Upgrade trunk

.gitignore

@@ -4,4 +4,3 @@
 /terraform.tfstate*
 /.terraform.tfstate*
 /.github/cache
-/terraform.tfvars

.trunk/trunk.yaml

@@ -24,13 +24,13 @@ lint:
     - checkov
   enabled:
     - hadolint@2.12.0
-    - tflint@0.52.0
+    - tflint@0.51.2
     - gitleaks@8.18.4
     - markdownlint@0.41.0
-    - taplo@0.9.2
+    - taplo@0.8.1
     - actionlint@1.7.1
     - git-diff-check
-    - prettier@3.3.3
+    - prettier@3.3.2
     - yamllint@1.35.1
   definitions:
     - name: markdownlint
@@ -49,12 +49,12 @@ tools:
     - gh@2.49.2
     - jq@jq-1.7.1
     - yq@4.44.1
-    - awscli@1.33.26
+    - awscli@1.33.22
     - action-validator@0.6.0
     - act@0.2.64
     - shellcheck@0.10.0
     - hadolint@2.12.0
     - tofu@1.7.2
     - trunk-toolbox@0.3.2
-    - tflint@0.52.0
+    - tflint@0.51.2
     - terraform@1.9.0

docker.tf

@@ -1,28 +1,33 @@
+/*provider "ssh" {
+  server = {
+    host = "california.ti"
+    port = 22
+  }
+  user = "techinc"
+  auth = {
+    private_key = {
+      content = file("~/.ssh/keys/exploding_bolts_2_rsa")
+    }
+  }
+}
+data "ssh_tunnel" "docker" {
+  connection_name = "docker_socket_tunnel_california"
+  remote = {
+    socket = "/var/run/docker.sock"
+  }
+}
+*/
+
 provider "docker" {
   host = "ssh://california.ti"
-  registry_auth {
-    address  = "docker.io"
-    username = "matthewbaggett"
-    password = "dckr_pat_6ytcZqdfqRXzFYe5GUh79RfH1Hw"
-  }
 }
 
 provider "docker" {
   alias = "printi"
   host  = "ssh://prin.ti"
-  registry_auth {
-    address  = "docker.io"
-    username = "matthewbaggett"
-    password = "dckr_pat_6ytcZqdfqRXzFYe5GUh79RfH1Hw"
-  }
 }
 
 provider "docker" {
   alias = "unifi"
   host  = "ssh://unifi.ti"
-  registry_auth {
-    address  = "docker.io"
-    username = "matthewbaggett"
-    password = "dckr_pat_6ytcZqdfqRXzFYe5GUh79RfH1Hw"
-  }
 }

minio.tf

@@ -4,5 +4,4 @@ module "minio" {
   network        = docker_network.loadbalancer
   storage_path   = "/media/storage/minio"
   admin_username = "techinc"
-  expose_ports   = true
 }

modules/minio/inputs.tf

@@ -18,8 +18,3 @@ variable "storage_path" {
   type        = string
   description = "The path to the storage directory to use"
 }
-variable "expose_ports" {
-  type        = bool
-  description = "Expose the minio ports to the outside world"
-  default     = false
-}

modules/minio/minio.tf

@@ -49,21 +49,6 @@ resource "docker_service" "minio" {
     parallelism = 1
     order       = "stop-first"
   }
-  dynamic "endpoint_spec" {
-    for_each = var.expose_ports ? toset(["aw yis"]) : toset([])
-    content {
-      ports {
-        target_port    = 9000
-        published_port = 9000
-        publish_mode   = "ingress"
-      }
-      ports {
-        target_port    = 9001
-        published_port = 9001
-        publish_mode   = "ingress"
-      }
-    }
-  }
 }
 
 module "minio_nginx_config" {

modules/vigil/configuration.tf

@@ -20,9 +20,6 @@ locals {
     support_url    = var.support_url
     custom_html    = var.custom_html
     services       = local.services_toml
-    startup_notification = var.notify_on_startup
-    telegram_bot_token   = var.notify_telegram.token
-    telegram_chat_id     = var.notify_telegram.channel
   })
   vigil_toml_checksum = md5(local.vigil_toml)
 }

