aboutsummaryrefslogtreecommitdiff
path: root/terraform/hash-docker
diff options
context:
space:
mode:
Diffstat (limited to 'terraform/hash-docker')
-rw-r--r--terraform/hash-docker/.terraform.lock.hcl62
-rw-r--r--terraform/hash-docker/backend.tf12
-rw-r--r--terraform/hash-docker/main.tf36
-rw-r--r--terraform/hash-docker/network.tf14
-rw-r--r--terraform/hash-docker/terragrunt.hcl3
-rw-r--r--terraform/hash-docker/traefik.tf105
6 files changed, 232 insertions, 0 deletions
diff --git a/terraform/hash-docker/.terraform.lock.hcl b/terraform/hash-docker/.terraform.lock.hcl
new file mode 100644
index 0000000..e35130a
--- /dev/null
+++ b/terraform/hash-docker/.terraform.lock.hcl
@@ -0,0 +1,62 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/null" {
+ version = "3.2.3"
+ hashes = [
+ "h1:+AnORRgFbRO6qqcfaQyeX80W0eX3VmjadjnUFUJTiXo=",
+ "zh:22d062e5278d872fe7aed834f5577ba0a5afe34a3bdac2b81f828d8d3e6706d2",
+ "zh:23dead00493ad863729495dc212fd6c29b8293e707b055ce5ba21ee453ce552d",
+ "zh:28299accf21763ca1ca144d8f660688d7c2ad0b105b7202554ca60b02a3856d3",
+ "zh:55c9e8a9ac25a7652df8c51a8a9a422bd67d784061b1de2dc9fe6c3cb4e77f2f",
+ "zh:756586535d11698a216291c06b9ed8a5cc6a4ec43eee1ee09ecd5c6a9e297ac1",
+ "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+ "zh:9d5eea62fdb587eeb96a8c4d782459f4e6b73baeece4d04b4a40e44faaee9301",
+ "zh:a6355f596a3fb8fc85c2fb054ab14e722991533f87f928e7169a486462c74670",
+ "zh:b5a65a789cff4ada58a5baffc76cb9767dc26ec6b45c00d2ec8b1b027f6db4ed",
+ "zh:db5ab669cf11d0e9f81dc380a6fdfcac437aea3d69109c7aef1a5426639d2d65",
+ "zh:de655d251c470197bcbb5ac45d289595295acb8f829f6c781d4a75c8c8b7c7dd",
+ "zh:f5c68199f2e6076bce92a12230434782bf768103a427e9bb9abee99b116af7b5",
+ ]
+}
+
+provider "registry.terraform.io/kreuzwerker/docker" {
+ version = "2.24.0"
+ constraints = "2.24.0"
+ hashes = [
+ "h1:1z0/qA77T3PS/1m4vRO8UgWjHjk5/v+f3JfGbMyzX18=",
+ "zh:181fefd55c8eb75efe9815c43fdd76422b57951ef53b5d5f19273a00fdf0e2e2",
+ "zh:2ec84e029d169f188be2addf7f45c2555f226f67d4b6fb66c1749ed5b2c4a76a",
+ "zh:6f5cf945148485f57b919d31a30f1a5a93d45f4e8edfdb0b80b22258d51795d8",
+ "zh:8d00c2c459a48453f52a00a8d1ffdb7bcf72fe4b3b09ffcfd52218c4646fa7fa",
+ "zh:9bd6e06601e0a972b9ce01150e32e76b76b4caf1d9798daf4cf16d06e2a8d4a3",
+ "zh:af72591132dc8cd338f293e458403851e6b8a6ac4c4d25a3268940f9763df7aa",
+ "zh:c4a47c5c7ad2ff1fc5212e69c5ef837a127346264e46ce7b5d13362545e4aa70",
+ "zh:c6d68f33efcd3372331ed0d58ec49e8b01ddc132934b14d2d45977076950e4b3",
+ "zh:db228855ae7235095d367f3597719747e5be0dd9ce2206ea02062560b518c08a",
+ "zh:e8d6ce89642925f2e813d0b829bd5562582de37eaa39351e231ab474383e703a",
+ "zh:ec83d8c86a918d25eb824cc99f98924ef8949eb69aa40cb5ff2db24369e52d9c",
+ "zh:ee0032d3d86adeeca7fdd4922bb8db87dbb5cd0093c054ff8efe2260de0b624c",
+ "zh:f033b70f342f32eeb98c213e6fc7098d7afd22b3146a5cb6173c128b0e86d732",
+ "zh:f1bc3a2c4f152f8adc9a1f9c852496232ef31073b149945756c13bc9688cf08b",
