first commit

hosts/AZ-PRM-1/services/containers/kestra.nix

@@ -0,0 +1,38 @@
+{config, ...}: let
+  serviceName = "kestra";
+  servicePort = config.m3ta.ports.get serviceName;
+in {
+  virtualisation.oci-containers.containers."${serviceName}" = {
+    image = "docker.io/kestra/kestra:latest";
+    environmentFiles = [
+      config.age.secrets.kestra-env.path
+      config.age.secrets.kestra-secrets.path
+    ];
+    cmd = ["server" "standalone" "--config" "/etc/config/application.yaml"];
+    ports = ["127.0.0.1:${toString servicePort}:8080"];
+    user = "root";
+    volumes = [
+      "/var/run/podman/podman.sock:/var/run/docker.sock"
+      "${config.age.secrets.kestra-config.path}:/etc/config/application.yaml"
+      "kestra_data:/app/storage"
+      "/tmp/kestra-wd:/tmp/kestra-wd"
+    ];
+    extraOptions = ["--add-host=postgres:10.89.0.1" "--ip=10.89.0.12" "--network=web"];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /tmp/kestra-wd 0750 1000 1000 - -"
+  ];
+
+  # Traefik configuration specific to kestra
+  services.traefik.dynamicConfigOptions.http = {
+    services.kestra.loadBalancer.servers = [{url = "http://localhost:${toString servicePort}/";}];
+
+    routers.kestra = {
+      rule = "Host(`k.l.az-gruppe.com`)";
+      tls = {certResolver = "ionos";};
+      service = "kestra";
+      entrypoints = "websecure";
+    };
+  };
+}