mirrors/khuedoan-homelab
1
0
Fork 0
mirror of https://github.com/khuedoan/homelab.git synced 2024-12-22 20:14:32 +07:00
Code Issues Packages Projects Releases Wiki Activity
cf94f761c4
khuedoan-homelab/external
History
Elliot Blackburn cf94f761c4
docs(external): add Terraform Cloud workspace instruction (#44) 
* Add note regarding terraform cloud execution mode

When configuring a workspace in Terraform Cloud, the execution mode defaults to "Remote". This is problematic for two reasons:
1. We use local files that are not in the terraform plan directory. This creates errors about being unable to local files where it is not immediately obvious why.
2. The remote (cloud) runner won't be able to access the kube cluster running on the internal network anyway, so any plan application will fail.

* Detail terraform cloud workspace setup
2022-02-15 08:32:29 +07:00
..
.gitignore fix(external): fix wrong provider name for B2 2021-12-09 01:23:04 +07:00
backblaze.tf chore: cleanup Backblaze secret keys 2021-12-25 21:58:23 +07:00
cert_manager.tf refactor(external): split Cloudflare into multiple files 2021-12-25 02:06:05 +07:00
cloudflare.tf refactor(external): ask to enter variables if var file does not exist 2021-12-25 02:34:49 +07:00
cloudflared.tf refactor(external): split Cloudflare into multiple files 2021-12-25 02:06:05 +07:00
external_dns.tf refactor(external): split Cloudflare into multiple files 2021-12-25 02:06:05 +07:00
Makefile refactor: inject Terraform secrets with Terraform 2021-12-29 22:51:36 +07:00
namespaces.yml feat(external): inject Backblaze secrets to k8up namespace 2021-12-25 20:18:45 +07:00
README.md docs(external): add Terraform Cloud workspace instruction (#44) 2022-02-15 08:32:29 +07:00
tekton.tf refactor: inject Terraform secrets with Terraform 2021-12-29 22:51:36 +07:00
terraform.tfvars.j2 refactor(external): ask to enter variables if var file does not exist 2021-12-25 02:34:49 +07:00
tfvars.yml style: format YAMLs to fix yamllint 2021-12-26 12:36:14 +07:00
variables.tf style(external): format 2021-12-25 02:50:18 +07:00
versions.tf chore(deps): update all non-major dependencies 2022-01-31 23:21:52 +07:00

README.md

External resources

WIP documents

These resources are optional, the homelab still works without them but will lack some features like trusted certificates and offsite backup

Although I try to keep the amount of external resources to the minimum, there's still need for a few of them. Below is a list of external resources and why we need them (also see some alternatives below).

  • Terraform Cloud:
    • Workspace to store the state for external resources
  • Cloudflare:
    • DNS
    • DNS-01 challenge for Let's Encrypt
    • Tunnel to public services to the internet without port-forwarding
  • Backblaze:
    • B2 storage with S3 compatible API for offsite backup

This layer will:

  • Create external resources
  • Add external secrets to namespaces

Prerequisites

Create Terraform workspace

Terraform is stateful, which means it needs somewhere to store it's state. The Terraform Cloud is one option for a state backend with a generous free tier perfect for a homelab.

  1. Sign up for a Terraform Cloud
  2. Create a workspace named homelab-external, this is the workspace where your homelab state will be stored.
  3. Change the "Execution Mode" from "Remote" to "Local". This will ensure your local machine, which can access your lab, is the one executing the terraform plan rather than the cloud runners.

If you decide to use a different terraform backend, you'll need to edit the external/versions.tf file as required.

Create Cloudflare API token

https://dash.cloudflare.com/profile/api-tokens

Terraform API token summary:

This API token will affect the below accounts and zones, along with their respective permissions

└── Khue Doan - Argo Tunnel:Edit, Account Settings:Read
    └── khuedoan.com - Zone:Read, DNS:Edit

Client IP Address Filtering

└── Is in - 117.xxx.xxx.xxx, 2402:xxx:xxx:xxx:xxx:xxx:xxx:xxx

Create Backblaze API key

https://secure.backblaze.com/app_keys.htm

Name of Key: Homelab
Allow access to Bucket(s): All
Type of Access: Read and Write

Deploy

Apply Terraform (you will be prompted to login to Terraform Cloud and enter API keys from the previous steps):

make

Alternatives

  • Terraform Cloud: any other Terraform backends
  • Cloudflare Tunnel: you can build a small VPS in the cloud and route traffic via it using Wireguard and HAProxy.
  • Backblaze B2: any S3 compatible object storage, such as S3 Glacier, Minio...