Clean repository: organized structure and GitOps setup
- Organized root directory structure - Moved orphan files to proper locations - Updated .gitignore to ignore temporary files - Set up Gitea Runner for GitOps automation - Fixed Tailscale access issues - Added workflow for automated Nomad deployment
This commit is contained in:
212
nomad-jobs/consul-cluster/consul-cluster.nomad
Normal file
212
nomad-jobs/consul-cluster/consul-cluster.nomad
Normal file
@@ -0,0 +1,212 @@
|
||||
job "consul-cluster-nomad" {
|
||||
datacenters = ["dc1"]
|
||||
type = "service"
|
||||
|
||||
group "consul-ch4" {
|
||||
constraint {
|
||||
attribute = "${node.unique.name}"
|
||||
value = "ch4"
|
||||
}
|
||||
|
||||
network {
|
||||
port "http" {
|
||||
static = 8500
|
||||
}
|
||||
port "server" {
|
||||
static = 8300
|
||||
}
|
||||
port "serf-lan" {
|
||||
static = 8301
|
||||
}
|
||||
port "serf-wan" {
|
||||
static = 8302
|
||||
}
|
||||
}
|
||||
|
||||
task "consul" {
|
||||
driver = "exec"
|
||||
|
||||
config {
|
||||
command = "consul"
|
||||
args = [
|
||||
"agent",
|
||||
"-server",
|
||||
"-bootstrap-expect=3",
|
||||
"-data-dir=/opt/nomad/data/consul",
|
||||
"-client=0.0.0.0",
|
||||
"-bind=100.117.106.136",
|
||||
"-advertise=100.117.106.136",
|
||||
"-retry-join=ash3c.tailnet-68f9.ts.net:8301",
|
||||
"-retry-join=warden.tailnet-68f9.ts.net:8301",
|
||||
"-retry-join=onecloud1.tailnet-68f9.ts.net:8301",
|
||||
"-ui",
|
||||
"-http-port=8500",
|
||||
"-server-port=8300",
|
||||
"-serf-lan-port=8301",
|
||||
"-serf-wan-port=8302"
|
||||
]
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 300
|
||||
memory = 512
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
group "consul-ash3c" {
|
||||
constraint {
|
||||
attribute = "${node.unique.name}"
|
||||
value = "ash3c"
|
||||
}
|
||||
|
||||
network {
|
||||
port "http" {
|
||||
static = 8500
|
||||
}
|
||||
port "server" {
|
||||
static = 8300
|
||||
}
|
||||
port "serf-lan" {
|
||||
static = 8301
|
||||
}
|
||||
port "serf-wan" {
|
||||
static = 8302
|
||||
}
|
||||
}
|
||||
|
||||
task "consul" {
|
||||
driver = "exec"
|
||||
|
||||
config {
|
||||
command = "consul"
|
||||
args = [
|
||||
"agent",
|
||||
"-server",
|
||||
"-data-dir=/opt/nomad/data/consul",
|
||||
"-client=0.0.0.0",
|
||||
"-bind=100.116.80.94",
|
||||
"-advertise=100.116.80.94",
|
||||
"-retry-join=ch4.tailnet-68f9.ts.net:8301",
|
||||
"-retry-join=warden.tailnet-68f9.ts.net:8301",
|
||||
"-retry-join=onecloud1.tailnet-68f9.ts.net:8301",
|
||||
"-ui",
|
||||
"-http-port=8500",
|
||||
"-server-port=8300",
|
||||
"-serf-lan-port=8301",
|
||||
"-serf-wan-port=8302"
|
||||
]
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 300
|
||||
memory = 512
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
group "consul-warden" {
|
||||
constraint {
|
||||
attribute = "${node.unique.name}"
|
||||
value = "warden"
|
||||
}
|
||||
|
||||
network {
|
||||
port "http" {
|
||||
static = 8500
|
||||
}
|
||||
port "server" {
|
||||
static = 8300
|
||||
}
|
||||
port "serf-lan" {
|
||||
static = 8301
|
||||
}
|
||||
port "serf-wan" {
|
||||
static = 8302
|
||||
}
|
||||
}
|
||||
|
||||
task "consul" {
|
||||
driver = "exec"
|
||||
|
||||
config {
|
||||
command = "consul"
|
||||
args = [
|
||||
"agent",
|
||||
"-server",
|
||||
"-data-dir=/opt/nomad/data/consul",
|
||||
"-client=0.0.0.0",
|
||||
"-bind=100.122.197.112",
|
||||
"-advertise=100.122.197.112",
|
||||
"-retry-join=ch4.tailnet-68f9.ts.net:8301",
