dotfiles/terranix/main/containers/hydra/job.hcl
magic_rb 4a29b6d8d3
Move terranix config into terranix/main
Signed-off-by: magic_rb <magic_rb@redalder.org>
2024-04-07 10:45:07 +02:00

202 lines
4 KiB
HCL

variable "flake_ref" {
type = string
}
variable "flake_sha" {
type = string
}
variable "store_path" {
type = object({
hydra = string
postgresql = string
})
}
job "hydra" {
datacenters = [ "homelab-1" ]
type = "service"
constraint {
attribute = "${attr.unique.hostname}"
value = "blowhole"
}
group "svc" {
count = 1
volume "hydra-data" {
type = "csi"
source = "hydra-data"
read_only = false
attachment_mode = "file-system"
access_mode = "single-node-writer"
}
volume "hydra-nix" {
type = "host"
read_only = false
source = "jellyfin-media"
}
volume "hydra-db" {
type = "csi"
source = "hydra-db"
read_only = false
attachment_mode = "file-system"
access_mode = "single-node-writer"
}
restart {
attempts = 5
delay = "5s"
}
network {
mode = "bridge"
}
service {
name = "hydra"
port = "3000"
check {
type = "http"
address_mode = "alloc"
path = "/"
port = "3000"
interval = "2s"
timeout = "2s"
}
connect {
sidecar_service {}
}
}
task "hydra" {
driver = "docker"
volume_mount {
volume = "hydra-data"
destination = "/var/lib/hydra"
read_only = false
}
volume_mount {
volume = "hydra-nix"
destination = "/nix-persist"
read_only = false
}
config {
nix_flake_ref = "${var.flake_ref}#nixngConfigurations.hydra.config.system.build.toplevel"
nix_flake_sha = var.flake_sha
nix_flake_store_path = var.store_path.hydra
entrypoint = [ "init" ]
devices = [
{
host_path = "/dev/fuse"
container_path = "/dev/fuse"
}
]
privileged = true
}
vault {
policies = ["hydra-policy"]
}
resources {
cpu = 4000
memory = 4096
memory_max = 8096
}
template {
data = <<EOF
{{ with secret "kv/data/cluster/hydra" }}{{ .Data.data.nixbuild_key }}{{ end }}
EOF
destination = "secrets/ssh-key"
perms = "400"
}
template {
data = <<EOF
dbi:Pg:dbname=hydra;host=127.0.0.1;port=5432;user=hydra;
EOF
destination = "local/dbi"
}
template {
data = <<EOF
127.0.0.1:*:*:hydra:{{ with secret "kv/data/cluster/hydra" }}{{ .Data.data.pgpass }}{{ end }}
EOF
destination = "secrets/pgpass"
perms = "400"
}
template {
data = <<EOF
127.0.0.1:*:*:hydra:{{ with secret "kv/data/cluster/hydra" }}{{ .Data.data.pgpass }}{{ end }}
EOF
destination = "secrets/pgpass-www"
perms = "400"
}
template {
data = <<EOF
127.0.0.1:*:*:hydra:{{ with secret "kv/data/cluster/hydra" }}{{ .Data.data.pgpass }}{{ end }}
EOF
destination = "secrets/pgpass-queue-runner"
perms = "400"
}
template {
data = <<EOF
{{ with secret "kv/data/cluster/hydra" }}{{ .Data.data.nix_signing_key }}{{ end }}
EOF
destination = "secrets/nix-key.private"
perms = "400"
}
}
task "postgresql" {
driver = "docker"
volume_mount {
volume = "hydra-db"
destination = "/var/lib/postgresql"
read_only = false
}
config {
nix_flake_ref = "${var.flake_ref}#nixngConfigurations.hydraPostgreSQL.config.system.build.toplevel"
nix_flake_sha = var.flake_sha
nix_flake_store_path = var.store_path.postgresql
entrypoint = [ "init" ]
}
resources {
cpu = 500
memory = 1024
memory_max = 1024
}
template {
data = <<EOF
alter user hydra with encrypted password '{{ with secret "kv/data/cluster/hydra" }}{{ .Data.data.pgpass }}{{ end }}';
EOF
destination = "secrets/init.sql"
}
vault {
policies = ["hydra-policy"]
}
}
}
}