modules/vigil/inputs.tf

@@ -16,20 +16,7 @@ variable "docker_networks" {
   description = "Docker networks to connect the vigil service to"
   default     = null
 }
-variable "notify_on_startup" {
+
-  type        = bool
-  description = "Whether to send a startup notifications"
-  default     = false
-}
-variable "notify_telegram" {
-  type = object({
-    token   = string
-    channel = string
-    topic = optional(string, null)
-  })
-  description = "Telegram configuration"
-  default     = null
-}
 variable "monitored_services" {
   type = map(list(object({
     id          = string
@@ -39,6 +26,7 @@ variable "monitored_services" {
     http_status_healthy_below = optional(number, 400)
     http_status_healthy_above = optional(number, 200)
   })))
+
 }
 variable "page_title" {
   type        = string

modules/vigil/vigil.toml.tpl

@@ -54,14 +54,14 @@ queue_nack_dead_above = 5000
 queue_loaded_retry_delay = 500
 
 [notify]
-startup_notification = ${startup_notification}
+startup_notification = false
 reminder_interval = 600
 reminder_backoff_function = "linear"
 reminder_backoff_limit = 3
 
-[notify.telegram]
+#[notify.telegram]
-bot_token = "${telegram_bot_token}"
+#bot_token = "xxxxxxxxxx:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
-chat_id = "${telegram_chat_id}"
+#chat_id = "xxxxxxxxx"
 
 [probe]
 

netbox.tf

@@ -1,20 +1,17 @@
 # Docker images in use
 data "docker_registry_image" "netbox" {
-  name = "netboxcommunity/netbox:v4.0-2.9.1"
+  name = "docker.io/netboxcommunity/netbox:v4.0-2.9.1"
 }
 data "docker_registry_image" "netbox_postgres" {
-  name = "postgres:16-alpine"
+  name = "docker.io/postgres:16-alpine"
 }
 data "docker_registry_image" "netbox_redis" {
-  name = "redis:7-alpine"
+  name = "docker.io/redis:7-alpine"
 }
 
 # Docker Network
 resource "docker_network" "netbox" {
   name = "netbox"
-  driver      = "overlay"
-  attachable  = true
-  ipam_driver = "default"
 }
 
 # Docker Volumes
@@ -49,16 +46,7 @@ resource "random_password" "redis_password" {
   length = 32
   special = false
 }
-resource "random_password" "redis_cache_password" {
-  length  = 32
-  special = false
-}
-resource "random_password" "secret_key" {
-  length  = 50
-  special = false
-}
 locals {
-  netbox_conf = {
   CORS_ORIGIN_ALLOW_ALL = true
 
   DB_HOST=docker_service.netbox_postgres.name
@@ -75,31 +63,30 @@ locals {
   EMAIL_TIMEOUT=5
   EMAIL_USERNAME="netbox"
   # EMAIL_USE_SSL and EMAIL_USE_TLS are mutually exclusive, i.e. they can't both be `true`!
-    EMAIL_USE_SSL = "false"
+  EMAIL_USE_SSL=false
-    EMAIL_USE_TLS = "false"
+  EMAIL_USE_TLS=false
 
-    GRAPHQL_ENABLED       = "true"
+  GRAPHQL_ENABLED=true
   HOUSEKEEPING_INTERVAL=86400
   MEDIA_ROOT="/opt/netbox/netbox/media"
-    METRICS_ENABLED       = "false"
+  METRICS_ENABLED=false
-
-    REDIS_DATABASE                 = 0
-    REDIS_HOST                     = docker_service.netbox_redis.name
-    REDIS_INSECURE_SKIP_TLS_VERIFY = "false"
-    //REDIS_PASSWORD                 = nonsensitive(random_password.redis_password.result)
-    REDIS_SSL = "false"
 
   REDIS_CACHE_DATABASE=1
   REDIS_CACHE_HOST=docker_service.netbox_redis_cache.name
-    REDIS_CACHE_INSECURE_SKIP_TLS_VERIFY = "false"
+  REDIS_CACHE_INSECURE_SKIP_TLS_VERIFY=false
-    //REDIS_CACHE_PASSWORD                 = nonsensitive(random_password.redis_cache_password.result)
+  REDIS_CACHE_PASSWORD=nonsensitive(random_password.redis_password.result)
-    REDIS_CACHE_SSL = "false"
+  REDIS_CACHE_SSL=false
+
+  REDIS_DATABASE=0
+  REDIS_HOST=docker_service.netbox_redis.name
+  REDIS_INSECURE_SKIP_TLS_VERIFY=false
+  REDIS_PASSWORD=nonsensitive(random_password.redis_password.result)
+  REDIS_SSL=false
 
