nomad

commit c98f3aa57712b06d293842632dc2119341622587
parent de0e8fef66fa224bdb301ff0a3dbb2faa5b509db
Author: Andreas Gruhler <agruhl@gmx.ch>
Date:   Thu, 28 Aug 2025 00:57:29 +0200

feat: add webssh

Diffstat:
A
hcl/default/webssh/templates/nginx.conf.tmpl
 | 
29
+++++++++++++++++++++++++++++
A
hcl/default/webssh/webssh.nomad
 | 
73
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 files changed, 102 insertions(+), 0 deletions(-)
diff --git a/hcl/default/webssh/templates/nginx.conf.tmpl b/hcl/default/webssh/templates/nginx.conf.tmpl
@@ -0,0 +1,29 @@
+# https://github.com/huashengdun/webssh/blob/master/README.md#deployment
+server {
+    listen               {{ env "NOMAD_PORT_https" }} ssl;
+
+    ssl_certificate      /etc/letsencrypt/live/ssh.in0rdr.ch/fullchain.pem;
+    ssl_certificate_key  /etc/letsencrypt/live/ssh.in0rdr.ch/privkey.pem;
+
+    location / {
+        proxy_pass       http://{{ env "NOMAD_ADDR_http" }};
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /ws {
+        proxy_pass       http://{{ env "NOMAD_ADDR_http" }};
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket proxying
+        # https://nginx.org/en/docs/http/websocket.html
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}
diff --git a/hcl/default/webssh/webssh.nomad b/hcl/default/webssh/webssh.nomad
@@ -0,0 +1,73 @@
+# https://github.com/huashengdun/webssh/blob/master/README.md#deployment
+
+job "webssh" {
+  datacenters = ["dc1"]
+
+  vault {}
+
+  group "server" {
+    count = 1
+
+    volume "tls" {
+      type = "csi"
+      source = "certbot"
+      access_mode = "multi-node-multi-writer"
+      attachment_mode = "file-system"
+    }
+
+    network {
+      port "http" {
+      }
+      port "https" {
+        static = 44414
+      }
+    }
+
+    task "nginx" {
+      driver = "podman"
+
+      config {
+        image = "docker.io/library/nginx:stable-alpine"
+        ports = ["https"]
+        volumes = [
+          # mount the templated config from the task directory to the container
+          "local/webssh.conf:/etc/nginx/conf.d/webssh.conf",
+        ]
+      }
+
+      volume_mount {
+        volume = "tls"
+        destination = "/etc/letsencrypt"
+      }
+
+      template {
+        destination = "${NOMAD_TASK_DIR}/webssh.conf"
+        data = file("./templates/nginx.conf.tmpl")
+      }
+
+      resources {
+        memory = 50
+        memory_max = 256
+        cpu    = 200
+      }
+    }
+
+    task "webssh" {
+      driver = "podman"
+
+      config {
+        image = "haproxy.lan:5000/webssh:latest"
+        command = "/usr/local/bin/python3"
+        args = ["run.py", "--address=0.0.0.0", "--port=${NOMAD_PORT_http}"]
+        force_pull = true
+        ports = ["http"]
+      }
+
+      resources {
+        memory = 512
+        memory_max = 1024
+        cpu    = 500
+      }
+    }
+  }
+}