|
|
10
Makefile
10
Makefile
|
@ -87,16 +87,6 @@ apply:
|
|||
-auto-approve \
|
||||
-var "nomad_secret_id=$(shell jq -r .SecretID nomad_bootstrap.json)" \
|
||||
|
||||
.PHONY: refresh
|
||||
refresh:
|
||||
@terraform refresh \
|
||||
-var "nomad_secret_id=$(shell jq -r .SecretID nomad_bootstrap.json)" \
|
||||
|
||||
.PHONY: destroy
|
||||
destroy:
|
||||
@terraform destroy \
|
||||
-var "nomad_secret_id=$(shell jq -r .SecretID nomad_bootstrap.json)" \
|
||||
|
||||
.PHONY: clean
|
||||
clean:
|
||||
env VIRTUAL_ENV=$(VENV) $(VENV)/bin/ansible-playbook -vv \
|
||||
|
|
|
@ -1,72 +1,62 @@
|
|||
---
|
||||
all:
|
||||
hosts:
|
||||
n1.thefij:
|
||||
nomad_node_class: ingress
|
||||
nomad_reserved_memory: 1024
|
||||
# nomad_meta:
|
||||
# hw_transcode.device: /dev/dri
|
||||
# hw_transcode.type: intel
|
||||
nfs_mounts:
|
||||
- src: 10.50.250.2:/srv/volumes
|
||||
path: /srv/volumes/moxy
|
||||
opts: proto=tcp,rw
|
||||
nomad_unique_host_volumes:
|
||||
- name: mysql-data
|
||||
path: /srv/volumes/mysql
|
||||
owner: "999"
|
||||
group: "100"
|
||||
mode: "0755"
|
||||
read_only: false
|
||||
- name: postgres-data
|
||||
path: /srv/volumes/postgres
|
||||
owner: "999"
|
||||
group: "999"
|
||||
mode: "0755"
|
||||
read_only: false
|
||||
n2.thefij:
|
||||
nomad_node_class: ingress
|
||||
nomad_reserved_memory: 1024
|
||||
nfs_mounts:
|
||||
- src: 10.50.250.2:/srv/volumes
|
||||
path: /srv/volumes/moxy
|
||||
opts: proto=tcp,rw
|
||||
nomad_unique_host_volumes:
|
||||
- name: nextcloud-data
|
||||
path: /srv/volumes/nextcloud
|
||||
owner: "root"
|
||||
group: "bin"
|
||||
mode: "0755"
|
||||
read_only: false
|
||||
pi4:
|
||||
nomad_node_class: ingress
|
||||
nomad_reserved_memory: 512
|
||||
nomad_meta:
|
||||
hw_transcode.device: /dev/video11
|
||||
hw_transcode.type: raspberry
|
||||
qnomad.thefij:
|
||||
ansible_host: 192.168.2.234
|
||||
nomad_reserved_memory: 1024
|
||||
# This VM uses a non-standard interface
|
||||
nomad_network_interface: ens3
|
||||
|
||||
nomad_instances:
|
||||
vars:
|
||||
nomad_network_interface: eth0
|
||||
children:
|
||||
nomad_servers: {}
|
||||
nomad_clients: {}
|
||||
nomad_servers:
|
||||
hosts:
|
||||
nonopi.thefij:
|
||||
ansible_host: 192.168.2.170
|
||||
n1.thefij: {}
|
||||
n2.thefij: {}
|
||||
pi4: {}
|
||||
qnomad.thefij: {}
|
||||
nomad_clients:
|
||||
hosts:
|
||||
n1.thefij: {}
|
||||
n2.thefij: {}
|
||||
pi4: {}
|
||||
qnomad.thefij: {}
|
||||
servers:
|
||||
hosts:
|
||||
n1.thefij:
|
||||
nomad_node_role: both
|
||||
# nomad_meta:
|
||||
# hw_transcode.device: /dev/dri
|
||||
# hw_transcode.type: intel
|
||||
nfs_mounts:
|
||||
- src: 10.50.250.2:/srv/volumes
|
||||
path: /srv/volumes/moxy
|
||||
opts: proto=tcp,rw
|
||||
nomad_unique_host_volumes:
|
||||
- name: mysql-data
|
||||
path: /srv/volumes/mysql
|
||||
owner: "999"
|
||||
group: "100"
|
||||
mode: "0755"
|
||||
read_only: false
|
||||
- name: postgres-data
|
||||
path: /srv/volumes/postgres
|
||||
owner: "999"
|
||||
group: "999"
|
||||
mode: "0755"
|
||||
read_only: false
|
||||
n2.thefij:
|
||||
nfs_mounts:
|
||||
- src: 10.50.250.2:/srv/volumes
|
||||
path: /srv/volumes/moxy
|
||||
opts: proto=tcp,rw
|
||||
nomad_node_class: ingress
|
||||
nomad_node_role: both
|
||||
nomad_unique_host_volumes:
|
||||
- name: nextcloud-data
|
||||
path: /srv/volumes/nextcloud
|
||||
owner: "root"
|
||||
group: "bin"
|
||||
mode: "0755"
|
||||
read_only: false
|
||||
- name: gitea-data
|
||||
path: /srv/volumes/gitea
|
||||
owner: "root"
|
||||
group: "bin"
|
||||
mode: "0755"
|
||||
read_only: false
|
||||
- name: sonarr-data
|
||||
path: /srv/volumes/sonarr
|
||||
owner: "root"
|
||||
group: "bin"
|
||||
mode: "0755"
|
||||
read_only: false
|
||||
pi4:
|
||||
nomad_node_role: both
|
||||
nomad_meta:
|
||||
hw_transcode.device: /dev/video11
|
||||
hw_transcode.type: raspberry
|
||||
|
||||
nomad_instances:
|
||||
children:
|
||||
servers: {}
|
||||
|
|
|
@ -14,14 +14,8 @@
|
|||
state: restarted
|
||||
become: true
|
||||
|
||||
- name: Start Docker
|
||||
systemd:
|
||||
name: docker
|
||||
state: started
|
||||
become: true
|
||||
|
||||
- name: Start Nomad
|
||||
systemd:
|
||||
name: nomad
|
||||
state: started
|
||||
state: stopped
|
||||
become: true
|
||||
|
|
|
@ -1,6 +1,6 @@
|
|||
---
|
||||
- name: Recover Nomad
|
||||
hosts: nomad_servers
|
||||
hosts: nomad_instances
|
||||
any_errors_fatal: true
|
||||
|
||||
tasks:
|
||||
|
|
|
@ -14,7 +14,7 @@
|
|||
line: "nameserver {{ non_nomad_dns }}"
|
||||
|
||||
- name: Install Docker
|
||||
hosts: nomad_clients
|
||||
hosts: nomad_instances
|
||||
become: true
|
||||
vars:
|
||||
docker_architecture_map:
|
||||
|
@ -44,7 +44,7 @@
|
|||
# state: present
|
||||
|
||||
- name: Create NFS mounts
|
||||
hosts: nomad_clients
|
||||
hosts: nomad_instances
|
||||
become: true
|
||||
vars:
|
||||
shared_nfs_mounts:
|
||||
|
@ -106,27 +106,20 @@
|
|||
- name: photoprism-media
|
||||
path: /srv/volumes/photos/Photoprism
|
||||
read_only: false
|
||||
|
||||
# TODO: If test hosts, use a different path
|
||||
- name: photoprism-storage
|
||||
path: /srv/volumes/nas-container/photoprism
|
||||
read_only: false
|
||||
- name: nzbget-config
|
||||
path: /srv/volumes/nas-container/nzbget
|
||||
read_only: false
|
||||
- name: sonarr-config
|
||||
path: /srv/volumes/nas-container/sonarr
|
||||
read_only: false
|
||||
- name: lidarr-config
|
||||
path: /srv/volumes/nas-container/lidarr
|
||||
read_only: false
|
||||
- name: radarr-config
|
||||
path: /srv/volumes/nas-container/radarr
|
||||
read_only: false
|
||||
- name: bazarr-config
|
||||
path: /srv/volumes/nas-container/bazarr
|
||||
read_only: false
|
||||
- name: gitea-data
|
||||
path: /srv/volumes/nas-container/gitea
|
||||
read_only: false
|
||||
- name: all-volumes
|
||||
path: /srv/volumes
|
||||
owner: "root"
|
||||
|
@ -137,10 +130,9 @@
|
|||
roles:
|
||||
- name: ansible-nomad
|
||||
vars:
|
||||
nomad_version: "1.7.6-1"
|
||||
nomad_version: "1.6.2-1"
|
||||
nomad_install_upgrade: true
|
||||
nomad_allow_purge_config: true
|
||||
nomad_node_role: "{% if 'nomad_clients' in group_names %}{% if 'nomad_servers' in group_names %}both{% else %}client{% endif %}{% else %}server{% endif %}"
|
||||
|
||||
# Where nomad gets installed to
|
||||
nomad_bin_dir: /usr/bin
|
||||
|
@ -194,8 +186,7 @@
|
|||
nomad_bind_address: 0.0.0.0
|
||||
|
||||
# Default interface for binding tasks
|
||||
# This is now set at the inventory level
|
||||
# nomad_network_interface: eth0
|
||||
nomad_network_interface: eth0
|
||||
|
||||
# Create networks for binding task ports
|
||||
nomad_host_networks:
|
||||
|
@ -214,7 +205,7 @@
|
|||
enabled: true
|
||||
|
||||
- name: Bootstrap Nomad ACLs and scheduler
|
||||
hosts: nomad_servers
|
||||
hosts: nomad_instances
|
||||
|
||||
tasks:
|
||||
- name: Start Nomad
|
||||
|
@ -244,7 +235,6 @@
|
|||
run_once: true
|
||||
ignore_errors: true
|
||||
register: bootstrap_result
|
||||
changed_when: bootstrap_result is succeeded
|
||||
|
||||
- name: Save bootstrap result
|
||||
copy:
|
||||
|
@ -276,15 +266,13 @@
|
|||
- list
|
||||
environment:
|
||||
NOMAD_TOKEN: "{{ read_secretid.stdout }}"
|
||||
register: policies
|
||||
run_once: true
|
||||
changed_when: false
|
||||
register: policies
|
||||
|
||||
- name: Copy policy
|
||||
copy:
|
||||
src: ../acls/nomad-anon-policy.hcl
|
||||
dest: /tmp/anonymous.policy.hcl
|
||||
delegate_to: "{{ play_hosts[0] }}"
|
||||
run_once: true
|
||||
register: anon_policy
|
||||
|
||||
|
@ -304,18 +292,6 @@
|
|||
delegate_to: "{{ play_hosts[0] }}"
|
||||
run_once: true
|
||||
|
||||
- name: Read scheduler config
|
||||
command:
|
||||
argv:
|
||||
- nomad
|
||||
- operator
|
||||
- scheduler
|
||||
- get-config
|
||||
- -json
|
||||
run_once: true
|
||||
register: scheduler_config
|
||||
changed_when: false
|
||||
|
||||
- name: Enable service scheduler preemption
|
||||
command:
|
||||
argv:
|
||||
|
@ -323,24 +299,12 @@
|
|||
- operator
|
||||
- scheduler
|
||||
- set-config
|
||||
- -preempt-system-scheduler=true
|
||||
- -preempt-service-scheduler=true
|
||||
environment:
|
||||
NOMAD_TOKEN: "{{ read_secretid.stdout }}"
|
||||
delegate_to: "{{ play_hosts[0] }}"
|
||||
run_once: true
|
||||
when: (scheduler_config.stdout | from_json)["SchedulerConfig"]["PreemptionConfig"]["ServiceSchedulerEnabled"] is false
|
||||
|
||||
- name: Enable system scheduler preemption
|
||||
command:
|
||||
argv:
|
||||
- nomad
|
||||
- operator
|
||||
- scheduler
|
||||
- set-config
|
||||
- -preempt-system-scheduler=true
|
||||
environment:
|
||||
NOMAD_TOKEN: "{{ read_secretid.stdout }}"
|
||||
run_once: true
|
||||
when: (scheduler_config.stdout | from_json)["SchedulerConfig"]["PreemptionConfig"]["SystemSchedulerEnabled"] is false
|
||||
|
||||
# - name: Set up Nomad backend and roles in Vault
|
||||
# community.general.terraform:
|
||||
|
|
|
@ -0,0 +1,25 @@
|
|||
---
|
||||
- name: Stop prod cluster
|
||||
hosts: nomad_instances
|
||||
vars:
|
||||
template_vm_name: jammy-cloud-tmpl
|
||||
|
||||
tasks:
|
||||
- name: Stop prod cluster
|
||||
community.general.proxmox_kvm:
|
||||
name: "{{ test_prod_vm }}"
|
||||
state: stopped
|
||||
delegate_to: localhost
|
||||
when: test_prod_vm
|
||||
|
||||
- name: Create test instances
|
||||
community.general.proxmox_kvm:
|
||||
clone: "{{ template_vm_name }}"
|
||||
name: "{{ ansible_hostname }}"
|
||||
ipconfig:
|
||||
ipconfig0: "ip={{ test_ip_address }},gw=192.168.2.1"
|
||||
delegate_to: localhost
|
||||
|
||||
- name: Wait for cluster to spin up
|
||||
|
||||
- import_playbook: setup-cluster.yml
|
|
@ -0,0 +1,55 @@
|
|||
---
|
||||
all:
|
||||
children:
|
||||
servers:
|
||||
hosts:
|
||||
tn1.thefij:
|
||||
test_prod_vm: n1
|
||||
test_ip_address: 192.168.2.201
|
||||
|
||||
nomad_node_role: both
|
||||
nomad_unique_host_volumes:
|
||||
- name: mysql-data
|
||||
path: /srv/volumes/mysql
|
||||
owner: "999"
|
||||
group: "100"
|
||||
mode: "0755"
|
||||
read_only: false
|
||||
- name: postgres-data
|
||||
path: /srv/volumes/postgres
|
||||
owner: "999"
|
||||
group: "999"
|
||||
mode: "0755"
|
||||
read_only: false
|
||||
tn2.thefij:
|
||||
test_prod_vm: n2
|
||||
test_ip_address: 192.168.2.202
|
||||
|
||||
nomad_node_class: ingress
|
||||
nomad_node_role: both
|
||||
nomad_unique_host_volumes:
|
||||
- name: nextcloud-data
|
||||
path: /srv/volumes/nextcloud
|
||||
owner: "root"
|
||||
group: "bin"
|
||||
mode: "0755"
|
||||
read_only: false
|
||||
- name: gitea-data
|
||||
path: /srv/volumes/gitea
|
||||
owner: "root"
|
||||
group: "bin"
|
||||
mode: "0755"
|
||||
read_only: false
|
||||
- name: sonarr-data
|
||||
path: /srv/volumes/sonarr
|
||||
owner: "root"
|
||||
group: "bin"
|
||||
mode: "0755"
|
||||
read_only: false
|
||||
tn3:
|
||||
test_ip_address: 192.168.2.203
|
||||
nomad_node_role: both
|
||||
|
||||
nomad_instances:
|
||||
children:
|
||||
servers: {}
|
|
@ -9,6 +9,8 @@ nomad/jobs/authelia:
|
|||
db_user: VALUE
|
||||
email_sender: VALUE
|
||||
jwt_secret: VALUE
|
||||
lldap_admin_password: VALUE
|
||||
lldap_admin_user: VALUE
|
||||
oidc_clients: VALUE
|
||||
oidc_hmac_secret: VALUE
|
||||
oidc_issuer_certificate_chain: VALUE
|
||||
|
@ -67,7 +69,6 @@ nomad/jobs/git:
|
|||
db_name: VALUE
|
||||
db_pass: VALUE
|
||||
db_user: VALUE
|
||||
oidc_secret: VALUE
|
||||
secret_key: VALUE
|
||||
smtp_sender: VALUE
|
||||
nomad/jobs/grafana:
|
||||
|
@ -90,15 +91,17 @@ nomad/jobs/immich:
|
|||
db_name: VALUE
|
||||
db_pass: VALUE
|
||||
db_user: VALUE
|
||||
nomad/jobs/lego:
|
||||
acme_email: VALUE
|
||||
domain_lego_dns: VALUE
|
||||
usersfile: VALUE
|
||||
nomad/jobs/ipdvr/radarr:
|
||||
db_pass: VALUE
|
||||
db_user: VALUE
|
||||
nomad/jobs/lidarr:
|
||||
db_name: VALUE
|
||||
db_pass: VALUE
|
||||
db_user: VALUE
|
||||
nomad/jobs/lldap:
|
||||
admin_email: VALUE
|
||||
admin_password: VALUE
|
||||
admin_user: VALUE
|
||||
db_name: VALUE
|
||||
db_pass: VALUE
|
||||
db_user: VALUE
|
||||
|
@ -119,32 +122,21 @@ nomad/jobs/photoprism:
|
|||
nomad/jobs/postgres-server:
|
||||
superuser: VALUE
|
||||
superuser_pass: VALUE
|
||||
nomad/jobs/radarr:
|
||||
db_name: VALUE
|
||||
db_pass: VALUE
|
||||
db_user: VALUE
|
||||
nomad/jobs/redis-authelia:
|
||||
allowed_psks: VALUE
|
||||
nomad/jobs/redis-blocky:
|
||||
allowed_psks: VALUE
|
||||
nomad/jobs/rediscommander:
|
||||
redis_stunnel_psk: VALUE
|
||||
nomad/jobs/sonarr:
|
||||
db_name: VALUE
|
||||
db_pass: VALUE
|
||||
db_user: VALUE
|
||||
nomad/jobs/traefik:
|
||||
external: VALUE