+ ]
+}
+
+provider "registry.terraform.io/lokkersp/sops" {
+ version = "0.6.10"
+ constraints = "0.6.10"
+ hashes = [
+ "h1:atU8NIBxpNTWY+qBubvEOfjOn4K1aCDoq1iUFocgIHQ=",
+ "zh:0f053a26392a581b1f1ce6316cb7ed8ec4cc75e7f5f1cf7cfd45050b6b3c87ea",
+ "zh:207bb96c4471fce9aeb1b3c217d772692c3d865d294cf4d2501dad41de36a15e",
+ "zh:28506e8f1f3b9eaa95d99043440328044ee6340143535e5751538328a529d001",
+ "zh:3cae3bcea9e35fdc5b3f2af1b4580cd625c996448ad0c676c772260e46b25289",
+ "zh:3e44daaf82986c2b0028aeb17b867f3c68ed5dd8ac8625ba0406cf2a5fd3d92e",
+ "zh:457fb8ca2e677af24f9a4bdd8b613b1d7b604ad7133541657e5757c19268da71",
+ "zh:473d727c228f021a3df8cc8dcc6231ad7f90ed63f9e47c36b597d591e76228da",
+ "zh:48c4c1df39fd76ec8bd5fe9ac70cdc0927ac8be95582dbe46458b3442ce0fcd9",
+ "zh:728b19cb5c07e5e9d8b78fd94cc57d4c13582ecd24b7eb7c4cc2bf73b12fe4d1",
+ "zh:c51ed9af591779bb0910b82addeebb10f53428b994f8db653dd1dedcec60916c",
+ "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+ ]
+}
diff --git a/terraform/hash-docker/backend.tf b/terraform/hash-docker/backend.tf
new file mode 100644
index 0000000..24314e3
--- /dev/null
+++ b/terraform/hash-docker/backend.tf
@@ -0,0 +1,12 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+ backend "s3" {
+ bucket = "terraform-a6726272-73ff-11ed-8bdd-c79eb8376e05"
+ key = "hash-docker/terraform.tfstate"
+ skip_region_validation = true
+ skip_credentials_validation = true
+ skip_metadata_api_check = true
+ region = "eu-central-1"
+ endpoint = "eu-central-1.linodeobjects.com"
+ }
+}
diff --git a/terraform/hash-docker/main.tf b/terraform/hash-docker/main.tf
new file mode 100644
index 0000000..4dde836
--- /dev/null
+++ b/terraform/hash-docker/main.tf
@@ -0,0 +1,36 @@
+terraform {
+ required_version = "~> 1.3.5"
+
+ required_providers {
+ docker = {
+ source = "kreuzwerker/docker"
+ version = "2.24.0"
+ }
+ sops = {
+ source = "lokkersp/sops"
+ version = "0.6.10"
+ }
+ }
+}
+
+locals {
+ host = "hash.trygvis.io"
+ public_ip = "138.201.33.16"
+
+ hs = module.ipam6.hosts
+ ns = module.ipam6.networks
+ dn42_range = local.ns.hash_docker_dn42.range
+}
+
+provider "docker" {
+ host = "ssh://${local.host}"
+}
+
+data "sops_file_entry" "linode_token" {
+ source_file = "../../sops.yml"
+ data_key = "linode_token"
+}
+
+module "ipam6" {
+ source = "../ipam6"
+}
diff --git a/terraform/hash-docker/network.tf b/terraform/hash-docker/network.tf
new file mode 100644
index 0000000..94ddeef
--- /dev/null
+++ b/terraform/hash-docker/network.tf
@@ -0,0 +1,14 @@
+resource "docker_network" "dn42" {
+ name = "dn42"
+
+ ipv6 = true
+
+ ipam_config {
+ gateway = "172.20.0.1"
+ subnet = "172.20.0.0/16"
+ }
+
+ ipam_config {
+ subnet = local.dn42_range
+ }
+}
diff --git a/terraform/hash-docker/terragrunt.hcl b/terraform/hash-docker/terragrunt.hcl
new file mode 100644
index 0000000..e147285
--- /dev/null
+++ b/terraform/hash-docker/terragrunt.hcl
@@ -0,0 +1,3 @@
