lutz/OpenTofuPlayground
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

tofu fmt
Some checks failed
Deploy / Update K8s Apps / Detect changed K8s tfvars (push) Successful in 12s
Details
Deploy / Update Apps / Detect changed tfvars files (push) Successful in 11s
Details
Test / Unit Tests — Docker Stack (push) Has been skipped
Details
Test / Unit Tests — K8s Stack (push) Has been skipped
Details
Test / Static Analysis (push) Failing after 23s
Details
Deploy / Update K8s Apps / Deploy ${{ matrix.tfvars }} (push) Failing after 12s
Details
Deploy / Update K8s Apps / Destroy ${{ matrix.tfvars }} (push) Has been skipped
Details
Deploy / Update Apps / Deploy ${{ matrix.tfvars }} (push) Failing after 12s
Details
Deploy / Update Apps / Destroy ${{ matrix.tfvars }} (push) Has been skipped
Details
Test / Integration Test — K8s (k3d) (push) Has been skipped
Details

Browse Source
This commit is contained in:
Lutz FInsterle
2026-03-13 20:13:42 +01:00
parent 8698e7c517
commit cb4d02a361
8 changed files with 45 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
apps/example-dev.tfvars
View File

@@ -1,11 +1,11 @@
# ─── Remote Host ────────────────────────────────────────────────────────────── # ─── Remote Host ──────────────────────────────────────────────────────────────
ssh_host = "dev-server.example.com" ssh_host = "dev-server.example.com"
ssh_user = "deploy" ssh_user = "deploy"
# ssh_key_path is supplied at runtime by CI/CD from gopass — not stored here. # ssh_key_path is supplied at runtime by CI/CD from gopass — not stored here.
# ─── App Identity ───────────────────────────────────────────────────────────── # ─── App Identity ─────────────────────────────────────────────────────────────
app_name = "myapp" app_name = "myapp"
environment = "dev" # ephemeral containers, no persistent volumes environment = "dev" # ephemeral containers, no persistent volumes
# ─── OpenResty: bind_mount mode ─────────────────────────────────────────────── # ─── OpenResty: bind_mount mode ───────────────────────────────────────────────
# Mount a directory that already exists on the remote server. # Mount a directory that already exists on the remote server.
@@ -17,7 +17,7 @@ openresty_external_port = 8080
# ─── PostgreSQL ─────────────────────────────────────────────────────────────── # ─── PostgreSQL ───────────────────────────────────────────────────────────────
db_name = "myapp_dev" db_name = "myapp_dev"
db_user = "myapp" db_user = "myapp"
db_password = "changeme-dev" # use gopass / CI secret for real deployments db_password = "changeme-dev" # use gopass / CI secret for real deployments
# ─── Images (optional overrides) ────────────────────────────────────────────── # ─── Images (optional overrides) ──────────────────────────────────────────────
# postgres_image = "postgres:16-alpine" # postgres_image = "postgres:16-alpine"

