prometheus+grafana

6 files changed, 232 insertions, 0 deletions

diff --git a/terraform/hash-docker/.terraform.lock.hcl b/terraform/hash-docker/.terraform.lock.hcl
new file mode 100644
index 0000000..e35130a
--- /dev/null
+++ b/terraform/hash-docker/.terraform.lock.hcl
@@ -0,0 +1,62 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/null" {
+  version = "3.2.3"
+  hashes = [
+    "h1:+AnORRgFbRO6qqcfaQyeX80W0eX3VmjadjnUFUJTiXo=",
+    "zh:22d062e5278d872fe7aed834f5577ba0a5afe34a3bdac2b81f828d8d3e6706d2",
+    "zh:23dead00493ad863729495dc212fd6c29b8293e707b055ce5ba21ee453ce552d",
+    "zh:28299accf21763ca1ca144d8f660688d7c2ad0b105b7202554ca60b02a3856d3",
+    "zh:55c9e8a9ac25a7652df8c51a8a9a422bd67d784061b1de2dc9fe6c3cb4e77f2f",
+    "zh:756586535d11698a216291c06b9ed8a5cc6a4ec43eee1ee09ecd5c6a9e297ac1",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:9d5eea62fdb587eeb96a8c4d782459f4e6b73baeece4d04b4a40e44faaee9301",
+    "zh:a6355f596a3fb8fc85c2fb054ab14e722991533f87f928e7169a486462c74670",
+    "zh:b5a65a789cff4ada58a5baffc76cb9767dc26ec6b45c00d2ec8b1b027f6db4ed",
+    "zh:db5ab669cf11d0e9f81dc380a6fdfcac437aea3d69109c7aef1a5426639d2d65",
+    "zh:de655d251c470197bcbb5ac45d289595295acb8f829f6c781d4a75c8c8b7c7dd",
+    "zh:f5c68199f2e6076bce92a12230434782bf768103a427e9bb9abee99b116af7b5",
+  ]
+}
+
+provider "registry.terraform.io/kreuzwerker/docker" {
+  version     = "2.24.0"
+  constraints = "2.24.0"
+  hashes = [
+    "h1:1z0/qA77T3PS/1m4vRO8UgWjHjk5/v+f3JfGbMyzX18=",
+    "zh:181fefd55c8eb75efe9815c43fdd76422b57951ef53b5d5f19273a00fdf0e2e2",
+    "zh:2ec84e029d169f188be2addf7f45c2555f226f67d4b6fb66c1749ed5b2c4a76a",
+    "zh:6f5cf945148485f57b919d31a30f1a5a93d45f4e8edfdb0b80b22258d51795d8",
+    "zh:8d00c2c459a48453f52a00a8d1ffdb7bcf72fe4b3b09ffcfd52218c4646fa7fa",
+    "zh:9bd6e06601e0a972b9ce01150e32e76b76b4caf1d9798daf4cf16d06e2a8d4a3",
+    "zh:af72591132dc8cd338f293e458403851e6b8a6ac4c4d25a3268940f9763df7aa",
+    "zh:c4a47c5c7ad2ff1fc5212e69c5ef837a127346264e46ce7b5d13362545e4aa70",
+    "zh:c6d68f33efcd3372331ed0d58ec49e8b01ddc132934b14d2d45977076950e4b3",
+    "zh:db228855ae7235095d367f3597719747e5be0dd9ce2206ea02062560b518c08a",
+    "zh:e8d6ce89642925f2e813d0b829bd5562582de37eaa39351e231ab474383e703a",
+    "zh:ec83d8c86a918d25eb824cc99f98924ef8949eb69aa40cb5ff2db24369e52d9c",
+    "zh:ee0032d3d86adeeca7fdd4922bb8db87dbb5cd0093c054ff8efe2260de0b624c",
+    "zh:f033b70f342f32eeb98c213e6fc7098d7afd22b3146a5cb6173c128b0e86d732",
+    "zh:f1bc3a2c4f152f8adc9a1f9c852496232ef31073b149945756c13bc9688cf08b",
+  ]
+}
+
+provider "registry.terraform.io/lokkersp/sops" {
+  version     = "0.6.10"
+  constraints = "0.6.10"
+  hashes = [
+    "h1:atU8NIBxpNTWY+qBubvEOfjOn4K1aCDoq1iUFocgIHQ=",
+    "zh:0f053a26392a581b1f1ce6316cb7ed8ec4cc75e7f5f1cf7cfd45050b6b3c87ea",
+    "zh:207bb96c4471fce9aeb1b3c217d772692c3d865d294cf4d2501dad41de36a15e",
