mariadb/mariadb.nomad.hcl

[[- $c := merge .mariadb.server . -]]
job [[ .instance | toJSON ]] {

[[ template "common/job_start" $c ]]

  group "server" {

    network {
      mode = "bridge"
    }

    volume "mariadb" {
      type            = [[ .mariadb.volumes.data.type | toJSON ]]
      source          = [[ .mariadb.volumes.data.source | toJSON ]]
      access_mode     = "single-node-writer"
      attachment_mode = "file-system"
      per_alloc       = true
    }

    service {
      name = "[[ .instance ]][[ $c.consul.suffix ]]"
      port = 3306

[[ template "common/connect" $c ]]

      check {
        name     = "alive"
        type     = "script"
        task     = "mariadb"
        command  = "mysqladmin"
        args     = [
          "ping"
        ]
        timeout  = "10s"
        interval = "5s"
      }

[[- if $c.traefik.enabled ]]
      tags = [
        "[[ $c.traefik.instance ]].enable=true",
        "[[ $c.traefik.instance ]].tcp.routers.[[ .instance ]][[ $c.consul.suffix ]].rule=HostSNI(`*`)",
        "[[ $c.traefik.instance ]].tcp.routers.[[ .instance ]][[ $c.consul.suffix ]].entrypoints=[[ join $c.traefik.entrypoints "," ]]",
        "[[ $c.traefik.instance ]].tcp.routers.[[ .instance ]][[ $c.consul.suffix ]].middlewares=[[ join $c.traefik.middlewares "," ]]"
      ]
[[- end ]]
    }

    # Run mysql_upgrade
    task "upgrade" {
      driver = [[ $c.nomad.driver | toJSON ]]

      lifecycle {
        hook = "poststart"
      }

      config {
        image = [[ .mariadb.server.image | toJSON ]]
        pids_limit = 100
        command = "/local/mysql_upgrade.sh"
      }

      vault {
        policies     = ["[[ .instance ]][[ .consul.suffix ]]"]
        env          = false
        disable_file = true
      }

      template {
        data = <<_EOT
[client]
user = root
host = 127.0.0.1
password = {{ with secret "[[ .vault.prefix ]]kv/service/[[ .instance ]]" }}{{ .Data.data.root_pwd }}{{ end }}
_EOT
        destination = "secrets/.my.cnf"
        uid = 100100
        gid = 100101
        perms = 640
      }

      template {
        data        = <<_EOT
[[ template "mariadb/mysql_upgrade.sh.tpl" $c ]]
_EOT
        destination = "local/mysql_upgrade.sh"
        perms       = 755
      }

      volume_mount {
        volume      = "mariadb"
        destination = "/data"
      }

      resources {
        cpu = 10
        memory = 32
        memory_max = 64
      }
    }

    task "mariadb" {
      driver = [[ $c.nomad.driver | toJSON ]]
      leader = true

      kill_timeout = "5m"

      config {
        image      = [[ .mariadb.server.image | toJSON ]]
        volumes    = [
          "secrets/:/etc/my.cnf.d",
          "secrets/my.conf:/var/lib/mysql/.my.cnf:ro",
        ]
        pids_limit = 300
        #readonly_rootfs = true
      }

      vault {
        policies     = ["[[ .instance ]][[ .consul.suffix ]]"]
        env          = false
        disable_file = true
      }

      env {
        MYSQL_CONF_11_bind-address = "127.0.0.1"
[[ template "common/env" $c.env ]]
      }

      template {
        data = <<_EOT
{{ with secret "[[ .vault.prefix ]]kv/service/[[ .instance ]]" }}
MYSQL_ROOT_PASSWORD={{ .Data.data.root_pwd }}
{{ end }}
_EOT
        destination = "secrets/mariadb.env"
        uid         = 100000
        gid         = 100000
        perms       = 400
        env         = true
      }

      template {
        data = <<_EOT
[client]
user = root
password = {{ with secret "[[ .vault.prefix ]]kv/service/[[ .instance ]]" }}{{ .Data.data.root_pwd }}{{ end }}
_EOT
        destination = "secrets/my.conf"
        uid = 100100
        gid = 100101
        perms = 640
      }

      volume_mount {
        volume      = "mariadb"
        destination = "/data"
      }

[[ template "common/resources" .mariadb.server.resources ]]

    }
  }

[[- if .mariadb.backup.dumps.enabled ]]
[[- $c := merge .mariadb.backup . ]]

  group "backup" {
    network {
      mode = "bridge"
    }

    volume "backup" {
      type            = [[ .mariadb.volumes.backup.type | toJSON ]]
      source          = [[ .mariadb.volumes.backup.source | toJSON ]]
      access_mode     = "multi-node-multi-writer"
      attachment_mode = "file-system"
    }

    service {
      name = "[[ .instance ]]-backup[[ $c.consul.suffix ]]"
[[ template "common/connect" $c ]]
    }

[[ template "common/task.wait_for" $c ]]

    task "backup" {
      driver = [[ $c.nomad.driver | toJSON ]]

      config {
        image = [[ .mariadb.backup.image | toJSON ]]
        pids_limit = 100
        readonly_rootfs = true
        command = "supercronic"
        args = [
          "/secrets/backup.cron"
        ]
      }

      vault {
        policies = ["[[ .instance ]][[ $c.consul.suffix ]]"]
        env = false
        disable_file = true
      }

      template {
        data = <<_EOT
[client]
user = root
host = 127.0.0.1
password = {{ with secret "[[ .vault.prefix ]]kv/service/[[ .instance ]]" }}{{ .Data.data.root_pwd }}{{ end }}
_EOT
        destination = "secrets/.my.cnf"
        uid = 100000
        gid = 100000
        perms = 400
      }

      template {
        data =<<_EOT
[[ template "mariadb/dump.sh.tpl" $c ]]
_EOT
        destination = "local/dump.sh"
        perms = 755
      }

      template {
        data =<<_EOT
[[ template "mariadb/backup.cron.tpl" $c ]]
_EOT
        destination = "secrets/backup.cron"
      }

      volume_mount {
        volume      = "backup"
        destination = "/backup"
      }

[[ template "common/resources" .mariadb.backup.resources ]]

    }
  }
[[- end ]]
}