16
apps/example-prod.tfvars
View File

@@ -1,25 +1,25 @@
# ─── Remote Host ────────────────────────────────────────────────────────────── # ─── Remote Host ──────────────────────────────────────────────────────────────
ssh_host = "prod-server.example.com" ssh_host = "prod-server.example.com"
ssh_user = "deploy" ssh_user = "deploy"
# ssh_key_path is supplied at runtime by CI/CD from gopass — not stored here. # ssh_key_path is supplied at runtime by CI/CD from gopass — not stored here.
# ─── App Identity ───────────────────────────────────────────────────────────── # ─── App Identity ─────────────────────────────────────────────────────────────
app_name = "myapp" app_name = "myapp"
environment = "prod" # named Docker volumes, data persists across container restarts environment = "prod" # named Docker volumes, data persists across container restarts
# ─── OpenResty: git_clone mode ──────────────────────────────────────────────── # ─── OpenResty: git_clone mode ────────────────────────────────────────────────
# The OpenResty Alpine image starts, installs git via apk, then clones the repo. # The OpenResty Alpine image starts, installs git via apk, then clones the repo.
# Pin to a tag or full commit SHA — never use a branch name in prod. # Pin to a tag or full commit SHA — never use a branch name in prod.
# The repo must contain an 'openresty/' directory with a valid nginx.conf. # The repo must contain an 'openresty/' directory with a valid nginx.conf.
openresty_source_type = "git_clone" openresty_source_type = "git_clone"
openresty_git_repo = "https://gitea.example.com/myorg/myapp-openresty.git" openresty_git_repo = "https://gitea.example.com/myorg/myapp-openresty.git"
openresty_git_ref = "v1.4.2" # pinned tag — never 'main' in prod openresty_git_ref = "v1.4.2" # pinned tag — never 'main' in prod
# openresty_git_token is supplied at runtime by CI/CD from gopass — not stored here. # openresty_git_token is supplied at runtime by CI/CD from gopass — not stored here.
openresty_external_port = 80 openresty_external_port = 80
# ─── PostgreSQL ─────────────────────────────────────────────────────────────── # ─── PostgreSQL ───────────────────────────────────────────────────────────────
db_name = "myapp_prod" db_name = "myapp_prod"
db_user = "myapp" db_user = "myapp"
# db_password is supplied at runtime by CI/CD from gopass — not stored here. # db_password is supplied at runtime by CI/CD from gopass — not stored here.
# ─── Images (optional overrides) ────────────────────────────────────────────── # ─── Images (optional overrides) ──────────────────────────────────────────────

2
k8s/apps/example-nodered.tfvars
View File

@@ -16,7 +16,7 @@ init_container_image = "gitea.example.com/myorg/mynodered-init:v1.2.0"
init_data_src_path = "/app-data" init_data_src_path = "/app-data"
# ─── Storage ────────────────────────────────────────────────────────────────── # ─── Storage ──────────────────────────────────────────────────────────────────
storage_class = "local-path" # k3s default provisioner storage_class = "local-path" # k3s default provisioner
app_pvc_size = "2Gi" app_pvc_size = "2Gi"
# ─── Ingress (Traefik) ──────────────────────────────────────────────────────── # ─── Ingress (Traefik) ────────────────────────────────────────────────────────

4
k8s/tests/k8s_validation.tftest.hcl
View File

@@ -48,8 +48,8 @@ run "valid_with_rabbitmq" {
run "valid_prod_environment" { run "valid_prod_environment" {
command = plan command = plan
variables { variables {
environment = "prod" environment = "prod"
enable_rabbitmq = true enable_rabbitmq = true
rabbitmq_password = "rabbit-secret" rabbitmq_password = "rabbit-secret"
} }
} }

12
k8s/variables.tf
View File

@@ -92,9 +92,9 @@ variable "loki_endpoint" {
variable "loki_auth_token" { variable "loki_auth_token" {
description = "Bearer token for Loki. Leave empty for unauthenticated Loki." description = "Bearer token for Loki. Leave empty for unauthenticated Loki."
type = string type = string
default = "" default = ""
sensitive = true sensitive = true
} }
# ─── RabbitMQ ───────────────────────────────────────────────────────────────── # ─── RabbitMQ ─────────────────────────────────────────────────────────────────
@@ -119,9 +119,9 @@ variable "rabbitmq_user" {
variable "rabbitmq_password" { variable "rabbitmq_password" {
description = "RabbitMQ default user password." description = "RabbitMQ default user password."
type = string type = string
sensitive = true sensitive = true
default = "" default = ""
} }
variable "rabbitmq_vhost" { variable "rabbitmq_vhost" {

12
modules/app-k8s-nodered-rabbitmq/variables.tf
View File

@@ -83,9 +83,9 @@ variable "loki_endpoint" {
variable "loki_auth_token" { variable "loki_auth_token" {
description = "Bearer token for Loki authentication. Leave empty for unauthenticated Loki." description = "Bearer token for Loki authentication. Leave empty for unauthenticated Loki."
type = string type = string
default = "" default = ""
sensitive = true sensitive = true
} }
# ─── RabbitMQ (optional) ────────────────────────────────────────────────────── # ─── RabbitMQ (optional) ──────────────────────────────────────────────────────
@@ -110,9 +110,9 @@ variable "rabbitmq_user" {
variable "rabbitmq_password" { variable "rabbitmq_password" {
description = "RabbitMQ default user password." description = "RabbitMQ default user password."
type = string type = string
sensitive = true sensitive = true
default = "" default = ""
} }
variable "rabbitmq_vhost" { variable "rabbitmq_vhost" {

