Skip to content

Commit 699c62f

Browse files
MafyuhMafyuh
committed
refactor(terraform): migrate everything to tf controller
1 parent 158e690 commit 699c62f

16 files changed

Lines changed: 258 additions & 249 deletions

File tree

‎kubernetes/components/tofu-controller/tofu/cloudflare.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
apiVersion: infra.contrib.fluxcd.io/v1alpha2
2+
kind: Terraform
3+
metadata:
4+
name: cloudflare-tofu
5+
namespace: flux-system
6+
spec:
7+
interval: 1h
8+
approvePlan: auto
9+
destroyResourcesOnDeletion: false
10+
backendConfig:
11+
customConfiguration: |
12+
backend "s3" {
13+
bucket = "tofu"
14+
key = "cloudflare.tfstate"
15+
region = "us-east-1"
16+
endpoint = "https://s3.mafyuh.xyz"
17+
skip_region_validation = true
18+
skip_credentials_validation = true
19+
skip_requesting_account_id = true
20+
force_path_style = true
21+
skip_s3_checksum = true
22+
skip_metadata_api_check = true
23+
}
24+
backendConfigsFrom:
25+
- kind: Secret
26+
name: terraform-s3-backend
27+
keys:
28+
- access_key
29+
- secret_key
30+
optional: false
31+
path: ./terraform/cloudflare
32+
sourceRef:
33+
kind: GitRepository
34+
name: iac
35+
namespace: flux-system
36+
writeOutputsToSecret:
37+
name: cloudflare-outputs
38+
vars:
39+
- name: access_token
40+
valueFrom:
41+
secretKeyRef:
42+
name: terraform-s3-backend
43+
key: BWS_ACCESS_TOKEN
44+
runnerPodTemplate:
45+
spec:
46+
env:
47+
- name: BWS_ACCESS_TOKEN
48+
valueFrom:
49+
secretKeyRef:
50+
name: terraform-s3-backend
51+
key: BWS_ACCESS_TOKEN
52+

‎kubernetes/components/tofu-controller/tofu/kustomization.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,6 @@ resources:
55
- servarr.yaml
66
- unifi.yaml
77
- authentik.yaml
8+
- cloudflare.yaml
9+
- twingate.yaml
10+
- oracle.yaml

‎kubernetes/components/tofu-controller/tofu/oracle.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
apiVersion: infra.contrib.fluxcd.io/v1alpha2
2+
kind: Terraform
3+
metadata:
4+
name: oracle-tofu
5+
namespace: flux-system
6+
spec:
7+
interval: 1h
8+
approvePlan: auto
9+
destroyResourcesOnDeletion: false
10+
backendConfig:
11+
customConfiguration: |
12+
backend "s3" {
13+
bucket = "tofu"
14+
key = "oci.tfstate"
15+
region = "us-east-1"
16+
endpoint = "https://s3.mafyuh.xyz"
17+
skip_region_validation = true
18+
skip_credentials_validation = true
19+
skip_requesting_account_id = true
20+
force_path_style = true
21+
skip_s3_checksum = true
22+
skip_metadata_api_check = true
23+
}
24+
backendConfigsFrom:
25+
- kind: Secret
26+
name: terraform-s3-backend
27+
keys:
28+
- access_key
29+
- secret_key
30+
optional: false
31+
path: ./terraform/oracle
32+
sourceRef:
33+
kind: GitRepository
34+
name: iac
35+
namespace: flux-system
36+
writeOutputsToSecret:
37+
name: oracle-outputs
38+
vars:
39+
- name: access_token
40+
valueFrom:
41+
secretKeyRef:
42+
name: terraform-s3-backend
43+
key: BWS_ACCESS_TOKEN
44+
runnerPodTemplate:
45+
spec:
46+
env:
47+
- name: BWS_ACCESS_TOKEN
48+
valueFrom:
49+
secretKeyRef:
50+
name: terraform-s3-backend
51+
key: BWS_ACCESS_TOKEN
52+

‎kubernetes/components/tofu-controller/tofu/twingate.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
apiVersion: infra.contrib.fluxcd.io/v1alpha2
2+
kind: Terraform
3+
metadata:
4+
name: twingate-tofu
5+
namespace: flux-system
6+
spec:
7+
interval: 1h
8+
approvePlan: auto
9+
destroyResourcesOnDeletion: false
10+
backendConfig:
11+
customConfiguration: |
12+
backend "s3" {
13+
bucket = "tofu"
14+
key = "twingate.tfstate"
15+
region = "us-east-1"
16+
endpoint = "https://s3.mafyuh.xyz"
17+
skip_region_validation = true
18+
skip_credentials_validation = true
19+
skip_requesting_account_id = true
20+
force_path_style = true
21+
skip_s3_checksum = true
22+
skip_metadata_api_check = true
23+
}
24+
backendConfigsFrom:
25+
- kind: Secret
26+
name: terraform-s3-backend
27+
keys:
28+
- access_key
29+
- secret_key
30+
optional: false
31+
path: ./terraform/twingate
32+
sourceRef:
33+
kind: GitRepository
34+
name: iac
35+
namespace: flux-system
36+
writeOutputsToSecret:
37+
name: twingate-outputs
38+
vars:
39+
- name: access_token
40+
valueFrom:
41+
secretKeyRef:
42+
name: terraform-s3-backend
43+
key: BWS_ACCESS_TOKEN
44+
runnerPodTemplate:
45+
spec:
46+
env:
47+
- name: BWS_ACCESS_TOKEN
48+
valueFrom:
49+
secretKeyRef:
50+
name: terraform-s3-backend
51+
key: BWS_ACCESS_TOKEN
52+

