vynil/domain
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix

Browse Source
This commit is contained in:
Sébastien Huss
2024-01-25 18:35:22 +01:00
parent 0727fca591
commit 8c4348d215
97 changed files with 402 additions and 402 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
apps/code-server/deploy.tf
View File

@@ -9,7 +9,7 @@ resource "kubectl_manifest" "deploy" {
spec:
replicas: 1
hostname: "${var.component}-${var.instance}"
subdomain: "${var.domain-name}"
subdomain: "${var.domain_name}"
selector:
matchLabels: ${jsonencode(local.common-labels)}
template:

8
apps/code-server/index.yaml
View File

@@ -6,17 +6,17 @@ metadata:
name: code-server
description: null
options:
app-group:
app_group:
default: dev
examples:
- dev
type: string
sub-domain:
sub_domain:
default: code
examples:
- code
type: string
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
@@ -48,7 +48,7 @@ options:
- Block
type: string
type: object
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com

20
apps/code-server/presentation.tf
View File

@@ -1,7 +1,7 @@
locals {
dns-name = "${var.instance}.${var.sub-domain}.${var.domain-name}"
dns-names = [local.dns-name]
app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
dns_name = "${var.instance}.${var.sub_domain}.${var.domain_name}"
dns_names = [local.dns_name]
app_name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
icon = "_static/src/browser/media/favicon-dark-support.svg"
request_headers = {
"Content-Type" = "application/json"
@@ -34,10 +34,10 @@ module "ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.common-labels
dns-names = local.dns-names
middlewares = ["forward-${local.app-name}"]
dns_names = local.dns_names
middlewares = ["forward-${local.app_name}"]
service = local.service
providers = {
kubectl = kubectl
@@ -48,8 +48,8 @@ module "application" {
source = "/dist/modules/application"
component = var.component
instance = var.instance
app-group = var.app-group
dns-name = local.dns-name
app_group = var.app_group
dns_name = local.dns_name
icon = local.icon
protocol_provider = module.forward.provider-id
providers = {
@@ -73,9 +73,9 @@ module "forward" {
instance = var.instance
domain = var.domain
namespace = var.namespace
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.common-labels
dns-names = local.dns-names
dns_names = local.dns_names
service = local.service
icon = local.icon
request_headers = local.request_headers

6
apps/code-server/pvc.tf
View File

@@ -8,10 +8,10 @@ resource "kubectl_manifest" "pvc" {
labels: ${jsonencode(local.common-labels)}
spec:
accessModes:
- "${var.storage.accessMode}"
- "${var.storage.volume.accessMode}"
resources:
requests:
storage: "${var.storage.size}"
volumeMode: "${var.storage.type}"
storage: "${var.storage.volume.size}"
volumeMode: "${var.storage.volume.type}"
EOF
}

8
apps/dbgate/index.yaml
View File

@@ -72,7 +72,7 @@ options:
examples:
- letsencrypt-prod
type: string
sub-domain:
sub_domain:
default: dbgate
examples:
- dbgate
@@ -106,12 +106,12 @@ options:
type: string
type: object
type: array
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
type: string
app-group:
app_group:
default: dev
examples:
- dev
@@ -169,7 +169,7 @@ options:
type: string
type: object
type: array
ingress-class:
ingress_class:
default: traefik
examples:
- traefik

16
apps/dbgate/presentation.tf
View File

@@ -1,7 +1,7 @@
locals {
dns-name = "${var.sub-domain}.${var.domain-name}"
dns-names = [local.dns-name]
app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
dns_name = "${var.sub_domain}.${var.domain_name}"
dns_names = [local.dns_name]
app_name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
icon = "logo192.png"
request_headers = {
"Content-Type" = "application/json"
@@ -34,9 +34,9 @@ module "ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.common-labels
dns-names = local.dns-names
dns_names = local.dns_names
middlewares = []
service = local.service
providers = {
@@ -48,8 +48,8 @@ module "application" {
source = "/dist/modules/application"
component = var.component
instance = var.instance
app-group = var.app-group
dns-name = local.dns-name
app_group = var.app_group
dns_name = local.dns_name
icon = local.icon
protocol_provider = module.oauth2.provider-id
providers = {
@@ -63,7 +63,7 @@ module "oauth2" {
instance = var.instance
namespace = var.namespace
labels = local.common-labels
dns-name = local.dns-name
dns_name = local.dns_name
redirect-path = ""
providers = {
kubernetes = kubernetes

6
apps/dbgate/pvc.tf
View File

@@ -8,10 +8,10 @@ resource "kubectl_manifest" "pvc" {
labels: ${jsonencode(local.common-labels)}
spec:
accessModes:
- "${var.storage.accessMode}"
- "${var.storage.volume.accessMode}"
resources:
requests:
storage: "${var.storage.size}"
volumeMode: "${var.storage.type}"
storage: "${var.storage.volume.size}"
volumeMode: "${var.storage.volume.type}"
EOF
}

14
apps/dolibarr/application.tf
View File

@@ -1,6 +1,6 @@
locals {
app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
main-group = format("app-%s", local.app-name)
app_name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
main-group = format("app-%s", local.app_name)
sorted-group-names = reverse(distinct(sort([
for grp in var.user-groups: grp.name
])))
@@ -19,7 +19,7 @@ data "authentik_group" "vynil-admin" {
resource "authentik_group" "groups" {
count = length(local.sorted-groups)
name = local.sorted-groups[count.index].name
attributes = jsonencode({"${local.app-name}" = true})
attributes = jsonencode({"${local.app_name}" = true})
}
data "authentik_group" "readed_groups" {
depends_on = [ authentik_group.groups ]
@@ -38,7 +38,7 @@ resource "authentik_policy_expression" "policy" {
name = local.main-group
expression = <<-EOF
attr = request.user.group_attributes()
return attr['${local.app-name}'] if '${local.app-name}' in attr else False
return attr['${local.app_name}'] if '${local.app_name}' in attr else False
EOF
}
@@ -61,10 +61,10 @@ resource "authentik_policy_binding" "dolibarr_ldap_access_vynil" {
resource "authentik_application" "dolibarr_application_saml" {
name = "${var.instance}"
slug = "${var.component}-${var.instance}"
group = var.app-group
group = var.app_group
protocol_provider = authentik_provider_saml.dolibarr.id
meta_launch_url = format("https://%s.%s", var.sub-domain, var.domain-name)
meta_icon = format("https://%s.%s/%s", var.sub-domain, var.domain-name, "theme/dolibarr_256x256_color.png")
meta_launch_url = format("https://%s.%s", var.sub_domain, var.domain_name)
meta_icon = format("https://%s.%s/%s", var.sub_domain, var.domain_name, "theme/dolibarr_256x256_color.png")
}
resource "authentik_policy_binding" "dolibarr_saml_access_users" {

2
apps/dolibarr/configmap.tf
View File

@@ -167,7 +167,7 @@ resource "kubectl_manifest" "config" {
DOLI_ADMIN_LOGIN: "admin_${var.instance}"
DOLI_MODULES: "modSociete,modBlockedLog,modSamlConnector,modLdap"
DOLI_AUTH: "dolibarr"
DOLI_URL_ROOT: "https://${var.sub-domain}.${var.domain-name}"
DOLI_URL_ROOT: "https://${var.sub_domain}.${var.domain_name}"
DOLI_LDAP_PORT: "389"
DOLI_LDAP_VERSION: "3"
DOLI_LDAP_SERVERTYPE: "openldap"

8
apps/dolibarr/index.yaml
View File

@@ -89,7 +89,7 @@ options:
type: string
type: object
type: object
sub-domain:
sub_domain:
default: erp
examples:
- erp
@@ -155,7 +155,7 @@ options:
default: '14'
type: string
type: object
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
@@ -198,7 +198,7 @@ options:
default: 2Gi
type: string
type: object
app-group:
app_group:
default: ''
examples:
- ''
@@ -341,7 +341,7 @@ options:
- block
type: string
type: object
ingress-class:
ingress_class:
default: traefik
examples:
- traefik

10
apps/dolibarr/ingress.tf
View File

@@ -1,5 +1,5 @@
locals {
dns-names = ["${var.sub-domain}.${var.domain-name}"]
dns_names = ["${var.sub_domain}.${var.domain_name}"]
middlewares = ["${var.instance}-https"]
service = {
"name" = "${var.instance}"
@@ -7,7 +7,7 @@ locals {
"number" = 80
}
}
rules = [ for v in local.dns-names : {
rules = [ for v in local.dns_names : {
"host" = "${v}"
"http" = {
"paths" = [{
@@ -31,7 +31,7 @@ resource "kubectl_manifest" "prj_certificate" {
labels: ${jsonencode(local.common-labels)}
spec:
secretName: "${var.instance}-cert"
dnsNames: ${jsonencode(local.dns-names)}
dnsNames: ${jsonencode(local.dns_names)}
issuerRef:
name: "${var.issuer}"
kind: "ClusterIssuer"
@@ -66,10 +66,10 @@ resource "kubectl_manifest" "prj_ingress" {
annotations:
"traefik.ingress.kubernetes.io/router.middlewares": "${join(",", [for m in local.middlewares : format("%s-%s@kubernetescrd", var.namespace, m)])}"
spec:
ingressClassName: "${var.ingress-class}"
ingressClassName: "${var.ingress_class}"
rules: ${jsonencode(local.rules)}
tls:
- hosts: ${jsonencode(local.dns-names)}
- hosts: ${jsonencode(local.dns_names)}
secretName: "${var.instance}-cert"
EOF
}

2
apps/dolibarr/ldap.tf
View File

@@ -5,7 +5,7 @@ data "kubernetes_secret_v1" "authentik" {
}
}
locals {
base-dn = format("dc=%s", join(",dc=", split(".", format("%s.%s", var.sub-domain, var.domain-name))))
base-dn = format("dc=%s", join(",dc=", split(".", format("%s.%s", var.sub_domain, var.domain_name))))
base-group-dn = format("ou=groups,%s", local.base-dn)
base-user-dn = format("ou=users,%s", local.base-dn)
authentik_url = "http://authentik.${var.domain}-auth.svc"

