thomasklein/terraform-app-influx
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

found it like this

Browse Source
This commit is contained in:
Tamas Kiss
2025-01-15 04:23:04 +01:00
commit 6d4b60fc38
12 changed files with 433 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
.gitignore vendored Normal file
View File

@@ -0,0 +1,34 @@
# Local .terraform directories
**/.terraform/*
# .tfstate files
*.tfstate
*.tfstate.*
# Crash log files
crash.log
crash.*.log
# Exclude all .tfvars files, which are likely to contain sensitive data, such as
# password, private keys, and other secrets. These should not be part of version
# control as they are data points which are potentially sensitive and subject
# to change depending on the environment.
*.tfvars
*.tfvars.json
# Ignore override files as they are usually used to override resources locally and so
# are not checked in
override.tf
override.tf.json
*_override.tf
*_override.tf.json
# Include override files you do wish to add to version control using negated pattern
# !example_override.tf
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
# example: *tfplan*
# Ignore CLI configuration files
.terraformrc
terraform.rc

81
.terraform.lock.hcl generated Normal file
View File

@@ -0,0 +1,81 @@
# This file is maintained automatically by "terraform init".
# Manual edits may be lost in future updates.
provider "registry.terraform.io/hashicorp/aws" {
version = "4.9.0"
constraints = "~> 4.9.0"
hashes = [
"h1:GtmIOZMkKmr9tMLWouHWiGXmKEL/diOTNar5XfOVLjs=",
"zh:084b83aef3335ad4f5e4b8323c6fe43c1ff55e17a7647c6a5cad6af519f72b42",
"zh:132e47ce69f14de4523b84b213cedf7173398acda14245b1ffe7747aac50f050",
"zh:2068baef7dfce3613f3b4f27314175e971f8db68d9cde9ec30b5659f80c68c6c",
"zh:63c6f489683d5f1ac55e82a0df387143ed22701d5f22c109a4d5c9924dd4e437",
"zh:8115fd21965954fa4568c09331e05bb29da967fab8d077419aed09954378e216",
"zh:8efdc95fde108f777ed9c79ae25dc17aea9771903250f5c5c8a4c726b90a345f",
"zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
"zh:9d42a7bc34d84b70c1d1bcc215cabd63abbcbd0352b70bd84da6c3916634932f",
"zh:aacbcceb241aa475888c0869e87593182edeced3170c76a0c960dd9c905df449",
"zh:c7fe7904511052e4102870256819a1917177572cf684f0611ebf767f9c1fbaa8",
"zh:c8e07c3424663d1d0e7e32f4ade8099c19f6326d37c6da98104d90c986ff66fc",
"zh:e47cafbd38b56ef14fd8d727b4ffea847c166b1c684f585ee5fb78983b537248",
]
}
provider "registry.terraform.io/hashicorp/helm" {
version = "2.5.1"
constraints = "~> 2.5.1"
hashes = [
"h1:NasRPC0qqlpGqcF3dsSoOFu7uc5hM+zJm+okd8FgrnQ=",
"zh:140b9748f0ad193a20d69e59d672f3c4eda8a56cede56a92f931bd3af020e2e9",
"zh:17ae319466ed6538ad49e011998bb86565fe0e97bc8b9ad7c8dda46a20f90669",
"zh:3a8bd723c21ba70e19f0395ed7096fc8e08bfc23366f1c3f06a9107eb37c572c",
"zh:3aae3b82adbe6dca52f1a1c8cf51575446e6b0f01f1b1f3b30de578c9af4a933",
