feat: organize all services into separate stacks by dependency

utils/1password-secret/index.ts

@@ -0,0 +1,36 @@
+import { Construct } from "constructs";
+import { Manifest } from "@cdktf/provider-kubernetes/lib/manifest";
+import { KubernetesProvider } from "@cdktf/provider-kubernetes/lib/provider";
+
+type SecretOptions = {
+  provider: KubernetesProvider;
+  namespace: string;
+  name: string;
+  itemPath: string;
+};
+
+export class OnePasswordSecret extends Construct {
+  constructor(scope: Construct, id: string, options: SecretOptions) {
+    super(scope, id);
+
+    const { itemPath, name, namespace, provider } = options;
+
+    new Manifest(this, name, {
+      provider,
+      manifest: {
+        apiVersion: "onepassword.com/v1",
+        kind: "OnePasswordItem",
+        metadata: {
+          name,
+          namespace,
+          annotations: {
+            "operator.1password.io/auto-restart": "true",
+          },
+        },
+        spec: {
+          itemPath,
+        },
+      },
+    });
+  }
+}

utils/cert-manager/index.ts

@@ -0,0 +1,85 @@
+import { Construct } from "constructs";
+import { Manifest } from "@cdktf/provider-kubernetes/lib/manifest";
+import { KubernetesProvider } from "@cdktf/provider-kubernetes/lib/provider";
+
+export interface CertificateOptions {
+  provider: KubernetesProvider;
+
+  /** Namespace to create the Certificate in */
+  namespace: string;
+
+  /** Required name of the certificate (and CRD name) */
+  name: string;
+
+  /** Secret name for storing the issued TLS cert */
+  secretName: string;
+
+  /** One or more DNS names the certificate should cover */
+  dnsNames: string[];
+
+  /** Reference to the cert-manager issuer */
+  issuerRef: {
+    name: string;
+    kind?: string; // ClusterIssuer or Issuer
+  };
+
+  /** Optional duration (default: cert-manager default) */
+  duration?: string;
+
+  /** Optional renewBefore (default: cert-manager default) */
+  renewBefore?: string;
+}
+
+class Certificate extends Construct {
+  public readonly manifest: Manifest;
+
+  constructor(scope: Construct, id: string, opts: CertificateOptions) {
+    super(scope, id);
+
+    const manifest: any = {
+      apiVersion: "cert-manager.io/v1",
+      kind: "Certificate",
+      metadata: {
+        name: opts.name,
+        namespace: opts.namespace,
+      },
+      spec: {
+        secretName: opts.secretName,
+        dnsNames: opts.dnsNames,
+        issuerRef: {
+          name: opts.issuerRef.name,
+          kind: opts.issuerRef.kind ?? "ClusterIssuer",
+        },
+      },
+    };
+
+    if (opts.duration) {
+      manifest.spec.duration = opts.duration;
+    }
+
+    if (opts.renewBefore) {
+      manifest.spec.renewBefore = opts.renewBefore;
+    }
+
+    this.manifest = new Manifest(this, id, {
+      provider: opts.provider,
+      manifest,
+    });
+  }
+}
+
+export class CloudflareCertificate extends Certificate {
+  constructor(
+    scope: Construct,
+    id: string,
+    opts: Omit<CertificateOptions, "issuerRef">,
+  ) {
+    super(scope, id, {
+      ...opts,
+      issuerRef: {
+        name: "cloudflare-issuer",
+        kind: "ClusterIssuer",
+      },
+    });
+  }
+}

utils/index.ts

@@ -0,0 +1,3 @@
+export { CloudflareCertificate } from "./cert-manager";
+export { OnePasswordSecret } from "./1password-secret";
+export { IngressRoute } from "./traefik";

utils/traefik/index.ts

@@ -0,0 +1,2 @@
+export { IngressRoute } from "./ingress";
+export { IngressRouteTcp } from "./ingress-tcp";