6
apps/dolibarr/pvc.tf
View File

@@ -10,10 +10,10 @@ resource "kubectl_manifest" "pvc" {
labels: ${jsonencode(local.common-labels)}
spec:
accessModes:
- "${var.storage.accessMode}"
- "${var.storage.volume.accessMode}"
resources:
requests:
storage: "${var.storage.size}"
volumeMode: "${var.storage.type}"
storage: "${var.storage.volume.size}"
volumeMode: "${var.storage.volume.type}"
EOF
}

6
apps/dolibarr/redis.tf
View File

@@ -13,7 +13,7 @@ resource "kubectl_manifest" "dolibarr_redis" {
labels: ${jsonencode(local.redis-labels)}
spec:
kubernetesConfig:
image: "${var.redis.image}"
image: "${var.images.redis.registry}/${var.images.redis.repository}:${var.images.redis.tag}"
imagePullPolicy: "IfNotPresent"
storage:
volumeClaimTemplate:
@@ -21,10 +21,10 @@ resource "kubectl_manifest" "dolibarr_redis" {
accessModes: ["ReadWriteOnce"]
resources:
requests:
storage: "${var.redis.storage}"
storage: "${var.storage.redis}"
redisExporter:
enabled: ${var.redis.exporter.enabled}
image: "${var.redis.exporter.image}"
image: "${var.images.redis_exporter.registry}/${var.images.redis_exporter.repository}:${var.images.redis_exporter.tag}"
securityContext:
runAsUser: 1000
fsGroup: 1000

4
apps/dolibarr/saml.tf
View File

@@ -35,7 +35,7 @@ resource "kubectl_manifest" "saml_certificate" {
labels: ${jsonencode(local.common-labels)}
spec:
secretName: "${var.instance}-${var.component}-saml"
dnsNames: ${jsonencode(local.dns-names)}
dnsNames: ${jsonencode(local.dns_names)}
issuerRef:
name: "self-sign"
kind: "ClusterIssuer"
@@ -47,7 +47,7 @@ resource "authentik_provider_saml" "dolibarr" {
name = "dolibarr-${var.instance}-saml"
authentication_flow = data.authentik_flow.default-authentication-flow.id
authorization_flow = data.authentik_flow.default-authorization-flow.id
acs_url = "https://${var.sub-domain}.${var.domain-name}/custom/samlconnector/acs.php?entity=1&fk_idp=0"
acs_url = "https://${var.sub_domain}.${var.domain_name}/custom/samlconnector/acs.php?entity=1&fk_idp=0"
property_mappings = data.authentik_property_mapping_saml.saml_maps.ids
name_id_mapping = data.authentik_property_mapping_saml.saml_name.id
signing_kp = data.authentik_certificate_key_pair.generated.id

10
apps/gitea/index.yaml
View File

@@ -156,7 +156,7 @@ options:
default: 2Gi
type: string
type: object
ssh-sub-domain:
ssh-sub_domain:
default: git
examples:
- git
@@ -185,12 +185,12 @@ options:
default: 10Gi
type: string
type: object
app-group:
app_group:
default: dev
examples:
- dev
type: string
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
@@ -301,7 +301,7 @@ options:
default: false
type: boolean
type: object
sub-domain:
sub_domain:
default: git
examples:
- git
@@ -351,7 +351,7 @@ options:
default: false
type: boolean
type: object
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com

8
apps/gitea/inline-config.tf
View File

@@ -43,15 +43,15 @@ ROOT=/data/git/gitea-repositories
EOF
server = <<-EOF
APP_DATA_PATH=/data
DOMAIN=${var.sub-domain}.${var.domain-name}
DOMAIN=${var.sub_domain}.${var.domain_name}
ENABLE_PPROF=false
HTTP_PORT=3000
PROTOCOL=http
ROOT_URL=https://${var.sub-domain}.${var.domain-name}
SSH_DOMAIN=${var.sub-domain}.${var.domain-name}
ROOT_URL=https://${var.sub_domain}.${var.domain_name}
SSH_DOMAIN=${var.sub_domain}.${var.domain_name}
SSH_LISTEN_PORT=2222
SSH_PORT=${var.ssh-port}
SSH_DOMAIN=${var.ssh-sub-domain}.${var.domain-name}
SSH_DOMAIN=${var.ssh-sub_domain}.${var.domain_name}
START_SSH_SERVER=true
EOF
ui = <<-EOF

16
apps/gitea/presentation.tf
View File

@@ -1,7 +1,7 @@
locals {
dns-name = "${var.sub-domain}.${var.domain-name}"
dns-names = [local.dns-name]
app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
dns_name = "${var.sub_domain}.${var.domain_name}"
dns_names = [local.dns_name]
app_name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
icon = "assets/img/logo.svg"
request_headers = {
"Content-Type" = "application/json"
@@ -34,9 +34,9 @@ module "ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.common-labels
dns-names = local.dns-names
dns_names = local.dns_names
middlewares = []
service = local.service
providers = {
@@ -48,8 +48,8 @@ module "application" {
source = "/dist/modules/application"
component = var.component
instance = var.instance
app-group = var.app-group
dns-name = local.dns-name
app_group = var.app_group
dns_name = local.dns_name
icon = local.icon
protocol_provider = module.oauth2.provider-id
providers = {
@@ -63,7 +63,7 @@ module "oauth2" {
instance = var.instance
namespace = var.namespace
labels = local.common-labels
dns-name = local.dns-name
dns_name = local.dns_name
redirect-path = "user/oauth2/vynil/callback"
providers = {
kubernetes = kubernetes

6
apps/gitea/redis.tf
View File

@@ -13,7 +13,7 @@ resource "kubectl_manifest" "prj_redis" {
labels: ${jsonencode(local.redis-labels)}
spec:
kubernetesConfig:
image: "${var.redis.image}"
image: "${var.images.redis.registry}/${var.images.redis.repository}:${var.images.redis.tag}"
imagePullPolicy: "IfNotPresent"
storage:
volumeClaimTemplate:
@@ -21,10 +21,10 @@ resource "kubectl_manifest" "prj_redis" {
accessModes: ["ReadWriteOnce"]
resources:
requests:
storage: "${var.redis.storage}"
storage: "${var.storage.redis}"
redisExporter:
enabled: ${var.redis.exporter.enabled}
image: "${var.redis.exporter.image}"
image: "${var.images.redis_exporter.registry}/${var.images.redis_exporter.repository}:${var.images.redis_exporter.tag}"
securityContext:
runAsUser: 1000
fsGroup: 1000

8
apps/gramo/index.yaml
View File

@@ -11,12 +11,12 @@ options:
examples:
- your-company
type: string
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
type: string
sub-domain:
sub_domain:
default: gramo
examples:
- gramo
@@ -70,7 +70,7 @@ options:
examples:
- false
type: boolean
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
@@ -85,7 +85,7 @@ options:
examples:
- letsencrypt-prod
type: string
app-group:
app_group:
default: infra
examples:
- infra

20
apps/gramo/presentation.tf
View File

@@ -1,7 +1,7 @@
locals {
dns-name = "${var.sub-domain}.${var.domain-name}"
dns-names = [local.dns-name]
app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
dns_name = "${var.sub_domain}.${var.domain_name}"
dns_names = [local.dns_name]
app_name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
icon = "icon.svg"
request_headers = {
"Content-Type" = "application/json"
@@ -34,10 +34,10 @@ module "ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress_class = var.ingress-class
ingress_class = var.ingress_class
labels = local.common-labels
dns_names = local.dns-names
middlewares = ["forward-${local.app-name}"]
dns_names = local.dns_names
middlewares = ["forward-${local.app_name}"]
services = [local.service]
providers = {
kubectl = kubectl
@@ -48,8 +48,8 @@ module "application" {
source = "git::https://git.solidite.fr/vynil/kydah-modules.git//application"
component = var.component
instance = var.instance
app_group = var.app-group
dns_name = local.dns-name
app_group = var.app_group
dns_name = local.dns_name
icon = local.icon
protocol_provider = module.forward.provider-id
providers = {
@@ -73,9 +73,9 @@ module "forward" {
instance = var.instance
domain = var.domain
namespace = var.namespace
ingress_class = var.ingress-class
ingress_class = var.ingress_class
labels = local.common-labels
dns_names = local.dns-names
dns_names = local.dns_names
service = local.service
icon = local.icon
request_headers = local.request_headers

6
apps/k8s-api/index.yaml
View File

@@ -6,7 +6,7 @@ metadata:
name: k8s-api
description: Access to the kubernetes api
options:
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
@@ -21,12 +21,12 @@ options:
examples:
- letsencrypt-prod
type: string
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
type: string
sub-domain:
sub_domain:
default: api
examples:
- api

6
apps/k8s-api/ingress.tf
View File

@@ -1,5 +1,5 @@
locals {
dns-names = ["${var.sub-domain}.${var.domain-name}"]
dns_names = ["${var.sub_domain}.${var.domain_name}"]
middlewares = []
services = [{
"kind" = "Service"
@@ -7,7 +7,7 @@ locals {
"namespace" = "default"
"port" = 443
}]
routes = [ for v in local.dns-names : {
routes = [ for v in local.dns_names : {
"kind" = "Rule"
"match" = "Host(`${v}`)"
"middlewares" = local.middlewares
@@ -25,7 +25,7 @@ resource "kubectl_manifest" "prj_certificate" {
labels: ${jsonencode(local.common-labels)}
spec:
secretName: "${var.instance}-cert"
dnsNames: ${jsonencode(local.dns-names)}
dnsNames: ${jsonencode(local.dns_names)}
issuerRef:
name: "${var.issuer}"
kind: "ClusterIssuer"

2
apps/nextcloud/collabora.tf
View File

@@ -36,7 +36,7 @@ resource "kubectl_manifest" "collabora_deploy" {
imagePullPolicy: "${var.images.collabora.pullPolicy}"
env:
- name: aliasgroup1
value: "https://${local.dns-name}"
value: "https://${local.dns_name}"
- name: DONT_GEN_SSL_CERT
value: "true"
- name: extra_params