|
||||
acme_email: VALUE
|
||||
domain_lego_dns: VALUE
|
||||
usersfile: VALUE
|
||||
nomad/jobs/unifi-traffic-route-ips:
|
||||
unifi_password: VALUE
|
||||
unifi_username: VALUE
|
||||
nomad/oidc:
|
||||
secret: VALUE
|
||||
secrets/ldap:
|
||||
admin_email: VALUE
|
||||
admin_password: VALUE
|
||||
admin_user: VALUE
|
||||
secrets/mysql:
|
||||
mysql_root_password: VALUE
|
||||
secrets/postgres:
|
||||
|
|
|
@ -62,8 +62,6 @@ job "backup%{ if batch_node != null }-oneoff-${batch_node}%{ endif }" {
|
|||
task "backup" {
|
||||
driver = "docker"
|
||||
|
||||
shutdown_delay = "5m"
|
||||
|
||||
volume_mount {
|
||||
volume = "all-volumes"
|
||||
destination = "/data"
|
||||
|
@ -71,7 +69,7 @@ job "backup%{ if batch_node != null }-oneoff-${batch_node}%{ endif }" {
|
|||
}
|
||||
|
||||
config {
|
||||
image = "iamthefij/resticscheduler:0.4.0"
|
||||
image = "iamthefij/resticscheduler:0.3.1"
|
||||
ports = ["metrics"]
|
||||
args = [
|
||||
%{ if batch_node != null ~}
|
||||
|
@ -87,21 +85,6 @@ job "backup%{ if batch_node != null }-oneoff-${batch_node}%{ endif }" {
|
|||
]
|
||||
}
|
||||
|
||||
action "unlockenv" {
|
||||
command = "sh"
|
||||
args = ["-c", "/bin/resticscheduler -once -unlock all $${NOMAD_TASK_DIR}/node-jobs.hcl"]
|
||||
}
|
||||
|
||||
action "unlocktmpl" {
|
||||
command = "/bin/resticscheduler"
|
||||
args = ["-once", "-unlock", "all", "{{ env 'NOMAD_TASK_DIR' }}/node-jobs.hcl"]
|
||||
}
|
||||
|
||||
action "unlockhc" {
|
||||
command = "/bin/resticscheduler"
|
||||
args = ["-once", "-unlock", "all", "/local/node-jobs.hcl"]
|
||||
}
|
||||
|
||||
env = {
|
||||
RCLONE_CHECKERS = "2"
|
||||
RCLONE_TRANSFERS = "2"
|
||||
|
@ -156,7 +139,7 @@ ${file("${module_path}/${job_file}")}
|
|||
|
||||
# Dummy job to keep task healthy on node without any stateful services
|
||||
job "Dummy" {
|
||||
schedule = "@daily"
|
||||
schedule = "0 0 1 1 0"
|
||||
|
||||
config {
|
||||
repo = "/local/dummy-repo"
|
||||
|
@ -190,8 +173,8 @@ job "Dummy" {
|
|||
}
|
||||
|
||||
config {
|
||||
image = "iamthefij/stunnel:latest"
|
||||
args = ["$${NOMAD_TASK_DIR}/stunnel.conf"]
|
||||
image = "alpine:3.17"
|
||||
args = ["/bin/sh", "$${NOMAD_TASK_DIR}/start.sh"]
|
||||
}
|
||||
|
||||
resources {
|
||||
|
@ -199,6 +182,15 @@ job "Dummy" {
|
|||
memory = 100
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
set -e
|
||||
apk add stunnel
|
||||
exec stunnel {{ env "NOMAD_TASK_DIR" }}/stunnel.conf
|
||||
EOF
|
||||
destination = "$${NOMAD_TASK_DIR}/start.sh"
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
syslog = no
|
||||
|
|
|
@ -1,57 +0,0 @@
|
|||
job "git" {
|
||||
schedule = "@daily"
|
||||
|
||||
config {
|
||||
repo = "s3://backups-minio.agnosticfront.thefij:8443/nomad/gitea"
|
||||
passphrase = env("BACKUP_PASSPHRASE")
|
||||
|
||||
options {
|
||||
InsecureTls = true
|
||||
}
|
||||
}
|
||||
|
||||
task "Create local gitea dir" {
|
||||
pre_script {
|
||||
on_backup = "mkdir -p /local/gitea"
|
||||
}
|
||||
}
|
||||
|
||||
task "Backup database" {
|
||||
mysql "Backup database" {
|
||||
hostname = env("MYSQL_HOST")
|
||||
port = env("MYSQL_PORT")
|
||||
database = "gitea"
|
||||
username = env("MYSQL_USER")
|
||||
password = env("MYSQL_PASSWORD")
|
||||
no_tablespaces = true
|
||||
dump_to = "/local/gitea/dump.sql"
|
||||
}
|
||||
}
|
||||
|
||||
backup {
|
||||
paths = [
|
||||
"/local/gitea",
|
||||
"/data/nas-container/gitea",
|
||||
]
|
||||
|
||||
backup_opts {
|
||||
Host = "nomad"
|
||||
}
|
||||
|
||||
restore_opts {
|
||||
Host = ["nomad"]
|
||||
# Because path is absolute
|
||||
Target = "/"
|
||||
}
|
||||
}
|
||||
|
||||
forget {
|
||||
KeepLast = 2
|
||||
KeepHourly = 24
|
||||
KeepDaily = 30
|
||||
KeepWeekly = 8
|
||||
KeepMonthly = 6
|
||||
KeepYearly = 2
|
||||
Prune = true
|
||||
}
|
||||
}
|
|
@ -1,64 +0,0 @@
|
|||
job "radarr" {
|
||||
schedule = "@daily"
|
||||
|
||||
config {
|
||||
repo = "s3://backups-minio.agnosticfront.thefij:8443/nomad/radarr"
|
||||
passphrase = env("BACKUP_PASSPHRASE")
|
||||
|
||||
options {
|
||||
InsecureTls = true
|
||||
}
|
||||
}
|
||||
|
||||
task "Backup main database" {
|
||||
postgres "Backup database" {
|
||||
hostname = env("POSTGRES_HOST")
|
||||
port = env("POSTGRES_PORT")
|
||||
username = env("POSTGRES_USER")
|
||||
password = env("POSTGRES_PASSWORD")
|
||||
database = "radarr"
|
||||
no_tablespaces = true
|
||||
dump_to = "/data/nas-container/radarr/Backups/dump-radarr.sql"
|
||||
}
|
||||
}
|
||||
|
||||
task "Backup logs database" {
|
||||
postgres "Backup database" {
|
||||
hostname = env("POSTGRES_HOST")
|
||||
port = env("POSTGRES_PORT")
|
||||
username = env("POSTGRES_USER")
|
||||
password = env("POSTGRES_PASSWORD")
|
||||
database = "radarr-logs"
|
||||
no_tablespaces = true
|
||||
dump_to = "/data/nas-container/radarr/Backups/dump-radarr-logs.sql"
|
||||
}
|
||||
}
|
||||
|
||||
backup {
|
||||
paths = ["/data/nas-container/radarr"]
|
||||
|
||||
backup_opts {
|
||||
Exclude = [
|
||||
"radarr_backup_*.zip",
|
||||
"/data/nas-container/radarr/MediaCover",
|
||||
"/data/nas-container/radarr/logs",
|
||||
]
|
||||
Host = "nomad"
|
||||
}
|
||||
|
||||
restore_opts {
|
||||
Host = ["nomad"]
|
||||
# Because path is absolute
|
||||
Target = "/"
|
||||
}
|
||||
}
|
||||
|
||||
forget {
|
||||
KeepLast = 2
|
||||
KeepDaily = 30
|
||||
KeepWeekly = 8
|
||||
KeepMonthly = 6
|
||||
KeepYearly = 2
|
||||
Prune = true
|
||||
}
|
||||
}
|
|
@ -11,37 +11,25 @@ job "sonarr" {
|
|||
}
|
||||
|
||||
task "Backup main database" {
|
||||
postgres "Backup database" {
|
||||
hostname = env("POSTGRES_HOST")
|
||||
port = env("POSTGRES_PORT")
|
||||
username = env("POSTGRES_USER")
|
||||
password = env("POSTGRES_PASSWORD")
|
||||
database = "sonarr"
|
||||
no_tablespaces = true
|
||||
dump_to = "/data/nas-container/sonarr/Backups/dump-sonarr.sql"
|
||||
sqlite "Backup database" {
|
||||
path = "/data/sonarr/sonarr.db"
|
||||
dump_to = "/data/sonarr/Backups/sonarr.db.bak"
|
||||
}
|
||||
}
|
||||
|
||||
task "Backup logs database" {
|
||||
postgres "Backup database" {
|
||||
hostname = env("POSTGRES_HOST")
|
||||
port = env("POSTGRES_PORT")
|
||||
username = env("POSTGRES_USER")
|
||||
password = env("POSTGRES_PASSWORD")
|
||||
database = "sonarr-logs"
|
||||
no_tablespaces = true
|
||||
dump_to = "/data/nas-container/sonarr/Backups/dump-sonarr-logs.sql"
|
||||
sqlite "Backup database" {
|
||||
path = "/data/sonarr/logs.db"
|
||||
dump_to = "/data/sonarr/Backups/logs.db.bak"
|
||||
}
|
||||
}
|
||||
|
||||
backup {
|
||||
paths = ["/data/nas-container/sonarr"]
|
||||
paths = ["/data/sonarr"]
|
||||
|
||||
backup_opts {
|
||||
Exclude = [
|
||||
"sonarr_backup_*.zip",
|
||||
"/data/nas-container/sonarr/MediaCover",
|
||||
"/data/nas-container/sonarr/logs",
|
||||
"*.db",
|
||||
"*.db-shm",
|
||||
"*.db-wal",
|
||||
|
|
|
@ -2,39 +2,39 @@
|
|||
# Manual edits may be lost in future updates.
|
||||
|
||||
provider "registry.terraform.io/hashicorp/nomad" {
|
||||
version = "2.1.1"
|
||||
version = "2.0.0"
|
||||
hashes = [
|
||||
"h1:liQBgBXfQEYmwpoGZUfSsu0U0t/nhvuRZbMhaMz7wcQ=",
|
||||
"zh:28bc6922e8a21334568410760150d9d413d7b190d60b5f0b4aab2f4ef52efeeb",
|
||||
"zh:2d4283740e92ce1403875486cd5ff2c8acf9df28c190873ab4d769ce37db10c1",
|
||||
"zh:457e16d70075eae714a7df249d3ba42c2176f19b6750650152c56f33959028d9",
|
||||
"zh:49ee88371e355c00971eefee6b5001392431b47b3e760a5c649dda76f59fb8fa",
|
||||
"zh:614ad3bf07155ed8a5ced41dafb09042afbd1868490a379654b3e970def8e33d",
|
||||
"zh:75be7199d76987e7549e1f27439922973d1bf27353b44a593bfbbc2e3b9f698f",
|
||||
"h1:lIHIxA6ZmfyTGL3J9YIddhxlfit4ipSS09BLxkwo6L0=",
|
||||
"zh:09b897d64db293f9a904a4a0849b11ec1e3fff5c638f734d82ae36d8dc044b72",
|
||||
"zh:435cc106799290f64078ec24b6c59cb32b33784d609088638ed32c6d12121199",
|
||||
"zh:7073444bd064e8c4ec115ca7d9d7f030cc56795c0a83c27f6668bba519e6849a",
|
||||
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
|
||||
"zh:888e14a24410d56b37212fbea373a3e0401d0ff8f8e4f4dd00ba8b29de9fed39",
|
||||
"zh:aa261925e8b152636a0886b3a2149864707632d836e98a88dacea6cfb6302082",
|
||||
"zh:ac10cefb4064b3bb63d4b0379624a416a45acf778eac0004466f726ead686196",
|
||||
"zh:b1a3c8b4d5b2dc9b510eac5e9e02665582862c24eb819ab74f44d3d880246d4f",
|
||||
"zh:c552e2fe5670b6d3ad9a5faf78e3a27197eeedbe2b13928d2c491fa509bc47c7",
|
||||
"zh:79d238c35d650d2d83a439716182da63f3b2767e72e4cbd0b69cb13d9b1aebfc",
|
||||
"zh:7ef5f49344278fe0bbc5447424e6aa5425ff1821d010d944a444d7fa2c751acf",
|
||||
"zh:92179091638c8ba03feef371c4361a790190f9955caea1fa59de2055c701a251",
|
||||
"zh:a8a34398851761368eb8e7c171f24e55efa6e9fdbb5c455f6dec34dc17f631bc",
|
||||
"zh:b38fd5338625ebace5a4a94cea1a28b11bd91995d834e318f47587cfaf6ec599",
|
||||
"zh:b71b273a2aca7ad5f1e07c767b25b5a888881ba9ca93b30044ccc39c2937f03c",
|
||||
"zh:cd14357e520e0f09fb25badfb4f2ee37d7741afdc3ed47c7bcf54c1683772543",
|
||||
"zh:e05e025f4bb95138c3c8a75c636e97cd7cfd2fc1525b0c8bd097db8c5f02df6e",
|
||||
]
|
||||
}
|
||||
|
||||
provider "registry.terraform.io/hashicorp/random" {
|
||||
version = "3.6.0"
|
||||
version = "3.5.1"
|
||||
hashes = [
|
||||
"h1:R5Ucn26riKIEijcsiOMBR3uOAjuOMfI1x7XvH4P6B1w=",
|
||||
"zh:03360ed3ecd31e8c5dac9c95fe0858be50f3e9a0d0c654b5e504109c2159287d",
|
||||
"zh:1c67ac51254ba2a2bb53a25e8ae7e4d076103483f55f39b426ec55e47d1fe211",
|
||||
"zh:24a17bba7f6d679538ff51b3a2f378cedadede97af8a1db7dad4fd8d6d50f829",
|
||||
"zh:30ffb297ffd1633175d6545d37c2217e2cef9545a6e03946e514c59c0859b77d",
|
||||
"zh:454ce4b3dbc73e6775f2f6605d45cee6e16c3872a2e66a2c97993d6e5cbd7055",
|
||||
"h1:VSnd9ZIPyfKHOObuQCaKfnjIHRtR7qTw19Rz8tJxm+k=",
|
||||
"zh:04e3fbd610cb52c1017d282531364b9c53ef72b6bc533acb2a90671957324a64",
|
||||
"zh:119197103301ebaf7efb91df8f0b6e0dd31e6ff943d231af35ee1831c599188d",
|
||||
"zh:4d2b219d09abf3b1bb4df93d399ed156cadd61f44ad3baf5cf2954df2fba0831",
|
||||
"zh:6130bdde527587bbe2dcaa7150363e96dbc5250ea20154176d82bc69df5d4ce3",
|
||||
"zh:6cc326cd4000f724d3086ee05587e7710f032f94fc9af35e96a386a1c6f2214f",
|
||||
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
|
||||
"zh:91df0a9fab329aff2ff4cf26797592eb7a3a90b4a0c04d64ce186654e0cc6e17",
|
||||
"zh:aa57384b85622a9f7bfb5d4512ca88e61f22a9cea9f30febaa4c98c68ff0dc21",
|
||||
"zh:c4a3e329ba786ffb6f2b694e1fd41d413a7010f3a53c20b432325a94fa71e839",
|
||||
"zh:e2699bc9116447f96c53d55f2a00570f982e6f9935038c3810603572693712d0",
|
||||
"zh:e747c0fd5d7684e5bfad8aa0ca441903f15ae7a98a737ff6aca24ba223207e2c",
|
||||
"zh:f1ca75f417ce490368f047b63ec09fd003711ae48487fba90b4aba2ccf71920e",
|
||||
"zh:b6d88e1d28cf2dfa24e9fdcc3efc77adcdc1c3c3b5c7ce503a423efbdd6de57b",
|
||||
"zh:ba74c592622ecbcef9dc2a4d81ed321c4e44cddf7da799faa324da9bf52a22b2",
|
||||
"zh:c7c5cde98fe4ef1143bd1b3ec5dc04baf0d4cc3ca2c5c7d40d17c0e9b2076865",
|
||||
"zh:dac4bad52c940cd0dfc27893507c1e92393846b024c5a9db159a93c534a3da03",
|
||||
"zh:de8febe2a2acd9ac454b844a4106ed295ae9520ef54dc8ed2faf29f12716b602",
|
||||
"zh:eab0d0495e7e711cca367f7d4df6e322e6c562fc52151ec931176115b83ed014",
|
||||
]
|
||||
}
|
||||
|
|
|
@ -49,7 +49,7 @@ module "authelia" {
|
|||
mount = false
|
||||
},
|
||||
{
|
||||
data = "{{ with nomadVar \"secrets/ldap\" }}{{ .admin_password }}{{ end }}"
|
||||
data = "{{ with nomadVar \"nomad/jobs/authelia\" }}{{ .lldap_admin_password }}{{ end }}"
|
||||
dest_prefix = "$${NOMAD_SECRETS_DIR}"
|
||||
dest = "ldap_password.txt"
|
||||
mount = false
|
||||
|
@ -105,43 +105,6 @@ module "authelia" {
|
|||
]
|
||||
}
|
||||
|
||||
resource "nomad_acl_policy" "authelia" {
|
||||
name = "authelia"
|
||||
description = "Give access to shared authelia variables"
|
||||
rules_hcl = <<EOH
|
||||
namespace "default" {
|
||||
variables {
|
||||
path "authelia/*" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
}
|
||||
}
|
||||
EOH
|
||||
|
||||
job_acl {
|
||||
job_id = module.authelia.job_id
|
||||
}
|
||||
}
|
||||
|
||||
# Give access to ldap secrets
|
||||
resource "nomad_acl_policy" "authelia_ldap_secrets" {
|
||||
name = "authelia-secrets-ldap"
|
||||
description = "Give access to LDAP secrets"
|
||||
rules_hcl = <<EOH
|
||||
namespace "default" {
|
||||
variables {
|
||||
path "secrets/ldap" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
}
|
||||
}
|
||||
EOH
|
||||
|
||||
job_acl {
|
||||
job_id = module.authelia.job_id
|
||||
}
|
||||
}
|
||||
|
||||
resource "nomad_acl_auth_method" "nomad_authelia" {
|
||||
name = "authelia"
|
||||
type = "OIDC"
|
||||
|
|
|
@ -89,8 +89,8 @@ authentication_backend:
|
|||
groups_filter: (member={dn})
