Restructure: servers/legion/ layout, rename repo to infrastructure

2026-03-23 07:38:42 -05:00
parent 7751eddd73
commit 0b4a236a88
22 changed files with 4 additions and 4 deletions
@@ -0,0 +1,180 @@
+# Traefik ingress routes for all services — TLS via cert-manager + Cloudflare DNS-01
+# Kong and open-webui ingresses moved to inactive/ — restore when needed
+
+resource "kubernetes_ingress_v1" "ollama" {
+  metadata {
+    name      = "ollama"
+    namespace = kubernetes_namespace.ollama.metadata[0].name
+    annotations = {
+      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
+      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
+    }
+  }
+
+  spec {
+    tls {
+      hosts       = ["ollama.${var.infra_domain}"]
+      secret_name = "ollama-tls"
+    }
+    rule {
+      host = "ollama.${var.infra_domain}"
+      http {
+        path {
+          path      = "/"
+          path_type = "Prefix"
+          backend {
+            service {
+              name = kubernetes_service.ollama.metadata[0].name
+              port { number = 11434 }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  depends_on = [helm_release.cert_manager]
+}
+
+
+resource "kubernetes_ingress_v1" "registry" {
+  metadata {
+    name      = "registry"
+    namespace = kubernetes_namespace.registry.metadata[0].name
+    annotations = {
+      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
+      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
+    }
+  }
+
+  spec {
+    tls {
+      hosts       = ["registry.${var.domain_suffix}"]
+      secret_name = "registry-tls"
+    }
+    rule {
+      host = "registry.${var.domain_suffix}"
+      http {
+        path {
+          path      = "/"
+          path_type = "Prefix"
+          backend {
+            service {
+              name = kubernetes_service.registry.metadata[0].name
+              port { number = 5000 }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  depends_on = [helm_release.cert_manager]
+}
+
+resource "kubernetes_ingress_v1" "registry_ui" {
+  metadata {
+    name      = "registry-ui"
+    namespace = kubernetes_namespace.registry.metadata[0].name
+    annotations = {
+      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
+      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
+    }
+  }
+
+  spec {
+    tls {
+      hosts       = ["docker.neuralplatform.ai"]
+      secret_name = "docker-ui-tls"
+    }
+    rule {
+      host = "docker.neuralplatform.ai"
+      http {
+        path {
+          path      = "/"
+          path_type = "Prefix"
+          backend {
+            service {
+              name = kubernetes_service.registry_ui.metadata[0].name
+              port { number = 80 }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  depends_on = [helm_release.cert_manager]
+}
+
+# npm registry — Verdaccio (proxies npmjs.org, caches locally)
+resource "kubernetes_ingress_v1" "npm_registry" {
+  metadata {
+    name      = "npm-registry"
+    namespace = kubernetes_namespace.packages.metadata[0].name
+    annotations = {
+      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
+      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
+    }
+  }
+
+  spec {
+    tls {
+      hosts       = ["npm.neuralplatform.ai"]
+      secret_name = "npm-registry-tls"
+    }
+    rule {
+      host = "npm.neuralplatform.ai"
+      http {
+        path {
+          path      = "/"
+          path_type = "Prefix"
+          backend {
+            service {
+              name = kubernetes_service.verdaccio.metadata[0].name
+              port { number = 4873 }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  depends_on = [helm_release.cert_manager, kubernetes_deployment.verdaccio]
+}
+
+# PyPI registry — devpi (proxies pypi.org, caches locally)
+resource "kubernetes_ingress_v1" "pypi_registry" {
+  metadata {
+    name      = "pypi-registry"
+    namespace = kubernetes_namespace.packages.metadata[0].name
+    annotations = {
+      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
+      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
+    }
+  }
+
+  spec {
+    tls {
+      hosts       = ["pypi.neuralplatform.ai"]
+      secret_name = "pypi-registry-tls"
+    }
+    rule {
+      host = "pypi.neuralplatform.ai"
+      http {
+        path {
+          path      = "/"
+          path_type = "Prefix"
+          backend {
+            service {
+              name = kubernetes_service.devpi.metadata[0].name
+              port { number = 3141 }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  depends_on = [helm_release.cert_manager, kubernetes_deployment.devpi]
+}