6
apps/nextcloud/configs.tf
View File

@@ -17,7 +17,7 @@ locals {
fi
}
run_as ./occ --no-warnings config:system:set trusted_domains 0 --value=nextcloud
run_as ./occ --no-warnings config:system:set trusted_domains 1 --value="${local.dns-name}"
run_as ./occ --no-warnings config:system:set trusted_domains 1 --value="${local.dns_name}"
run_as ./occ app:install user_oidc ||:
run_as ./occ user_oidc:provider "$${OAUTH2_CONNECTOR_NAME}" --clientid="$${OAUTH2_CLIENT_ID}" \
--clientsecret="$${OAUTH2_CLIENT_SECRET}" \
@@ -41,14 +41,14 @@ locals {
var.apps.collabora?[
"run_as ./occ app:install richdocuments ||:",
"run_as ./occ app:enable richdocuments ||:",
"run_as ./occ config:app:set richdocuments wopi_url --value=\"https://collabora.${local.dns-name}/\"",
"run_as ./occ config:app:set richdocuments wopi_url --value=\"https://collabora.${local.dns_name}/\"",
"run_as ./occ config:app:set richdocuments federation_use_trusted_domains --value=yes",
"run_as ./occ richdocuments:activate-config ||:",
]:["run_as ./occ app:disable richdocuments ||:"],
var.apps.onlyoffice?[
"run_as ./occ app:install onlyoffice ||:",
"run_as ./occ app:enable onlyoffice ||:",
"run_as ./occ --no-warnings config:app:set onlyoffice DocumentServerUrl --value=\"https://onlyoffice.${local.dns-name}/\"",
"run_as ./occ --no-warnings config:app:set onlyoffice DocumentServerUrl --value=\"https://onlyoffice.${local.dns_name}/\"",
"run_as ./occ --no-warnings config:app:set onlyoffice DocumentServerInternalUrl --value=\"http://${var.instance}-onlyoffice/\"",
"run_as ./occ --no-warnings config:app:set onlyoffice StorageUrl --value=\"http://nextcloud/\"",
"run_as ./occ --no-warnings config:app:set onlyoffice jwt_secret --value=\"$${ONLYOFFICE_JWT_SECRET}\"",

12
apps/nextcloud/datas.tf
View File

@@ -81,7 +81,7 @@ data "kustomization_overlay" "data" {
secretKeyRef:
name: "${var.instance}-${var.component}-pg-app"
- name: NEXTCLOUD_TRUSTED_DOMAINS
value: "${local.dns-name}"
value: "${local.dns_name}"
- name: REDIS_HOST
value: "${var.instance}-${var.component}-redis.${var.namespace}.svc"
- name: REDIS_HOST_PORT
@@ -134,12 +134,12 @@ data "kustomization_overlay" "data" {
httpGet:
httpHeaders:
- name: Host
value: "${local.dns-name}"
value: "${local.dns_name}"
livenessProbe:
httpGet:
httpHeaders:
- name: Host
value: "${local.dns-name}"
value: "${local.dns_name}"
EOF
}
patches {
@@ -163,7 +163,7 @@ data "kustomization_overlay" "data" {
imagePullPolicy: "${var.images.exporter.pullPolicy}"
env:
- name: NEXTCLOUD_SERVER
value: "https://${local.dns-name}"
value: "https://${local.dns_name}"
- name: NEXTCLOUD_TLS_SKIP_VERIFY
value: "${var.issuer=="letsencrypt-prod"?"false":"true"}"
EOF
@@ -182,10 +182,10 @@ data "kustomization_overlay" "data" {
k8up.io/backup: "true"
spec:
accessModes:
- "${var.storage.accessMode}"
- "${var.storage.volume.accessMode}"
resources:
requests:
storage: "${var.storage.size}"
storage: "${var.storage.volume.size}"
EOF
}
patches {

8
apps/nextcloud/index.yaml
View File

@@ -21,7 +21,7 @@ options:
examples:
- your-company
type: string
app-group:
app_group:
default: ''
examples:
- ''
@@ -36,12 +36,12 @@ options:
examples:
- letsencrypt-prod
type: string
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
type: string
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
@@ -497,7 +497,7 @@ options:
default: '14'
type: string
type: object
sub-domain:
sub_domain:
default: files
examples:
- files

28
apps/nextcloud/presentation.tf
View File

@@ -1,9 +1,9 @@
locals {
dns-name = "${var.sub-domain}.${var.domain-name}"
dns-collabora = "collabora.${local.dns-name}"
dns-onlyoffice = "onlyoffice.${local.dns-name}"
dns-names = [local.dns-name]
app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
dns_name = "${var.sub_domain}.${var.domain_name}"
dns-collabora = "collabora.${local.dns_name}"
dns-onlyoffice = "onlyoffice.${local.dns_name}"
dns_names = [local.dns_name]
app_name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
icon = "apps/theming/favicon"
service = {
"name" = "${var.component}"
@@ -31,9 +31,9 @@ module "ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.common-labels
dns-names = local.dns-names
dns_names = local.dns_names
middlewares = ["${var.instance}-sslenforce", "${var.instance}-redirectdav", "${var.instance}-redirectindex"]
service = local.service
providers = {
@@ -45,8 +45,8 @@ module "application" {
source = "/dist/modules/application"
component = var.component
instance = var.instance
app-group = var.app-group
dns-name = local.dns-name
app_group = var.app_group
dns_name = local.dns_name
icon = local.icon
protocol_provider = module.oauth2.provider-id
providers = {
@@ -60,7 +60,7 @@ module "oauth2" {
instance = var.instance
namespace = var.namespace
labels = local.common-labels
dns-name = local.dns-name
dns_name = local.dns_name
redirect-path = "apps/user_oidc/code"
providers = {
kubernetes = kubernetes
@@ -90,9 +90,9 @@ module "collabora-ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.collabora-labels
dns-names = [local.dns-collabora]
dns_names = [local.dns-collabora]
middlewares = []
service = local.collabora-service
providers = {
@@ -121,9 +121,9 @@ module "onlyoffice-ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.onlyoffice-labels
dns-names = [local.dns-onlyoffice]
dns_names = [local.dns-onlyoffice]
middlewares = []
service = local.onlyoffice-service
providers = {

6
apps/nextcloud/redis.tf
View File

@@ -13,7 +13,7 @@ resource "kubectl_manifest" "prj_redis" {
labels: ${jsonencode(local.redis-labels)}
spec:
kubernetesConfig:
image: "${var.redis.image}"
image: "${var.images.redis.registry}/${var.images.redis.repository}:${var.images.redis.tag}"
imagePullPolicy: "IfNotPresent"
storage:
volumeClaimTemplate:
@@ -21,10 +21,10 @@ resource "kubectl_manifest" "prj_redis" {
accessModes: ["ReadWriteOnce"]
resources:
requests:
storage: "${var.redis.storage}"
storage: "${var.storage.redis}"
redisExporter:
enabled: ${var.redis.exporter.enabled}
image: "${var.redis.exporter.image}"
image: "${var.images.redis_exporter.registry}/${var.images.redis_exporter.repository}:${var.images.redis_exporter.tag}"
securityContext:
runAsUser: 1000
fsGroup: 1000

8
apps/okd/index.yaml
View File

@@ -6,12 +6,12 @@ metadata:
name: okd
description: null
options:
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
type: string
sub-domain:
sub_domain:
default: okd
examples:
- okd
@@ -65,7 +65,7 @@ options:
examples:
- letsencrypt-prod
type: string
app-group:
app_group:
default: infra
examples:
- infra
@@ -75,7 +75,7 @@ options:
examples:
- false
type: boolean
ingress-class:
ingress_class:
default: traefik
examples:
- traefik

20
apps/okd/presentation.tf
View File

@@ -1,7 +1,7 @@
locals {
dns-name = "${var.sub-domain}.${var.domain-name}"
dns-names = [local.dns-name]
app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
dns_name = "${var.sub_domain}.${var.domain_name}"
dns_names = [local.dns_name]
app_name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
icon = "static/assets/okd-logo.svg"
request_headers = {
"Content-Type" = "application/json"
@@ -34,10 +34,10 @@ module "ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.common-labels
dns-names = local.dns-names
middlewares = ["forward-${local.app-name}"]
dns_names = local.dns_names
middlewares = ["forward-${local.app_name}"]
service = local.service
providers = {
kubectl = kubectl
@@ -48,8 +48,8 @@ module "application" {
source = "/dist/modules/application"
component = var.component
instance = var.instance
app-group = var.app-group
dns-name = local.dns-name
app_group = var.app_group
dns_name = local.dns_name
icon = local.icon
protocol_provider = module.forward.provider-id
providers = {
@@ -73,9 +73,9 @@ module "forward" {
instance = var.instance
domain = var.domain
namespace = var.namespace
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.common-labels
dns-names = local.dns-names
dns_names = local.dns_names
service = local.service
icon = local.icon
request_headers = local.request_headers

6
apps/sonar/index.yaml
View File

@@ -6,12 +6,12 @@ metadata:
name: sonar
description: null
options:
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
type: string
sub-domain:
sub_domain:
default: sonar
examples:
- sonar
@@ -78,7 +78,7 @@ options:
examples:
- your-company
type: string
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com

8
apps/traefik-ui/index.yaml
View File

@@ -11,7 +11,7 @@ options:
examples:
- letsencrypt-prod
type: string
app-group:
app_group:
default: infra
examples:
- infra
@@ -21,17 +21,17 @@ options:
examples:
- your-company
type: string
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
type: string
sub-domain:
sub_domain:
default: traefik
examples:
- traefik
type: string
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com

20
apps/traefik-ui/presentation.tf
View File

@@ -1,7 +1,7 @@
locals {
dns-name = "${var.sub-domain}.${var.domain-name}"
dns-names = [local.dns-name]
app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
dns_name = "${var.sub_domain}.${var.domain_name}"
dns_names = [local.dns_name]
app_name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
icon = "dashboard/statics/icons/favicon-96x96.png"
request_headers = {
"Content-Type" = "application/json"
@@ -21,10 +21,10 @@ module "ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.common-labels
dns-names = local.dns-names
middlewares = ["forward-${local.app-name}"]
dns_names = local.dns_names
middlewares = ["forward-${local.app_name}"]
service = local.service
providers = {
kubectl = kubectl
@@ -35,8 +35,8 @@ module "application" {
source = "/dist/modules/application"
component = var.component
instance = var.instance
app-group = var.app-group
dns-name = local.dns-name
app_group = var.app_group
dns_name = local.dns_name
icon = local.icon
protocol_provider = module.forward.provider-id
providers = {
@@ -60,9 +60,9 @@ module "forward" {
instance = var.instance
domain = var.domain
namespace = var.namespace
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.common-labels
dns-names = local.dns-names
dns_names = local.dns_names
service = local.service
icon = local.icon
request_headers = local.request_headers