"zh:3f65221f40148df57d2888e4f31ef3bf430b8c5af41de0db39a2b964e1826d7c",
"zh:650c74c4f46f5eb01df11d8392bdb7ebee3bba59ac0721000a6ad731ff0e61e2",
"zh:930fb8ab4cd6634472dfd6aa3123f109ef5b32cbe6ef7b4695fae6751353e83f",
"zh:ae57cd4b0be4b9ca252bc5d347bc925e35b0ed74d3dcdebf06c11362c1ac3436",
"zh:d15b1732a8602b6726eac22628b2f72f72d98b75b9c6aabceec9fd696fda696a",
"zh:d730ede1656bd193e2aea5302acec47c4905fe30b96f550196be4a0ed5f41936",
"zh:f010d4f9d8cd15936be4df12bf256cb2175ca1dedb728bd3a866c03d2ee7591f",
"zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
]
}
provider "registry.terraform.io/hashicorp/kubernetes" {
version = "2.11.0"
constraints = "~> 2.11.0, ~> 2.11"
hashes = [
"h1:pJiAJwZKUaoAJ4x+3ONJkwEVkjrwGROCGFgj7noPO58=",
"zh:143a19dd0ea3b07fc5e3d9231f3c2d01f92894385c98a67327de74c76c715843",
"zh:1fc757d209e09c3cf7848e4274daa32408c07743698fbed10ee52a4a479b62b6",
"zh:22dfebd0685749c51a8f765d51a1090a259778960ac1cd4f32021a325b2b9b72",
"zh:3039b3b76e870cd8fc404cf75a29c66b171c6ba9b6182e131b6ae2ca648ec7c0",
"zh:3af0a15562fcab4b5684b18802e0239371b2b8ff9197ed069ff4827f795a002b",
"zh:50aaf20336d1296a73315adb66f7687f75bd5c6b1f93a894b95c75cc142810ec",
"zh:682064fabff895ec351860b4fe0321290bbbb17c2a410b62c9bea0039400650e",
"zh:70ac914d5830b3371a2679d8f77cc20c419a6e12925145afae6c977c8eb90934",
"zh:710aa02cccf7b0f3fb50880d6d2a7a8b8c9435248666616844ba71f74648cddc",
"zh:88e418118cd5afbdec4984944c7ab36950bf48e8d3e09e090232e55eecfb470b",
"zh:9cef159377bf23fa331f8724fdc6ce27ad39a217a4bae6df3b1ca408fc643da6",
"zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
]
}
provider "registry.terraform.io/hashicorp/random" {
version = "3.4.3"
hashes = [
"h1:xZGZf18JjMS06pFa4NErzANI98qi59SEcBsOcS2P2yQ=",
"zh:41c53ba47085d8261590990f8633c8906696fa0a3c4b384ff6a7ecbf84339752",
"zh:59d98081c4475f2ad77d881c4412c5129c56214892f490adf11c7e7a5a47de9b",
"zh:686ad1ee40b812b9e016317e7f34c0d63ef837e084dea4a1f578f64a6314ad53",
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
"zh:84103eae7251384c0d995f5a257c72b0096605048f757b749b7b62107a5dccb3",
"zh:8ee974b110adb78c7cd18aae82b2729e5124d8f115d484215fd5199451053de5",
"zh:9dd4561e3c847e45de603f17fa0c01ae14cae8c4b7b4e6423c9ef3904b308dda",
"zh:bb07bb3c2c0296beba0beec629ebc6474c70732387477a65966483b5efabdbc6",
"zh:e891339e96c9e5a888727b45b2e1bb3fcbdfe0fd7c5b4396e4695459b38c8cb1",
"zh:ea4739860c24dfeaac6c100b2a2e357106a89d18751f7693f3c31ecf6a996f8d",
"zh:f0c76ac303fd0ab59146c39bc121c5d7d86f878e9a69294e29444d4c653786f8",
"zh:f143a9a5af42b38fed328a161279906759ff39ac428ebcfe55606e05e1518b93",
]
}

10
backend.tf Normal file
View File

@@ -0,0 +1,10 @@
terraform {
backend "s3" {
bucket = "thomasklein-global-states"
key = "apps/lawndale/influx"
region = "eu-central-1"
encrypt = true
kms_key_id = "a767a3ce-c505-44c0-9f93-6f53678c69c7"
dynamodb_table = "thomasklein-global-state-locks"
}
}