|
||||
"-retry-join=ash3c.tailnet-68f9.ts.net:8301",
|
||||
"-retry-join=onecloud1.tailnet-68f9.ts.net:8301",
|
||||
"-ui",
|
||||
"-http-port=8500",
|
||||
"-server-port=8300",
|
||||
"-serf-lan-port=8301",
|
||||
"-serf-wan-port=8302"
|
||||
]
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 300
|
||||
memory = 512
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
group "consul-onecloud1" {
|
||||
constraint {
|
||||
attribute = "${node.unique.name}"
|
||||
value = "onecloud1"
|
||||
}
|
||||
|
||||
network {
|
||||
port "http" {
|
||||
static = 8500
|
||||
}
|
||||
port "server" {
|
||||
static = 8300
|
||||
}
|
||||
port "serf-lan" {
|
||||
static = 8301
|
||||
}
|
||||
port "serf-wan" {
|
||||
static = 8302
|
||||
}
|
||||
}
|
||||
|
||||
task "consul" {
|
||||
driver = "exec"
|
||||
|
||||
config {
|
||||
command = "consul"
|
||||
args = [
|
||||
"agent",
|
||||
"-server",
|
||||
"-data-dir=/opt/nomad/data/consul",
|
||||
"-client=0.0.0.0",
|
||||
"-bind=100.98.209.50",
|
||||
"-advertise=100.98.209.50",
|
||||
"-retry-join=ch4.tailnet-68f9.ts.net:8301",
|
||||
"-retry-join=ash3c.tailnet-68f9.ts.net:8301",
|
||||
"-retry-join=warden.tailnet-68f9.ts.net:8301",
|
||||
"-ui",
|
||||
"-http-port=8500",
|
||||
"-server-port=8300",
|
||||
"-serf-lan-port=8301",
|
||||
"-serf-wan-port=8302"
|
||||
]
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 300
|
||||
memory = 512
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
249
nomad-jobs/traefik-cloudflare/traefik-cloudflare-v3.nomad
Normal file
249
nomad-jobs/traefik-cloudflare/traefik-cloudflare-v3.nomad
Normal file
@@ -0,0 +1,249 @@
|
||||
job "traefik-cloudflare-v3" {
|
||||
datacenters = ["dc1"]
|
||||
type = "service"
|
||||
|
||||
group "traefik" {
|
||||
count = 1
|
||||
|
||||
constraint {
|
||||
attribute = "${node.unique.name}"
|
||||
value = "hcp1"
|
||||
}
|
||||
|
||||
volume "traefik-certs" {
|
||||
type = "host"
|
||||
read_only = false
|
||||
source = "traefik-certs"
|
||||
}
|
||||
|
||||
network {
|
||||
mode = "host"
|
||||
port "http" {
|
||||
static = 80
|
||||
}
|
||||
port "https" {
|
||||
static = 443
|
||||
}
|
||||
port "traefik" {
|
||||
static = 8080
|
||||
}
|
||||
}
|
||||
|
||||
task "traefik" {
|
||||
driver = "exec"
|
||||
|
||||
config {
|
||||
command = "/usr/local/bin/traefik"
|
||||
args = [
|
||||
"--configfile=/local/traefik.yml"
|
||||
]
|
||||
}
|
||||
|
||||
env {
|
||||
CLOUDFLARE_EMAIL = "locksmithknight@gmail.com"
|
||||
CLOUDFLARE_DNS_API_TOKEN = "0aPWoLaQ59l0nyL1jIVzZaEx2e41Gjgcfhn3ztJr"
|
||||
CLOUDFLARE_ZONE_API_TOKEN = "0aPWoLaQ59l0nyL1jIVzZaEx2e41Gjgcfhn3ztJr"
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
volume = "traefik-certs"
|
||||
destination = "/opt/traefik/certs"
|
||||
read_only = false
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
api:
|
||||
dashboard: true
|
||||
insecure: true
|
||||
|
||||
entryPoints:
|
||||
web:
|
||||
address: "0.0.0.0:80"
|
||||
http:
|
||||
redirections:
|
||||
entrypoint:
|
||||
to: websecure
|
||||
scheme: https
|
||||
permanent: true
|
||||
websecure:
|
||||
address: "0.0.0.0:443"
|
||||
traefik:
|
||||
address: "0.0.0.0:8080"
|
||||
|
||||
providers:
|
||||
consulCatalog:
|
||||
endpoint:
|
||||
address: "warden.tailnet-68f9.ts.net:8500"
|
||||
scheme: "http"
|
||||
watch: true
|
||||
exposedByDefault: false
|
||||
prefix: "traefik"
|
||||
defaultRule: "Host(`{{ .Name }}.git-4ta.live`)"
|
||||
file:
|
||||
filename: /local/dynamic.yml