|
||||
|
||||
## The username and password of the admin user.
|
||||
{{ with nomadVar "secrets/ldap" }}
|
||||
user: uid={{ .admin_user }},ou=people,{{ with nomadVar "nomad/jobs" }}{{ .ldap_base_dn }}{{ end }}
|
||||
{{ with nomadVar "nomad/jobs/authelia" }}
|
||||
user: uid={{ .lldap_admin_user }},ou=people,{{ with nomadVar "nomad/jobs" }}{{ .ldap_base_dn }}{{ end }}
|
||||
{{ end }}
|
||||
# password set using secrets file
|
||||
# password: <secret>
|
||||
|
@ -151,10 +151,6 @@ access_control:
|
|||
networks: 192.168.5.0/24
|
||||
|
||||
rules:
|
||||
{{ range nomadVarList "authelia/access_control/service_rules" }}{{ with nomadVar .Path }}
|
||||
- domain: '{{ .name }}.{{ with nomadVar "nomad/jobs" }}{{ .base_hostname }}{{ end }}'
|
||||
{{ .rule.Value | indent 6 }}
|
||||
{{ end }}{{ end }}
|
||||
## Rules applied to everyone
|
||||
- domain: '*.{{ with nomadVar "nomad/jobs" }}{{ .base_hostname }}{{ end }}'
|
||||
networks:
|
||||
|
|
|
@ -32,9 +32,7 @@ job "blocky" {
|
|||
|
||||
dns {
|
||||
# Set expclicit DNS servers because tasks, by default, use this task
|
||||
servers = [
|
||||
"192.168.2.1",
|
||||
]
|
||||
servers = ["1.1.1.1", "1.0.0.1"]
|
||||
}
|
||||
}
|
||||
|
||||
|
@ -76,8 +74,8 @@ job "blocky" {
|
|||
|
||||
resources {
|
||||
cpu = 50
|
||||
memory = 75
|
||||
memory_max = 150
|
||||
memory = 50
|
||||
memory_max = 100
|
||||
}
|
||||
|
||||
template {
|
||||
|
@ -118,9 +116,9 @@ job "blocky" {
|
|||
}
|
||||
|
||||
config {
|
||||
image = "iamthefij/stunnel:latest"
|
||||
args = ["$${NOMAD_TASK_DIR}/stunnel.conf"]
|
||||
image = "alpine:3.17"
|
||||
ports = ["tls"]
|
||||
args = ["/bin/sh", "$${NOMAD_TASK_DIR}/start.sh"]
|
||||
}
|
||||
|
||||
resources {
|
||||
|
@ -128,27 +126,36 @@ job "blocky" {
|
|||
memory = 100
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
set -e
|
||||
apk add stunnel
|
||||
exec stunnel {{ env "NOMAD_TASK_DIR" }}/stunnel.conf
|
||||
EOF
|
||||
destination = "$${NOMAD_TASK_DIR}/start.sh"
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
syslog = no
|
||||
foreground = yes
|
||||
delay = yes
|
||||
|
||||
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-tls" -}}
|
||||
[mysql_client]
|
||||
client = yes
|
||||
accept = 127.0.0.1:3306
|
||||
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "mysql-tls" -}}
|
||||
connect = {{ .Address }}:{{ .Port }}
|
||||
PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/mysql_stunnel_psk.txt
|
||||
{{- end }}
|
||||
PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/mysql_stunnel_psk.txt
|
||||
|
||||
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "redis-blocky" -}}
|
||||
[redis_client]
|
||||
client = yes
|
||||
accept = 127.0.0.1:6379
|
||||
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "redis-blocky" -}}
|
||||
connect = {{ .Address }}:{{ .Port }}
|
||||
PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/stunnel_psk.txt
|
||||
{{- end }}
|
||||
PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/stunnel_psk.txt
|
||||
EOF
|
||||
destination = "$${NOMAD_TASK_DIR}/stunnel.conf"
|
||||
}
|
||||
|
|
|
@ -5,45 +5,25 @@ ports:
|
|||
bootstrapDns:
|
||||
- upstream: 1.1.1.1
|
||||
- upstream: 1.0.0.1
|
||||
- upstream: 9.9.9.9
|
||||
- upstream: 149.112.112.112
|
||||
|
||||
|
||||
upstreams:
|
||||
groups:
|
||||
default:
|
||||
- https://dns.quad9.net/dns-query
|
||||
- tcp-tls:dns.quad9.net
|
||||
- https://one.one.one.one/dns-query
|
||||
- tcp-tls:one.one.one.one
|
||||
cloudflare:
|
||||
- 1.1.1.1
|
||||
- 1.0.0.1
|
||||
- 2606:4700:4700::1111
|
||||
- 2606:4700:4700::1001
|
||||
- https://one.one.one.one/dns-query
|
||||
- tcp-tls:one.one.one.one
|
||||
quad9:
|
||||
- 9.9.9.9
|
||||
- 149.112.112.112
|
||||
- 2620:fe::fe
|
||||
- 2620:fe::9
|
||||
- https://dns.quad9.net/dns-query
|
||||
- tcp-tls:dns.quad9.net
|
||||
quad9-secured:
|
||||
- 9.9.9.11
|
||||
- 149.112.112.11
|
||||
- 2620:fe::11
|
||||
- 2620:fe::fe:11
|
||||
- https://dns11.quad9.net/dns-query
|
||||
- tcp-tls:dns11.quad9.net
|
||||
quad9-unsecured:
|
||||
- 9.9.9.10
|
||||
- 149.112.112.10
|
||||
- 2620:fe::10
|
||||
- 2620:fe::fe:10
|
||||
- https://dns10.quad9.net/dns-query
|
||||
- tcp-tls:dns10.quad9.net
|
||||
upstream:
|
||||
default:
|
||||
- 1.1.1.1
|
||||
- 1.0.0.1
|
||||
quad9:
|
||||
- 9.9.9.9
|
||||
- 149.112.112.112
|
||||
- 2620:fe::fe
|
||||
- 2620:fe::9
|
||||
- https://dns.quad9.net/dns-query
|
||||
- tcp-tls:dns.quad9.net
|
||||
quad9-unsecured:
|
||||
- 9.9.9.10
|
||||
- 149.112.112.10
|
||||
- 2620:fe::10
|
||||
- 2620:fe::fe:10
|
||||
- https://dns10.quad9.net/dns-query
|
||||
- tcp-tls:dns10.quad9.net
|
||||
|
||||
conditional:
|
||||
fallbackUpstream: false
|
||||
|
@ -56,11 +36,9 @@ conditional:
|
|||
.: 192.168.2.1
|
||||
|
||||
hostsFile:
|
||||
sources:
|
||||
- {{ env "NOMAD_TASK_DIR" }}/nomad.hosts
|
||||
filePath: {{ env "NOMAD_TASK_DIR" }}/nomad.hosts
|
||||
hostsTTL: 30s
|
||||
loading:
|
||||
refreshPeriod: 30s
|
||||
refreshPeriod: 30s
|
||||
|
||||
clientLookup:
|
||||
upstream: 192.168.2.1
|
||||
|
@ -72,10 +50,10 @@ blocking:
|
|||
- http://sysctl.org/cameleon/hosts
|
||||
- https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt
|
||||
- https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt
|
||||
# - https://hosts-file.net/ad_servers.txt
|
||||
- https://hosts-file.net/ad_servers.txt
|
||||
smarttv:
|
||||
- https://perflyst.github.io/PiHoleBlocklist/SmartTV.txt
|
||||
# - https://perflyst.github.io/PiHoleBlocklist/regex.list
|
||||
- https://perflyst.github.io/PiHoleBlocklist/regex.list
|
||||
wemo:
|
||||
- |
|
||||
# Remote commands
|
||||
|
@ -86,6 +64,8 @@ blocking:
|
|||
nat.wemo2.com
|
||||
# Connectivity checks
|
||||
heartbeat.xwemo.com
|
||||
malware:
|
||||
- https://mirror1.malwaredomains.com/files/justdomains
|
||||
antisocial:
|
||||
- |
|
||||
facebook.com
|
||||
|
@ -93,21 +73,18 @@ blocking:
|
|||
reddit.com
|
||||
twitter.com
|
||||
youtube.com
|
||||
custom:
|
||||
- https://git.thefij.rocks/iamthefij/blocklists/raw/branch/main/block
|
||||
|
||||
whiteLists:
|
||||
# Move to Gitea when deployed internally
|
||||
ads:
|
||||
{{ with nomadVar "nomad/jobs/blocky" -}}
|
||||
{{ .whitelists_ads.Value | indent 6 }}
|
||||
{{- end }}
|
||||
custom:
|
||||
- https://git.thefij.rocks/iamthefij/blocklists/raw/branch/main/allow
|
||||
|
||||
clientGroupsBlock:
|
||||
default:
|
||||
- ads
|
||||
- custom
|
||||
- malware
|
||||
- smarttv
|
||||
- wemo
|
||||
|
||||
|
@ -128,7 +105,7 @@ customDNS:
|
|||
prometheus:
|
||||
enable: true
|
||||
|
||||
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "redis-blocky" -}}
|
||||
{{ range nomadService 1 (env "NOMAD_ALLOC_ID") "redis-tls" -}}
|
||||
redis:
|
||||
address: 127.0.0.1:6379
|
||||
# password: ""
|
||||
|
|
|
@ -40,8 +40,8 @@ job "grafana" {
|
|||
}
|
||||
|
||||
config {
|
||||
image = "iamthefij/stunnel:latest"
|
||||
args = ["$${NOMAD_TASK_DIR}/stunnel.conf"]
|
||||
image = "alpine:3.17"
|
||||
args = ["/bin/sh", "$${NOMAD_TASK_DIR}/start.sh"]
|
||||
}
|
||||
|
||||
resources {
|
||||
|
@ -49,6 +49,15 @@ job "grafana" {
|
|||
memory = 100
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
set -e
|
||||
apk add stunnel
|
||||
exec stunnel {{ env "NOMAD_TASK_DIR" }}/stunnel.conf
|
||||
EOF
|
||||
destination = "$${NOMAD_TASK_DIR}/start.sh"
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
syslog = no
|
||||
|
@ -133,7 +142,7 @@ SELECT 'NOOP';
|
|||
driver = "docker"
|
||||
|
||||
config {
|
||||
image = "grafana/grafana:10.0.10"
|
||||
image = "grafana/grafana:9.4.2"
|
||||
args = ["--config", "$${NOMAD_ALLOC_DIR}/config/grafana.ini"]
|
||||
ports = ["web"]
|
||||
}
|
||||
|
|
|
@ -270,10 +270,6 @@ api_url = https://authelia.{{ with nomadVar "nomad/jobs" }}{{ .base_hostname }}{
|
|||
login_attribute_path = preferred_username
|
||||
groups_attribute_path = groups
|
||||
name_attribute_path = name
|
||||
# Role attribute path is not working
|
||||
role_attribute_path = contains(groups[*], 'admin') && 'Admin' || contains(groups[*], 'grafana-admin') && 'Admin' || contains(groups[*], 'grafana-editor') && 'Editor' || contains(groups[*], 'developer') && 'Editor'
|
||||
allow_assign_grafana_admin = true
|
||||
skip_org_role_sync = true
|
||||
use_pkce = true
|
||||
|
||||
;team_ids =
|
||||
|
|
|
@ -0,0 +1,783 @@
|
|||
{
|
||||
"__inputs": [
|
||||
{
|
||||
"name": "DS_PROMETHEUS",
|
||||
"label": "Prometheus",
|
||||
"description": "",
|
||||
"type": "datasource",
|
||||
"pluginId": "prometheus",
|
||||
"pluginName": "Prometheus"
|
||||
}
|
||||
],
|
||||
"__requires": [
|
||||
{
|
||||
"type": "grafana",
|
||||
"id": "grafana",
|
||||
"name": "Grafana",
|
||||
"version": "7.5.5"
|
||||
},
|
||||
{
|
||||
"type": "panel",
|
||||
"id": "graph",
|
||||
"name": "Graph",
|
||||
"version": ""
|
||||
},
|
||||
{
|
||||
"type": "panel",
|
||||
"id": "piechart",
|
||||
"name": "Pie chart v2",
|
||||
"version": ""
|
||||
},
|
||||
{
|
||||
"type": "datasource",
|
||||
"id": "prometheus",
|
||||
"name": "Prometheus",
|
||||
"version": "1.0.0"
|
||||
},
|
||||
{
|
||||
"type": "panel",
|
||||
"id": "singlestat",
|
||||
"name": "Singlestat",
|
||||
"version": ""
|
||||
}
|
||||
],
|
||||
"annotations": {
|
||||
"list": [
|
||||
{
|
||||
"builtIn": 1,
|
||||
"datasource": "-- Grafana --",
|
||||
"enable": true,
|
||||
"hide": true,
|
||||
"iconColor": "rgba(0, 211, 255, 1)",
|
||||
"name": "Annotations & Alerts",
|
||||
"type": "dashboard"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": "Traefik dashboard prometheus",
|
||||
"editable": true,
|
||||
"gnetId": 4475,
|
||||
"graphTooltip": 0,
|
||||
"id": null,
|
||||
"iteration": 1620932097756,
|
||||
"links": [],
|
||||
"panels": [
|
||||
{
|
||||
"datasource": null,
|
||||
"gridPos": {
|
||||
"h": 1,
|
||||
"w": 24,
|
||||
"x": 0,
|
||||
"y": 0
|
||||
},
|
||||
"id": 10,
|
||||
"title": "$backend stats",
|
||||
"type": "row"
|
||||
},
|
||||
{
|
||||
"cacheTimeout": null,
|
||||
"datasource": "${DS_PROMETHEUS}",
|
||||
"fieldConfig": {
|
||||
"defaults": {
|
||||
"color": {
|
||||
"mode": "palette-classic"
|
||||
},
|
||||
"decimals": 0,
|
||||
"mappings": [],
|
||||
"thresholds": {
|
||||
"mode": "absolute",
|
||||
"steps": [
|
||||
{
|
||||
"color": "green",
|
||||
"value": null
|
||||
},
|
||||
{
|
||||
"color": "red",
|
||||
"value": 80
|
||||
}
|
||||
]
|
||||
},
|
||||
"unit": "short"
|
||||
},
|
||||
"overrides": []
|
||||
},
|
||||
"gridPos": {
|
||||
"h": 7,
|
||||
"w": 12,
|
||||
"x": 0,
|
||||
"y": 1
|
||||
},
|
||||
"id": 2,
|
||||
"interval": null,
|
||||
"links": [],
|
||||
"maxDataPoints": 3,
|
||||
"options": {
|
||||
"displayLabels": [],
|
||||
"legend": {
|
||||
"calcs": [],
|
||||
"displayMode": "table",
|
||||
"placement": "right",
|
||||
"values": [
|
||||
"value",
|
||||
"percent"
|
||||
]
|
||||
},
|
||||
"pieType": "pie",
|
||||
"reduceOptions": {
|
||||
"calcs": [
|
||||
"lastNotNull"
|
||||
],
|
||||
"fields": "",
|
||||
"values": false
|
||||
},
|
||||
"text": {}
|
||||
},
|
||||
"targets": [
|
||||
{
|
||||
"exemplar": true,
|
||||
"expr": "traefik_service_requests_total{service=\"$service\"}",
|
||||
"format": "time_series",
|
||||
"interval": "",
|
||||
"intervalFactor": 2,
|
||||
"legendFormat": "{{method}} : {{code}}",
|
||||
"refId": "A"
|
||||
}
|
||||
],
|
||||
"title": "$service return code",
|
||||
"type": "piechart"
|
||||
},
|
||||
{
|
||||
"cacheTimeout": null,
|
||||
"colorBackground": false,
|
||||
"colorValue": false,
|
||||
"colors": [
|
||||
"#299c46",
|
||||
"rgba(237, 129, 40, 0.89)",
|
||||
"#d44a3a"
|
||||
],
|
||||
"datasource": "${DS_PROMETHEUS}",
|
||||
"fieldConfig": {
|
||||
"defaults": {},
|
||||
"overrides": []
|
||||
},
|
||||
"format": "ms",
|
||||
"gauge": {
|
||||
"maxValue": 100,
|
||||
"minValue": 0,
|
||||
"show": false,
|
||||
"thresholdLabels": false,
|
||||
"thresholdMarkers": true
|
||||
},
|
||||
"gridPos": {
|
||||
"h": 7,
|
||||
"w": 12,
|
||||
"x": 12,
|
||||
"y": 1
|
||||
},
|
||||
"id": 4,
|
||||
"interval": null,
|
||||
"links": [],
|
||||
"mappingType": 1,
|
||||
"mappingTypes": [
|
||||
{
|
||||
"name": "value to text",
|
||||
"value": 1
|
||||
},
|
||||
{
|
||||
"name": "range to text",
|
||||
"value": 2
|
||||
}
|
||||
],
|
||||
"maxDataPoints": 100,
|
||||
"nullPointMode": "connected",
|
||||
"nullText": null,
|
||||
"postfix": "",
|
||||
"postfixFontSize": "50%",
|
||||
"prefix": "",
|
||||
"prefixFontSize": "50%",
|
||||
"rangeMaps": [
|
||||
{
|
||||
"from": "null",
|
||||
"text": "N/A",
|
||||
"to": "null"
|
||||
}
|
||||
],
|
||||
"sparkline": {
|
||||
"fillColor": "rgba(31, 118, 189, 0.18)",
|
||||
"full": false,
|
||||
"lineColor": "rgb(31, 120, 193)",
|
||||
"show": true
|
||||
},
|
||||
"tableColumn": "",
|
||||
"targets": [
|
||||
{
|
||||
"exemplar": true,
|
||||
"expr": "sum(traefik_service_request_duration_seconds_sum{service=\"$service\"}) / sum(traefik_service_requests_total{service=\"$service\"}) * 1000",
|
||||
"format": "time_series",
|
||||
"interval": "",
|
||||
"intervalFactor": 2,
|
||||
"legendFormat": "",
|
||||
"refId": "A"
|
||||
}
|
||||
],
|
||||
"thresholds": "",
|
||||
"title": "$service response time",
|
||||
"type": "singlestat",
|
||||