   RELEASE_CHECK_URL="https://api.github.com/repos/netbox-community/netbox/releases"
-    SECRET_KEY        = nonsensitive(random_password.secret_key.result)
+  SECRET_KEY="r(m)9nLGnz$(_q3N4z1k(EFsMCjjjzx08x9VhNVcfd%6RF#r!6DE@+V5Zk2X"
-    SKIP_SUPERUSER    = "true"
+  SKIP_SUPERUSER=true
-    WEBHOOKS_ENABLED  = "true"
+  WEBHOOKS_ENABLED=true
-  }
 }
 
 # Services
@@ -109,12 +96,11 @@ resource "docker_service" "netbox" {
     container_spec {
       image = "${data.docker_registry_image.netbox.name}@${data.docker_registry_image.netbox.sha256_digest}"
       user = "unit:root"
-      env   = local.netbox_conf
       healthcheck {
         test = ["CMD-SHELL", "curl -f http://localhost:8080/login/ || exit 1"]
         interval = "15s"
         timeout = "3s"
-        start_period = "2m"
+        start_period = "60s"
       }
       mounts {
         target = "/etc/netbox/config"
@@ -149,21 +135,6 @@ resource "docker_service" "netbox" {
       window    = "0s"
     }
   }
-  endpoint_spec {
-    ports {
-      protocol     = "tcp"
-      publish_mode = "ingress"
-      target_port  = 8080
-    }
-  }
-  converge_config {
-    timeout = "2m"
-  }
-  depends_on = [
-    docker_service.netbox_postgres,
-    docker_service.netbox_redis,
-    docker_service.netbox_redis_cache,
-  ]
 }
 resource "docker_service" "netbox_worker" {
   name = "netbox-worker"
@@ -171,7 +142,6 @@ resource "docker_service" "netbox_worker" {
     container_spec {
       image = "${data.docker_registry_image.netbox.name}@${data.docker_registry_image.netbox.sha256_digest}"
       user = "unit:root"
-      env     = local.netbox_conf
       command = ["/opt/netbox/venv/bin/python", "/opt/netbox/netbox/manage.py", "rqworker",]
       healthcheck {
         test = ["CMD-SHELL", "ps -aux | grep -v grep | grep -q rqworker || exit 1"]
@@ -209,12 +179,6 @@ resource "docker_service" "netbox_worker" {
       window    = "0s"
     }
   }
-  converge_config {
-    timeout = "2m"
-  }
-  depends_on = [
-    docker_service.netbox
-  ]
 }
 resource "docker_service" "netbox_housekeeping" {
   name = "netbox-housekeeping"
@@ -222,7 +186,6 @@ resource "docker_service" "netbox_housekeeping" {
     container_spec {
       image = "${data.docker_registry_image.netbox.name}@${data.docker_registry_image.netbox.sha256_digest}"
       user = "unit:root"
-      env     = local.netbox_conf
       command = ["/opt/netbox/housekeeping.sh",]
       healthcheck {
         test = ["CMD-SHELL", "ps -aux | grep -v grep | grep -q housekeeping || exit 1"]
@@ -260,12 +223,6 @@ resource "docker_service" "netbox_housekeeping" {
       window    = "0s"
     }
   }
-  converge_config {
-    timeout = "2m"
-  }
-  depends_on = [
-    docker_service.netbox
-  ]
 }
 
 # Netbox Postgres Database
@@ -283,6 +240,7 @@ resource "docker_service" "netbox_postgres" {
         POSTGRES_DB       = "netbox"
         POSTGRES_USER     = "netbox"
         POSTGRES_PASSWORD = random_password.postgres_password.result
+
       }
     }
     networks_advanced {
@@ -294,9 +252,6 @@ resource "docker_service" "netbox_postgres" {
       window    = "0s"
     }
   }
-  converge_config {
-    timeout = "2m"
-  }
 }
 