|
||||
watch: true
|
||||
|
||||
certificatesResolvers:
|
||||
cloudflare:
|
||||
acme:
|
||||
email: {{ env "CLOUDFLARE_EMAIL" }}
|
||||
storage: /opt/traefik/certs/acme.json
|
||||
dnsChallenge:
|
||||
provider: cloudflare
|
||||
delayBeforeCheck: 30s
|
||||
|
||||
log:
|
||||
level: DEBUG
|
||||
EOF
|
||||
destination = "local/traefik.yml"
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
http:
|
||||
serversTransports:
|
||||
waypoint-insecure:
|
||||
insecureSkipVerify: true
|
||||
authentik-insecure:
|
||||
insecureSkipVerify: true
|
||||
|
||||
middlewares:
|
||||
consul-stripprefix:
|
||||
stripPrefix:
|
||||
prefixes:
|
||||
- "/consul"
|
||||
waypoint-auth:
|
||||
replacePathRegex:
|
||||
regex: "^/auth/token(.*)$"
|
||||
replacement: "/auth/token$1"
|
||||
|
||||
services:
|
||||
consul-cluster:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://ch4.tailnet-68f9.ts.net:8500" # 韩国，Leader
|
||||
- url: "http://warden.tailnet-68f9.ts.net:8500" # 北京，Follower
|
||||
- url: "http://ash3c.tailnet-68f9.ts.net:8500" # 美国，Follower
|
||||
healthCheck:
|
||||
path: "/v1/status/leader"
|
||||
interval: "30s"
|
||||
timeout: "15s"
|
||||
|
||||
nomad-cluster:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://ch2.tailnet-68f9.ts.net:4646" # 韩国，Leader
|
||||
- url: "http://ash3c.tailnet-68f9.ts.net:4646" # 美国，Follower
|
||||
healthCheck:
|
||||
path: "/v1/status/leader"
|
||||
interval: "30s"
|
||||
timeout: "15s"
|
||||
|
||||
waypoint-cluster:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "https://hcp1.tailnet-68f9.ts.net:9701" # hcp1 节点 HTTPS API
|
||||
serversTransport: waypoint-insecure
|
||||
|
||||
vault-cluster:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://warden.tailnet-68f9.ts.net:8200" # 北京，单节点
|
||||
healthCheck:
|
||||
path: "/ui/"
|
||||
interval: "30s"
|
||||
timeout: "15s"
|
||||
|
||||
authentik-cluster:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "https://authentik.tailnet-68f9.ts.net:9443" # Authentik容器HTTPS端口
|
||||
serversTransport: authentik-insecure
|
||||
healthCheck:
|
||||
path: "/flows/-/default/authentication/"
|
||||
interval: "30s"
|
||||
timeout: "15s"
|
||||
|
||||
routers:
|
||||
consul-api:
|
||||
rule: "Host(`consul.git-4ta.live`)"
|
||||
service: consul-cluster
|
||||
middlewares:
|
||||
- consul-stripprefix
|
||||
entryPoints:
|
||||
- websecure
|
||||
tls:
|
||||
certResolver: cloudflare
|
||||
|
||||
traefik-dashboard:
|
||||
rule: "Host(`traefik.git-4ta.live`)"
|
||||
service: dashboard@internal
|
||||
middlewares:
|
||||
- dashboard_redirect@internal
|
||||
- dashboard_stripprefix@internal
|
||||
entryPoints:
|
||||
- websecure
|
||||
tls:
|
||||
certResolver: cloudflare
|
||||
|
||||
traefik-api:
|
||||
rule: "Host(`traefik.git-4ta.live`) && PathPrefix(`/api`)"
|
||||
service: api@internal
|
||||
entryPoints:
|
||||
- websecure
|
||||
tls:
|
||||
certResolver: cloudflare
|
||||
|
||||
nomad-ui:
|
||||
rule: "Host(`nomad.git-4ta.live`)"
|
||||
service: nomad-cluster
|
||||
entryPoints:
|
||||
- websecure
|
||||
tls:
|
||||
certResolver: cloudflare
|
||||
|
||||
waypoint-ui:
|
||||
rule: "Host(`waypoint.git-4ta.live`)"
|
||||
service: waypoint-cluster
|
||||
entryPoints:
|
||||
- websecure
|
||||
tls:
|
||||
certResolver: cloudflare
|
||||
|
||||
vault-ui:
|
||||
rule: "Host(`vault.git-4ta.live`)"
|
||||
service: vault-cluster
|
||||
entryPoints:
|
||||
- websecure
|
||||
tls:
|
||||
certResolver: cloudflare
|
||||
|
