117 lines
3.7 KiB
HCL
117 lines
3.7 KiB
HCL
#
|
|
# Forgejo (git service).
|
|
#
|
|
# Sizing and service ports belong to the service, so they have defaults here.
|
|
# The address on the main private network does not: it is part of the address
|
|
# plan of the project, and it is passed in by the caller.
|
|
#
|
|
|
|
variable "forgejo_data" {
|
|
description = "Instance, volume and ports of the forgejo service. m1.xlarge is RAM 16 - VCPUs 8"
|
|
type = object({
|
|
name = optional(string, "forgejo")
|
|
description = optional(string, "Forgejo git service")
|
|
flavor = optional(string, "m1.xlarge")
|
|
boot_vol_size = optional(number, 20)
|
|
# Repositories and attachments
|
|
vol_data_name = optional(string, "forgejo-data")
|
|
vol_data_size = optional(number, 200)
|
|
vol_data_device = optional(string, "/dev/vdb")
|
|
volume_type = optional(string, "CephSSD")
|
|
# forgejo terminates the TLS connection itself, with the certificate that
|
|
# os-bootstrap gets from the internal CA: no nginx in front of it. 3000 is
|
|
# its default port, so it does not need to bind a privileged one
|
|
service_ports = optional(list(number), [3000])
|
|
# Builtin SSH server. It cannot be the port 22 of the VM, which belongs to
|
|
# sshd, so git over SSH is published on the port 22 of the load balancer and
|
|
# forwarded here
|
|
ssh_port = optional(number, 2222)
|
|
})
|
|
default = {}
|
|
}
|
|
|
|
# Part of the address plan of the project: no default on purpose
|
|
variable "forgejo_main_ip" {
|
|
type = string
|
|
description = "Address of the instance on the main private network"
|
|
}
|
|
|
|
# Data that comes from the network/DNS and project setup workspaces
|
|
variable "main_private_network_id" {
|
|
type = string
|
|
description = "ID of the main private network of the project"
|
|
}
|
|
|
|
variable "main_private_subnet_id" {
|
|
type = string
|
|
description = "ID of the main private subnet of the project"
|
|
}
|
|
|
|
variable "default_security_group_id" {
|
|
type = string
|
|
description = "ID of the 'default_for_all' security group of the project"
|
|
}
|
|
|
|
variable "haproxy_l7_ip" {
|
|
type = list(string)
|
|
description = "Addresses of the L7 HAPROXY load balancers, the only ones allowed to reach the service"
|
|
}
|
|
|
|
# Data that comes from the postgresql workspace
|
|
variable "postgresql_network_id" {
|
|
type = string
|
|
description = "ID of the dedicated network of the PostgreSQL service"
|
|
}
|
|
|
|
variable "postgresql_subnet_id" {
|
|
type = string
|
|
description = "ID of the dedicated subnet of the PostgreSQL service"
|
|
}
|
|
|
|
variable "postgresql_client_security_group_id" {
|
|
type = string
|
|
description = "Security group that allows the connections to the PostgreSQL service"
|
|
}
|
|
|
|
variable "availability_zone" {
|
|
type = string
|
|
description = "Availability zone hint of the instance"
|
|
}
|
|
|
|
variable "image" {
|
|
description = "Image of the instance: uuid and cloud-init user data file"
|
|
type = object({
|
|
uuid = string
|
|
user_data_file = string
|
|
})
|
|
}
|
|
|
|
variable "ssh_key_name" {
|
|
type = string
|
|
description = "Name of the SSH key pair injected by cloud-init"
|
|
}
|
|
|
|
# DNS. The A record on the main network address is always created; the public
|
|
# name is a CNAME of the load balancer that publishes the service
|
|
variable "dns_zone_id" {
|
|
type = string
|
|
description = "ID of the DNS zone of the project"
|
|
}
|
|
|
|
variable "dns_zone_name" {
|
|
type = string
|
|
description = "Name of the DNS zone of the project, with the trailing dot"
|
|
}
|
|
|
|
variable "forgejo_public_name" {
|
|
type = string
|
|
default = "git"
|
|
description = "Left part of the public name, a CNAME of the load balancer. Empty means no record"
|
|
}
|
|
|
|
variable "forgejo_cname_target" {
|
|
type = string
|
|
default = ""
|
|
description = "Target of the CNAME, usually the name of the main load balancer, with the trailing dot"
|
|
}
|