26
modules/app-openresty-pg-redis/variables.tf
View File

@@ -48,8 +48,8 @@ variable "openresty_remote_config_path" {
Absolute path on the REMOTE HOST to mount as /usr/local/openresty/nginx/conf inside the container. Absolute path on the REMOTE HOST to mount as /usr/local/openresty/nginx/conf inside the container.
Only used when openresty_source_type = 'bind_mount'. Only used when openresty_source_type = 'bind_mount'.
EOT EOT
type = string type = string
default = "" default = ""
} }
# ─── OpenResty: local_build options ─────────────────────────────────────────── # ─── OpenResty: local_build options ───────────────────────────────────────────
@@ -60,8 +60,8 @@ variable "openresty_local_build_context" {
The context is transferred to the remote Docker daemon over SSH and built there. The context is transferred to the remote Docker daemon over SSH and built there.
Only used when openresty_source_type = 'local_build'. Only used when openresty_source_type = 'local_build'.
EOT EOT
type = string type = string
default = "" default = ""
} }
variable "openresty_dockerfile" { variable "openresty_dockerfile" {
@@ -78,8 +78,8 @@ variable "openresty_git_repo" {
Only used when openresty_source_type = 'git_clone'. Only used when openresty_source_type = 'git_clone'.
The cloned repo must contain an 'openresty/' directory with a valid nginx.conf. The cloned repo must contain an 'openresty/' directory with a valid nginx.conf.
EOT EOT
type = string type = string
default = "" default = ""
} }
variable "openresty_git_ref" { variable "openresty_git_ref" {
@@ -89,8 +89,8 @@ variable "openresty_git_ref" {
could contain different code each time the container is recreated). could contain different code each time the container is recreated).
Only used when openresty_source_type = 'git_clone'. Only used when openresty_source_type = 'git_clone'.
EOT EOT
type = string type = string
default = "" default = ""
validation { validation {
condition = var.openresty_git_ref == "" || !contains( condition = var.openresty_git_ref == "" || !contains(
@@ -107,9 +107,9 @@ variable "openresty_git_token" {
Injected into the clone URL as oauth2:<token>@. Injected into the clone URL as oauth2:<token>@.
Only used when openresty_source_type = 'git_clone'. Only used when openresty_source_type = 'git_clone'.
EOT EOT
type = string type = string
default = "" default = ""
sensitive = true sensitive = true
} }
# ─── Networking & Ports ─────────────────────────────────────────────────────── # ─── Networking & Ports ───────────────────────────────────────────────────────
@@ -133,8 +133,8 @@ variable "db_user" {
variable "db_password" { variable "db_password" {
description = "PostgreSQL password." description = "PostgreSQL password."
type = string type = string
sensitive = true sensitive = true
} }
variable "postgres_image" { variable "postgres_image" {

10
variables.tf
View File

@@ -89,9 +89,9 @@ variable "openresty_git_ref" {
variable "openresty_git_token" { variable "openresty_git_token" {
description = "Optional auth token for private git repos (git_clone mode)." description = "Optional auth token for private git repos (git_clone mode)."
type = string type = string
default = "" default = ""
sensitive = true sensitive = true
} }
# ─── PostgreSQL ─────────────────────────────────────────────────────────────── # ─── PostgreSQL ───────────────────────────────────────────────────────────────
@@ -108,8 +108,8 @@ variable "db_user" {
variable "db_password" { variable "db_password" {
description = "PostgreSQL password." description = "PostgreSQL password."
type = string type = string
sensitive = true sensitive = true
} }
variable "postgres_image" { variable "postgres_image" {