||||
authentik-ui:
|
||||
rule: "Host(`authentik1.git-4ta.live`)"
|
||||
service: authentik-cluster
|
||||
entryPoints:
|
||||
- websecure
|
||||
tls:
|
||||
certResolver: cloudflare
|
||||
EOF
|
||||
destination = "local/dynamic.yml"
|
||||
}
|
||||
|
||||
template {
|
||||
data = <<EOF
|
||||
CLOUDFLARE_EMAIL=locksmithknight@gmail.com
|
||||
CLOUDFLARE_DNS_API_TOKEN=0aPWoLaQ59l0nyL1jIVzZaEx2e41Gjgcfhn3ztJr
|
||||
CLOUDFLARE_ZONE_API_TOKEN=0aPWoLaQ59l0nyL1jIVzZaEx2e41Gjgcfhn3ztJr
|
||||
EOF
|
||||
destination = "local/cloudflare.env"
|
||||
env = true
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 500
|
||||
memory = 512
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
388
nomad-jobs/vault-single/vault-cluster.nomad
Normal file
388
nomad-jobs/vault-single/vault-cluster.nomad
Normal file
@@ -0,0 +1,388 @@
|
||||
job "vault-cluster" {
|
||||
datacenters = ["dc1"]
|
||||
type = "service"
|
||||
|
||||
group "vault-warden" {
|
||||
count = 1
|
||||
|
||||
volume "vault-storage" {
|
||||
type = "host"
|
||||
read_only = false
|
||||
source = "vault-storage"
|
||||
}
|
||||
|
||||
constraint {
|
||||
attribute = "${node.unique.name}"
|
||||
operator = "="
|
||||
value = "warden"
|
||||
}
|
||||
|
||||
network {
|
||||
port "http" {
|
||||
static = 8200
|
||||
to = 8200
|
||||
}
|
||||
port "cluster" {
|
||||
static = 8201
|
||||
to = 8201
|
||||
}
|
||||
}
|
||||
|
||||
task "vault" {
|
||||
driver = "exec"
|
||||
|
||||
volume_mount {
|
||||
volume = "vault-storage"
|
||||
destination = "/opt/nomad/data/vault-storage"
|
||||
read_only = false
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 500
|
||||
memory = 1024
|
||||
}
|
||||
|
||||
env {
|
||||
VAULT_ADDR = "http://127.0.0.1:8200"
|
||||
VAULT_CLUSTER_ADDR = "http://127.0.0.1:8201"
|
||||
}
|
||||
|
||||
# Vault集群配置
|
||||
template {
|
||||
data = <<EOF
|
||||
ui = true
|
||||
disable_mlock = true
|
||||
|
||||
# 使用Consul作为存储后端
|
||||
storage "consul" {
|
||||
address = "127.0.0.1:8500"
|
||||
path = "vault/"
|
||||
|
||||
# 集群配置
|
||||
datacenter = "dc1"
|
||||
service = "vault"
|
||||
service_tags = "vault-server"
|
||||
|
||||
# 会话配置
|
||||
session_ttl = "15s"
|
||||
lock_wait_time = "15s"
|
||||
}
|
||||
|
||||
# HTTP监听器
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8200"
|
||||
tls_disable = 1
|
||||
}
|
||||
|
||||
# 集群监听器
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8201"
|
||||
purpose = "cluster"
|
||||
}
|
||||
|
||||
# API地址 - 使用Tailscale网络
|
||||
api_addr = "http://{{ env "NOMAD_IP_http" }}:8200"
|
||||
|
||||
# 集群地址 - 使用Tailscale网络
|
||||
cluster_addr = "http://{{ env "NOMAD_IP_cluster" }}:8201"
|
||||
|
||||
# 集群名称
|
||||
cluster_name = "vault-cluster"
|
||||
|
||||
# 日志配置
|
||||
log_level = "INFO"
|
||||
EOF
|
||||
destination = "local/vault.hcl"
|
||||
perms = "644"
|
||||
}
|
||||
|
||||
config {
|
||||
command = "vault"
|
||||
args = [
|
||||
"server",
|
||||
"-config=/local/vault.hcl"
|
||||
]
|
||||
}
|
||||
|
||||
restart {
|
||||
attempts = 2
|
||||
interval = "30m"
|
||||
delay = "15s"
|
||||
mode = "fail"
|
||||
}
|
||||
}
|
||||
|
||||
update {
|
||||
max_parallel = 1
|
||||
health_check = "checks"
|
||||
min_healthy_time = "10s"
|
||||
healthy_deadline = "5m"
|
||||
progress_deadline = "10m"
|
||||
auto_revert = true
|
||||
canary = 0
|
||||
}
|
||||
|
||||
migrate {
|
||||
max_parallel = 1
|
||||
health_check = "checks"
|
||||
min_healthy_time = "10s"
|
||||
healthy_deadline = "5m"
|
||||
}
|