"valueFontSize": "80%",
|
||||
"valueMaps": [
|
||||
{
|
||||
"op": "=",
|
||||
"text": "N/A",
|
||||
"value": "null"
|
||||
}
|
||||
],
|
||||
"valueName": "avg"
|
||||
},
|
||||
{
|
||||
"aliasColors": {},
|
||||
"bars": true,
|
||||
"dashLength": 10,
|
||||
"dashes": false,
|
||||
"datasource": "${DS_PROMETHEUS}",
|
||||
"fieldConfig": {
|
||||
"defaults": {},
|
||||
"overrides": []
|
||||
},
|
||||
"fill": 1,
|
||||
"fillGradient": 0,
|
||||
"gridPos": {
|
||||
"h": 7,
|
||||
"w": 24,
|
||||
"x": 0,
|
||||
"y": 8
|
||||
},
|
||||
"hiddenSeries": false,
|
||||
"id": 3,
|
||||
"legend": {
|
||||
"alignAsTable": true,
|
||||
"avg": true,
|
||||
"current": false,
|
||||
"max": true,
|
||||
"min": true,
|
||||
"rightSide": true,
|
||||
"show": true,
|
||||
"total": false,
|
||||
"values": true
|
||||
},
|
||||
"lines": false,
|
||||
"linewidth": 1,
|
||||
"links": [],
|
||||
"nullPointMode": "null",
|
||||
"options": {
|
||||
"alertThreshold": true
|
||||
},
|
||||
"percentage": false,
|
||||
"pluginVersion": "7.5.5",
|
||||
"pointradius": 5,
|
||||
"points": false,
|
||||
"renderer": "flot",
|
||||
"seriesOverrides": [],
|
||||
"spaceLength": 10,
|
||||
"stack": false,
|
||||
"steppedLine": false,
|
||||
"targets": [
|
||||
{
|
||||
"exemplar": true,
|
||||
"expr": "sum(rate(traefik_service_requests_total{service=\"$service\"}[5m]))",
|
||||
"format": "time_series",
|
||||
"interval": "",
|
||||
"intervalFactor": 2,
|
||||
"legendFormat": "Total requests $service",
|
||||
"refId": "A"
|
||||
}
|
||||
],
|
||||
"thresholds": [],
|
||||
"timeFrom": null,
|
||||
"timeRegions": [],
|
||||
"timeShift": null,
|
||||
"title": "Total requests over 5min $service",
|
||||
"tooltip": {
|
||||
"shared": true,
|
||||
"sort": 0,
|
||||
"value_type": "individual"
|
||||
},
|
||||
"type": "graph",
|
||||
"xaxis": {
|
||||
"buckets": null,
|
||||
"mode": "time",
|
||||
"name": null,
|
||||
"show": true,
|
||||
"values": []
|
||||
},
|
||||
"yaxes": [
|
||||
{
|
||||
"format": "short",
|
||||
"label": null,
|
||||
"logBase": 1,
|
||||
"max": null,
|
||||
"min": null,
|
||||
"show": true
|
||||
},
|
||||
{
|
||||
"format": "short",
|
||||
"label": null,
|
||||
"logBase": 1,
|
||||
"max": null,
|
||||
"min": null,
|
||||
"show": true
|
||||
}
|
||||
],
|
||||
"yaxis": {
|
||||
"align": false,
|
||||
"alignLevel": null
|
||||
}
|
||||
},
|
||||
{
|
||||
"collapsed": false,
|
||||
"datasource": null,
|
||||
"gridPos": {
|
||||
"h": 1,
|
||||
"w": 24,
|
||||
"x": 0,
|
||||
"y": 15
|
||||
},
|
||||
"id": 12,
|
||||
"panels": [],
|
||||
"title": "Global stats",
|
||||
"type": "row"
|
||||
},
|
||||
{
|
||||
"aliasColors": {},
|
||||
"bars": true,
|
||||
"dashLength": 10,
|
||||
"dashes": false,
|
||||
"datasource": "${DS_PROMETHEUS}",
|
||||
"fieldConfig": {
|
||||
"defaults": {},
|
||||
"overrides": []
|
||||
},
|
||||
"fill": 1,
|
||||
"fillGradient": 0,
|
||||
"gridPos": {
|
||||
"h": 7,
|
||||
"w": 12,
|
||||
"x": 0,
|
||||
"y": 16
|
||||
},
|
||||
"hiddenSeries": false,
|
||||
"id": 5,
|
||||
"legend": {
|
||||
"alignAsTable": true,
|
||||
"avg": false,
|
||||
"current": true,
|
||||
"max": true,
|
||||
"min": true,
|
||||
"rightSide": true,
|
||||
"show": true,
|
||||
"total": false,
|
||||
"values": true
|
||||
},
|
||||
"lines": false,
|
||||
"linewidth": 1,
|
||||
"links": [],
|
||||
"nullPointMode": "null",
|
||||
"options": {
|
||||
"alertThreshold": true
|
||||
},
|
||||
"percentage": false,
|
||||
"pluginVersion": "7.5.5",
|
||||
"pointradius": 5,
|
||||
"points": false,
|
||||
"renderer": "flot",
|
||||
"seriesOverrides": [],
|
||||
"spaceLength": 10,
|
||||
"stack": true,
|
||||
"steppedLine": false,
|
||||
"targets": [
|
||||
{
|
||||
"expr": "rate(traefik_entrypoint_requests_total{entrypoint=~\"$entrypoint\",code=\"200\"}[5m])",
|
||||
"format": "time_series",
|
||||
"intervalFactor": 2,
|
||||
"legendFormat": "{{method}} : {{code}}",
|
||||
"refId": "A"
|
||||
}
|
||||
],
|
||||
"thresholds": [],
|
||||
"timeFrom": null,
|
||||
"timeRegions": [],
|
||||
"timeShift": null,
|
||||
"title": "Status code 200 over 5min",
|
||||
"tooltip": {
|
||||
"shared": true,
|
||||
"sort": 0,
|
||||
"value_type": "individual"
|
||||
},
|
||||
"type": "graph",
|
||||
"xaxis": {
|
||||
"buckets": null,
|
||||
"mode": "time",
|
||||
"name": null,
|
||||
"show": true,
|
||||
"values": []
|
||||
},
|
||||
"yaxes": [
|
||||
{
|
||||
"format": "short",
|
||||
"label": null,
|
||||
"logBase": 1,
|
||||
"max": null,
|
||||
"min": null,
|
||||
"show": true
|
||||
},
|
||||
{
|
||||
"format": "short",
|
||||
"label": null,
|
||||
"logBase": 1,
|
||||
"max": null,
|
||||
"min": null,
|
||||
"show": true
|
||||
}
|
||||
],
|
||||
"yaxis": {
|
||||
"align": false,
|
||||
"alignLevel": null
|
||||
}
|
||||
},
|
||||
{
|
||||
"aliasColors": {},
|
||||
"bars": true,
|
||||
"dashLength": 10,
|
||||
"dashes": false,
|
||||
"datasource": "${DS_PROMETHEUS}",
|
||||
"fieldConfig": {
|
||||
"defaults": {},
|
||||
"overrides": []
|
||||
},
|
||||
"fill": 1,
|
||||
"fillGradient": 0,
|
||||
"gridPos": {
|
||||
"h": 7,
|
||||
"w": 12,
|
||||
"x": 12,
|
||||
"y": 16
|
||||
},
|
||||
"hiddenSeries": false,
|
||||
"id": 6,
|
||||
"legend": {
|
||||
"alignAsTable": true,
|
||||
"avg": false,
|
||||
"current": true,
|
||||
"max": true,
|
||||
"min": true,
|
||||
"rightSide": true,
|
||||
"show": true,
|
||||
"total": false,
|
||||
"values": true
|
||||
},
|
||||
"lines": false,
|
||||
"linewidth": 1,
|
||||
"links": [],
|
||||
"nullPointMode": "null",
|
||||
"options": {
|
||||
"alertThreshold": true
|
||||
},
|
||||
"percentage": false,
|
||||
"pluginVersion": "7.5.5",
|
||||
"pointradius": 5,
|
||||
"points": false,
|
||||
"renderer": "flot",
|
||||
"seriesOverrides": [],
|
||||
"spaceLength": 10,
|
||||
"stack": true,
|
||||
"steppedLine": false,
|
||||
"targets": [
|
||||
{
|
||||
"expr": "rate(traefik_entrypoint_requests_total{entrypoint=~\"$entrypoint\",code!=\"200\"}[5m])",
|
||||
"format": "time_series",
|
||||
"intervalFactor": 2,
|
||||
"legendFormat": "{{ method }} : {{code}}",
|
||||
"refId": "A"
|
||||
}
|
||||
],
|
||||
"thresholds": [],
|
||||
"timeFrom": null,
|
||||
"timeRegions": [],
|
||||
"timeShift": null,
|
||||
"title": "Others status code over 5min",
|
||||
"tooltip": {
|
||||
"shared": true,
|
||||
"sort": 0,
|
||||
"value_type": "individual"
|
||||
},
|
||||
"type": "graph",
|
||||
"xaxis": {
|
||||
"buckets": null,
|
||||
"mode": "time",
|
||||
"name": null,
|
||||
"show": true,
|
||||
"values": []
|
||||
},
|
||||
"yaxes": [
|
||||
{
|
||||
"format": "short",
|
||||
"label": null,
|
||||
"logBase": 1,
|
||||
"max": null,
|
||||
"min": null,
|
||||
"show": true
|
||||
},
|
||||
{
|
||||
"format": "short",
|
||||
"label": null,
|
||||
"logBase": 1,
|
||||
"max": null,
|
||||
"min": null,
|
||||
"show": true
|
||||
}
|
||||
],
|
||||
"yaxis": {
|
||||
"align": false,
|
||||
"alignLevel": null
|
||||
}
|
||||
},
|
||||
{
|
||||
"cacheTimeout": null,
|
||||
"datasource": "${DS_PROMETHEUS}",
|
||||
"fieldConfig": {
|
||||
"defaults": {
|
||||
"color": {
|
||||
"mode": "palette-classic"
|
||||
},
|
||||
"decimals": 0,
|
||||
"mappings": [],
|
||||
"thresholds": {
|
||||
"mode": "absolute",
|
||||
"steps": [
|
||||
{
|
||||
"color": "green",
|
||||
"value": null
|
||||
},
|
||||
{
|
||||
"color": "red",
|
||||
"value": 80
|
||||
}
|
||||
]
|
||||
},
|
||||
"unit": "short"
|
||||
},
|
||||
"overrides": []
|
||||
},
|
||||
"gridPos": {
|
||||
"h": 7,
|
||||
"w": 12,
|
||||
"x": 0,
|
||||
"y": 23
|
||||
},
|
||||
"id": 7,
|
||||
"interval": null,
|
||||
"links": [],
|
||||
"maxDataPoints": 3,
|
||||
"options": {
|
||||
"displayLabels": [],
|
||||
"legend": {
|
||||
"calcs": [],
|
||||
"displayMode": "table",
|
||||
"placement": "right",
|
||||
"values": [
|
||||
"value"
|
||||
]
|
||||
},
|
||||
"pieType": "pie",
|
||||
"reduceOptions": {
|
||||
"calcs": [
|
||||
"sum"
|
||||
],
|
||||
"fields": "",
|
||||
"values": false
|
||||
},
|
||||
"text": {}
|
||||
},
|
||||
"targets": [
|
||||
{
|
||||
"exemplar": true,
|
||||
"expr": "sum(rate(traefik_service_requests_total[5m])) by (service) ",
|
||||
"format": "time_series",
|
||||
"interval": "",
|
||||
"intervalFactor": 2,
|
||||
"legendFormat": "{{ service }}",
|
||||
"refId": "A"
|
||||
}
|
||||
],
|
||||
"title": "Requests by service",
|
||||
"type": "piechart"
|
||||
},
|
||||
{
|
||||
"cacheTimeout": null,
|
||||
"datasource": "${DS_PROMETHEUS}",
|
||||
"fieldConfig": {
|
||||
"defaults": {
|
||||
"color": {
|
||||
"mode": "palette-classic"
|
||||
},
|
||||
"decimals": 0,
|
||||
"mappings": [],
|
||||
"thresholds": {
|
||||
"mode": "absolute",
|
||||
"steps": [
|
||||
{
|
||||
"color": "green",
|
||||
"value": null
|
||||
},
|
||||
{
|
||||
"color": "red",
|
||||
"value": 80
|
||||
}
|
||||
]
|
||||
},
|
||||
"unit": "short"
|
||||
},
|
||||
"overrides": []
|
||||
},
|
||||
"gridPos": {
|
||||
"h": 7,
|
||||
"w": 12,
|
||||
"x": 12,
|
||||
"y": 23
|
||||
},
|
||||
"id": 8,
|
||||
"interval": null,
|
||||
"links": [],
|
||||
"maxDataPoints": 3,
|
||||
"options": {
|
||||
"displayLabels": [],
|
||||
"legend": {
|
||||
"calcs": [],
|
||||
"displayMode": "table",
|
||||
"placement": "right",
|
||||
"values": [
|
||||
"value"
|
||||
]
|
||||
},
|
||||
"pieType": "pie",
|
||||
"reduceOptions": {
|
||||
"calcs": [
|
||||
"sum"
|
||||
],
|
||||
"fields": "",
|
||||
"values": false
|
||||
},
|
||||
"text": {}
|
||||
},
|
||||
"targets": [
|
||||
{
|
||||
"exemplar": true,
|
||||
"expr": "sum(rate(traefik_entrypoint_requests_total{entrypoint =~ \"$entrypoint\"}[5m])) by (entrypoint) ",
|
||||
"format": "time_series",
|
||||
"interval": "",
|
||||
"intervalFactor": 2,
|
||||
"legendFormat": "{{ entrypoint }}",
|
||||
"refId": "A"
|
||||
}
|
||||
],
|
||||
"title": "Requests by protocol",
|
||||
"type": "piechart"
|
||||
}
|
||||
],
|
||||
"schemaVersion": 27,
|
||||
"style": "dark",
|
||||
"tags": [
|
||||
"traefik",
|
||||
"prometheus"
|
||||
],
|
||||
"templating": {
|
||||
"list": [
|
||||
{
|
||||
"allValue": null,
|
||||
"current": {},
|
||||
"datasource": "${DS_PROMETHEUS}",
|
||||
"definition": "label_values(service)",
|
||||
"description": null,
|
||||
"error": null,
|
||||
"hide": 0,
|
||||
"includeAll": false,
|
||||
"label": null,
|
||||
"multi": false,
|
||||
"name": "service",
|
||||
"options": [],
|
||||
"query": {
|
||||
"query": "label_values(service)",
|
||||
"refId": "StandardVariableQuery"
|
||||
},
|
||||
"refresh": 1,
|
||||
"regex": "",
|
||||
"skipUrlSync": false,
|
||||
"sort": 0,
|
||||
"tagValuesQuery": "",
|
||||
"tags": [],
|
||||
"tagsQuery": "",
|
||||
"type": "query",
|
||||
"useTags": false
|
||||
},
|
||||
{
|
||||
"allValue": null,
|
||||
"current": {},
|
||||
"datasource": "${DS_PROMETHEUS}",
|
||||
"definition": "",
|
||||
"description": null,
|
||||
"error": null,
|
||||
"hide": 0,
|
||||
"includeAll": true,
|
||||
"label": null,
|
||||
"multi": true,
|
||||
"name": "entrypoint",
|
||||
"options": [],
|
||||
"query": {
|
||||
"query": "label_values(entrypoint)",
|
||||
"refId": "Prometheus-entrypoint-Variable-Query"
|
||||
},
|
||||
"refresh": 1,
|
||||
"regex": "",
|
||||
"skipUrlSync": false,
|
||||
"sort": 0,
|
||||
"tagValuesQuery": "",
|
||||
"tags": [],
|
||||
"tagsQuery": "",
|
||||
"type": "query",
|
||||
"useTags": false
|
||||
}
|
||||
]
|
||||
},
|
||||
"time": {
|
||||
"from": "now-1h",
|
||||
"to": "now"
|
||||
},
|
||||
"timepicker": {
|
||||
"refresh_intervals": [
|
||||
"5s",
|
||||
"10s",
|
||||
"30s",
|
||||
"1m",
|
||||
"5m",
|
||||
"15m",
|
||||
"30m",
|
||||
"1h",
|
||||
"2h",
|
||||
"1d"
|
||||
],
|
||||
"time_options": [
|
||||
"5m",
|
||||
"15m",
|
||||
"1h",
|
||||
"6h",
|
||||
"12h",
|
||||
"24h",
|
||||
"2d",
|
||||
"7d",
|
||||
"30d"
|
||||
]
|
||||
},
|
||||
"timezone": "",
|
||||
"title": "Traefik",
|
||||
"uid": "qPdAviJmz",
|
||||
"version": 10
|
||||
}
|
|
@ -1,97 +0,0 @@
|
|||
variable "lego_version" {
|
||||
default = "4.14.2"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "nomad_var_dirsync_version" {
|
||||
default = "0.0.2"
|
||||
type = string
|
||||
}
|
||||
|
||||
job "lego" {
|
||||
|
||||
type = "batch"
|
||||
|
||||
periodic {
|
||||
cron = "@weekly"
|
||||
prohibit_overlap = true
|
||||
}
|
||||
|
||||
group "main" {
|
||||
|
||||
network {
|
||||
dns {
|
||||
servers = ["1.1.1.1", "1.0.0.1"]
|
||||
}
|
||||
}
|
||||
|
||||
task "main" {
|
||||
driver = "exec"
|
||||
|
||||
config {
|
||||
# image = "alpine:3"
|
||||
command = "/bin/bash"
|
||||
args = ["${NOMAD_TASK_DIR}/start.sh"]
|
||||
}
|
||||
|
||||
artifact {
|
||||
source = "https://github.com/go-acme/lego/releases/download/v${var.lego_version}/lego_v${var.lego_version}_linux_${attr.cpu.arch}.tar.gz"
|
||||
}
|
||||
|
||||
artifact {
|
||||
source = "https://git.iamthefij.com/iamthefij/nomad-var-dirsync/releases/download/v${var.nomad_var_dirsync_version}/nomad-var-dirsync-linux-${attr.cpu.arch}.tar.gz"
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOH
|
||||
#! /bin/sh
|
||||
set -ex
|
||||
|
||||
cd ${NOMAD_TASK_DIR}
|
||||
|
||||
echo "Read certs from nomad vars"
|
||||
${NOMAD_TASK_DIR}/nomad-var-dirsync-linux-{{ env "attr.cpu.arch" }} -root-var=secrets/certs read .
