main.tf.example

terraform {
  required_providers {
    kubernetes = {
      version = ">= 2.19.0"
    }
  }
}

locals {
  getssl_service        = "getssl"
  getssl_worker_version = "0.0.4"
}

resource "kubernetes_persistent_volume_claim_v1" "certs_storage" {
  metadata {
    name   = "getssl-storage-claim"
    labels = {
      service = local.getssl_service
    }
  }
  wait_until_bound = false

  spec {
    access_modes       = ["ReadWriteOnce"]
    storage_class_name = "local-path"
    resources {
      requests = {
        storage = "100Mi"
      }
    }
  }
}

resource "kubernetes_persistent_volume" "certs_storage" {
  metadata {
    name = "getssl-storage"

    labels = {
      service = local.getssl_service
      name    = "getssl-storage"
    }
  }

  spec {
    capacity = {
      storage = "100Mi"
    }

    claim_ref {
      name      = kubernetes_persistent_volume_claim_v1.certs_storage.metadata[0].name
      namespace = "default"
    }

    access_modes = ["ReadWriteOnce"]
  }
}

resource "kubernetes_config_map_v1" "config" {
  metadata {
    name = "getssl-config"

    labels = {
      service = local.getssl_service
    }
  }

  data = {
    wild-example-com = "*.example.com"
    example-com      = "example.com"
  }
}

resource "kubernetes_config_map_v1" "custom_scripts" {
  metadata {
    name = "getssl-custom-operations"

    labels = {
      service = local.getssl_service
    }
  }

  data = {
    wild-example-com = <<-EOT
    CERT_FILE_PATH="$HOME/.getssl/*.example.com/*.example.com"
    RELOAD_CMD="your-custom-cert-upload-command '$CERT_FILE_PATH'"
    EOT

    example-com = <<-EOT
    CERT_FILE_PATH="$HOME/.getssl/example.com/example.com"
    RELOAD_CMD="your-custom-cert-upload-command '$CERT_FILE_PATH'"
    EOT
  }
}

resource "kubernetes_cron_job_v1" "getssl" {
  metadata {
    name = local.getssl_service

    labels = {
      service = local.getssl_service
    }
  }

  spec {
    concurrency_policy            = "Replace"
    failed_jobs_history_limit     = 5
    schedule                      = "0 4 * * *" # Every day at 04:00 am
    starting_deadline_seconds     = 10
    successful_jobs_history_limit = 10

    job_template {
      metadata {
        labels = {
          service = local.getssl_service
        }
      }

      spec {
        parallelism                = 1
        backoff_limit              = 2
        ttl_seconds_after_finished = 24*60*60 # Keep pod for 24 hours for debug purposes

        template {
          metadata {
            labels = {
              service = local.getssl_service
            }
          }

          spec {
            restart_policy = "Never"

            dynamic init_container {
              for_each = kubernetes_config_map_v1.config.data

              content {
                name    = "init-${init_container.key}"
                image   = "askarini/timeweb-getssl:${local.getssl_worker_version}"
                command = [
                  "/bin/sh",
                  "-c",
                  "cp -n $HOME/src/getssl.cfg $HOME/.getssl/getssl.cfg && getssl -c \"${init_container.value}\""
                ]

                volume_mount {
                  name       = "store"
                  mount_path = "/getssl/.getssl"
                }
              }
            }

            container {
              name  = "getssl"
              image = "askarini/timeweb-getssl:${local.getssl_worker_version}"

              volume_mount {
                name       = "store"
                mount_path = "/getssl/.getssl"
              }

              dynamic volume_mount {
                for_each = kubernetes_config_map_v1.config.data
                content {
                  mount_path = "/getssl/.getssl/${volume_mount.value}/getssl.cfg"
                  sub_path   = volume_mount.key
                  name       = "cert-configs"
                }
              }

              volume_mount {
                name       = "twc-config"
                mount_path = "/run/secrets/timeweb-getssl-twcrc"
                sub_path   = "timeweb-getssl-twcrc"
              }
            }

            volume {
              name = "store"
              persistent_volume_claim {
                claim_name = kubernetes_persistent_volume_claim_v1.certs_storage.metadata[0].name
              }
            }

            volume {
              name = "cert-configs"

              config_map {
                name = kubernetes_config_map_v1.custom_scripts.metadata.0.name

                dynamic items {
                  for_each = kubernetes_config_map_v1.config.data
                  content {
                    key  = items.key
                    path = items.key
                  }
                }
              }
            }

            volume {
              name = "twc-config"

              secret {
                secret_name = "timeweb-secrets"
                items {
                  key  = "getssl-twc-config"
                  path = "timeweb-getssl-twcrc"
                }
              }
            }
          }
        }
      }
    }
  }
}