diff options
Diffstat (limited to 'terraform')
36 files changed, 830 insertions, 248 deletions
diff --git a/terraform/conflatorio-docker/main.tf b/terraform/conflatorio-docker/main.tf deleted file mode 100644 index ad4e6fd..0000000 --- a/terraform/conflatorio-docker/main.tf +++ /dev/null @@ -1,37 +0,0 @@ -terraform { - required_version = "~> 1.3.5" - - required_providers { - docker = { - source = "kreuzwerker/docker" - version = "2.24.0" - } - sops = { - source = "lokkersp/sops" - version = "0.6.10" - } - } -} - -provider "docker" { - host = "ssh://conflatorio.vpn.trygvis.io" -} - -data "sops_file_entry" "linode_token" { - source_file = "../../sops.yml" - data_key = "linode_token" -} - -locals { - hs = module.ipam6.hosts - ns = module.ipam6.networks - public_ip = local.hs.conflatorio-ix.address - network_addr = local.ns.conflatorio_docker.address - network_range = local.ns.conflatorio_docker.prefix - private_network_addr = local.ns.conflatorio_docker_private.address - private_network_range = local.ns.conflatorio_docker_private.range -} - -module "ipam6" { - source = "../ipam6" -} diff --git a/terraform/conflatorio-docker/network.tf b/terraform/conflatorio-docker/network.tf deleted file mode 100644 index 8a839f5..0000000 --- a/terraform/conflatorio-docker/network.tf +++ /dev/null @@ -1,25 +0,0 @@ -resource "docker_network" "public" { - name = "public" - - ipv6 = true - - ipam_config { - subnet = "${local.network_addr}/${local.network_range}" - } - - ipam_config { - gateway = "172.22.0.1" - subnet = "172.22.0.0/16" - } -} - -# Internal shared network -resource "docker_network" "private" { - name = "private" - - ipv6 = true - - ipam_config { - subnet = "${local.private_network_addr}/${local.private_network_range}" - } -} diff --git a/terraform/grafana/backend.tf b/terraform/dns/backend.tf index e796c2e..4f05aaf 100644 --- a/terraform/grafana/backend.tf +++ b/terraform/dns/backend.tf @@ -1,12 +1,16 @@ # Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa terraform { + required_version = "~> 1.9.5" + backend "s3" { bucket = "terraform-a6726272-73ff-11ed-8bdd-c79eb8376e05" - key = "grafana/terraform.tfstate" + key = "dns/terraform.tfstate" skip_region_validation = true skip_credentials_validation = true skip_metadata_api_check = true + skip_requesting_account_id = true + skip_s3_checksum = true region = "eu-central-1" - endpoint = "eu-central-1.linodeobjects.com" + endpoints = { s3 : "https://eu-central-1.linodeobjects.com" } } } diff --git a/terraform/dns/dn42.tf b/terraform/dns/dn42.tf index b13d597..5e39c97 100644 --- a/terraform/dns/dn42.tf +++ b/terraform/dns/dn42.tf @@ -7,9 +7,9 @@ resource "linode_domain_record" "dn42-conflatorio" { target = "fdb1:4242:3538:2008:8042:32ff:fe0c:7161" } -resource "linode_domain_record" "dn42-coregonus-ix" { +resource "linode_domain_record" "dn42-coregonus" { domain_id = linode_domain.root.id - name = "coregonus-ix.dn42" + name = "coregonus.dn42" record_type = "AAAA" target = "fdb1:4242:3538:2005::ffff" } @@ -25,7 +25,14 @@ resource "linode_domain_record" "dn42-hash" { domain_id = linode_domain.root.id name = "hash.dn42" record_type = "AAAA" - target = "fdb1:4242:3538:2009::ffff" + target = "fdb1:4242:3538:2007::ffff" +} + +resource "linode_domain_record" "dn42-homeassistant" { + domain_id = linode_domain.root.id + name = "homeassistant.dn42" + record_type = "AAAA" + target = "2a01:799:111d:1801:e0d7:757e:4080:a508" } resource "linode_domain_record" "dn42-knot" { @@ -53,12 +60,19 @@ resource "linode_domain_record" "dn42-node1" { domain_id = linode_domain.root.id name = "node1.dn42" record_type = "AAAA" - target = "fdb1:4242:3538:2002::" + target = "fdb1:4242:3538:2002::ffff" } resource "linode_domain_record" "dn42-node2" { domain_id = linode_domain.root.id name = "node2.dn42" record_type = "AAAA" - target = "fdb1:4242:3538:2003::" + target = "fdb1:4242:3538:2003::ffff" +} + +resource "linode_domain_record" "dn42-unifi" { + domain_id = linode_domain.root.id + name = "unifi.dn42" + record_type = "AAAA" + target = "fdb1:4242:3538:2008:5054:ff:fe4d:96c" } diff --git a/terraform/dns/main.tf b/terraform/dns/main.tf index 753ef75..812f3b2 100644 --- a/terraform/dns/main.tf +++ b/terraform/dns/main.tf @@ -1,16 +1,4 @@ terraform { - required_version = "~> 1.3.6" - - backend "s3" { - bucket = "terraform-a6726272-73ff-11ed-8bdd-c79eb8376e05" - key = "dns/terraform.tfstate" - region = "eu-central-1" - skip_region_validation = true - skip_credentials_validation = true - skip_metadata_api_check = true - endpoint = "eu-central-1.linodeobjects.com" - } - required_providers { linode = { version = "2.7.1" diff --git a/terraform/dns/terraform.tfstate b/terraform/dns/terraform.tfstate new file mode 100644 index 0000000..891db4d --- /dev/null +++ b/terraform/dns/terraform.tfstate @@ -0,0 +1,52 @@ +{ + "version": 3, + "serial": 1, + "lineage": "8244bd55-1992-3e9a-1072-28df4fb0d2f2", + "backend": { + "type": "s3", + "config": { + "access_key": null, + "acl": null, + "assume_role_duration_seconds": null, + "assume_role_policy": null, + "assume_role_policy_arns": null, + "assume_role_tags": null, + "assume_role_transitive_tag_keys": null, + "bucket": "terraform-a6726272-73ff-11ed-8bdd-c79eb8376e05", + "dynamodb_endpoint": null, + "dynamodb_table": null, + "encrypt": null, + "endpoint": "eu-central-1.linodeobjects.com", + "external_id": null, + "force_path_style": null, + "iam_endpoint": null, + "key": "dns/terraform.tfstate", + "kms_key_id": null, + "max_retries": null, + "profile": null, + "region": "eu-central-1", + "role_arn": null, + "secret_key": null, + "session_name": null, + "shared_credentials_file": null, + "skip_credentials_validation": true, + "skip_metadata_api_check": true, + "skip_region_validation": true, + "sse_customer_key": null, + "sts_endpoint": null, + "token": null, + "workspace_key_prefix": null + }, + "hash": 1226279900 + }, + "modules": [ + { + "path": [ + "root" + ], + "outputs": {}, + "resources": {}, + "depends_on": [] + } + ] +} diff --git a/terraform/conflatorio-docker/terragrunt.hcl b/terraform/dns/terragrunt.hcl