 # Netbox Redis
@@ -305,21 +260,11 @@ resource "docker_service" "netbox_redis" {
   task_spec {
     container_spec {
       image = "${data.docker_registry_image.netbox_redis.name}@${data.docker_registry_image.netbox_redis.sha256_digest}"
-      command = [
+      command = ["sh", "-c", "redis-server","--appendonly","yes", "--requirepass", random_password.redis_password.result, ]
-        "sh", "-c",
-        "redis-server",
-        "--appendonly", "yes",
-        //"--requirepass", nonsensitive(random_password.redis_password.result),
-      ]
       mounts {
         target = "/data"
         type   = "volume"
-        source = docker_volume.netbox_redis.name
+        source = docker_volume.netbox_database.name
-      }
-      healthcheck {
-        test     = ["CMD", "sh", "-c", "redis-cli", "PING"]
-        interval = "5s"
-        timeout  = "3s"
       }
     }
     networks_advanced {
@@ -331,29 +276,17 @@ resource "docker_service" "netbox_redis" {
       window    = "0s"
     }
   }
-  converge_config {
-    timeout = "2m"
-  }
 }
 resource "docker_service" "netbox_redis_cache" {
   name = "netbox-redis-cache"
   task_spec {
     container_spec {
       image = "${data.docker_registry_image.netbox_redis.name}@${data.docker_registry_image.netbox_redis.sha256_digest}"
-      command = [
+      command = ["sh", "-c", "redis-server", "--requirepass", random_password.redis_password.result, ]
-        "sh", "-c",
-        "redis-server",
-        //"--requirepass", nonsensitive(random_password.redis_cache_password.result),
-      ]
       mounts {
         target = "/data"
         type   = "volume"
-        source = docker_volume.netbox_cache.name
+        source = docker_volume.netbox_database.name
-      }
-      healthcheck {
-        test     = ["CMD", "sh", "-c", "redis-cli", "PING"]
-        interval = "5s"
-        timeout  = "3s"
       }
     }
     networks_advanced {
@@ -365,23 +298,4 @@ resource "docker_service" "netbox_redis_cache" {
       window    = "0s"
     }
   }
-  converge_config {
-    timeout = "2m"
-  }
-}
-
-# Set up some nginx bits for it
-module "netbox_nginx_config" {
-  # tflint-ignore: terraform_module_pinned_source
-  source   = "git::https://code.techinc.nl/grey/terraform-nginx.git//nginx-site-available"
-  hostname = "netbox.california.ti"
-  //certificate   = acme_certificate.ooo_grey["s3"]
-  service_name  = docker_service.netbox.name
-  upstream_host = "${docker_service.netbox.name}:8080"
-  config_prefix = "nginx"
-  allow_non_ssl = true
-  allow_ssl     = false
-  depends_on = [
-    docker_service.netbox
-  ]
 }

nginx.tf

@@ -17,10 +17,9 @@ module "nginx" {
     module.minio.nginx_files,
     module.vigil_nginx_config.files,
     module.videobucket_nginx_config.files,
-    //module.netbox_nginx_config.files,
   )
   networks = [
     docker_network.loadbalancer,
   ]
-  replicas = 2
+  replicas = 1
 }

printers.tf

@@ -17,7 +17,8 @@ resource "scratch_string" "arse" {
 }
 
 resource "docker_container" "ender5plus" {
-  image    = docker_image.octoprint.image_id
+  image    = "${docker_image.octoprint.name}:latest"
+  #image = docker_image.octoprint.image_id
   provider = docker.printi
   name     = "ender5plus"
   env = [

terraform.tf

@@ -1,6 +1,5 @@
 terraform {
   required_version = "~> 1.6"
-
   required_providers {
     docker = {
       source  = "kreuzwerker/docker"
@@ -19,20 +18,4 @@ terraform {
       version = "0.4.0"
     }
   }
-
-  backend "s3" {
-    bucket                   = "terraform"
-    key                      = "ti-iac.tfstate"
-    profile                  = "techinc-tf"
-    shared_credentials_files = ["~/.aws/credentials"]
-    endpoints = {
-      s3 = "http://california.ti:9000"
-    }
-    region                      = "main" # Region validation will be skipped
-    skip_credentials_validation = true   # Skip AWS related checks and validations
-    skip_requesting_account_id  = true
-    skip_metadata_api_check     = true
-    skip_region_validation      = true
-    use_path_style              = true # Enable path-style S3 URLs (https://<HOST>/<BUCKET> https://developer.hashicorp.com/terraform/language/settings/backends/s3#use_path_style
-  }
 }

