bk node and refactor

config/services/systemd/common/alloy/config.alloy.j2

@@ -6,7 +6,7 @@
 //// Metric ouput
 prometheus.remote_write "prometheus" {
     endpoint {
-        url = "https://{{ services['prometheus']['domain'] }}.{{ domain['internal'] }}:{{ services['prometheus']['ports']['https'] }}/api/v1/write"
+        url = "https://{{ services['prometheus']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['prometheus']['ports']['https'] }}/api/v1/write"
     }
 }
 
@@ -71,8 +71,8 @@ prometheus.scrape "system" {
 ////// For Crowdsec metrics
 prometheus.scrape "crowdsec" {
     targets = [
-        { "__address__" = "{{ services['crowdsec']['domain'] }}.{{ domain['internal'] }}:6060", "job" = "crowdsec" },
-        { "__address__" = "{{ services['crowdsec']['domain'] }}.{{ domain['internal'] }}:60601", "job" = "crowdsec-bouncer" },
+        { "__address__" = "{{ services['crowdsec']['domain']['internal'] }}.{{ domain['internal'] }}:6060", "job" = "crowdsec" },
+        { "__address__" = "{{ services['crowdsec']['domain']['internal'] }}.{{ domain['internal'] }}:60601", "job" = "crowdsec-bouncer" },
     ]
     honor_labels = true
     forward_to = [prometheus.relabel.default_label.receiver]
@@ -83,7 +83,7 @@ prometheus.scrape "crowdsec" {
 ////// For postgresql metrics
 prometheus.exporter.postgres "postgresql" {
     data_source_names = [
-        "postgres://alloy@{{ services['postgresql']['domain'] }}.{{ domain['internal'] }}:{{ services['postgresql']['ports']['tcp'] }}/postgres?sslmode=verify-full",
+        "postgres://alloy@{{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['postgresql']['ports']['tcp'] }}/postgres?sslmode=verify-full",
     ]
 }
 prometheus.scrape "postgresql" {
@@ -99,7 +99,7 @@ prometheus.scrape "x509" {
 }
 {% endif %}
 
-{% if node['name'] in ['infra', 'auth', 'app'] %}
+{% if node['name'] in ["infra", "auth", "app"] %}
 ////// For Input Caddy metrics
 prometheus.scrape "caddy" {
     targets = [
@@ -114,7 +114,7 @@ prometheus.scrape "caddy" {
 //// Logs output
 loki.write "loki" {
     endpoint {
-        url = "https://{{ services['loki']['domain'] }}.{{ domain['internal'] }}:{{ services['loki']['ports']['https'] }}/loki/api/v1/push"
+        url = "https://{{ services['loki']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['loki']['ports']['https'] }}/loki/api/v1/push"
         tenant_id = "{{ domain['internal'] }}"
     }
 }

config/services/systemd/common/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml.j2

@@ -8,7 +8,7 @@ log_compression: true
 log_max_size: 100
 log_max_backups: 3
 log_max_age: 30
-api_url: "https://{{ services['crowdsec']['domain'] }}.{{ domain['internal'] }}:{{ services['crowdsec']['ports']['https'] }}"
+api_url: "https://{{ services['crowdsec']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['crowdsec']['ports']['https'] }}"
 api_key: "{{ hostvars['console']['crowdsec']['bouncer']['fw'] }}"
 insecure_skip_verify: false
 disable_ipv6: false

config/services/systemd/common/crowdsec/etc/local_api_credentials.yaml.j2

@@ -1,3 +1,3 @@
-url: https://{{ services['crowdsec']['domain'] }}.{{ domain['internal'] }}:{{ services['crowdsec']['ports']['https'] }}
+url: https://{{ services['crowdsec']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['crowdsec']['ports']['https'] }}
 login: {{ node['name'] }}
 password: {{ hostvars['console']['crowdsec']['machine'][node['name']] }}

config/services/systemd/common/kopia/kopia-backup.service.j2

@@ -28,8 +28,10 @@ BindPaths=/etc/secrets/{{ kopia_uid }}
 BindPaths=/var/cache/kopia
 EnvironmentFile=/etc/secrets/{{ kopia_uid }}/kopia.env
 
+ExecStartPre=/usr/bin/nc -zv {{ services['kopia']['domain']['internal'] }}.{{ domain['internal'] }} 443
+
 ExecStartPre=/usr/bin/kopia repository connect server \
-    --url=https://{{ services['kopia']['domain'] }}.{{ domain['internal'] }}:{{ services['kopia']['ports']['https'] }} \
+    --url=https://{{ services['kopia']['domain']['internal'] }}.{{ domain['internal'] }}:443 \
     --override-username={{ node['name'] }} \
     --override-hostname={{ node['name'] }}.{{ domain['internal'] }}
 

config/services/systemd/common/kopia/kopia-server.service.j2

@@ -0,0 +1,24 @@
+[Unit]
+Description=Kopia repository server
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+# logging
+StandardOutput=journal
+StandardError=journal
+
+EnvironmentFile=/etc/secrets/{{ node['uid'] }}/kopia.env
+
+ExecStartPre=/usr/bin/kopia repository connect filesystem \
+    --path={{ node['home_path'] }}/data/kopia/repository
+
+ExecStart=/usr/bin/kopia server start \
+    --no-ui \
+    --tls-cert-file=/etc/kopia/ssl/kopia.crt \
+    --tls-key-file=/etc/kopia/ssl/kopia.key \
+    --address=0.0.0.0:{{ services['kopia']['ports']['https'] }} \
+    --log-level=info
+
+[Install]
+WantedBy=default.target

config/services/systemd/common/kopia/kopia.env.j2

@@ -1,4 +1,8 @@
+{% if node['name'] == "bk" %}
+KOPIA_PASSWORD={{ hostvars['console']['kopia']['repository'] }}
+{% elif node['name'] in ["infra", "app"] %}
 KOPIA_PASSWORD={{ hostvars['console']['kopia']['users'][node['name']] }}
+{% endif %}
 KOPIA_CONFIG_PATH=/etc/kopia/repository.config
 KOPIA_CACHE_DIRECTORY=/var/cache/kopia
 KOPIA_LOG_DIR=/var/cache/kopia/logs