index e147285..e147285 100644 --- a/terraform/conflatorio-docker/terragrunt.hcl +++ b/terraform/dns/terragrunt.hcl diff --git a/terraform/dns/trygvis.tf b/terraform/dns/trygvis.tf index 608dd3e..4dcec85 100644 --- a/terraform/dns/trygvis.tf +++ b/terraform/dns/trygvis.tf @@ -170,7 +170,7 @@ resource "linode_domain_record" "grafana" { domain_id = linode_domain.root.id name = "grafana" record_type = "CNAME" - target = "vs.trygvis.io" + target = "hash.trygvis.io" } resource "linode_domain_record" "owncloud" { diff --git a/terraform/dns/vpn-cname.tf b/terraform/dns/vpn-cname.tf index 7a9fba4..c03b2bb 100644 --- a/terraform/dns/vpn-cname.tf +++ b/terraform/dns/vpn-cname.tf @@ -19,13 +19,6 @@ resource "linode_domain_record" "vpn-unifi" { target = "${linode_domain_record.net-conflatorio.name}.trygvis.io" } -resource "linode_domain_record" "vpn-grafana" { - domain_id = linode_domain.root.id - name = "grafana.vpn" - record_type = "CNAME" - target = "${linode_domain_record.net-conflatorio.name}.trygvis.io" -} - resource "linode_domain_record" "vpn-influxdb" { domain_id = linode_domain.root.id name = "influxdb.vpn" diff --git a/terraform/conflatorio-docker/.terraform.lock.hcl b/terraform/hash-docker/.terraform.lock.hcl index aa0f1fb..e35130a 100644 --- a/terraform/conflatorio-docker/.terraform.lock.hcl +++ b/terraform/hash-docker/.terraform.lock.hcl @@ -2,21 +2,21 @@ # Manual edits may be lost in future updates. provider "registry.terraform.io/hashicorp/null" { - version = "3.2.1" + version = "3.2.3" hashes = [ - "h1:FbGfc+muBsC17Ohy5g806iuI1hQc4SIexpYCrQHQd8w=", - "zh:58ed64389620cc7b82f01332e27723856422820cfd302e304b5f6c3436fb9840", - "zh:62a5cc82c3b2ddef7ef3a6f2fedb7b9b3deff4ab7b414938b08e51d6e8be87cb", - "zh:63cff4de03af983175a7e37e52d4bd89d990be256b16b5c7f919aff5ad485aa5", - "zh:74cb22c6700e48486b7cabefa10b33b801dfcab56f1a6ac9b6624531f3d36ea3", + "h1:+AnORRgFbRO6qqcfaQyeX80W0eX3VmjadjnUFUJTiXo=", + "zh:22d062e5278d872fe7aed834f5577ba0a5afe34a3bdac2b81f828d8d3e6706d2", + "zh:23dead00493ad863729495dc212fd6c29b8293e707b055ce5ba21ee453ce552d", + "zh:28299accf21763ca1ca144d8f660688d7c2ad0b105b7202554ca60b02a3856d3", + "zh:55c9e8a9ac25a7652df8c51a8a9a422bd67d784061b1de2dc9fe6c3cb4e77f2f", + "zh:756586535d11698a216291c06b9ed8a5cc6a4ec43eee1ee09ecd5c6a9e297ac1", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:79e553aff77f1cfa9012a2218b8238dd672ea5e1b2924775ac9ac24d2a75c238", - "zh:a1e06ddda0b5ac48f7e7c7d59e1ab5a4073bbcf876c73c0299e4610ed53859dc", - "zh:c37a97090f1a82222925d45d84483b2aa702ef7ab66532af6cbcfb567818b970", - "zh:e4453fbebf90c53ca3323a92e7ca0f9961427d2f0ce0d2b65523cc04d5d999c2", - "zh:e80a746921946d8b6761e77305b752ad188da60688cfd2059322875d363be5f5", - "zh:fbdb892d9822ed0e4cb60f2fedbdbb556e4da0d88d3b942ae963ed6ff091e48f", - "zh:fca01a623d90d0cad0843102f9b8b9fe0d3ff8244593bd817f126582b52dd694", + "zh:9d5eea62fdb587eeb96a8c4d782459f4e6b73baeece4d04b4a40e44faaee9301", + "zh:a6355f596a3fb8fc85c2fb054ab14e722991533f87f928e7169a486462c74670", + "zh:b5a65a789cff4ada58a5baffc76cb9767dc26ec6b45c00d2ec8b1b027f6db4ed", + "zh:db5ab669cf11d0e9f81dc380a6fdfcac437aea3d69109c7aef1a5426639d2d65", + "zh:de655d251c470197bcbb5ac45d289595295acb8f829f6c781d4a75c8c8b7c7dd", + "zh:f5c68199f2e6076bce92a12230434782bf768103a427e9bb9abee99b116af7b5", ] } diff --git a/terraform/conflatorio-docker/backend.tf b/terraform/hash-docker/backend.tf index d2de289..d793773 100644 --- a/terraform/conflatorio-docker/backend.tf +++ b/terraform/hash-docker/backend.tf @@ -1,12 +1,16 @@ # Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa terraform { + required_version = "~> 1.9.5" + backend "s3" { bucket = "terraform-a6726272-73ff-11ed-8bdd-c79eb8376e05" - key = "conflatorio-docker/terraform.tfstate" + key = "hash-docker/terraform.tfstate" skip_region_validation = true skip_credentials_validation = true skip_metadata_api_check = true + skip_requesting_account_id = true + skip_s3_checksum = true region = "eu-central-1" - endpoint = "eu-central-1.linodeobjects.com" + endpoints = { s3 : "https://eu-central-1.linodeobjects.com" } } } diff --git a/terraform/hash-docker/main.tf b/terraform/hash-docker/main.tf new file mode 100644 index 0000000..ba2c79f --- /dev/null +++ b/terraform/hash-docker/main.tf @@ -0,0 +1,34 @@ +terraform { + required_providers { + docker = { + source = "kreuzwerker/docker" + version = "2.24.0" + } + sops = { + source = "lokkersp/sops" + version = "0.6.10" + } + } +} + +locals { + host = "hash.trygvis.io" + public_ip = "138.201.33.16" + + hs = module.ipam6.hosts + ns = module.ipam6.networks + dn42_range = local.ns.hash_docker_dn42.range +} + +provider "docker" { + host = "ssh://${local.host}" +} + +data "sops_file_entry" "linode_token" { + source_file = "../../sops.yml" + data_key = "linode_token" +} + +module "ipam6" { + source = "../ipam6" +} diff --git a/terraform/hash-docker/network.tf b/terraform/hash-docker/network.tf new file mode 100644 index 0000000..94ddeef --- /dev/null +++ b/terraform/hash-docker/network.tf @@ -0,0 +1,14 @@ +resource "docker_network" "dn42" { + name = "dn42" + + ipv6 = true + + ipam_config { + gateway = "172.20.0.1" + subnet = "172.20.0.0/16" + } + + ipam_config { + subnet = local.dn42_range + } +} diff --git a/terraform/grafana/terragrunt.hcl b/terraform/hash-docker/terragrunt.hcl index e147285..e147285 100644 --- a/terraform/grafana/terragrunt.hcl +++ b/terraform/hash-docker/terragrunt.hcl diff --git a/terraform/hash-docker/traefik.tf b/terraform/hash-docker/traefik.tf new file mode 100644 index 0000000..3708024 --- /dev/null +++ b/terraform/hash-docker/traefik.tf @@ -0,0 +1,105 @@ +resource "docker_network" "traefik" { + name = "traefik" +} + +resource "docker_image" "traefik" { + name = "traefik:2.9.8" +} + +resource "docker_container" "traefik" { + image = docker_image.traefik.image_id + name = "traefik" + privileged = false + must_run = false + + network_mode = "bridge" + + networks_advanced { + name = docker_network.traefik.name + } + + ports { + internal = 80 + external = 80 + ip = local.public_ip + } + + ports { + internal = 443 + external = 443 + ip = local.public_ip + } + + command = [ + "--log.level=DEBUG", + "--api=true", + "--api.dashboard=true", + "--api.debug=true", + # "--api.insecure=true", + "--providers.docker=true", + "--providers.docker.exposedbydefault=false", + "--entrypoints.websecure.address=:443", + "--entrypoints.web.address=:80", + "--entrypoints.web.http.redirections.entrypoint.to=websecure", + "--entrypoints.web.http.redirections.entrypoint.scheme=https", + "--certificatesresolvers.linode.acme.dnschallenge.provider=linode", + "--certificatesresolvers.linode.