nomad to the max

.project

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>nomad-nummer5</name>
+	<comment></comment>
+	<projects>
+	</projects>
+	<buildSpec>
+	</buildSpec>
+	<natures>
+	</natures>
+</projectDescription>

.settings/org.eclipse.core.resources.prefs

@@ -0,0 +1,2 @@
+eclipse.preferences.version=1
+encoding/<project>=UTF-8

README.md

@@ -0,0 +1,8 @@
+# Datacenter: nummer5
+
+* Packages: podman, kubernetes-cni (from the kubernetes-source)
+
+
+# Plugins
+
+NFS - https://github.com/thatsk/nfs-csi-nomad/tree/main

_sys/nfs-controller.hcl

@@ -0,0 +1,38 @@
+# nfs-controller.job
+variable "datacenters" {
+  type        = list(string)
+  description = "List of datacenters to deploy to."
+  default     = ["nummer5"]
+}
+
+job "plugin-nfs-controller" {
+  datacenters = var.datacenters
+
+  group "controller" {
+    task "plugin" {
+      driver = "podman"
+
+      config {
+        image = "mcr.microsoft.com/k8s/csi/nfs-csi:latest"
+
+        args = [
+          "--endpoint=unix://csi/csi.sock",
+          "--nodeid=${attr.unique.hostname}",
+          "--logtostderr",
+          "-v=5",
+        ]
+      }
+
+      csi_plugin {
+        id        = "nfs"
+        type      = "controller"
+        mount_dir = "/csi"
+      }
+
+      resources {
+        cpu    = 250
+        memory = 128
+      }
+    }
+  }
+}

_sys/nfs-nodes.hcl

@@ -0,0 +1,42 @@
+#nfs-nodes.job
+variable "datacenters" {
+  type        = list(string)
+  description = "List of datacenters to deploy to."
+  default     = ["nummer5"]
+}
+
+job "plugin-nfs-nodes" {
+  datacenters = var.datacenters
+
+  type = "system"
+
+  group "nodes" {
+    task "plugin" {
+      driver = "podman"
+
+      config {
+        image = "mcr.microsoft.com/k8s/csi/nfs-csi:latest"
+
+        args = [
+          "--endpoint=unix://csi/csi.sock",
+          "--nodeid=${attr.unique.hostname}",
+          "--logtostderr",
+          "--v=5",
+        ]
+
+        privileged = true
+      }
+
+      csi_plugin {
+        id        = "nfs"
+        type      = "node"
+        mount_dir = "/csi"
+      }
+
+      resources {
+        cpu    = 250
+        memory = 128
+      }
+    }
+  }
+}

_sys/traeffik.hcl

@@ -0,0 +1,74 @@
+job "traefik" {
+  region      = "global"
+  datacenters = ["nummer5"]
+  type        = "service"
+
+  group "traefik" {
+    count = 1
+
+    network {
+      port "http" {
+        static = 80
+      }
+
+      port "api" {
+        static = 81
+      }
+    }
+
+    service {
+      name = "traefik"
+
+      check {
+        name     = "alive"
+        type     = "tcp"
+        port     = "http"
+        interval = "10s"
+        timeout  = "2s"
+      }
+    }
+
+    task "traefik" {
+      driver = "podman"
+
+      config {
+        image        = "docker.io/library/traefik:latest"
+        network_mode = "host"
+
+        volumes = [
+          "local/traefik.toml:/etc/traefik/traefik.toml",
+        ]
+      }
+
+      template {
+        data = <<EOF
+[entryPoints]
+    [entryPoints.http]
+    address = ":80"
+    [entryPoints.traefik]
+    address = ":81"
+
+[api]
+    dashboard = true
+    insecure  = true
+
+# Enable Consul Catalog configuration backend.
+[providers.consulCatalog]
+    prefix           = "traefik"
+    exposedByDefault = false
+
+    [providers.consulCatalog.endpoint]
+      address = "127.0.0.1:8500"
+      scheme  = "http"
+EOF
+
+        destination = "local/traefik.toml"
+      }
+
+      resources {
+        cpu    = 100
+        memory = 128
+      }
+    }
+  }
+}

apps/apt-cacher-ng/live.hcl

@@ -0,0 +1,51 @@
+job "apt-cacher-ng" {
+  datacenters = ["nummer5"]
+  
+  group "system" {
+    count = 1
+
+    network {
+      port  "http"{
+        to = 3142
+      }
+    }
+
+    service {
+      name = "apt-cache"
+      port = "http"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.http.rule=Host(`apt-cache.service.consul`)",
+      ]
+
+    }
+    
+    volume "apt-cacher-data" {
+        type = "csi"
+        read_only = false
+        source = "apt-cacher-data"
+        access_mode = "single-node-writer"
+        attachment_mode = "file-system"
+    }  
+      
+    task "server" {
+      env {
+        PORT    = "${NOMAD_PORT_http}"
+        NODE_IP = "${NOMAD_IP_http}"
+      }
+
+      driver = "podman"
+
+      config {
+        image = "cr.wks/apt-cacher-ng"
+        ports = ["http"]
+      }
+      
+      volume_mount {
+        volume = "apt-cacher-data"
+        destination = "/var/cache/apt-cacher-ng"
+      }
+    }
+  }
+}