4
apps/woodpecker/datas.tf
View File

@@ -150,9 +150,9 @@ data "kustomization_overlay" "data" {
- name: WOODPECKER_ADMIN
value: "${var.admin-users}"
- name: WOODPECKER_HOST
value: "https://${var.sub-domain}.${var.domain-name}"
value: "https://${var.sub_domain}.${var.domain_name}"
- name: WOODPECKER_HOST
value: "https://${var.sub-domain}.${var.domain-name}"
value: "https://${var.sub_domain}.${var.domain_name}"
envFrom:
- secretRef:
name: woodpecker-secret

2
apps/woodpecker/gitea_token.tf
View File

@@ -22,7 +22,7 @@ resource "gitea_oauth2_app" "prj" {
name = var.component
confidential_client = true
redirect_uris = [
"https://${var.sub-domain}.${var.domain-name}/authorize"
"https://${var.sub_domain}.${var.domain_name}/authorize"
]
}

8
apps/woodpecker/index.yaml
View File

@@ -36,12 +36,12 @@ options:
examples:
- your-company
type: string
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
type: string
app-group:
app_group:
default: dev
examples:
- dev
@@ -162,7 +162,7 @@ options:
default: 10Gi
type: string
type: object
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
@@ -187,7 +187,7 @@ options:
default: '120'
type: string
type: object
sub-domain:
sub_domain:
default: ci
examples:
- ci

12
apps/woodpecker/presentation.tf
View File

@@ -1,6 +1,6 @@
locals {
dns-name = "${var.sub-domain}.${var.domain-name}"
dns-names = [local.dns-name]
dns_name = "${var.sub_domain}.${var.domain_name}"
dns_names = [local.dns_name]
icon = "favicons/favicon-light-default.png"
service = {
"name" = "${var.component}-server"
@@ -16,9 +16,9 @@ module "ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.common-labels
dns-names = local.dns-names
dns_names = local.dns_names
middlewares = []
service = local.service
providers = {
@@ -30,8 +30,8 @@ module "application" {
source = "/dist/modules/application"
component = var.component
instance = var.instance
app-group = var.app-group
dns-name = local.dns-name
app_group = var.app_group
dns_name = local.dns_name
icon = local.icon
providers = {
authentik = authentik

8
meta/domain-apps/apps.tf
View File

@@ -2,15 +2,15 @@ locals {
annotations = {
"vynil.solidite.fr/meta" = var.component
"vynil.solidite.fr/name" = "${var.namespace}-auth"
"vynil.solidite.fr/domain" = var.domain-name
"vynil.solidite.fr/domain" = var.domain_name
"vynil.solidite.fr/issuer" = var.issuer
"vynil.solidite.fr/ingress" = var.ingress-class
"vynil.solidite.fr/ingress" = var.ingress_class
}
global = {
"domain" = var.namespace
"domain-name" = var.domain-name
"domain_name" = var.domain_name
"issuer" = var.issuer
"ingress-class" = var.ingress-class
"ingress_class" = var.ingress_class
"backups" = var.backups
}
default-mode = var.storage-classes.FilesystemReadWriteMany!=""?"ReadWriteMany":"ReadWriteOnce"

4
meta/domain-apps/index.yaml
View File

@@ -73,7 +73,7 @@ options:
examples:
- letsencrypt-prod
type: string
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
@@ -103,7 +103,7 @@ options:
default: ''
type: string
type: object
ingress-class:
ingress_class:
default: traefik
examples:
- traefik

8
meta/domain-auth/apps.tf
View File

@@ -2,15 +2,15 @@ locals {
annotations = {
"vynil.solidite.fr/meta" = var.component
"vynil.solidite.fr/name" = "${var.namespace}-auth"
"vynil.solidite.fr/domain" = var.domain-name
"vynil.solidite.fr/domain" = var.domain_name
"vynil.solidite.fr/issuer" = var.issuer
"vynil.solidite.fr/ingress" = var.ingress-class
"vynil.solidite.fr/ingress" = var.ingress_class
}
global = {
"domain" = var.namespace
"domain-name" = var.domain-name
"domain_name" = var.domain_name
"issuer" = var.issuer
"ingress-class" = var.ingress-class
"ingress_class" = var.ingress_class
"backups" = var.backups
}
authentik = { for k, v in var.authentik : k => v if k!="enable" }

4
meta/domain-auth/index.yaml
View File

@@ -41,7 +41,7 @@ options:
default: true
type: boolean
type: object
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
@@ -81,7 +81,7 @@ options:
default: backup-settings
type: string
type: object
ingress-class:
ingress_class:
default: traefik
examples:
- traefik

8
meta/domain-ci/apps.tf
View File

@@ -2,15 +2,15 @@ locals {
annotations = {
"vynil.solidite.fr/meta" = var.component
"vynil.solidite.fr/name" = var.namespace
"vynil.solidite.fr/domain" = var.domain-name
"vynil.solidite.fr/domain" = var.domain_name
"vynil.solidite.fr/issuer" = var.issuer
"vynil.solidite.fr/ingress" = var.ingress-class
"vynil.solidite.fr/ingress" = var.ingress_class
}
global = {
"domain" = var.namespace
"domain-name" = var.domain-name
"domain_name" = var.domain_name
"issuer" = var.issuer
"ingress-class" = var.ingress-class
"ingress_class" = var.ingress_class
"backups" = var.backups
}
default-mode = var.storage-classes.FilesystemReadWriteMany!=""?"ReadWriteMany":"ReadWriteOnce"

4
meta/domain-ci/index.yaml
View File

@@ -41,12 +41,12 @@ options:
examples:
- your-company
type: string
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
type: string
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com

14
meta/domain-devspaces/apps.tf
View File

@@ -2,21 +2,21 @@ locals {
annotations = {
"vynil.solidite.fr/meta" = var.component
"vynil.solidite.fr/name" = "${var.domain}-devspaces"
"vynil.solidite.fr/domain" = var.domain-name
"vynil.solidite.fr/domain" = var.domain_name
"vynil.solidite.fr/issuer" = var.issuer
"vynil.solidite.fr/ingress" = var.ingress-class
"vynil.solidite.fr/ingress" = var.ingress_class
}
global = {
"domain" = var.domain
"domain-name" = var.domain-name
"domain_name" = var.domain_name
"issuer" = var.issuer
"ingress-class" = var.ingress-class
"ingress_class" = var.ingress_class
"backups" = var.backups
"app-group" = var.app-group
"app_group" = var.app_group
}
global-apps = merge(local.global, {
"domain-name" = "devtools.${var.domain-name}"
"app-group" = "dev"
"domain_name" = "devtools.${var.domain_name}"
"app_group" = "dev"
})
okd = merge({
"namespaces" = concat([

8
meta/domain-devspaces/index.yaml
View File

@@ -110,7 +110,7 @@ options:
type: string
type: object
type: array
app-group:
app_group:
default: dev
examples:
- dev
@@ -220,7 +220,7 @@ options:
type: string
type: object
type: array
stations-sub-domain:
stations-sub_domain:
default: code
examples:
- code
@@ -230,12 +230,12 @@ options:
examples:
- letsencrypt-prod
type: string
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
type: string
ingress-class:
ingress_class:
default: traefik
examples:
- traefik

2
meta/domain-devspaces/stations.tf
View File

@@ -21,7 +21,7 @@ locals {
"organisation" = org
"usage" = "station"
"station" = station
"sub-domain" = "${station.name}.stations"
"sub_domain" = "${station.name}.stations"
}) if ds.name == dsname
]
]) if org.name == name

12
meta/domain-erp/apps.tf
View File

@@ -2,19 +2,19 @@ locals {
annotations = {
"vynil.solidite.fr/meta" = var.component
"vynil.solidite.fr/name" = var.namespace
"vynil.solidite.fr/domain" = var.domain-name
"vynil.solidite.fr/domain" = var.domain_name
"vynil.solidite.fr/issuer" = var.issuer
"vynil.solidite.fr/ingress" = var.ingress-class
"vynil.solidite.fr/ingress" = var.ingress_class
}
annotations_default = {
"vynil.solidite.fr/default/domain_name" = var.domain-name
"vynil.solidite.fr/default/*" = var.domain-name
"vynil.solidite.fr/default/domain_name" = var.domain_name
"vynil.solidite.fr/default/*" = var.domain_name
}
global = {
"domain" = var.namespace
"domain-name" = var.domain-name
"domain_name" = var.domain_name
"issuer" = var.issuer
"ingress-class" = var.ingress-class
"ingress_class" = var.ingress_class
"backups" = var.backups
}
default-mode = var.storage-classes.FilesystemReadWriteMany!=""?"ReadWriteMany":"ReadWriteOnce"

4
meta/domain-erp/index.yaml
View File

@@ -36,7 +36,7 @@ options:
default: backup-settings
type: string
type: object
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
@@ -46,7 +46,7 @@ options:
examples:
- letsencrypt-prod
type: string
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com

10
meta/domain-infra/apps.tf
View File

@@ -2,17 +2,17 @@ locals {
annotations = {
"vynil.solidite.fr/meta" = "domain-ci"
"vynil.solidite.fr/name" = var.namespace
"vynil.solidite.fr/domain" = var.domain-name
"vynil.solidite.fr/domain" = var.domain_name
"vynil.solidite.fr/issuer" = var.issuer
"vynil.solidite.fr/ingress" = var.ingress-class
"vynil.solidite.fr/ingress" = var.ingress_class
}
global = {
"domain" = var.namespace
"domain-name" = "admin.${var.domain-name}"
"domain_name" = "admin.${var.domain_name}"
"issuer" = var.issuer
"ingress-class" = var.ingress-class
"ingress_class" = var.ingress_class
"backups" = var.backups
"app-group" = var.app-group
"app_group" = var.app_group
}
traefik = { for k, v in var.traefik : k => v if k!="enable" }
dns = { for k, v in var.dns : k => v if k!="enable" }