92
chronograf.tf Normal file
View File

@@ -0,0 +1,92 @@
resource "kubernetes_persistent_volume" "chronograf" {
metadata {
name = "pv-p9hostpath-chronograf"
}
spec {
capacity = {
storage = "8Gi"
}
access_modes = ["ReadWriteMany"]
persistent_volume_source {
host_path {
path = "/mnt/datastore/chronograf"
}
}
}
}
resource "random_password" "chronograf_token_secret" {
length = 80
special = true
}
resource "helm_release" "chronograf" {
name = "chronograf"
namespace = kubernetes_namespace.this.metadata.0.name
repository = "https://helm.influxdata.com/"
chart = "chronograf"
version = "1.2.5"
values = [
jsonencode({
ingress = {
enabled = true
className = "traefik"
hostname = local.chronograf_domain
tls = true
secretName = "chronograf-tls"
annotations = {
"cert-manager.io/cluster-issuer" = "acme-thomasklein-me"
# "kubernetes.io/ingress.class" = "traefik"
# "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
# "traefik.ingress.kubernetes.io/router.tls" = "true"
# "traefik.ingress.kubernetes.io/router.tls.certresolver" = "acme-thomasklein-me"
# "traefik.ingress.kubernetes.io/router.tls.domains.0.main" = local.ingress_domain
# "traefik.ingress.kubernetes.io/router.middlewares" = "redirect-metrics@file" # hide /metrics from the internet
}
labels = {}
}
}),
jsonencode({
updateStrategy = {
type = "Recreate"
},
persistence = {
enabled = "true"
accessMode = "ReadWriteMany"
storageClass = "-"
}
}),
jsonencode({
oauth = {
enabled = true
token_secret = random_password.chronograf_token_secret.result
jwks = local.jwks_url
generic = {
enabled = true
name = "Cognito"
public_url = "https://${local.chronograf_domain}/"
auth_url = local.cognito_authz_url
token_url = local.cognito_token_url
api_url = "${local.cognito_userinfo_url}"
api_key = "email"
scopes = "email openid profile"
}
}
})
]
set_sensitive {
name = "oauth.generic.client_id"
value = aws_cognito_user_pool_client.this.id
}
set_sensitive {
name = "oauth.generic.client_secret"
value = aws_cognito_user_pool_client.this.client_secret
}
}

53
influxdb.tf Normal file
View File

@@ -0,0 +1,53 @@
# resource "helm_release" "influx" {
# name = "influxdb"
# namespace = kubernetes_namespace.this.metadata.0.name
# repository = "https://helm.influxdata.com/"
# chart = "influxdb"
# version = "4.12.0"
# values = [
# jsonencode({
# ingress = {
# enabled = true
# hostname = local.influx_domain
# tls = true
# secretName = "influxdb-tls"
# annotations = {
# "cert-manager.io/cluster-issuer" = "acme-thomasklein-me"
# # "kubernetes.io/ingress.class" = "traefik"
# # "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
# # "traefik.ingress.kubernetes.io/router.tls" = "true"
# # "traefik.ingress.kubernetes.io/router.tls.certresolver" = "acme-thomasklein-me"
# # "traefik.ingress.kubernetes.io/router.tls.domains.0.main" = local.ingress_domain
# # "traefik.ingress.kubernetes.io/router.middlewares" = "redirect-metrics@file" # hide /metrics from the internet
# }
# labels = {}
# }
# }),
# jsonencode({
# persistence = {
# enabled = "true"
# existingClaim = kubernetes_persistent_volume_claim.this.metadata.0.name
# }
# }),
# jsonencode({
# config = {
# coordinator = {
# # "max-concurrent-queries" = 10
# "query-timeout" = "1m"
# }
# retention = {
# enabled = true
# "check-interval" = "60m0s"
# }
# monitor = {
# "store-enabled" = true
# "store-interval" = "30s"
# }
# }),
# ]
# }