apps/apt-cacher-ng/volume.hcl

@@ -0,0 +1,21 @@
+type = "csi"
+id = "apt-cacher-data"
+name = "apt-cacher-data"
+plugin_id = "nfs"
+external_id = "apt-cacher-data"
+
+capability {
+    access_mode = "single-node-writer"
+    attachment_mode = "file-system"
+}
+
+context {
+  server = "ebin02.wks"
+  share = "/data/raid1-ssd/app-data/apt-cacher-ng"
+  mountPermissions = "0"  
+}
+
+mount_options {
+  fs_type = "nfs"
+  mount_flags = [ "timeo=30", "vers=3", "_netdev" , "nolock" ]
+}

apps/gitea/live.hcl

@@ -0,0 +1,83 @@
+job "gitea" {
+  datacenters = [
+    "nummer5",
+  ]
+  type = "service"
+
+  group "gitea" {
+    count = 1
+
+    network {
+      port "http" {
+        to = 3000
+      }
+
+      port "ssh" {
+        static = 2222
+        to     = 22
+      }
+    }
+
+    volume "gitea-data" {
+      type      = "csi"
+      source    = "gitea-data"
+      read_only = false
+      access_mode = "single-node-writer"
+      attachment_mode = "file-system"
+    }
+
+    restart {
+      attempts = 5
+      delay    = "30s"
+    }
+
+    task "gitea" {
+      driver = "podman"
+      volume_mount {
+        volume      = "gitea-data"
+        destination = "/data"
+        read_only   = false
+      }
+
+      config {
+        image = "docker.io/gitea/gitea:latest"
+        ports = ["ssh", "http"]
+      }
+
+      env {
+        APP_NAME                        = "Gitea: Git with a cup of tea"
+        RUN_MODE                        = "prod"
+        SSH_DOMAIN                      = "consul"
+        SSH_PORT                        = "2222"
+        ROOT_URL                        = "http://gitea.service.consul"
+        TZ                              = "Europe/Berlin"
+        USER_UID                        = "1000"
+        USER_GID                        = "1000"
+        DB_TYPE                         = "postgres"
+        DB_HOST                         = "postgres.service.consul"
+        DB_USER                         = "gitea"
+        DB_PASSWORD                     = "giteaEu94XSS4gKpheSBoMsIs"
+        GITEA__lfs__PATH                = "/data/git/lfs"
+        GITEA__server__START_SSH_SERVER = "true"
+        GITEA__packages__ENABLED        = "true"
+        GITEA__log__LEVEL               = "warn"
+        
+      }
+
+      resources {
+        cpu    = 200
+        memory = 512
+      }
+
+      service {
+        name = "gitea"
+        port = "http"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.http.routers.gitea.rule=Host(`gitea.service.consul`)",
+        ]
+      }
+    }
+  }
+}

apps/gitea/volume.hcl

@@ -0,0 +1,21 @@
+type = "csi"
+id = "gitea-data"
+name = "gitea-data"
+plugin_id = "nfs"
+external_id = "gitea-data"
+
+capability {
+    access_mode = "single-node-writer"
+    attachment_mode = "file-system"
+}
+
+context {
+  server = "ebin02.wks"
+  share = "/data/raid1-ssd/app-data/gitea-data"
+  mountPermissions = "0"  
+}
+
+mount_options {
+  fs_type = "nfs"
+  mount_flags = [ "timeo=30", "vers=3", "_netdev" , "nolock" ]
+}