|
||||
|
||||
action=run
|
||||
if [ -f /.lego/certificates/_.thefij.rocks.crt ]; then
|
||||
action=renew
|
||||
fi
|
||||
|
||||
echo "Attempt to $action certificates"
|
||||
${NOMAD_TASK_DIR}/lego \
|
||||
--accept-tos --pem \
|
||||
--email=iamthefij@gmail.com \
|
||||
--domains="*.thefij.rocks" \
|
||||
--dns="cloudflare" \
|
||||
$action \
|
||||
--$action-hook="${NOMAD_TASK_DIR}/nomad-var-dirsync-linux-{{ env "attr.cpu.arch" }} -root-var=secrets/certs write .lego" \
|
||||
EOH
|
||||
destination = "${NOMAD_TASK_DIR}/start.sh"
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOH
|
||||
{{ with nomadVar "nomad/jobs/lego" -}}
|
||||
CF_DNS_API_TOKEN={{ .domain_lego_dns }}
|
||||
CF_ZONE_API_TOKEN={{ .domain_lego_dns }}
|
||||
{{- end }}
|
||||
EOH
|
||||
destination = "secrets/cloudflare.env"
|
||||
env = true
|
||||
}
|
||||
|
||||
env = {
|
||||
NOMAD_ADDR = "unix:///secrets/api.sock"
|
||||
}
|
||||
|
||||
identity {
|
||||
env = true
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 50
|
||||
memory = 100
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
23
core/lego.tf
23
core/lego.tf
|
@ -1,23 +0,0 @@
|
|||
resource "nomad_job" "lego" {
|
||||
jobspec = file("${path.module}/lego.nomad")
|
||||
}
|
||||
|
||||
resource "nomad_acl_policy" "secrets_certs_write" {
|
||||
name = "secrets-certs-write"
|
||||
description = "Write certs to secrets store"
|
||||
rules_hcl = <<EOH
|
||||
namespace "default" {
|
||||
variables {
|
||||
path "secrets/certs/*" {
|
||||
capabilities = ["write", "read"]
|
||||
}
|
||||
path "secrets/certs" {
|
||||
capabilities = ["write", "read"]
|
||||
}
|
||||
}
|
||||
}
|
||||
EOH
|
||||
job_acl {
|
||||
job_id = "lego/*"
|
||||
}
|
||||
}
|
|
@ -3,27 +3,31 @@ auth_enabled: false
|
|||
server:
|
||||
http_listen_port: 3100
|
||||
|
||||
common:
|
||||
ring:
|
||||
instance_addr: 127.0.0.1
|
||||
kvstore:
|
||||
store: inmemory
|
||||
replication_factor: 1
|
||||
path_prefix: /tmp/loki
|
||||
ingester:
|
||||
lifecycler:
|
||||
address: 127.0.0.1
|
||||
ring:
|
||||
kvstore:
|
||||
store: inmemory
|
||||
replication_factor: 1
|
||||
final_sleep: 0s
|
||||
chunk_idle_period: 5m
|
||||
chunk_retain_period: 30s
|
||||
max_transfer_retries: 0
|
||||
|
||||
schema_config:
|
||||
configs:
|
||||
- from: 2020-05-15
|
||||
store: boltdb-shipper
|
||||
- from: 2018-04-15
|
||||
store: boltdb
|
||||
object_store: filesystem
|
||||
schema: v11
|
||||
index:
|
||||
prefix: index_
|
||||
period: 24h
|
||||
period: 168h
|
||||
|
||||
storage_config:
|
||||
boltdb_shipper:
|
||||
active_index_directory: {{ env "NOMAD_TASK_DIR" }}/index
|
||||
boltdb:
|
||||
directory: {{ env "NOMAD_TASK_DIR" }}/index
|
||||
|
||||
filesystem:
|
||||
directory: {{ env "NOMAD_TASK_DIR" }}/chunks
|
||||
|
@ -34,8 +38,8 @@ limits_config:
|
|||
reject_old_samples_max_age: 168h
|
||||
|
||||
chunk_store_config:
|
||||
max_look_back_period: 168h
|
||||
max_look_back_period: 0s
|
||||
|
||||
table_manager:
|
||||
retention_deletes_enabled: true
|
||||
retention_period: 168h
|
||||
retention_deletes_enabled: false
|
||||
retention_period: 0s
|
||||
|
|
|
@ -3,17 +3,15 @@ module "loki" {
|
|||
detach = false
|
||||
|
||||
name = "loki"
|
||||
image = "grafana/loki:2.8.7"
|
||||
image = "grafana/loki:2.2.1"
|
||||
args = ["--config.file=$${NOMAD_TASK_DIR}/loki-config.yml"]
|
||||
|
||||
service_port = 3100
|
||||
ingress = true
|
||||
use_wesher = var.use_wesher
|
||||
service_check = {
|
||||
path = "/ready"
|
||||
}
|
||||
|
||||
sticky_disk = true
|
||||
# healthcheck = "/ready"
|
||||
templates = [
|
||||
{
|
||||
data = file("${path.module}/loki-config.yml")
|
||||
|
|
|
@ -24,8 +24,7 @@ job "nomad-client-stalker" {
|
|||
|
||||
resources {
|
||||
cpu = 10
|
||||
memory = 15
|
||||
memory_max = 30
|
||||
memory = 10
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
@ -27,7 +27,9 @@ job "syslogng" {
|
|||
driver = "docker"
|
||||
|
||||
meta = {
|
||||
"diun.sort_tags" = "semver"
|
||||
"diun.watch_repo" = true
|
||||
"diun.include_tags" = "^[0-9]+\\.[0-9]+\\.[0-9]+$"
|
||||
}
|
||||
|
||||
config {
|
||||
|
|
|
@ -2,20 +2,20 @@
|
|||
# Manual edits may be lost in future updates.
|
||||
|
||||
provider "registry.terraform.io/hashicorp/nomad" {
|
||||
version = "2.1.0"
|
||||
version = "1.4.17"
|
||||
hashes = [
|
||||
"h1:ek0L7fA+4R1/BXhbutSRqlQPzSZ5aY/I2YfVehuYeEU=",
|
||||
"zh:39ba4d4fc9557d4d2c1e4bf866cf63973359b73e908cce237c54384512bdb454",
|
||||
"zh:40d2b66e3f3675e6b88000c145977c1d5288510c76b702c6c131d9168546c605",
|
||||
"zh:40fbe575d85a083f96d4703c6b7334e9fc3e08e4f1d441de2b9513215184ebcc",
|
||||
"zh:42ce6db79e2f94557fae516ee3f22e5271f0b556638eb45d5fbad02c99fc7af3",
|
||||
"zh:4acf63dfb92f879b3767529e75764fef68886521b7effa13dd0323c38133ce88",
|
||||
"zh:72cf35a13c2fb542cd3c8528826e2390db9b8f6f79ccb41532e009ad140a3269",
|
||||
"h1:iPylWr144mqXvM8NBVMTm+MS6JRhqIihlpJG91GYDyA=",
|
||||
"zh:146f97eacd9a0c78b357a6cfd2cb12765d4b18e9660a75500ee3e748c6eba41a",
|
||||
"zh:2eb89a6e5cee9aea03a96ea9f141096fe3baf219b2700ce30229d2d882f5015f",
|
||||
"zh:3d0f971f79b615c1014c75e2f99f34bd4b4da542ca9f31d5ea7fadc4e9de39c1",
|
||||
"zh:46099a750c752ce05aa14d663a86478a5ad66d95aff3d69367f1d3628aac7792",
|
||||
"zh:71e56006b013dcfe1e4e059b2b07148b44fcd79351ae2c357e0d97e27ae0d916",
|
||||
"zh:74febd25d776688f0558178c2f5a0e6818bbf4cdaa2e160d7049da04103940f0",
|
||||
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
|
||||
"zh:8b8bcc136c05916234cb0c3bcc3d48fda7ca551a091ad8461ea4ab16fb6960a3",
|
||||
"zh:8e1c2f924eae88afe7ac83775f000ae8fd71a04e06228edf7eddce4df2421169",
|
||||
"zh:abc6e725531fc06a8e02e84946aaabc3453ecafbc1b7a442ea175db14fd9c86a",
|
||||
"zh:b735fcd1fb20971df3e92f81bb6d73eef845dcc9d3d98e908faa3f40013f0f69",
|
||||
"zh:ce59797282505d872903789db8f092861036da6ec3e73f6507dac725458a5ec9",
|
||||
"zh:af18c064a5f0dd5422d6771939274841f635b619ab392c73d5bf9720945fdb85",
|
||||
"zh:c133d7a862079da9f06e301c530eacbd70e9288fa2276ec0704df907270ee328",
|
||||
"zh:c894cf98d239b9f5a4b7cde9f5c836face0b5b93099048ee817b0380ea439c65",
|
||||
"zh:c918642870f0cafdbe4d7dd07c909701fc3ddb47cac8357bdcde1327bf78c11d",
|
||||
"zh:f8f5655099a57b4b9c0018a2d49133771e24c7ff8262efb1ceb140fd224aa9b6",
|
||||
]
|
||||
}
|
||||
|
|
|
@ -20,7 +20,7 @@ job "traefik" {
|
|||
}
|
||||
|
||||
group "traefik" {
|
||||
count = 2
|
||||
count = 1
|
||||
|
||||
network {
|
||||
port "web" {
|
||||
|
@ -35,17 +35,14 @@ job "traefik" {
|
|||
static = 514
|
||||
}
|
||||
|
||||
port "gitssh" {
|
||||
static = 2222
|
||||
}
|
||||
|
||||
port "metrics" {}
|
||||
|
||||
dns {
|
||||
servers = [
|
||||
# TODO: Get these IP addresses from ansible? Or, do these need to be here?
|
||||
"192.168.2.101",
|
||||
"192.168.2.102",
|
||||
"192.168.2.30",
|
||||
# Fallback DNS IP should be static
|
||||
"192.168.2.170",
|
||||
]
|
||||
}
|
||||
}
|
||||
|
@ -55,42 +52,39 @@ job "traefik" {
|
|||
sticky = true
|
||||
}
|
||||
|
||||
service {
|
||||
name = "traefik"
|
||||
provider = "nomad"
|
||||
port = "web"
|
||||
|
||||
check {
|
||||
type = "http"
|
||||
path = "/ping"
|
||||
port = "web"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
}
|
||||
|
||||
tags = [
|
||||
"traefik.enable=true",
|
||||
"traefik.http.routers.traefik.entryPoints=websecure",
|
||||
"traefik.http.routers.traefik.service=api@internal",
|
||||
]
|
||||
}
|
||||
|
||||
task "traefik" {
|
||||
driver = "docker"
|
||||
|
||||
service {
|
||||
name = "traefik"
|
||||
provider = "nomad"
|
||||
port = "web"
|
||||
|
||||
check {
|
||||
type = "http"
|
||||
path = "/ping"
|
||||
interval = "10s"
|
||||
timeout = "2s"
|
||||
}
|
||||
|
||||
tags = [
|
||||
"traefik.enable=true",
|
||||
"traefik.http.routers.traefik.entryPoints=websecure",
|
||||
"traefik.http.routers.traefik.service=api@internal",
|
||||
]
|
||||
}
|
||||
|
||||
service {
|
||||
name = "traefik-metrics"
|
||||
provider = "nomad"
|
||||
port = "metrics"
|
||||
|
||||
tags = [
|
||||
"prometheus.scrape",
|
||||
]
|
||||
meta = {
|
||||
"diun.sort_tags" = "semver"
|
||||
"diun.watch_repo" = true
|
||||
"diun.include_tags" = "^[0-9]+\\.[0-9]+$"
|
||||
}
|
||||
|
||||
config {
|
||||
image = "traefik:2.10"
|
||||
image = "traefik:2.9"
|
||||
|
||||
ports = ["web", "websecure", "syslog", "gitssh", "metrics"]
|
||||
ports = ["web", "websecure"]
|
||||
network_mode = "host"
|
||||
|
||||
mount {
|
||||
|
@ -104,12 +98,6 @@ job "traefik" {
|
|||
target = "/etc/traefik/usersfile"
|
||||
source = "secrets/usersfile"
|
||||
}
|
||||
|
||||
mount {
|
||||
type = "bind"
|
||||
target = "/etc/traefik/certs"
|
||||
source = "secrets/certs"
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
|
@ -132,9 +120,12 @@ job "traefik" {
|
|||
[entryPoints.websecure]
|
||||
address = ":443"
|
||||
[entryPoints.websecure.http.tls]
|
||||
certResolver = "letsEncrypt"
|
||||
[[entryPoints.websecure.http.tls.domains]]
|
||||
main = "*.<< with nomadVar "nomad/jobs" >><< .base_hostname >><< end >>"
|
||||
|
||||
[entryPoints.metrics]
|
||||
address = ":<< env "NOMAD_PORT_metrics" >>"
|
||||
address = ":8989"
|
||||
|
||||
[entryPoints.syslogtcp]
|
||||
address = ":514"
|
||||
|
@ -142,9 +133,6 @@ job "traefik" {
|
|||
[entryPoints.syslogudp]
|
||||
address = ":514/udp"
|
||||
|
||||
[entryPoints.gitssh]
|
||||
address = ":2222"
|
||||
|
||||
[api]
|
||||
dashboard = true
|
||||
|
||||
|
@ -164,9 +152,31 @@ job "traefik" {
|
|||
exposedByDefault = false
|
||||
defaultRule = "Host(`{{normalize .Name}}.<< with nomadVar "nomad/jobs" >><< .base_hostname >><< end >>`)"
|
||||
[providers.nomad.endpoint]
|
||||
address = "http://127.0.0.1:4646"
|
||||
address = "http://<< env "attr.unique.network.ip-address" >>:4646"
|
||||
|
||||
<< if nomadVarExists "nomad/jobs/traefik" ->>
|
||||
[certificatesResolvers.letsEncrypt.acme]
|
||||
email = "<< with nomadVar "nomad/jobs/traefik" >><< .acme_email >><< end >>"
|
||||
# Store in /local because /secrets doesn't persist with ephemeral disk
|
||||
storage = "/local/acme.json"
|
||||
[certificatesResolvers.letsEncrypt.acme.dnsChallenge]
|
||||
provider = "cloudflare"
|
||||
resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
|
||||
delayBeforeCheck = 0
|
||||
<<- end >>
|
||||
EOH
|
||||
destination = "${NOMAD_TASK_DIR}/config/traefik.toml"
|
||||
destination = "local/config/traefik.toml"
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOH
|
||||
{{ with nomadVar "nomad/jobs/traefik" -}}
|
||||
CF_DNS_API_TOKEN={{ .domain_lego_dns }}
|
||||
CF_ZONE_API_TOKEN={{ .domain_lego_dns }}
|
||||
{{- end }}
|
||||
EOH
|
||||
destination = "secrets/cloudflare.env"
|
||||
env = true
|
||||
}
|
||||
|
||||
template {
|
||||
|
@ -177,39 +187,23 @@ job "traefik" {
|
|||
entryPoints = ["websecure"]
|
||||
service = "nomad"
|
||||
rule = "Host(`nomad.{{ with nomadVar "nomad/jobs" }}{{ .base_hostname }}{{ end }}`)"
|
||||
|
||||
{{ with nomadVar "nomad/jobs/traefik" }}{{ with .external }}{{ with .Value | parseYAML -}}
|
||||
{{ range $service, $url := . }}
|
||||
[http.routers.{{ $service }}]
|
||||
[http.routers.hass]
|
||||
entryPoints = ["websecure"]
|
||||
service = "{{ $service }}"
|
||||
rule = "Host(`{{ $service }}.{{ with nomadVar "nomad/jobs" }}{{ .base_hostname }}{{ end }}`)"
|
||||
{{ end }}
|
||||
{{- end }}{{ end }}{{ end }}
|
||||
service = "hass"
|
||||
rule = "Host(`hass.{{ with nomadVar "nomad/jobs" }}{{ .base_hostname }}{{ end }}`)"
|
||||
|
||||
[http.services]
|
||||
[http.services.nomad]
|
||||
[http.services.nomad.loadBalancer]
|
||||
[[http.services.nomad.loadBalancer.servers]]
|
||||
url = "http://127.0.0.1:4646"
|
||||
|
||||
{{ with nomadVar "nomad/jobs/traefik" }}{{ with .external }}{{ with .Value | parseYAML -}}
|
||||
{{ range $service, $url := . }}
|
||||
[http.services.{{ $service }}]
|
||||
[http.services.{{ $service }}.loadBalancer]
|
||||
[[http.services.{{ $service }}.loadBalancer.servers]]
|
||||
url = "{{ $url }}"
|
||||
{{ end }}
|
||||
{{- end }}{{ end }}{{ end }}
|
||||
[http.services.hass]
|
||||
[http.services.hass.loadBalancer]
|
||||
[[http.services.hass.loadBalancer.servers]]
|
||||
url = "http://192.168.3.65:8123"
|
||||
EOH
|
||||
destination = "${NOMAD_TASK_DIR}/config/conf/route-hashi.toml"
|
||||
destination = "local/config/conf/route-hashi.toml"
|
||||
change_mode = "noop"
|
||||
splay = "1m"
|
||||
|
||||
wait {
|
||||
min = "10s"
|
||||
max = "20s"
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
|
@ -245,39 +239,7 @@ job "traefik" {
|
|||
{{ end -}}
|
||||
{{- end }}
|
||||
EOH
|
||||
destination = "${NOMAD_TASK_DIR}/config/conf/route-syslog-ng.toml"
|
||||
change_mode = "noop"
|
||||
splay = "1m"
|
||||
|
||||
wait {
|
||||
min = "10s"
|
||||
max = "20s"
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
{{- with nomadVar "secrets/certs/_lego/certificates/__thefij_rocks_crt" }}{{ .contents }}{{ end -}}"
|
||||
EOF
|
||||
destination = "${NOMAD_SECRETS_DIR}/certs/_.thefij.rocks.crt"
|
||||
change_mode = "noop"
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
