tixie/nixcfg
1
0
Fork 0
forked from Deuxfleurs/nixcfg
Code Pull requests Activity

staging: reorganize core services and add D53

Browse source
This commit is contained in:
Alex 2022-12-07 16:35:21 +01:00
parent ab97a7bffd
commit 4c50dd57f1
Signed by untrusted user: lx
GPG key ID: 0E496D15096376BE
5 changed files with 144 additions and 82 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

62
cluster/staging/app/core/deploy/core-service.hcl Normal file
View file

@ -0,0 +1,62 @@
job "core-service" {
datacenters = ["neptune"]
type = "service"
priority = 90
group "D53" {
count = 1
task "d53" {
driver = "nix2"
config {
packages = [
"git+https://git.deuxfleurs.fr/lx/D53.git?ref=main&rev=ed2653ae7dba9c072dcca1aed03b7cda0d910c85"
]
command = "d53"
}
resources {
cpu = 100
memory = 100
}
restart {
interval = "3m"
attempts = 10
delay = "15s"
mode = "delay"
}
template {
data = "{{ key \"secrets/consul/consul-ca.crt\" }}"
destination = "etc/tricot/consul-ca.crt"
}
template {
data = "{{ key \"secrets/consul/consul-client.crt\" }}"
destination = "etc/tricot/consul-client.crt"
}
template {
data = "{{ key \"secrets/consul/consul-client.key\" }}"
destination = "etc/tricot/consul-client.key"
}
template {
data = <<EOH
D53_CONSUL_HOST=https://localhost:8501
D53_CONSUL_CA_CERT=/etc/tricot/consul-ca.crt
D53_CONSUL_CLIENT_CERT=/etc/tricot/consul-client.crt
D53_CONSUL_CLIENT_KEY=/etc/tricot/consul-client.key
D53_PROVIDER=gandi
D53_GANDI_API_KEY={{ key "secrets/d53/gandi_api_key" }}
D53_ALLOWED_DOMAINS=staging.deuxfleurs.org
RUST_LOG=d53=info
EOH
destination = "secrets/env"
env = true
}
}
}
}

85
cluster/staging/app/frontend/deploy/frontend-tricot.hcl → cluster/staging/app/core/deploy/core-system.hcl
View file

@ -1,14 +1,75 @@
job "frontend" {
job "core-system" {
datacenters = ["neptune"]
type = "service"
type = "system"
priority = 90
group "tricot" {
constraint {
attribute = "${attr.unique.hostname}"
value = "caribou"
}
constraint {
attribute = "${attr.cpu.arch}"
value = "amd64"
}
update {
max_parallel = 1
stagger = "1m"
}
group "diplonat" {
task "diplonat" {
driver = "nix2"
config {
packages = [
"#iptables",
"git+https://git.deuxfleurs.fr/Deuxfleurs/diplonat.git?ref=main&rev=f306e8dc8d0e93478353ce39b6064e8c06a8bca6"
]
command = "diplonat"
}
user = "root"
restart {
interval = "30m"
attempts = 2
delay = "15s"
mode = "delay"
}
template {
data = "{{ key \"secrets/consul/consul-ca.crt\" }}"
destination = "etc/diplonat/consul-ca.crt"
}
template {
data = "{{ key \"secrets/consul/consul-client.crt\" }}"
destination = "etc/diplonat/consul-client.crt"
}
template {
data = "{{ key \"secrets/consul/consul-client.key\" }}"
destination = "etc/diplonat/consul-client.key"
}
template {
data = <<EOH
DIPLONAT_REFRESH_TIME=60
DIPLONAT_EXPIRATION_TIME=300
DIPLONAT_CONSUL_NODE_NAME={{ env "attr.unique.hostname" }}
DIPLONAT_CONSUL_URL=https://localhost:8501
DIPLONAT_CONSUL_CA_CERT=/etc/diplonat/consul-ca.crt
DIPLONAT_CONSUL_CLIENT_CERT=/etc/diplonat/consul-client.crt
DIPLONAT_CONSUL_CLIENT_KEY=/etc/diplonat/consul-client.key
RUST_LOG=debug
EOH
destination = "secrets/env"
env = true
}
resources {
memory = 40
}
}
}
group "tricot" {
network {
port "http_port" { static = 80 }
port "https_port" { static = 443 }
@ -75,14 +136,20 @@ EOH
service {
name = "tricot-http"
port = "http_port"
/* tags = [ "(diplonat (tcp_port 80))" ] */
tags = [
"d53-aaaa deuxfleurs.org ${meta.site}.site.staging",
"d53-aaaa deuxfleurs.org staging",
# "(diplonat (tcp_port 80))"
]
address_mode = "host"
}
service {
name = "tricot-https"
port = "https_port"
/* tags = [ "(diplonat (tcp_port 443))" ] */
tags = [
# "(diplonat (tcp_port 443))"
]
address_mode = "host"
}

