155 lines
4.9 KiB
Markdown
155 lines
4.9 KiB
Markdown
# HashiCorp Stack - hobbs.farm
|
|
|
|
## Overview
|
|
|
|
Production HashiCorp stack providing container orchestration, service discovery, and secrets management across the hobbs.farm infrastructure.
|
|
|
|
## Cluster Architecture
|
|
|
|
```
|
|
┌─────────────────────────────────────────────────────────────────────┐
|
|
│ hobbs.farm Cluster │
|
|
├────────────────────────────────┬────────────────────────────────────┤
|
|
│ hf-pdocker-01 │ hf-pdocker-02 │
|
|
│ 192.168.86.192 │ 192.168.86.45 │
|
|
│ (Primary) │ (Legacy) │
|
|
├────────────────────────────────┼────────────────────────────────────┤
|
|
│ Consul Server (Leader) │ Consul Client │
|
|
│ Nomad Server │ Nomad Client │
|
|
│ Nomad Client │ node_class: legacy │
|
|
│ Vault Server │ meta: disk_status=failing │
|
|
└────────────────────────────────┴────────────────────────────────────┘
|
|
```
|
|
|
|
## Services
|
|
|
|
| Service | Version | Port | Primary URL | Notes |
|
|
|---------|---------|------|-------------|-------|
|
|
| Consul | 1.17.1 | 8500 | http://192.168.86.192:8500 | Service discovery, KV store |
|
|
| Nomad | 1.7.3 | 4646 | http://192.168.86.192:4646 | Container orchestration |
|
|
| Vault | 1.15.4 | 8200 | http://192.168.86.192:8200 | Secrets management |
|
|
|
|
## Deployed Jobs
|
|
|
|
### media-stack (service)
|
|
| Service | Port | Health | URL |
|
|
|---------|------|--------|-----|
|
|
| Jellyfin | 8096 | ✅ | http://192.168.86.192:8096 |
|
|
| Sonarr | 8989 | ✅ | http://192.168.86.192:8989 |
|
|
| Radarr | 7878 | ✅ | http://192.168.86.192:7878 |
|
|
| SABnzbd | 8082 | ✅ | http://192.168.86.192:8082 |
|
|
| NZBHydra2 | 5076 | ✅ | http://192.168.86.192:5076 |
|
|
| Jellyseerr | 5055 | ✅ | http://192.168.86.192:5055 |
|
|
|
|
### traefik (system)
|
|
| Service | Port | Health | URL |
|
|
|---------|------|--------|-----|
|
|
| HTTP | 80 | ✅ | Redirects to HTTPS |
|
|
| HTTPS | 443 | ✅ | Reverse proxy |
|
|
| Dashboard | 8088 | ✅ | http://192.168.86.192:8088 |
|
|
|
|
## Host Volumes (hf-pdocker-01)
|
|
|
|
| Volume | Path | Purpose |
|
|
|--------|------|---------|
|
|
| media | /data/media | Movies, TV, downloads |
|
|
| jellyfin-config | /data/configs/jellyfin | Jellyfin configuration |
|
|
| sonarr-config | /data/configs/sonarr | Sonarr configuration |
|
|
| radarr-config | /data/configs/radarr | Radarr configuration |
|
|
| sabnzbd-config | /data/configs/sabnzbd | SABnzbd configuration |
|
|
| nzbhydra-config | /data/configs/nzbhydra | NZBHydra2 configuration |
|
|
| jellyseerr-config | /data/configs/jellyseerr | Jellyseerr configuration |
|
|
| traefik-data | /data/traefik | Traefik certs & config |
|
|
|
|
## Vault Secrets
|
|
|
|
```
|
|
secret/
|
|
├── media/
|
|
│ ├── jellyfin
|
|
│ ├── sonarr
|
|
│ ├── radarr
|
|
│ ├── sabnzbd
|
|
│ ├── nzbhydra
|
|
│ └── jellyseerr
|
|
└── traefik/
|
|
└── cloudflare (email, api_token)
|
|
```
|
|
|
|
## Configuration Files
|
|
|
|
### hf-pdocker-01 (Server)
|
|
| Service | Config Path |
|
|
|---------|-------------|
|
|
| Consul | /etc/consul.d/consul.hcl |
|
|
| Nomad | /etc/nomad.d/nomad.hcl, client.hcl |
|
|
| Vault | /etc/vault.d/vault.hcl |
|
|
|
|
### hf-pdocker-02 (Client)
|
|
| Service | Config Path |
|
|
|---------|-------------|
|
|
| Consul | /etc/consul.d/consul.hcl |
|
|
| Nomad | /etc/nomad.d/nomad.hcl, client.hcl |
|
|
|
|
## Operations
|
|
|
|
### Check Cluster Health
|
|
```bash
|
|
# Consul cluster
|
|
consul members
|
|
|
|
# Nomad cluster
|
|
nomad server members
|
|
nomad node status
|
|
|
|
# Vault status
|
|
vault status
|
|
```
|
|
|
|
### Job Management
|
|
```bash
|
|
# Deploy job
|
|
nomad job run <job.hcl>
|
|
|
|
# Check job status
|
|
nomad job status <job-name>
|
|
|
|
# View allocations
|
|
nomad job allocs <job-name>
|
|
|
|
# View logs
|
|
nomad alloc logs <alloc-id> <task-name>
|
|
|
|
# Stop job
|
|
nomad job stop <job-name>
|
|
```
|
|
|
|
### Service Restarts
|
|
```bash
|
|
# On hf-pdocker-01
|
|
systemctl restart consul nomad vault
|
|
|
|
# On hf-pdocker-02
|
|
systemctl restart consul nomad
|
|
```
|
|
|
|
## IaC Repository
|
|
|
|
All job specifications are stored in Gitea:
|
|
- **Repo:** `jeremy/ansible-homelab`
|
|
- **Path:** `nomad-jobs/`
|
|
- `media-stack.nomad.hcl`
|
|
- `traefik.nomad.hcl`
|
|
|
|
## Security Notes
|
|
|
|
- Vault root token stored in `/tmp/vault-init.json` on hf-pdocker-01 (move to secure location)
|
|
- Consul encryption enabled with shared key
|
|
- mTLS not configured (internal network only)
|
|
- Cloudflare API token in Vault for Let's Encrypt DNS challenge
|
|
|
|
---
|
|
|
|
*Last Updated: 2026-02-04*
|
|
*Maintained by: Pluto 🪐*
|