||||
}
|
||||
|
||||
group "vault-ch4" {
|
||||
count = 1
|
||||
|
||||
volume "vault-storage" {
|
||||
type = "host"
|
||||
read_only = false
|
||||
source = "vault-storage"
|
||||
}
|
||||
|
||||
constraint {
|
||||
attribute = "${node.unique.name}"
|
||||
operator = "="
|
||||
value = "ch4"
|
||||
}
|
||||
|
||||
network {
|
||||
port "http" {
|
||||
static = 8200
|
||||
to = 8200
|
||||
}
|
||||
port "cluster" {
|
||||
static = 8201
|
||||
to = 8201
|
||||
}
|
||||
}
|
||||
|
||||
task "vault" {
|
||||
driver = "exec"
|
||||
|
||||
volume_mount {
|
||||
volume = "vault-storage"
|
||||
destination = "/opt/nomad/data/vault-storage"
|
||||
read_only = false
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 500
|
||||
memory = 1024
|
||||
}
|
||||
|
||||
env {
|
||||
VAULT_ADDR = "http://127.0.0.1:8200"
|
||||
VAULT_CLUSTER_ADDR = "http://127.0.0.1:8201"
|
||||
}
|
||||
|
||||
# Vault集群配置
|
||||
template {
|
||||
data = <<EOF
|
||||
ui = true
|
||||
disable_mlock = true
|
||||
|
||||
# 使用Consul作为存储后端
|
||||
storage "consul" {
|
||||
address = "127.0.0.1:8500"
|
||||
path = "vault/"
|
||||
|
||||
# 集群配置
|
||||
datacenter = "dc1"
|
||||
service = "vault"
|
||||
service_tags = "vault-server"
|
||||
|
||||
# 会话配置
|
||||
session_ttl = "15s"
|
||||
lock_wait_time = "15s"
|
||||
}
|
||||
|
||||
# HTTP监听器
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8200"
|
||||
tls_disable = 1
|
||||
}
|
||||
|
||||
# 集群监听器
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8201"
|
||||
purpose = "cluster"
|
||||
}
|
||||
|
||||
# API地址 - 使用Tailscale网络
|
||||
api_addr = "http://{{ env "NOMAD_IP_http" }}:8200"
|
||||
|
||||
# 集群地址 - 使用Tailscale网络
|
||||
cluster_addr = "http://{{ env "NOMAD_IP_cluster" }}:8201"
|
||||
|
||||
# 集群名称
|
||||
cluster_name = "vault-cluster"
|
||||
|
||||
# 日志配置
|
||||
log_level = "INFO"
|
||||
EOF
|
||||
destination = "local/vault.hcl"
|
||||
perms = "644"
|
||||
}
|
||||
|
||||
config {
|
||||
command = "vault"
|
||||
args = [
|
||||
"server",
|
||||
"-config=/local/vault.hcl"
|
||||
]
|
||||
}
|
||||
|
||||
restart {
|
||||
attempts = 2
|
||||
interval = "30m"
|
||||
delay = "15s"
|
||||
mode = "fail"
|
||||
}
|
||||
}
|
||||
|
||||
update {
|
||||
max_parallel = 1
|
||||
health_check = "checks"
|
||||
min_healthy_time = "10s"
|
||||
healthy_deadline = "5m"
|
||||
progress_deadline = "10m"
|
||||
auto_revert = true
|
||||
canary = 0
|
||||
}
|
||||
|
||||
migrate {
|
||||
max_parallel = 1
|
||||
health_check = "checks"
|
||||
min_healthy_time = "10s"
|
||||
healthy_deadline = "5m"
|
||||
}
|
||||
}
|
||||
|
||||
group "vault-ash3c" {
|
||||
count = 1
|
||||
|
||||
volume "vault-storage" {
|
||||
type = "host"
|
||||
read_only = false
|
||||
source = "vault-storage"
|
||||
}
|
||||
|
||||
constraint {
|
||||
attribute = "${node.unique.name}"
|
||||
operator = "="
|
||||
value = "ash3c"
|
||||
}
|
||||
|
||||
network {
|
||||
port "http" {
|
||||
static = 8200
|
||||
to = 8200
|
||||
}
|
||||
port "cluster" {
|
||||
static = 8201
|
||||
to = 8201
|
||||
}
|
||||
}
|
||||
|
||||
task "vault" {
|
||||
driver = "exec"
|
||||
|
||||
volume_mount {
|
||||
volume = "vault-storage"
|
||||
destination = "/opt/nomad/data/vault-storage"
|
||||
read_only = false
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 500
|
||||
memory = 1024
|
||||
}
|
||||
|
||||
env {
|
||||
VAULT_ADDR = "http://127.0.0.1:8200"
|
||||
VAULT_CLUSTER_ADDR = "http://127.0.0.1:8201"
|
||||
}
|
||||
|
||||
# Vault集群配置
|