56
influxdb2.tf Normal file
View File

@@ -0,0 +1,56 @@
module "influxdb_persistance" {
source = "git@git.thomasklein.me:thomasklein/terraform-modules//9p-persistent-volume"
namespace = kubernetes_namespace.this.metadata.0.name
name = "influxdb"
volume_storage_capacity = "20Gi"
}
resource "helm_release" "influx" {
name = "influxdb"
namespace = kubernetes_namespace.this.metadata.0.name
repository = "https://helm.influxdata.com/"
chart = "influxdb2"
version = "2.1.1"
values = [
jsonencode({
ingress = {
enabled = true
hostname = local.influx_domain
tls = true
secretName = "influxdb-tls"
annotations = {
"cert-manager.io/cluster-issuer" = "acme-thomasklein-me"
# "kubernetes.io/ingress.class" = "traefik"
# "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
# "traefik.ingress.kubernetes.io/router.tls" = "true"
# "traefik.ingress.kubernetes.io/router.tls.certresolver" = "acme-thomasklein-me"
# "traefik.ingress.kubernetes.io/router.tls.domains.0.main" = local.ingress_domain
# "traefik.ingress.kubernetes.io/router.middlewares" = "redirect-metrics@file" # hide /metrics from the internet
}
labels = {}
}
}),
jsonencode({
persistence = {
enabled = "true"
useExisting = true
name = module.influxdb_persistance.pvc_name
}
}),
jsonencode({
adminUser = {
organization = "thomasklein"
user = "admin"
retention_policy = "90d"
existingSecret = kubernetes_secret.influxdb_auth.metadata.0.name
}
}),
]
}

7
locals.tf Normal file
View File

@@ -0,0 +1,7 @@
locals {
namespace = "influxdb"
influx_domain = "influxdb.thomasklein.me"
chronograf_domain = "chronograf.thomasklein.me"
}
data "aws_region" "current" {}

5
namespace.tf Normal file
View File

@@ -0,0 +1,5 @@
resource "kubernetes_namespace" "this" {
metadata {
name = local.namespace
}
}

34
oidc.tf Normal file
View File

@@ -0,0 +1,34 @@
data "aws_cognito_user_pools" "thomasklein_infra" {
name = "thomasklein-infra"
}
resource "aws_cognito_user_pool_client" "this" {
name = "chronograf"
user_pool_id = data.aws_cognito_user_pools.thomasklein_infra.ids[0]
allowed_oauth_flows_user_pool_client = true
allowed_oauth_flows = ["code"]
allowed_oauth_scopes = ["profile", "email", "openid"]
supported_identity_providers = ["COGNITO"]
generate_secret = true
callback_urls = [
"https://${local.chronograf_domain}/oauth/cognito/callback",
"https://${local.chronograf_domain}/oauth/Cognito/callback"
]
}
locals {
# these should be available as an attribute
cognito_base_url = "https://${data.aws_cognito_user_pools.thomasklein_infra.name}.auth.${data.aws_region.current.name}.amazoncognito.com"
cognito_authz_url = "${local.cognito_base_url}/oauth2/authorize"
cognito_token_url = "${local.cognito_base_url}/oauth2/token"
cognito_userinfo_url = "${local.cognito_base_url}/oauth2/userInfo"
jwks_url = "https://cognito-idp.${data.aws_region.current.name}.amazonaws.com/${aws_cognito_user_pool_client.this.user_pool_id}/.well-known/jwks.json"
}
# https://cognito-idp.{region}.amazonaws.com/{userPoolId}/.well-known/jwks.json

9
output.tf Normal file
View File

@@ -0,0 +1,9 @@
output "admin_password" {
sensitive = true
value = random_password.influxdb_admin.result
}
output "admin_token" {
sensitive = true
value = random_password.influxdb_admin_token.result
}

28
provider.tf Normal file
View File

@@ -0,0 +1,28 @@
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 4.9.0"
}
helm = {
source = "hashicorp/helm"
version = "~> 2.5.1"
}
kubernetes = {
source = "hashicorp/kubernetes"
version = "~> 2.11.0"
}
}
}
provider "aws" {
# Configuration options
default_tags {
tags = {
"managed-by" = "terraform"
}
}
}

24
secret.tf Normal file
View File

@@ -0,0 +1,24 @@
resource "random_password" "influxdb_admin" {
length = 20
special = true
override_special = "-_."
}
resource "random_password" "influxdb_admin_token" {
length = 32
special = true
override_special = "-_."
}
resource "kubernetes_secret" "influxdb_auth" {
metadata {
name = "influxdb-auth"
namespace = kubernetes_namespace.this.metadata.0.name
}
data = {
"admin-password" = random_password.influxdb_admin.result
"admin-token" = random_password.influxdb_admin_token.result
}
type = "Opaque"
}