‎terraform/cloudflare/provider.tf‎

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,17 @@
11
terraform {
2-
required_version = ">= 1.0.0"
2+
backend "s3" {
3+
bucket = "tofu"
4+
region = "us-east-1"
5+
key = "cloudflare.tfstate"
6+
endpoint = "https://s3.mafyuh.xyz"
7+
skip_region_validation = true
8+
skip_credentials_validation = true
9+
skip_requesting_account_id = true
10+
use_path_style = true
11+
skip_s3_checksum = true
12+
skip_metadata_api_check = true
13+
}
14+
315
required_providers {
416
cloudflare = {
517
source = "cloudflare/cloudflare"
@@ -10,4 +22,17 @@ terraform {
1022
version = "0.16.0"
1123
}
1224
}
13-
}
25+
}
26+
27+
provider "bitwarden" {
28+
access_token = var.access_token
29+
experimental {
30+
embedded_client = true
31+
}
32+
}
33+
34+
provider "cloudflare" {
35+
# api_token = data.bitwarden_secret.cloudflare_api_token.value
36+
api_key = data.bitwarden_secret.cloudflare_api_key.value
37+
email = "matt@mafyuh.dev"
38+
}

‎terraform/cloudflare/secrets.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,4 +27,8 @@ data "bitwarden_secret" "cf_account_id" {
2727

2828
data "bitwarden_secret" "pbx_ip" {
2929
id = "34c5c2f3-541f-41de-bb25-b309001f9253"
30+
}
31+
32+
data "bitwarden_secret" "cloudflare_api_key" {
33+
id = "87e2b23c-f62d-4b6d-8a3a-b2e1018983ac"
3034
}

‎terraform/cloudflare/vars.tf‎

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
variable "domains" {
2-
type = map(string)
3-
}
4-
51
variable "npm_ip_address" {
62
type = string
73
default = "10.69.69.200"
@@ -10,4 +6,20 @@ variable "npm_ip_address" {
106
variable "k3s_nginx_ip_address" {
117
type = string
128
default = "10.69.69.220"
13-
}
9+
}
10+
11+
variable "domains" {
12+
type = map(string)
13+
default = {
14+
xyz = "mafyuh.xyz"
15+
com = "mafyuh.com"
16+
dev = "mafyuh.dev"
17+
io = "mafyuh.io"
18+
}
19+
}
20+
21+
variable "access_token" {
22+
description = "Bitwarden access token"
23+
type = string
24+
sensitive = true
25+
}

‎terraform/cloudflare/zero_trust_tunnel_config.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "main_tunnel" {
112112
},
113113
{
114114
hostname = "auth.${var.domains["io"]}"
115-
service = "https://10.0.0.210:443"
115+
service = "https://10.0.0.213:443"
116116
path = ""
117117
origin_request = {
118118
no_tls_verify = true

‎terraform/main.tf‎

Lines changed: 0 additions & 59 deletions
This file was deleted.

‎terraform/oracle/instances.tf‎

Lines changed: 0 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -1,77 +1,3 @@
1-
resource "oci_core_instance" "VPS" {
2-
availability_domain = "nWCj:US-ASHBURN-AD-2"
3-
compartment_id = data.bitwarden_secret.compartment_id.value
4-
display_name = "VPS"
5-
fault_domain = "FAULT-DOMAIN-2"
6-
shape = "VM.Standard.E2.1.Micro"
7-
8-
shape_config {
9-
memory_in_gbs = "1"
10-
ocpus = "1"
11-
vcpus = "2"
12-
}
13-
14-
agent_config {
15-
are_all_plugins_disabled = false
16-
is_management_disabled = false
17-
is_monitoring_disabled = false
18-
19-
plugins_config {
20-
desired_state = "DISABLED"
21-
name = "Vulnerability Scanning"
22-
}
23-
plugins_config {
24-
desired_state = "DISABLED"
25-
name = "Management Agent"
26-
}
27-
plugins_config {
28-
desired_state = "ENABLED"
29-
name = "Custom Logs Monitoring"
30-
}
31-
plugins_config {
32-
desired_state = "ENABLED"
33-
name = "Compute Instance Monitoring"
34-
}
35-
plugins_config {
36-
desired_state = "DISABLED"
37-
name = "Bastion"
38-
}
39-
}
40-
41-
availability_config {
42-
recovery_action = "RESTORE_INSTANCE"
43-
}
44-
45-
create_vnic_details {
46-
assign_public_ip = true
47-
display_name = "VPS"
48-
hostname_label = "vps"
49-
skip_source_dest_check = false
50-
}
51-
52-
instance_options {
53-
are_legacy_imds_endpoints_disabled = false
54-
}
55-
56-
launch_options {
57-
boot_volume_type = "PARAVIRTUALIZED"
58-
firmware = "UEFI_64"
59-
is_consistent_volume_naming_enabled = true
60-
is_pv_encryption_in_transit_enabled = true
61-
network_type = "PARAVIRTUALIZED"
62-
remote_data_volume_type = "PARAVIRTUALIZED"
63-
}
64-
65-
source_details {
66-
boot_volume_size_in_gbs = "50"
67-
boot_volume_vpus_per_gb = "10"
68-
source_id = "ocid1.image.oc1.iad.aaaaaaaa6blpytk5nu622uj7trevp7kjxihx4byt4q6botynbyjpknk7zwna"
69-
source_type = "image"
70-
}
71-
72-
state = "RUNNING"
73-
}
74-
751
## ARM VM
762
resource oci_core_instance arm {
773
agent_config {

0 commit comments

Comments
 (0)