||||
template {
|
||||
data = <<EOF
|
||||
ui = true
|
||||
disable_mlock = true
|
||||
|
||||
# 使用Consul作为存储后端
|
||||
storage "consul" {
|
||||
address = "127.0.0.1:8500"
|
||||
path = "vault/"
|
||||
|
||||
# 集群配置
|
||||
datacenter = "dc1"
|
||||
service = "vault"
|
||||
service_tags = "vault-server"
|
||||
|
||||
# 会话配置
|
||||
session_ttl = "15s"
|
||||
lock_wait_time = "15s"
|
||||
}
|
||||
|
||||
# HTTP监听器
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8200"
|
||||
tls_disable = 1
|
||||
}
|
||||
|
||||
# 集群监听器
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8201"
|
||||
purpose = "cluster"
|
||||
}
|
||||
|
||||
# API地址 - 使用Tailscale网络
|
||||
api_addr = "http://{{ env "NOMAD_IP_http" }}:8200"
|
||||
|
||||
# 集群地址 - 使用Tailscale网络
|
||||
cluster_addr = "http://{{ env "NOMAD_IP_cluster" }}:8201"
|
||||
|
||||
# 集群名称
|
||||
cluster_name = "vault-cluster"
|
||||
|
||||
# 日志配置
|
||||
log_level = "INFO"
|
||||
EOF
|
||||
destination = "local/vault.hcl"
|
||||
perms = "644"
|
||||
}
|
||||
|
||||
config {
|
||||
command = "vault"
|
||||
args = [
|
||||
"server",
|
||||
"-config=/local/vault.hcl"
|
||||
]
|
||||
}
|
||||
|
||||
restart {
|
||||
attempts = 2
|
||||
interval = "30m"
|
||||
delay = "15s"
|
||||
mode = "fail"
|
||||
}
|
||||
}
|
||||
|
||||
update {
|
||||
max_parallel = 1
|
||||
health_check = "checks"
|
||||
min_healthy_time = "10s"
|
||||
healthy_deadline = "5m"
|
||||
progress_deadline = "10m"
|
||||
auto_revert = true
|
||||
canary = 0
|
||||
}
|
||||
|
||||
migrate {
|
||||
max_parallel = 1
|
||||
health_check = "checks"
|
||||
min_healthy_time = "10s"
|
||||
healthy_deadline = "5m"
|
||||
}
|
||||
}
|
||||
}
|
||||
320
nomad-jobs/vault-single/vault-single.nomad
Normal file
320
nomad-jobs/vault-single/vault-single.nomad
Normal file
@@ -0,0 +1,320 @@
|
||||
job "vault-single-nomad" {
|
||||
datacenters = ["dc1"]
|
||||
type = "service"
|
||||
|
||||
group "vault-warden" {
|
||||
count = 1
|
||||
|
||||
volume "vault-storage" {
|
||||
type = "host"
|
||||
read_only = false
|
||||
source = "vault-storage"
|
||||
}
|
||||
|
||||
constraint {
|
||||
attribute = "${node.unique.name}"
|
||||
operator = "="
|
||||
value = "warden"
|
||||
}
|
||||
|
||||
network {
|
||||
port "http" {
|
||||
static = 8200
|
||||
to = 8200
|
||||
}
|
||||
}
|
||||
|
||||
task "vault" {
|
||||
driver = "exec"
|
||||
|
||||
volume_mount {
|
||||
volume = "vault-storage"
|
||||
destination = "/opt/nomad/data/vault-storage"
|
||||
read_only = false
|
||||
}
|
||||
|
||||
|
||||
resources {
|
||||
cpu = 500
|
||||
memory = 1024
|
||||
}
|
||||
|
||||
env {
|
||||
VAULT_ADDR = "http://127.0.0.1:8200"
|
||||
}
|
||||
|
||||
# Vault配置 - 使用Consul存储
|
||||
template {
|
||||
data = <<EOF
|
||||
ui = true
|
||||
disable_mlock = true
|
||||
|
||||
# 使用Consul作为存储后端
|
||||
storage "consul" {
|
||||
address = "127.0.0.1:8500"
|
||||
path = "vault/"
|
||||
|
||||
# 集群配置
|
||||
datacenter = "dc1"
|
||||
service = "vault"
|
||||
service_tags = "vault-server"
|
||||
|
||||
# 会话配置
|
||||
session_ttl = "15s"
|
||||
lock_wait_time = "15s"
|
||||
}
|
||||
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8200"
|
||||
tls_disable = 1
|
||||
}
|
||||
|
||||
# API地址 - 使用Tailscale网络
|
||||
api_addr = "http://warden.tailnet-68f9.ts.net:8200"
|
||||
|
||||
# 集群名称
|
||||
cluster_name = "vault-cluster"
|
||||
|
||||
# 日志配置
|
||||
log_level = "INFO"
|
||||
EOF
|
||||
destination = "local/vault.hcl"
|
||||
perms = "644"
|
||||
}
