diff options
Diffstat (limited to 'terraform')
-rw-r--r-- | terraform/conflatorio-docker/main.tf | 14 | ||||
-rw-r--r-- | terraform/conflatorio-docker/network.tf | 18 | ||||
-rw-r--r-- | terraform/conflatorio-docker/traefik.tf | 8 | ||||
-rw-r--r-- | terraform/conflatorio-prometheus/.terraform.lock.hcl | 104 | ||||
-rw-r--r-- | terraform/conflatorio-prometheus/backend.tf | 12 | ||||
-rw-r--r-- | terraform/conflatorio-prometheus/main.tf | 34 | ||||
-rw-r--r-- | terraform/conflatorio-prometheus/prometheus.tf | 66 | ||||
-rw-r--r-- | terraform/conflatorio-prometheus/terragrunt.hcl | 3 | ||||
-rw-r--r-- | terraform/dns/dn42.tf | 64 | ||||
-rw-r--r-- | terraform/dns/main.tf | 2 | ||||
-rw-r--r-- | terraform/dns/trygvis.tf | 76 | ||||
-rw-r--r-- | terraform/dns/vpn-cname.tf | 17 | ||||
-rw-r--r-- | terraform/dns/vpn.tf | 36 | ||||
-rw-r--r-- | terraform/grafana/grafana.tf | 4 | ||||
-rw-r--r-- | terraform/grafana/main.tf | 4 | ||||
-rw-r--r-- | terraform/ipam6/ipam6.tf | 172 | ||||
-rw-r--r-- | terraform/telegraf/conflatorio/vault.yml | 5 | ||||
-rw-r--r-- | terraform/terragrunt.hcl | 2 | ||||
-rw-r--r-- | terraform/unifi-controller/main.tf | 4 | ||||
-rw-r--r-- | terraform/unifi-controller/mongo.tf | 5 | ||||
-rw-r--r-- | terraform/unifi-controller/unifi.tf | 3 |
21 files changed, 605 insertions, 48 deletions
diff --git a/terraform/conflatorio-docker/main.tf b/terraform/conflatorio-docker/main.tf index 8a01be6..ad4e6fd 100644 --- a/terraform/conflatorio-docker/main.tf +++ b/terraform/conflatorio-docker/main.tf @@ -22,6 +22,16 @@ data "sops_file_entry" "linode_token" { data_key = "linode_token" } -output "foo" { - value = "foo!" +locals { + hs = module.ipam6.hosts + ns = module.ipam6.networks + public_ip = local.hs.conflatorio-ix.address + network_addr = local.ns.conflatorio_docker.address + network_range = local.ns.conflatorio_docker.prefix + private_network_addr = local.ns.conflatorio_docker_private.address + private_network_range = local.ns.conflatorio_docker_private.range +} + +module "ipam6" { + source = "../ipam6" } diff --git a/terraform/conflatorio-docker/network.tf b/terraform/conflatorio-docker/network.tf index 32e1bfb..8a839f5 100644 --- a/terraform/conflatorio-docker/network.tf +++ b/terraform/conflatorio-docker/network.tf @@ -4,6 +4,22 @@ resource "docker_network" "public" { ipv6 = true ipam_config { - subnet = "fdf3:aad9:a885:77dd:bbbb::/120" + subnet = "${local.network_addr}/${local.network_range}" + } + + ipam_config { + gateway = "172.22.0.1" + subnet = "172.22.0.0/16" + } +} + +# Internal shared network +resource "docker_network" "private" { + name = "private" + + ipv6 = true + + ipam_config { + subnet = "${local.private_network_addr}/${local.private_network_range}" } } diff --git a/terraform/conflatorio-docker/traefik.tf b/terraform/conflatorio-docker/traefik.tf index d15ac5c..cb5f2a0 100644 --- a/terraform/conflatorio-docker/traefik.tf +++ b/terraform/conflatorio-docker/traefik.tf @@ -12,6 +12,8 @@ resource "docker_container" "traefik" { privileged = false must_run = false + network_mode = "bridge" + networks_advanced { name = docker_network.traefik.name } @@ -23,20 +25,20 @@ resource "docker_container" "traefik" { ports { internal = 80 external = 80 - ip = "fdf3:aad9:a885:77dd::2" + ip = "${local.public_ip}" } ports { internal = 443 external = 443 - ip = "fdf3:aad9:a885:77dd::2" + ip = "${local.public_ip}" } # for buildfarm-server ports { internal = 8980 external = 8980 - ip = "fdf3:aad9:a885:77dd::2" + ip = "${local.public_ip}" } command = [ diff --git a/terraform/conflatorio-prometheus/.terraform.lock.hcl b/terraform/conflatorio-prometheus/.terraform.lock.hcl new file mode 100644 index 