staging: reorganize core services and add D53

This commit is contained in:
Alex 2022-12-07 16:35:21 +01:00
parent ab97a7bffd
commit 4c50dd57f1
Signed by untrusted user: lx
GPG key ID: 0E496D15096376BE
5 changed files with 144 additions and 82 deletions

View file

@ -0,0 +1,62 @@
job "core-service" {
datacenters = ["neptune"]
type = "service"
priority = 90
group "D53" {
count = 1
task "d53" {
driver = "nix2"
config {
packages = [
"git+https://git.deuxfleurs.fr/lx/D53.git?ref=main&rev=ed2653ae7dba9c072dcca1aed03b7cda0d910c85"
]
command = "d53"
}
resources {
cpu = 100
memory = 100
}
restart {
interval = "3m"
attempts = 10
delay = "15s"
mode = "delay"
}
template {
data = "{{ key \"secrets/consul/consul-ca.crt\" }}"
destination = "etc/tricot/consul-ca.crt"
}
template {
data = "{{ key \"secrets/consul/consul-client.crt\" }}"
destination = "etc/tricot/consul-client.crt"
}
template {
data = "{{ key \"secrets/consul/consul-client.key\" }}"
destination = "etc/tricot/consul-client.key"
}
template {
data = <<EOH
D53_CONSUL_HOST=https://localhost:8501
D53_CONSUL_CA_CERT=/etc/tricot/consul-ca.crt
D53_CONSUL_CLIENT_CERT=/etc/tricot/consul-client.crt
D53_CONSUL_CLIENT_KEY=/etc/tricot/consul-client.key
D53_PROVIDER=gandi
D53_GANDI_API_KEY={{ key "secrets/d53/gandi_api_key" }}
D53_ALLOWED_DOMAINS=staging.deuxfleurs.org
RUST_LOG=d53=info
EOH
destination = "secrets/env"
env = true
}
}
}
}

View file

@ -1,14 +1,75 @@
job "frontend" { job "core-system" {
datacenters = ["neptune"] datacenters = ["neptune"]
type = "service" type = "system"
priority = 90 priority = 90
group "tricot" { constraint {
constraint { attribute = "${attr.cpu.arch}"
attribute = "${attr.unique.hostname}" value = "amd64"
value = "caribou" }
}
update {
max_parallel = 1
stagger = "1m"
}
group "diplonat" {
task "diplonat" {
driver = "nix2"
config {
packages = [
"#iptables",
"git+https://git.deuxfleurs.fr/Deuxfleurs/diplonat.git?ref=main&rev=f306e8dc8d0e93478353ce39b6064e8c06a8bca6"
]
command = "diplonat"
}
user = "root"
restart {
interval = "30m"
attempts = 2
delay = "15s"
mode = "delay"
}
template {
data = "{{ key \"secrets/consul/consul-ca.crt\" }}"
destination = "etc/diplonat/consul-ca.crt"
}
template {
data = "{{ key \"secrets/consul/consul-client.crt\" }}"
destination = "etc/diplonat/consul-client.crt"
}
template {
data = "{{ key \"secrets/consul/consul-client.key\" }}"
destination = "etc/diplonat/consul-client.key"
}
template {
data = <<EOH
DIPLONAT_REFRESH_TIME=60
DIPLONAT_EXPIRATION_TIME=300
DIPLONAT_CONSUL_NODE_NAME={{ env "attr.unique.hostname" }}
DIPLONAT_CONSUL_URL=https://localhost:8501
DIPLONAT_CONSUL_CA_CERT=/etc/diplonat/consul-ca.crt
DIPLONAT_CONSUL_CLIENT_CERT=/etc/diplonat/consul-client.crt
DIPLONAT_CONSUL_CLIENT_KEY=/etc/diplonat/consul-client.key
RUST_LOG=debug
EOH
destination = "secrets/env"
env = true
}
resources {
memory = 40
}
}
}
group "tricot" {
network { network {
port "http_port" { static = 80 } port "http_port" { static = 80 }
port "https_port" { static = 443 } port "https_port" { static = 443 }
@ -75,14 +136,20 @@ EOH
service { service {
name = "tricot-http" name = "tricot-http"
port = "http_port" port = "http_port"
/* tags = [ "(diplonat (tcp_port 80))" ] */ tags = [
"d53-aaaa deuxfleurs.org ${meta.site}.site.staging",
"d53-aaaa deuxfleurs.org staging",
# "(diplonat (tcp_port 80))"
]
address_mode = "host" address_mode = "host"
} }
service { service {
name = "tricot-https" name = "tricot-https"
port = "https_port" port = "https_port"
/* tags = [ "(diplonat (tcp_port 443))" ] */ tags = [
# "(diplonat (tcp_port 443))"
]
address_mode = "host" address_mode = "host"
} }

