locals.tf.example

locals {
  platform_name        = "my-own-paas"
  platform_zone        = "de-fra-1"
  platform_backup_zone = "de-muc-1"

  # Defaults to the public IP of the device running terraform apply in `terraform-base`.
  # This calls ipconfig.me to automatically detect this public IP address.
  platform_admin_networks = "auto"

  # For more privacy, manually set the allowed list of public IPs:
  # platform_admin_networks = [
  #   "a.b.c.d/32"
  # ]

  # For development purposes (not recommended as this open administration services to the world)
  # platform_admin_networks = [
  #   "0.0.0.0/0",
  #   "::/0"
  # ]

  # Set your infrastructure domain here
  platform_domain = "${local.platform_name}.domain.tld"

  # Set your authentication settings here.
  # Possible (oidc) provider is only "vault" for now.
  #
  # If provider is "vault", you can set your users and their groups here.
  # In this case, possible groups are "administrator", "developer" or both.
  platform_authentication = {
    provider = "vault"
    users = {
      "lucy.l" = {
        email  = "lucy@domain.tld"
        groups = ["administrator"]
      }
      "lucas.c" = {
        email  = "lucas@domain.tld"
        groups = ["developer"]
      }
    }
  }

  platform_app_namespaces = {
    # Here we define targets and their environments
    # Resources declared here will end up as namespaces and related resources:
    # - Namespace with `<target>-<environment>` as name
    # - LimitRange for CPU request, memory request, and memory limits
    # - Resource quotas for CPU request, memory request, memory limit and maximum number of Pods
    # - RBAC resources (a set of Roles, RoleBindings, ClusterRoles & ClusterRoleBindings) to allow 
    #   defined groups / users to access a subset of resources for this namespace, and the namespace
    #   itself.
    #
    # The example below will create two namespaces:
    # - `target-production`:
    #     - default resources for a pod are 100m CPU, 128M Memory, and 256M Memory (hard) limit
    #     - resources quota for the whole namespace are 400m CPU, 512M Memory, 1G Memory (hard) limit, and 4 Pods
    #     - all users belonging to the "developer" group
    # - `target-staging`
    #     - default resources for a pod are 100m CPU, 128M Memory, and 256M Memory (hard) limit
    #     - resources quota for the whole namespace are 200m CPU, 256M Memory, 512M Memory (hard) limit, and 2 Pods
    #     - all users belonging to the "developer" group
    #     - the "lucy.l" user
    target = {
      production = {
        resource-quota    = { cpu-request = "400m", memory-request = "512Mi", memory-limit = "1Gi", pods = 4 }
        resource-defaults = { cpu-request = "100m", memory-request = "128Mi", memory-limit = "256Mi" }
        groups            = ["developer"]
      }
      staging = {
        resource-quota    = { cpu-request = "200m", memory-request = "256Mi", memory-limit = "512Mi", pods = 2 }
        resource-defaults = { cpu-request = "100m", memory-request = "128Mi", memory-limit = "256Mi" }
        groups            = ["developer"]
        users             = ["lucy.l"]
      }
    }
  }

  platform_components = {
    vault = {
      endpoint = "vault.${local.platform_domain}"
      # Set the template id returned by packer when building the vault template (from exoscale-vault.pkr.hcl)
      template = "<vault-template-id>"
    }
    kubernetes = {
      endpoint = "apiserver.kubernetes.${local.platform_domain}"
      templates = {
        # Set the template id returned by packer when building the etcd template (from exoscale-etcd.pkr.hcl)
        etcd          = "<etcd-template-id>"
        # Set the template id returned by packer when building the kubernetes control plane template (from exoscale-kube-controlplane.pkr.hcl)
        control_plane = "<kubernetes-control-plane-template-id>"
        # Set the template id returned by packer when building the kubelet template (from exoscale-kube-node.pkr.hcl)
        kubelet       = "<kubernetes-node-template-id>"
      }
      # cluster settings
      cluster_domain         = "cluster.local"
      pod_cidr_ipv4          = "10.96.0.0/12"
      service_cidr_ipv4      = "10.80.0.0/12"
      apiserver_service_ipv4 = "10.80.0.1"
      dns_service_ipv4       = "10.80.0.2"

      pod_cidr_ipv6          = "fc00::2:0/112"
      service_cidr_ipv6      = "fc00::1:0/112"
      apiserver_service_ipv6 = "fc00::1:1"
      dns_service_ipv6       = "fc00::1:2"

      deployments = {
        core = {
          repository = "https://github.com/PhilippeChepy/platform.git"
          revision   = "main"
          self_heal  = true
        }
        ingress = {
          repository = "https://github.com/PhilippeChepy/platform.git"
          revision   = "main"
          self_heal  = true
        }
      }

      # Define your ingress pools here
      ingresses = {
        default = {
          pool_size = 2
        }
        internal = {
          pool_size   = 2,
          domain      = "internal.example.tld"
          integration = "cloudflare"
        }
      }
    }
  }

  platform_ssh_settings = {
    # Key Algorithm (e.g. 'RSA', 'ECDSA' or 'ED25519'), with 'ED25519' as the default.
    algorithm = "ED25519"

    # May be any of 'P224', 'P256', 'P384' or 'P521', with 'P224' as the default.    
    # ecdsa_curve = "P521"

    # Defaults to '4096' bits.
    # rsa_bits = 4096
  }

  platform_tls_settings = {
    # Key Algorithm (e.g. 'RSA', 'ECDSA' or 'ED25519'), with 'ED25519' as the default.
    algorithm = "RSA"

    # May be any of 'P224', 'P256', 'P384' or 'P521', with 'P224' as the default.    
    # ecdsa_curve = "P521"

    # Defaults to '4096' bits.
    rsa_bits = 4096

    ttl_hours = {
      ca   = 262800 # 30y
      ica  = 87600  # 10y
      cert = 96     # 4d
    }

    subject = {
      organizational_unit = "Internal PaaS"
      organization        = "Organization"
      street_address      = ["Street Address"]
      postal_code         = "postal code"
      locality            = "Locality"
      province            = "Province"
      country             = "Country"
    }
  }
}