{{- with nomadVar "secrets/certs/_lego/certificates/__thefij_rocks_key" }}{{ .contents }}{{ end -}}"
|
||||
EOF
|
||||
destination = "${NOMAD_SECRETS_DIR}/certs/_.thefij.rocks.key"
|
||||
change_mode = "noop"
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOH
|
||||
[[tls.certificates]]
|
||||
certFile = "/etc/traefik/certs/_.thefij.rocks.crt"
|
||||
keyFile = "/etc/traefik/certs/_.thefij.rocks.key"
|
||||
EOH
|
||||
destination = "${NOMAD_TASK_DIR}/config/conf/dynamic-tls.toml"
|
||||
destination = "local/config/conf/route-syslog-ng.toml"
|
||||
change_mode = "noop"
|
||||
}
|
||||
|
||||
|
@ -287,11 +249,12 @@ EOF
|
|||
{{ with nomadVar "nomad/jobs/traefik" }}
|
||||
{{ if .usersfile }}
|
||||
[http.middlewares.basic-auth.basicAuth]
|
||||
# TODO: Reference secrets mount
|
||||
usersFile = "/etc/traefik/usersfile"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
EOH
|
||||
destination = "${NOMAD_TASK_DIR}/config/conf/middlewares.toml"
|
||||
destination = "local/config/conf/middlewares.toml"
|
||||
change_mode = "noop"
|
||||
}
|
||||
|
||||
|
@ -301,7 +264,7 @@ EOF
|
|||
{{ .usersfile }}
|
||||
{{- end }}
|
||||
EOH
|
||||
destination = "${NOMAD_SECRETS_DIR}/usersfile"
|
||||
destination = "secrets/usersfile"
|
||||
change_mode = "noop"
|
||||
}
|
||||
|
||||
|
|
|
@ -1,23 +1,3 @@
|
|||
resource "nomad_job" "traefik" {
|
||||
jobspec = file("${path.module}/traefik.nomad")
|
||||
}
|
||||
|
||||
resource "nomad_acl_policy" "treafik_secrets_certs_read" {
|
||||
name = "traefik-secrets-certs-read"
|
||||
description = "Read certs to secrets store"
|
||||
rules_hcl = <<EOH
|
||||
namespace "default" {
|
||||
variables {
|
||||
path "secrets/certs/*" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
path "secrets/certs" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
}
|
||||
}
|
||||
EOH
|
||||
job_acl {
|
||||
job_id = resource.nomad_job.traefik.id
|
||||
}
|
||||
}
|
||||
|
|
|
@ -70,12 +70,10 @@ job "lldap" {
|
|||
data = <<EOH
|
||||
ldap_base_dn = "{{ with nomadVar "nomad/jobs" }}{{ .ldap_base_dn }}{{ end }}"
|
||||
|
||||
{{ with nomadVar "secrets/ldap" -}}
|
||||
{{ with nomadVar "nomad/jobs/lldap" -}}
|
||||
ldap_user_dn = "{{ .admin_user }}"
|
||||
ldap_user_email = "{{ .admin_email }}"
|
||||
{{ end -}}
|
||||
|
||||
{{ with nomadVar "nomad/jobs/lldap" -}}
|
||||
[smtp_options]
|
||||
from = "{{ .smtp_from }}"
|
||||
reply_to = "{{ .smtp_reply_to }}"
|
||||
|
@ -111,7 +109,7 @@ user = "{{ .user }}"
|
|||
}
|
||||
|
||||
template {
|
||||
data = "{{ with nomadVar \"secrets/ldap\" }}{{ .admin_password }}{{ end }}"
|
||||
data = "{{ with nomadVar \"nomad/jobs/lldap\" }}{{ .admin_password }}{{ end }}"
|
||||
destination = "$${NOMAD_SECRETS_DIR}/user_pass.txt"
|
||||
change_mode = "restart"
|
||||
}
|
||||
|
@ -195,9 +193,9 @@ SELECT 'NOOP';
|
|||
}
|
||||
|
||||
config {
|
||||
image = "iamthefij/stunnel:latest"
|
||||
args = ["$${NOMAD_TASK_DIR}/stunnel.conf"]
|
||||
image = "alpine:3.17"
|
||||
ports = ["tls"]
|
||||
args = ["/bin/sh", "$${NOMAD_TASK_DIR}/start.sh"]
|
||||
}
|
||||
|
||||
resources {
|
||||
|
@ -205,6 +203,15 @@ SELECT 'NOOP';
|
|||
memory = 100
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
set -e
|
||||
apk add stunnel
|
||||
exec stunnel {{ env "NOMAD_TASK_DIR" }}/stunnel.conf
|
||||
EOF
|
||||
destination = "$${NOMAD_TASK_DIR}/start.sh"
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
syslog = no
|
||||
|
@ -215,7 +222,7 @@ delay = yes
|
|||
accept = {{ env "NOMAD_PORT_tls" }}
|
||||
connect = 127.0.0.1:{{ env "NOMAD_PORT_ldap" }}
|
||||
ciphers = PSK
|
||||
PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/stunnel_psk.txt
|
||||
PSKsecrets = {{ env "NOMAD_TASK_DIR" }}/stunnel_psk.txt
|
||||
|
||||
[mysql_client]
|
||||
client = yes
|
||||
|
@ -234,7 +241,7 @@ PSKsecrets = {{ env "NOMAD_SECRETS_DIR" }}/mysql_stunnel_psk.txt
|
|||
{{ with nomadVar .Path }}{{ .psk }}{{ end }}
|
||||
{{ end -}}
|
||||
EOF
|
||||
destination = "$${NOMAD_SECRETS_DIR}/stunnel_psk.txt"
|
||||
destination = "$${NOMAD_TASK_DIR}/stunnel_psk.txt"
|
||||
}
|
||||
|
||||
template {
|
||||
|
|
|
@ -9,42 +9,6 @@ resource "nomad_job" "lldap" {
|
|||
detach = false
|
||||
}
|
||||
|
||||
# Give access to ldap secrets
|
||||
resource "nomad_acl_policy" "lldap_ldap_secrets" {
|
||||
name = "lldap-secrets-ldap"
|
||||
description = "Give access to LDAP secrets"
|
||||
rules_hcl = <<EOH
|
||||
namespace "default" {
|
||||
variables {
|
||||
path "secrets/ldap/*" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
path "secrets/ldap" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
}
|
||||
}
|
||||
EOH
|
||||
|
||||
job_acl {
|
||||
# job_id = resource.nomad_job.lldap.id
|
||||
job_id = "lldap"
|
||||
}
|
||||
}
|
||||
|
||||
# Create self-scoped psk so that config is valid at first start
|
||||
resource "random_password" "lldap_ldap_psk" {
|
||||
length = 32
|
||||
override_special = "!@#%&*-_="
|
||||
}
|
||||
|
||||
resource "nomad_variable" "lldap_ldap_psk" {
|
||||
path = "secrets/ldap/allowed_psks/ldap"
|
||||
items = {
|
||||
psk = "lldap:${resource.random_password.lldap_ldap_psk.result}"
|
||||
}
|
||||
}
|
||||
|
||||
# Give access to smtp secrets
|
||||
resource "nomad_acl_policy" "lldap_smtp_secrets" {
|
||||
name = "lldap-secrets-smtp"
|
||||
|
@ -60,7 +24,6 @@ namespace "default" {
|
|||
EOH
|
||||
|
||||
job_acl {
|
||||
# job_id = resource.nomad_job.lldap.id
|
||||
job_id = "lldap"
|
||||
group = "lldap"
|
||||
task = "lldap"
|
||||
|
@ -82,7 +45,6 @@ namespace "default" {
|
|||
EOH
|
||||
|
||||
job_acl {
|
||||
# job_id = resource.nomad_job.lldap.id
|
||||
job_id = "lldap"
|
||||
group = "lldap"
|
||||
task = "bootstrap"
|
||||
|
@ -115,9 +77,27 @@ namespace "default" {
|
|||
EOH
|
||||
|
||||
job_acl {
|
||||
# job_id = resource.nomad_job.lldap.id
|
||||
job_id = "lldap"
|
||||
group = "lldap"
|
||||
task = "stunnel"
|
||||
}
|
||||
}
|
||||
|
||||
# Give access to all ldap secrets
|
||||
resource "nomad_acl_policy" "secrets_ldap" {
|
||||
name = "secrets-ldap"
|
||||
description = "Give access to Postgres secrets"
|
||||
rules_hcl = <<EOH
|
||||
namespace "default" {
|
||||
variables {
|
||||
path "secrets/ldap/*" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
}
|
||||
}
|
||||
EOH
|
||||
|
||||
job_acl {
|
||||
job_id = resource.nomad_job.lldap.id
|
||||
}
|
||||
}
|
||||
|
|
|
@ -0,0 +1,62 @@
|
|||
resource "nomad_job" "mysql-server" {
|
||||
jobspec = file("${path.module}/mysql.nomad")
|
||||
|
||||
# Block until deployed as there are servics dependent on this one
|
||||
detach = false
|
||||
}
|
||||
|
||||
resource "nomad_acl_policy" "secrets_mysql" {
|
||||
name = "secrets-mysql"
|
||||
description = "Give access to MySQL secrets"
|
||||
rules_hcl = <<EOH
|
||||
namespace "default" {
|
||||
variables {
|
||||
path "secrets/mysql/*" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
}
|
||||
}
|
||||
EOH
|
||||
|
||||
job_acl {
|
||||
job_id = resource.nomad_job.mysql-server.id
|
||||
}
|
||||
}
|
||||
|
||||
resource "nomad_job" "postgres-server" {
|
||||
jobspec = file("${path.module}/postgres.nomad")
|
||||
|
||||
# Block until deployed as there are servics dependent on this one
|
||||
detach = false
|
||||
}
|
||||
|
||||
resource "nomad_acl_policy" "secrets_postgres" {
|
||||
name = "secrets-postgres"
|
||||
description = "Give access to Postgres secrets"
|
||||
rules_hcl = <<EOH
|
||||
namespace "default" {
|
||||
variables {
|
||||
path "secrets/postgres/*" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
}
|
||||
}
|
||||
EOH
|
||||
|
||||
job_acl {
|
||||
job_id = resource.nomad_job.postgres-server.id
|
||||
}
|
||||
}
|
||||
|
||||
resource "nomad_job" "redis" {
|
||||
for_each = toset(["blocky", "authelia"])
|
||||
|
||||
jobspec = templatefile("${path.module}/redis.nomad",
|
||||
{
|
||||
name = each.key,
|
||||
}
|
||||
)
|
||||
|
||||
# Block until deployed as there are servics dependent on this one
|
||||
detach = false
|
||||
}
|
|
@ -81,9 +81,9 @@ MYSQL_ROOT_PASSWORD={{ .mysql_root_password }}
|
|||
driver = "docker"
|
||||
|
||||
config {
|
||||
image = "iamthefij/stunnel:latest"
|
||||
args = ["${NOMAD_TASK_DIR}/stunnel.conf"]
|
||||
image = "alpine:3.17"
|
||||
ports = ["tls"]
|
||||
args = ["/bin/sh", "${NOMAD_TASK_DIR}/start.sh"]
|
||||
}
|
||||
|
||||
resources {
|
||||
|
@ -91,6 +91,15 @@ MYSQL_ROOT_PASSWORD={{ .mysql_root_password }}
|
|||
memory = 100
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
set -e
|
||||
apk add stunnel
|
||||
exec stunnel ${NOMAD_TASK_DIR}/stunnel.conf
|
||||
EOF
|
||||
destination = "${NOMAD_TASK_DIR}/start.sh"
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
syslog = no
|
||||
|
|
|
@ -1,41 +0,0 @@
|
|||
resource "nomad_job" "mysql-server" {
|
||||
jobspec = file("${path.module}/mysql.nomad")
|
||||
|
||||
# Block until deployed as there are servics dependent on this one
|
||||
detach = false
|
||||
}
|
||||
|
||||
resource "nomad_acl_policy" "secrets_mysql" {
|
||||
name = "secrets-mysql"
|
||||
description = "Give access to MySQL secrets"
|
||||
rules_hcl = <<EOH
|
||||
namespace "default" {
|
||||
variables {
|
||||
path "secrets/mysql" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
path "secrets/mysql/*" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
}
|
||||
}
|
||||
EOH
|
||||
|
||||
job_acl {
|
||||
# job_id = resource.nomad_job.mysql-server.id
|
||||
job_id = "mysql-server"
|
||||
}
|
||||
}
|
||||
|
||||
# Create self-scoped psk so that config is valid at first start
|
||||
resource "random_password" "mysql_mysql_psk" {
|
||||
length = 32
|
||||
override_special = "!@#%&*-_="
|
||||
}
|
||||
|
||||
resource "nomad_variable" "mysql_mysql_psk" {
|
||||
path = "secrets/mysql/allowed_psks/mysql"
|
||||
items = {
|
||||
psk = "mysql:${resource.random_password.mysql_mysql_psk.result}"
|
||||
}
|
||||
}
|
|
@ -73,8 +73,7 @@ POSTGRES_PASSWORD={{ .superuser_pass }}
|
|||
|
||||
resources {
|
||||
cpu = 500
|
||||
memory = 700
|
||||
memory_max = 1200
|
||||
memory = 500
|
||||
}
|
||||
}
|
||||
|
||||
|
@ -82,9 +81,9 @@ POSTGRES_PASSWORD={{ .superuser_pass }}
|
|||
driver = "docker"
|
||||
|
||||
config {
|
||||
image = "iamthefij/stunnel:latest"
|
||||
args = ["${NOMAD_TASK_DIR}/stunnel.conf"]
|
||||
image = "alpine:3.17"
|
||||
ports = ["tls"]
|
||||
args = ["/bin/sh", "${NOMAD_TASK_DIR}/start.sh"]
|
||||
}
|
||||
|
||||
resources {
|
||||
|
@ -92,6 +91,15 @@ POSTGRES_PASSWORD={{ .superuser_pass }}
|
|||
memory = 100
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
set -e
|
||||
apk add stunnel
|
||||
exec stunnel ${NOMAD_TASK_DIR}/stunnel.conf
|
||||
EOF
|
||||
destination = "${NOMAD_TASK_DIR}/start.sh"
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
syslog = no
|
||||
|
|
|
@ -1,41 +0,0 @@
|
|||
resource "nomad_job" "postgres-server" {
|
||||
jobspec = file("${path.module}/postgres.nomad")
|
||||
|
||||
# Block until deployed as there are servics dependent on this one
|
||||
detach = false
|
||||
}
|
||||
|
||||
resource "nomad_acl_policy" "secrets_postgres" {
|
||||
name = "secrets-postgres"
|
||||
description = "Give access to Postgres secrets"
|
||||
rules_hcl = <<EOH
|
||||
namespace "default" {
|
||||
variables {
|
||||
path "secrets/postgres" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
path "secrets/postgres/*" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
}
|
||||
}
|
||||
EOH
|
||||
|
||||
job_acl {
|
||||
# job_id = resource.nomad_job.postgres-server.id
|
||||
job_id = "postgres-server"
|
||||
}
|
||||
}
|
||||
|
||||
# Create self-scoped psk so that config is valid at first start
|
||||
resource "random_password" "postgres_postgres_psk" {
|
||||
length = 32
|
||||
override_special = "!@#%&*-_="
|
||||
}
|
||||
|
||||
resource "nomad_variable" "postgres_postgres_psk" {
|
||||
path = "secrets/postgres/allowed_psks/postgres"
|
||||
items = {
|
||||
psk = "postgres:${resource.random_password.postgres_postgres_psk.result}"
|
||||
}
|
||||
}
|
|
@ -35,7 +35,7 @@ job "redis-${name}" {
|
|||
|
||||
resources {
|
||||
cpu = 100
|
||||
memory = 64
|
||||
memory = 128
|
||||
memory_max = 512
|
||||
}
|
||||
}
|
||||
|
@ -44,14 +44,23 @@ job "redis-${name}" {
|
|||
driver = "docker"
|
||||
|
||||
config {
|
||||
image = "iamthefij/stunnel:latest"
|
||||
args = ["$${NOMAD_TASK_DIR}/stunnel.conf"]
|
||||
image = "alpine:3.17"
|
||||
ports = ["tls"]
|
||||
args = ["/bin/sh", "$${NOMAD_TASK_DIR}/start.sh"]
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 50
|
||||
memory = 15
|
||||
cpu = 100
|
||||
memory = 100
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
set -e
|
||||
apk add stunnel
|
||||
exec stunnel $${NOMAD_TASK_DIR}/stunnel.conf
|
||||
EOF
|
||||
destination = "$${NOMAD_TASK_DIR}/start.sh"
|
||||
}
|
||||
|
||||
template {
|
||||
|
|
|
@ -1,12 +0,0 @@
|
|||
resource "nomad_job" "redis" {
|
||||
for_each = toset(["blocky", "authelia"])
|
||||
|
||||
jobspec = templatefile("${path.module}/redis.nomad",
|
||||
{
|
||||
name = each.key,
|
||||
}
|
||||
)
