Skip to content

Commit 9ddeeb4

Browse files
supaPatricksupaPatrick
committed
feat: WIP envoy into the image
1 parent 9c7f846 commit 9ddeeb4

File tree

8 files changed

+185
-2
lines changed

8 files changed

+185
-2
lines changed

‎ansible/files/adminapi.sudoers.conf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ Cmnd_Alias KONG = /bin/systemctl start kong.service, /bin/systemctl stop kong.se
22
Cmnd_Alias POSTGREST = /bin/systemctl start postgrest.service, /bin/systemctl stop postgrest.service, /bin/systemctl restart postgrest.service, /bin/systemctl disable postgrest.service, /bin/systemctl enable postgrest.service
33
Cmnd_Alias GOTRUE = /bin/systemctl start gotrue.service, /bin/systemctl stop gotrue.service, /bin/systemctl restart gotrue.service, /bin/systemctl disable gotrue.service, /bin/systemctl enable gotrue.service
44
Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl stop pgbouncer.service, /bin/systemctl restart pgbouncer.service, /bin/systemctl disable pgbouncer.service, /bin/systemctl enable pgbouncer.service, /bin/systemctl reload pgbouncer.service
5+
Cmnd_Alias ENVOY = /bin/systemctl start envoy.service, /bin/systemctl stop envoy.service, /bin/systemctl restart envoy.service, /bin/systemctl disable envoy.service, /bin/systemctl enable envoy.service, /bin/systemctl reload envoy.service
56

67
%adminapi ALL= NOPASSWD: /root/grow_fs.sh
78
%adminapi ALL= NOPASSWD: /root/manage_readonly_mode.sh
@@ -24,3 +25,4 @@ Cmnd_Alias PGBOUNCER = /bin/systemctl start pgbouncer.service, /bin/systemctl st
2425
%adminapi ALL= NOPASSWD: POSTGREST
2526
%adminapi ALL= NOPASSWD: GOTRUE
2627
%adminapi ALL= NOPASSWD: PGBOUNCER
28+
%adminapi ALL= NOPASSWD: ENVOY

‎ansible/files/envoy_config/envoy.service.j2

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
Description=Envoy Proxy Server
2+
After=postgrest.service gotrue.service adminapi.service
3+
Wants=postgrest.service gotrue.service adminapi.service
4+
5+
[Service]
6+
Type=simple
7+
#ExecStart=/opt/envoy/envoy --config-path /opt/envoy/envoy.yml
8+
ExecStart=/usr/bin/bash -c '/opt/envoy/envoy --config-path /opt/envoy/envoy.yml'
9+
User=envoy
10+
11+
Slice=envoy.slice
12+
Restart=always
13+
RestartSec=3
14+
LimitNOFILE=100000
15+
16+
# The envoy user is unpriviledged and thus not permited to bind on ports < 1024
17+
# Via systemd we grant the process a set of priviledges to bind to 80/443
18+
# See http://archive.vn/36zJU
19+
AmbientCapabilities=CAP_NET_BIND_SERVICE
20+
21+
[Install]
22+
WantedBy=multi-user.target

‎ansible/files/envoy_config/envoy.yml

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
static_resources:
2+
listeners:
3+
- name: listener_0
4+
address:
5+
socket_address: { address: 0.0.0.0, port_value: 443 }
6+
filter_chains:
7+
- filters:
8+
- name: envoy.filters.network.http_connection_manager
9+
typed_config:
10+
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
11+
stat_prefix: ingress_http
12+
codec_type: AUTO
13+
route_config:
14+
name: local_route
15+
virtual_hosts:
16+
- name: local_service
17+
domains: ["*"]
18+
routes:
19+
- match:
20+
prefix: "/health"
21+
direct_response:
22+
status: 200
23+
body:
24+
inline_string: "Healthy"
25+
- match:
26+
prefix: "/rest/v1/"
27+
headers:
28+
- name: apikey
29+
string_match:
30+
exact: '{{ supabase-api-key-2020-07-28 }}'
31+
route:
32+
cluster: rest
33+
prefix_rewrite: "/"
34+
- match:
35+
prefix: "/auth/v1/admin/"
36+
headers:
37+
- name: apikey
38+
string_match:
39+
exact: '{{ supabase-api-key-2020-07-28 }}'
40+
route:
41+
cluster: gotrue
42+
prefix_rewrite: "/"
43+
- match:
44+
prefix: "/auth/v1/"
45+
route:
46+
cluster: gotrue
47+
prefix_rewrite: "/"
48+
- match:
49+
prefix: "/pg/"
50+
headers:
51+
- name: apikey
52+
string_match:
53+
exact: '{{ supabase-api-key-2020-07-28 }}'
54+
route:
55+
cluster: pg-v1
56+
prefix_rewrite: "/"
57+
http_filters:
58+
- name: envoy.filters.http.router
59+
typed_config:
60+
"@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
61+
62+
clusters:
63+
- name: gotrue
64+
connect_timeout: 0.25s
65+
type: STATIC
66+
lb_policy: ROUND_ROBIN
67+
load_assignment:
68+
cluster_name: gotrue
69+
endpoints:
70+
- lb_endpoints:
71+
- endpoint:
72+
address:
73+
socket_address:
74+
address: 127.0.0.1
75+
port_value: 9998
76+
77+
- name: rest
78+
connect_timeout: 0.25s
79+
type: STATIC
80+
lb_policy: ROUND_ROBIN
81+
load_assignment:
82+
cluster_name: rest
83+
endpoints:
84+
- lb_endpoints:
85+
- endpoint:
86+
address:
87+
socket_address:
88+
address: 127.0.0.1
89+
port_value: 3000
90+
91+
- name: pg-v1
92+
connect_timeout: 0.25s
93+
type: STATIC
94+
lb_policy: ROUND_ROBIN
95+
load_assignment:
96+
cluster_name: pg-v1
97+
endpoints:
98+
- lb_endpoints:
99+
- endpoint:
100+
address:
101+
socket_address:
102+
address: 127.0.0.1
103+
port_value: 1337