ubiquity.tf

@@ -53,36 +53,6 @@ resource "docker_service" "unifi_controller" {
   }
 }
 
-resource "docker_service" "unifi_controller_restored_from_backup" {
-  name     = "unifi_controller_restored_from_backup"
-  provider = docker.unifi
-  task_spec {
-    container_spec {
-      image = "${data.docker_registry_image.unifi_controller.name}@${data.docker_registry_image.unifi_controller.sha256_digest}"
-      env = {
-        TZ = "Europe/Amsterdam"
-      }
-      mounts {
-        target = "/unifi"
-        source = "/home/techinc/unifi_restored_from_backup"
-        type   = "bind"
-      }
-    }
-    restart_policy {
-      condition = "any"
-      delay     = "0s"
-      window    = "0s"
-    }
-  }
-  endpoint_spec {
-    ports {
-      target_port    = 443
-      published_port = 444
-      publish_mode   = "ingress"
-    }
-  }
-}
-
 data "docker_registry_image" "http2https" {
   name = "articulate/http-to-https"
 }

video-bucket.tf

@@ -33,10 +33,6 @@ EOF
 resource "docker_config" "video_bucket_config" {
   name = "video_bucket_config_${substr(md5(local.video_bucket_config),0,7)}"
   data = base64encode(local.video_bucket_config)
-  lifecycle {
-    ignore_changes        = [name]
-    create_before_destroy = true
-  }
 }
 module "videobucket_nginx_config" {
   # tflint-ignore: terraform_module_pinned_source

vigil.tf

@@ -9,15 +9,7 @@ module "vigil_nginx_config" {
   allow_non_ssl = true
   allow_ssl     = false
 }
-variable "telegram_token" {
+
-  type = string
-}
-variable "telegram_channel" {
-  type = string
-}
-variable "telegram_topic" {
-  type = string
-}
 module "vigil" {
   source = "./modules/vigil"
   monitored_services = {
@@ -61,7 +53,7 @@ module "vigil" {
         id    = "backup"
         label = "Backup Server"
         endpoints = [
-          #"icmp://backup.ti", # ??? Doesn't work?
+          "icmp://backup.ti",
           "tcp://backup.ti:22",
           "http://backup.ti",
         ]
@@ -81,25 +73,24 @@ module "vigil" {
         id    = "unifi-ap-mainspace"
         label = "Unifi AP Mainspace"
         endpoints = [
-          # "icmp://mainspace-ap.ti", # Painfully, ICMP said it was up when it was infact entirely unplugged. No ICMP for you.
+          "icmp://mainspace-ap.ti",
-          "tcp://mainspace-ap.ti:22",
         ]
       },
       {
         id    = "unifi-ap-auxspace"
         label = "Unifi AP Auxspace"
         endpoints = [
-          # "icmp://auxspace-ap.ti", # Painfully, ICMP said it was up when it was infact entirely unplugged. No ICMP for you.
+          "icmp://auxspace-ap.ti",
-          "tcp://auxspace-ap.ti:22",
-        ]
-      },
-      {
-        id    = "unifi-ap-toilets"
-        label = "Unifi AP Hallway/Toilets"
-        endpoints = [
-          "icmp://toilet-ap.ti",
         ]
       },
+      #{
+      #  id = "unifi-ap-hallway"
+      #  label = "Unifi AP Hallway"
+      #  endpoints = [
+      #    "icmp://hallway-ap.ti",
+      #  ]
+      #},
+
     ]
     "Printers" = [
       {
@@ -144,9 +135,9 @@ module "vigil" {
         id    = "ansible"
         label = "TechInc Ansible Server"
         endpoints = [
-          #"icmp://ansible.ti", # Doesn't work?
+          "icmp://ansible.ti",
           "tcp://ansible.ti:22",
-          #"http://ansible.ti", # Doesn't work?
+          "http://ansible.ti"
         ]
         http_method = "GET"
       },
@@ -165,7 +156,7 @@ module "vigil" {
         endpoints = [
           #"icmp://shardik.ti", # Doesn't work?
           "tcp://shardik.ti:22",
-          "http://shardik.ti",
+          "http://shardik.ti"
         ]
         http_method = "GET"
       },
@@ -173,8 +164,8 @@ module "vigil" {
         id    = "sip"
         label = "SIP"
         endpoints = [
-          #"icmp://sip.ti", # Doesn't work?
+          "icmp://sip.ti",
-          "http://sip.ti",
+          "http://sip.ti"
         ]
         http_method = "GET"
       },
@@ -212,10 +203,4 @@ module "vigil" {
   docker_networks = [
     docker_network.loadbalancer
   ]
-  notify_on_startup = true
-  notify_telegram = {
-    token   = var.telegram_token
-    channel = var.telegram_channel
-    topic = var.telegram_topic
-  }
 }