|
||||
|
||||
config {
|
||||
command = "vault"
|
||||
args = [
|
||||
"server",
|
||||
"-config=/local/vault.hcl"
|
||||
]
|
||||
}
|
||||
|
||||
restart {
|
||||
attempts = 2
|
||||
interval = "30m"
|
||||
delay = "15s"
|
||||
mode = "fail"
|
||||
}
|
||||
}
|
||||
|
||||
update {
|
||||
max_parallel = 1
|
||||
health_check = "checks"
|
||||
min_healthy_time = "10s"
|
||||
healthy_deadline = "5m"
|
||||
progress_deadline = "10m"
|
||||
auto_revert = true
|
||||
canary = 0
|
||||
}
|
||||
|
||||
migrate {
|
||||
max_parallel = 1
|
||||
health_check = "checks"
|
||||
min_healthy_time = "10s"
|
||||
healthy_deadline = "5m"
|
||||
}
|
||||
}
|
||||
|
||||
group "vault-ch4" {
|
||||
count = 1
|
||||
|
||||
constraint {
|
||||
attribute = "${node.unique.name}"
|
||||
operator = "="
|
||||
value = "ch4"
|
||||
}
|
||||
|
||||
network {
|
||||
port "http" {
|
||||
static = 8200
|
||||
to = 8200
|
||||
}
|
||||
}
|
||||
|
||||
task "vault" {
|
||||
driver = "exec"
|
||||
|
||||
resources {
|
||||
cpu = 500
|
||||
memory = 1024
|
||||
}
|
||||
|
||||
env {
|
||||
VAULT_ADDR = "http://127.0.0.1:8200"
|
||||
}
|
||||
|
||||
# Vault配置 - 使用Consul存储
|
||||
template {
|
||||
data = <<EOF
|
||||
ui = true
|
||||
disable_mlock = true
|
||||
|
||||
# 使用Consul作为存储后端
|
||||
storage "consul" {
|
||||
address = "127.0.0.1:8500"
|
||||
path = "vault/"
|
||||
|
||||
# 集群配置
|
||||
datacenter = "dc1"
|
||||
service = "vault"
|
||||
service_tags = "vault-server"
|
||||
|
||||
# 会话配置
|
||||
session_ttl = "15s"
|
||||
lock_wait_time = "15s"
|
||||
}
|
||||
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8200"
|
||||
tls_disable = 1
|
||||
}
|
||||
|
||||
# API地址 - 使用Tailscale网络
|
||||
api_addr = "http://ch4.tailnet-68f9.ts.net:8200"
|
||||
|
||||
# 集群名称
|
||||
cluster_name = "vault-cluster"
|
||||
|
||||
# 日志配置
|
||||
log_level = "INFO"
|
||||
EOF
|
||||
destination = "local/vault.hcl"
|
||||
perms = "644"
|
||||
}
|
||||
|
||||
config {
|
||||
command = "vault"
|
||||
args = [
|
||||
"server",
|
||||
"-config=/local/vault.hcl"
|
||||
]
|
||||
}
|
||||
|
||||
restart {
|
||||
attempts = 2
|
||||
interval = "30m"
|
||||
delay = "15s"
|
||||
mode = "fail"
|
||||
}
|
||||
}
|
||||
|
||||
update {
|
||||
max_parallel = 1
|
||||
health_check = "checks"
|
||||
min_healthy_time = "10s"
|
||||
healthy_deadline = "5m"
|
||||
progress_deadline = "10m"
|
||||
auto_revert = true
|
||||
canary = 0
|
||||
}
|
||||
|
||||
migrate {
|
||||
max_parallel = 1
|
||||
health_check = "checks"
|
||||
min_healthy_time = "10s"
|
||||
healthy_deadline = "5m"
|
||||
}
|
||||
}
|
||||
|
||||
group "vault-ash3c" {
|
||||
count = 1
|
||||
|
||||
constraint {
|
||||
attribute = "${node.unique.name}"
|
||||
operator = "="
|
||||
value = "ash3c"
|
||||
}
|
||||
|
||||
network {
|
||||
port "http" {
|
||||
static = 8200
|
||||
to = 8200
|
||||
}
|
||||
}
|
||||
|
||||
task "vault" {
|
||||
driver = "exec"
|
||||
|
||||
resources {
|
||||
cpu = 500
|
||||
memory = 1024
|
||||
}
|
||||
|
||||
env {
|
||||
VAULT_ADDR = "http://127.0.0.1:8200"
|
||||
}
|
||||
|
||||
# Vault配置 - 使用Consul存储
|
||||
template {
|
||||
data = <<EOF
|
||||
ui = true
|
||||
disable_mlock = true
|
||||
|
||||
# 使用Consul作为存储后端
|
||||
storage "consul" {
|
||||
address = "127.0.0.1:8500"
|
||||
path = "vault/"
|
||||
|
||||
# 集群配置
|
||||
datacenter = "dc1"
|
||||
service = "vault"
|
||||
service_tags = "vault-server"
|
||||
|
||||
# 会话配置
|
||||
session_ttl = "15s"
|
||||
lock_wait_time = "15s"