6
meta/domain-infra/index.yaml
View File

@@ -46,7 +46,7 @@ options:
default: false
type: boolean
type: object
app-group:
app_group:
default: infra
examples:
- infra
@@ -63,7 +63,7 @@ options:
type: object
x-vynil-category: apps
x-vynil-package: gramo
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
@@ -105,7 +105,7 @@ options:
default: domain
type: string
type: object
ingress-class:
ingress_class:
default: traefik
examples:
- traefik

8
meta/domain-mail/apps.tf
View File

@@ -2,15 +2,15 @@ locals {
annotations = {
"vynil.solidite.fr/meta" = var.component
"vynil.solidite.fr/name" = var.namespace
"vynil.solidite.fr/domain" = var.domain-name
"vynil.solidite.fr/domain" = var.domain_name
"vynil.solidite.fr/issuer" = var.issuer
"vynil.solidite.fr/ingress" = var.ingress-class
"vynil.solidite.fr/ingress" = var.ingress_class
}
global = {
"domain" = var.namespace
"domain-name" = var.domain-name
"domain_name" = var.domain_name
"issuer" = var.issuer
"ingress-class" = var.ingress-class
"ingress_class" = var.ingress_class
"backups" = var.backups
}
wildduck = { for k, v in var.wildduck : k => v if k!="enable" }

4
meta/domain-mail/index.yaml
View File

@@ -6,7 +6,7 @@ metadata:
name: domain-mail
description: null
options:
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
@@ -71,7 +71,7 @@ options:
default: domain
type: string
type: object
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com

10
meta/domain-monitor/apps.tf
View File

@@ -2,17 +2,17 @@ locals {
annotations = {
"vynil.solidite.fr/meta" = "domain-monitor"
"vynil.solidite.fr/name" = var.namespace
"vynil.solidite.fr/domain" = var.domain-name
"vynil.solidite.fr/domain" = var.domain_name
"vynil.solidite.fr/issuer" = var.issuer
"vynil.solidite.fr/ingress" = var.ingress-class
"vynil.solidite.fr/ingress" = var.ingress_class
}
global = {
"domain" = var.namespace
"domain-name" = "monitor.${var.domain-name}"
"domain_name" = "monitor.${var.domain_name}"
"issuer" = var.issuer
"ingress-class" = var.ingress-class
"ingress_class" = var.ingress_class
"backups" = var.backups
"app-group" = var.app-group
"app_group" = var.app_group
}
grafana = { for k, v in var.grafana : k => v if k!="enable" }
prometheus = { for k, v in var.prometheus : k => v if k!="enable" }

6
meta/domain-monitor/index.yaml
View File

@@ -71,12 +71,12 @@ options:
type: object
x-vynil-category: monitor
x-vynil-package: dashboards-cluster
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
type: string
app-group:
app_group:
default: monitor
examples:
- monitor
@@ -176,7 +176,7 @@ options:
type: object
x-vynil-category: monitor
x-vynil-package: dashboards-namespace
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com

4
meta/domain/index.yaml
View File

@@ -111,7 +111,7 @@ options:
examples:
- letsencrypt-prod
type: string
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
@@ -228,7 +228,7 @@ options:
default: backup-settings
type: string
type: object
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com

8
meta/domain/installs.tf
View File

@@ -1,9 +1,9 @@
locals {
global = {
"domain" = var.namespace
"domain-name" = var.domain-name
"domain_name" = var.domain_name
"issuer" = var.issuer
"ingress-class" = var.ingress-class
"ingress_class" = var.ingress_class
"distributions" = var.distributions
"backups" = var.backups
"storage-classes"= var.storage-classes
@@ -11,9 +11,9 @@ locals {
annotations = {
"vynil.solidite.fr/meta" = var.component
"vynil.solidite.fr/name" = var.namespace
"vynil.solidite.fr/domain" = var.domain-name
"vynil.solidite.fr/domain" = var.domain_name
"vynil.solidite.fr/issuer" = var.issuer
"vynil.solidite.fr/ingress" = var.ingress-class
"vynil.solidite.fr/ingress" = var.ingress_class
}
auth = { for k, v in var.auth : k => v if k!="enable" }
infra = { for k, v in var.infra : k => v if k!="enable" }

16
modules/application/application.tf
View File

@@ -1,36 +1,36 @@
locals {
app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
main-group = format("app-%s", local.app-name)
app_name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
main-group = format("app-%s", local.app_name)
}
data "authentik_group" "akadmin" {
name = "authentik Admins"
}
resource "authentik_group" "groups" {
name = local.main-group
attributes = jsonencode({"${local.app-name}" = true})
attributes = jsonencode({"${local.app_name}" = true})
}
resource "authentik_group" "subgroup" {
count = length(var.sub-groups)
name = format("%s-%s", local.app-name, var.sub-groups[count.index])
name = format("%s-%s", local.app_name, var.sub-groups[count.index])
parent = authentik_group.groups.id
}
resource "authentik_application" "prj_app" {
name = "${var.instance}"
slug = "${var.component}-${var.instance}"
group = var.app-group
group = var.app_group
protocol_provider = var.protocol_provider
backchannel_providers = var.backchannel_providers
meta_launch_url = format("https://%s", var.dns-name)
meta_icon = format("https://%s/%s", var.dns-name, var.icon)
meta_launch_url = format("https://%s", var.dns_name)
meta_icon = format("https://%s/%s", var.dns_name, var.icon)
}
resource "authentik_policy_expression" "policy" {
name = local.main-group
expression = <<-EOF
attr = request.user.group_attributes()
return attr['${local.app-name}'] if '${local.app-name}' in attr else False
return attr['${local.app_name}'] if '${local.app_name}' in attr else False
EOF
}

4
modules/application/variables.tf
View File

@@ -7,14 +7,14 @@ variable "instance" {
variable "icon" {
type = string
}
variable "app-group" {
variable "app_group" {
type = string
}
variable "protocol_provider" {
type = number
default = null
}
variable "dns-name" {
variable "dns_name" {
type = string
}
variable "sub-groups" {

16
modules/forward/forward.tf
View File

@@ -1,10 +1,10 @@
locals {
forward-outpost-providers = jsondecode(data.http.get_forward_outpost.response_body).results[0].providers
forward-outpost-pk = jsondecode(data.http.get_forward_outpost.response_body).results[0].pk
app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
main-group = format("app-%s", local.app-name)
external-url = format("https://%s", var.dns-names[0])
rules-icons = [ for v in var.dns-names : {
app_name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
main-group = format("app-%s", local.app_name)
external-url = format("https://%s", var.dns_names[0])
rules-icons = [ for v in var.dns_names : {
"host" = "${v}"
"http" = {
"paths" = [{
@@ -28,10 +28,10 @@ resource "kubectl_manifest" "prj_ingress_icon" {
namespace: "${var.namespace}"
labels: ${jsonencode(var.labels)}
spec:
ingressClassName: "${var.ingress-class}"
ingressClassName: "${var.ingress_class}"
rules: ${jsonencode(local.rules-icons)}
tls:
- hosts: ${jsonencode(var.dns-names)}
- hosts: ${jsonencode(var.dns_names)}
secretName: "${var.instance}-cert"
EOF
}
@@ -41,7 +41,7 @@ data "authentik_flow" "default-authorization-flow" {
}
resource "authentik_provider_proxy" "prj_forward" {
name = local.app-name
name = local.app_name
external_host = local.external-url
authorization_flow = data.authentik_flow.default-authorization-flow.id
mode = "forward_single"
@@ -74,7 +74,7 @@ resource "kubectl_manifest" "prj_middleware" {
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: "forward-${local.app-name}"
name: "forward-${local.app_name}"
namespace: "${var.namespace}"
labels: ${jsonencode(var.labels)}
spec:

4
modules/forward/variables.tf
View File

@@ -13,13 +13,13 @@ variable "domain" {
variable "namespace" {
type = string
}
variable "ingress-class" {
variable "ingress_class" {
type = string
}
variable "labels" {
type = map(string)
}
variable "dns-names" {
variable "dns_names" {
type = list(string)
}
variable "access-token-validity" {

8
modules/ingress/ingress.tf
View File

@@ -1,6 +1,6 @@
locals {
rules = [ for v in var.dns-names : {
rules = [ for v in var.dns_names : {
"host" = "${v}"
"http" = {
"paths" = [{
@@ -25,7 +25,7 @@ resource "kubectl_manifest" "prj_certificate" {
labels: ${jsonencode(var.labels)}
spec:
secretName: "${var.instance}${var.component==""?"":"-"}${var.component}-cert"
dnsNames: ${jsonencode(var.dns-names)}
dnsNames: ${jsonencode(var.dns_names)}
issuerRef:
name: "${var.issuer}"
kind: "ClusterIssuer"
@@ -61,10 +61,10 @@ resource "kubectl_manifest" "prj_ingress" {
annotations:
"traefik.ingress.kubernetes.io/router.middlewares": "${join(",", [for m in concat(["${var.instance}-https"],var.middlewares) : format("%s-%s@kubernetescrd", var.namespace, m)])}"
spec:
ingressClassName: "${var.ingress-class}"
ingressClassName: "${var.ingress_class}"
rules: ${jsonencode(local.rules)}
tls:
- hosts: ${jsonencode(var.dns-names)}
- hosts: ${jsonencode(var.dns_names)}
secretName: "${var.instance}${var.secret-component!=""?"-${var.secret-component}":var.component==""?"":"-${var.component}"}-cert"
EOF
}

4
modules/ingress/variables.tf
View File

@@ -10,14 +10,14 @@ variable "namespace" {
variable "issuer" {
type = string
}
variable "ingress-class" {
variable "ingress_class" {
type = string
}
variable "labels" {
type = map(string)
}
variable "dns-names" {
variable "dns_names" {
type = list(string)
}
variable "middlewares" {

