88 lines
3.5 KiB
Terraform
88 lines
3.5 KiB
Terraform
# resources.tf — два HTTP-контейнера: EMQX (первым) и iot-service (вторым).
|
|
# Образы: gitea.services.ngcloud.ru/nail/{iot-emqx,iot-service}.
|
|
# Провайдер nubes_http: docs-rendered/http.md.
|
|
#
|
|
# Порядок важен: iot-service подключается к EMQX (MQTT) → depends_on.
|
|
|
|
locals {
|
|
# Внутренний адрес EMQX-контейнера (для bridge внутри кластера).
|
|
# ⚠️ Service в namespace платформы ВСЕГДА называется `containerk8s`, НЕ
|
|
# resource_name. Проверено в кластере iot-naeel (2026-10-11):
|
|
# containerk8s.<instanceUid>.svc.cluster.local → 10.98.42.138 ✅
|
|
# iot-emqx.<instanceUid>.svc.cluster.local → NXDOMAIN ❌
|
|
# (тот же формат зафиксирован в HISTORY/2026-08-16-session-log.md:824).
|
|
# Если окажется иным — переопредели var.mqtt_host.
|
|
emqx_internal_host = "containerk8s.${nubes_http.iot_emqx.state_out.instanceUid}.svc.cluster.local"
|
|
mqtt_host = var.mqtt_host != "" ? var.mqtt_host : local.emqx_internal_host
|
|
}
|
|
|
|
# ── EMQX (создаётся ПЕРВЫМ) ──
|
|
resource "nubes_http" "iot_emqx" {
|
|
resource_name = "iot-emqx"
|
|
resource_realm = var.realm
|
|
|
|
domain = var.emqx_domain
|
|
registry_path = "${var.registry}/iot-emqx:${var.iot_emqx_version}"
|
|
|
|
resource_cpu = 1000
|
|
resource_memory = 1024
|
|
resource_instances = 1
|
|
|
|
# EMQX auth/ACL — напрямую в PostgreSQL (таблица iot_devices).
|
|
# ⚠ НЕ задавать ...__URL (HTTP-auth старой схемы — уронит под).
|
|
json_env = jsonencode({
|
|
EMQX_AUTHENTICATION__1__SERVER = "${var.pg_host}:${var.pg_port}"
|
|
EMQX_AUTHENTICATION__1__DATABASE = var.pg_db
|
|
EMQX_AUTHENTICATION__1__USERNAME = var.pg_user
|
|
EMQX_AUTHENTICATION__1__PASSWORD = var.pg_password
|
|
EMQX_AUTHORIZATION__SOURCES__1__SERVER = "${var.pg_host}:${var.pg_port}"
|
|
EMQX_AUTHORIZATION__SOURCES__1__DATABASE = var.pg_db
|
|
EMQX_AUTHORIZATION__SOURCES__1__USERNAME = var.pg_user
|
|
EMQX_AUTHORIZATION__SOURCES__1__PASSWORD = var.pg_password
|
|
EMQX_LOG__CONSOLE_HANDLER__LEVEL = "warning"
|
|
})
|
|
|
|
adopt_existing_on_create = true
|
|
}
|
|
|
|
# ── iot-service (создаётся ВТОРЫМ, после EMQX) ──
|
|
resource "nubes_http" "iot_service" {
|
|
resource_name = "iot-service"
|
|
resource_realm = var.realm
|
|
|
|
domain = var.iot_domain
|
|
registry_path = "${var.registry}/iot-service:${var.iot_service_version}"
|
|
|
|
resource_cpu = 200
|
|
resource_memory = 512
|
|
resource_instances = 1
|
|
|
|
json_env = jsonencode({
|
|
IOT_PG_DSN = "postgresql://${var.pg_user}:${var.pg_password}@${var.pg_host}:${var.pg_port}/${var.pg_db}?sslmode=require"
|
|
|
|
SQS_ENDPOINT = var.sqs_endpoint
|
|
SQS_ACCESS_KEY = var.sqs_access_key
|
|
SQS_SECRET_KEY = var.sqs_secret_key
|
|
SQS_QUEUE_NAME = var.sqs_queue_name
|
|
SQS_DLQ_NAME = var.sqs_dlq_name
|
|
SQS_REGION = "us-east-1"
|
|
|
|
MQTT_HOST = local.mqtt_host
|
|
MQTT_PORT = "8083"
|
|
MQTT_WS_PATH = "/mqtt"
|
|
MQTT_USERNAME = var.mqtt_username
|
|
MQTT_PASSWORD = var.mqtt_password
|
|
|
|
JWT_HMAC_SECRET = var.jwt_hmac_secret
|
|
ADMIN_STATS_TOKEN = var.admin_stats_token
|
|
AUTH_TEST_MODE = "false"
|
|
LOG_LEVEL = "info"
|
|
API_PORT = "9090"
|
|
})
|
|
|
|
# iot-service стартует только после создания EMQX
|
|
depends_on = [nubes_http.iot_emqx]
|
|
|
|
adopt_existing_on_create = true
|
|
}
|