View file

@ -1,71 +0,0 @@
job "core" {
datacenters = ["dc1", "neptune"]
type = "system"
priority = 90
constraint {
attribute = "${attr.cpu.arch}"
value = "amd64"
}
update {
max_parallel = 1
stagger = "1m"
}
group "network" {
task "diplonat" {
driver = "nix2"
config {
packages = [
"#iptables",
"git+https://git.deuxfleurs.fr/Deuxfleurs/diplonat.git?ref=main&rev=f306e8dc8d0e93478353ce39b6064e8c06a8bca6"
]
command = "diplonat"
}
user = "root"
restart {
interval = "30m"
attempts = 2
delay = "15s"
mode = "delay"
}
template {
data = "{{ key \"secrets/consul/consul-ca.crt\" }}"
destination = "etc/diplonat/consul-ca.crt"
}
template {
data = "{{ key \"secrets/consul/consul-client.crt\" }}"
destination = "etc/diplonat/consul-client.crt"
}
template {
data = "{{ key \"secrets/consul/consul-client.key\" }}"
destination = "etc/diplonat/consul-client.key"
}
template {
data = <<EOH
DIPLONAT_REFRESH_TIME=60
DIPLONAT_EXPIRATION_TIME=300
DIPLONAT_CONSUL_NODE_NAME={{ env "attr.unique.hostname" }}
DIPLONAT_CONSUL_URL=https://localhost:8501
DIPLONAT_CONSUL_CA_CERT=/etc/diplonat/consul-ca.crt
DIPLONAT_CONSUL_CLIENT_CERT=/etc/diplonat/consul-client.crt
DIPLONAT_CONSUL_CLIENT_KEY=/etc/diplonat/consul-client.key
RUST_LOG=debug
EOH
destination = "secrets/env"
env = true
}
resources {
memory = 40
}
}
}
}

View file

@ -111,8 +111,8 @@ EOH
name = "guichet" name = "guichet"
tags = [ tags = [
"guichet", "guichet",
"tricot guichet-staging.home.adnab.me",
"tricot guichet.staging.deuxfleurs.org", "tricot guichet.staging.deuxfleurs.org",
"d53-cname deuxfleurs.org guichet.staging",
] ]
port = "web_port" port = "web_port"
check { check {

View file

@ -156,6 +156,7 @@ job "telemetry" {
tags = [ tags = [
"grafana", "grafana",
"tricot grafana.staging.deuxfleurs.org", "tricot grafana.staging.deuxfleurs.org",
"d53-cname deuxfleurs.org grafana.staging",
] ]
port = "grafana" port = "grafana"
check { check {
@ -237,7 +238,10 @@ EOH
port = "jaeger-frontend" port = "jaeger-frontend"
address_mode = "host" address_mode = "host"
name = "jaeger-frontend" name = "jaeger-frontend"
tags = [ "tricot jaeger.staging.deuxfleurs.org" ] tags = [
"tricot jaeger.staging.deuxfleurs.org",
"d53-cname deuxfleurs.org jaeger.staging",
]
check { check {
type = "tcp" type = "tcp"
port = "jaeger-frontend" port = "jaeger-frontend"