openstack-infrastructure-terraform/modules/forgejo/forgejo.tf

#
# Forgejo (git service).
#
# One VM with two interfaces: the main private network, where the L7 load
# balancers reach it, and the dedicated network of the database. The
# repositories live on a volume of their own.
#
# forgejo terminates the TLS connection itself, with the certificate of the
# internal CA of the project: there is no nginx in front of it.
#

locals {
  # One rule per (load balancer, service port) pair
  forgejo_service_rules = {
    for pair in setproduct(var.haproxy_l7_ip, var.forgejo_data.service_ports) :
    "${pair[0]}-${pair[1]}" => { address = pair[0], port = pair[1] }
  }
}

#
# Traffic from the main L7 load balancers
#
resource "openstack_networking_secgroup_v2" "traffic_to_forgejo" {
  name                 = "traffic_to_forgejo_from_the_main_load_balancers"
  delete_default_rules = "true"
  description          = "Traffic from the main L7 HAPROXY load balancers to the forgejo service"
}

resource "openstack_networking_secgroup_rule_v2" "haproxy_to_forgejo" {
  for_each          = local.forgejo_service_rules
  security_group_id = openstack_networking_secgroup_v2.traffic_to_forgejo.id
  description       = "Traffic from the HAPROXY L7 ${each.value.address} to the port ${each.value.port}"
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = each.value.port
  port_range_max    = each.value.port
  remote_ip_prefix  = "${each.value.address}/32"
}

# Git over SSH. The public port 22 is a listener of the main load balancer, that
# forwards to the HAPROXY L7 instances; they in turn reach the builtin SSH server
# of forgejo on this port. The VM port 22 stays with sshd
resource "openstack_networking_secgroup_rule_v2" "haproxy_to_forgejo_ssh" {
  for_each          = toset(var.haproxy_l7_ip)
  security_group_id = openstack_networking_secgroup_v2.traffic_to_forgejo.id
  description       = "Git over SSH from the HAPROXY L7 ${each.value}"
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = var.forgejo_data.ssh_port
  port_range_max    = var.forgejo_data.ssh_port
  remote_ip_prefix  = "${each.value}/32"
}

#
# Data volume: the repositories and the attachments. Online resize enabled, like
# every other additional volume of the project
#
resource "openstack_blockstorage_volume_v3" "forgejo_data_vol" {
  name                 = var.forgejo_data.vol_data_name
  description          = "Forgejo repositories and attachments"
  size                 = var.forgejo_data.vol_data_size
  volume_type          = var.forgejo_data.volume_type
  enable_online_resize = true
}

#
# Ports, declared outside the instance
#
resource "openstack_networking_port_v2" "forgejo_main_port" {
  name           = "${var.forgejo_data.name}-main-port"
  description    = "Port of the forgejo service on the main private network"
  admin_state_up = true
  network_id     = var.main_private_network_id
  security_group_ids = [
    var.default_security_group_id,
    openstack_networking_secgroup_v2.traffic_to_forgejo.id,
  ]
  fixed_ip {
    subnet_id  = var.main_private_subnet_id
    ip_address = var.forgejo_main_ip
  }
}

resource "openstack_networking_port_v2" "forgejo_postgresql_port" {
  name               = "${var.forgejo_data.name}-postgresql-port"
  description        = "Port of the forgejo service on the dedicated network of the database"
  admin_state_up     = true
  network_id         = var.postgresql_network_id
  security_group_ids = [var.postgresql_client_security_group_id]
  # The address comes from the allocation pool of the dedicated subnet
  fixed_ip {
    subnet_id = var.postgresql_subnet_id
  }
}

#
# Instance
#
resource "openstack_compute_instance_v2" "forgejo" {
  name                    = var.forgejo_data.name
  availability_zone_hints = var.availability_zone
  flavor_name             = var.forgejo_data.flavor
  key_pair                = var.ssh_key_name

  block_device {
    uuid                  = var.image.uuid
    source_type           = "image"
    volume_size           = var.forgejo_data.boot_vol_size
    boot_index            = 0
    destination_type      = "volume"
    delete_on_termination = false
  }

  network {
    port = openstack_networking_port_v2.forgejo_main_port.id
  }

  network {
    port = openstack_networking_port_v2.forgejo_postgresql_port.id
  }

  user_data = file(var.image.user_data_file)

  # Do not replace the instance when the ssh key or the user data change
  lifecycle {
    ignore_changes = [
      key_pair, user_data, network
    ]
  }
}

resource "openstack_compute_volume_attach_v2" "forgejo_data_attach" {
  instance_id = openstack_compute_instance_v2.forgejo.id
  volume_id   = openstack_blockstorage_volume_v3.forgejo_data_vol.id
  device      = var.forgejo_data.vol_data_device
}

#
# A record on the main network address, so that the name can be used by the
# playbooks and by the load balancer configuration
#
resource "openstack_dns_recordset_v2" "forgejo_recordset" {
  zone_id     = var.dns_zone_id
  name        = "${var.forgejo_data.name}.${var.dns_zone_name}"
  description = "Address of the forgejo service on the main private network"
  ttl         = 8600
  type        = "A"
  records     = [var.forgejo_main_ip]
}

#
# Public name of the service, a CNAME of the main load balancer that publishes
# it. The other name, gitea-s2i2s.isti.cnr.it, belongs to the isti.cnr.it zone
# and is moved here by hand at the migration: it is not managed by tofu
#
resource "openstack_dns_recordset_v2" "git_recordset" {
  count       = length(var.forgejo_public_name) > 0 ? 1 : 0
  zone_id     = var.dns_zone_id
  name        = "${var.forgejo_public_name}.${var.dns_zone_name}"
  description = "Forgejo git service, published by the main load balancer"
  ttl         = 8600
  type        = "CNAME"
  records     = [var.forgejo_cname_target]
}