From e316ea92f8cf0a6312d7d42031c7c33232222e2c Mon Sep 17 00:00:00 2001
From: root <root@BITMT501.boday.biz>
Date: Sun, 8 Nov 2026 02:25:56 +0100
Subject: [PATCH] intial import

---
 .github/workflows/deploy.yml |  23 ++++++++
 .gitignore                   |   3 +
 main.tf                      | 104 +++++++++++++++++++++++++++++++++++
 talos/registry-patch.yaml    |  22 ++++++++
 terraform.tfvars             |   3 +
 5 files changed, 155 insertions(+)
 create mode 100644 .github/workflows/deploy.yml
 create mode 100644 .gitignore
 create mode 100644 main.tf
 create mode 100644 talos/registry-patch.yaml
 create mode 100644 terraform.tfvars

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..b9fa8c3
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,23 @@
+name: Talos Platform Deploy
+
+on:
+  push:
+    branches: [ "main" ]
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare Kubernetes Access (Talos)
+        run: |
+          echo "${{ secrets.KUBECONFIG_TALOS }}" > ./talos_kubeconfig
+          chmod 600 ./talos_kubeconfig
+
+      - name: Terraform Deploy
+        run: |
+          terraform init
+          terraform apply -auto-approve
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..84134cd
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+.terraform/
+talos_kubeconfig
+*.tfstate*
diff --git a/main.tf b/main.tf
new file mode 100644
index 0000000..013d96e
--- /dev/null
+++ b/main.tf
@@ -0,0 +1,104 @@
+# talos-platform – gemeinsame Cluster-Dienste für Produktion (Talos)
+# Hier liegt alles, was ALLE Apps brauchen. Apps (boday_tf, ...) bringen nur ihr eigenes Chart mit.
+
+terraform {
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "~> 2.26"
+    }
+    helm = {
+      source  = "hashicorp/helm"
+      version = "~> 2.12"
+    }
+  }
+
+  backend "consul" {
+    address = "consul:8500"
+    path    = "terraform/states/talos_platform"
+  }
+}
+
+variable "kubeconfig_path" {
+  type    = string
+  default = "./talos_kubeconfig"
+}
+
+# Version des Traefik-Helm-Charts (traefik/traefik). Bewusst pinnen, damit Updates geplant passieren.
+variable "traefik_chart_version" {
+  type = string
+}
+
+provider "kubernetes" {
+  config_path = var.kubeconfig_path
+}
+
+provider "helm" {
+  kubernetes {
+    config_path = var.kubeconfig_path
+  }
+}
+
+# Feste IP für Traefik aus dem MetalLB-Pool. Auf diese IP zeigt das OPNsense-Portforwarding (80/443).
+variable "traefik_lb_ip" {
+  type = string
+}
+
+# Kein hostPort mehr -> der Talos-Standard (PSA "baseline") reicht
+resource "kubernetes_namespace" "traefik" {
+  metadata {
+    name = "traefik"
+  }
+}
+
+# Traefik hinter einem MetalLB-LoadBalancer: VIP wandert bei Node-Ausfall auf den anderen Node
+resource "helm_release" "traefik" {
+  name       = "traefik"
+  repository = "https://traefik.github.io/charts"
+  chart      = "traefik"
+  version    = var.traefik_chart_version
+  namespace  = kubernetes_namespace.traefik.metadata[0].name
+
+  values = [yamlencode({
+    deployment = { replicas = 2 }
+
+    # Je ein Pod pro Node
+    topologySpreadConstraints = [{
+      maxSkew           = 1
+      topologyKey       = "kubernetes.io/hostname"
+      whenUnsatisfiable = "DoNotSchedule"
+      labelSelector = {
+        matchLabels = {
+          "app.kubernetes.io/name"     = "traefik"
+          "app.kubernetes.io/instance" = "traefik-traefik"
+        }
+      }
+    }]
+
+    service = {
+      type = "LoadBalancer"
+      annotations = {
+        "metallb.io/loadBalancerIPs" = var.traefik_lb_ip
+      }
+      spec = {
+        # Echte Client-IP bleibt erhalten (Django-Logs, CrowdSec)
+        externalTrafficPolicy = "Local"
+      }
+    }
+
+    ingressClass = {
+      enabled        = true
+      isDefaultClass = true
+      name           = "traefik"
+    }
+
+    providers = {
+      kubernetesIngress = { enabled = true }
+      kubernetesCRD     = { enabled = true }
+    }
+  })]
+}
+
+output "traefik_lb_ip" {
+  value = var.traefik_lb_ip
+}
diff --git a/talos/registry-patch.yaml b/talos/registry-patch.yaml
new file mode 100644
index 0000000..5187b8b
--- /dev/null
+++ b/talos/registry-patch.yaml
@@ -0,0 +1,22 @@
+# Talos Machine-Config-Patch: Images aus registry.local (Forgejo-Registry hinter nginx, self-signed) ziehen
+#
+# Anwenden (pro Node, kein Reboot nötig):
+#   talosctl patch machineconfig --nodes 172.25.64.74 --patch @talos/registry-patch.yaml
+#
+# <REGISTRY_IP>  = IP des nginx vor der Forgejo-Registry
+# <CA_BASE64>    = base64 -w0 nginx_ssl/nginx.crt
+machine:
+  network:
+    extraHostEntries:
+      - ip: <REGISTRY_IP>
+        aliases:
+          - registry.local
+  registries:
+    mirrors:
+      registry.local:
+        endpoints:
+          - https://registry.local
+    config:
+      registry.local:
+        tls:
+          ca: <CA_BASE64>
diff --git a/terraform.tfvars b/terraform.tfvars
new file mode 100644
index 0000000..50b41e2
--- /dev/null
+++ b/terraform.tfvars
@@ -0,0 +1,3 @@
+kubeconfig_path       = "./talos_kubeconfig"
+traefik_chart_version = "CHANGE_ME"        # aktuelle Version: helm search repo traefik/traefik
+traefik_lb_ip         = "172.25.64.CHANGE" # freie IP aus deinem MetalLB-IPAddressPool