feat: infra - remove openobserve, add loki

2026-07-16 17:41:09 +02:00 · 2025-06-08 14:18:23 +08:00
parent 77ed0378d1
commit e12afe7cea
11 changed files with 139 additions and 105 deletions
@@ -0,0 +1,22 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/aminueza/minio" {
+  version     = "3.5.2"
+  constraints = "3.5.2"
+  hashes = [
+    "h1:3G/Q/dlf4ItE5tvE1zvSDUW4bYvwdCMVsHNAhMq9328=",
+    "zh:5513c7b20eac89b7bc27b1f762ff03058b4c75456523d5065c41be170fc1ce53",
+    "zh:597ec8ab8169ab4d044b7d442e65b03bbce2516c15f718510e8c80b5fc451be6",
+    "zh:608ff0eb5929b840c11efee1da0273b81d21a8149d8f2d259989597068b48253",
+    "zh:71bee58a6ba43d2a2aadd604c0e04f621fa67cb82ab3633fc5d1366689a5be6b",
+    "zh:9871556bcc3d5daab3cd8e302d1d07bc5693038e1abf8bd11aaf07a439d67a0b",
+    "zh:a3272fbb1ac7dff2481e778284709a5d8b85eda61f26239867eaed9ede57e90a",
+    "zh:a5048a378d5b075a6afac14197fc0fc57f97788cd697749621c07cec7156344c",
+    "zh:a8f28d070653cbd78ca85f9e54d9391a164828de598d481ed53d04882944dcb7",
+    "zh:cbf6895d80828f66fdaa234c6fcf87c329c41eb72391a6d29056b917bce65426",
+    "zh:cd48186b94cee7757a59f848dd6a2bd1d2faa76738a849261ca7cf14e7ca76c2",
+    "zh:cdefdf9bb591ab19c3176c7c8796762e2626ebde0d49971b49393f6bf28533ba",
+    "zh:ef16beff601be117a837cd47a1813be24ee0463d4f36a5d5f7e42a19d6c02b3d",
+  ]
+}
@@ -0,0 +1,3 @@
+# Buckets for Grafana Loki
+
+Store Log data.
@@ -0,0 +1,90 @@
+# ==============================================
+# Buckets
+# ==============================================
+
+resource "minio_s3_bucket" "k3s-test-1-loki-chunks" {
+  bucket = "k3s-test-1-loki-chunks"
+  acl    = "private"
+}
+
+resource "minio_s3_bucket" "k3s-test-1-loki-ruler" {
+  bucket = "k3s-test-1-loki-ruler"
+  acl    = "private"
+}
+
+resource "minio_s3_bucket" "k3s-test-1-loki-admin" {
+  bucket = "k3s-test-1-loki-admin"
+  acl    = "private"
+}
+
+# ==============================================
+# User & Permission
+# ==============================================
+
+
+resource "minio_iam_user" "loki" {
+  name          = "loki"
+  force_destroy = true
+  tags = {
+    env       = "prod"
+    managedBy = "terraform"
+  }
+}
+
+resource "minio_iam_service_account" "loki" {
+  target_user = minio_iam_user.loki.name
+}
+
+resource "minio_iam_policy" "loki" {
+  name   = "loki"
+  policy = <<EOF
+{
+  "Version":"2012-10-17",
+  "Statement": [
+    {
+      "Sid": "ObjectFullAccess",
+      "Action": [
+        "s3:PutObject",
+        "s3:GetObject",
+        "s3:ListBucket",
+        "s3:DeleteObject"
+      ],
+      "Effect": "Allow",
+      "Resource": [
+        "arn:aws:s3:::k3s-test-1-loki-chunks/*",
+        "arn:aws:s3:::k3s-test-1-loki-ruler/*",
+        "arn:aws:s3:::k3s-test-1-loki-admin/*"
+      ]
+    }
+  ]
+}
+EOF
+}
+
+resource "minio_iam_user_policy_attachment" "loki-1" {
+  user_name   = minio_iam_user.loki.id
+  policy_name = minio_iam_policy.loki.id
+}
+
+# ======================================================
+
+output "loki-chunks_url" {
+  value = minio_s3_bucket.k3s-test-1-loki-chunks.bucket_domain_name
+}
+
+output "loki-ruler_url" {
+  value = minio_s3_bucket.k3s-test-1-loki-ruler.bucket_domain_name
+}
+
+output "loki-admin_url" {
+  value = minio_s3_bucket.k3s-test-1-loki-admin.bucket_domain_name
+}
+
+output "loki_accesskey" {
+  value = minio_iam_service_account.loki.access_key
+}
+
+output "loki_secretkey" {
+  value     = minio_iam_service_account.loki.secret_key
+  sensitive = true
+}
@@ -0,0 +1,41 @@
+terraform {
+  # https://developer.hashicorp.com/terraform/language/settings/backends/s3#credentials-and-shared-configuration
+  backend "s3" {
+    bucket = "tf-s3-backend"
+    key    = "homelab/minio/terraform.tfstate"
+    region = "us-east-1"
+    endpoints = {
+      s3 = "https://minio.writefor.fun"
+    }
+
+    # pass access key & secret via:
+    # 1. env: AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
+    # 2. aws credential: ~/.aws/credentials
+    # access_key = ""
+    # secret_key = ""
+
+    # we're using minio, skip all aws related validation & checks
+    skip_credentials_validation = true
+    skip_metadata_api_check     = true
+    skip_region_validation      = true
+    skip_requesting_account_id  = true
+    use_path_style              = true
+  }
+
+  required_providers {
+    minio = {
+      source  = "aminueza/minio"
+      version = "3.5.2"
+    }
+  }
+}
+
+# https://registry.terraform.io/providers/aminueza/minio/latest/docs
+provider "minio" {
+  minio_server = "minio.writefor.fun"
+  minio_user   = "ryan"
+
+  minio_api_version = "v4"
+  minio_region      = "us-east-1"
+  minio_ssl         = true
+}
@@ -0,0 +1,16 @@
+# for provider
+#
+# export MINIO_PASSWORD="xxx"
+
+# for terraform's s3 backend
+#
+# export AWS_ACCESS_KEY_ID="xxx"
+# export AWS_SECRET_ACCESS_KEY="xxx"
+#
+terraform init
+terraform plan
+terraform apply
+
+# show secret key
+terraform output loki_secretkey
+