Will Anderson
90 lines
2.0 KiB
Terraform
90 lines
2.0 KiB
Terraform
# AdGuard Home — household DNS with ad blocking and local nook.family resolution
|
|
|
|
resource "kubernetes_namespace" "dns" {
|
|
metadata {
|
|
name = "dns"
|
|
labels = {
|
|
managed-by = "terraform"
|
|
tier = "infrastructure"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_persistent_volume_claim" "adguard_config" {
|
|
wait_until_bound = false
|
|
metadata {
|
|
name = "adguard-config"
|
|
namespace = kubernetes_namespace.dns.metadata[0].name
|
|
}
|
|
spec {
|
|
access_modes = ["ReadWriteOnce"]
|
|
resources {
|
|
requests = {
|
|
storage = "1Gi"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_persistent_volume_claim" "adguard_data" {
|
|
wait_until_bound = false
|
|
metadata {
|
|
name = "adguard-data"
|
|
namespace = kubernetes_namespace.dns.metadata[0].name
|
|
}
|
|
spec {
|
|
access_modes = ["ReadWriteOnce"]
|
|
resources {
|
|
requests = {
|
|
storage = "5Gi"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
# Deployment + Service managed by Argo CD — see servers/legion/apps/adguard.yaml
|
|
|
|
resource "kubernetes_ingress_v1" "adguard" {
|
|
metadata {
|
|
name = "adguard"
|
|
namespace = kubernetes_namespace.dns.metadata[0].name
|
|
annotations = {
|
|
"traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
|
|
"cert-manager.io/cluster-issuer" = "letsencrypt-prod"
|
|
}
|
|
}
|
|
|
|
spec {
|
|
tls {
|
|
hosts = ["dns.${var.domain_suffix}"]
|
|
secret_name = "adguard-tls"
|
|
}
|
|
|
|
rule {
|
|
host = "dns.${var.domain_suffix}"
|
|
http {
|
|
path {
|
|
path = "/"
|
|
path_type = "Prefix"
|
|
backend {
|
|
service {
|
|
name = "adguard-ui"
|
|
port {
|
|
number = 3000
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
depends_on = [helm_release.cert_manager]
|
|
}
|
|
|
|
# Host-level bootstrap notes (run bootstrap.sh once on new Legion installs):
|
|
# - systemd-resolved disabled (conflicts with AdGuard on port 53)
|
|
# - k3s config.yaml includes tls-san for LAN IP
|
|
# - /etc/resolv.conf set to 1.1.1.1 fallback
|
|
# See: servers/legion/bootstrap.sh
|