110 lines
2.3 KiB
HCL
110 lines
2.3 KiB
HCL
resource "proxmox_virtual_environment_container" "valkey" {
|
|
node_name = "pve"
|
|
|
|
vm_id = 1040
|
|
|
|
tags = ["dev", "database", "cache"]
|
|
|
|
unprivileged = true
|
|
|
|
cpu {
|
|
cores = 1
|
|
}
|
|
|
|
memory {
|
|
dedicated = 512
|
|
}
|
|
|
|
disk {
|
|
datastore_id = var.datastore_id
|
|
size = 4
|
|
}
|
|
|
|
network_interface {
|
|
bridge = var.internal_network_bridge_name
|
|
name = "eth-dev"
|
|
firewall = true
|
|
enabled = true
|
|
}
|
|
|
|
initialization {
|
|
hostname = "valkey"
|
|
ip_config {
|
|
ipv4 {
|
|
address = "192.168.0.4/24"
|
|
gateway = "192.168.0.1"
|
|
}
|
|
}
|
|
user_account {
|
|
keys = [var.ssh_public_key]
|
|
}
|
|
}
|
|
|
|
operating_system {
|
|
template_file_id = "local:vztmpl/debian-12-standard_12.7-1_amd64.tar.zst"
|
|
type = "debian"
|
|
}
|
|
|
|
started = true
|
|
|
|
startup {
|
|
order = 100
|
|
up_delay = 0
|
|
down_delay = 0
|
|
}
|
|
|
|
features {
|
|
nesting = true
|
|
}
|
|
}
|
|
|
|
resource "proxmox_virtual_environment_firewall_options" "valkey" {
|
|
depends_on = [proxmox_virtual_environment_container.valkey]
|
|
|
|
node_name = proxmox_virtual_environment_container.valkey.node_name
|
|
vm_id = proxmox_virtual_environment_container.valkey.vm_id
|
|
|
|
enabled = true
|
|
dhcp = true
|
|
input_policy = "DROP"
|
|
output_policy = "ACCEPT"
|
|
}
|
|
|
|
resource "proxmox_virtual_environment_firewall_rules" "valkey" {
|
|
depends_on = [proxmox_virtual_environment_container.valkey]
|
|
|
|
node_name = proxmox_virtual_environment_container.valkey.node_name
|
|
vm_id = proxmox_virtual_environment_container.valkey.vm_id
|
|
|
|
rule {
|
|
type = "in"
|
|
source = split("/", data.terraform_remote_state.common.outputs.bastion_ct.initialization[0].ip_config[1].ipv4[0].address)[0]
|
|
proto = "tcp"
|
|
dport = "22"
|
|
action = "ACCEPT"
|
|
comment = "SSH from Bastion."
|
|
}
|
|
|
|
rule {
|
|
type = "in"
|
|
proto = "icmp"
|
|
dport = "8"
|
|
action = "ACCEPT"
|
|
comment = "Ping."
|
|
}
|
|
|
|
rule {
|
|
security_group = data.terraform_remote_state.common.outputs.prometheus_node_exporter_sg.name
|
|
comment = "Allow Prometheus server to pull Prometheus node exporter from Monitoring Node."
|
|
}
|
|
|
|
rule {
|
|
type = "in"
|
|
source = "+${data.terraform_remote_state.common.outputs.dev_valkey_clients_ipset.name}"
|
|
proto = "tcp"
|
|
dport = "6379"
|
|
action = "ACCEPT"
|
|
comment = "Access valkey from client nodes."
|
|
}
|
|
}
|