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53", + "--certificatesresolvers.linode.acme.email=root@trygvis.io", + "--certificatesresolvers.linode.acme.storage=/letsencrypt/acme.json", + + # There doesn't seem to be a way to define a specific + # serversTransport through the CLI or lables, to here backend + # certificate checks are globally disabled. + "--serverstransport.insecureskipverify", + ] + + dynamic "labels" { + for_each = [ + { label = "traefik.enable", value = "true" }, + { label = "traefik.http.routers.traefik.service", value = "api@internal" }, + { label = "traefik.http.routers.traefik.rule", value = "Host(`${local.host}`)" }, + { label = "traefik.http.routers.traefik.entrypoints", value = "websecure" }, + { label = "traefik.http.routers.traefik.tls.certresolver", value = "linode" }, + ] + content { + label = labels.value["label"] + value = labels.value["value"] + } + } + + env = [ + "LINODE_TOKEN=${data.sops_file_entry.linode_token.data}" + ] + + mounts { + source = "/etc/docker-service/traefik/letsencrypt" + target = "/letsencrypt" + type = "bind" + read_only = false + } + + mounts { + source = "/var/run/docker.sock" + target = "/var/run/docker.sock" + type = "bind" + read_only = true + } + + depends_on = [ + resource.null_resource.letsencrypt, + ] +} + +locals { + path = "/etc/docker-service/traefik/letsencrypt" +} + +resource "null_resource" "letsencrypt" { + triggers = { + path = local.path + } + + provisioner "local-exec" { + command = "ssh ${local.host} sudo mkdir -p ${local.path}" + } +} diff --git a/terraform/grafana/.terraform.lock.hcl b/terraform/hash-grafana/.terraform.lock.hcl index 4362198..3242795 100644 --- a/terraform/grafana/.terraform.lock.hcl +++ b/terraform/hash-grafana/.terraform.lock.hcl @@ -43,24 +43,24 @@ provider "registry.terraform.io/hashicorp/random" { } provider "registry.terraform.io/kreuzwerker/docker" { - version = "2.24.0" - constraints = "2.24.0" + version = "3.0.2" + constraints = "3.0.2" hashes = [ - "h1:1z0/qA77T3PS/1m4vRO8UgWjHjk5/v+f3JfGbMyzX18=", - "zh:181fefd55c8eb75efe9815c43fdd76422b57951ef53b5d5f19273a00fdf0e2e2", - "zh:2ec84e029d169f188be2addf7f45c2555f226f67d4b6fb66c1749ed5b2c4a76a", - "zh:6f5cf945148485f57b919d31a30f1a5a93d45f4e8edfdb0b80b22258d51795d8", - "zh:8d00c2c459a48453f52a00a8d1ffdb7bcf72fe4b3b09ffcfd52218c4646fa7fa", - "zh:9bd6e06601e0a972b9ce01150e32e76b76b4caf1d9798daf4cf16d06e2a8d4a3", - "zh:af72591132dc8cd338f293e458403851e6b8a6ac4c4d25a3268940f9763df7aa", - "zh:c4a47c5c7ad2ff1fc5212e69c5ef837a127346264e46ce7b5d13362545e4aa70", - "zh:c6d68f33efcd3372331ed0d58ec49e8b01ddc132934b14d2d45977076950e4b3", - "zh:db228855ae7235095d367f3597719747e5be0dd9ce2206ea02062560b518c08a", - "zh:e8d6ce89642925f2e813d0b829bd5562582de37eaa39351e231ab474383e703a", - "zh:ec83d8c86a918d25eb824cc99f98924ef8949eb69aa40cb5ff2db24369e52d9c", - "zh:ee0032d3d86adeeca7fdd4922bb8db87dbb5cd0093c054ff8efe2260de0b624c", - "zh:f033b70f342f32eeb98c213e6fc7098d7afd22b3146a5cb6173c128b0e86d732", - "zh:f1bc3a2c4f152f8adc9a1f9c852496232ef31073b149945756c13bc9688cf08b", + "h1:cT2ccWOtlfKYBUE60/v2/4Q6Stk1KYTNnhxSck+VPlU=", + "zh:15b0a2b2b563d8d40f62f83057d91acb02cd0096f207488d8b4298a59203d64f", + "zh:23d919de139f7cd5ebfd2ff1b94e6d9913f0977fcfc2ca02e1573be53e269f95", + "zh:38081b3fe317c7e9555b2aaad325ad3fa516a886d2dfa8605ae6a809c1072138", + "zh:4a9c5065b178082f79ad8160243369c185214d874ff5048556d48d3edd03c4da", + "zh:5438ef6afe057945f28bce43d76c4401254073de01a774760169ac1058830ac2", + "zh:60b7fadc287166e5c9873dfe53a7976d98244979e0ab66428ea0dea1ebf33e06", + "zh:61c5ec1cb94e4c4a4fb1e4a24576d5f39a955f09afb17dab982de62b70a9bdd1", + "zh:a38fe9016ace5f911ab00c88e64b156ebbbbfb72a51a44da3c13d442cd214710", + "zh:c2c4d2b1fd9ebb291c57f524b3bf9d0994ff3e815c0cd9c9bcb87166dc687005", + "zh:d567bb8ce483ab2cf0602e07eae57027a1a53994aba470fa76095912a505533d", + "zh:e83bf05ab6a19dd8c43547ce9a8a511f8c331a124d11ac64687c764ab9d5a792", + "zh:e90c934b5cd65516fbcc454c89a150bfa726e7cf1fe749790c7480bbeb19d387", + "zh:f05f167d2eaf913045d8e7b88c13757e3cf595dd5cd333057fdafc7c4b7fed62", + "zh:fcc9c1cea5ce85e8bcb593862e699a881bd36dffd29e2e367f82d15368659c3d", ] } diff --git a/terraform/hash-grafana/backend.tf b/terraform/hash-grafana/backend.tf new file mode 100644 index 0000000..b06355d --- /dev/null +++ b/terraform/hash-grafana/backend.tf @@ -0,0 +1,16 @@ +# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa +terraform { + required_version = "~> 1.9.5" + + backend "s3" { + bucket = "terraform-a6726272-73ff-11ed-8bdd-c79eb8376e05" + key = "hash-grafana/terraform.tfstate" + skip_region_validation = true + skip_credentials_validation = true + skip_metadata_api_check = true + skip_requesting_account_id = true + skip_s3_checksum = true + region = "eu-central-1" + endpoints = { s3 : "https://eu-central-1.linodeobjects.com" } + } +} diff --git a/terraform/grafana/grafana.tf b/terraform/hash-grafana/grafana.tf index 7cda977..b425e72 100644 --- a/terraform/grafana/grafana.tf +++ b/terraform/hash-grafana/grafana.tf @@ -1,5 +1,5 @@ resource "docker_image" "grafana" { - name = "grafana/grafana-oss:10.1.5" + name = "grafana/grafana-oss:11.2.2" } resource "docker_volume" "grafana" { @@ -19,14 +19,14 @@ resource "docker_container" "grafana" { } networks_advanced { - name = data.docker_network.private.name + name = data.docker_network.dn42.name } dynamic "labels" { for_each = [ { label = "traefik.enable", value = "true" }, { label = "traefik.docker.network", value = data.docker_network.traefik.name }, - { label = "traefik.http.routers.grafana.rule", value = "Host(`grafana.vpn.trygvis.io`)" }, + { label = "traefik.http.routers.grafana.rule", value = "Host(`grafana.trygvis.io`)" }, { label = "traefik.http.routers.grafana.entrypoints", value = "websecure" }, { label = "traefik.http.routers.grafana.tls.certresolver", value = "linode" }, ] @@ -38,7 +38,7 @@ resource "docker_container" "grafana" { env = [ "GF_DATABASE_TYPE=postgres", - "GF_DATABASE_HOST=[fdf3:aad9:a885:b3a::1]", + "GF_DATABASE_HOST=knot.dn42.trygvis.io", "GF_DATABASE_DATABASE=${postgresql_database.grafana.name}", "GF_DATABASE_USER=${postgresql_role.grafana.name}", "GF_DATABASE_PASSWORD=${postgresql_role.grafana.password}", @@ -47,5 +47,6 @@ resource "docker_container" "grafana" { volumes { volume_name = docker_volume.grafana.name container_path = "/var/lib/grafana" + read_only = false } } diff --git a/terraform/grafana/main.tf b/terraform/hash-grafana/main.tf index cb9b920..043b778 100644 --- a/terraform/grafana/main.tf +++ b/terraform/hash-grafana/main.tf @@ -1,10 +1,8 @@ terraform { - required_version = "~> 1.3.5" - required_providers { docker = { source = "kreuzwerker/docker" - version = "2.24.0" + version = "3.0.2" } postgresql = { source = "cyrilgdn/postgresql" @@ -21,8 +19,12 @@ terraform { } } +locals { + host = "hash.trygvis.io" +} + provider "docker" { - host = "ssh://conflatorio.vpn.trygvis.io" + host = "ssh://${local.host}" } data "sops_file_entry" "knot_pdb_terraform_password" { @@ -42,10 +44,6 @@ data "docker_network" "traefik" { name = "traefik" } -data "docker_network" "public" { - name = "public" -} - -data "docker_network" "private" { - name = "private" +data "docker_network" "dn42" { + name = "dn42" } diff --git a/terraform/grafana/pdb.tf b/terraform/hash-grafana/pdb.tf index e2a59cd..e2a59cd 100644 --- a/terraform/grafana/pdb.tf +++ b/terraform/hash-grafana/pdb.tf diff --git a/terraform/hash-grafana/terragrunt.hcl b/terraform/hash-grafana/terragrunt.hcl new file mode 100644 index 0000000..e147285 --- /dev/null +++ b/terraform/hash-grafana/terragrunt.hcl @@ -0,0 +1,3 @@ +include "root" { + path = find_in_parent_folders() +} diff --git a/terraform/hash-prometheus/.terraform.lock.hcl b/terraform/hash-prometheus/.terraform.lock.hcl new file mode 100644 index 0000000..52de25e --- /dev/null +++ b/terraform/hash-prometheus/.terraform.lock.hcl @@ -0,0 +1,123 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/cyrilgdn/postgresql" { + version = "1.21.0" + constraints = "1.21.0" + hashes = [ + "h1:v7X6z6j8Uo07+QJPuO3EVM8N1uy6t2k+1GiRGioOPGc=", + "zh:17e3d204dabc116276c763bb0cd159aa315789d3b0bcd3b8aede935509960ab6", + "zh:1a7e5ac1921afdb3b12a49714c5f446a7604bfa1eb7bd9c123d607f8cbda45e4", + "zh:24a880623e30928ee866c84016b1db4e0458764c7a547b808e2d398e90456d42", + "zh:255c6162d35ace6a313a50c4ceb5452bd5582d7bb097a44e75ac4901e635ca13", + "zh:281ab48b69d0852b5138fe5ea2301ff7fdff30748f1f7878ac837c71622d3f7b", + "zh:3d4e0ae2809e743272e5d2640b64354c48140e225c2ba6f1a211700ea70e0754", + "zh:4f4df290e3ff626d8b274c624852d21d194a397a7f580ebe0cbf0ff64dd8fa31", + "zh:5997ce8f7cbcd7ff5a443d037b83857b17b64be928e9d9338dd494466733df60", + "zh:a05f0b65b0abf4488cdaf7b239206940940be77fd51f458f2a0986c6a17436aa", + "zh:aeb6c6da639abb6126f38be90a7bc428f925461bf599388ff092e059e0bb1a94", + "zh:d30bb053b6000c32cc8d03da231c30eaecddd926200adf2e9ad9c0186c2ad1ad", + "zh:d978827683b324c75141fa80ebc28dcaf181acd0be0a47b1e5f9579a72a08151", + "zh:f51fae9206361cbe865e30b06d106270d6acf7ece0550953b0d6b55afe6be9ba", + "zh:fa49a2702c529865c20f57185d6dd41072fdd9a13ac1a49e30eb88605c31af7a", + ] +} + +provider "registry.terraform.io/hashicorp/local" { + version = "2.5.2" + hashes = [ + "h1:JlMZD6nYqJ8sSrFfEAH0Vk/SL8WLZRmFaMUF9PJK5wM=", + "zh:136299545178ce281c56f36965bf91c35407c11897f7082b3b983d86cb79b511", + "zh:3b4486858aa9cb8163378722b642c57c529b6c64bfbfc9461d940a84cd66ebea", + "zh:4855ee628ead847741aa4f4fc9bed50cfdbf197f2912775dd9fe7bc43fa077c0", + "zh:4b8cd2583d1edcac4011caafe8afb7a95e8110a607a1d5fb87d921178074a69b", + "zh:52084ddaff8c8cd3f9e7bcb7ce4dc1eab00602912c96da43c29b4762dc376038", + "zh:71562d330d3f92d79b2952ffdda0dad167e952e46200c767dd30c6af8d7c0ed3", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:805f81ade06ff68fa8b908d31892eaed5c180ae031c77ad35f82cb7a74b97cf4", + "zh:8b6b3ebeaaa8e38dd04e56996abe80db9be6f4c1df75ac3cccc77642899bd464", + "zh:ad07750576b99248037b897de71113cc19b1a8d0bc235eb99173cc83d0de3b1b", + "zh:b9f1c3bfadb74068f5c205292badb0661e17ac05eb23bfe8bd809691e4583d0e", + "zh:cc4cbcd67414fefb111c1bf7ab0bc4beb8c0b553d01719ad17de9a047adff4d1", + ] +} + +provider "registry.terraform.io/hashicorp/null" { + version = "3.2.3" + hashes = [ + "h1:+AnORRgFbRO6qqcfaQyeX80W0eX3VmjadjnUFUJTiXo=", + "zh:22d062e5278d872fe7aed834f5577ba0a5afe34a3bdac2b81f828d8d3e6706d2", + "zh:23dead00493ad863729495dc212fd6c29b8293e707b055ce5ba21ee453ce552d", + "zh:28299accf21763ca1ca144d8f660688d7c2ad0b105b7202554ca60b02a3856d3", + "zh:55c9e8a9ac25a7652df8c51a8a9a422bd67d784061b1de2dc9fe6c3cb4e77f2f", + "zh:756586535d11698a216291c06b9ed8a5cc6a4ec43eee1ee09ecd5c6a9e297ac1", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:9d5eea62fdb587eeb96a8c4d782459f4e6b73baeece4d04b4a40e44faaee9301", + "zh:a6355f596a3fb8fc85c2fb054ab14e722991533f87f928e7169a486462c74670", + "zh:b5a65a789cff4ada58a5baffc76cb9767dc26ec6b45c00d2ec8b1b027f6db4ed", + "zh:db5ab669cf11d0e9f81dc380a6fdfcac437aea3d69109c7aef1a5426639d2d65", + "zh:de655d251c470197bcbb5ac45d289595295acb8f829f6c781d4a75c8c8b7c7dd", + "zh:f5c68199f2e6076bce92a12230434782bf768103a427e9bb9abee99b116af7b5", + ] +} + +provider "registry.terraform.io/hashicorp/random" { + version = "3.5.1" + constraints = "3.5.1" + hashes = [ + "h1:VSnd9ZIPyfKHOObuQCaKfnjIHRtR7qTw19Rz8tJxm+k=", + "zh:04e3fbd610cb52c1017d282531364b9c53ef72b6bc533acb2a90671957324a64", + "zh:119197103301ebaf7efb91df8f0b6e0dd31e6ff943d231af35ee1831c599188d", + "zh:4d2b219d09abf3b1bb4df93d399ed156cadd61f44ad3baf5cf2954df2fba0831", + "zh:6130bdde527587bbe2dcaa7150363e96dbc5250ea20154176d82bc69df5d4ce3", + "zh:6cc326cd4000f724d3086ee05587e7710f032f94fc9af35e96a386a1c6f2214f", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:b6d88e1d28cf2dfa24e9fdcc3efc77adcdc1c3c3b5c7ce503a423efbdd6de57b", + "zh:ba74c592622ecbcef9dc2a4d81ed321c4e44cddf7da799faa324da9bf52a22b2", + "zh:c7c5cde98fe4ef1143bd1b3ec5dc04baf0d4cc3ca2c5c7d40d17c0e9b2076865", + "zh:dac4bad52c940cd0dfc27893507c1e92393846b024c5a9db159a93c534a3da03", + "zh:de8febe2a2acd9ac454b844a4106ed295ae9520ef54dc8ed2faf29f12716b602", + "zh:eab0d0495e7e711cca367f7d4df6e322e6c562fc52151ec931176115b83ed014", + ] +} + +provider "registry.terraform.io/kreuzwerker/docker" { + version = "3.0.2" + constraints = "3.0.2" + hashes = [ + "h1:cT2ccWOtlfKYBUE60/v2/4Q6Stk1KYTNnhxSck+VPlU=", + "zh:15b0a2b2b563d8d40f62f83057d91acb02cd0096f207488d8b4298a59203d64f", + "zh:23d919de139f7cd5ebfd2ff1b94e6d9913f0977fcfc2ca02e1573be53e269f95", + "zh:38081b3fe317c7e9555b2aaad325ad3fa516a886d2dfa8605ae6a809c1072138", + "zh:4a9c5065b178082f79ad8160243369c185214d874ff5048556d48d3edd03c4da", + "zh:5438ef6afe057945f28bce43d76c4401254073de01a774760169ac1058830ac2", + "zh:60b7fadc287166e5c9873dfe53a7976d98244979e0ab66428ea0dea1ebf33e06", + "zh:61c5ec1cb94e4c4a4fb1e4a24576d5f39a955f09afb17dab982de62b70a9bdd1", + "zh:a38fe9016ace5f911ab00c88e64b156ebbbbfb72a51a44da3c13d442cd214710", + "zh:c2c4d2b1fd9ebb291c57f524b3bf9d0994ff3e815c0cd9c9bcb87166dc687005", + "zh:d567bb8ce483ab2cf0602e07eae57027a1a53994aba470fa76095912a505533d", + "zh:e83bf05ab6a19dd8c43547ce9a8a511f8c331a124d11ac64687c764ab9d5a792", + "zh:e90c934b5cd65516fbcc454c89a150bfa726e7cf1fe749790c7480bbeb19d387", + "zh:f05f167d2eaf913045d8e7b88c13757e3cf595dd5cd333057fdafc7c4b7fed62", + "zh:fcc9c1cea5ce85e8bcb593862e699a881bd36dffd29e2e367f82d15368659c3d", + ] +} + +provider "registry.terraform.io/lokkersp/sops" { + version = "0.6.10" + constraints = "0.6.10" + hashes = [ + "h1:atU8NIBxpNTWY+qBubvEOfjOn4K1aCDoq1iUFocgIHQ=", + "zh:0f053a26392a581b1f1ce6316cb7ed8ec4cc75e7f5f1cf7cfd45050b6b3c87ea", + "zh:207bb96c4471fce9aeb1b3c217d772692c3d865d294cf4d2501dad41de36a15e", + "zh:28506e8f1f3b9eaa95d99043440328044ee6340143535e5751538328a529d001", + "zh:3cae3bcea9e35fdc5b3f2af1b4580cd625c996448ad0c676c772260e46b25289", + "zh:3e44daaf82986c2b0028aeb17b867f3c68ed5dd8ac8625ba0406cf2a5fd3d92e", + "zh:457fb8ca2e677af24f9a4bdd8b613b1d7b604ad7133541657e5757c19268da71", + "zh:473d727c228f021a3df8cc8dcc6231ad7f90ed63f9e47c36b597d591e76228da", + "zh:48c4c1df39fd76ec8bd5fe9ac70cdc0927ac8be95582dbe46458b3442ce0fcd9", + "zh:728b19cb5c07e5e9d8b78fd94cc57d4c13582ecd24b7eb7c4cc2bf73b12fe4d1", + "zh:c51ed9af591779bb0910b82addeebb10f53428b994f8db653dd1dedcec60916c", + "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", + ] +} diff --git a/terraform/hash-prometheus/backend.tf b/terraform/hash-prometheus/backend.tf new file mode 100644 index 0000000..d531b8d --- /dev/null +++ b/terraform/hash-prometheus/backend.tf @@ -0,0 +1,16 @@ +# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa +terraform { + required_version = "~> 1.9.5" + + backend "s3" { + bucket = "terraform-a6726272-73ff-11ed-8bdd-c79eb8376e05" + key = "hash-prometheus/terraform.tfstate" + skip_region_validation = true + skip_credentials_validation = true + skip_metadata_api_check = true + skip_requesting_account_id = true + skip_s3_checksum = true + region = "eu-central-1" + endpoints = { s3 : "https://eu-central-1.linodeobjects.com" } + } +} diff --git a/terraform/hash-prometheus/main.tf b/terraform/hash-prometheus/main.tf new file mode 100644 index 0000000..cbf843e --- /dev/null +++ b/terraform/hash-prometheus/main.tf @@ -0,0 +1,36 @@ +terraform { + required_providers { + docker = { + source = "kreuzwerker/docker" + version = "3.0.2" + } + postgresql = { + source = "cyrilgdn/postgresql" + version = "1.21.0" + } + random = { + source = "hashicorp/random" + version = "3.5.1" + } + sops = { + source = "lokkersp/sops" + version = "0.6.10" + } + } +} + +locals { + host = "hash.trygvis.io" +} + +provider "docker" { + host = "ssh://${local.host}" +} + +data "docker_network" "traefik" { + name = "traefik" +} + +data "docker_network" "dn42" { + name = "dn42" +} diff --git a/terraform/hash-prometheus/play-config.yml b/terraform/hash-prometheus/play-config.yml new file mode 100644 index 0000000..92ec3e6 --- /dev/null +++ b/terraform/hash-prometheus/play-config.yml @@ -0,0 +1,17 @@ +- hosts: hash + tasks: + - become: yes + name: mkdir /etc/docker-service/prometheus + file: + path: /etc/docker-service/prometheus + state: directory + + - become: yes + name: cp /etc/docker-service/prometheus/prometheus.yml + register: config + copy: + src: prometheus.yml + dest: /etc/docker-service/prometheus/prometheus.yml + + - shell: docker kill --signal HUP prometheus + when: config.changed diff --git a/terraform/hash-prometheus/prometheus.tf b/terraform/hash-prometheus/prometheus.tf new file mode 100644 index 0000000..09df3ee --- /dev/null +++ b/terraform/hash-prometheus/prometheus.tf @@ -0,0 +1,70 @@ +data "docker_registry_image" "prometheus" { + name = "prom/prometheus:v2.53.2" +} + +resource "docker_image" "prometheus" { + name = data.docker_registry_image.prometheus.name + pull_triggers = [data.docker_registry_image.prometheus.sha256_digest] +} + +resource "docker_volume" "prometheus" { + name = "prometheus" +} + +resource "docker_container" "prometheus" { + image = docker_image.prometheus.image_id + name = "prometheus" + must_run = true + + env = [ + ] + + command = [ +#"/bin/prometheus", + "--config.file=/etc/prometheus/prometheus.yml", + "--storage.tsdb.path=/prometheus", + "--web.console.libraries=/usr/share/prometheus/console_libraries", + "--web.console.templates=/usr/share/prometheus/consoles", + "--storage.tsdb.retention.time=100y", + ] + + networks_advanced { + name = data.docker_network.dn42.name + } + + # networks_advanced { + # name = data.docker_network.traefik.name + # } + + # dynamic "labels" { + # for_each = [ + # { label = "traefik.enable", value = "true" }, + # { label = "traefik.docker.network", value = data.docker_network.traefik.name }, + # { label = "traefik.http.routers.prometheus.rule", value = "Host(`prometheus.trygvis.io`)" }, + # { label = "traefik.http.routers.prometheus.entrypoints", value = "websecure" }, + # { label = "traefik.http.routers.prometheus.tls.certresolver", value = "linode" }, + # ] + # content { + # label = labels.value["label"] + # value = labels.value["value"] + # } + # } + + mounts { + source = local.path + target = "/etc/prometheus" + type = "bind" + read_only = false + } + + volumes { + volume_name = docker_volume.prometheus.name + read_only = false + container_path = "/prometheus" + } + +} + +locals { + path = "/etc/docker-service/prometheus" +} diff --git a/terraform/hash-prometheus/prometheus.yml b/terraform/hash-prometheus/prometheus.yml new file mode 100644 index 0000000..9c0ede7 --- /dev/null +++ b/terraform/hash-prometheus/prometheus.yml @@ -0,0 +1,91 @@ +global: + scrape_interval: 60s + +scrape_configs: + - job_name: node + scrape_interval: 30s + static_configs: + - targets: + - "conflatorio.dn42.trygvis.io:9100" + - "coregonus.dn42.trygvis.io:9100" + - "hash.dn42.trygvis.io:9100" + - "knot.dn42.trygvis.io:9100" + - "lhn2pi.dn42.trygvis.io:9100" + + - job_name: bird + scrape_interval: 30s + static_configs: + - targets: + - "coregonus.dn42.trygvis.io:9324" + - "hash.dn42.trygvis.io:9324" + - "knot.dn42.trygvis.io:9324" + - "lhn2pi.dn42.trygvis.io:9324" + + - job_name: libvirt + scrape_interval: 30s + static_configs: + - targets: + - "conflatorio.dn42.trygvis.io:9177" + - "hash.dn42.trygvis.io:9177" + + - job_name: snmp_kv24_ap + scrape_interval: 60s + static_configs: + - targets: + - "192.168.10.20" + - "192.168.10.21" + - "192.168.10.22" + - "192.168.10.23" + - "192.168.10.25" + - "192.168.10.26" + metrics_path: /snmp + params: + auth: [public_v2] + module: + - if_mib + - ubiquiti_unifi + relabel_configs: + - source_labels: [__address__] + target_label: __param_target + - source_labels: [__param_target] + target_label: instance + - target_label: __address__ + replacement: "coregonus.dn42.trygvis.io:9116" + + - job_name: snmp_kv24_sw + scrape_interval: 60s + static_configs: + - targets: + - "192.168.10.10" + - "192.168.10.11" + - "192.168.10.12" + metrics_path: /snmp + params: + auth: [public_v2] + module: + - if_mib + relabel_configs: + - source_labels: [__address__] + target_label: __param_target + - source_labels: [__param_target] + target_label: instance + - target_label: __address__ + replacement: "coregonus.dn42.trygvis.io:9116" + + - job_name: snmp_kv24_router + scrape_interval: 60s + static_configs: + - targets: + - "192.168.10.1" + metrics_path: /snmp + params: + auth: [public_v2] + module: + - if_mib + relabel_configs: + - source_labels: [__address__] + target_label: __param_target + - source_labels: [__param_target] + target_label: instance + - target_label: __address__ + replacement: "coregonus.dn42.trygvis.io:9116" diff --git a/terraform/hash-prometheus/terragrunt.hcl b/terraform/hash-prometheus/terragrunt.hcl new file mode 100644 index 0000000..e147285 --- /dev/null +++ b/terraform/hash-prometheus/terragrunt.hcl @@ -0,0 +1,3 @@ +include "root" { + path = find_in_parent_folders() +} diff --git a/terraform/ipam6/ipam6.tf b/terraform/ipam6/ipam6.tf index a41a6be..a077e98 100644 --- a/terraform/ipam6/ipam6.tf +++ b/terraform/ipam6/ipam6.tf @@ -27,8 +27,8 @@ output "networks" { prefix = "64" hosts = { node1 = { - address : "fdb1:4242:3538:2002::" - prefix : "64" + address : "fdb1:4242:3538:2002::ffff" + prefix : "128" } } } @@ -38,8 +38,8 @@ output "networks" { prefix = "64" hosts = { node2 = { - address : "fdb1:4242:3538:2003::" - prefix : "64" + address : "fdb1:4242:3538:2003::ffff" + prefix : "128" } } } @@ -50,7 +50,7 @@ output "networks" { hosts = { knot = { address : "fdb1:4242:3538:2004::ffff" - prefix : "64" + prefix : "128" } } } @@ -59,12 +59,8 @@ output "networks" { address = "fdb1:4242:3538:2005::" prefix = "64" hosts = { - coregonus-ix = { + coregonus = { address : "fdb1:4242:3538:2005::ffff" - prefix : "64" - } - danneri = { - address : "fdb1:4242:3538:2005:9422:d355:95b7:f170" prefix : "128" } } @@ -76,6 +72,17 @@ output "networks" { hosts = { } } + kv24_pub = { + range = "2a01:799:111d:1801::/64" + address = "2a01:799:111d:1801::" + prefix = "64" + hosts = { + homeassistant = { + address : "2a01:799:111d:1801:e0d7:757e:4080:a508" + prefix : "128" + } + } + } kv24_dn42 = { range = "fdb1:4242:3538:2006::/64" address = "fdb1:4242:3538:2006::" @@ -83,15 +90,26 @@ output "networks" { hosts = { kv24ix = { address : "fdb1:4242:3538:2006::ffff" - prefix : "64" + prefix : "128" } } } - unused_2007 = { + hash_dn42 = { range = "fdb1:4242:3538:2007::/64" address = "fdb1:4242:3538:2007::" prefix = "64" hosts = { + hash = { + address : "fdb1:4242:3538:2007::ffff" + prefix : "128" + } + } + } + hash_docker_dn42 = { + range = "fdb1:4242:3538:2007:1001::/112" + address = "fdb1:4242:3538:2007:1001::" + prefix = "112" + hosts = { } } lhn2_dn42 = { @@ -101,23 +119,48 @@ output "networks" { hosts = { lhn2pi = { address : "fdb1:4242:3538:2008::ffff" - prefix : "64" + prefix : "128" } conflatorio = { address : "fdb1:4242:3538:2008:8042:32ff:fe0c:7161" prefix : "128" } + danneri = { + address : "fdb1:4242:3538:2008:9422:d355:95b7:f170" + prefix : "128" + } + unifi = { + address : "fdb1:4242:3538:2008:5054:ff:fe4d:96c" + prefix : "128" + } } } - hash_dn42 = { - range = "fdb1:4242:3538:2009::/64" - address = "fdb1:4242:3538:2009::" - prefix = "64" + danneri_cluster = { + range = "fdb1:4242:3538:3009::/112" + address = "fdb1:4242:3538:3009::" + prefix = "112" + hosts = { + } + } + danneri_service = { + range = "fdb1:4242:3538:300a::/100" + address = "fdb1:4242:3538:300a::" + prefix = "100" + hosts = { + } + } + k8s = { + range = "fdb1:4242:3538:3000::/52" + address = "fdb1:4242:3538:3000::" + prefix = "52" + hosts = { + } + } + danneri_service2 = { + range = "fdb1:4242:3538:300a::/112" + address = "fdb1:4242:3538:300a::" + prefix = "112" hosts = { - hash = { - address : "fdb1:4242:3538:2009::ffff" - prefix : "64" - } } } dn42 = { @@ -133,40 +176,48 @@ output "networks" { output "hosts" { value = { node1 = { - address : "fdb1:4242:3538:2002::" - prefix : "64" + address : "fdb1:4242:3538:2002::ffff" + prefix : "128" } node2 = { - address : "fdb1:4242:3538:2003::" - prefix : "64" + address : "fdb1:4242:3538:2003::ffff" + prefix : "128" } knot = { address : "fdb1:4242:3538:2004::ffff" - prefix : "64" + prefix : "128" } - coregonus-ix = { + coregonus = { address : "fdb1:4242:3538:2005::ffff" - prefix : "64" + prefix : "128" } - danneri = { - address : "fdb1:4242:3538:2005:9422:d355:95b7:f170" + homeassistant = { + address : "2a01:799:111d:1801:e0d7:757e:4080:a508" prefix : "128" } kv24ix = { address : "fdb1:4242:3538:2006::ffff" - prefix : "64" + prefix : "128" + } + hash = { + address : "fdb1:4242:3538:2007::ffff" + prefix : "128" } lhn2pi = { address : "fdb1:4242:3538:2008::ffff" - prefix : "64" + prefix : "128" } conflatorio = { address : "fdb1:4242:3538:2008:8042:32ff:fe0c:7161" prefix : "128" } - hash = { - address : "fdb1:4242:3538:2009::ffff" - prefix : "64" + danneri = { + address : "fdb1:4242:3538:2008:9422:d355:95b7:f170" + prefix : "128" + } + unifi = { + address : "fdb1:4242:3538:2008:5054:ff:fe4d:96c" + prefix : "128" } } } diff --git a/terraform/terragrunt.hcl b/terraform/terragrunt.hcl index 382cf17..8af2aca 100644 --- a/terraform/terragrunt.hcl +++ b/terraform/terragrunt.hcl @@ -3,14 +3,18 @@ generate "backend" { if_exists = "overwrite_terragrunt" contents = <<EOF terraform { + required_version = "~> 1.9.5" + backend "s3" { bucket = "terraform-a6726272-73ff-11ed-8bdd-c79eb8376e05" key = "${path_relative_to_include()}/terraform.tfstate" skip_region_validation = true skip_credentials_validation = true skip_metadata_api_check = true + skip_requesting_account_id = true + skip_s3_checksum = true region = "eu-central-1" - endpoint = "eu-central-1.linodeobjects.com" + endpoints = { s3 : "https://eu-central-1.linodeobjects.com" } } } EOF diff --git a/terraform/unifi-controller/.terraform.lock.hcl b/terraform/unifi-controller/.terraform.lock.hcl index 9fa446f..e61b376 100644 --- a/terraform/unifi-controller/.terraform.lock.hcl +++ b/terraform/unifi-controller/.terraform.lock.hcl @@ -24,24 +24,24 @@ provider "registry.terraform.io/cyrilgdn/postgresql" { } provider "registry.terraform.io/kreuzwerker/docker" { - version = "3.0.1" - constraints = "3.0.1" + version = "3.0.2" + constraints = "3.0.2" hashes = [ - "h1:X2wZHQoG54NmtojeFcX0PSJPelaIejQRqyyI2h+LjWg=", - "zh:02f60126ca16b344092df3c315296bf1a216c3b2a68eddb3c89fdfa5ea826118", - "zh:0d2ee9624a54dbc10538b0c4e296348641b9bfba1354b3f872e43f7ec69a75f2", - "zh:473d7427da8c9efc231266abc7fdc27fca5f9ee0bdfcdb9914f0a2886e3e23b8", - "zh:5f0189bcd0c944c001098cb17a23efa79df8f0eec8644a64fe0e4200983ba5b7", - "zh:6200319c41d6baad3f46701a4028412f8ae2496e29fc4fef9584cc71da5fbbe6", - "zh:650be621f2216b1240f148eae8fcf80ec57c35925e2b212db7c23a70b9e67e06", - "zh:72fcfa6207251105066a34f0ec6d27ecc658b565e84fa946da376dd1afadd265", - "zh:92fc352a2090d3d380c7c8e8bbdf6f99d93a0182701056bb1d2dbfd5049e8ca6", - "zh:a7e2ef666c2a7eb5661b06cfbd7635cb9543524e7bf6a3851dcf6eacc9950cc4", - "zh:a8604595e61e8919c51a8656800c8c64557f9a2bc00309315895b380f2e9be19", - "zh:caf65603a84b749d8f3af2ee47b66f7e21d481f981e2e1d1d59838751c5e3be4", - "zh:dad40c4e57da284e7f57b5c0cc9dfac3cb27b01d2f2436fbe3464f0a2111b262", - "zh:dc1b173dbcba9d74879b16f36f6d9e97ef62fbd6fca8db79ec4fe4ec69c0e2f3", - "zh:e506d04677383b6d62bd69d42dc9005e27a45ccc2efc6e0de607e1f8445981d2", + "h1:cT2ccWOtlfKYBUE60/v2/4Q6Stk1KYTNnhxSck+VPlU=", + "zh:15b0a2b2b563d8d40f62f83057d91acb02cd0096f207488d8b4298a59203d64f", + "zh:23d919de139f7cd5ebfd2ff1b94e6d9913f0977fcfc2ca02e1573be53e269f95", + "zh:38081b3fe317c7e9555b2aaad325ad3fa516a886d2dfa8605ae6a809c1072138", + "zh:4a9c5065b178082f79ad8160243369c185214d874ff5048556d48d3edd03c4da", + "zh:5438ef6afe057945f28bce43d76c4401254073de01a774760169ac1058830ac2", + "zh:60b7fadc287166e5c9873dfe53a7976d98244979e0ab66428ea0dea1ebf33e06", + "zh:61c5ec1cb94e4c4a4fb1e4a24576d5f39a955f09afb17dab982de62b70a9bdd1", + "zh:a38fe9016ace5f911ab00c88e64b156ebbbbfb72a51a44da3c13d442cd214710", + "zh:c2c4d2b1fd9ebb291c57f524b3bf9d0994ff3e815c0cd9c9bcb87166dc687005", + "zh:d567bb8ce483ab2cf0602e07eae57027a1a53994aba470fa76095912a505533d", + "zh:e83bf05ab6a19dd8c43547ce9a8a511f8c331a124d11ac64687c764ab9d5a792", + "zh:e90c934b5cd65516fbcc454c89a150bfa726e7cf1fe749790c7480bbeb19d387", + "zh:f05f167d2eaf913045d8e7b88c13757e3cf595dd5cd333057fdafc7c4b7fed62", + "zh:fcc9c1cea5ce85e8bcb593862e699a881bd36dffd29e2e367f82d15368659c3d", ] } diff --git a/terraform/unifi-controller/backend.tf b/terraform/unifi-controller/backend.tf index 5f2d6d0..bebc5a5 100644 --- a/terraform/unifi-controller/backend.tf +++ b/terraform/unifi-controller/backend.tf @@ -1,12 +1,16 @@ # Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa terraform { + required_version = "~> 1.9.5" + backend "s3" { bucket = "terraform-a6726272-73ff-11ed-8bdd-c79eb8376e05" key = "unifi-controller/terraform.tfstate" skip_region_validation = true skip_credentials_validation = true skip_metadata_api_check = true + skip_requesting_account_id = true + skip_s3_checksum = true region = "eu-central-1" - endpoint = "eu-central-1.linodeobjects.com" + endpoints = { s3 : "https://eu-central-1.linodeobjects.com" } } } diff --git a/terraform/unifi-controller/main.tf b/terraform/unifi-controller/main.tf index 55c133c..f93bc78 100644 --- a/terraform/unifi-controller/main.tf +++ b/terraform/unifi-controller/main.tf @@ -1,10 +1,8 @@ terraform { - required_version = "~> 1.3.5" - required_providers { docker = { source = "kreuzwerker/docker" - version = "3.0.1" + version = "3.0.2" } linode = { source = "linode/linode" @@ -22,15 +20,16 @@ terraform { } provider "docker" { - host = "ssh://conflatorio.vpn.trygvis.io" + host = "ssh://unifi.dn42.trygvis.io" } locals { domain_name = "unifi.vpn.trygvis.io" - public_ip = "fdb1:4242:3538:2001::ffff" + public_ip = module.ipam.hosts.unifi.address - docker_image_controller = "lscr.io/linuxserver/unifi-controller:8.0.24-mongoless" +# docker_image_controller = "lscr.io/linuxserver/unifi-controller:8.0.24-mongoless" + docker_image_controller = "lscr.io/linuxserver/unifi-network-application:8.5.6-ls68" docker_image_mongo = "mongo:7.0" mongo_database = "unifi" @@ -42,3 +41,7 @@ data "sops_file_entry" "mongo_password" { source_file = "sops.yml" data_key = "mongo_password" } + +module "ipam" { + source = "../ipam6" +} diff --git a/terraform/unifi-controller/mongo.tf b/terraform/unifi-controller/mongo.tf index 2b83691..f7c1950 100644 --- a/terraform/unifi-controller/mongo.tf +++ b/terraform/unifi-controller/mongo.tf @@ -1,6 +1,6 @@ -resource "docker_network" "unifi" { - name = "unifi" -} +# resource "docker_network" "unifi" { +# name = "unifi" +# } data "docker_registry_image" "mongo" { name = local.docker_image_mongo @@ -20,11 +20,11 @@ resource "docker_container" "unifi-mongo" { name = "unifi-mongo" hostname = "unifi-mongo" - networks_advanced { - name = docker_network.unifi.name - } +# networks_advanced { +# name = docker_network.unifi.name +# } - network_mode = "bridge" + network_mode = "host" volumes { volume_name = docker_volume.unifi-mongo.name diff --git a/terraform/unifi-controller/terragrunt.hcl b/terraform/unifi-controller/terragrunt.hcl index 5236c23..f378bf5 100644 --- a/terraform/unifi-controller/terragrunt.hcl +++ b/terraform/unifi-controller/terragrunt.hcl @@ -2,10 +2,6 @@ include "root" { path = find_in_parent_folders() } -dependency "docker" { - config_path = "../conflatorio-docker" -} - -# inputs = { -# vpc_id = dependency.docker.outputs.foo -# } +#dependency "ipam6" { +# config_path = "../ipam6" +#} diff --git a/terraform/unifi-controller/unifi.tf b/terraform/unifi-controller/unifi.tf index 4b0f1c6..4f1317f 100644 --- a/terraform/unifi-controller/unifi.tf +++ b/terraform/unifi-controller/unifi.tf @@ -1,34 +1,36 @@ -data "docker_network" "traefik" { - name = "traefik" -} +# data "docker_network" "traefik" { +# name = "traefik" +# } -data "docker_registry_image" "unifi-controller" { +data "docker_registry_image" "unifi-network-application" { name = local.docker_image_controller } -resource "docker_image" "unifi-controller" { - name = data.docker_registry_image.unifi-controller.name - pull_triggers = [data.docker_registry_image.unifi-controller.sha256_digest] +resource "docker_image" "unifi-network-application" { + name = data.docker_registry_image.unifi-network-application.name + pull_triggers = [data.docker_registry_image.unifi-network-application.sha256_digest] } -resource "docker_volume" "unifi-controller" { - name = "unifi-controller-new" +resource "docker_volume" "unifi-network-application" { + name = "unifi-network-application" } -resource "docker_container" "unifi-controller" { - image = docker_image.unifi-controller.image_id - name = "unifi-controller" - hostname = "unifi-controller" +resource "docker_container" "unifi-network-application" { + image = docker_image.unifi-network-application.image_id + name = "unifi-network-application" + hostname = "unifi-network-application" # privileged = true - # must_run = false + must_run = true - networks_advanced { - name = data.docker_network.traefik.name - } + network_mode = "host" - networks_advanced { - name = docker_network.unifi.name - } +# networks_advanced { +# name = data.docker_network.traefik.name +# } + +# networks_advanced { +# name = docker_network.unifi.name +# } dynamic "ports" { for_each = [ @@ -40,7 +42,8 @@ resource "docker_container" "unifi-controller" { { port = 8080, proto = "tcp" }, # Required for device communication # Public HTTP is handled by traefik - # { port = 8443, proto = "tcp" }, # Unifi web admin port + # Not anymore! + { port = 8443, proto = "tcp" }, # Unifi web admin port # Not used # { port = 8843, proto = "tcp" }, # Unifi guest portal HTTPS redirect port @@ -57,27 +60,27 @@ resource "docker_container" "unifi-controller" { } volumes { - volume_name = docker_volume.unifi-controller.name + volume_name = docker_volume.unifi-network-application.name read_only = false container_path = "/config" } - dynamic "labels" { - for_each = [ - { label = "traefik.enable", value = "true" }, - { label = "traefik.http.routers.unifi-controller.rule", value = "Host(`${local.domain_name}`)" }, - { label = "traefik.http.routers.unifi-controller.entrypoints", value = "websecure" }, - { label = "traefik.http.routers.unifi-controller.tls.certresolver", value = "linode" }, - { label = "traefik.http.services.unifi-controller.loadbalancer.server.port", value = "8443" }, - { label = "traefik.http.services.unifi-controller.loadbalancer.server.scheme", value = "https" }, - { label = "traefik.docker.network", value = "traefik" }, - # { label = "traefik.http.services.unifi-controller.loadbalancer.passHostHeader", value = "false" }, - ] - content { - label = labels.value["label"] - value = labels.value["value"] - } - } +# dynamic "labels" { +# for_each = [ +# { label = "traefik.enable", value = "true" }, +# { label = "traefik.http.routers.unifi-network-application.rule", value = "Host(`${local.domain_name}`)" }, +# { label = "traefik.http.routers.unifi-network-application.entrypoints", value = "websecure" }, +# { label = "traefik.http.routers.unifi-network-application.tls.certresolver", value = "linode" }, +# { label = "traefik.http.services.unifi-network-application.loadbalancer.server.port", value = "8443" }, +# { label = "traefik.http.services.unifi-network-application.loadbalancer.server.scheme", value = "https" }, +# { label = "traefik.docker.network", value = "traefik" }, +# # { label = "traefik.http.services.unifi-network-application.loadbalancer.passHostHeader", value = "false" }, +# ] +# content { +# label = labels.value["label"] +# value = labels.value["value"] +# } +# } env = [ "PUID=1000", @@ -86,7 +89,8 @@ resource "docker_container" "unifi-controller" { "MEM_LIMIT=default", "MONGO_USER=${local.mongo_username}", "MONGO_PASS=${local.mongo_password}", - "MONGO_HOST=${docker_container.unifi-mongo.hostname}", + #"MONGO_HOST=${docker_container.unifi-mongo.hostname}", + "MONGO_HOST=localhost", "MONGO_PORT=27017", "MONGO_DBNAME=${local.mongo_database}", ] |