|
||||
}
|
||||
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8200"
|
||||
tls_disable = 1
|
||||
}
|
||||
|
||||
# API地址 - 使用Tailscale网络
|
||||
api_addr = "http://ash3c.tailnet-68f9.ts.net:8200"
|
||||
|
||||
# 集群名称
|
||||
cluster_name = "vault-cluster"
|
||||
|
||||
# 日志配置
|
||||
log_level = "INFO"
|
||||
EOF
|
||||
destination = "local/vault.hcl"
|
||||
perms = "644"
|
||||
}
|
||||
|
||||
config {
|
||||
command = "vault"
|
||||
args = [
|
||||
"server",
|
||||
"-config=/local/vault.hcl"
|
||||
]
|
||||
}
|
||||
|
||||
restart {
|
||||
attempts = 2
|
||||
interval = "30m"
|
||||
delay = "15s"
|
||||
mode = "fail"
|
||||
}
|
||||
}
|
||||
|
||||
update {
|
||||
max_parallel = 1
|
||||
health_check = "checks"
|
||||
min_healthy_time = "10s"
|
||||
healthy_deadline = "5m"
|
||||
progress_deadline = "10m"
|
||||
auto_revert = true
|
||||
canary = 0
|
||||
}
|
||||
|
||||
migrate {
|
||||
max_parallel = 1
|
||||
health_check = "checks"
|
||||
min_healthy_time = "10s"
|
||||
healthy_deadline = "5m"
|
||||
}
|
||||
}
|
||||
}
|
||||
57
nomad-jobs/waypoint-server.nomad
Normal file
57
nomad-jobs/waypoint-server.nomad
Normal file
@@ -0,0 +1,57 @@
|
||||
job "waypoint-server" {
|
||||
datacenters = ["dc1"]
|
||||
type = "service"
|
||||
|
||||
group "waypoint" {
|
||||
count = 1
|
||||
|
||||
volume "waypoint-data" {
|
||||
type = "host"
|
||||
read_only = false
|
||||
source = "waypoint-data"
|
||||
}
|
||||
|
||||
network {
|
||||
port "http" {
|
||||
static = 9701
|
||||
}
|
||||
port "grpc" {
|
||||
static = 9702
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
task "waypoint" {
|
||||
driver = "exec"
|
||||
|
||||
|
||||
volume_mount {
|
||||
volume = "waypoint-data"
|
||||
destination = "/opt/waypoint"
|
||||
read_only = false
|
||||
}
|
||||
|
||||
config {
|
||||
command = "/usr/local/bin/waypoint"
|
||||
|
||||
args = [
|
||||
"server", "run",
|
||||
"-accept-tos",
|
||||
"-vvv",
|
||||
"-db=/opt/waypoint/waypoint.db",
|
||||
"-listen-grpc=0.0.0.0:9702",
|
||||
"-listen-http=0.0.0.0:9701"
|
||||
]
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 500
|
||||
memory = 512
|
||||
}
|
||||
|
||||
env {
|
||||
WAYPOINT_LOG_LEVEL = "DEBUG"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
57
nomad-jobs/waypoint-server/waypoint-server.nomad
Normal file
57
nomad-jobs/waypoint-server/waypoint-server.nomad
Normal file
@@ -0,0 +1,57 @@
|
||||
job "waypoint-server" {
|
||||
datacenters = ["dc1"]
|
||||
type = "service"
|
||||
|
||||
group "waypoint" {
|
||||
count = 1
|
||||
|
||||
volume "waypoint-data" {
|
||||
type = "host"
|
||||
read_only = false
|
||||
source = "waypoint-data"
|
||||
}
|
||||
|
||||
network {
|
||||
port "http" {
|
||||
static = 9701
|
||||
}
|
||||
port "grpc" {
|
||||
static = 9702
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
task "waypoint" {
|
||||
driver = "exec"
|
||||
|
||||
|
||||
volume_mount {
|
||||
volume = "waypoint-data"
|
||||
destination = "/opt/waypoint"
|
||||
read_only = false
|
||||
}
|
||||
|
||||
config {
|
||||
command = "/usr/local/bin/waypoint"
|
||||
|
||||
args = [
|
||||
"server", "run",
|
||||
"-accept-tos",
|
||||
"-vvv",
|
||||
"-db=/opt/waypoint/waypoint.db",
|
||||
"-listen-grpc=0.0.0.0:9702",
|
||||
"-listen-http=0.0.0.0:9701"
|
||||
]
|
||||
}
|
||||
|
||||
resources {
|
||||
cpu = 500
|
||||
memory = 512
|
||||
}
|
||||
|
||||
env {
|
||||
WAYPOINT_LOG_LEVEL = "DEBUG"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user