first commit

hosts/AZ-PRM-1/services/containers/default.nix

@@ -0,0 +1,15 @@
+{lib, ...}: {
+  imports = [
+    #./baserow.nix
+    ./kestra.nix
+    ./stirling-pdf.nix
+  ];
+  system.activationScripts.createPodmanNetworkWeb = lib.mkAfter ''
+    if ! /run/current-system/sw/bin/podman network exists web; then
+      /run/current-system/sw/bin/podman network create web --subnet=10.89.0.0/24 --internal
+    fi
+    if ! /run/current-system/sw/bin/podman network exists web-dev; then
+      /run/current-system/sw/bin/podman network create web-dev --subnet=10.89.1.0/24 --internal
+    fi
+  '';
+}

hosts/AZ-PRM-1/services/containers/kestra.nix

@@ -0,0 +1,38 @@
+{config, ...}: let
+  serviceName = "kestra";
+  servicePort = config.m3ta.ports.get serviceName;
+in {
+  virtualisation.oci-containers.containers."${serviceName}" = {
+    image = "docker.io/kestra/kestra:latest";
+    environmentFiles = [
+      config.age.secrets.kestra-env.path
+      config.age.secrets.kestra-secrets.path
+    ];
+    cmd = ["server" "standalone" "--config" "/etc/config/application.yaml"];
+    ports = ["127.0.0.1:${toString servicePort}:8080"];
+    user = "root";
+    volumes = [
+      "/var/run/podman/podman.sock:/var/run/docker.sock"
+      "${config.age.secrets.kestra-config.path}:/etc/config/application.yaml"
+      "kestra_data:/app/storage"
+      "/tmp/kestra-wd:/tmp/kestra-wd"
+    ];
+    extraOptions = ["--add-host=postgres:10.89.0.1" "--ip=10.89.0.12" "--network=web"];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /tmp/kestra-wd 0750 1000 1000 - -"
+  ];
+
+  # Traefik configuration specific to kestra
+  services.traefik.dynamicConfigOptions.http = {
+    services.kestra.loadBalancer.servers = [{url = "http://localhost:${toString servicePort}/";}];
+
+    routers.kestra = {
+      rule = "Host(`k.l.az-gruppe.com`)";
+      tls = {certResolver = "ionos";};
+      service = "kestra";
+      entrypoints = "websecure";
+    };
+  };
+}

hosts/AZ-PRM-1/services/containers/stirling-pdf.nix

@@ -0,0 +1,30 @@
+{config, ...}: let
+  serviceName = "stirling-pdf";
+  servicePort = config.m3ta.ports.get serviceName;
+in {
+  virtualisation.oci-containers.containers."${serviceName}" = {
+    image = "docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest-fat";
+    ports = ["127.0.0.1:${toString servicePort}:8080"];
+    environment = {
+      SECURITY_ENABLELOGIN = "False";
+      DISABLE_ADDITIONAL_FEATURES = "False";
+    };
+
+    volumes = [
+      "stirling_pdf_data:/usr/share/tessdata"
+      "stirling_pdf_configs:/configs"
+    ];
+    extraOptions = ["--ip=10.89.0.13" "--network=web"];
+  };
+
+  services.traefik.dynamicConfigOptions.http = {
+    services.${serviceName}.loadBalancer.servers = [{url = "http://localhost:${toString servicePort}/";}];
+
+    routers.${serviceName} = {
+      rule = "Host(`pdf.l.az-gruppe.com`)";
+      tls = {certResolver = "ionos";};
+      service = serviceName;
+      entrypoints = "websecure";
+    };
+  };
+}