71
cluster/staging/app/core/deploy/core.hcl
View file

@ -1,71 +0,0 @@
job "core" {
datacenters = ["dc1", "neptune"]
type = "system"
priority = 90
constraint {
attribute = "${attr.cpu.arch}"
value = "amd64"
}
update {
max_parallel = 1
stagger = "1m"
}
group "network" {
task "diplonat" {
driver = "nix2"
config {
packages = [
"#iptables",
"git+https://git.deuxfleurs.fr/Deuxfleurs/diplonat.git?ref=main&rev=f306e8dc8d0e93478353ce39b6064e8c06a8bca6"
]
command = "diplonat"
}
user = "root"
restart {
interval = "30m"
attempts = 2
delay = "15s"
mode = "delay"
}
template {
data = "{{ key \"secrets/consul/consul-ca.crt\" }}"
destination = "etc/diplonat/consul-ca.crt"
}
template {
data = "{{ key \"secrets/consul/consul-client.crt\" }}"
destination = "etc/diplonat/consul-client.crt"
}
template {
data = "{{ key \"secrets/consul/consul-client.key\" }}"
destination = "etc/diplonat/consul-client.key"
}
template {
data = <<EOH
DIPLONAT_REFRESH_TIME=60
DIPLONAT_EXPIRATION_TIME=300
DIPLONAT_CONSUL_NODE_NAME={{ env "attr.unique.hostname" }}
DIPLONAT_CONSUL_URL=https://localhost:8501
DIPLONAT_CONSUL_CA_CERT=/etc/diplonat/consul-ca.crt
DIPLONAT_CONSUL_CLIENT_CERT=/etc/diplonat/consul-client.crt
DIPLONAT_CONSUL_CLIENT_KEY=/etc/diplonat/consul-client.key
RUST_LOG=debug
EOH
destination = "secrets/env"
env = true
}
resources {
memory = 40
}
}
}
}

2
cluster/staging/app/directory/deploy/directory.hcl
View file

@ -111,8 +111,8 @@ EOH
name = "guichet"
tags = [
"guichet",
"tricot guichet-staging.home.adnab.me",
"tricot guichet.staging.deuxfleurs.org",
"d53-cname deuxfleurs.org guichet.staging",
]
port = "web_port"
check {

6
cluster/staging/app/telemetry/deploy/telemetry.hcl
View file

@ -156,6 +156,7 @@ job "telemetry" {
tags = [
"grafana",
"tricot grafana.staging.deuxfleurs.org",
"d53-cname deuxfleurs.org grafana.staging",
]
port = "grafana"
check {
@ -237,7 +238,10 @@ EOH
port = "jaeger-frontend"
address_mode = "host"
name = "jaeger-frontend"
tags = [ "tricot jaeger.staging.deuxfleurs.org" ]
tags = [
"tricot jaeger.staging.deuxfleurs.org",
"d53-cname deuxfleurs.org jaeger.staging",
]
check {
type = "tcp"
port = "jaeger-frontend"