mirror of
https://git.sr.ht/~magic_rb/dotfiles
synced 2024-12-04 22:14:58 +01:00
4a29b6d8d3
Signed-off-by: magic_rb <magic_rb@redalder.org>
202 lines
4 KiB
HCL
202 lines
4 KiB
HCL
variable "flake_ref" {
|
|
type = string
|
|
}
|
|
|
|
variable "flake_sha" {
|
|
type = string
|
|
}
|
|
|
|
variable "store_path" {
|
|
type = object({
|
|
hydra = string
|
|
postgresql = string
|
|
})
|
|
}
|
|
|
|
|
|
job "hydra" {
|
|
datacenters = [ "homelab-1" ]
|
|
type = "service"
|
|
|
|
constraint {
|
|
attribute = "${attr.unique.hostname}"
|
|
value = "blowhole"
|
|
}
|
|
|
|
group "svc" {
|
|
count = 1
|
|
|
|
volume "hydra-data" {
|
|
type = "csi"
|
|
source = "hydra-data"
|
|
read_only = false
|
|
|
|
attachment_mode = "file-system"
|
|
access_mode = "single-node-writer"
|
|
}
|
|
|
|
volume "hydra-nix" {
|
|
type = "host"
|
|
read_only = false
|
|
source = "jellyfin-media"
|
|
}
|
|
|
|
volume "hydra-db" {
|
|
type = "csi"
|
|
source = "hydra-db"
|
|
read_only = false
|
|
|
|
attachment_mode = "file-system"
|
|
access_mode = "single-node-writer"
|
|
}
|
|
|
|
restart {
|
|
attempts = 5
|
|
delay = "5s"
|
|
}
|
|
|
|
network {
|
|
mode = "bridge"
|
|
}
|
|
|
|
service {
|
|
name = "hydra"
|
|
port = "3000"
|
|
|
|
check {
|
|
type = "http"
|
|
address_mode = "alloc"
|
|
path = "/"
|
|
port = "3000"
|
|
interval = "2s"
|
|
timeout = "2s"
|
|
}
|
|
|
|
connect {
|
|
sidecar_service {}
|
|
}
|
|
}
|
|
|
|
task "hydra" {
|
|
driver = "docker"
|
|
|
|
volume_mount {
|
|
volume = "hydra-data"
|
|
destination = "/var/lib/hydra"
|
|
read_only = false
|
|
}
|
|
|
|
volume_mount {
|
|
volume = "hydra-nix"
|
|
destination = "/nix-persist"
|
|
read_only = false
|
|
}
|
|
|
|
config {
|
|
nix_flake_ref = "${var.flake_ref}#nixngConfigurations.hydra.config.system.build.toplevel"
|
|
nix_flake_sha = var.flake_sha
|
|
nix_flake_store_path = var.store_path.hydra
|
|
entrypoint = [ "init" ]
|
|
|
|
devices = [
|
|
{
|
|
host_path = "/dev/fuse"
|
|
container_path = "/dev/fuse"
|
|
}
|
|
]
|
|
privileged = true
|
|
}
|
|
|
|
vault {
|
|
policies = ["hydra-policy"]
|
|
}
|
|
|
|
resources {
|
|
cpu = 4000
|
|
memory = 4096
|
|
memory_max = 8096
|
|
}
|
|
|
|
template {
|
|
data = <<EOF
|
|
{{ with secret "kv/data/cluster/hydra" }}{{ .Data.data.nixbuild_key }}{{ end }}
|
|
EOF
|
|
destination = "secrets/ssh-key"
|
|
perms = "400"
|
|
}
|
|
|
|
template {
|
|
data = <<EOF
|
|
dbi:Pg:dbname=hydra;host=127.0.0.1;port=5432;user=hydra;
|
|
EOF
|
|
destination = "local/dbi"
|
|
}
|
|
|
|
template {
|
|
data = <<EOF
|
|
127.0.0.1:*:*:hydra:{{ with secret "kv/data/cluster/hydra" }}{{ .Data.data.pgpass }}{{ end }}
|
|
EOF
|
|
destination = "secrets/pgpass"
|
|
perms = "400"
|
|
}
|
|
|
|
template {
|
|
data = <<EOF
|
|
127.0.0.1:*:*:hydra:{{ with secret "kv/data/cluster/hydra" }}{{ .Data.data.pgpass }}{{ end }}
|
|
EOF
|
|
destination = "secrets/pgpass-www"
|
|
perms = "400"
|
|
}
|
|
|
|
template {
|
|
data = <<EOF
|
|
127.0.0.1:*:*:hydra:{{ with secret "kv/data/cluster/hydra" }}{{ .Data.data.pgpass }}{{ end }}
|
|
EOF
|
|
destination = "secrets/pgpass-queue-runner"
|
|
perms = "400"
|
|
}
|
|
|
|
template {
|
|
data = <<EOF
|
|
{{ with secret "kv/data/cluster/hydra" }}{{ .Data.data.nix_signing_key }}{{ end }}
|
|
EOF
|
|
destination = "secrets/nix-key.private"
|
|
perms = "400"
|
|
}
|
|
}
|
|
|
|
task "postgresql" {
|
|
driver = "docker"
|
|
|
|
volume_mount {
|
|
volume = "hydra-db"
|
|
destination = "/var/lib/postgresql"
|
|
read_only = false
|
|
}
|
|
|
|
config {
|
|
nix_flake_ref = "${var.flake_ref}#nixngConfigurations.hydraPostgreSQL.config.system.build.toplevel"
|
|
nix_flake_sha = var.flake_sha
|
|
nix_flake_store_path = var.store_path.postgresql
|
|
entrypoint = [ "init" ]
|
|
}
|
|
|
|
resources {
|
|
cpu = 500
|
|
memory = 1024
|
|
memory_max = 1024
|
|
}
|
|
|
|
template {
|
|
data = <<EOF
|
|
alter user hydra with encrypted password '{{ with secret "kv/data/cluster/hydra" }}{{ .Data.data.pgpass }}{{ end }}';
|
|
EOF
|
|
destination = "secrets/init.sql"
|
|
}
|
|
|
|
vault {
|
|
policies = ["hydra-policy"]
|
|
}
|
|
}
|
|
}
|
|
}
|