feat(deploy): Terraform-стек IoT (nubes_http: EMQX + iot-service) — провайдер nubes-test 3.1.0

2026-10-11 14:20:13 +03:00
parent c06fb3a8e2
commit 0832d7e0cb
7 changed files with 324 additions and 0 deletions
@@ -0,0 +1,83 @@
+# resources.tf — два HTTP-контейнера: EMQX (первым) и iot-service (вторым).
+# Образы: gitea.services.ngcloud.ru/nail/{iot-emqx,iot-service}.
+# Провайдер nubes_http: docs-rendered/http.md.
+#
+# Порядок важен: iot-service подключается к EMQX (MQTT) → depends_on.
+
+locals {
+  # Внутренний адрес EMQX-контейнера (для bridge внутри кластера).
+  # Формат Nubes: <resource_name>.<instanceUid>.svc.cluster.local.
+  # Если окажется иным — переопредели var.mqtt_host (см. ЛК → инстанс EMQX).
+  emqx_internal_host = "${nubes_http.iot_emqx.resource_name}.${nubes_http.iot_emqx.state_out.instanceUid}.svc.cluster.local"
+  mqtt_host          = var.mqtt_host != "" ? var.mqtt_host : local.emqx_internal_host
+}
+
+# ── EMQX (создаётся ПЕРВЫМ) ──
+resource "nubes_http" "iot_emqx" {
+  resource_name  = "iot-emqx"
+  resource_realm = var.realm
+
+  domain        = var.emqx_domain
+  registry_path = "${var.registry}/iot-emqx:${var.iot_emqx_version}"
+
+  resource_cpu       = 1000
+  resource_memory    = 1024
+  resource_instances = 1
+
+  # EMQX auth/ACL — напрямую в PostgreSQL (таблица iot_devices).
+  # ⚠ НЕ задавать ...__URL (HTTP-auth старой схемы — уронит под).
+  json_env = jsonencode({
+    EMQX_AUTHENTICATION__1__SERVER           = "${var.pg_host}:${var.pg_port}"
+    EMQX_AUTHENTICATION__1__DATABASE         = var.pg_db
+    EMQX_AUTHENTICATION__1__USERNAME         = var.pg_user
+    EMQX_AUTHENTICATION__1__PASSWORD         = var.pg_password
+    EMQX_AUTHORIZATION__SOURCES__1__SERVER   = "${var.pg_host}:${var.pg_port}"
+    EMQX_AUTHORIZATION__SOURCES__1__DATABASE = var.pg_db
+    EMQX_AUTHORIZATION__SOURCES__1__USERNAME = var.pg_user
+    EMQX_AUTHORIZATION__SOURCES__1__PASSWORD = var.pg_password
+    EMQX_LOG__CONSOLE_HANDLER__LEVEL         = "warning"
+  })
+
+  adopt_existing_on_create = true
+}
+
+# ── iot-service (создаётся ВТОРЫМ, после EMQX) ──
+resource "nubes_http" "iot_service" {
+  resource_name  = "iot-service"
+  resource_realm = var.realm
+
+  domain        = var.iot_domain
+  registry_path = "${var.registry}/iot-service:${var.iot_service_version}"
+
+  resource_cpu       = 200
+  resource_memory    = 512
+  resource_instances = 1
+
+  json_env = jsonencode({
+    IOT_PG_DSN = "postgresql://${var.pg_user}:${var.pg_password}@${var.pg_host}:${var.pg_port}/${var.pg_db}?sslmode=require"
+
+    SQS_ENDPOINT   = var.sqs_endpoint
+    SQS_ACCESS_KEY = var.sqs_access_key
+    SQS_SECRET_KEY = var.sqs_secret_key
+    SQS_QUEUE_NAME = var.sqs_queue_name
+    SQS_DLQ_NAME   = var.sqs_dlq_name
+    SQS_REGION     = "us-east-1"
+
+    MQTT_HOST     = local.mqtt_host
+    MQTT_PORT     = "8083"
+    MQTT_WS_PATH  = "/mqtt"
+    MQTT_USERNAME = var.mqtt_username
+    MQTT_PASSWORD = var.mqtt_password
+
+    JWT_HMAC_SECRET   = var.jwt_hmac_secret
+    ADMIN_STATS_TOKEN = var.admin_stats_token
+    AUTH_TEST_MODE    = "false"
+    LOG_LEVEL         = "info"
+    API_PORT          = "9090"
+  })
+
+  # iot-service стартует только после создания EMQX
+  depends_on = [nubes_http.iot_emqx]
+
+  adopt_existing_on_create = true
+}