utils/traefik/ingress-tcp.ts

@@ -0,0 +1,71 @@
+import { Construct } from "constructs";
+import { Manifest } from "@cdktf/provider-kubernetes/lib/manifest";
+import { KubernetesProvider } from "@cdktf/provider-kubernetes/lib/provider";
+
+export interface IngressRouteTcpOptions {
+  provider: KubernetesProvider;
+
+  /** Namespace where the IngressRouteTCP will be created */
+  namespace: string;
+
+  /** EntryPoint name (e.g., "ssh", "mc25565", "postgres", etc.) */
+  entryPoint: string;
+
+  /** Backend service name */
+  serviceName: string;
+
+  /** Backend service port */
+  servicePort: number;
+
+  /**
+   * Match rule.
+   * Default is `HostSNI(\`*\`)` which is correct for most TCP services.
+   */
+  match?: string;
+
+  /** Name override (CR name) */
+  name?: string;
+}
+
+export class IngressRouteTcp extends Construct {
+  public readonly manifest: Manifest;
+
+  constructor(scope: Construct, id: string, opts: IngressRouteTcpOptions) {
+    super(scope, id);
+
+    const name =
+      opts.name ??
+      `tcp-${opts.entryPoint}-${opts.serviceName}`.replace(
+        /[^a-zA-Z0-9-]/g,
+        "",
+      );
+
+    const matchRule = opts.match ?? "HostSNI(`*`)";
+
+    this.manifest = new Manifest(this, name, {
+      provider: opts.provider,
+      manifest: {
+        apiVersion: "traefik.io/v1alpha1",
+        kind: "IngressRouteTCP",
+        metadata: {
+          name,
+          namespace: opts.namespace,
+        },
+        spec: {
+          entryPoints: [opts.entryPoint],
+          routes: [
+            {
+              match: matchRule,
+              services: [
+                {
+                  name: opts.serviceName,
+                  port: opts.servicePort,
+                },
+              ],
+            },
+          ],
+        },
+      },
+    });
+  }
+}

utils/traefik/ingress.ts

@@ -0,0 +1,94 @@
+import { Construct } from "constructs";
+import { Manifest } from "@cdktf/provider-kubernetes/lib/manifest";
+import { KubernetesProvider } from "@cdktf/provider-kubernetes/lib/provider";
+
+import { CloudflareCertificate } from "../cert-manager";
+
+export interface IngressRouteOptions {
+  provider: KubernetesProvider;
+  namespace: string;
+
+  /** Hostname for this route (e.g. npm.dogar.dev) */
+  host: string;
+
+  /** Path prefix (default: "/") */
+  path?: string;
+
+  /** Backend K8s Service */
+  serviceName: string;
+  servicePort: number;
+
+  /** EntryPoints (default: ["websecure"]) */
+  entryPoints?: string[];
+
+  /** TLS secret name for HTTPS termination */
+  tlsSecretName?: string;
+
+  /** Extra middlewares (traefik format: namespace/name) */
+  middlewares?: string[];
+
+  /** Name override (otherwise auto) */
+  name?: string;
+}
+
+export class IngressRoute extends Construct {
+  public readonly manifest: Manifest;
+
+  constructor(scope: Construct, id: string, opts: IngressRouteOptions) {
+    super(scope, id);
+
+    const name = opts.name ?? `route-${opts.host.replace(/\./g, "-")}`;
+    const path = opts.path ?? "/";
+    const entryPoints = opts.entryPoints ?? ["websecure"];
+
+    const route: any = {
+      match: `Host(\`${opts.host}\`) && PathPrefix(\`${path}\`)`,
+      kind: "Rule",
+      services: [
+        {
+          name: opts.serviceName,
+          port: opts.servicePort,
+        },
+      ],
+    };
+
+    if (opts.middlewares?.length) {
+      route.middlewares = opts.middlewares.map((mw) => {
+        const [namespace, name] = mw.split("/");
+        return { name, namespace };
+      });
+    }
+
+    const spec: any = {
+      entryPoints,
+      routes: [route],
+    };
+
+    if (opts.tlsSecretName) {
+      spec.tls = {
+        secretName: opts.tlsSecretName,
+      };
+
+      new CloudflareCertificate(this, `${name}-cert`, {
+        provider: opts.provider,
+        namespace: opts.namespace,
+        name: opts.host,
+        secretName: opts.tlsSecretName,
+        dnsNames: [opts.host],
+      });
+    }
+
+    this.manifest = new Manifest(this, name, {
+      provider: opts.provider,
+      manifest: {
+        apiVersion: "traefik.io/v1alpha1",
+        kind: "IngressRoute",
+        metadata: {
+          name,
+          namespace: opts.namespace,
+        },
+        spec,
+      },
+    });
+  }
+}