2
modules/oauth2/oauth2.tf
View File

@@ -50,7 +50,7 @@ resource "authentik_provider_oauth2" "oauth2" {
signing_key = data.authentik_certificate_key_pair.ca.id
property_mappings = data.authentik_scope_mapping.oauth2.ids
redirect_uris = [
"https://${var.dns-name}/${var.redirect-path}"
"https://${var.dns_name}/${var.redirect-path}"
]
}

2
modules/oauth2/variables.tf
View File

@@ -10,7 +10,7 @@ variable "namespace" {
variable "labels" {
type = map(string)
}
variable "dns-name" {
variable "dns_name" {
type = string
}
variable "redirect-path" {

4
modules/saml/saml.tf
View File

@@ -35,7 +35,7 @@ resource "kubectl_manifest" "saml_certificate" {
labels: ${jsonencode(var.labels)}
spec:
secretName: "${var.instance}-${var.component}-saml"
dnsNames: ${jsonencode(var.dns-names)}
dnsNames: ${jsonencode(var.dns_names)}
issuerRef:
name: "self-sign"
kind: "ClusterIssuer"
@@ -47,7 +47,7 @@ resource "authentik_provider_saml" "prj" {
name = "${var.component}-${var.instance}-saml"
authentication_flow = data.authentik_flow.default-authentication-flow.id
authorization_flow = data.authentik_flow.default-authorization-flow.id
acs_url = "https://${var.dns-names[0]}/${var.acs-path}"
acs_url = "https://${var.dns_names[0]}/${var.acs-path}"
property_mappings = data.authentik_property_mapping_saml.saml_maps.ids
name_id_mapping = data.authentik_property_mapping_saml.saml_name.id
signing_kp = data.authentik_certificate_key_pair.generated.id

2
modules/saml/variables.tf
View File

@@ -4,7 +4,7 @@ variable "component" {
variable "instance" {
type = string
}
variable "dns-names" {
variable "dns_names" {
type = list(string)
}
variable "acs-path" {

8
monitor/alertmanager/index.yaml
View File

@@ -6,7 +6,7 @@ metadata:
name: alertmanager
description: null
options:
sub-domain:
sub_domain:
default: alertmanager
examples:
- alertmanager
@@ -16,7 +16,7 @@ options:
examples:
- letsencrypt-prod
type: string
app-group:
app_group:
default: monitor
examples:
- monitor
@@ -65,7 +65,7 @@ options:
examples:
- info
type: string
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
@@ -75,7 +75,7 @@ options:
examples:
- 120h
type: string
ingress-class:
ingress_class:
default: traefik
examples:
- traefik

20
monitor/alertmanager/presentation.tf
View File

@@ -1,7 +1,7 @@
locals {
dns-name = "${var.sub-domain}.${var.domain-name}"
dns-names = [local.dns-name]
app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
dns_name = "${var.sub_domain}.${var.domain_name}"
dns_names = [local.dns_name]
app_name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
icon = "favicon.ico"
request_headers = {
"Content-Type" = "application/json"
@@ -21,10 +21,10 @@ module "ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress_class = var.ingress-class
ingress_class = var.ingress_class
labels = local.common-labels
dns_names = local.dns-names
middlewares = ["forward-${local.app-name}"]
dns_names = local.dns_names
middlewares = ["forward-${local.app_name}"]
services = [local.service]
providers = {
kubectl = kubectl
@@ -35,8 +35,8 @@ module "application" {
source = "git::https://git.solidite.fr/vynil/kydah-modules.git//application"
component = var.component
instance = var.instance
app_group = var.app-group
dns_name = local.dns-name
app_group = var.app_group
dns_name = local.dns_name
icon = local.icon
protocol_provider = module.forward.provider-id
providers = {
@@ -60,9 +60,9 @@ module "forward" {
instance = var.instance
domain = var.domain
namespace = var.namespace
ingress_class = var.ingress-class
ingress_class = var.ingress_class
labels = local.common-labels
dns_names = local.dns-names
dns_names = local.dns_names
service = local.service
icon = local.icon
request_headers = local.request_headers

2
monitor/grafana/config.tf
View File

@@ -19,7 +19,7 @@ plugins = /var/lib/grafana/plugins
provisioning = /etc/grafana/provisioning
[server]
domain = ''
root_url = 'https://${local.dns-name}/'
root_url = 'https://${local.dns_name}/'
[users]
auto_assign_org = true
auto_assign_org_id = 1

8
monitor/grafana/index.yaml
View File

@@ -25,7 +25,7 @@ options:
default: 10Gi
type: string
type: object
sub-domain:
sub_domain:
default: grafana
examples:
- grafana
@@ -132,7 +132,7 @@ options:
type: string
type: object
type: object
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
@@ -147,12 +147,12 @@ options:
examples:
- grafana_admin
type: string
app-group:
app_group:
default: monitor
examples:
- monitor
type: string
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com

16
monitor/grafana/presentation.tf
View File

@@ -1,7 +1,7 @@
locals {
dns-name = "${var.sub-domain}.${var.domain-name}"
dns-names = [local.dns-name]
app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
dns_name = "${var.sub_domain}.${var.domain_name}"
dns_names = [local.dns_name]
app_name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
icon = "public/img/grafana_icon.svg"
request_headers = {
"Content-Type" = "application/json"
@@ -21,9 +21,9 @@ module "ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress_class = var.ingress-class
ingress_class = var.ingress_class
labels = local.common-labels
dns_names = local.dns-names
dns_names = local.dns_names
middlewares = []
services = [local.service]
providers = {
@@ -35,8 +35,8 @@ module "ingress" {
source = "git::https://git.solidite.fr/vynil/kydah-modules.git//application"
component = var.component
instance = var.instance
app_group = var.app-group
dns_name = local.dns-name
app_group = var.app_group
dns_name = local.dns_name
icon = local.icon
sub_groups = ["admin"]
protocol_provider = module.oauth2.provider-id
@@ -52,7 +52,7 @@ module "oauth2" {
namespace = var.namespace
domain = var.domain
labels = local.common-labels
dns_name = local.dns-name
dns_name = local.dns_name
redirect_path = "login/generic_oauth"
providers = {
kubernetes = kubernetes

8
monitor/prometheus/index.yaml
View File

@@ -16,12 +16,12 @@ options:
examples:
- 10d
type: string
sub-domain:
sub_domain:
default: prometheus
examples:
- prometheus
type: string
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
@@ -80,12 +80,12 @@ options:
examples:
- 1
type: integer
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
type: string
app-group:
app_group:
default: monitor
examples:
- monitor

20
monitor/prometheus/presentation.tf
View File

@@ -1,7 +1,7 @@
locals {
dns-name = "${var.sub-domain}.${var.domain-name}"
dns-names = [local.dns-name]
app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
dns_name = "${var.sub_domain}.${var.domain_name}"
dns_names = [local.dns_name]
app_name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
icon = "favicon.ico"
request_headers = {
"Content-Type" = "application/json"
@@ -21,10 +21,10 @@ module "ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress_class = var.ingress-class
ingress_class = var.ingress_class
labels = local.common-labels
dns_names = local.dns-names
middlewares = ["forward-${local.app-name}"]
dns_names = local.dns_names
middlewares = ["forward-${local.app_name}"]
services = [local.service]
providers = {
kubectl = kubectl
@@ -35,8 +35,8 @@ module "application" {
source = "git::https://git.solidite.fr/vynil/kydah-modules.git//application"
component = var.component
instance = var.instance
app_group = var.app-group
dns_name = local.dns-name
app_group = var.app_group
dns_name = local.dns_name
icon = local.icon
protocol_provider = module.forward.provider-id
providers = {
@@ -60,9 +60,9 @@ module "forward" {
instance = var.instance
domain = var.domain
namespace = var.namespace
ingress_class = var.ingress-class
ingress_class = var.ingress_class
labels = local.common-labels
dns_names = local.dns-names
dns_names = local.dns_names
service = local.service
icon = local.icon
request_headers = local.request_headers

6
share/authentik-forward/index.yaml
View File

@@ -11,7 +11,7 @@ options:
examples:
- letsencrypt-prod
type: string
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
@@ -21,12 +21,12 @@ options:
examples:
- your-company
type: string
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
type: string
sub-domain:
sub_domain:
default: null
dependencies:
- dist: null

2
share/authentik/datas.tf
View File

@@ -46,7 +46,7 @@ data "kustomization_overlay" "data" {
"AUTHENTIK_POSTGRESQL__PORT=5432",
"AUTHENTIK_POSTGRESQL__USER=${var.component}",
"AUTHENTIK_REDIS__HOST=${var.name}-${var.component}-redis",
"AUTHENTIK_BOOTSTRAP_EMAIL=${var.admin.email}@${var.domain-name}",
"AUTHENTIK_BOOTSTRAP_EMAIL=${var.admin.email}@${var.domain_name}",
]
}
patches {

6
share/authentik/index.yaml
View File

@@ -115,7 +115,7 @@ options:
examples:
- letsencrypt-prod
type: string
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
@@ -183,7 +183,7 @@ options:
default: 2023.8.3
type: string
type: object
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
@@ -198,7 +198,7 @@ options:
default: auth-admin
type: string
type: object
sub-domain:
sub_domain:
default: auth
examples:
- auth

10
share/authentik/ingress.tf
View File

@@ -1,5 +1,5 @@
locals {
dns-names = ["${var.sub-domain}.${var.domain-name}"]
dns_names = ["${var.sub_domain}.${var.domain_name}"]
middlewares = ["${var.instance}-https"]
service = {
"name" = "${var.instance}"
@@ -7,7 +7,7 @@ locals {
"number" = 80
}
}
rules = [ for v in local.dns-names : {
rules = [ for v in local.dns_names : {
"host" = "${v}"
"http" = {
"paths" = [{
@@ -31,7 +31,7 @@ resource "kubectl_manifest" "prj_certificate" {
labels: ${jsonencode(local.common-labels)}
spec:
secretName: "${var.instance}-cert"
dnsNames: ${jsonencode(local.dns-names)}
dnsNames: ${jsonencode(local.dns_names)}
issuerRef:
name: "${var.issuer}"
kind: "ClusterIssuer"
@@ -66,10 +66,10 @@ resource "kubectl_manifest" "prj_ingress" {
annotations:
"traefik.ingress.kubernetes.io/router.middlewares": "${join(",", [for m in local.middlewares : format("%s-%s@kubernetescrd", var.namespace, m)])}"
spec:
ingressClassName: "${var.ingress-class}"
ingressClassName: "${var.ingress_class}"
rules: ${jsonencode(local.rules)}
tls:
- hosts: ${jsonencode(local.dns-names)}
- hosts: ${jsonencode(local.dns_names)}
secretName: "${var.instance}-cert"
EOF
}