‎ansible/playbook.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,11 @@
5656
tags:
5757
- install-supabase-internal
5858

59+
- name: Install Envoy
60+
import_tasks: tasks/setup-envoy.yml
61+
tags:
62+
- install-supabase-internal
63+
5964
- name: Install nginx
6065
import_tasks: tasks/setup-nginx.yml
6166
tags:

‎ansible/tasks/internal/admin-api.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
- name: adminapi - system user
22
user:
33
name: adminapi
4-
groups: root,admin,kong,pgbouncer,postgres,postgrest,systemd-journal,wal-g
4+
groups: root,admin,kong,envoy,pgbouncer,postgres,postgrest,systemd-journal,wal-g
55
append: yes
66

77
- name: Move shell scripts to /root dir

‎ansible/tasks/setup-envoy.yml

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
- name: Envoy - system user
2+
user: name=envoy
3+
4+
- name: envoy - create /opt/envoy
5+
file:
6+
path: /opt/envoy
7+
state: directory
8+
owner: envoy
9+
mode: 0775
10+
11+
- name: Envoy - download binary
12+
get_url:
13+
url: "https://github.com/envoyproxy/envoy/releases/download/v{{ envoy_release }}/envoy-{{ envoy_release }}-linux-aarch_64"
14+
dest: /opt/envoy/envoy
15+
checksum: "{{ envoy_release_checksum }}"
16+
17+
- name: Envoy - add execution bit to binary
18+
file:
19+
path: /opt/envoy/envoy
20+
state: file
21+
owner: envoy
22+
mode: u+rwx
23+
24+
- name: Envoy - copy basic conf
25+
copy:
26+
src: files/envoy_config/envoy.yml
27+
dest: /opt/envoy/envoy.yml
28+
29+
# [warn] ulimit is currently set to "1024". For better performance set it to at least
30+
# "4096" using "ulimit -n"
31+
- name: Envoy - bump up ulimit
32+
pam_limits:
33+
limit_item: nofile
34+
limit_type: soft
35+
domain: envoy
36+
value: "4096"
37+
38+
- name: Envoy - create service file
39+
template:
40+
src: files/envoy_config/envoy.service.j2
41+
dest: /etc/systemd/system/envoy.service
42+
43+
- name: Envoy - disable service
44+
systemd:
45+
enabled: no
46+
name: envoy
47+
state: stopped
48+
daemon_reload: yes

‎ansible/vars.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,9 @@ kong_release_target: focal # if it works, it works
2828
kong_deb: kong_2.8.1_arm64.deb
2929
kong_deb_checksum: sha1:2086f6ccf8454fe64435252fea4d29d736d7ec61
3030

31+
envoy_release: "1.26.0"
32+
envoy_release_checksum: sha1:57d5bb8bfbc66d7ba4705b98ddab9ddebc069708
33+
3134
nginx_release: 1.22.0
3235
nginx_release_checksum: sha1:419efb77b80f165666e2ee406ad8ae9b845aba93
3336

‎common.vars.pkr.hcl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
postgres-version = "15.1.0.115"
1+
postgres-version = "15.1.0.115-envoy-rc9"

0 commit comments

Comments
 (0)