provis

provis.hcl

server "nomad-client" {

  config {
    packages "yum" {
      additional_sources = [
        "epel-releases",
        "https://download.docker.com/linux/centos/docker-ce.repo"
      ]
    }
    services "systemctl" {}
    firewall "iptables" {}
    os "centos7" {
      hostname = "foobar"
      selinux  = "disabled"
      timezone = "UTC"
      env_vars {
        CONSUL_HTTP_ADDR = "http://127.0.0.1:8500"
      }
    }
  }

  artifacts {
    block "common" {
      package "yum-utils" {}
      package "unzip" {}
      package "libselinux-python" {}
      package "vim" {}
      package "tmux" {}
      package "htop" {}
      package "git" {}
      package "curl" {}
      package "mc" {}
      package "net-tools" {}
      package "noderig" { removed = true }
      service "firewalld" { enabled = false }
    }

    block "yum-cron" {
      package "yum-cron" {}
      file "/etc/yum/yum-cron.conf" {
        from = "yum-cron.conf"
        owner = "root"
        group = "root"
        permissions = 0644
      }
      service "yum-cron" {
        enabled = true
      }
    }

    block "unbound" {
      package "unbound" {}
      file "/etc/unbound/unbound.conf" {
        from = "unbound.conf"
      }
      file "/etc/resolv.conf" {
        content = "nameserver 127.0.0.1"
      }
      service "unbound" {
        enabled = true
      }
    }

    block "node_exporter" {
      file "/usr/local/bin/node_exporter" {
        from_url = "https://github.com/prometheus/node_exporter/releases/download/v0.18.1/node_exporter-0.18.1.linux-amd64.tar.gz"
        unarchive = true
        owner = "root"
        group = "root"
        permissions = 0644
      }
      user "node_exporter" {
        shell = "/bin/nologin"
        home  = ""
      }
      directory "/etc/node_exporter" {
        touch = true
        owner = "root"
        group = "root"
        permissions = 0644
      }
      file "/etc/systemd/system/node_exporter.service" {
        from = "node_exporter.service"
        owner = "root"
        group = "root"
        permissions = 0644
      }
      firewall "node_exporter" {
        port = 9100
        ips = [
          "144.76.235.93/16",
          "51.178.78.52",
        ]
      }
      service "node_exporter" {
        enabled = true
      }
    }

    block "docker" {
      package "yum-utils" {}
      package "device-mapper-persistent-data" {}
      package "lvm2" {}
      package "libselinux-python" {}
      package "docker-ce" {}
      package "docker-ce-cli" {}
      package "containerd.io" {}
      package "python-pip" {}

      file "/etc/docker/daemon.json" {
        from_path = "docker.json"
        owner = "root"
        group = "root"
        permissions = 0644
      }
      service "docker" {
        enabled = true
      }
    }

    block "consul" {
      file "/usr/local/bin/consul" {
        from      = https://releases.hashicorp.com/consul/1.9.5/consul_1.9.5_linux_amd64.zip
        unarchive = true
      }
      file "/etc/consul.d/config.json" {
        from     =
        template = true
        owner    = "consul"
        group    = "consul"
        mode     = 0400
      }
      user "consul" {
        shell = "/bin/nologin"
        home  = "/var/consul"
      }
      directory "/etc/consul.d/" {
        owner = "consul"
        group = "consul"
      }
      file "/etc/systemd/system/consul.service" {
        from_path = "consul.service"
        owner = "root"
        group = "root"
        permissions = 0644
      }
      service "consul" {
        enabled = true
      }
    }
  }
}