+include "root" {
+ path = find_in_parent_folders()
+}
diff --git a/terraform/hash-docker/traefik.tf b/terraform/hash-docker/traefik.tf
new file mode 100644
index 0000000..3708024
--- /dev/null
+++ b/terraform/hash-docker/traefik.tf
@@ -0,0 +1,105 @@
+resource "docker_network" "traefik" {
+ name = "traefik"
+}
+
+resource "docker_image" "traefik" {
+ name = "traefik:2.9.8"
+}
+
+resource "docker_container" "traefik" {
+ image = docker_image.traefik.image_id
+ name = "traefik"
+ privileged = false
+ must_run = false
+
+ network_mode = "bridge"
+
+ networks_advanced {
+ name = docker_network.traefik.name
+ }
+
+ ports {
+ internal = 80
+ external = 80
+ ip = local.public_ip
+ }
+
+ ports {
+ internal = 443
+ external = 443
+ ip = local.public_ip
+ }
+
+ command = [
+ "--log.level=DEBUG",
+ "--api=true",
+ "--api.dashboard=true",
+ "--api.debug=true",
+ # "--api.insecure=true",
+ "--providers.docker=true",
+ "--providers.docker.exposedbydefault=false",
+ "--entrypoints.websecure.address=:443",
+ "--entrypoints.web.address=:80",
+ "--entrypoints.web.http.redirections.entrypoint.to=websecure",
+ "--entrypoints.web.http.redirections.entrypoint.scheme=https",
+ "--certificatesresolvers.linode.acme.dnschallenge.provider=linode",
+ "--certificatesresolvers.linode.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53",
+ "--certificatesresolvers.linode.acme.email=root@trygvis.io",
+ "--certificatesresolvers.linode.acme.storage=/letsencrypt/acme.json",
+
+ # There doesn't seem to be a way to define a specific
+ # serversTransport through the CLI or lables, to here backend
+ # certificate checks are globally disabled.
+ "--serverstransport.insecureskipverify",
+ ]
+
+ dynamic "labels" {
+ for_each = [
+ { label = "traefik.enable", value = "true" },
+ { label = "traefik.http.routers.traefik.service", value = "api@internal" },
+ { label = "traefik.http.routers.traefik.rule", value = "Host(`${local.host}`)" },
+ { label = "traefik.http.routers.traefik.entrypoints", value = "websecure" },
+ { label = "traefik.http.routers.traefik.tls.certresolver", value = "linode" },
+ ]
+ content {
+ label = labels.value["label"]
+ value = labels.value["value"]
+ }
+ }
+
+ env = [
+ "LINODE_TOKEN=${data.sops_file_entry.linode_token.data}"
+ ]
+
+ mounts {
+ source = "/etc/docker-service/traefik/letsencrypt"
+ target = "/letsencrypt"
+ type = "bind"
+ read_only = false
+ }
+
+ mounts {
+ source = "/var/run/docker.sock"
+ target = "/var/run/docker.sock"
+ type = "bind"
+ read_only = true
+ }
+
+ depends_on = [
+ resource.null_resource.letsencrypt,
+ ]
+}
+
+locals {
+ path = "/etc/docker-service/traefik/letsencrypt"
+}
+
+resource "null_resource" "letsencrypt" {
+ triggers = {
+ path = local.path
+ }
+
+ provisioner "local-exec" {
+ command = "ssh ${local.host} sudo mkdir -p ${local.path}"
+ }
+}
generated by cgit v1.2.3 (git 2.46.0) at 2024-12-22 22:12:16 +0000