Syncing goliath configs

cluster/.envrc

@@ -0,0 +1,2 @@
+sops -d ./cluster.tfvars.sops > cluster.tfvars
+export TF_CLI_ARGS="--var-file=cluster.tfvars"

cluster/.gitignore

@@ -0,0 +1 @@
+cluster.tfvars

cluster/authentik.tf

@@ -0,0 +1,75 @@
+variable "authentik_postgresql_password" {
+    type = string
+}
+
+variable "authentik_secret_key" {
+    type = string
+}
+
+resource "helm_release" "authentik" {
+    depends_on = [
+        helm_release.local_path_provisioner
+    ]
+
+    name = "authentik"
+    repository = "https://charts.goauthentik.io"
+    chart = "authentik"
+    create_namespace = true
+    namespace = "authentik"
+
+    timeout = var.helm_timeout
+    cleanup_on_fail = true
+    force_update = true
+
+    values = [
+        yamlencode({
+            authentik = {
+                secret_key = var.authentik_secret_key
+                error_reporting = {
+                    enabled = true
+                }
+                postgresql = {
+                    password = var.authentik_postgresql_password
+                }
+            }
+            redis = {
+                enabled = true 
+                master = {
+                    persistence = {
+                        enabled = true
+                        storageClass = "local-path"
+                        accessModes = [
+                            "ReadWriteOnce"
+                        ]
+                    }
+                }
+            }
+            postgresql = {
+                enabled = true
+                password = var.authentik_postgresql_password
+                postgresqlPassword = var.authentik_postgresql_password
+                persistence = {
+                    enabled = true
+                    storageClass = "local-path"
+                    accessModes = [
+                        "ReadWriteOnce"
+                    ]
+                }
+            }
+            ingress = {
+                enabled = true
+                hosts = [
+                    {
+                        host = "auth.inskip.me"
+                        paths = [
+                            {
+                                path = "/"
+                                pathType = "Prefix"
+                            }
+                        ]
+                    }
+                ]
+            }
+        })
+    ]
+}

cluster/backend.tf

@@ -0,0 +1,10 @@
+terraform {
+  backend "remote" {
+    hostname = "app.terraform.io"
+    organization = "kittywitch"
+
+    workspaces {
+      name = "infrastructure-cluster"
+    }
+  }
+}

cluster/local-path-provisioner.tf

@@ -1,5 +1,5 @@
 resource "helm_release" "local_path_provisioner" {
-    name = "local-path-provisioner"
+    name = "local-path-storage"
     repository = "${path.module}/lpp/deploy/chart"
     chart = "local-path-provisioner"
     create_namespace = true
@@ -8,4 +8,10 @@ resource "helm_release" "local_path_provisioner" {
     timeout = var.helm_timeout
     cleanup_on_fail = true
     force_update = true
+
+    values = [yamlencode({
+        storageClass = {
+            defaultClass = true
+        }
+    })]
 }

cluster/pihole-deployment.tf

@@ -131,8 +131,8 @@ resource "kubernetes_deployment" "pihole" {
             initial_delay_seconds = 60
             period_seconds = 15
           }
-        }
         */
+        }
 
         container {
           image = "ghcr.io/tailscale/tailscale:latest"

cluster/postgres.tf

@@ -1,49 +0,0 @@
-variable "postgres_password" {
-    type = string
-}
-
-resource "kubernetes_namespace" "postgres_namespace" {
-    metadata { 
-        name = "postgresql"
-    }
-}
-
-resource "kubernetes_secret" "postgres_auth_secret" {
-    depends_on = [
-        kubernetes_namespace.postgres_namespace
-    ]
-
-    metadata {
-        name = "postgres-auth-secret"
-        namespace = "postgresql"
-    }
-    data = {
-        postgres-password = var.postgres_password
-    }
-    type = "Opaque"
-}
-
-resource "helm_release" "postgresql" {
-    depends_on = [
-        kubernetes_namespace.postgres_namespace,
-        kubernetes_secret.postgres_auth_secret
-    ]
-
-    name = "postgresql"
-    repository = "https://charts.bitnami.com/bitnami"
-    chart = "postgresql"
-    namespace = "postgresql"
-
-    timeout = var.helm_timeout
-    cleanup_on_fail = true
-    force_update = true
-
-    set {
-        name = "global.storageClass"
-        value = "local-path"
-    }
-    set {
-        name = "global.postgresql.existingSecret"
-        value = "postgres-auth-secret"
-    }
-}

cluster/tailscale.tf

@@ -1,11 +1,15 @@
-
 variable "tailscale_api_key" {
     type = string
 }
 
+variable "tailnet" {
+    type = string
+}
+
+
 provider "tailscale" {
     api_key = var.tailscale_api_key
-    tailnet = "inskip.me"
+    tailnet = var.tailnet
 }
 
 resource "tailscale_tailnet_key" "cluster_reusable" {