|
||||
|
||||
# Block until deployed as there are servics dependent on this one
|
||||
detach = false
|
||||
}
|
|
@ -2,39 +2,39 @@
|
|||
# Manual edits may be lost in future updates.
|
||||
|
||||
provider "registry.terraform.io/hashicorp/nomad" {
|
||||
version = "2.1.1"
|
||||
version = "2.0.0"
|
||||
hashes = [
|
||||
"h1:liQBgBXfQEYmwpoGZUfSsu0U0t/nhvuRZbMhaMz7wcQ=",
|
||||
"zh:28bc6922e8a21334568410760150d9d413d7b190d60b5f0b4aab2f4ef52efeeb",
|
||||
"zh:2d4283740e92ce1403875486cd5ff2c8acf9df28c190873ab4d769ce37db10c1",
|
||||
"zh:457e16d70075eae714a7df249d3ba42c2176f19b6750650152c56f33959028d9",
|
||||
"zh:49ee88371e355c00971eefee6b5001392431b47b3e760a5c649dda76f59fb8fa",
|
||||
"zh:614ad3bf07155ed8a5ced41dafb09042afbd1868490a379654b3e970def8e33d",
|
||||
"zh:75be7199d76987e7549e1f27439922973d1bf27353b44a593bfbbc2e3b9f698f",
|
||||
"h1:lIHIxA6ZmfyTGL3J9YIddhxlfit4ipSS09BLxkwo6L0=",
|
||||
"zh:09b897d64db293f9a904a4a0849b11ec1e3fff5c638f734d82ae36d8dc044b72",
|
||||
"zh:435cc106799290f64078ec24b6c59cb32b33784d609088638ed32c6d12121199",
|
||||
"zh:7073444bd064e8c4ec115ca7d9d7f030cc56795c0a83c27f6668bba519e6849a",
|
||||
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
|
||||
"zh:888e14a24410d56b37212fbea373a3e0401d0ff8f8e4f4dd00ba8b29de9fed39",
|
||||
"zh:aa261925e8b152636a0886b3a2149864707632d836e98a88dacea6cfb6302082",
|
||||
"zh:ac10cefb4064b3bb63d4b0379624a416a45acf778eac0004466f726ead686196",
|
||||
"zh:b1a3c8b4d5b2dc9b510eac5e9e02665582862c24eb819ab74f44d3d880246d4f",
|
||||
"zh:c552e2fe5670b6d3ad9a5faf78e3a27197eeedbe2b13928d2c491fa509bc47c7",
|
||||
"zh:79d238c35d650d2d83a439716182da63f3b2767e72e4cbd0b69cb13d9b1aebfc",
|
||||
"zh:7ef5f49344278fe0bbc5447424e6aa5425ff1821d010d944a444d7fa2c751acf",
|
||||
"zh:92179091638c8ba03feef371c4361a790190f9955caea1fa59de2055c701a251",
|
||||
"zh:a8a34398851761368eb8e7c171f24e55efa6e9fdbb5c455f6dec34dc17f631bc",
|
||||
"zh:b38fd5338625ebace5a4a94cea1a28b11bd91995d834e318f47587cfaf6ec599",
|
||||
"zh:b71b273a2aca7ad5f1e07c767b25b5a888881ba9ca93b30044ccc39c2937f03c",
|
||||
"zh:cd14357e520e0f09fb25badfb4f2ee37d7741afdc3ed47c7bcf54c1683772543",
|
||||
"zh:e05e025f4bb95138c3c8a75c636e97cd7cfd2fc1525b0c8bd097db8c5f02df6e",
|
||||
]
|
||||
}
|
||||
|
||||
provider "registry.terraform.io/hashicorp/random" {
|
||||
version = "3.6.0"
|
||||
version = "3.5.1"
|
||||
hashes = [
|
||||
"h1:R5Ucn26riKIEijcsiOMBR3uOAjuOMfI1x7XvH4P6B1w=",
|
||||
"zh:03360ed3ecd31e8c5dac9c95fe0858be50f3e9a0d0c654b5e504109c2159287d",
|
||||
"zh:1c67ac51254ba2a2bb53a25e8ae7e4d076103483f55f39b426ec55e47d1fe211",
|
||||
"zh:24a17bba7f6d679538ff51b3a2f378cedadede97af8a1db7dad4fd8d6d50f829",
|
||||
"zh:30ffb297ffd1633175d6545d37c2217e2cef9545a6e03946e514c59c0859b77d",
|
||||
"zh:454ce4b3dbc73e6775f2f6605d45cee6e16c3872a2e66a2c97993d6e5cbd7055",
|
||||
"h1:VSnd9ZIPyfKHOObuQCaKfnjIHRtR7qTw19Rz8tJxm+k=",
|
||||
"zh:04e3fbd610cb52c1017d282531364b9c53ef72b6bc533acb2a90671957324a64",
|
||||
"zh:119197103301ebaf7efb91df8f0b6e0dd31e6ff943d231af35ee1831c599188d",
|
||||
"zh:4d2b219d09abf3b1bb4df93d399ed156cadd61f44ad3baf5cf2954df2fba0831",
|
||||
"zh:6130bdde527587bbe2dcaa7150363e96dbc5250ea20154176d82bc69df5d4ce3",
|
||||
"zh:6cc326cd4000f724d3086ee05587e7710f032f94fc9af35e96a386a1c6f2214f",
|
||||
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
|
||||
"zh:91df0a9fab329aff2ff4cf26797592eb7a3a90b4a0c04d64ce186654e0cc6e17",
|
||||
"zh:aa57384b85622a9f7bfb5d4512ca88e61f22a9cea9f30febaa4c98c68ff0dc21",
|
||||
"zh:c4a3e329ba786ffb6f2b694e1fd41d413a7010f3a53c20b432325a94fa71e839",
|
||||
"zh:e2699bc9116447f96c53d55f2a00570f982e6f9935038c3810603572693712d0",
|
||||
"zh:e747c0fd5d7684e5bfad8aa0ca441903f15ae7a98a737ff6aca24ba223207e2c",
|
||||
"zh:f1ca75f417ce490368f047b63ec09fd003711ae48487fba90b4aba2ccf71920e",
|
||||
"zh:b6d88e1d28cf2dfa24e9fdcc3efc77adcdc1c3c3b5c7ce503a423efbdd6de57b",
|
||||
"zh:ba74c592622ecbcef9dc2a4d81ed321c4e44cddf7da799faa324da9bf52a22b2",
|
||||
"zh:c7c5cde98fe4ef1143bd1b3ec5dc04baf0d4cc3ca2c5c7d40d17c0e9b2076865",
|
||||
"zh:dac4bad52c940cd0dfc27893507c1e92393846b024c5a9db159a93c534a3da03",
|
||||
"zh:de8febe2a2acd9ac454b844a4106ed295ae9520ef54dc8ed2faf29f12716b602",
|
||||
"zh:eab0d0495e7e711cca367f7d4df6e322e6c562fc52151ec931176115b83ed014",
|
||||
]
|
||||
}
|
||||
|
|
|
@ -0,0 +1,58 @@
|
|||
module "bazarr" {
|
||||
source = "./service"
|
||||
|
||||
name = "bazarr"
|
||||
image = "lscr.io/linuxserver/bazarr:1.2.4"
|
||||
|
||||
resources = {
|
||||
cpu = 150
|
||||
memory = 400
|
||||
}
|
||||
|
||||
ingress = true
|
||||
service_port = 6767
|
||||
use_wesher = var.use_wesher
|
||||
|
||||
use_postgres = true
|
||||
postgres_bootstrap = {
|
||||
enabled = true
|
||||
}
|
||||
|
||||
env = {
|
||||
PGID = 100
|
||||
PUID = 1001
|
||||
TZ = "America/Los_Angeles"
|
||||
}
|
||||
|
||||
host_volumes = [
|
||||
{
|
||||
name = "bazarr-config"
|
||||
dest = "/config"
|
||||
read_only = false
|
||||
},
|
||||
{
|
||||
name = "media-write"
|
||||
dest = "/media"
|
||||
read_only = false
|
||||
},
|
||||
]
|
||||
|
||||
templates = [
|
||||
{
|
||||
data = <<EOF
|
||||
{{ with nomadVar "nomad/jobs/bazarr" -}}
|
||||
POSTGRES_ENABLED=True
|
||||
POSTGRES_HOST=127.0.0.1
|
||||
POSTGRES_PORT=5432
|
||||
POSTGRES_DATABASE={{ .db_name }}
|
||||
POSTGRES_USERNAME={{ .db_user }}
|
||||
POSTGRES_PASSWORD={{ .db_pass }}
|
||||
{{- end }}
|
||||
EOF
|
||||
dest_prefix = "$${NOMAD_SECRETS_DIR}/"
|
||||
dest = "env"
|
||||
env = true
|
||||
mount = false
|
||||
},
|
||||
]
|
||||
}
|
|
@ -2,7 +2,7 @@ module "diun" {
|
|||
source = "./service"
|
||||
|
||||
name = "diun"
|
||||
image = "crazymax/diun:4.27"
|
||||
image = "crazymax/diun:4.26"
|
||||
args = ["serve", "--log-level=debug"]
|
||||
|
||||
sticky_disk = true
|
||||
|
@ -16,13 +16,10 @@ module "diun" {
|
|||
DIUN_DEFAULTS_INCLUDETAGS = "^\\d+(\\.\\d+){0,2}$"
|
||||
|
||||
# Nomad API
|
||||
NOMAD_ADDR = "unix:///secrets/api.sock"
|
||||
DIUN_PROVIDERS_NOMAD = true
|
||||
DIUN_PROVIDERS_NOMAD_SECRETID = "$${NOMAD_TOKEN}"
|
||||
}
|
||||
|
||||
task_identity = {
|
||||
env = true
|
||||
# TODO: Use socket in $NOMAD_SECRETS_DIR/api.sock when we can assign workload ACLs with Terraform to
|
||||
# allow read access. Will need to update template to allow passing token by env
|
||||
NOMAD_ADDR = "http://$${attr.unique.network.ip-address}:4646/"
|
||||
DIUN_PROVIDERS_NOMAD = true
|
||||
}
|
||||
|
||||
templates = [
|
||||
|
@ -39,16 +36,3 @@ module "diun" {
|
|||
},
|
||||
]
|
||||
}
|
||||
|
||||
resource "nomad_acl_policy" "diun_query_jobs" {
|
||||
name = "diun-query-jobs"
|
||||
description = "Allow diun to query jobs"
|
||||
rules_hcl = <<EOH
|
||||
namespace "default" {
|
||||
capabilities = ["list-jobs", "read-job"]
|
||||
}
|
||||
EOH
|
||||
job_acl {
|
||||
job_id = module.diun.job_id
|
||||
}
|
||||
}
|
||||
|
|
|
@ -1,116 +0,0 @@
|
|||
module "gitea" {
|
||||
source = "./service"
|
||||
|
||||
name = "git"
|
||||
image = "gitea/gitea:1.21"
|
||||
|
||||
resources = {
|
||||
cpu = 200
|
||||
memory = 512
|
||||
}
|
||||
|
||||
env = {
|
||||
# Custom files should be part of the task
|
||||
GITEA_WORK_DIR = "$${NOMAD_TASK_DIR}"
|
||||
GITEA_CUSTOM = "$${NOMAD_TASK_DIR}/custom"
|
||||
}
|
||||
|
||||
ingress = true
|
||||
service_port = 3000
|
||||
use_wesher = var.use_wesher
|
||||
ports = [
|
||||
{
|
||||
name = "ssh"
|
||||
to = 22
|
||||
}
|
||||
]
|
||||
service_check = {
|
||||
path = "/api/healthz"
|
||||
}
|
||||
|
||||
custom_services = [
|
||||
{
|
||||
name = "git-ssh"
|
||||
port = "ssh"
|
||||
tags = [
|
||||
"traefik.enable=true",
|
||||
"traefik.tcp.routers.git-ssh.entryPoints=gitssh",
|
||||
"traefik.tcp.routers.git-ssh.rule=HostSNI(`*`)",
|
||||
"traefik.tcp.routers.git-ssh.tls=false",
|
||||
]
|
||||
},
|
||||
]
|
||||
|
||||
use_smtp = true
|
||||
mysql_bootstrap = {
|
||||
enabled = true
|
||||
}
|
||||
|
||||
host_volumes = [
|
||||
{
|
||||
name = "gitea-data"
|
||||
dest = "/data"
|
||||
read_only = false
|
||||
},
|
||||
]
|
||||
|
||||
# TODO: Bootstrap OIDC with
|
||||
# su -- git gitea admin auth add-oauth --name authelia --provider openidConnect --key gitea --secret "{{ .oidc_secret }}" --auto-discover-url https://authelia.thefij.rocks/.well-known/openid-configuration --skip-local-2fa
|
||||
|
||||
templates = [
|
||||
{
|
||||
data = <<EOF
|
||||
{{ with nomadVar "nomad/jobs/git" }}
|
||||
GITEA__server__DOMAIN=git.thefij.rocks
|
||||
GITEA__server__SSH_PORT=2222
|
||||
GITEA__server__ROOT_URL=https://git.thefij.rocks
|
||||
|
||||
GITEA__security__INSTALL_LOCK=true
|
||||
|
||||
GITEA__database__DB_TYPE=mysql
|
||||
GITEA__database__HOST=127.0.0.1:3306
|
||||
GITEA__database__NAME={{ .db_name }}
|
||||
GITEA__database__USER={{ .db_user }}
|
||||
|
||||
GITEA__service__DISABLE_REGISTRATION=false
|
||||
GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION=true
|
||||
GITEA__service__SHOW_REGISTRATION_BUTTON=false
|
||||
|
||||
GITEA__openid__ENABLE_OPENID_SIGNIN=true
|
||||
GITEA__openid__ENABLE_OPENID_SIGNUP=true
|
||||
GITEA__openid__WHITELISTED_URIS=authelia.thefij.rocks
|
||||
|
||||
GITEA__log__ROOT_PATH={{ env "NOMAD_TASK_DIR" }}/log
|
||||
|
||||
GITEA__mailer__ENABLED=true
|
||||
GITEA__mailer__FROM={{ .smtp_sender }}
|
||||
|
||||
GITEA__session__provider=db
|
||||
{{ end }}
|
||||
EOF
|
||||
env = true
|
||||
mount = false
|
||||
dest = "env"
|
||||
},
|
||||
# TODO: Gitea writes these out to the ini file in /local anyway
|
||||
# Find some way to get it to write to /secrets
|
||||
{
|
||||
data = <<EOF
|
||||
{{ with nomadVar "nomad/jobs/git" }}
|
||||
GITEA__security__SECRET_KEY="{{ .secret_key }}"
|
||||
GITEA__database__PASSWD={{ .db_pass }}
|
||||
{{ end }}
|
||||
{{ with nomadVar "secrets/smtp" }}
|
||||
GITEA__mailer__SMTP_ADDR={{ .server }}
|
||||
GITEA__mailer__SMTP_PORT={{ .port }}
|
||||
GITEA__mailer__USER={{ .user }}
|
||||
GITEA__mailer__PASSWD={{ .password }}
|
||||
{{ end }}
|
||||
EOF
|
||||
env = true
|
||||
mount = false
|
||||
dest = "env"
|
||||
dest_prefix = "$${NOMAD_SECRETS_DIR}"
|
||||
}
|
||||
]
|
||||
}
|
|
@ -1,25 +0,0 @@
|
|||
module "languagetool" {
|
||||
source = "./service"
|
||||
|
||||
name = "languagetool"
|
||||
image = "ghcr.io/erikvl87/docker-languagetool/languagetool:4.8"
|
||||
ingress = true
|
||||
service_port = 8010
|
||||
use_wesher = var.use_wesher
|
||||
|
||||
env = {
|
||||
Java_Xmx = "512m"
|
||||
}
|
||||
|
||||
service_check = {
|
||||
path = "/v2/healthcheck"
|
||||
}
|
||||
|
||||
# Possibility to use a volume over nfs to host n-gram datasets
|
||||
# https://github.com/Erikvl87/docker-languagetool/pkgs/container/docker-languagetool%2Flanguagetool#using-n-gram-datasets
|
||||
|
||||
resources = {
|
||||
cpu = 100
|
||||
memory = 512
|
||||
}
|
||||
}
|
|
@ -40,4 +40,9 @@ module "lidarr" {
|
|||
cpu = 500
|
||||
memory = 1500
|
||||
}
|
||||
|
||||
stunnel_resources = {
|
||||
cpu = 100
|
||||
memory = 100
|
||||
}
|
||||
}
|
||||
|
|
|
@ -21,6 +21,15 @@ monitors:
|
|||
- '/app/scripts/curl_ok.sh'
|
||||
- 'https://grafana.thefij.rocks'
|
||||
|
||||
- name: Plex
|
||||
command:
|
||||
- 'curl'
|
||||
- '--silent'
|
||||
- '--show-error'
|
||||
- '-o'
|
||||
- '/dev/null'
|
||||
- 'http://192.168.2.10:32400'
|
||||
|
||||
- name: NZBget
|
||||
command:
|
||||
- '/app/scripts/curl_ok.sh'
|
||||
|
@ -36,11 +45,6 @@ monitors:
|
|||
- '/app/scripts/curl_ok.sh'
|
||||
- 'https://lidarr.thefij.rocks'
|
||||
|
||||
- name: Radarr
|
||||
command:
|
||||
- '/app/scripts/curl_ok.sh'
|
||||
- 'https://radarr.thefij.rocks'
|
||||
|
||||
- name: Authelia
|
||||
command:
|
||||
- '/app/scripts/curl_ok.sh'
|
||||
|
@ -51,20 +55,6 @@ monitors:
|
|||
- '/app/scripts/curl_ok.sh'
|
||||
- 'https://photoprism.thefij.rocks'
|
||||
|
||||
- name: Prometheus
|
||||
command:
|
||||
- '/app/scripts/curl_ok.sh'
|
||||
- 'https://prometheus.thefij.rocks'
|
||||
|
||||
- name: Plex
|
||||
command:
|
||||
- 'curl'
|
||||
- '--silent'
|
||||
- '--show-error'
|
||||
- '-o'
|
||||
- '/dev/null'
|
||||
- 'http://192.168.2.10:32400'
|
||||
|
||||
alerts:
|
||||
log:
|
||||
command:
|
||||
|
|
|
@ -1,13 +1,12 @@
|
|||
module "minitor" {
|
||||
source = "./service"
|
||||
|
||||
name = "minitor"
|
||||
image = "iamthefij/minitor-go:1.4.1"
|
||||
args = ["-metrics", "-config=$${NOMAD_TASK_DIR}/config.yml"]
|
||||
service_port = 8080
|
||||
service_check = null
|
||||
use_wesher = var.use_wesher
|
||||
prometheus = true
|
||||
name = "minitor"
|
||||
image = "iamthefij/minitor-go:1.4.1"
|
||||
args = ["-metrics", "-config=$${NOMAD_TASK_DIR}/config.yml"]
|
||||
service_port = 8080
|
||||
use_wesher = var.use_wesher
|
||||
prometheus = true
|
||||
|
||||
env = {
|
||||
TZ = "America/Los_Angeles",
|
||||
|
|
|
@ -7,12 +7,13 @@ job "fixers" {
|
|||