+    "zh:28506e8f1f3b9eaa95d99043440328044ee6340143535e5751538328a529d001",
+    "zh:3cae3bcea9e35fdc5b3f2af1b4580cd625c996448ad0c676c772260e46b25289",
+    "zh:3e44daaf82986c2b0028aeb17b867f3c68ed5dd8ac8625ba0406cf2a5fd3d92e",
+    "zh:457fb8ca2e677af24f9a4bdd8b613b1d7b604ad7133541657e5757c19268da71",
+    "zh:473d727c228f021a3df8cc8dcc6231ad7f90ed63f9e47c36b597d591e76228da",
+    "zh:48c4c1df39fd76ec8bd5fe9ac70cdc0927ac8be95582dbe46458b3442ce0fcd9",
+    "zh:728b19cb5c07e5e9d8b78fd94cc57d4c13582ecd24b7eb7c4cc2bf73b12fe4d1",
+    "zh:c51ed9af591779bb0910b82addeebb10f53428b994f8db653dd1dedcec60916c",
+    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+  ]
+}
diff --git a/terraform/hash-docker/backend.tf b/terraform/hash-docker/backend.tf
new file mode 100644
index 0000000..24314e3
--- /dev/null
+++ b/terraform/hash-docker/backend.tf
@@ -0,0 +1,12 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  backend "s3" {
+    bucket                      = "terraform-a6726272-73ff-11ed-8bdd-c79eb8376e05"
+    key                         = "hash-docker/terraform.tfstate"
+    skip_region_validation      = true
+    skip_credentials_validation = true
+    skip_metadata_api_check     = true
+    region                      = "eu-central-1"
+    endpoint                    = "eu-central-1.linodeobjects.com"
+  }
+}
diff --git a/terraform/hash-docker/main.tf b/terraform/hash-docker/main.tf
new file mode 100644
index 0000000..4dde836
--- /dev/null
+++ b/terraform/hash-docker/main.tf
@@ -0,0 +1,36 @@
+terraform {
+  required_version = "~> 1.3.5"
+
+  required_providers {
+    docker = {
+      source  = "kreuzwerker/docker"
+      version = "2.24.0"
+    }
+    sops = {
+      source  = "lokkersp/sops"
+      version = "0.6.10"
+    }
+  }
+}
+
+locals {
+  host      = "hash.trygvis.io"
+  public_ip = "138.201.33.16"
+
+  hs         = module.ipam6.hosts
+  ns         = module.ipam6.networks
+  dn42_range = local.ns.hash_docker_dn42.range
+}
+
+provider "docker" {
+  host = "ssh://${local.host}"
+}
+
+data "sops_file_entry" "linode_token" {
+  source_file = "../../sops.yml"
+  data_key    = "linode_token"
+}
+
+module "ipam6" {
+  source = "../ipam6"
+}
diff --git a/terraform/hash-docker/network.tf b/terraform/hash-docker/network.tf
new file mode 100644
index 0000000..94ddeef
--- /dev/null
+++ b/terraform/hash-docker/network.tf
@@ -0,0 +1,14 @@
+resource "docker_network" "dn42" {
+  name = "dn42"
+
+  ipv6 = true
+
+  ipam_config {
+    gateway = "172.20.0.1"
+    subnet  = "172.20.0.0/16"
+  }
+
+  ipam_config {
+    subnet = local.dn42_range
+  }
+}
diff --git a/terraform/hash-docker/terragrunt.hcl b/terraform/hash-docker/terragrunt.hcl
new file mode 100644
index 0000000..e147285
--- /dev/null
+++ b/terraform/hash-docker/terragrunt.hcl
@@ -0,0 +1,3 @@
+include "root" {
+  path = find_in_parent_folders()
+}
diff --git a/terraform/hash-docker/traefik.tf b/terraform/hash-docker/traefik.tf
