Configure Terraform

.gitignore

@@ -1,3 +1,8 @@
+.env
+
+
+# Terraform
+
 # Local .terraform directories
 .terraform/
 

terraform/dependencies.tf

@@ -0,0 +1,14 @@
+terraform {
+    required_version = "~> v1.14.7"
+
+    required_providers {
+      digitalocean = {
+        source = "digitalocean/digitalocean"
+        version = "~> 2.81.0"
+      }
+      random = {
+        source = "hashicorp/random"
+        version = "~> 3.8.1"
+      }
+    }
+}

terraform/domain.tf

@@ -0,0 +1,3 @@
+resource "digitalocean_domain" "main" {
+    name = var.domain_name
+}

terraform/kubernetes.tf

@@ -0,0 +1,20 @@
+data "digitalocean_kubernetes_versions" "current" {
+    version_prefix = var.k8s_version
+}
+
+resource "digitalocean_kubernetes_cluster" "main" {
+    name = var.cluster_name
+    region = var.region
+    version = data.digitalocean_kubernetes_versions.current.latest_version
+    vpc_uuid = digitalocean_vpc.main.id
+
+    auto_upgrade = false
+    surge_upgrade = true
+
+    node_pool {
+      name = "default"
+      size = var.node_size
+      node_count = var.node_count
+      labels = { role = "general" }
+    }
+}

terraform/outputs.tf

@@ -0,0 +1,45 @@
+output "kubeconfig" {
+    value = digitalocean_kubernetes_cluster.main.kube_config[0].raw_config
+    sensitive = true
+}
+
+
+output "postgres_host" {
+    value = digitalocean_database_cluster.postgres.private_host
+}
+
+output "postgres_port" {
+    value = digitalocean_database_cluster.postgres.port
+}
+
+output "postgres_user" {
+    value = digitalocean_database_user.gitlab.name
+}
+
+output "postgres_password" {
+    value = digitalocean_database_user.gitlab.password
+    sensitive = true
+}
+
+
+output "valkey_host" {
+    value = digitalocean_database_cluster.valkey.private_host
+}
+
+output "valkey_port" {
+    value = digitalocean_database_cluster.valkey.port
+}
+
+output "valkey_password" {
+    value = digitalocean_database_cluster.valkey.password
+    sensitive = true
+}
+
+
+output "spaces_endpoint" {
+    value = "${var.region}.digitaloceanspaces.com"
+}
+
+output "spaces_buckets" {
+    value = { for k, b in digitalocean_spaces_bucket.gitlab : k => b.name }
+}

terraform/postgres.tf

@@ -0,0 +1,27 @@
+resource "digitalocean_database_cluster" "postgres" {
+    name = "${var.cluster_name}-postgres"
+    engine = "pg"
+    version = 18
+    size = "db-s-1vcpu-1gb"
+    region = var.region
+    node_count = 1
+    private_network_uuid = digitalocean_vpc.main.id
+}
+
+resource "digitalocean_database_db" "gitlab" {
+    cluster_id = digitalocean_database_cluster.postgres.id
+    name = "gitlab_production"
+}
+
+resource "digitalocean_database_user" "gitlab" {
+    cluster_id = digitalocean_database_cluster.postgres.id
+    name = "gitlab"
+}
+
+resource "digitalocean_database_firewall" "postgres" {
+    cluster_id = digitalocean_database_cluster.postgres.id
+    rule {
+        type = "k8s"
+        value = digitalocean_kubernetes_cluster.main.id
+    }
+}

terraform/providers.tf

@@ -0,0 +1,5 @@
+provider "digitalocean" {
+    token = var.do_token
+    spaces_access_id = var.spaces_access_id
+    spaces_secret_key = var.spaces_secret_key
+}

terraform/spaces.tf

@@ -0,0 +1,18 @@
+locals {
+    spaces = toset([
+        "artifacts", "lfs", "uploads", "packages",
+        "registry", "backups", "tmp", "ci-secure-files",
+        "dependency-proxy", "terraform-state", "pages"
+    ])
+}
+
+resource "random_id" "suffix" {
+    byte_length = 3
+}
+
+resource "digitalocean_spaces_bucket" "gitlab" {
+    for_each = local.spaces
+    name = "${var.cluster_name}-${each.key}-${random_id.suffix.hex}"
+    region = var.region
+    acl = "private"
+}

terraform/valkey.tf

@@ -0,0 +1,18 @@
+resource "digitalocean_database_cluster" "valkey" {
+    name = "${var.cluster_name}-valkey"
+    engine = "valkey"
+    version = "8"
+    size = "db-s-1vcpu-1gb"
+    region = var.region
+    node_count = 1
+    private_network_uuid = digitalocean_vpc.main.id
+    eviction_policy = "noeviction"
+}
+
+resource "digitalocean_database_firewall" "valkey" {
+    cluster_id = digitalocean_database_cluster.valkey.id
+    rule {
+        type = "k8s"
+        value = digitalocean_kubernetes_cluster.main.id
+    }
+}

terraform/variables.tf

@@ -0,0 +1,54 @@
+variable "do_token" {
+    type = string
+    sensitive = true
+}
+
+variable "spaces_access_id" {
+    type = string
+    sensitive = true
+}
+
+variable "spaces_secret_key" {
+    type = string
+    sensitive = true
+}
+
+
+variable "region" {
+    type = string
+    default = "fra1"
+}
+
+variable "cluster_name" {
+    type = string
+    default = "gitlab"
+}
+
+variable "k8s_version" {
+    type = string
+    default = "1.35.1"
+}
+
+variable "node_size" {
+    type = string
+    default = "s-2vcpu-4gb"
+}
+
+variable "node_count" {
+    type = number
+    default = 2
+}
+
+variable "domain_name" {
+    type = string
+}
+
+variable "gitlab_host" {
+    type = string
+    default = "gitlab"
+}
+
+variable "registry_host" {
+    type = string
+    default = "registry"
+}

terraform/vpc.tf

@@ -0,0 +1,5 @@
+resource "digitalocean_vpc" "main" {
+    name = "${var.cluster_name}-vpc"
+    region = var.region
+    ip_range = "10.20.0.0/16"
+}