prohibit_overlap = true
|
||||
}
|
||||
|
||||
group "orphaned_services" {
|
||||
group "main" {
|
||||
|
||||
task "orphaned_services" {
|
||||
driver = "docker"
|
||||
|
||||
config {
|
||||
image = "iamthefij/nomad-service-fixers:0.1.1"
|
||||
image = "iamthefij/nomad-service-fixers:0.1.0"
|
||||
command = "/scripts/nomad_orphan_services.py"
|
||||
args = ["--delete"]
|
||||
}
|
||||
|
@ -24,15 +25,8 @@ job "fixers" {
|
|||
identity {
|
||||
env = true
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 50
|
||||
memory = 100
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
group "missing_services" {
|
||||
task "missing_services" {
|
||||
driver = "docker"
|
||||
|
||||
|
@ -49,11 +43,6 @@ job "fixers" {
|
|||
identity {
|
||||
env = true
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 50
|
||||
memory = 100
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
@ -2,24 +2,27 @@ module "photoprism_module" {
|
|||
source = "./service"
|
||||
|
||||
name = "photoprism"
|
||||
image = "photoprism/photoprism:231128"
|
||||
image = "photoprism/photoprism:221118-jammy"
|
||||
image_pull_timeout = "10m"
|
||||
# constraints = [{
|
||||
# attribute = "$${meta.hw_transcode.type}"
|
||||
# # operator = "is_set"
|
||||
# value = "raspberry"
|
||||
# }]
|
||||
priority = 60
|
||||
constraints = [{
|
||||
attribute = "$${meta.hw_transcode.type}"
|
||||
# operator = "is_set"
|
||||
value = "raspberry"
|
||||
}]
|
||||
|
||||
# docker_devices = [{
|
||||
# host_path = "$${meta.hw_transcode.device}"
|
||||
# container_path = "$${meta.hw_transcode.device}"
|
||||
# }]
|
||||
docker_devices = [{
|
||||
host_path = "$${meta.hw_transcode.device}"
|
||||
container_path = "$${meta.hw_transcode.device}"
|
||||
}]
|
||||
resources = {
|
||||
cpu = 1500
|
||||
memory = 2200
|
||||
cpu = 2000
|
||||
memory = 2500
|
||||
memory_max = 4000
|
||||
}
|
||||
stunnel_resources = {
|
||||
cpu = 100
|
||||
memory = 100
|
||||
}
|
||||
sticky_disk = true
|
||||
host_volumes = [
|
||||
{
|
||||
|
|
|
@ -1,59 +0,0 @@
|
|||
module "radarr" {
|
||||
source = "./service"
|
||||
|
||||
name = "radarr"
|
||||
image = "lscr.io/linuxserver/radarr:5.2.6"
|
||||
|
||||
ingress = true
|
||||
service_port = 7878
|
||||
use_wesher = var.use_wesher
|
||||
ingress_middlewares = [
|
||||
"authelia@nomad"
|
||||
]
|
||||
|
||||
use_postgres = true
|
||||
postgres_bootstrap = {
|
||||
enabled = true
|
||||
databases = [
|
||||
"radarr",
|
||||
"radarr-logs",
|
||||
]
|
||||
}
|
||||
|
||||
env = {
|
||||
PGID = 100
|
||||
PUID = 1001
|
||||
TZ = "America/Los_Angeles"
|
||||
}
|
||||
|
||||
host_volumes = [
|
||||
{
|
||||
name = "radarr-config"
|
||||
dest = "/config"
|
||||
read_only = false
|
||||
},
|
||||
{
|
||||
name = "media-write"
|
||||
dest = "/media"
|
||||
read_only = false
|
||||
},
|
||||
]
|
||||
|
||||
resources = {
|
||||
cpu = 500
|
||||
memory = 500
|
||||
memory_max = 700
|
||||
}
|
||||
}
|
||||
|
||||
resource "nomad_variable" "authelia_service_rules_radarr" {
|
||||
path = "authelia/access_control/service_rules/radarr"
|
||||
items = {
|
||||
name = "radarr"
|
||||
rule = <<EOH
|
||||
policy: bypass
|
||||
resources:
|
||||
- '^/api([/?].*)?$'
|
||||
EOH
|
||||
}
|
||||
}
|
|
@ -8,7 +8,6 @@ resource "nomad_job" "service" {
|
|||
args = var.args
|
||||
env = var.env
|
||||
task_meta = var.task_meta
|
||||
task_identity = var.task_identity
|
||||
group_meta = var.group_meta
|
||||
job_meta = var.job_meta
|
||||
constraints = var.constraints
|
||||
|
@ -16,7 +15,6 @@ resource "nomad_job" "service" {
|
|||
|
||||
service_port = var.service_port
|
||||
service_port_static = var.service_port_static
|
||||
service_check = var.service_check
|
||||
ports = var.ports
|
||||
sticky_disk = var.sticky_disk
|
||||
resources = var.resources
|
||||
|
@ -61,7 +59,7 @@ namespace "default" {
|
|||
EOH
|
||||
|
||||
job_acl {
|
||||
job_id = resource.nomad_job.service.id
|
||||
job_id = var.name
|
||||
group = var.name
|
||||
task = "mysql-bootstrap"
|
||||
}
|
||||
|
@ -99,7 +97,7 @@ namespace "default" {
|
|||
EOH
|
||||
|
||||
job_acl {
|
||||
job_id = resource.nomad_job.service.id
|
||||
job_id = var.name
|
||||
group = var.name
|
||||
task = "stunnel"
|
||||
}
|
||||
|
@ -121,7 +119,7 @@ namespace "default" {
|
|||
EOH
|
||||
|
||||
job_acl {
|
||||
job_id = resource.nomad_job.service.id
|
||||
job_id = var.name
|
||||
group = var.name
|
||||
task = "postgres-bootstrap"
|
||||
}
|
||||
|
@ -159,7 +157,7 @@ namespace "default" {
|
|||
EOH
|
||||
|
||||
job_acl {
|
||||
job_id = resource.nomad_job.service.id
|
||||
job_id = var.name
|
||||
group = var.name
|
||||
task = "stunnel"
|
||||
}
|
||||
|
@ -197,7 +195,7 @@ namespace "default" {
|
|||
EOH
|
||||
|
||||
job_acl {
|
||||
job_id = resource.nomad_job.service.id
|
||||
job_id = var.name
|
||||
group = var.name
|
||||
task = "stunnel"
|
||||
}
|
||||
|
@ -219,7 +217,7 @@ namespace "default" {
|
|||
EOH
|
||||
|
||||
job_acl {
|
||||
job_id = resource.nomad_job.service.id
|
||||
job_id = var.name
|
||||
group = var.name
|
||||
task = var.name
|
||||
}
|
||||
|
|
|
@ -1,3 +0,0 @@
|
|||
output "job_id" {
|
||||
value = resource.nomad_job.service.id
|
||||
}
|
|
@ -31,18 +31,10 @@ job "${name}" {
|
|||
%{~ endif ~}
|
||||
%{~ for port in ports }
|
||||
port "${port.name}" {
|
||||
%{~ if port.host_network != null ~}
|
||||
host_network = "${port.host_network}"
|
||||
%{~ endif ~}
|
||||
%{~ if port.from != null ~}
|
||||
from = ${port.from}
|
||||
%{~ endif ~}
|
||||
%{~ if port.to != null ~}
|
||||
to = ${port.to}
|
||||
%{~ endif ~}
|
||||
%{~ if port.static != null ~}
|
||||
static = ${port.static}
|
||||
%{~ endif ~}
|
||||
%{ if port.host_network != null }host_network = "${port.host_network}"%{ endif ~}
|
||||
%{ if port.from != null }to = ${port.from}%{ endif ~}
|
||||
%{ if port.to != null }to = ${port.to}%{ endif ~}
|
||||
%{ if port.static != null }static = ${port.static}%{ endif ~}
|
||||
}
|
||||
%{~ endfor ~}
|
||||
}
|
||||
|
@ -73,7 +65,43 @@ job "${name}" {
|
|||
source = "${host_volume.name}"
|
||||
}
|
||||
%{~ endfor ~}
|
||||
%{~ if service_port != null }
|
||||
service {
|
||||
name = "${replace(name, "_", "-")}"
|
||||
provider = "nomad"
|
||||
port = "main"
|
||||
|
||||
tags = [
|
||||
%{~ if prometheus == true ~}
|
||||
"prometheus.scrape",
|
||||
%{~ endif ~}
|
||||
%{~ if ingress ~}
|
||||
"traefik.enable=true",
|
||||
"traefik.http.routers.${name}.entryPoints=websecure",
|
||||
%{~ if try(ingress_rule, null) != null ~}
|
||||
"traefik.http.routers.${name}.rule=${ingress_rule}",
|
||||
%{~ endif ~}
|
||||
%{~ for middleware in ingress_middlewares ~}
|
||||
"traefik.http.routers.${name}.middlewares=${middleware}",
|
||||
%{~ endfor ~}
|
||||
%{~ endif ~}
|
||||
%{~ for tag in service_tags ~}
|
||||
"${tag}",
|
||||
%{~ endfor ~}
|
||||
]
|
||||
}
|
||||
%{~ endif ~}
|
||||
|
||||
%{~ for custom_service in custom_services ~}
|
||||
service {
|
||||
name = "${custom_service.name}"
|
||||
provider = "nomad"
|
||||
port = "${custom_service.port}"
|
||||
|
||||
tags = ${jsonencode(custom_service.tags)}
|
||||
}
|
||||
|
||||
%{~ endfor ~}
|
||||
task "${name}" {
|
||||
driver = "docker"
|
||||
%{~ if length(task_meta) > 0 }
|
||||
|
@ -83,63 +111,7 @@ job "${name}" {
|
|||
%{ endfor ~}
|
||||
}
|
||||
%{~ endif ~}
|
||||
%{~ if service_port != null }
|
||||
service {
|
||||
name = "${replace(name, "_", "-")}"
|
||||
provider = "nomad"
|
||||
port = "main"
|
||||
|
||||
tags = [
|
||||
%{~ if prometheus == true ~}
|
||||
"prometheus.scrape",
|
||||
%{~ endif ~}
|
||||
%{~ if ingress ~}
|
||||
"traefik.enable=true",
|
||||
"traefik.http.routers.${name}.entryPoints=websecure",
|
||||
%{~ if try(ingress_rule, null) != null ~}
|
||||
"traefik.http.routers.${name}.rule=${ingress_rule}",
|
||||
%{~ endif ~}
|
||||
%{~ for middleware in ingress_middlewares ~}
|
||||
"traefik.http.routers.${name}.middlewares=${middleware}",
|
||||
%{~ endfor ~}
|
||||
%{~ endif ~}
|
||||
%{~ for tag in service_tags ~}
|
||||
"${tag}",
|
||||
%{~ endfor ~}
|
||||
]
|
||||
|
||||
%{~ if service_check != null ~}
|
||||
check {
|
||||
%{~ if service_check.name != "" ~}
|
||||
name = "${service_check.name}"
|
||||
%{~ endif ~}
|
||||
%{~ if service_check.name != "" ~}
|
||||
port = "${service_check.port}"
|
||||
%{~ endif ~}
|
||||
type = "${service_check.type}"
|
||||
path = "${service_check.path}"
|
||||
interval = "${service_check.interval}"
|
||||
timeout = "${service_check.timeout}"
|
||||
|
||||
check_restart {
|
||||
limit = 5
|
||||
grace = "90s"
|
||||
}
|
||||
}
|
||||
%{~ endif ~}
|
||||
}
|
||||
|
||||
%{~ endif ~}
|
||||
%{~ for custom_service in custom_services ~}
|
||||
service {
|
||||
name = "${custom_service.name}"
|
||||
provider = "nomad"
|
||||
port = "${custom_service.port}"
|
||||
|
||||
tags = ${jsonencode(custom_service.tags)}
|
||||
}
|
||||
|
||||
%{~ endfor ~}
|
||||
config {
|
||||
image = "${image}"
|
||||
%{~if image_pull_timeout != null ~}
|
||||
|
@ -225,12 +197,6 @@ EOF
|
|||
%{~ endif ~}
|
||||
}
|
||||
%{~ endif ~}
|
||||
%{~ if task_identity != null }
|
||||
identity {
|
||||
env = ${task_identity.env}
|
||||
file = ${task_identity.file}
|
||||
}
|
||||
%{~ endif ~}
|
||||
}
|
||||
%{~ if mysql_bootstrap != null }
|
||||
task "mysql-bootstrap" {
|
||||
|
@ -380,8 +346,8 @@ $$;
|
|||
}
|
||||
|
||||
config {
|
||||
image = "iamthefij/stunnel:latest"
|
||||
args = ["$${NOMAD_TASK_DIR}/stunnel.conf"]
|
||||
image = "alpine:3.17"
|
||||
args = ["/bin/sh", "$${NOMAD_TASK_DIR}/start.sh"]
|
||||
}
|
||||
|
||||
resources {
|
||||
|
@ -392,6 +358,15 @@ $$;
|
|||
%{~ endif ~}
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
set -e
|
||||
apk add stunnel
|
||||
exec stunnel {{ env "NOMAD_TASK_DIR" }}/stunnel.conf
|
||||
EOF
|
||||
destination = "$${NOMAD_TASK_DIR}/start.sh"
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
syslog = no
|
||||
|
|
|
@ -21,6 +21,7 @@ variable "priority" {
|
|||
description = "Scheduler priority of the service"
|
||||
}
|
||||
|
||||
|
||||
variable "image" {
|
||||
type = string
|
||||
description = "Image that should be run"
|
||||
|
@ -38,15 +39,6 @@ variable "task_meta" {
|
|||
description = "Meta attributes to attach to the task"
|
||||
}
|
||||
|
||||
variable "task_identity" {
|
||||
description = "Task workload identity"
|
||||
type = object({
|
||||
env = optional(bool, false)
|
||||
file = optional(bool, false)
|
||||
})
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "group_meta" {
|
||||
type = map(string)
|
||||
default = {}
|
||||
|
@ -118,7 +110,7 @@ variable "stunnel_resources" {
|
|||
|
||||
default = {
|
||||
cpu = 50
|
||||
memory = 15
|
||||
memory = 50
|
||||
memory_max = null
|
||||
}
|
||||
|
||||
|
@ -276,17 +268,3 @@ variable "use_wesher" {
|
|||
description = "Indicates whether or not services should expose themselves on the wesher network"
|
||||
default = true
|
||||
}
|
||||
|
||||
variable "service_check" {
|
||||
description = "Health check for main ingress service"
|
||||
type = object({
|
||||
name = optional(string, "")
|
||||
port = optional(string, "")
|
||||
path = optional(string, "/")
|
||||
interval = optional(string, "30s")
|
||||
timeout = optional(string, "2s")
|
||||
type = optional(string, "http")
|
||||
})
|
||||
|
||||
default = {}
|
||||
}
|
||||
|
|
|
@ -2,25 +2,11 @@ module "sonarr" {
|
|||
source = "./service"
|
||||
|
||||
name = "sonarr"
|
||||
image = "lscr.io/linuxserver/sonarr:4.0.2"
|
||||
|
||||
priority = 55
|
||||
image = "lscr.io/linuxserver/sonarr:3.0.10"
|
||||
|
||||
ingress = true
|
||||
service_port = 8989
|
||||
use_wesher = var.use_wesher
|
||||
ingress_middlewares = [
|
||||
"authelia@nomad"
|
||||
]
|
||||
|
||||
use_postgres = true
|
||||
postgres_bootstrap = {
|
||||
enabled = true
|
||||
databases = [
|
||||
"sonarr",
|
||||
"sonarr-logs",
|
||||
]
|
||||
}
|
||||
|
||||
env = {
|
||||
PGID = 100
|
||||
|
@ -30,7 +16,7 @@ module "sonarr" {
|
|||
|
||||
host_volumes = [
|
||||
{
|
||||
name = "sonarr-config"
|
||||
name = "sonarr-data"
|
||||
dest = "/config"
|
||||
read_only = false
|
||||
},
|
||||
|
@ -47,15 +33,3 @@ module "sonarr" {
|
|||
memory_max = 700
|
||||
}
|
||||
}
|
||||
|
||||
resource "nomad_variable" "authelia_service_rules_sonarr" {
|
||||
path = "authelia/access_control/service_rules/sonarr"
|
||||
items = {
|
||||
name = "sonarr"
|
||||
rule = <<EOH
|
||||
policy: bypass
|
||||
resources:
|
||||
- '^/api([/?].*)?$'
|
||||
EOH
|
||||
}
|
||||
}
|
||||
|
|
|
@ -13,7 +13,7 @@ job "unifi-traffic-route-ips" {
|
|||
driver = "docker"
|
||||
|
||||
config {
|
||||
image = "iamthefij/unifi-traffic-routes:0.0.2"
|
||||
image = "iamthefij/unifi-traffic-routes:0.0.1"
|
||||
}
|
||||
|
||||
env = {
|
||||
|
|
Loading…
Reference in New Issue