new file mode 100644
index 0000000..3708024
--- /dev/null
+++ b/terraform/hash-docker/traefik.tf
@@ -0,0 +1,105 @@
+resource "docker_network" "traefik" {
+  name = "traefik"
+}
+
+resource "docker_image" "traefik" {
+  name = "traefik:2.9.8"
+}
+
+resource "docker_container" "traefik" {
+  image      = docker_image.traefik.image_id
+  name       = "traefik"
+  privileged = false
+  must_run   = false
+
+  network_mode = "bridge"
+
+  networks_advanced {
+    name = docker_network.traefik.name
+  }
+
+  ports {
+    internal = 80
+    external = 80
+    ip       = local.public_ip
+  }
+
+  ports {
+    internal = 443
+    external = 443
+    ip       = local.public_ip
+  }
+
+  command = [
+    "--log.level=DEBUG",
+    "--api=true",
+    "--api.dashboard=true",
+    "--api.debug=true",
+    #    "--api.insecure=true",
+    "--providers.docker=true",
+    "--providers.docker.exposedbydefault=false",
+    "--entrypoints.websecure.address=:443",
+    "--entrypoints.web.address=:80",
+    "--entrypoints.web.http.redirections.entrypoint.to=websecure",
+    "--entrypoints.web.http.redirections.entrypoint.scheme=https",
+    "--certificatesresolvers.linode.acme.dnschallenge.provider=linode",
+    "--certificatesresolvers.linode.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53",
+    "--certificatesresolvers.linode.acme.email=root@trygvis.io",
+    "--certificatesresolvers.linode.acme.storage=/letsencrypt/acme.json",
+
+    # There doesn't seem to be a way to define a specific
+    # serversTransport through the CLI or lables, to here backend
+    # certificate checks are globally disabled.
+    "--serverstransport.insecureskipverify",
+  ]
+
+  dynamic "labels" {
+    for_each = [
+      { label = "traefik.enable", value = "true" },
+      { label = "traefik.http.routers.traefik.service", value = "api@internal" },
+      { label = "traefik.http.routers.traefik.rule", value = "Host(`${local.host}`)" },
+      { label = "traefik.http.routers.traefik.entrypoints", value = "websecure" },
+      { label = "traefik.http.routers.traefik.tls.certresolver", value = "linode" },
+    ]
+    content {
+      label = labels.value["label"]
+      value = labels.value["value"]
+    }
+  }
+
+  env = [
+    "LINODE_TOKEN=${data.sops_file_entry.linode_token.data}"
+  ]
+
+  mounts {
+    source    = "/etc/docker-service/traefik/letsencrypt"
+    target    = "/letsencrypt"
+    type      = "bind"
+    read_only = false
+  }
+
+  mounts {
+    source    = "/var/run/docker.sock"
+    target    = "/var/run/docker.sock"
+    type      = "bind"
+    read_only = true
+  }
+
+  depends_on = [
+    resource.null_resource.letsencrypt,
+  ]
+}
+
+locals {
+  path = "/etc/docker-service/traefik/letsencrypt"
+}
+
+resource "null_resource" "letsencrypt" {
+  triggers = {
+    path = local.path
+  }
+
+  provisioner "local-exec" {
+    command = "ssh ${local.host} sudo mkdir -p ${local.path}"
+  }
+}