0000000..9e1ccff --- /dev/null +++ b/terraform/conflatorio-prometheus/.terraform.lock.hcl @@ -0,0 +1,104 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/cyrilgdn/postgresql" { + version = "1.21.0" + constraints = "1.21.0" + hashes = [ + "h1:v7X6z6j8Uo07+QJPuO3EVM8N1uy6t2k+1GiRGioOPGc=", + "zh:17e3d204dabc116276c763bb0cd159aa315789d3b0bcd3b8aede935509960ab6", + "zh:1a7e5ac1921afdb3b12a49714c5f446a7604bfa1eb7bd9c123d607f8cbda45e4", + "zh:24a880623e30928ee866c84016b1db4e0458764c7a547b808e2d398e90456d42", + "zh:255c6162d35ace6a313a50c4ceb5452bd5582d7bb097a44e75ac4901e635ca13", + "zh:281ab48b69d0852b5138fe5ea2301ff7fdff30748f1f7878ac837c71622d3f7b", + "zh:3d4e0ae2809e743272e5d2640b64354c48140e225c2ba6f1a211700ea70e0754", + "zh:4f4df290e3ff626d8b274c624852d21d194a397a7f580ebe0cbf0ff64dd8fa31", + "zh:5997ce8f7cbcd7ff5a443d037b83857b17b64be928e9d9338dd494466733df60", + "zh:a05f0b65b0abf4488cdaf7b239206940940be77fd51f458f2a0986c6a17436aa", + "zh:aeb6c6da639abb6126f38be90a7bc428f925461bf599388ff092e059e0bb1a94", + "zh:d30bb053b6000c32cc8d03da231c30eaecddd926200adf2e9ad9c0186c2ad1ad", + "zh:d978827683b324c75141fa80ebc28dcaf181acd0be0a47b1e5f9579a72a08151", + "zh:f51fae9206361cbe865e30b06d106270d6acf7ece0550953b0d6b55afe6be9ba", + "zh:fa49a2702c529865c20f57185d6dd41072fdd9a13ac1a49e30eb88605c31af7a", + ] +} + +provider "registry.terraform.io/hashicorp/null" { + version = "3.2.2" + hashes = [ + "h1:zT1ZbegaAYHwQa+QwIFugArWikRJI9dqohj8xb0GY88=", + "zh:3248aae6a2198f3ec8394218d05bd5e42be59f43a3a7c0b71c66ec0df08b69e7", + "zh:32b1aaa1c3013d33c245493f4a65465eab9436b454d250102729321a44c8ab9a", + "zh:38eff7e470acb48f66380a73a5c7cdd76cc9b9c9ba9a7249c7991488abe22fe3", + "zh:4c2f1faee67af104f5f9e711c4574ff4d298afaa8a420680b0cb55d7bbc65606", + "zh:544b33b757c0b954dbb87db83a5ad921edd61f02f1dc86c6186a5ea86465b546", + "zh:696cf785090e1e8cf1587499516b0494f47413b43cb99877ad97f5d0de3dc539", + "zh:6e301f34757b5d265ae44467d95306d61bef5e41930be1365f5a8dcf80f59452", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:913a929070c819e59e94bb37a2a253c228f83921136ff4a7aa1a178c7cce5422", + "zh:aa9015926cd152425dbf86d1abdbc74bfe0e1ba3d26b3db35051d7b9ca9f72ae", + "zh:bb04798b016e1e1d49bcc76d62c53b56c88c63d6f2dfe38821afef17c416a0e1", + "zh:c23084e1b23577de22603cff752e59128d83cfecc2e6819edadd8cf7a10af11e", + ] +} + +provider "registry.terraform.io/hashicorp/random" { + version = "3.5.1" + constraints = "3.5.1" + hashes = [ + "h1:VSnd9ZIPyfKHOObuQCaKfnjIHRtR7qTw19Rz8tJxm+k=", + "zh:04e3fbd610cb52c1017d282531364b9c53ef72b6bc533acb2a90671957324a64", + "zh:119197103301ebaf7efb91df8f0b6e0dd31e6ff943d231af35ee1831c599188d", + "zh:4d2b219d09abf3b1bb4df93d399ed156cadd61f44ad3baf5cf2954df2fba0831", + "zh:6130bdde527587bbe2dcaa7150363e96dbc5250ea20154176d82bc69df5d4ce3", + "zh:6cc326cd4000f724d3086ee05587e7710f032f94fc9af35e96a386a1c6f2214f", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:b6d88e1d28cf2dfa24e9fdcc3efc77adcdc1c3c3b5c7ce503a423efbdd6de57b", + "zh:ba74c592622ecbcef9dc2a4d81ed321c4e44cddf7da799faa324da9bf52a22b2", + "zh:c7c5cde98fe4ef1143bd1b3ec5dc04baf0d4cc3ca2c5c7d40d17c0e9b2076865", + "zh:dac4bad52c940cd0dfc27893507c1e92393846b024c5a9db159a93c534a3da03", + "zh:de8febe2a2acd9ac454b844a4106ed295ae9520ef54dc8ed2faf29f12716b602", + "zh:eab0d0495e7e711cca367f7d4df6e322e6c562fc52151ec931176115b83ed014", + ] +} + +provider "registry.terraform.io/kreuzwerker/docker" { + version = "2.24.0" + constraints = "2.24.0" + hashes = [ + "h1:1z0/qA77T3PS/1m4vRO8UgWjHjk5/v+f3JfGbMyzX18=", + "zh:181fefd55c8eb75efe9815c43fdd76422b57951ef53b5d5f19273a00fdf0e2e2", + "zh:2ec84e029d169f188be2addf7f45c2555f226f67d4b6fb66c1749ed5b2c4a76a", + "zh:6f5cf945148485f57b919d31a30f1a5a93d45f4e8edfdb0b80b22258d51795d8", + "zh:8d00c2c459a48453f52a00a8d1ffdb7bcf72fe4b3b09ffcfd52218c4646fa7fa", + "zh:9bd6e06601e0a972b9ce01150e32e76b76b4caf1d9798daf4cf16d06e2a8d4a3", + "zh:af72591132dc8cd338f293e458403851e6b8a6ac4c4d25a3268940f9763df7aa", + "zh:c4a47c5c7ad2ff1fc5212e69c5ef837a127346264e46ce7b5d13362545e4aa70", + "zh:c6d68f33efcd3372331ed0d58ec49e8b01ddc132934b14d2d45977076950e4b3", + "zh:db228855ae7235095d367f3597719747e5be0dd9ce2206ea02062560b518c08a", + "zh:e8d6ce89642925f2e813d0b829bd5562582de37eaa39351e231ab474383e703a", + "zh:ec83d8c86a918d25eb824cc99f98924ef8949eb69aa40cb5ff2db24369e52d9c", + "zh:ee0032d3d86adeeca7fdd4922bb8db87dbb5cd0093c054ff8efe2260de0b624c", + "zh:f033b70f342f32eeb98c213e6fc7098d7afd22b3146a5cb6173c128b0e86d732", + "zh:f1bc3a2c4f152f8adc9a1f9c852496232ef31073b149945756c13bc9688cf08b", + ] +} + +provider "registry.terraform.io/lokkersp/sops" { + version = "0.6.10" + constraints = "0.6.10" + hashes = [ + "h1:atU8NIBxpNTWY+qBubvEOfjOn4K1aCDoq1iUFocgIHQ=", + "zh:0f053a26392a581b1f1ce6316cb7ed8ec4cc75e7f5f1cf7cfd45050b6b3c87ea", + "zh:207bb96c4471fce9aeb1b3c217d772692c3d865d294cf4d2501dad41de36a15e", + "zh:28506e8f1f3b9eaa95d99043440328044ee6340143535e5751538328a529d001", + "zh:3cae3bcea9e35fdc5b3f2af1b4580cd625c996448ad0c676c772260e46b25289", + "zh:3e44daaf82986c2b0028aeb17b867f3c68ed5dd8ac8625ba0406cf2a5fd3d92e", + "zh:457fb8ca2e677af24f9a4bdd8b613b1d7b604ad7133541657e5757c19268da71", + "zh:473d727c228f021a3df8cc8dcc6231ad7f90ed63f9e47c36b597d591e76228da", + "zh:48c4c1df39fd76ec8bd5fe9ac70cdc0927ac8be95582dbe46458b3442ce0fcd9", + "zh:728b19cb5c07e5e9d8b78fd94cc57d4c13582ecd24b7eb7c4cc2bf73b12fe4d1", + "zh:c51ed9af591779bb0910b82addeebb10f53428b994f8db653dd1dedcec60916c", + "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", + ] +} diff --git a/terraform/conflatorio-prometheus/backend.tf b/terraform/conflatorio-prometheus/backend.tf new file mode 100644 index 0000000..9f2eed0 --- /dev/null +++ b/terraform/conflatorio-prometheus/backend.tf @@ -0,0 +1,12 @@ +# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa +terraform { + backend "s3" { + bucket = "terraform-a6726272-73ff-11ed-8bdd-c79eb8376e05" + key = "conflatorio-prometheus/terraform.tfstate" + skip_region_validation = true + skip_credentials_validation = true + skip_metadata_api_check = true + region = "eu-central-1" + endpoint = "eu-central-1.linodeobjects.com" + } +} diff --git a/terraform/conflatorio-prometheus/main.tf b/terraform/conflatorio-prometheus/main.tf new file mode 100644 index 0000000..f5c5a7f --- /dev/null +++ b/terraform/conflatorio-prometheus/main.tf @@ -0,0 +1,34 @@ +terraform { + required_version = "~> 1.3.5" + + required_providers { + docker = { + source = "kreuzwerker/docker" + version = "2.24.0" + } + postgresql = { + source = "cyrilgdn/postgresql" + version = "1.21.0" + } + random = { + source = "hashicorp/random" + version = "3.5.1" + } + sops = { + source = "lokkersp/sops" + version = "0.6.10" + } + } +} + +provider "docker" { + host = "ssh://conflatorio.vpn.trygvis.io" +} + +data "docker_network" "traefik" { + name = "traefik" +} + +data "docker_network" "private" { + name = "private" +} diff --git a/terraform/conflatorio-prometheus/prometheus.tf b/terraform/conflatorio-prometheus/prometheus.tf new file mode 100644 index 0000000..04dd406 --- /dev/null +++ b/terraform/conflatorio-prometheus/prometheus.tf @@ -0,0 +1,66 @@ +resource "docker_image" "prometheus" { + name = "prom/prometheus:v2.53.2" +} + +resource "docker_volume" "prometheus" { + name = "prometheus" +} + +resource "docker_container" "prometheus" { + image = docker_image.prometheus.image_id + name = "prometheus" + must_run = true + + env = [ + ] + + networks_advanced { + name = data.docker_network.private.name + } + + # networks_advanced { + # name = data.docker_network.traefik.name + # } + + # dynamic "labels" { + # for_each = [ + # { label = "traefik.enable", value = "true" }, + # { label = "traefik.docker.network", value = data.docker_network.traefik.name }, + # { label = "traefik.http.routers.prometheus.rule", value = "Host(`prometheus.trygvis.io`)" }, + # { label = "traefik.http.routers.prometheus.entrypoints", value = "websecure" }, + # { label = "traefik.http.routers.prometheus.tls.certresolver", value = "linode" }, + # ] + # content { + # label = labels.value["label"] + # value = labels.value["value"] + # } + # } + + mounts { + source = "${local.path}" + target = "/etc/prometheus" + type = "bind" + } + + volumes { + volume_name = docker_volume.prometheus.name + read_only = false + container_path = "/prometheus" + } + + depends_on = [ null_resource.mkdir ] +} + +locals { + path = "/etc/docker-service/prometheus" +} + +resource "null_resource" "mkdir" { + triggers = { + path = local.path + } + + provisioner "local-exec" { + command = "ssh conflatorio.vpn.trygvis.io sudo mkdir -p ${local.path}" + } +} diff --git a/terraform/conflatorio-prometheus/terragrunt.hcl b/terraform/conflatorio-prometheus/terragrunt.hcl new file mode 100644 index 0000000..e147285 --- /dev/null +++ b/terraform/conflatorio-prometheus/terragrunt.hcl @@ -0,0 +1,3 @@ +include "root" { + path = find_in_parent_folders() +} diff --git a/terraform/dns/dn42.tf b/terraform/dns/dn42.tf new file mode 100644 index 0000000..2390d5d --- /dev/null +++ b/terraform/dns/dn42.tf @@ -0,0 +1,64 @@ +# Generated from ansible data + +resource "linode_domain_record" "dn42-conflatorio" { + domain_id = linode_domain.root.id + name = "conflatorio.dn42" + record_type = "AAAA" + target = "fdb1:4242:3538:2008:8042:32ff:fe0c:7161" +} + +resource "linode_domain_record" "dn42-coregonus-ix" { + domain_id = linode_domain.root.id + name = "coregonus-ix.dn42" + record_type = "AAAA" + target = "fdb1:4242:3538:2005::ffff" +} + +resource "linode_domain_record" "dn42-danneri" { + domain_id = linode_domain.root.id + name = "danneri.dn42" + record_type = "AAAA" + target = "fdb1:4242:3538:2005:9422:d355:95b7:f170" +} + +resource "linode_domain_record" "dn42-hash" { + domain_id = linode_domain.root.id + name = "hash.dn42" + record_type = "AAAA" + target = "fdb1:4242:3538:2009::ffff" +} + +resource "linode_domain_record" "dn42-knot" { + domain_id = linode_domain.root.id + name = "knot.dn42" + record_type = "AAAA" + target = "fdb1:4242:3538:2004::ffff" +} + +resource "linode_domain_record" "dn42-kv24ix" { + domain_id = linode_domain.root.id + name = "kv24ix.dn42" + record_type = "AAAA" + target = "fdb1:4242:3538:2006::ffff" +} + +resource "linode_domain_record" "dn42-lhn2pi" { + domain_id = linode_domain.root.id + name = "lhn2pi.dn42" + record_type = "AAAA" + target = "fdb1:4242:3538:2008::ffff" +} + +resource "linode_domain_record" "dn42-node1" { + domain_id = linode_domain.root.id + name = "node1.dn42" + record_type = "AAAA" + target = "fdb1:4242:3538:2002::" +} + +resource "linode_domain_record" "dn42-node2" { + domain_id = linode_domain.root.id + name = "node2.dn42" + record_type = "AAAA" + target = "fdb1:4242:3538:2003::" +} diff --git a/terraform/dns/main.tf b/terraform/dns/main.tf index c67944e..753ef75 100644 --- a/terraform/dns/main.tf +++ b/terraform/dns/main.tf @@ -14,7 +14,7 @@ terraform { required_providers { linode = { version = "2.7.1" - source = "linode/linode" + source = "linode/linode" } } } diff --git a/terraform/dns/trygvis.tf b/terraform/dns/trygvis.tf index 01b6cec..608dd3e 