apps/postgresql/live.hcl

@@ -0,0 +1,82 @@
+#To Configure vault
+# vault secrets enable database
+# vault write database/config/postgresql  plugin_name=postgresql-database-plugin   connection_url="postgresql://{{username}}:{{password}}@postgres.service.consul:5432/postgres?sslmode=disable"   allowed_roles="*"     username="root"     password="rootpassword"
+# vault write database/roles/readonly db_name=postgresql     creation_statements=@readonly.sql     default_ttl=1h max_ttl=24h
+
+job "postgres" {
+  datacenters = ["nummer5"]
+  type = "service"
+
+  group "service" {
+    count = 1
+    volume "postgres-data" {
+        type = "csi"
+        read_only = false
+        source = "postgresql"
+        access_mode = "single-node-writer"
+        attachment_mode = "file-system"
+    }
+    
+    task "postgres" {
+      driver = "podman"
+      config {
+        image = "docker.io/postgres:13"
+        network_mode = "host"
+        port_map {
+          db = 5432
+        }
+      }
+      volume_mount {
+        volume = "postgres-data"
+        destination = "/var/lib/postgresql/data"
+      }
+      env {
+          POSTGRES_USER="root"
+          POSTGRES_PASSWORD="pg2020"
+      }
+
+      logs {
+        max_files     = 5
+        max_file_size = 15
+      }
+      
+      resources {
+        cpu = 1000
+        memory = 1024
+        network {
+          mbits = 10
+          port  "db"  {
+            static = 5432
+          }
+        }
+      }
+      service {
+        name = "postgres"
+        tags = ["postgres for vault"]
+        port = "db"
+
+        check {
+          name     = "alive"
+          type     = "tcp"
+          interval = "60s"
+          timeout  = "2s"
+        }
+      }
+    }
+    restart {
+      attempts = 10
+      interval = "5m"
+      delay = "25s"
+      mode = "delay"
+    }
+
+  }
+
+  update {
+    max_parallel = 1
+    min_healthy_time = "5s"
+    healthy_deadline = "9m"
+    auto_revert = false
+    canary = 0
+  }
+}

apps/postgresql/volume.hcl

@@ -0,0 +1,21 @@
+type = "csi"
+id = "postgresql"
+name = "postgresql"
+plugin_id = "nfs"
+external_id = "psotgresql"
+
+capability {
+    access_mode = "single-node-writer"
+    attachment_mode = "file-system"
+}
+
+context {
+  server = "ebin01.wks"
+  share = "/data/raid1-ssd/app-data/postgres-data"
+  mountPermissions = "0"  
+}
+
+mount_options {
+  fs_type = "nfs"
+  mount_flags = [ "timeo=30", "vers=3", "_netdev" , "nolock" ]
+}

test/demo-webapp.hcl

@@ -0,0 +1,45 @@
+job "demo-webapp" {
+  datacenters = ["dc1"]
+  
+  group "demo" {
+    count = 3
+
+    network {
+      port  "http"{
+        to = -1
+      }
+    }
+
+    service {
+      name = "demo-webapp"
+      port = "http"
+
+      tags = [
+        "traefik.enable=true",
+        "#traefik.http.routers.http.rule=Path(`/myapp`)",
+        "traefik.http.routers.http.rule=Host(`test.lan`)",
+      ]
+
+      check {
+        type     = "http"
+        path     = "/"
+        interval = "2s"
+        timeout  = "2s"
+      }
+    }
+
+    task "server" {
+      env {
+        PORT    = "${NOMAD_PORT_http}"
+        NODE_IP = "${NOMAD_IP_http}"
+      }
+
+      driver = "podman"
+
+      config {
+        image = "docker.io/hashicorp/demo-webapp-lb-guide"
+        ports = ["http"]
+      }
+    }
+  }
+}

test/nfs-volume.hcl

@@ -0,0 +1,18 @@
+type = "csi"
+id = "test"
+name = "test"
+plugin_id = "nfsofficial"
+external_id = "testid"
+capability {
+    access_mode = "multi-node-multi-writer"
+    attachment_mode = "file-system"
+}
+context {
+  server = "192.168.10.3"
+  share = "/srv/pub/Music"
+  mountPermissions = "0"  
+}
+mount_options {
+  fs_type = "nfs"
+  mount_flags = [ "timeo=30", "intr", "vers=3", "_netdev" , "nolock" ]
+}

test/nginx-lb.hcl

@@ -0,0 +1,55 @@
+job "nginx" {
+  datacenters = ["dc1"]
+
+  group "nginx" {
+    count = 1
+
+    network {
+      port "http" {
+        static = 80
+      }
+    }
+
+    service {
+      name = "nginx"
+      port = "http"
+    }
+
+    task "nginx" {
+      driver = "podman"
+
+      config {
+        image = "docker.io/nginx"
+
+        ports = ["http"]
+
+        volumes = [
+          "local:/etc/nginx/conf.d",
+        ]
+      }
+
+      template {
+        data = <<EOF
+upstream backend {
+{{ range service "demo-webapp" }}
+  server {{ .Address }}:{{ .Port }};
+{{ else }}server 127.0.0.1:65535; # force a 502
+{{ end }}
+}
+
+server {
+   listen 80;
+
+   location / {
+      proxy_pass http://backend;
+   }
+}
+EOF
+
+        destination   = "local/load-balancer.conf"
+        change_mode   = "signal"
+        change_signal = "SIGHUP"
+      }
+    }
+  }
+}