6
share/authentik/redis.tf
View File

@@ -8,7 +8,7 @@ resource "kubectl_manifest" "authentik_redis" {
labels: ${jsonencode(local.common-labels)}
spec:
kubernetesConfig:
image: "${var.redis.image}"
image: "${var.images.redis.registry}/${var.images.redis.repository}:${var.images.redis.tag}"
imagePullPolicy: "IfNotPresent"
redisSecret:
name: "${var.component}"
@@ -19,10 +19,10 @@ resource "kubectl_manifest" "authentik_redis" {
accessModes: ["ReadWriteOnce"]
resources:
requests:
storage: "${var.redis.storage}"
storage: "${var.storage.redis}"
redisExporter:
enabled: ${var.redis.exporter.enabled}
image: "${var.redis.exporter.image}"
image: "${var.images.redis_exporter.registry}/${var.images.redis_exporter.repository}:${var.images.redis_exporter.tag}"
securityContext:
runAsUser: 1000
fsGroup: 1000

26
share/dataset-pg/directus.tf
View File

@@ -5,7 +5,7 @@ locals {
"app.kubernetes.io/component" = "directus"
})
directus-icon = "admin/img/directus-white.png"
directus-dns-name = "directus.${local.dns-name}"
directus-dns_name = "directus.${local.dns_name}"
directus-service = {
"name" = "directus-${var.instance}"
"port" = {
@@ -45,15 +45,15 @@ resource "kubectl_manifest" "directus_config" {
DB_PORT: "5432"
STORAGE_LOCATIONS: "local"
STORAGE_LOCAL_ROOT: "/var/store"
ADMIN_EMAIL: "admin@${var.domain-name}"
ADMIN_EMAIL: "admin@${var.domain_name}"
NODE_EXTRA_CA_CERTS: "/etc/local-ca/ca.crt"
TELEMETRY: "false"
AUTH_PROVIDERS: "VYNIL"
AUTH_VYNIL_DRIVER: "openid"
AUTH_VYNIL_ALLOW_PUBLIC_REGISTRATION: "true"
AUTH_VYNIL_ISSUER_URL: "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/directus-${replace(var.sub-domain, ".", "-")}-${var.instance}/.well-known/openid-configuration"
AUTH_VYNIL_ISSUER_URL: "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/directus-${replace(var.sub_domain, ".", "-")}-${var.instance}/.well-known/openid-configuration"
AUTH_VYNIL_IDENTIFIER_KEY: "email"
PUBLIC_URL: "https://${local.directus-dns-name}"
PUBLIC_URL: "https://${local.directus-dns_name}"
EOF
}
@@ -133,12 +133,12 @@ resource "kubectl_manifest" "directus_deploy" {
valueFrom:
secretKeyRef:
key: "client-id"
name: "directus-${replace(var.sub-domain, ".", "-")}-${var.instance}-id"
name: "directus-${replace(var.sub_domain, ".", "-")}-${var.instance}-id"
- name: AUTH_VYNIL_CLIENT_SECRET
valueFrom:
secretKeyRef:
key: "client-secret"
name: "directus-${replace(var.sub-domain, ".", "-")}-${var.instance}-secret"
name: "directus-${replace(var.sub_domain, ".", "-")}-${var.instance}-secret"
- name: DB_USER
valueFrom:
secretKeyRef:
@@ -216,9 +216,9 @@ module "directus-ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.directus-labels
dns-names = [local.directus-dns-name]
dns_names = [local.directus-dns_name]
create-redirect = true
middlewares = []
service = local.directus-service
@@ -230,10 +230,10 @@ module "directus-ingress" {
module "directus-application" {
count = var.extentions.directus.enable ? 1 : 0
source = "/dist/modules/application"
component = "directus-${replace(var.sub-domain, ".", "-")}"
component = "directus-${replace(var.sub_domain, ".", "-")}"
instance = var.instance
app-group = var.app-group
dns-name = local.directus-dns-name
app_group = var.app_group
dns_name = local.directus-dns_name
icon = local.directus-icon
protocol_provider = module.directus-oauth2[0].provider-id
providers = {
@@ -244,11 +244,11 @@ module "directus-application" {
module "directus-oauth2" {
count = var.extentions.directus.enable ? 1 : 0
source = "/dist/modules/oauth2"
component = "directus-${replace(var.sub-domain, ".", "-")}"
component = "directus-${replace(var.sub_domain, ".", "-")}"
instance = var.instance
namespace = var.namespace
labels = local.directus-labels
dns-name = local.directus-dns-name
dns_name = local.directus-dns_name
redirect-path = "auth/login/VYNIL/callback"
providers = {
kubernetes = kubernetes

8
share/dataset-pg/index.yaml
View File

@@ -65,17 +65,17 @@ options:
examples:
- your-company
type: string
sub-domain:
sub_domain:
default: dataset-pg
examples:
- dataset-pg
type: string
app-group:
app_group:
default: api
examples:
- api
type: string
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
@@ -85,7 +85,7 @@ options:
examples:
- 8Gi
type: string
ingress-class:
ingress_class:
default: traefik
examples:
- traefik

2
share/dataset-pg/postgresql.tf
View File

@@ -1,5 +1,5 @@
locals {
dns-name = "${var.instance}.${var.sub-domain}.${var.domain-name}"
dns_name = "${var.instance}.${var.sub_domain}.${var.domain_name}"
pg-labels = merge(local.common-labels, {
"app.kubernetes.io/component" = "postgresql"
})

14
share/dataset-pg/postgrest.tf
View File

@@ -2,7 +2,7 @@ locals {
prest-labels = merge(local.common-labels, {
"app.kubernetes.io/component" = "postgrest"
})
prest-dns-name = "api.${local.dns-name}"
prest-dns_name = "api.${local.dns_name}"
prest-service = {
"name" = "postgrest-${var.instance}"
"port" = {
@@ -32,9 +32,9 @@ resource "kubectl_manifest" "postgrest_config" {
PGPORT: "5432"
PGRST_DB_SCHEMA: public
PGRST_DB_ANON_ROLE: anonymous
PGRST_OPENAPI_SERVER_PROXY_URI: "https://${local.prest-dns-name}"
PGRST_OPENAPI_SERVER_PROXY_URI: "https://${local.prest-dns_name}"
PGRST_ADMIN_SERVER_PORT: "9000"
API_URL: "https://${local.prest-dns-name}"
API_URL: "https://${local.prest-dns_name}"
BASE_URL: "/ui"
EOF
}
@@ -152,9 +152,9 @@ module "postgrest-ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.prest-labels
dns-names = [local.prest-dns-name]
dns_names = [local.prest-dns_name]
create-redirect = true
middlewares = []
service = local.prest-service
@@ -184,9 +184,9 @@ module "swagger-ingress" {
instance = var.instance
namespace = var.namespace
issuer = var.issuer
ingress-class = var.ingress-class
ingress_class = var.ingress_class
labels = local.prest-labels
dns-names = [local.prest-dns-name]
dns_names = [local.prest-dns_name]
middlewares = []
create-cert = false
sub-path = "ui"

4
share/dns/config.tf
View File

@@ -23,13 +23,13 @@ locals {
}
EOF
soa-ns = <<-EOF
@ IN SOA ${var.sub-domain}.${var.domain-name}. ${var.domain-name}. (
@ IN SOA ${var.sub_domain}.${var.domain_name}. ${var.domain_name}. (
${formatdate("YYYYMMDDhh",timestamp())} ; Serial
4H ; Refresh
1H ; Retry
7D ; Expire
4H ) ; Negative Cache TTL
@ IN NS ${var.sub-domain}.${var.domain-name}.
@ IN NS ${var.sub_domain}.${var.domain_name}.
EOF
files = merge({
"Corefile" = join("\n", concat([local.begin-core],[for z in var.zones: format("file /etc/coredns/%s.db %s", z.name,z.name)],[local.end-core]))

4
share/dns/index.yaml
View File

@@ -6,12 +6,12 @@ metadata:
name: dns
description: null
options:
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
type: string
sub-domain:
sub_domain:
default: dns
examples:
- dns

2
share/organisation/gitea-user.tf
View File

@@ -83,7 +83,7 @@ resource "gitea_user" "user-ci" {
username = "${var.instance}-ci"
login_name = "${var.instance}-ci"
password = random_password.password.result
email = "${var.instance}-ci@${var.domain-name}"
email = "${var.instance}-ci@${var.domain_name}"
must_change_password = true
}

6
share/organisation/index.yaml
View File

@@ -27,7 +27,7 @@ options:
type: string
type: object
type: array
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
@@ -87,12 +87,12 @@ options:
default: backup-settings
type: string
type: object
app-group:
app_group:
default: dev
examples:
- dev
type: string
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com

12
share/organisation/stages.tf
View File

@@ -1,17 +1,17 @@
locals {
annotations = {
"vynil.solidite.fr/name" = "${var.component}"
"vynil.solidite.fr/domain" = var.domain-name
"vynil.solidite.fr/domain" = var.domain_name
"vynil.solidite.fr/issuer" = var.issuer
"vynil.solidite.fr/ingress" = var.ingress-class
"vynil.solidite.fr/ingress" = var.ingress_class
}
global = {
"domain" = var.namespace
"domain-name" = var.domain-name
"domain_name" = var.domain_name
"issuer" = var.issuer
"ingress-class" = var.ingress-class
"ingress_class" = var.ingress_class
"backups" = var.backups
"app-group" = var.app-group
"app_group" = var.app_group
}
sorted-stage-name = reverse(distinct(sort([for s in var.stages: s.name])))
sorted-dataset-name = reverse(distinct(sort([for d in var.datasets: d.name])))
@@ -26,7 +26,7 @@ locals {
for name in local.sorted-dataset-name: [
for ds in var.datasets:
merge(ds,{
"sub-domain" = "${stage}.${var.instance}"
"sub_domain" = "${stage}.${var.instance}"
"namespace" = "${var.domain}-${var.instance}-${stage}"
}) if ds.name == name
]