100644 --- a/terraform/dns/trygvis.tf +++ b/terraform/dns/trygvis.tf @@ -17,6 +17,22 @@ resource "linode_domain_record" "root-a" { target = "176.58.112.84" } +resource "linode_domain_record" "root-mx" { + domain_id = linode_domain.root.id + name = "" + record_type = "MX" + target = "in1-smtp.messagingengine.com" + priority = 10 +} + +resource "linode_domain_record" "root-mx2" { + domain_id = linode_domain.root.id + name = "" + record_type = "MX" + target = "in2-smtp.messagingengine.com" + priority = 20 +} + resource "linode_domain_record" "root-txt-google" { domain_id = linode_domain.root.id name = "" @@ -39,6 +55,52 @@ resource "linode_domain_record" "root-txt-keybase" { target = "keybase-site-verification=gcoO7zav4G2IK5KQdrWOgz_PD9wpZhz-0afIb1Kodrk" } +resource "linode_domain_record" "root-txt-fastmail-dkim" { + count = 3 + domain_id = linode_domain.root.id + name = format("fm%d._domainkey", count.index + 1) + record_type = "CNAME" + target = format("fm%d.trygvis.io.dkim.fmhosted.com", count.index + 1) +} + +resource "linode_domain_record" "root-txt-fastmail-spf" { + domain_id = linode_domain.root.id + name = "" + record_type = "TXT" + target = "v=spf1 include:spf.messagingengine.com ?all" +} + +resource "linode_domain_record" "root-txt-fastmail-dmark" { + domain_id = linode_domain.root.id + name = "_dmarc" + record_type = "TXT" + target = "v=DMARC1; p=none;" +} + +resource "linode_domain_record" "root-txt-fastmail-srv" { + domain_id = linode_domain.root.id + record_type = "SRV" + service = each.key + priority = each.value.priority + weight = each.value.weight + port = each.value.port + target = each.value.target + + for_each = tomap({ + submission = { priority = 0, weight = 0, port = 0, target = "." }, + imap = { priority = 0, weight = 0, port = 0, target = "." }, + submissions = { priority = 0, weight = 1, port = 465, target = "smtp.fastmail.com" }, + imaps = { priority = 0, weight = 1, port = 993, target = "imap.fastmail.com" }, + jmap = { priority = 0, weight = 1, port = 443, target = "api.fastmail.com" }, + autodiscover = { priority = 0, weight = 1, port = 443, target = "autodiscover.fastmail.com" }, + autodiscover = { priority = 0, weight = 1, port = 443, target = "autodiscover.fastmail.com" }, + carddav = { priority = 0, weight = 0, port = 0, target = "." }, + carddavs = { priority = 0, weight = 1, port = 443, target = "carddav.fastmail.com" }, + caldav = { priority = 0, weight = 0, port = 0, target = "." }, + caldavs = { priority = 0, weight = 1, port = 443, target = "caldav.fastmail.com" }, + }) +} + resource "linode_domain_record" "root-cname-ses-1" { domain_id = linode_domain.root.id name = "k5o5gjadej2kkfncu36i3ef5gt473sxy._domainkey" @@ -53,13 +115,6 @@ resource "linode_domain_record" "root-cname-ses-2" { target = "imtuzw2lnfktlc7uongw433qbwjxxatg.dkim.amazonses.com" } -resource "linode_domain_record" "dlock" { - domain_id = linode_domain.root.id - name = "dlock" - record_type = "A" - target = "35.205.192.14" -} - resource "linode_domain_record" "hash" { domain_id = linode_domain.root.id name = "hash" @@ -81,6 +136,13 @@ resource "linode_domain_record" "numquam" { target = "163.172.160.56" } +resource "linode_domain_record" "lon1_dn42" { + domain_id = linode_domain.root.id + name = "lon1.dn42" + record_type = "CNAME" + target = "knot.inamo.no" +} + # Aliases for trygvis.io resource "linode_domain_record" "mw" { domain_id = linode_domain.root.id diff --git a/terraform/dns/vpn-cname.tf b/terraform/dns/vpn-cname.tf index bbd411a..7a9fba4 100644 --- a/terraform/dns/vpn-cname.tf +++ b/terraform/dns/vpn-cname.tf @@ -1,22 +1,29 @@ -resource "linode_domain_record" "vpn-conflatorio" { +#resource "linode_domain_record" "vpn-conflatorio" { +# domain_id = linode_domain.root.id +# name = "conflatorio.vpn" +# record_type = "AAAA" +# target = "fdf3:aad9:a885:77dd::2" +#} + +resource "linode_domain_record" "net-conflatorio" { domain_id = linode_domain.root.id - name = "conflatorio.vpn" + name = "conflatorio.net" record_type = "AAAA" - target = "fdf3:aad9:a885:77dd::2" + target = "fdb1:4242:3538:2001::ffff" } resource "linode_domain_record" "vpn-unifi" { domain_id = linode_domain.root.id name = "unifi.vpn" record_type = "CNAME" - target = "${linode_domain_record.vpn-conflatorio.name}.trygvis.io" + target = "${linode_domain_record.net-conflatorio.name}.trygvis.io" } resource "linode_domain_record" "vpn-grafana" { domain_id = linode_domain.root.id name = "grafana.vpn" record_type = "CNAME" - target = "${linode_domain_record.vpn-conflatorio.name}.trygvis.io" + target = "${linode_domain_record.net-conflatorio.name}.trygvis.io" } resource "linode_domain_record" "vpn-influxdb" { diff --git a/terraform/dns/vpn.tf b/terraform/dns/vpn.tf index d73d01e..58efa5c 100644 --- a/terraform/dns/vpn.tf +++ b/terraform/dns/vpn.tf @@ -5,11 +5,11 @@ resource "linode_domain_record" "vpn-knot" { record_type = "AAAA" target = "fdf3:aad9:a885:0b3a::1" } -resource "linode_domain_record" "vpn-birgitte" { +resource "linode_domain_record" "vpn-conflatorio" { domain_id = linode_domain.root.id - name = "birgitte.vpn" + name = "conflatorio.vpn" record_type = "AAAA" - target = "fdf3:aad9:a885:0b3a::2" + target = "fdf3:aad9:a885:0b3a::3" } resource "linode_domain_record" "vpn-arius" { domain_id = linode_domain.root.id @@ -23,36 +23,18 @@ resource "linode_domain_record" "vpn-akili" { record_type = "AAAA" target = "fdf3:aad9:a885:0b3a::7" } -resource "linode_domain_record" "vpn-malabaricus" { - domain_id = linode_domain.root.id - name = "malabaricus.vpn" - record_type = "AAAA" - target = "fdf3:aad9:a885:0b3a::8" -} resource "linode_domain_record" "vpn-sweetzpot-mobile" { domain_id = linode_domain.root.id name = "sweetzpot-mobile.vpn" record_type = "AAAA" target = "fdf3:aad9:a885:0b3a::9" } -resource "linode_domain_record" "vpn-astyanax" { - domain_id = linode_domain.root.id - name = "astyanax.vpn" - record_type = "AAAA" - target = "fdf3:aad9:a885:0b3a::10" -} resource "linode_domain_record" "vpn-sweetzpot-macos" { domain_id = linode_domain.root.id name = "sweetzpot-macos.vpn" record_type = "AAAA" target = "fdf3:aad9:a885:0b3a::11" } -resource "linode_domain_record" "vpn-android-trygvis" { - domain_id = linode_domain.root.id - name = "android-trygvis.vpn" - record_type = "AAAA" - target = "fdf3:aad9:a885:0b3a::12" -} resource "linode_domain_record" "vpn-hash" { domain_id = linode_domain.root.id name = "hash.vpn" @@ -71,9 +53,21 @@ resource "linode_domain_record" "vpn-lhn2ix" { record_type = "AAAA" target = "fdf3:aad9:a885:0b3a::15" } +resource "linode_domain_record" "vpn-kv24ix" { + domain_id = linode_domain.root.id + name = "kv24ix.vpn" + record_type = "AAAA" + target = "fdf3:aad9:a885:0b3a::16" +} resource "linode_domain_record" "vpn-biwia" { domain_id = linode_domain.root.id name = "biwia.vpn" record_type = "AAAA" target = "fdf3:aad9:a885:0b3a::17" } +resource "linode_domain_record" "vpn-coregonus" { + domain_id = linode_domain.root.id + name = "coregonus.vpn" + record_type = "AAAA" + target = "fdf3:aad9:a885:0b3a::18" +} diff --git a/terraform/grafana/grafana.tf b/terraform/grafana/grafana.tf index 6d75da3..7cda977 100644 --- a/terraform/grafana/grafana.tf +++ b/terraform/grafana/grafana.tf @@ -12,12 +12,14 @@ resource "docker_container" "grafana" { privileged = false must_run = true + network_mode = "bridge" + networks_advanced { name = data.docker_network.traefik.name } networks_advanced { - name = data.docker_network.public.name + name = data.docker_network.private.name } dynamic "labels" { diff --git a/terraform/grafana/main.tf b/terraform/grafana/main.tf index fa225ab..cb9b920 100644 --- a/terraform/grafana/main.tf +++ b/terraform/grafana/main.tf @@ -45,3 +45,7 @@ data "docker_network" "traefik" { data "docker_network" "public" { name = "public" } + +data "docker_network" "private" { + name = "private" +} diff --git a/terraform/ipam6/ipam6.tf b/terraform/ipam6/ipam6.tf new file mode 100644 index 0000000..a41a6be --- /dev/null +++ b/terraform/ipam6/ipam6.tf @@ -0,0 +1,172 @@ +output "networks" { + value = { + bitraf_dn42 = { + range = "fdb1:4242:3538::/48" + address = "fdb1:4242:3538::" + prefix = "48" + hosts = { + } + } + tnet_dn42 = { + range = "fdb1:4242:3538:2000::/52" + address = "fdb1:4242:3538:2000::" + prefix = "52" + hosts = { + } + } + unused_2001 = { + range = "fdb1:4242:3538:2001::/64" + address = "fdb1:4242:3538:2001::" + prefix = "64" + hosts = { + } + } + node1_dn42 = { + range = "fdb1:4242:3538:2002::/64" + address = "fdb1:4242:3538:2002::" + prefix = "64" + hosts = { + node1 = { + address : "fdb1:4242:3538:2002::" + prefix : "64" + } + } + } + node2_dn42 = { + range = "fdb1:4242:3538:2003::/64" + address = "fdb1:4242:3538:2003::" + prefix = "64" + hosts = { + node2 = { + address : "fdb1:4242:3538:2003::" + prefix : "64" + } + } + } + knot_dn42 = { + range = "fdb1:4242:3538:2004::/64" + address = "fdb1:4242:3538:2004::" + prefix = "64" + hosts = { + knot = { + address : "fdb1:4242:3538:2004::ffff" + prefix : "64" + } + } + } + coregonus_dn42 = { + range = "fdb1:4242:3538:2005::/64" + address = "fdb1:4242:3538:2005::" + prefix = "64" + hosts = { + coregonus-ix = { + address : "fdb1:4242:3538:2005::ffff" + prefix : "64" + } + danneri = { + address : "fdb1:4242:3538:2005:9422:d355:95b7:f170" + prefix : "128" + } + } + } + coregonus_docker = { + range = "fdb1:4242:3538:2005:df01:676a:ec28:0a00/120" + address = "fdb1:4242:3538:2005:df01:676a:ec28:a00" + prefix = "120" + hosts = { + } + } + kv24_dn42 = { + range = "fdb1:4242:3538:2006::/64" + address = "fdb1:4242:3538:2006::" + prefix = "64" + hosts = { + kv24ix = { + address : "fdb1:4242:3538:2006::ffff" + prefix : "64" + } + } + } + unused_2007 = { + range = "fdb1:4242:3538:2007::/64" + address = "fdb1:4242:3538:2007::" + prefix = "64" + hosts = { + } + } + lhn2_dn42 = { + range = "fdb1:4242:3538:2008::/64" + address = "fdb1:4242:3538:2008::" + prefix = "64" + hosts = { + lhn2pi = { + address : "fdb1:4242:3538:2008::ffff" + prefix : "64" + } + conflatorio = { + address : "fdb1:4242:3538:2008:8042:32ff:fe0c:7161" + prefix : "128" + } + } + } + hash_dn42 = { + range = "fdb1:4242:3538:2009::/64" + address = "fdb1:4242:3538:2009::" + prefix = "64" + hosts = { + hash = { + address : "fdb1:4242:3538:2009::ffff" + prefix : "64" + } + } + } + dn42 = { + range = "fd00::/8" + address = "fd00::" + prefix = "8" + hosts = { + } + } + } +} + +output "hosts" { + value = { + node1 = { + address : "fdb1:4242:3538:2002::" + prefix : "64" + } + node2 = { + address : "fdb1:4242:3538:2003::" + prefix : "64" + } + knot = { + address : "fdb1:4242:3538:2004::ffff" + prefix : "64" + } + coregonus-ix = { + address : "fdb1:4242:3538:2005::ffff" + prefix : "64" + } + danneri = { + address : "fdb1:4242:3538:2005:9422:d355:95b7:f170" + prefix : "128" + } + kv24ix = { + address : "fdb1:4242:3538:2006::ffff" + prefix : "64" + } + lhn2pi = { + address : "fdb1:4242:3538:2008::ffff" + prefix : "64" + } + conflatorio = { + address : "fdb1:4242:3538:2008:8042:32ff:fe0c:7161" + prefix : "128" + } + hash = { + address : "fdb1:4242:3538:2009::ffff" + prefix : "64" + } + } +} diff --git a/terraform/telegraf/conflatorio/vault.yml b/terraform/telegraf/conflatorio/vault.yml index 90061a8..e380599 100644 --- a/terraform/telegraf/conflatorio/vault.yml +++ b/terraform/telegraf/conflatorio/vault.yml @@ -1,5 +1,4 @@ influx_token: ENC[AES256_GCM,data:48AbbP7v1QRvK7h73J6RYb1BBXsKdF+8YREXqtvPlEk3DFHoncmPIVWCH0G8it21BJtBsAupnJCPoa9IR7nJMWZMy/2NotmjeJuBD7LYY05BFEs4K5y+yw==,iv:RbWI8JWTg1LHqNUAEsx42rFp7IIntkz7PR6l/kCl7z8=,tag:lCpcfh7xQR+29RhWEkG1lA==,type:str] -config_url: ENC[AES256_GCM,data:tlhn8wfyD7EETkWGeeLEVOVQ3OS+PXnfWL6zXbuKYxz2I4EftRTAG9QAGCw2nb2VpTkBG4AE3kkLKLTiNWFBQsQ=,iv:V1pSBlTeE3zFBI29DtrzgAySHxhTS5jp8kuc7HtCKiI=,tag:Yo8vqUr9gohQYvuwqFkdFw==,type:str] sops: kms: [] gcp_kms: [] @@ -15,8 +14,8 @@ sops: Snd2V1FCL0hXUHA0R0FyUHBEUmNoeTAKK3uEAXKZetmJmn9vwleVzpfvIqyDMbuv FEYrJ4oBr+NykSfWqZSLB+y4DPTNyE2jhZ1vOK1u/CcxisaVa3o7+A== -----END AGE ENCRYPTED FILE----- - lastmodified: "2023-10-26T17:50:27Z" - mac: ENC[AES256_GCM,data:eFMCwmDaAvVaF1a45UQo/Z0lahAPVw5Mi7MH0m/UcVmvczad31gbPNuSZDAHyF+CWz4RmVCuqR0ukRBBXF5y18mVaTWC0zXhBaMsYIV3LR4CrdJ3wgmD5uY91X4un1aPJ/iR6T7w0wPfEaSnTR00n+f7tVhmyVfl6+9IwuUlcUo=,iv:Kme2RcQXWpYKPXfbzmK0JxbNyJqK1PEvLO6K4smWMLM=,tag:11nLZIVh7AYqhcO+1E6HmA==,type:str] + lastmodified: "2023-10-31T14:31:13Z" + mac: ENC[AES256_GCM,data:0KMb/2PdJybWd47RFIDn5bLaQzjKLATPDSgjmT7O79ErKvRu5gqt/or04kPcla1ToofNza1b1tH2nvJONTrIx8I/GCvy1nNa1sFfFa8cbb12em1SWwVIrqG8O2zEiQ9Wh2FW4x2wFRTinOEzwhAnum5OPD2K58fPWm6jFsG9fxY=,iv:SeCYnl/dngeAGOtTL3/qblrMXvRPPTfnhjoVSmbNGZA=,tag:t8grQyCkM0SWWFYWUomIJg==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.7.3 diff --git a/terraform/terragrunt.hcl b/terraform/terragrunt.hcl index e7e5f6a..382cf17 100644 --- a/terraform/terragrunt.hcl +++ b/terraform/terragrunt.hcl @@ -1,7 +1,7 @@ generate "backend" { path = "backend.tf" if_exists = "overwrite_terragrunt" - contents = <<EOF + contents = <<EOF terraform { backend "s3" { bucket = "terraform-a6726272-73ff-11ed-8bdd-c79eb8376e05" diff --git a/terraform/unifi-controller/main.tf b/terraform/unifi-controller/main.tf index f5f7b0a..55c133c 100644 --- a/terraform/unifi-controller/main.tf +++ b/terraform/unifi-controller/main.tf @@ -28,8 +28,10 @@ provider "docker" { locals { domain_name = "unifi.vpn.trygvis.io" + public_ip = "fdb1:4242:3538:2001::ffff" + docker_image_controller = "lscr.io/linuxserver/unifi-controller:8.0.24-mongoless" - docker_image_mongo = "mongo:7.0" + docker_image_mongo = "mongo:7.0" mongo_database = "unifi" mongo_username = "unifi" diff --git a/terraform/unifi-controller/mongo.tf b/terraform/unifi-controller/mongo.tf index 98b4e36..2b83691 100644 --- a/terraform/unifi-controller/mongo.tf +++ b/terraform/unifi-controller/mongo.tf @@ -24,15 +24,18 @@ resource "docker_container" "unifi-mongo" { name = docker_network.unifi.name } + network_mode = "bridge" + volumes { volume_name = docker_volume.unifi-mongo.name + read_only = false container_path = "/data/db" } } output "mongo_init_js" { sensitive = true - value = <<-EOF + value = <<-EOF db.getSiblingDB("${local.mongo_database}"). createUser({ user: "${local.mongo_database}", diff --git a/terraform/unifi-controller/unifi.tf b/terraform/unifi-controller/unifi.tf index 8e6c7d7..4b0f1c6 100644 --- a/terraform/unifi-controller/unifi.tf +++ b/terraform/unifi-controller/unifi.tf @@ -52,12 +52,13 @@ resource "docker_container" "unifi-controller" { internal = ports.value["port"] external = ports.value["port"] protocol = ports.value["proto"] - ip = "fdf3:aad9:a885:77dd::2" + ip = local.public_ip } } volumes { volume_name = docker_volume.unifi-controller.name + read_only = false container_path = "/config" } |