120 lines
3.1 KiB
HCL
120 lines
3.1 KiB
HCL
terraform {
|
||
required_providers {
|
||
kubernetes = {
|
||
source = "hashicorp/kubernetes"
|
||
version = "~> 2.26"
|
||
}
|
||
helm = {
|
||
source = "hashicorp/helm"
|
||
version = "~> 2.12"
|
||
}
|
||
}
|
||
|
||
# Der State-Pfad pro Umgebung wird beim init gesetzt:
|
||
# terraform init -backend-config=envs/test.backend.hcl (k3s, terraform/states/boday_tf – unverändert)
|
||
# terraform init -backend-config=envs/prod.backend.hcl (Talos, terraform/states/boday_tf_prod)
|
||
backend "consul" {
|
||
address = "consul:8500"
|
||
}
|
||
}
|
||
|
||
# --- Variablen ---------------------------------------------------------------
|
||
|
||
variable "app_version" {
|
||
description = "Image-Tag (Git-SHA aus der Pipeline)"
|
||
type = string
|
||
default = "latest"
|
||
}
|
||
|
||
variable "environment" {
|
||
description = "test (k3s) oder prod (Talos)"
|
||
type = string
|
||
}
|
||
|
||
variable "kubeconfig_path" {
|
||
type = string
|
||
default = "./kind_kubeconfig"
|
||
}
|
||
|
||
# Nur für k3s nötig (überschreibt den Server aus der Kubeconfig). Bei Talos null lassen.
|
||
variable "kube_host" {
|
||
type = string
|
||
default = null
|
||
}
|
||
|
||
# k3s-Test: true. Talos: false – die Kubeconfig von talosctl enthält die CA.
|
||
variable "kube_insecure" {
|
||
type = bool
|
||
default = false
|
||
}
|
||
|
||
variable "namespace" {
|
||
type = string
|
||
default = "default"
|
||
}
|
||
|
||
# Leer = Wert aus values.yaml bleibt (k3s-Test). Für Prod als Forgejo-Secret übergeben.
|
||
variable "django_secret_key" {
|
||
type = string
|
||
default = ""
|
||
sensitive = true
|
||
}
|
||
|
||
variable "postgres_password" {
|
||
type = string
|
||
default = ""
|
||
sensitive = true
|
||
}
|
||
|
||
# --- Provider ----------------------------------------------------------------
|
||
|
||
provider "kubernetes" {
|
||
config_path = var.kubeconfig_path
|
||
host = var.kube_host
|
||
insecure = var.kube_insecure
|
||
}
|
||
|
||
provider "helm" {
|
||
kubernetes {
|
||
config_path = var.kubeconfig_path
|
||
host = var.kube_host
|
||
insecure = var.kube_insecure
|
||
}
|
||
}
|
||
|
||
# --- Deployment --------------------------------------------------------------
|
||
|
||
resource "helm_release" "boday_website" {
|
||
name = "boday-it"
|
||
chart = "./charts/boday-it"
|
||
namespace = var.namespace
|
||
create_namespace = var.namespace != "default"
|
||
timeout = 600 # 10 min instead of 5 (first Longhorn volume, slow pulls)
|
||
atomic = true # on failure: automatic rollback instead of a "failed" release
|
||
|
||
# Umgebungsspezifische Werte (Ingress-Klasse, StorageClass, ...)
|
||
values = [file("${path.module}/charts/boday-it/values-${var.environment}.yaml")]
|
||
|
||
set {
|
||
name = "image.tag"
|
||
value = var.app_version
|
||
}
|
||
|
||
# Secrets nur setzen, wenn sie übergeben wurden (sonst gilt values.yaml).
|
||
# nonsensitive() gibt nur "gesetzt ja/nein" frei, nicht den Wert selbst.
|
||
dynamic "set_sensitive" {
|
||
for_each = nonsensitive(var.django_secret_key != "") ? ["secrets.djangoSecretKey"] : []
|
||
content {
|
||
name = set_sensitive.value
|
||
value = var.django_secret_key
|
||
}
|
||
}
|
||
|
||
dynamic "set_sensitive" {
|
||
for_each = nonsensitive(var.postgres_password != "") ? ["secrets.postgresPassword"] : []
|
||
content {
|
||
name = set_sensitive.value
|
||
value = var.postgres_password
|
||
}
|
||
}
|
||
}
|