14
share/wildduck/application.tf
View File

@@ -1,30 +1,30 @@
locals {
app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
main-group = format("app-%s", local.app-name)
app_name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
main-group = format("app-%s", local.app_name)
}
data "authentik_group" "akadmin" {
name = "authentik Admins"
}
resource "authentik_group" "groups" {
name = local.main-group
attributes = jsonencode({"${local.app-name}" = true})
attributes = jsonencode({"${local.app_name}" = true})
}
resource "authentik_application" "prj_app" {
name = "${var.instance}"
slug = "${var.component}-${var.instance}"
#protocol_provider = authentik_provider_oauth2.oauth2.id
group = var.app-group
group = var.app_group
backchannel_providers = [authentik_provider_scim.scim.id]
meta_launch_url = format("https://%s.%s", var.sub-domain, var.domain-name)
meta_icon = format("https://%s.%s/%s", var.sub-domain, var.domain-name, "favicon-32x32.png")
meta_launch_url = format("https://%s.%s", var.sub_domain, var.domain_name)
meta_icon = format("https://%s.%s/%s", var.sub_domain, var.domain_name, "favicon-32x32.png")
}
resource "authentik_policy_expression" "policy" {
name = local.main-group
expression = <<-EOF
attr = request.user.group_attributes()
return attr['${local.app-name}'] if '${local.app-name}' in attr else False
return attr['${local.app_name}'] if '${local.app_name}' in attr else False
EOF
}

8
share/wildduck/haraka.tf
View File

@@ -96,11 +96,11 @@ resource "kubernetes_config_map_v1" "haraka_config" {
}
data = yamldecode(<<-EOF
me: |-
${var.sub-domain}.${var.domain-name}
${var.sub_domain}.${var.domain_name}
host_list: |-
# add hosts in here we want to accept mail for
${var.sub-domain}.${var.domain-name}
${var.domain-name}
${var.sub_domain}.${var.domain_name}
${var.domain_name}
${join("\n ",var.additional-domains)}
rspamd.ini: |-
host = ${var.instance}-rspamd.${var.namespace}.svc.cluster.local
@@ -188,7 +188,7 @@ resource "kubernetes_config_map_v1" "haraka_config" {
dkim_sign.ini: |-
disabled = true
selector = mail
domain = ${var.domain-name}
domain = ${var.domain_name}
headers_to_sign = From, Sender, Reply-To, Subject, Date, Message-ID, To, Cc, MIME-Version
wildduck.yaml: |-
redis:

8
share/wildduck/index.yaml
View File

@@ -6,7 +6,7 @@ metadata:
name: wildduck
description: null
options:
ingress-class:
ingress_class:
default: traefik
examples:
- traefik
@@ -255,7 +255,7 @@ options:
examples:
- your-company
type: string
app-group:
app_group:
default: ''
examples:
- ''
@@ -298,7 +298,7 @@ options:
default: 2Gi
type: string
type: object
domain-name:
domain_name:
default: your_company.com
examples:
- your_company.com
@@ -308,7 +308,7 @@ options:
examples:
- letsencrypt-prod
type: string
sub-domain:
sub_domain:
default: mail
examples:
- mail

10
share/wildduck/ingress.tf
View File

@@ -1,6 +1,6 @@
locals {
dns-names = ["${var.sub-domain}.${var.domain-name}"]
cert-names = concat(local.dns-names, ["${var.domain-name}"])
dns_names = ["${var.sub_domain}.${var.domain_name}"]
cert-names = concat(local.dns_names, ["${var.domain_name}"])
middlewares = ["${var.instance}-https"]
service = {
"name" = "${var.instance}-webmail"
@@ -8,7 +8,7 @@ locals {
"number" = 80
}
}
rules = [ for v in local.dns-names : {
rules = [ for v in local.dns_names : {
"host" = "${v}"
"http" = {
"paths" = [{
@@ -67,10 +67,10 @@ resource "kubectl_manifest" "prj_ingress" {
annotations:
"traefik.ingress.kubernetes.io/router.middlewares": "${join(",", [for m in local.middlewares : format("%s-%s@kubernetescrd", var.namespace, m)])}"
spec:
ingressClassName: "${var.ingress-class}"
ingressClassName: "${var.ingress_class}"
rules: ${jsonencode(local.rules)}
tls:
- hosts: ${jsonencode(local.dns-names)}
- hosts: ${jsonencode(local.dns_names)}
secretName: "${var.instance}-cert"
EOF
}

6
share/wildduck/redis.tf
View File

@@ -13,7 +13,7 @@ resource "kubectl_manifest" "prj_redis" {
labels: ${jsonencode(local.redis-labels)}
spec:
kubernetesConfig:
image: "${var.redis.image}"
image: "${var.images.redis.registry}/${var.images.redis.repository}:${var.images.redis.tag}"
imagePullPolicy: "IfNotPresent"
storage:
volumeClaimTemplate:
@@ -21,10 +21,10 @@ resource "kubectl_manifest" "prj_redis" {
accessModes: ["ReadWriteOnce"]
resources:
requests:
storage: "${var.redis.storage}"
storage: "${var.storage.redis}"
redisExporter:
enabled: ${var.redis.exporter.enabled}
image: "${var.redis.exporter.image}"
image: "${var.images.redis_exporter.registry}/${var.images.redis_exporter.repository}:${var.images.redis_exporter.tag}"
securityContext:
runAsUser: 1000
fsGroup: 1000

2
share/wildduck/scimgateway.tf
View File

@@ -55,7 +55,7 @@ resource "kubectl_manifest" "scimgateway_deploy" {
- name: "PORT"
value: "8880"
- name: "WILDDUCK_DOMAIN"
value: "${var.domain-name}"
value: "${var.domain_name}"
- name: "WILDDUCK_API"
value: "http://${var.instance}-wildduck-api.${var.namespace}.svc"
- name: SEED

12
share/wildduck/webmail.tf
View File

@@ -92,7 +92,7 @@ resource "kubernetes_config_map_v1" "webmail_config" {
[service]
# email domain for new users
domain="${var.domain-name}"
domain="${var.domain_name}"
# default quotas for new users
quota=1024
recipients=2000
@@ -102,7 +102,7 @@ resource "kubernetes_config_map_v1" "webmail_config" {
allowJoin=false
enableSpecial=false # if true the allow creating addresses with special usernames
# allowed domains for new addresses
domains=["${var.domain-name}"]
domains=["${var.domain_name}"]
generalNotification="" # static notification to show on top of the page
@@ -145,7 +145,7 @@ resource "kubernetes_config_map_v1" "webmail_config" {
# set to false if not using HTTPS
enabled=true
# must be https url or use default
appId="https://${var.domain-name}"
appId="https://${var.domain_name}"
[log]
level="silly"
@@ -154,15 +154,15 @@ resource "kubernetes_config_map_v1" "webmail_config" {
[setup]
# these values are shown in the configuration help page
[setup.imap]
hostname="${var.sub-domain}.${var.domain-name}"
hostname="${var.sub_domain}.${var.domain_name}"
secure=true
port=143
[setup.pop3]
hostname="${var.sub-domain}.${var.domain-name}"
hostname="${var.sub_domain}.${var.domain_name}"
secure=true
port=110
[setup.smtp]
hostname="${var.sub-domain}.${var.domain-name}"
hostname="${var.sub_domain}.${var.domain_name}"
secure=true
port=25
EOF

6
share/wildduck/wildduck.tf
View File

@@ -173,7 +173,7 @@ resource "kubernetes_config_map_v1" "wildduck_config" {
enabled=true
[smtp.setup]
# Public configuration for SMTP MDA, needed for mobileconfig files
hostname="${var.sub-domain}.${var.domain-name}"
hostname="${var.sub_domain}.${var.domain_name}"
secure=true
port=465
[webhooks]
@@ -312,7 +312,7 @@ resource "kubernetes_config_map_v1" "wildduck_config" {
autoExpunge=true
[setup]
# Public configuration for IMAP
hostname="${var.sub-domain}.${var.domain-name}"
hostname="${var.sub_domain}.${var.domain_name}"
secure=true
# port defaults to imap.port
port=9930
@@ -360,7 +360,7 @@ resource "kubernetes_config_map_v1" "wildduck_config" {
cert="/var/opt/certs/tls.crt"
[setup]
# Public configuration for POP3
hostname="${var.sub-domain}.${var.domain-name}"
hostname="${var.sub_domain}.${var.domain_name}"
secure=true
# port defaults to pop3.port
port=995

6
share/wildduck/zonemta.tf
View File

@@ -128,7 +128,7 @@ resource "kubernetes_config_map_v1" "zonemta_config" {
# Server process must be able to locally bind to these addresses
[[default]]
address="0.0.0.0"
name="${var.sub-domain}.${var.domain-name}"
name="${var.sub_domain}.${var.domain_name}"
#
#[[default]]
#address="1.2.3.5"
@@ -145,7 +145,7 @@ resource "kubernetes_config_map_v1" "zonemta_config" {
interfaces=["feeder"]
# optional hostname to be used in headers
# defaults to os.hostname()
hostname="${var.sub-domain}.${var.domain-name}"
hostname="${var.sub_domain}.${var.domain_name}"
# How long to keep auth records in log
authlogExpireDays=30
# default smtp recipients for 24h (can be overriden per user)
@@ -161,7 +161,7 @@ resource "kubernetes_config_map_v1" "zonemta_config" {
# SRS secret value. Must be the same as in the MX side
secret="${local.secrets.srs}"
# SRS domain, must resolve back to MX
rewriteDomain="${var.domain-name}"
rewriteDomain="${var.domain_name}"
# DKIM Settings
# -------------
["modules/zonemta-wildduck".dkim]