Will Anderson
afe01d2ad9
Move gitea, github-runner, neuron, cloudflared, ollama, verdaccio, devpi, registry, and registry-ui deployments+services to apps/*.yaml so Argo CD manages the app layer. Terraform retains namespaces, PVCs, ConfigMaps, Secrets, and Ingresses. New Secrets in Terraform: - kubernetes_secret.github_runner_secret (ci/github-runner-secret) - kubernetes_secret.cloudflared_secret (neuron/cloudflared-secret) Hardcoded service names in ingress.tf and neuron.tf to remove dependency on removed kubernetes_service resources.
79 lines
1.8 KiB
Terraform
79 lines
1.8 KiB
Terraform
# Package registries — Verdaccio (npm) and devpi (PyPI)
|
|
# Both proxy to public registries and cache locally on Legion
|
|
|
|
resource "kubernetes_namespace" "packages" {
|
|
metadata {
|
|
name = "packages"
|
|
labels = {
|
|
managed-by = "terraform"
|
|
tier = "infrastructure"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_persistent_volume_claim" "verdaccio_data" {
|
|
metadata {
|
|
name = "verdaccio-data"
|
|
namespace = kubernetes_namespace.packages.metadata[0].name
|
|
}
|
|
spec {
|
|
access_modes = ["ReadWriteOnce"]
|
|
resources {
|
|
requests = { storage = "10Gi" }
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_persistent_volume_claim" "devpi_data" {
|
|
metadata {
|
|
name = "devpi-data"
|
|
namespace = kubernetes_namespace.packages.metadata[0].name
|
|
}
|
|
spec {
|
|
access_modes = ["ReadWriteOnce"]
|
|
resources {
|
|
requests = { storage = "10Gi" }
|
|
}
|
|
}
|
|
}
|
|
|
|
# Verdaccio — npm proxy/cache
|
|
resource "kubernetes_config_map" "verdaccio_config" {
|
|
metadata {
|
|
name = "verdaccio-config"
|
|
namespace = kubernetes_namespace.packages.metadata[0].name
|
|
}
|
|
|
|
data = {
|
|
"config.yaml" = <<-EOT
|
|
storage: /verdaccio/storage
|
|
auth:
|
|
htpasswd:
|
|
file: /verdaccio/storage/htpasswd
|
|
max_users: 1
|
|
uplinks:
|
|
npmjs:
|
|
url: https://registry.npmjs.org/
|
|
cache: true
|
|
packages:
|
|
'@harmonic-framework/*':
|
|
access: $authenticated
|
|
publish: $authenticated
|
|
unpublish: $authenticated
|
|
'**':
|
|
access: $all
|
|
publish: $authenticated
|
|
proxy: npmjs
|
|
listen: 0.0.0.0:4873
|
|
server:
|
|
keepAliveTimeout: 60
|
|
log:
|
|
type: stdout
|
|
format: pretty
|
|
level: http
|
|
EOT
|
|
}
|
|
}
|
|
|
|
# Deployments + Services managed by Argo CD — see servers/legion/apps/packages.yaml
|